Technical Engineering Report

No supported build manifest found for npm, Maven, Gradle, Cargo, dotnet, or Go.

Engine

Quality

Evidence

{}

Recommendation

Fix build failures before production release and add the build command to CI gates.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No ESLint lint script or global ESLint tool was available. Fallback static scan found elevated smell, any-type, or duplicate-symbol counts.

Engine

Quality

Evidence

{ "staticScan": { "scannedFiles": 17, "codeSmellCount": 39, "unsafeAnyCount": 47, "duplicatedSymbolCount": 9 } }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No runnable test script was found for Jest, Vitest, Playwright, Cypress, or coverage.

Engine

Quality

Evidence

{ "availableScripts": [] }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Fallback SAST scan found high-risk code patterns.

Engine

Security

Evidence

{ "findings": [ { "name": "Unsafe eval", "count": 0, "severity": "high" }, { "name": "Command execution", "count": 1, "severity": "high" }, { "name": "SQL string construction", "count": 1, "severity": "high" }, { "name": "Weak crypto", "count": 0, "severity": "medium" }, { "name": "Prototype pollution sink", "count": 0, "severity": "medium" }, { "name": "Path traversal risk", "count": 14, "severity": "medium" } ], "scannedFiles": 17 }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Fallback secret scan did not find known secret patterns.

Engine

Security

Evidence

{ "envFiles": [], "findings": [ { "name": "AWS access key", "count": 0 }, { "name": "OpenAI key", "count": 0 }, { "name": "Private key", "count": 0 }, { "name": "JWT", "count": 0 }, { "name": "Generic secret assignment", "count": 0 } ], "scannedFiles": 21, "includeGitHistory": false }

Recommendation

Rotate exposed credentials, remove secrets from source control, and enforce secret scanning in CI.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No dependency security scanner or supported dependency manifest was available.

Engine

Security

Evidence

{}

Recommendation

Upgrade vulnerable dependencies, pin safe versions, and re-run dependency audit.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Custom web security rules found missing or undiscovered controls.

Engine

Security

Evidence

{ "hasCsp": false, "missing": [ "hasCsp", "hasCsrfToken", "hasSecureCookie" ], "hasCsrfToken": false, "hasRateLimit": true, "scannedFiles": 20, "hasCorsConfig": true, "hasAuthzChecks": true, "hasSecureCookie": false }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

API security rules found core validation and authorization signals.

Engine

Security

Evidence

{ "missing": [ "hasGraphql" ], "hasGraphql": false, "openApiFiles": [], "scannedFiles": 21, "hasJwtValidation": true, "hasInputValidation": true, "hasObjectAuthorization": true }

Recommendation

Enforce authentication middleware, validate tokens server-side, and add object-level authorization tests.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No .git directory found, so historical secret scanning could not run.

Engine

Security

Evidence

{}

Recommendation

Rotate exposed credentials, remove secrets from source control, and enforce secret scanning in CI.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No Dockerfile was found, so container security checks could not run.

Engine

Infrastructure

Evidence

{ "dockerfiles": [] }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Fallback IaC scan found no obvious infrastructure risks.

Engine

Infrastructure

Evidence

{ "helmFiles": [], "composeFiles": [], "scannedFiles": 1, "riskyPatterns": [ { "name": "Privileged containers", "count": 0 }, { "name": "Host networking", "count": 0 }, { "name": "Latest image tags", "count": 0 }, { "name": "Public ingress CIDR", "count": 0 }, { "name": "Plaintext secret resources", "count": 0 } ], "terraformFiles": [], "kubernetesFiles": [] }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No GitHub Actions, Azure DevOps, Jenkins, or GitLab CI definitions were found.

Engine

Infrastructure

Evidence

{}

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Static network readiness scan found no obvious network risks.

Engine

Infrastructure

Evidence

{ "note": "Runtime Nmap or SSL analysis requires an explicit authorized target.", "weakTls": false, "openPorts": [], "hasDnsConfig": false, "scannedFiles": [ "backend/pnpm-lock.yaml" ], "publicExposure": false, "hasReverseProxy": false, "hasCertificateFiles": false }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Architecture scan found folder-structure or layer-boundary risks.

Engine

Architecture

Evidence

{ "dddSignals": [], "scannedFiles": 17, "topLevelDirs": [ "backend" ], "layerViolations": [], "microserviceSignals": [], "cleanArchitectureSignals": [ "domain" ] }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Frontend scan found CSP, source map, backend URL, or debug endpoint gaps.

Engine

Architecture

Evidence

{ "hasCsp": false, "envFiles": [], "backendUrls": 3, "scannedFiles": 15, "debugEndpoints": 0, "exposedEnvFiles": [], "dangerousDomApis": 0, "publicSecretNames": 0, "sourceMapsEnabled": false }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Backend scan found core backend security controls or no obvious gaps.

Engine

Architecture

Evidence

{ "missing": [ "hasAuthorization", "hasRateLimiting" ], "hasLogging": true, "scannedFiles": 5, "hasMiddleware": true, "hasValidation": true, "hasRateLimiting": false, "hasAuthorization": false, "hasAuthentication": true, "hasExceptionHandling": true }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Data layer scan found missing ORM, pooling, or encryption signals.

Engine

Architecture

Evidence

{ "hasOrm": true, "hasPooling": false, "scannedFiles": 17, "hasEncryption": false, "databaseExposure": 0, "rawSqlConstruction": 0 }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No AWS, Azure, or GCP architecture artifacts were found.

Engine

Architecture

Evidence

{}

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline