Compliance Attestation Report
Framework-oriented control mapping for audit and governance workflows
achieveradarsh/schedula-app-model | 7/30/2026, 4:32:34 PM
68%
Not Production ReadyRecommendation: Deploy after fixing: High-risk controls, Secrets.
0Critical
1High
2Medium
1Low
Framework Mapping
| Framework | Mapped Controls | Status |
|---|---|---|
| OWASP Top 10 | A01 Broken Access Control, A05 Security Misconfiguration, A06 Vulnerable Components | Partial |
| CIS Controls | Secure configuration, vulnerability management, audit logging | Needs Work |
| NIST CSF | Identify, Protect, Detect, Respond, Recover | Mapped |
| SOC 2 | Security, availability, confidentiality evidence | Partial |
| ISO 27001 | Risk treatment, access control, operational security | Partial |
| PCI DSS | Dependency risk, secrets handling, secure transmission | Needs Work |
| GDPR | Data exposure, access control, retention and privacy signals | Initial |
Control Evidence Summary
#1
Suite 14 - Repository Architecture
PASS
Architecture scan found organized repository structure and no obvious layer violations.
- Engine
- Architecture
- Evidence
- { "topLevelDirs": [ "app", "components", "hooks", "lib", "public", "services", "store", "styles", "types" ], "cleanArchitectureSignals": [], "dddSignals": [], "microserviceSignals": [], "layerViolations": [], "scannedFiles": 103 }
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#2
Suite 15 - Frontend Security
FAIL | high
Frontend scan found exposed env, public secret, or dangerous DOM API risks.
- Engine
- Architecture
- Evidence
- { "scannedFiles": 95, "envFiles": [], "exposedEnvFiles": [], "publicSecretNames": 0, "backendUrls": 0, "debugEndpoints": 0, "dangerousDomApis": 1, "hasCsp": false, "sourceMapsEnabled": false }
- Recommendation
- Rotate exposed credentials, remove secrets from source control, and enforce secret scanning in CI.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#3
Suite 16 - Backend Security
WARN | medium
Backend scan found missing or undiscovered security controls.
- Engine
- Architecture
- Evidence
- { "hasMiddleware": false, "hasValidation": true, "hasAuthentication": false, "hasAuthorization": false, "hasLogging": true, "hasRateLimiting": false, "hasExceptionHandling": true, "scannedFiles": 5, "missing": [ "hasMiddleware", "hasAuthentication", "hasAuthorization", "hasRateLimiting" ] }
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#4
Suite 17 - Data Layer
WARN | medium
Data layer scan found missing ORM, pooling, or encryption signals.
- Engine
- Architecture
- Evidence
- { "hasOrm": false, "rawSqlConstruction": 0, "hasPooling": false, "hasEncryption": true, "databaseExposure": 0, "scannedFiles": 105 }
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#5
Suite 18 - Cloud Architecture
WARN | low
No AWS, Azure, or GCP architecture artifacts were found.
- Engine
- Architecture
- Evidence
- {}
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline