Compliance Attestation Report
Framework-oriented control mapping for audit and governance workflows
achieveradarsh/hdnotebackend | 7/25/2026, 2:20:53 PM
76%
Ready With ConditionsRecommendation: Deploy after fixing: Critical findings, Authentication, Secrets.
1Critical
0High
13Medium
4Low
Framework Mapping
| Framework | Mapped Controls | Status |
|---|---|---|
| OWASP Top 10 | A01 Broken Access Control, A05 Security Misconfiguration, A06 Vulnerable Components | Partial |
| CIS Controls | Secure configuration, vulnerability management, audit logging | Partial |
| NIST CSF | Identify, Protect, Detect, Respond, Recover | Mapped |
| SOC 2 | Security, availability, confidentiality evidence | Needs Work |
| ISO 27001 | Risk treatment, access control, operational security | Partial |
| PCI DSS | Dependency risk, secrets handling, secure transmission | Partial |
| GDPR | Data exposure, access control, retention and privacy signals | Initial |
Control Evidence Summary
#1
Suite 1 - Build Verification
WARN | low
No supported build manifest found for npm, Maven, Gradle, Cargo, dotnet, or Go.
- Engine
- Quality
- Evidence
- {}
- Recommendation
- Fix build failures before production release and add the build command to CI gates.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#2
Suite 2 - Static Code Quality
WARN | medium
No ESLint lint script or global ESLint tool was available. Fallback static scan found elevated smell, any-type, or duplicate-symbol counts.
- Engine
- Quality
- Evidence
- { "staticScan": { "scannedFiles": 17, "codeSmellCount": 39, "unsafeAnyCount": 47, "duplicatedSymbolCount": 9 } }
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#3
Suite 3 - Testing
WARN | medium
No runnable test script was found for Jest, Vitest, Playwright, Cypress, or coverage.
- Engine
- Quality
- Evidence
- { "availableScripts": [] }
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#4
Suite 4 - SAST
FAIL | critical
Fallback SAST scan found high-risk code patterns.
- Engine
- Security
- Evidence
- { "findings": [ { "name": "Unsafe eval", "count": 0, "severity": "high" }, { "name": "Command execution", "count": 1, "severity": "high" }, { "name": "SQL string construction", "count": 1, "severity": "high" }, { "name": "Weak crypto", "count": 0, "severity": "medium" }, { "name": "Prototype pollution sink", "count": 0, "severity": "medium" }, { "name": "Path traversal risk", "count": 14, "severity": "medium" } ], "scannedFiles": 17 }
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#5
Suite 5 - Secret Detection
PASS | medium
Fallback secret scan did not find known secret patterns.
- Engine
- Security
- Evidence
- { "envFiles": [], "findings": [ { "name": "AWS access key", "count": 0 }, { "name": "OpenAI key", "count": 0 }, { "name": "Private key", "count": 0 }, { "name": "JWT", "count": 0 }, { "name": "Generic secret assignment", "count": 0 } ], "scannedFiles": 21, "includeGitHistory": false }
- Recommendation
- Rotate exposed credentials, remove secrets from source control, and enforce secret scanning in CI.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#6
Suite 6 - Dependency Security
WARN | medium
No dependency security scanner or supported dependency manifest was available.
- Engine
- Security
- Evidence
- {}
- Recommendation
- Upgrade vulnerable dependencies, pin safe versions, and re-run dependency audit.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#7
Suite 7 - Web Application Security
WARN | medium
Custom web security rules found missing or undiscovered controls.
- Engine
- Security
- Evidence
- { "hasCsp": false, "missing": [ "hasCsp", "hasCsrfToken", "hasSecureCookie" ], "hasCsrfToken": false, "hasRateLimit": true, "scannedFiles": 20, "hasCorsConfig": true, "hasAuthzChecks": true, "hasSecureCookie": false }
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#8
Suite 8 - API Security
PASS | medium
API security rules found core validation and authorization signals.
- Engine
- Security
- Evidence
- { "missing": [ "hasGraphql" ], "hasGraphql": false, "openApiFiles": [], "scannedFiles": 21, "hasJwtValidation": true, "hasInputValidation": true, "hasObjectAuthorization": true }
- Recommendation
- Enforce authentication middleware, validate tokens server-side, and add object-level authorization tests.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#9
Suite 9 - Secrets in Git History
WARN | medium
No .git directory found, so historical secret scanning could not run.
- Engine
- Security
- Evidence
- {}
- Recommendation
- Rotate exposed credentials, remove secrets from source control, and enforce secret scanning in CI.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#10
Suite 10 - Container Security
WARN | low
No Dockerfile was found, so container security checks could not run.
- Engine
- Infrastructure
- Evidence
- { "dockerfiles": [] }
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#11
Suite 11 - Infrastructure as Code
PASS | medium
Fallback IaC scan found no obvious infrastructure risks.
- Engine
- Infrastructure
- Evidence
- { "helmFiles": [], "composeFiles": [], "scannedFiles": 1, "riskyPatterns": [ { "name": "Privileged containers", "count": 0 }, { "name": "Host networking", "count": 0 }, { "name": "Latest image tags", "count": 0 }, { "name": "Public ingress CIDR", "count": 0 }, { "name": "Plaintext secret resources", "count": 0 } ], "terraformFiles": [], "kubernetesFiles": [] }
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#12
Suite 12 - CI/CD Security
WARN | low
No GitHub Actions, Azure DevOps, Jenkins, or GitLab CI definitions were found.
- Engine
- Infrastructure
- Evidence
- {}
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#13
Suite 13 - Network Readiness
PASS | medium
Static network readiness scan found no obvious network risks.
- Engine
- Infrastructure
- Evidence
- { "note": "Runtime Nmap or SSL analysis requires an explicit authorized target.", "weakTls": false, "openPorts": [], "hasDnsConfig": false, "scannedFiles": [ "backend/pnpm-lock.yaml" ], "publicExposure": false, "hasReverseProxy": false, "hasCertificateFiles": false }
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#14
Suite 14 - Repository Architecture
WARN | medium
Architecture scan found folder-structure or layer-boundary risks.
- Engine
- Architecture
- Evidence
- { "dddSignals": [], "scannedFiles": 17, "topLevelDirs": [ "backend" ], "layerViolations": [], "microserviceSignals": [], "cleanArchitectureSignals": [ "domain" ] }
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#15
Suite 15 - Frontend Security
WARN | medium
Frontend scan found CSP, source map, backend URL, or debug endpoint gaps.
- Engine
- Architecture
- Evidence
- { "hasCsp": false, "envFiles": [], "backendUrls": 3, "scannedFiles": 15, "debugEndpoints": 0, "exposedEnvFiles": [], "dangerousDomApis": 0, "publicSecretNames": 0, "sourceMapsEnabled": false }
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#16
Suite 16 - Backend Security
PASS | medium
Backend scan found core backend security controls or no obvious gaps.
- Engine
- Architecture
- Evidence
- { "missing": [ "hasAuthorization", "hasRateLimiting" ], "hasLogging": true, "scannedFiles": 5, "hasMiddleware": true, "hasValidation": true, "hasRateLimiting": false, "hasAuthorization": false, "hasAuthentication": true, "hasExceptionHandling": true }
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#17
Suite 17 - Data Layer
WARN | medium
Data layer scan found missing ORM, pooling, or encryption signals.
- Engine
- Architecture
- Evidence
- { "hasOrm": true, "hasPooling": false, "scannedFiles": 17, "hasEncryption": false, "databaseExposure": 0, "rawSqlConstruction": 0 }
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#18
Suite 18 - Cloud Architecture
WARN | low
No AWS, Azure, or GCP architecture artifacts were found.
- Engine
- Architecture
- Evidence
- {}
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline