Technical Engineering Report
Every engine, suite, finding, evidence object, recommendation, and remediation path
local-upload/ShiftOps-master | 7/17/2026, 5:54:20 PM
73%
Ready With ConditionsRecommendation: Deploy after fixing: Critical findings, Authentication, Secrets.
1Critical
0High
5Medium
0Low
Detailed Findings
#1
Suite 4 - SAST
FAIL | critical
Fallback SAST scan found high-risk code patterns.
- Engine
- Security
- Evidence
- { "findings": [ { "name": "Unsafe eval", "count": 0, "severity": "high" }, { "name": "Command execution", "count": 0, "severity": "high" }, { "name": "SQL string construction", "count": 9, "severity": "high" }, { "name": "Weak crypto", "count": 0, "severity": "medium" }, { "name": "Prototype pollution sink", "count": 0, "severity": "medium" }, { "name": "Path traversal risk", "count": 0, "severity": "medium" } ], "scannedFiles": 22 }
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#2
Suite 5 - Secret Detection
PASS | medium
Fallback secret scan did not find known secret patterns.
- Engine
- Security
- Evidence
- { "envFiles": [], "findings": [ { "name": "AWS access key", "count": 0 }, { "name": "OpenAI key", "count": 0 }, { "name": "Private key", "count": 0 }, { "name": "JWT", "count": 0 }, { "name": "Generic secret assignment", "count": 0 } ], "scannedFiles": 26, "includeGitHistory": false }
- Recommendation
- Rotate exposed credentials, remove secrets from source control, and enforce secret scanning in CI.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#3
Suite 6 - Dependency Security
WARN | medium
pnpm audit could not be started on this machine.
- Engine
- Security
- Evidence
- { "tool": "pnpm audit", "output": "spawn EINVAL" }
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#4
Suite 7 - Web Application Security
WARN | medium
Custom web security rules found missing or undiscovered controls.
- Engine
- Security
- Evidence
- { "hasCsp": false, "missing": [ "hasCsp", "hasCorsConfig", "hasCsrfToken", "hasRateLimit", "hasSecureCookie" ], "hasCsrfToken": false, "hasRateLimit": false, "scannedFiles": 25, "hasCorsConfig": false, "hasAuthzChecks": true, "hasSecureCookie": false }
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#5
Suite 8 - API Security
PASS | medium
API security rules found core validation and authorization signals.
- Engine
- Security
- Evidence
- { "missing": [ "hasObjectAuthorization" ], "hasGraphql": true, "openApiFiles": [], "scannedFiles": 26, "hasJwtValidation": true, "hasInputValidation": true, "hasObjectAuthorization": false }
- Recommendation
- Enforce authentication middleware, validate tokens server-side, and add object-level authorization tests.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#6
Suite 9 - Secrets in Git History
WARN | medium
No .git directory found, so historical secret scanning could not run.
- Engine
- Security
- Evidence
- {}
- Recommendation
- Rotate exposed credentials, remove secrets from source control, and enforce secret scanning in CI.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline