Handles PII
Posture
critical
3
high
2
medium
6
low
4
Ownership
Findings (18)
low
JWT signed with weak HS256 secret
tfsecIaC
accepted
5.3
medium
Missing rate limiting on /login
Burp SuiteDAST
open
9.5
medium
Dependency confusion risk on internal package
SnykSCA
false positive
4.7
high
Unencrypted RDS snapshot
SonarQubeSAST
triaged
6
low
Outdated lodash with prototype pollution
SonarQubeSAST
open
8.3
low
Insecure deserialization in message queue consumer
Burp SuiteDAST
false positive
7.9
high
Race condition in payment idempotency
tfsecIaC
triaged
7.1
medium
Missing CSP header on auth pages
tfsecIaC
triaged
7.4
critical
Excessive Kubernetes RBAC privileges
TrivyContainer
triaged
5.7
info
Path traversal in file download endpoint
Burp Pro PenTestPenTest
triaged
8.6
info
SSRF in webhook fetcher
SemgrepSAST
accepted
5.1
critical
Open Redis without auth
TrivyContainer
open
5.1
medium
Missing CSP header on auth pages
SonarQubeSAST
triaged
5.4
low
Outdated lodash with prototype pollution
CodeQLSAST
triaged
8
medium
SQL Injection in user-input handler
WizCSPM
triaged
8.4