CONFIDENTIAL

Evidence Report

Tool, command, output, timing, and repeatability evidence generated by Arsenal

achieveradarsh/hdnotebackend | 7/25/2026, 2:20:53 PM

76%
Ready With Conditions

Recommendation: Deploy after fixing: Critical findings, Authentication, Secrets.

1Critical
0High
13Medium
4Low

Evidence Ledger

SuiteToolStatusDurationOutput
Suite 1 - Build Verification Arsenal probe WARN 1 ms 
{
  "message": "No supported build manifest found for npm, Maven, Gradle, Cargo, dotnet, or Go."
}
Suite 2 - Static Code Quality Arsenal probe WARN 9 ms 
{
  "staticScan": {
    "scannedFiles": 17,
    "codeSmellCount": 39,
    "unsafeAnyCount": 47,
    "duplicatedSymbolCount": 9
  }
}
Suite 3 - Testing Arsenal probe WARN 0 ms 
{
  "availableScripts": []
}
Suite 4 - SAST Arsenal probe FAIL 10 ms 
{
  "findings": [
    {
      "name": "Unsafe eval",
      "count": 0,
      "severity": "high"
    },
    {
      "name": "Command execution",
      "count": 1,
      "severity": "high"
    },
    {
      "name": "SQL string construction",
      "count": 1,
      "severity": "high"
    },
    {
      "name": "Weak crypto",
      "count": 0,
      "severity": "medium"
    },
    {
      "name": "Prototype pollution sink",
      "count": 0,
      "severity": "medium"
    },
    {
      "name": "Path traversal risk",
      "count": 14,
      "severity": "medium"
    }
  ],
  "scan
Suite 5 - Secret Detection Arsenal probe PASS 7 ms 
{
  "envFiles": [],
  "findings": [
    {
      "name": "AWS access key",
      "count": 0
    },
    {
      "name": "OpenAI key",
      "count": 0
    },
    {
      "name": "Private key",
      "count": 0
    },
    {
      "name": "JWT",
      "count": 0
    },
    {
      "name": "Generic secret assignment",
      "count": 0
    }
  ],
  "scannedFiles": 21,
  "includeGitHistory": false
}
Suite 6 - Dependency Security Arsenal probe WARN 8 ms 
{
  "message": "No dependency security scanner or supported dependency manifest was available."
}
Suite 7 - Web Application Security Arsenal probe WARN 5 ms 
{
  "hasCsp": false,
  "missing": [
    "hasCsp",
    "hasCsrfToken",
    "hasSecureCookie"
  ],
  "hasCsrfToken": false,
  "hasRateLimit": true,
  "scannedFiles": 20,
  "hasCorsConfig": true,
  "hasAuthzChecks": true,
  "hasSecureCookie": false
}
Suite 8 - API Security Arsenal probe PASS 2 ms 
{
  "missing": [
    "hasGraphql"
  ],
  "hasGraphql": false,
  "openApiFiles": [],
  "scannedFiles": 21,
  "hasJwtValidation": true,
  "hasInputValidation": true,
  "hasObjectAuthorization": true
}
Suite 9 - Secrets in Git History Arsenal probe WARN 0 ms 
{
  "message": "No .git directory found, so historical secret scanning could not run."
}
Suite 10 - Container Security Arsenal probe WARN 1 ms 
{
  "dockerfiles": []
}
Suite 11 - Infrastructure as Code Arsenal probe PASS 9 ms 
{
  "helmFiles": [],
  "composeFiles": [],
  "scannedFiles": 1,
  "riskyPatterns": [
    {
      "name": "Privileged containers",
      "count": 0
    },
    {
      "name": "Host networking",
      "count": 0
    },
    {
      "name": "Latest image tags",
      "count": 0
    },
    {
      "name": "Public ingress CIDR",
      "count": 0
    },
    {
      "name": "Plaintext secret resources",
      "count": 0
    }
  ],
  "terraformFiles": [],
  "kubernetesFiles": []
}
Suite 12 - CI/CD Security Arsenal probe WARN 1 ms 
{
  "message": "No GitHub Actions, Azure DevOps, Jenkins, or GitLab CI definitions were found."
}
Suite 13 - Network Readiness Arsenal probe PASS 2 ms 
{
  "note": "Runtime Nmap or SSL analysis requires an explicit authorized target.",
  "weakTls": false,
  "openPorts": [],
  "hasDnsConfig": false,
  "scannedFiles": [
    "backend/pnpm-lock.yaml"
  ],
  "publicExposure": false,
  "hasReverseProxy": false,
  "hasCertificateFiles": false
}
Suite 14 - Repository Architecture Arsenal probe WARN 2 ms 
{
  "dddSignals": [],
  "scannedFiles": 17,
  "topLevelDirs": [
    "backend"
  ],
  "layerViolations": [],
  "microserviceSignals": [],
  "cleanArchitectureSignals": [
    "domain"
  ]
}
Suite 15 - Frontend Security Arsenal probe WARN 3 ms 
{
  "hasCsp": false,
  "envFiles": [],
  "backendUrls": 3,
  "scannedFiles": 15,
  "debugEndpoints": 0,
  "exposedEnvFiles": [],
  "dangerousDomApis": 0,
  "publicSecretNames": 0,
  "sourceMapsEnabled": false
}
Suite 16 - Backend Security Arsenal probe PASS 1 ms 
{
  "missing": [
    "hasAuthorization",
    "hasRateLimiting"
  ],
  "hasLogging": true,
  "scannedFiles": 5,
  "hasMiddleware": true,
  "hasValidation": true,
  "hasRateLimiting": false,
  "hasAuthorization": false,
  "hasAuthentication": true,
  "hasExceptionHandling": true
}
Suite 17 - Data Layer Arsenal probe WARN 2 ms 
{
  "hasOrm": true,
  "hasPooling": false,
  "scannedFiles": 17,
  "hasEncryption": false,
  "databaseExposure": 0,
  "rawSqlConstruction": 0
}
Suite 18 - Cloud Architecture Arsenal probe WARN 1 ms 
{
  "message": "No AWS, Azure, or GCP architecture artifacts were found."
}