CONFIDENTIAL

Evidence Report

Tool, command, output, timing, and repeatability evidence generated by Arsenal

local-upload/ShiftOps-master | 7/17/2026, 5:54:20 PM

73%
Ready With Conditions

Recommendation: Deploy after fixing: Critical findings, Authentication, Secrets.

1Critical
0High
5Medium
0Low

Evidence Ledger

SuiteToolStatusDurationOutput
Suite 4 - SAST Arsenal probe FAIL 18 ms 
{
  "findings": [
    {
      "name": "Unsafe eval",
      "count": 0,
      "severity": "high"
    },
    {
      "name": "Command execution",
      "count": 0,
      "severity": "high"
    },
    {
      "name": "SQL string construction",
      "count": 9,
      "severity": "high"
    },
    {
      "name": "Weak crypto",
      "count": 0,
      "severity": "medium"
    },
    {
      "name": "Prototype pollution sink",
      "count": 0,
      "severity": "medium"
    },
    {
      "name": "Path traversal risk",
      "count": 0,
      "severity": "medium"
    }
  ],
  "scann
Suite 5 - Secret Detection Arsenal probe PASS 21 ms 
{
  "envFiles": [],
  "findings": [
    {
      "name": "AWS access key",
      "count": 0
    },
    {
      "name": "OpenAI key",
      "count": 0
    },
    {
      "name": "Private key",
      "count": 0
    },
    {
      "name": "JWT",
      "count": 0
    },
    {
      "name": "Generic secret assignment",
      "count": 0
    }
  ],
  "scannedFiles": 26,
  "includeGitHistory": false
}
Suite 6 - Dependency Security pnpm audit WARN 1 ms 
{
  "tool": "pnpm audit",
  "output": "spawn EINVAL"
}
Suite 7 - Web Application Security Arsenal probe WARN 17 ms 
{
  "hasCsp": false,
  "missing": [
    "hasCsp",
    "hasCorsConfig",
    "hasCsrfToken",
    "hasRateLimit",
    "hasSecureCookie"
  ],
  "hasCsrfToken": false,
  "hasRateLimit": false,
  "scannedFiles": 25,
  "hasCorsConfig": false,
  "hasAuthzChecks": true,
  "hasSecureCookie": false
}
Suite 8 - API Security Arsenal probe PASS 22 ms 
{
  "missing": [
    "hasObjectAuthorization"
  ],
  "hasGraphql": true,
  "openApiFiles": [],
  "scannedFiles": 26,
  "hasJwtValidation": true,
  "hasInputValidation": true,
  "hasObjectAuthorization": false
}
Suite 9 - Secrets in Git History Arsenal probe WARN 0 ms 
{
  "message": "No .git directory found, so historical secret scanning could not run."
}