Checklist status
| No. | Information or document required | Status |
|---|---|---|
| 1 | Application architecture diagram | Available |
| 2 | Data-flow diagram | Available |
| 3 | Hosting / cloud architecture | Available |
| 4 | Database architecture | Available |
| 5 | API architecture and API documentation | Deferred |
| 6 | List of third-party integrations | Available |
| 7 | Latest Web Application VAPT report | Available |
| 8 | Latest API VAPT / API security assessment report | Available |
| 9 | Vulnerability remediation / closure report | Not available |
| 10 | VAPT retest report, if available | Deferred |
| 11 | Authentication mechanism details | Available |
| 12 | RBAC / authorization matrix | Available |
| 13 | Secure SDLC / secure development process | Available |
| 14 | SAST / DAST / dependency scanning evidence | Available |
| 15 | Cloud / hosting provider details | Available |
| 16 | Network / security architecture | Available |
| 17 | Firewall / WAF controls | Available |
| 18 | IAM and privileged-access controls | Available |
| 19 | Encryption in transit and at rest details | Available |
| 20 | Database security controls | Available |
| 21 | Backup and DR architecture | Available |
| 22 | Logging and monitoring architecture | Available |
| 23 | ISO 27001 certificate, if available | Deferred |
| 24 | SOC 2 Type II report, if available | Deferred |
| 25 | Other independent security audit reports | Not available |
| 26 | Latest infrastructure VAPT report | Not available |
| 27 | Information Security Policy | Available |
| 28 | Incident Response Plan / process | Available |
| 29 | Vulnerability Management process | Available |
| 30 | Patch Management process | Available |
| 31 | Backup / DR policy | Available |
| 32 | Data protection / privacy controls | Available |
| 33 | Third-party / sub-processor list | Available |
| 34 | Security responsibility / shared-responsibility matrix | Available |
| 35 | UAT / staging URL | Deferred |
| 36 | Test user credentials | Deferred |
| 37 | Admin / privileged test credentials, where applicable | Deferred |
| 38 | API documentation and test credentials | Deferred |
| 39 | Written authorization for VAPT | Not available |
| 40 | Testing scope and permitted IP/domain list | Not available |
| 41 | SaaS provider technical point of contact | Deferred |
Items 9, 25, 26, 39, and 40 are marked unavailable because the requested historical closure, audit, infrastructure-assessment, authorization, or scope evidence does not exist. No report has been reconstructed from an unperformed test, and no production security test has been initiated without written authorization and scope.
Item 14 is available on the strength of verified Snyk pull-request security checks and automated AI security-review evidence. Authenticated configuration review confirmed Snyk Open Source and Snyk Code with documented thresholds. DAST remains unavailable, and required merge-gate enforcement still needs administrator-level confirmation.
Applicable-item remediation register
These records relate only to applicable checklist items. Partially available means a verified
control exists but material scope or evidence is absent. Not available means the corrective
control or its verification evidence is absent. Deferred checklist requests remain outside this
register.
Web and API assessment finding remediationNot availableCritical
Present: The internal web assessment records findings WAV-001 through WAV-008. The internal
API assessment records findings API-001 through API-007. Each record includes severity,
identified condition, security effect, remediation instrument, resolution sequence, and closure test
in the Security findings register.
Not present: No finding has an implemented corrective release, internal closure result, or
independent retest result. Checklist item 9 therefore remains Not available and item 10 remains
Deferred.
Remediation instruments: Snyk Open Source and Snyk Code, Supabase Security Advisor, database authorization tests, DOMPurify, Cloudflare security rules, GitHub security controls, OWASP ZAP, API contract tests, Sentry redaction, and software-bill-of-material tooling. The findings register maps the applicable instrument to each finding.
Closure evidence: Corrected release identifier, finding owner, implementation record, internal negative and regression tests, authorised independent retest, and reviewer-approved residual risk.
Authentication hardeningPartially availableCritical
Present: Password authentication, signed access and refresh sessions, tenant-context validation, account-status validation, session refresh, and current-browser sign-out are active.
Not present: MFA enforcement is absent. No enrolled second factors were observed. Leaked-password protection is disabled.
Remediation instruments: Supabase Auth authenticator-app MFA, assurance-level checks in privileged database and server operations, leaked-password protection, and synthetic authentication test accounts.
Resolution: Enable leaked-password screening, enrol privileged users, enforce the higher assurance level for privileged access, define recovery codes and lost-factor handling, and test enrolment, challenge, bypass denial, recovery, and offboarding.
Closure evidence: Redacted provider configuration, factor-enrolment record, denied lower-assurance request, successful higher-assurance request, recovery test, and offboarding test.
Login abuse protectionPartially availableHigh
Present: Supabase Auth supplies managed authentication rate controls. Authentication uses a password and rejects invalid credentials.
Not present: The pre-authentication account-context step has no verified uniform failure, progressive delay, account-specific counter, CAPTCHA, or bot challenge. Distinguishable failures permit context discovery.
Remediation instruments: Uniform application errors, Cloudflare rate-limiting rules, Cloudflare Turnstile or an equivalent challenge, application attempt counters, and alert correlation.
Resolution: Normalise failures and timing, apply per-source and per-account thresholds, add progressive delay and challenge, retain privacy-safe correlation data, and test with synthetic accounts.
Closure evidence: Threshold configuration plus tests for enumeration resistance, rate response, challenge activation, temporary blocking, recovery, and legitimate-user success.
Session governancePartially availableHigh
Present: Signed access and refresh tokens, automatic refresh, foreground revalidation, invalid- session clearing, and current-browser sign-out are active.
Not present: Approved inactivity timeout, maximum session duration, concurrent-session rule, refresh-token reuse response, administrator revocation, and lost-device process are not evidenced.
Remediation instruments: Supabase session configuration and administrative session revocation, server-side session checks for sensitive operations, application inactivity controls, and browser automation for lifecycle tests.
Resolution: Approve the session matrix, configure token and session limits, add administrator revocation and lost-device handling, and revalidate sensitive operations against current server state.
Closure evidence: Tests for idle expiry, absolute expiry, refresh rotation, token reuse, parallel sessions, administrator revocation, profile disablement, foreground resume, and lost-device response.
Source-control merge gatesPartially availableHigh
Present: GitHub pull requests, Snyk Open Source checks, Snyk Code checks, and automated AI review are active development controls.
Not present: Administrator evidence has not confirmed that the protected branch requires the latest build, Snyk results, test results, ownership review, and human approval before merge.
Remediation instruments: GitHub rulesets or protected branches, required status checks, required pull-request reviews, code-owner approval, Snyk PR checks, and merge-queue controls.
Resolution: Define the required check set, require the latest reviewed revision, prevent direct push and force push, restrict bypass, require stale-approval dismissal, and test each rejection path.
Closure evidence: Redacted ruleset export and synthetic pull requests showing failed security, missing approval, stale approval, direct push, and unauthorised bypass are blocked.
Automated security regression gateNot availableHigh
Present: Manual QA, browser-assisted verification, Snyk checks, and AI review provide change feedback.
Not present: One automated pull-request suite covering authentication, tenant isolation, authorization, database policies, migrations, privileged operations, and critical business workflows does not exist.
Remediation instruments: Vitest for application logic, Playwright for browser workflows, pgTAP or database-driven policy tests, contract tests for trusted operations, and GitHub Actions as the gate.
Resolution: Establish deterministic test data, add positive and negative security cases, execute them on every pull request, publish results, and make the successful latest revision a required check.
Closure evidence: Required-check configuration and retained passing plus intentionally failing examples for cross-tenant access, lower-role access, invalid transitions, and migration regressions.
Secret detectionNot availableHigh
Present: Review processes protect known credentials and server-held secrets from public clients.
Not present: A deterministic scanner covering new commits, pull requests, and repository history, with push blocking and a documented response process, is not evidenced.
Remediation instruments: GitHub secret scanning and push protection where plan eligibility allows; Gitleaks as a repository-independent pull-request and history scanner; provider-specific token validation; incident-response records for rotation.
Resolution: Enable default and custom patterns, scan history, triage every alert, revoke exposed values before removal, restrict bypass, and test with a synthetic non-working secret pattern.
Closure evidence: Configuration export, completed history scan, zero unresolved valid alerts, blocked synthetic push, bypass audit, and credential-rotation procedure.
Dynamic application security testingNot availableHigh
Present: Internal static review and unauthenticated local browser smoke testing are complete.
Not present: No authorised DAST run exists for authenticated web or API workflows. Production testing remains prohibited without written authorization and a defined scope.
Remediation instruments: OWASP ZAP Automation Framework or Burp Suite Professional; dedicated non-production environment; synthetic user and administrator accounts; OpenAPI-assisted API scan; central finding export.
Resolution: Approve target domains, accounts, source addresses, techniques, data rules, safety limits, contact, stop conditions, and window; run passive checks first; then execute the authorised authenticated test plan.
Closure evidence: Signed authorization, rules of engagement, scanner plan, scan log, complete report, false-positive decisions, remediation owners, and retest results.
SAST coveragePartially availableHigh
Present: Snyk Code runs on pull requests and reports source-code security issues against configured thresholds.
Not present: The scanner does not analyse every language and generated, configuration, database, or serverless source category. A documented coverage map and secondary scanner for unsupported categories are absent.
Remediation instruments: Snyk Code coverage review, CodeQL or Semgrep for compatible unsupported patterns, database linting, configuration linting, and a maintained source-to-scanner matrix.
Resolution: Enumerate source categories, map each to a scanner, add compatible checks, document intentional exclusions, assign residual risk, and require all applicable results on pull requests.
Closure evidence: Coverage matrix, scan logs for each supported category, reviewed exclusions, synthetic vulnerable examples, and required-check enforcement.
Cloudflare edge security configurationNot availableHigh
Present: Cloudflare Pages delivers the static application over the edge network. Cloudflare provides WAF, rate-limiting, bot, TLS, caching, and response-header capabilities.
Not present: Active production configuration for managed rules, custom rules, rate limits, bot controls, response headers, TLS policy, and cache exclusions has not been inspected or exported.
Remediation instruments: Cloudflare WAF managed rules, custom rules, rate-limiting rules, Turnstile, response-header transform rules, Security Analytics, and production response capture.
Resolution: Export the active rules, map them to routes and threats, add missing protections, stage high-impact rules, define bypass ownership and expiry, and test allow, challenge, block, cache, and header behavior.
Closure evidence: Redacted ruleset export, response-header capture, rule-hit evidence, false- positive test, approved exceptions, and rollback record.
Privileged provider accessNot availableHigh
Present: Provider administration is separated from customer application access, and provider platforms supply role and MFA capabilities.
Not present: Redacted membership, assigned role, MFA, recovery, break-glass, quarterly review, and timely removal evidence is absent for the GitHub, Cloudflare, Supabase, Snyk, and monitoring accounts.
Remediation instruments: Provider member and role exports, provider MFA enforcement, single sign- on where available, password manager or privileged-access vault, access-review register, and break-glass log.
Resolution: Identify every privileged identity, remove shared and dormant access, reduce roles, enforce MFA, protect recovery, document emergency access, and complete a quarterly owner review.
Closure evidence: Redacted membership and role exports, MFA status, access approval, removal test, break-glass exercise, recovery review, and signed quarterly certification.
Database security advisory treatmentPartially availableHigh
Present: Row-level security is enabled across reviewed exposed application data. The managed security advisor is active and currently reports security findings.
Not present: Open advisory categories include exposed privilege-defining operations, mutable function resolution context, row-protected tables without explicit policies, and disabled leaked- password protection. A consolidated owner, treatment, exception, and retest record is absent.
Remediation instruments: Supabase Security Advisor, database catalogue review, RLS Tester, least-privilege grants, stable function resolution configuration, pgTAP authorization tests, and time-bounded risk exceptions.
Resolution: Classify each advisory by intended access, remediate unintended exposure, document intentional deny-all tables, restrict privileged operations, fix resolution context, enable password screening, and rerun the advisor.
Closure evidence: Advisor export without unassigned warnings, approved exceptions with expiry, grant diff, policy tests, direct-operation denial tests, and reviewer sign-off.
Stored-object recoveryNot availableHigh
Present: Managed object storage protects access through bucket and object policies. Database backups protect metadata stored in the database.
Not present: Database backup does not recover deleted object bytes. Object versioning, independent protected copies, retention lock, and a tested object-restore workflow are not evidenced.
Remediation instruments: Provider-supported object versioning where available, or scheduled replication to a separate protected object store; immutable retention for selected evidence; inventory reconciliation between metadata and object copies.
Resolution: Classify recoverable object sets, define retention, create independent copies, protect the recovery identity from normal application deletion, reconcile inventory, and conduct a restore.
Closure evidence: Timed deletion-and-restore exercise, object checksum comparison, metadata link validation, access-control test, retention evidence, and documented unrecoverable exclusions.
Recovery readinessPartially availableHigh
Present: The Supabase Pro entitlement supplies managed daily database backups. Cloudflare retains versioned frontend deployments that support rollback.
Not present: Approved service-specific recovery point and recovery time objectives are absent. No retained timed exercise covers database, stored objects, frontend, provider configuration, and external-transaction reconciliation as one recovery event.
Remediation instruments: Supabase restore workflow, Cloudflare deployment rollback, protected configuration exports, object recovery mechanism, timed runbook, reconciliation queries, and incident command record.
Resolution: Approve objectives by service, define dependencies and authority, prepare validation queries, execute isolated restores, measure each stage, reconcile external side effects, and record gaps.
Closure evidence: Approved objectives, restore logs, measured time and data loss, integrity results, object validation, frontend rollback result, provider reconciliation, and corrective actions.
Logging and alertingPartially availableMedium
Present: Application monitoring, Cloudflare deployment records, Supabase service logs, and application audit records provide diagnostic and security evidence.
Not present: One approved source matrix, retention schedule, security alert catalogue, responder ownership, delivery health check, and end-to-end escalation test is absent.
Remediation instruments: Sentry alerts and data scrubbing, Supabase log drains or current logs interface, Cloudflare security events, application audit queries, on-call notification, and synthetic canary alerts.
Resolution: Catalogue sources and events, approve retention and access, define alert thresholds and owners, correlate identities and transactions safely, monitor delivery failure, and run alert tests.
Closure evidence: Log-source matrix, retention and access approval, alert definitions, synthetic delivery result, acknowledged escalation, incident linkage, and privacy-redaction test.
Vulnerability operationsPartially availableMedium
Present: Vulnerability-management lifecycle, severity targets, Snyk findings, internal assessment findings, and managed security advisories exist.
Not present: One operating register with owner, severity, due date, affected release, exception, retest, closure, and overdue reporting is absent. Historical target performance is unavailable.
Remediation instruments: A restricted vulnerability register in the approved work-management system, Snyk export, Supabase advisory export, assessment import, SLA reporting, and exception workflow.
Resolution: Consolidate validated findings, deduplicate by root cause, assign ownership and due date, record treatment, link corrected release and retest, escalate overdue items, and report trends.
Closure evidence: Complete register, owner acceptance, overdue report, exception approval with expiry, retest result, closure review, and historical SLA metrics.
Patch operationsPartially availableMedium
Present: Snyk identifies vulnerable dependencies and supplies fix guidance. Pull-request review controls changes before release.
Not present: One reproducible component inventory, approved patch cadence, supported-version baseline, emergency-patch path, exception register, and historical patch-age metric is absent.
Remediation instruments: Snyk Open Source, dependency update automation, CycloneDX or SPDX bill of materials, package-manager reproducible install, provider security advisories, and patch-age reporting.
Resolution: Establish the deployed baseline, monitor direct and transitive advisories, schedule routine updates, fast-track active exploitation, test affected workflows, document exceptions, and measure age by severity.
Closure evidence: Deployed inventory, scheduled and emergency examples, scan before and after, regression result, exception record, rollback plan, and patch-age trend.
Incident readinessPartially availableMedium
Present: The incident plan defines severity, roles, triage, containment, eradication, recovery, communication, evidence handling, and post-incident review.
Not present: Current restricted contact tree, tested provider escalation, approved notification templates, and a retained tabletop result are absent.
Remediation instruments: Restricted incident roster, provider support channels, secure incident record, communication templates, tabletop scenario, timer, decision log, and action tracker.
Resolution: Confirm contacts and deputies, test provider escalation, approve templates, conduct a cross-functional scenario, measure decisions and communications, and assign every gap.
Closure evidence: Participant list, timeline, severity decisions, escalation proof, communication drafts, recovery criteria, lessons, owners, dates, and completed corrective actions.
Privacy governancePartially availableMedium
Present: Tenant-scoped access, transport encryption, managed platform encryption, data minimisation controls, supplier inventory, and incident handling provide technical privacy controls.
Not present: Approved processing record, purpose and lawful-basis record, retention schedule, rights-request workflow, transfer assessment, processor terms, and deletion verification are absent or incomplete.
Remediation instruments: Record of processing activities, data inventory and flow map, retention schedule, rights-request register, processor agreement register, transfer assessment, and deletion test protocol.
Resolution: Confirm purpose and data classes, assign legal basis, approve retention and deletion, document rights handling, complete provider terms and transfer review, and test deletion across database, storage, telemetry, and providers.
Closure evidence: Approved records, request simulation, deletion result, retention enforcement, provider confirmation, exception process, and annual review.
Supplier governancePartially availableMedium
Present: The technical provider list records service purpose, data categories, integration boundary, and operational dependency.
Not present: Confirmed contracting entity, region, retention, onward processors, breach contact, notification deadline, audit evidence, exit terms, and annual review are incomplete.
Remediation instruments: Contract and data-processing agreement register, supplier security questionnaire, provider assurance reports, subprocessor notice monitoring, incident-contact register, and exit checklist.
Resolution: Complete the commercial and privacy fields, assess criticality, approve residual risk, monitor material changes, test incident contact, and document credential revocation, export, deletion, and replacement at exit.
Closure evidence: Complete processor register, signed terms, assurance evidence, approved risk, annual review, change-notice record, incident-contact test, and exit evidence.
Policy governancePartially availableMedium
Present: Public Information Security, Incident Response, Vulnerability Management, Patch Management, Backup and Recovery, Privacy, Supplier, and Shared Responsibility documents are available.
Not present: Formal approval, named owner, review history, staff acknowledgement, training, exception register, and periodic control-test evidence are absent from the public evidence set.
Remediation instruments: Controlled policy register, approval workflow, version history, acknowledgement and training records, exception workflow with expiry, and control-testing calendar.
Resolution: Assign owners and approvers, approve the current versions, set review dates, obtain acknowledgement, deliver role-relevant training, record exceptions, and test representative controls.
Closure evidence: Approval, owner, effective date, review date, change history, acknowledgement, training completion, exceptions, control-test results, and corrective actions.