Posture
critical
3
high
3
medium
8
low
6
Ownership
Findings (22)
info
S3 bucket publicly readable
SonarQubeSAST
open
9.9
high
SSRF in webhook fetcher
tfsecIaC
triaged
6.5
low
Terraform module pins old AMI with CVEs
SonarQubeSAST
accepted
4.6
medium
Race condition in payment idempotency
TruffleHogSecrets
triaged
4.4
critical
Dependency confusion risk on internal package
CheckmarxSAST
open
4.5
low
Missing rate limiting on /login
Contrast RASPRASP
accepted
6
low
Missing CSP header on auth pages
CheckmarxSAST
false positive
9.4
medium
Open Redis without auth
CheckmarxSAST
open
4.7
medium
Dependency confusion risk on internal package
CheckmarxSAST
open
4.2
critical
Race condition in payment idempotency
TruffleHogSecrets
triaged
5.1
medium
S3 bucket publicly readable
SnykSCA
triaged
8.3
medium
Outdated lodash with prototype pollution
OWASP ZAPDAST
open
6.5
medium
Missing rate limiting on /login
GrypeContainer
accepted
4.7
low
Missing CSP header on auth pages
TruffleHogSecrets
false positive
7.9
high
Race condition in payment idempotency
SemgrepSAST
open
5.2
low
Insecure deserialization in message queue consumer
DependabotSCA
open
9.1
info
Path traversal in file download endpoint
CheckovIaC
open
6.5