Solo Developer Arsenal Compliance Attestation Report

69%

Not Production Ready

Recommendation: Deploy after fixing: Critical findings, Authentication, Secrets.

1Critical

0High

11Medium

6Low

Framework Mapping

Framework	Mapped Controls	Status
OWASP Top 10	A01 Broken Access Control, A05 Security Misconfiguration, A06 Vulnerable Components	Partial
CIS Controls	Secure configuration, vulnerability management, audit logging	Needs Work
NIST CSF	Identify, Protect, Detect, Respond, Recover	Mapped
SOC 2	Security, availability, confidentiality evidence	Needs Work
ISO 27001	Risk treatment, access control, operational security	Partial
PCI DSS	Dependency risk, secrets handling, secure transmission	Partial
GDPR	Data exposure, access control, retention and privacy signals	Initial

Control Evidence Summary

#1 Suite 1 - Build Verification WARN | low

No supported build manifest found for npm, Maven, Gradle, Cargo, dotnet, or Go.

Engine: Quality
Evidence: {}
Recommendation: Fix build failures before production release and add the build command to CI gates.
References: OWASP ASVS, CWE mapping pending, organization policy baseline

#2 Suite 2 - Static Code Quality WARN | medium

No ESLint lint script or global ESLint tool was available.

Engine: Quality
Evidence: { "staticScan": { "scannedFiles": 0, "codeSmellCount": 0, "unsafeAnyCount": 0, "duplicatedSymbolCount": 0 } }
Recommendation: Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
References: OWASP ASVS, CWE mapping pending, organization policy baseline

#3 Suite 3 - Testing WARN | medium

No runnable test script was found for Jest, Vitest, Playwright, Cypress, or coverage.

Engine: Quality
Evidence: { "availableScripts": [] }
Recommendation: Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
References: OWASP ASVS, CWE mapping pending, organization policy baseline

#4 Suite 4 - SAST PASS | medium

Fallback SAST scan did not find known risky patterns.

Engine: Security
Evidence: { "findings": [ { "name": "Unsafe eval", "count": 0, "severity": "high" }, { "name": "Command execution", "count": 0, "severity": "high" }, { "name": "SQL string construction", "count": 0, "severity": "high" }, { "name": "Weak crypto", "count": 0, "severity": "medium" }, { "name": "Prototype pollution sink", "count": 0, "severity": "medium" }, { "name": "Path traversal risk", "count": 0, "severity": "medium" } ], "scannedFiles": 1 }
Recommendation: Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
References: OWASP ASVS, CWE mapping pending, organization policy baseline

#5 Suite 5 - Secret Detection FAIL | critical

Fallback secret scan found potential secrets or exposed environment files.

Engine: Security
Evidence: { "envFiles": [], "findings": [ { "name": "AWS access key", "count": 0 }, { "name": "OpenAI key", "count": 0 }, { "name": "Private key", "count": 0 }, { "name": "JWT", "count": 0 }, { "name": "Generic secret assignment", "count": 1 } ], "scannedFiles": 3, "includeGitHistory": false }
Recommendation: Rotate exposed credentials, remove secrets from source control, and enforce secret scanning in CI.
References: OWASP ASVS, CWE mapping pending, organization policy baseline

#6 Suite 6 - Dependency Security WARN | medium

No dependency security scanner or supported dependency manifest was available.

Engine: Security
Evidence: {}
Recommendation: Upgrade vulnerable dependencies, pin safe versions, and re-run dependency audit.
References: OWASP ASVS, CWE mapping pending, organization policy baseline

#7 Suite 7 - Web Application Security WARN | medium

Custom web security rules found missing or undiscovered controls.

Engine: Security
Evidence: { "hasCsp": false, "missing": [ "hasCsp", "hasCorsConfig", "hasCsrfToken", "hasRateLimit", "hasSecureCookie", "hasAuthzChecks" ], "hasCsrfToken": false, "hasRateLimit": false, "scannedFiles": 1, "hasCorsConfig": false, "hasAuthzChecks": false, "hasSecureCookie": false }
Recommendation: Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
References: OWASP ASVS, CWE mapping pending, organization policy baseline

#8 Suite 8 - API Security WARN | medium

API security rules found missing or undiscovered JWT, authorization, or validation controls.

Engine: Security
Evidence: { "missing": [ "hasJwtValidation", "hasObjectAuthorization", "hasInputValidation", "hasGraphql" ], "hasGraphql": false, "openApiFiles": [], "scannedFiles": 1, "hasJwtValidation": false, "hasInputValidation": false, "hasObjectAuthorization": false }
Recommendation: Enforce authentication middleware, validate tokens server-side, and add object-level authorization tests.
References: OWASP ASVS, CWE mapping pending, organization policy baseline

#9 Suite 9 - Secrets in Git History WARN | medium

No .git directory found, so historical secret scanning could not run.

Engine: Security
Evidence: {}
Recommendation: Rotate exposed credentials, remove secrets from source control, and enforce secret scanning in CI.
References: OWASP ASVS, CWE mapping pending, organization policy baseline

#10 Suite 10 - Container Security WARN | low

No Dockerfile was found, so container security checks could not run.

Engine: Infrastructure
Evidence: { "dockerfiles": [] }
Recommendation: Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
References: OWASP ASVS, CWE mapping pending, organization policy baseline

#11 Suite 11 - Infrastructure as Code WARN | low

No Terraform, Kubernetes, Helm, or Docker Compose files were found.

Engine: Infrastructure
Evidence: {}
Recommendation: Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
References: OWASP ASVS, CWE mapping pending, organization policy baseline

#12 Suite 12 - CI/CD Security WARN | low

No GitHub Actions, Azure DevOps, Jenkins, or GitLab CI definitions were found.

Engine: Infrastructure
Evidence: {}
Recommendation: Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
References: OWASP ASVS, CWE mapping pending, organization policy baseline

#13 Suite 13 - Network Readiness WARN | low

No network configuration files or authorized runtime target were provided.

Engine: Infrastructure
Evidence: { "note": "Runtime Nmap or SSL analysis requires an explicit authorized target.", "weakTls": false, "openPorts": [], "hasDnsConfig": false, "scannedFiles": [], "publicExposure": false, "hasReverseProxy": false, "hasCertificateFiles": false }
Recommendation: Enforce authentication middleware, validate tokens server-side, and add object-level authorization tests.
References: OWASP ASVS, CWE mapping pending, organization policy baseline

#14 Suite 14 - Repository Architecture WARN | medium

Architecture scan found folder-structure or layer-boundary risks.

Engine: Architecture
Evidence: { "dddSignals": [], "scannedFiles": 1, "topLevelDirs": [ "procfile" ], "layerViolations": [], "microserviceSignals": [], "cleanArchitectureSignals": [] }
Recommendation: Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
References: OWASP ASVS, CWE mapping pending, organization policy baseline

#15 Suite 15 - Frontend Security WARN | medium

Frontend scan found CSP, source map, backend URL, or debug endpoint gaps.

Engine: Architecture
Evidence: { "hasCsp": false, "envFiles": [], "backendUrls": 0, "scannedFiles": 0, "debugEndpoints": 0, "exposedEnvFiles": [], "dangerousDomApis": 0, "publicSecretNames": 0, "sourceMapsEnabled": false }
Recommendation: Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
References: OWASP ASVS, CWE mapping pending, organization policy baseline

#16 Suite 16 - Backend Security WARN | medium

Backend scan found missing or undiscovered security controls.

Engine: Architecture
Evidence: { "missing": [ "hasMiddleware", "hasValidation", "hasAuthentication", "hasAuthorization", "hasLogging", "hasRateLimiting", "hasExceptionHandling" ], "hasLogging": false, "scannedFiles": 0, "hasMiddleware": false, "hasValidation": false, "hasRateLimiting": false, "hasAuthorization": false, "hasAuthentication": false, "hasExceptionHandling": false }
Recommendation: Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
References: OWASP ASVS, CWE mapping pending, organization policy baseline

#17 Suite 17 - Data Layer WARN | medium

Data layer scan found missing ORM, pooling, or encryption signals.

Engine: Architecture
Evidence: { "hasOrm": false, "hasPooling": false, "scannedFiles": 1, "hasEncryption": false, "databaseExposure": 0, "rawSqlConstruction": 0 }
Recommendation: Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
References: OWASP ASVS, CWE mapping pending, organization policy baseline

#18 Suite 18 - Cloud Architecture WARN | low

No AWS, Azure, or GCP architecture artifacts were found.

Engine: Architecture
Evidence: {}
Recommendation: Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
References: OWASP ASVS, CWE mapping pending, organization policy baseline