sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity
Files
32abbfb7bbcfdeb3966568ffa6dbb588ab2a8742
compliance-scanner-agent/control-map/data/cra_control_map.json
T
Sharang ParnerkarandClaude Fable 5 32abbfb7bb
CI / Check (push) Skipped
CI / Check (pull_request) Successful in 6m2s
Details
CI / Detect Changes (pull_request) Skipped
Details
CI / Deploy Agent (pull_request) Skipped
Details
CI / Deploy Dashboard (pull_request) Skipped
Details
CI / Deploy Docs (pull_request) Skipped
Details
CI / Deploy MCP (pull_request) Skipped
Details
feat(controls): promote grounded controls to covered + enable LLM passes by default 
The grounded surface path (Stage 5d) is validated live: against an absence-vuln
fixture it flags cra-ai-11 (unprotected login), cra-ai-24 (unlogged admin action),
and cra-ai-28/29/30 (unverified firmware update), each grounded + control-tagged.

- LUT: promote the 8 absence-based controls (cra-ai-6,11,12,24,27,28,29,30)
  needs_tooling -> covered (grounded-control-check binding). CRA coverage is now
  21 covered / 0 needs_tooling / 19 not_code_checkable.
- Enable both advanced LLM passes by default: semantic_mapping (validated in C5)
  and grounded_control_checks (validated here). Both were gated only for cost /
  verification; the GPU is in-house so cost isn't a constraint. Still no-ops
  unless breakpilot base_url is set and the catalog is reachable.
- Gated regression tests (ignored, not run by CI --lib): c5_example2.rs (semantic,
  4 varied vulns) and grounded_surface_live.rs (Stage 5d validation).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-22 09:42:06 +02:00

497 lines
13 KiB
JSON
Raw Blame History

{
"version": "1.0",
"framework": "cra",
"controls": [
{
"control": "cra-ai-1",
"title": "Secure-by-Default-Konfiguration",
"scans": [
{
"tool": "semgrep",
"scan_type": "sast",
"cwe": [],
"rules": [
"cra-ai-1-flask-debug-enabled",
"cra-ai-1-django-debug-true",
"cra-ai-1-tls-verify-disabled",
"cra-ai-1-cors-wildcard"
]
}
],
"note": null,
"status": "covered"
},
{
"control": "cra-ai-2",
"title": "Minimale Angriffsflaeche",
"scans": [],
"note": "design property (minimal attack surface) — not derivable from local code patterns; architecture/threat-model review",
"status": "not_code_checkable"
},
{
"control": "cra-ai-3",
"title": "Sichere Systemarchitektur",
"scans": [],
"note": "design property (secure system architecture) — architecture review, not statically code-checkable",
"status": "not_code_checkable"
},
{
"control": "cra-ai-4",
"title": "Least-Privilege-Prinzip",
"scans": [],
"note": "design property (least-privilege) — deployment/IAM & architecture review, not a local code pattern",
"status": "not_code_checkable"
},
{
"control": "cra-ai-5",
"title": "Manipulationsschutz",
"scans": [],
"note": "design property (tamper protection) — hardware/runtime & operational control, not statically code-checkable",
"status": "not_code_checkable"
},
{
"control": "cra-ai-6",
"title": "Integritaetspruefung",
"scans": [
{
"tool": "grounded-control-check",
"scan_type": "code_review",
"cwe": [],
"rules": []
}
],
"note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
"status": "covered"
},
{
"control": "cra-ai-7",
"title": "Starke Authentifizierung",
"scans": [
{
"tool": "semgrep",
"scan_type": "sast",
"cwe": [],
"rules": [
"cra-ai-7-weak-password-hash"
]
}
],
"note": null,
"status": "covered"
},
{
"control": "cra-ai-8",
"title": "Keine Default-Passwoerter",
"scans": [
{
"tool": "gitleaks",
"scan_type": "secret_detection",
"cwe": [],
"rules": []
},
{
"tool": "semgrep",
"scan_type": "sast",
"cwe": [
"CWE-798",
"CWE-259"
],
"rules": []
}
],
"note": null,
"status": "covered"
},
{
"control": "cra-ai-9",
"title": "Sicheres Credential-Management",
"scans": [
{
"tool": "gitleaks",
"scan_type": "secret_detection",
"cwe": [],
"rules": []
},
{
"tool": "semgrep",
"scan_type": "sast",
"cwe": [
"CWE-798",
"CWE-522"
],
"rules": []
}
],
"note": null,
"status": "covered"
},
{
"control": "cra-ai-10",
"title": "Sitzungsmanagement",
"scans": [
{
"tool": "semgrep",
"scan_type": "sast",
"cwe": [],
"rules": [
"cra-ai-10-session-cookie-insecure",
"cra-ai-10-express-cookie-insecure"
]
}
],
"note": null,
"status": "covered"
},
{
"control": "cra-ai-11",
"title": "Brute-Force-Schutz",
"scans": [
{
"tool": "grounded-control-check",
"scan_type": "code_review",
"cwe": [],
"rules": []
}
],
"note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
"status": "covered"
},
{
"control": "cra-ai-12",
"title": "Rollenbasierte Autorisierung",
"scans": [
{
"tool": "grounded-control-check",
"scan_type": "code_review",
"cwe": [],
"rules": []
}
],
"note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
"status": "covered"
},
{
"control": "cra-ai-13",
"title": "Verschluesselung sensibler Daten",
"scans": [
{
"tool": "semgrep",
"scan_type": "sast",
"cwe": [
"CWE-327",
"CWE-326"
],
"rules": []
}
],
"note": null,
"status": "covered"
},
{
"control": "cra-ai-14",
"title": "Speicher-Schutz (Data at Rest)",
"scans": [
{
"tool": "semgrep",
"scan_type": "sast",
"cwe": [],
"rules": [
"cra-ai-14-python-weak-cipher",
"cra-ai-14-node-weak-cipher"
]
}
],
"note": null,
"status": "covered"
},
{
"control": "cra-ai-15",
"title": "Transport-Schutz (Data in Transit)",
"scans": [
{
"tool": "semgrep",
"scan_type": "sast",
"cwe": [
"CWE-319",
"CWE-311"
],
"rules": []
}
],
"note": null,
"status": "covered"
},
{
"control": "cra-ai-16",
"title": "Sicheres Schluesselmanagement",
"scans": [
{
"tool": "gitleaks",
"scan_type": "secret_detection",
"cwe": [],
"rules": []
},
{
"tool": "semgrep",
"scan_type": "sast",
"cwe": [
"CWE-798",
"CWE-321"
],
"rules": []
}
],
"note": null,
"status": "covered"
},
{
"control": "cra-ai-17",
"title": "Datenminimierung",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-18",
"title": "Strukturierter SSDLC",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-19",
"title": "Systematische Code Reviews",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-20",
"title": "Automatisierte Sicherheitstests",
"scans": [
{
"tool": "semgrep",
"scan_type": "sast",
"cwe": [
"CWE-89",
"CWE-78",
"CWE-79",
"CWE-22"
],
"rules": []
}
],
"note": null,
"status": "covered"
},
{
"control": "cra-ai-21",
"title": "Supply-Chain-Security",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-22",
"title": "Dependency-Monitoring",
"scans": [
{
"tool": "osv",
"scan_type": "cve",
"cwe": [],
"rules": []
},
{
"tool": "syft",
"scan_type": "sbom",
"cwe": [],
"rules": []
}
],
"note": null,
"status": "covered"
},
{
"control": "cra-ai-23",
"title": "Software Bill of Materials (SBOM)",
"scans": [
{
"tool": "syft",
"scan_type": "sbom",
"cwe": [],
"rules": []
}
],
"note": null,
"status": "covered"
},
{
"control": "cra-ai-24",
"title": "Security-Logging",
"scans": [
{
"tool": "grounded-control-check",
"scan_type": "code_review",
"cwe": [],
"rules": []
}
],
"note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
"status": "covered"
},
{
"control": "cra-ai-25",
"title": "Ereignis-Monitoring",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-26",
"title": "Anomalie-Erkennung",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-27",
"title": "Log-Integritaet und -Aufbewahrung",
"scans": [
{
"tool": "grounded-control-check",
"scan_type": "code_review",
"cwe": [],
"rules": []
}
],
"note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
"status": "covered"
},
{
"control": "cra-ai-28",
"title": "Sichere Update-Mechanismen",
"scans": [
{
"tool": "grounded-control-check",
"scan_type": "code_review",
"cwe": [],
"rules": []
}
],
"note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
"status": "covered"
},
{
"control": "cra-ai-29",
"title": "Update-Authentizitaet",
"scans": [
{
"tool": "grounded-control-check",
"scan_type": "code_review",
"cwe": [],
"rules": []
}
],
"note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
"status": "covered"
},
{
"control": "cra-ai-30",
"title": "Update-Integritaet",
"scans": [
{
"tool": "grounded-control-check",
"scan_type": "code_review",
"cwe": [],
"rules": []
}
],
"note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
"status": "covered"
},
{
"control": "cra-ai-31",
"title": "Lifecycle-Support",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-32",
"title": "Schwachstellen-Identifikation",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-33",
"title": "SBOM-Pflege und Analyse",
"scans": [
{
"tool": "syft",
"scan_type": "sbom",
"cwe": [],
"rules": []
},
{
"tool": "osv",
"scan_type": "cve",
"cwe": [],
"rules": []
}
],
"note": null,
"status": "covered"
},
{
"control": "cra-ai-34",
"title": "Risikobasierte Priorisierung",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-35",
"title": "Coordinated Vulnerability Disclosure",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-36",
"title": "Incident-Response-Prozess",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-37",
"title": "Fruehwarnung (24h)",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-38",
"title": "Detaillierter Vorfallsbericht (72h)",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-39",
"title": "Patch-Bereitstellung",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-40",
"title": "Dokumentation und Nachbereitung",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
}
]
}
Reference in New Issue View Git Blame Copy Permalink