Technical Engineering Report

No supported build manifest found for npm, Maven, Gradle, Cargo, dotnet, or Go.

Engine

Quality

Evidence

{}

Recommendation

Fix build failures before production release and add the build command to CI gates.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No ESLint lint script or global ESLint tool was available.

Engine

Quality

Evidence

{ "staticScan": { "scannedFiles": 0, "codeSmellCount": 0, "unsafeAnyCount": 0, "duplicatedSymbolCount": 0 } }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No runnable test script was found for Jest, Vitest, Playwright, Cypress, or coverage.

Engine

Quality

Evidence

{ "availableScripts": [] }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Fallback SAST scan did not find known risky patterns.

Engine

Security

Evidence

{ "findings": [ { "name": "Unsafe eval", "count": 0, "severity": "high" }, { "name": "Command execution", "count": 0, "severity": "high" }, { "name": "SQL string construction", "count": 0, "severity": "high" }, { "name": "Weak crypto", "count": 0, "severity": "medium" }, { "name": "Prototype pollution sink", "count": 0, "severity": "medium" }, { "name": "Path traversal risk", "count": 0, "severity": "medium" } ], "scannedFiles": 1 }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Fallback secret scan found potential secrets or exposed environment files.

Engine

Security

Evidence

{ "envFiles": [], "findings": [ { "name": "AWS access key", "count": 0 }, { "name": "OpenAI key", "count": 0 }, { "name": "Private key", "count": 0 }, { "name": "JWT", "count": 0 }, { "name": "Generic secret assignment", "count": 1 } ], "scannedFiles": 3, "includeGitHistory": false }

Recommendation

Rotate exposed credentials, remove secrets from source control, and enforce secret scanning in CI.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No dependency security scanner or supported dependency manifest was available.

Engine

Security

Evidence

{}

Recommendation

Upgrade vulnerable dependencies, pin safe versions, and re-run dependency audit.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Custom web security rules found missing or undiscovered controls.

Engine

Security

Evidence

{ "hasCsp": false, "missing": [ "hasCsp", "hasCorsConfig", "hasCsrfToken", "hasRateLimit", "hasSecureCookie", "hasAuthzChecks" ], "hasCsrfToken": false, "hasRateLimit": false, "scannedFiles": 1, "hasCorsConfig": false, "hasAuthzChecks": false, "hasSecureCookie": false }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

API security rules found missing or undiscovered JWT, authorization, or validation controls.

Engine

Security

Evidence

{ "missing": [ "hasJwtValidation", "hasObjectAuthorization", "hasInputValidation", "hasGraphql" ], "hasGraphql": false, "openApiFiles": [], "scannedFiles": 1, "hasJwtValidation": false, "hasInputValidation": false, "hasObjectAuthorization": false }

Recommendation

Enforce authentication middleware, validate tokens server-side, and add object-level authorization tests.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No .git directory found, so historical secret scanning could not run.

Engine

Security

Evidence

{}

Recommendation

Rotate exposed credentials, remove secrets from source control, and enforce secret scanning in CI.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No Dockerfile was found, so container security checks could not run.

Engine

Infrastructure

Evidence

{ "dockerfiles": [] }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No Terraform, Kubernetes, Helm, or Docker Compose files were found.

Engine

Infrastructure

Evidence

{}

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No GitHub Actions, Azure DevOps, Jenkins, or GitLab CI definitions were found.

Engine

Infrastructure

Evidence

{}

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No network configuration files or authorized runtime target were provided.

Engine

Infrastructure

Evidence

{ "note": "Runtime Nmap or SSL analysis requires an explicit authorized target.", "weakTls": false, "openPorts": [], "hasDnsConfig": false, "scannedFiles": [], "publicExposure": false, "hasReverseProxy": false, "hasCertificateFiles": false }

Recommendation

Enforce authentication middleware, validate tokens server-side, and add object-level authorization tests.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Architecture scan found folder-structure or layer-boundary risks.

Engine

Architecture

Evidence

{ "dddSignals": [], "scannedFiles": 1, "topLevelDirs": [ "procfile" ], "layerViolations": [], "microserviceSignals": [], "cleanArchitectureSignals": [] }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Frontend scan found CSP, source map, backend URL, or debug endpoint gaps.

Engine

Architecture

Evidence

{ "hasCsp": false, "envFiles": [], "backendUrls": 0, "scannedFiles": 0, "debugEndpoints": 0, "exposedEnvFiles": [], "dangerousDomApis": 0, "publicSecretNames": 0, "sourceMapsEnabled": false }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Backend scan found missing or undiscovered security controls.

Engine

Architecture

Evidence

{ "missing": [ "hasMiddleware", "hasValidation", "hasAuthentication", "hasAuthorization", "hasLogging", "hasRateLimiting", "hasExceptionHandling" ], "hasLogging": false, "scannedFiles": 0, "hasMiddleware": false, "hasValidation": false, "hasRateLimiting": false, "hasAuthorization": false, "hasAuthentication": false, "hasExceptionHandling": false }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Data layer scan found missing ORM, pooling, or encryption signals.

Engine

Architecture

Evidence

{ "hasOrm": false, "hasPooling": false, "scannedFiles": 1, "hasEncryption": false, "databaseExposure": 0, "rawSqlConstruction": 0 }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No AWS, Azure, or GCP architecture artifacts were found.

Engine

Architecture

Evidence

{}

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline