Internet-exposed
Handles PII
Posture
critical
1
high
8
medium
9
low
8
Ownership
Findings (30)
low
Terraform module pins old AMI with CVEs
Burp Pro PenTestPenTest
triaged
9.7
high
Outdated lodash with prototype pollution
SonarQubeSAST
triaged
7.9
medium
JWT signed with weak HS256 secret
tfsecIaC
open
6.5
info
Outdated lodash with prototype pollution
SemgrepSAST
triaged
5.8
medium
Excessive Kubernetes RBAC privileges
CheckovIaC
triaged
8.8
medium
S3 bucket publicly readable
GitleaksSecrets
false positive
8.3
high
Container running as root
TruffleHogSecrets
accepted
7
high
Open Redis without auth
Scout SuiteCSPM
false positive
7.8
medium
Missing rate limiting on /login
Contrast RASPRASP
accepted
5.2
medium
Dependency confusion risk on internal package
OWASP ZAPDAST
false positive
5.3
low
JWT signed with weak HS256 secret
GitleaksSecrets
open
8.8
medium
Cross-site Scripting in profile renderer
Burp SuiteDAST
false positive
4.6
high
Dependency confusion risk on internal package
DependabotSCA
triaged
5.7
high
JWT signed with weak HS256 secret
GrypeContainer
accepted
9.6
info
Path traversal in file download endpoint
SnykSCA
accepted
7.9
high
Unencrypted RDS snapshot
TrivyContainer
open
5.3
low
IAM role with wildcard permissions
Contrast RASPRASP
open
8.9
medium
Excessive Kubernetes RBAC privileges
TrivyContainer
triaged
4.1
low
Race condition in payment idempotency
GrypeContainer
triaged
7.5
medium
Open Redis without auth
GitleaksSecrets
accepted
7.4
medium
SQL Injection in user-input handler
CodeQLSAST
false positive
5.1
low
Open Redis without auth
OWASP ZAPDAST
triaged
7.3
high
Outdated lodash with prototype pollution
DependabotSCA
open
4.6
low
S3 bucket publicly readable
GitleaksSecrets
triaged
8.7
low
Excessive Kubernetes RBAC privileges
TruffleHogSecrets
accepted
7.9