Compliance Attestation Report
Framework-oriented control mapping for audit and governance workflows
local-upload/ShiftOps-master | 7/17/2026, 5:28:56 PM
55%
Not Production ReadyRecommendation: Deploy after fixing: Critical findings, Authentication, Secrets.
3Critical
0High
3Medium
0Low
Framework Mapping
| Framework | Mapped Controls | Status |
|---|---|---|
| OWASP Top 10 | A01 Broken Access Control, A05 Security Misconfiguration, A06 Vulnerable Components | Needs Work |
| CIS Controls | Secure configuration, vulnerability management, audit logging | Needs Work |
| NIST CSF | Identify, Protect, Detect, Respond, Recover | Mapped |
| SOC 2 | Security, availability, confidentiality evidence | Needs Work |
| ISO 27001 | Risk treatment, access control, operational security | Partial |
| PCI DSS | Dependency risk, secrets handling, secure transmission | Partial |
| GDPR | Data exposure, access control, retention and privacy signals | Initial |
Control Evidence Summary
#1
Suite 4 - SAST
FAIL | critical
semgrep reported SAST findings.
- Engine
- Security
- Evidence
- { "tool": "semgrep", "output": "spawn EINVAL" }
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#2
Suite 5 - Secret Detection
FAIL | critical
gitleaks reported potential secrets.
- Engine
- Security
- Evidence
- { "tool": "gitleaks", "output": "spawn EINVAL" }
- Recommendation
- Rotate exposed credentials, remove secrets from source control, and enforce secret scanning in CI.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#3
Suite 6 - Dependency Security
FAIL | critical
Dependency audit reported vulnerable packages.
- Engine
- Security
- Evidence
- { "tool": "pnpm audit", "output": "spawn EINVAL" }
- Recommendation
- Upgrade vulnerable dependencies, pin safe versions, and re-run dependency audit.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#4
Suite 7 - Web Application Security
WARN | medium
OWASP ZAP is installed, but no authorized target URL was provided for DAST.
- Engine
- Security
- Evidence
- {}
- Recommendation
- Enforce authentication middleware, validate tokens server-side, and add object-level authorization tests.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#5
Suite 8 - API Security
PASS | medium
API security rules found core validation and authorization signals.
- Engine
- Security
- Evidence
- { "missing": [ "hasObjectAuthorization" ], "hasGraphql": true, "openApiFiles": [], "scannedFiles": 26, "hasJwtValidation": true, "hasInputValidation": true, "hasObjectAuthorization": false }
- Recommendation
- Enforce authentication middleware, validate tokens server-side, and add object-level authorization tests.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#6
Suite 9 - Secrets in Git History
WARN | medium
No .git directory found, so historical secret scanning could not run.
- Engine
- Security
- Evidence
- {}
- Recommendation
- Rotate exposed credentials, remove secrets from source control, and enforce secret scanning in CI.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline