sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity
Files
753ecefaaead1b302f8f881749a4b67f922ab55f
compliance-scanner-agent/control-map/data/cra_control_map.json
T
Sharang ParnerkarandClaude Fable 5 b7534d1123 feat(control-map): deterministic control->scan LUT crate (CRA, 40 controls) 
New standalone crate — the 'transcribing' layer that maps each control to the
static-scan step(s) that check it, or marks it needs_tooling / not_code_checkable.
Authored + human-reviewed: no LLM decides coverage. The LLM only triages the
tool's findings downstream (in the agent), never here.

- ControlMap / ControlEntry / ScanBinding / Coverage types + embedded JSON LUT
- query API: coverage(control), controls_for(tool, cwe), summary()
- CRA LUT: 40 controls -> 9 covered (semgrep/gitleaks/syft/osv) / 16 needs_tooling
  / 15 not_code_checkable
- wired into CI (clippy + test). 4 lib tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-21 10:15:26 +02:00

400 lines
11 KiB
JSON
Raw Blame History

{
"version": "1.0",
"framework": "cra",
"controls": [
{
"control": "cra-ai-1",
"title": "Secure-by-Default-Konfiguration",
"scans": [],
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
"status": "needs_tooling"
},
{
"control": "cra-ai-2",
"title": "Minimale Angriffsflaeche",
"scans": [],
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
"status": "needs_tooling"
},
{
"control": "cra-ai-3",
"title": "Sichere Systemarchitektur",
"scans": [],
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
"status": "needs_tooling"
},
{
"control": "cra-ai-4",
"title": "Least-Privilege-Prinzip",
"scans": [],
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
"status": "needs_tooling"
},
{
"control": "cra-ai-5",
"title": "Manipulationsschutz",
"scans": [],
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
"status": "needs_tooling"
},
{
"control": "cra-ai-6",
"title": "Integritaetspruefung",
"scans": [],
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
"status": "needs_tooling"
},
{
"control": "cra-ai-7",
"title": "Starke Authentifizierung",
"scans": [],
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
"status": "needs_tooling"
},
{
"control": "cra-ai-8",
"title": "Keine Default-Passwoerter",
"scans": [
{
"tool": "gitleaks",
"scan_type": "secret_detection",
"cwe": [],
"rules": []
},
{
"tool": "semgrep",
"scan_type": "sast",
"cwe": [
"CWE-798",
"CWE-259"
],
"rules": []
}
],
"note": null,
"status": "covered"
},
{
"control": "cra-ai-9",
"title": "Sicheres Credential-Management",
"scans": [
{
"tool": "gitleaks",
"scan_type": "secret_detection",
"cwe": [],
"rules": []
},
{
"tool": "semgrep",
"scan_type": "sast",
"cwe": [
"CWE-798",
"CWE-522"
],
"rules": []
}
],
"note": null,
"status": "covered"
},
{
"control": "cra-ai-10",
"title": "Sitzungsmanagement",
"scans": [],
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
"status": "needs_tooling"
},
{
"control": "cra-ai-11",
"title": "Brute-Force-Schutz",
"scans": [],
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
"status": "needs_tooling"
},
{
"control": "cra-ai-12",
"title": "Rollenbasierte Autorisierung",
"scans": [],
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
"status": "needs_tooling"
},
{
"control": "cra-ai-13",
"title": "Verschluesselung sensibler Daten",
"scans": [
{
"tool": "semgrep",
"scan_type": "sast",
"cwe": [
"CWE-327",
"CWE-326"
],
"rules": []
}
],
"note": null,
"status": "covered"
},
{
"control": "cra-ai-14",
"title": "Speicher-Schutz (Data at Rest)",
"scans": [],
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
"status": "needs_tooling"
},
{
"control": "cra-ai-15",
"title": "Transport-Schutz (Data in Transit)",
"scans": [
{
"tool": "semgrep",
"scan_type": "sast",
"cwe": [
"CWE-319",
"CWE-311"
],
"rules": []
}
],
"note": null,
"status": "covered"
},
{
"control": "cra-ai-16",
"title": "Sicheres Schluesselmanagement",
"scans": [
{
"tool": "gitleaks",
"scan_type": "secret_detection",
"cwe": [],
"rules": []
},
{
"tool": "semgrep",
"scan_type": "sast",
"cwe": [
"CWE-798",
"CWE-321"
],
"rules": []
}
],
"note": null,
"status": "covered"
},
{
"control": "cra-ai-17",
"title": "Datenminimierung",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-18",
"title": "Strukturierter SSDLC",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-19",
"title": "Systematische Code Reviews",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-20",
"title": "Automatisierte Sicherheitstests",
"scans": [
{
"tool": "semgrep",
"scan_type": "sast",
"cwe": [
"CWE-89",
"CWE-78",
"CWE-79",
"CWE-22"
],
"rules": []
}
],
"note": null,
"status": "covered"
},
{
"control": "cra-ai-21",
"title": "Supply-Chain-Security",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-22",
"title": "Dependency-Monitoring",
"scans": [
{
"tool": "osv",
"scan_type": "cve",
"cwe": [],
"rules": []
},
{
"tool": "syft",
"scan_type": "sbom",
"cwe": [],
"rules": []
}
],
"note": null,
"status": "covered"
},
{
"control": "cra-ai-23",
"title": "Software Bill of Materials (SBOM)",
"scans": [
{
"tool": "syft",
"scan_type": "sbom",
"cwe": [],
"rules": []
}
],
"note": null,
"status": "covered"
},
{
"control": "cra-ai-24",
"title": "Security-Logging",
"scans": [],
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
"status": "needs_tooling"
},
{
"control": "cra-ai-25",
"title": "Ereignis-Monitoring",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-26",
"title": "Anomalie-Erkennung",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-27",
"title": "Log-Integritaet und -Aufbewahrung",
"scans": [],
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
"status": "needs_tooling"
},
{
"control": "cra-ai-28",
"title": "Sichere Update-Mechanismen",
"scans": [],
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
"status": "needs_tooling"
},
{
"control": "cra-ai-29",
"title": "Update-Authentizitaet",
"scans": [],
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
"status": "needs_tooling"
},
{
"control": "cra-ai-30",
"title": "Update-Integritaet",
"scans": [],
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
"status": "needs_tooling"
},
{
"control": "cra-ai-31",
"title": "Lifecycle-Support",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-32",
"title": "Schwachstellen-Identifikation",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-33",
"title": "SBOM-Pflege und Analyse",
"scans": [
{
"tool": "syft",
"scan_type": "sbom",
"cwe": [],
"rules": []
},
{
"tool": "osv",
"scan_type": "cve",
"cwe": [],
"rules": []
}
],
"note": null,
"status": "covered"
},
{
"control": "cra-ai-34",
"title": "Risikobasierte Priorisierung",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-35",
"title": "Coordinated Vulnerability Disclosure",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-36",
"title": "Incident-Response-Prozess",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-37",
"title": "Fruehwarnung (24h)",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-38",
"title": "Detaillierter Vorfallsbericht (72h)",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-39",
"title": "Patch-Bereitstellung",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
},
{
"control": "cra-ai-40",
"title": "Dokumentation und Nachbereitung",
"scans": [],
"note": "process / document control — outside static-scan scope",
"status": "not_code_checkable"
}
]
}
Reference in New Issue View Git Blame Copy Permalink