Block a user
Executive compliance posture reports
File splitting refactor — no file over 250 lines
Policy-as-Code: custom compliance rules via YAML
SOC2 and ISO 27001 compliance control mappings
CI/CD pipeline gates — block deploys on critical findings
Webhook delivery tracking and retry
Audit logging for security-sensitive operations
Email notification channel for CVE alerts
license_summary and SBOM export fetch entire dataset without limits
Webhook server port is hardcoded to 3002
sort_by query parameter is a NoSQL injection vector
No graceful shutdown — in-progress scans left in running state
get_attack_chain has no pagination — long sessions return unbounded data
Scheduled scans run sequentially — one slow repo blocks all others
CVE monitor loads entire SBOM collection into memory
Graph endpoints load full node/edge collections without pagination
No request body size limit on API and webhook servers
Health endpoint does not verify database connectivity
JWT audience validation disabled — cross-app token reuse