{
  "repositoryName": "achieveradarsh/hdnotebackend",
  "overallScore": 76,
  "scanDate": "2026-07-25T14:20:53.400Z",
  "totalTests": 18,
  "summary": {
    "passed": 5,
    "warnings": 12,
    "failed": 1,
    "errors": 0
  },
  "results": [
    {
      "testSuiteId": "build-verification",
      "status": "WARN",
      "message": "No supported build manifest found for npm, Maven, Gradle, Cargo, dotnet, or Go.",
      "severity": "low",
      "executionTime": 1,
      "testName": "Suite 1 - Build Verification",
      "sectionName": "Quality"
    },
    {
      "testSuiteId": "static-code-quality",
      "status": "WARN",
      "message": "No ESLint lint script or global ESLint tool was available. Fallback static scan found elevated smell, any-type, or duplicate-symbol counts.",
      "severity": "medium",
      "details": {
        "staticScan": {
          "scannedFiles": 17,
          "codeSmellCount": 39,
          "unsafeAnyCount": 47,
          "duplicatedSymbolCount": 9
        }
      },
      "executionTime": 9,
      "testName": "Suite 2 - Static Code Quality",
      "sectionName": "Quality"
    },
    {
      "testSuiteId": "testing",
      "status": "WARN",
      "message": "No runnable test script was found for Jest, Vitest, Playwright, Cypress, or coverage.",
      "severity": "medium",
      "details": {
        "availableScripts": []
      },
      "executionTime": 0,
      "testName": "Suite 3 - Testing",
      "sectionName": "Quality"
    },
    {
      "testSuiteId": "sast",
      "status": "FAIL",
      "message": "Fallback SAST scan found high-risk code patterns.",
      "severity": "critical",
      "details": {
        "findings": [
          {
            "name": "Unsafe eval",
            "count": 0,
            "severity": "high"
          },
          {
            "name": "Command execution",
            "count": 1,
            "severity": "high"
          },
          {
            "name": "SQL string construction",
            "count": 1,
            "severity": "high"
          },
          {
            "name": "Weak crypto",
            "count": 0,
            "severity": "medium"
          },
          {
            "name": "Prototype pollution sink",
            "count": 0,
            "severity": "medium"
          },
          {
            "name": "Path traversal risk",
            "count": 14,
            "severity": "medium"
          }
        ],
        "scannedFiles": 17
      },
      "executionTime": 10,
      "testName": "Suite 4 - SAST",
      "sectionName": "Security"
    },
    {
      "testSuiteId": "secret-detection",
      "status": "PASS",
      "message": "Fallback secret scan did not find known secret patterns.",
      "severity": "medium",
      "details": {
        "envFiles": [],
        "findings": [
          {
            "name": "AWS access key",
            "count": 0
          },
          {
            "name": "OpenAI key",
            "count": 0
          },
          {
            "name": "Private key",
            "count": 0
          },
          {
            "name": "JWT",
            "count": 0
          },
          {
            "name": "Generic secret assignment",
            "count": 0
          }
        ],
        "scannedFiles": 21,
        "includeGitHistory": false
      },
      "executionTime": 7,
      "testName": "Suite 5 - Secret Detection",
      "sectionName": "Security"
    },
    {
      "testSuiteId": "dependency-security",
      "status": "WARN",
      "message": "No dependency security scanner or supported dependency manifest was available.",
      "severity": "medium",
      "executionTime": 8,
      "testName": "Suite 6 - Dependency Security",
      "sectionName": "Security"
    },
    {
      "testSuiteId": "web-application-security",
      "status": "WARN",
      "message": "Custom web security rules found missing or undiscovered controls.",
      "severity": "medium",
      "details": {
        "hasCsp": false,
        "missing": [
          "hasCsp",
          "hasCsrfToken",
          "hasSecureCookie"
        ],
        "hasCsrfToken": false,
        "hasRateLimit": true,
        "scannedFiles": 20,
        "hasCorsConfig": true,
        "hasAuthzChecks": true,
        "hasSecureCookie": false
      },
      "executionTime": 5,
      "testName": "Suite 7 - Web Application Security",
      "sectionName": "Security"
    },
    {
      "testSuiteId": "api-security",
      "status": "PASS",
      "message": "API security rules found core validation and authorization signals.",
      "severity": "medium",
      "details": {
        "missing": [
          "hasGraphql"
        ],
        "hasGraphql": false,
        "openApiFiles": [],
        "scannedFiles": 21,
        "hasJwtValidation": true,
        "hasInputValidation": true,
        "hasObjectAuthorization": true
      },
      "executionTime": 2,
      "testName": "Suite 8 - API Security",
      "sectionName": "Security"
    },
    {
      "testSuiteId": "git-history-secrets",
      "status": "WARN",
      "message": "No .git directory found, so historical secret scanning could not run.",
      "severity": "medium",
      "executionTime": 0,
      "testName": "Suite 9 - Secrets in Git History",
      "sectionName": "Security"
    },
    {
      "testSuiteId": "container-security",
      "status": "WARN",
      "message": "No Dockerfile was found, so container security checks could not run.",
      "severity": "low",
      "details": {
        "dockerfiles": []
      },
      "executionTime": 1,
      "testName": "Suite 10 - Container Security",
      "sectionName": "Infrastructure"
    },
    {
      "testSuiteId": "infrastructure-as-code",
      "status": "PASS",
      "message": "Fallback IaC scan found no obvious infrastructure risks.",
      "severity": "medium",
      "details": {
        "helmFiles": [],
        "composeFiles": [],
        "scannedFiles": 1,
        "riskyPatterns": [
          {
            "name": "Privileged containers",
            "count": 0
          },
          {
            "name": "Host networking",
            "count": 0
          },
          {
            "name": "Latest image tags",
            "count": 0
          },
          {
            "name": "Public ingress CIDR",
            "count": 0
          },
          {
            "name": "Plaintext secret resources",
            "count": 0
          }
        ],
        "terraformFiles": [],
        "kubernetesFiles": []
      },
      "executionTime": 9,
      "testName": "Suite 11 - Infrastructure as Code",
      "sectionName": "Infrastructure"
    },
    {
      "testSuiteId": "ci-cd-security",
      "status": "WARN",
      "message": "No GitHub Actions, Azure DevOps, Jenkins, or GitLab CI definitions were found.",
      "severity": "low",
      "executionTime": 1,
      "testName": "Suite 12 - CI/CD Security",
      "sectionName": "Infrastructure"
    },
    {
      "testSuiteId": "network-readiness",
      "status": "PASS",
      "message": "Static network readiness scan found no obvious network risks.",
      "severity": "medium",
      "details": {
        "note": "Runtime Nmap or SSL analysis requires an explicit authorized target.",
        "weakTls": false,
        "openPorts": [],
        "hasDnsConfig": false,
        "scannedFiles": [
          "backend/pnpm-lock.yaml"
        ],
        "publicExposure": false,
        "hasReverseProxy": false,
        "hasCertificateFiles": false
      },
      "executionTime": 2,
      "testName": "Suite 13 - Network Readiness",
      "sectionName": "Infrastructure"
    },
    {
      "testSuiteId": "repository-architecture",
      "status": "WARN",
      "message": "Architecture scan found folder-structure or layer-boundary risks.",
      "severity": "medium",
      "details": {
        "dddSignals": [],
        "scannedFiles": 17,
        "topLevelDirs": [
          "backend"
        ],
        "layerViolations": [],
        "microserviceSignals": [],
        "cleanArchitectureSignals": [
          "domain"
        ]
      },
      "executionTime": 2,
      "testName": "Suite 14 - Repository Architecture",
      "sectionName": "Architecture"
    },
    {
      "testSuiteId": "frontend-security",
      "status": "WARN",
      "message": "Frontend scan found CSP, source map, backend URL, or debug endpoint gaps.",
      "severity": "medium",
      "details": {
        "hasCsp": false,
        "envFiles": [],
        "backendUrls": 3,
        "scannedFiles": 15,
        "debugEndpoints": 0,
        "exposedEnvFiles": [],
        "dangerousDomApis": 0,
        "publicSecretNames": 0,
        "sourceMapsEnabled": false
      },
      "executionTime": 3,
      "testName": "Suite 15 - Frontend Security",
      "sectionName": "Architecture"
    },
    {
      "testSuiteId": "backend-security",
      "status": "PASS",
      "message": "Backend scan found core backend security controls or no obvious gaps.",
      "severity": "medium",
      "details": {
        "missing": [
          "hasAuthorization",
          "hasRateLimiting"
        ],
        "hasLogging": true,
        "scannedFiles": 5,
        "hasMiddleware": true,
        "hasValidation": true,
        "hasRateLimiting": false,
        "hasAuthorization": false,
        "hasAuthentication": true,
        "hasExceptionHandling": true
      },
      "executionTime": 1,
      "testName": "Suite 16 - Backend Security",
      "sectionName": "Architecture"
    },
    {
      "testSuiteId": "data-layer",
      "status": "WARN",
      "message": "Data layer scan found missing ORM, pooling, or encryption signals.",
      "severity": "medium",
      "details": {
        "hasOrm": true,
        "hasPooling": false,
        "scannedFiles": 17,
        "hasEncryption": false,
        "databaseExposure": 0,
        "rawSqlConstruction": 0
      },
      "executionTime": 2,
      "testName": "Suite 17 - Data Layer",
      "sectionName": "Architecture"
    },
    {
      "testSuiteId": "cloud-architecture",
      "status": "WARN",
      "message": "No AWS, Azure, or GCP architecture artifacts were found.",
      "severity": "low",
      "executionTime": 1,
      "testName": "Suite 18 - Cloud Architecture",
      "sectionName": "Architecture"
    }
  ]
}