🛡️ Finaisse Security Posture
Where we stand — a live snapshot of the security posture for the Finaisse / Blitz platform (multi-tenant financial SaaS). Drill into any item via the linked GitHub issues.
| Owner | Sekhar Prakash — Security & Infrastructure |
| Last reviewed | 2026-06-24 (iteration 1) · re-verified 2026-07-10 |
| Review cadence | Quarterly + on major architecture change |
| Environments | Staging on Railway (live) · Production being built on AWS ap-south-1 |
| Target framework | SOC 2 (stated target) · India DPDP baseline · ISO 27001 likely |
Pre-production hardening in progress
0 of 20 domains are at target state — 11 have critical gaps, 9 are partial. 6 P0 findings (exploitable now, hitting Restricted data or the tenant/identity boundary) are hard blockers for production go-live. Expected for iteration 1 — the posture exists to drive these to closure before the first production tenant. See Coverage & methodology for which assessment methods have/haven't been run.
Re-verified 2026-07-10 — first fixes landed (mostly infra + frontend)
Resolved: F-13 ALB + TLS (AWS Phase 3 — ACM cert, HTTPS listener, 80→443 redirect); F-36 bun.lock committed + --frozen-lockfile enforced across all Docker/CI builds + reusable lockfile guard (2026-07-18). Progress to partial: F-11 detection (GuardDuty + VPC Flow Logs + WAF in; CloudTrail + Security Hub still out), F-12 IAM scoping, F-18 KMS CMKs, F-22 Identity Center, F-03 SQLi (identifiers constrained; matchstatus/matchtype still raw), F-27 pagination cap. Frontend RBAC route guards now exist (UX layer only — backend RBAC still open). Unchanged (still open): F-01 tenant isolation, F-02 backend RBAC, F-04 CORS, F-08 email XSS, F-25 mass-assignment, F-26 BOLA, F-28 query.token. New (2026-07-18): dependency-CVE counts are now authoritative against the committed lockfiles (F-36 resolved) — blitz 97, blitz-ui 93; and F-37 — no branch protection on main in either code repo (force-push / unreviewed merge possible).
Open security issues by severity
37 open · 1 resolved (F-13) · all tracked with the security label and on the Finboard project. Full list: Findings register →
Owner decisions pending (7): SAST tooling · secret-scan tooling · pentest vendor/budget · SSO provider · SOC 2 target · PCI scope · AWS go-live date — see Open Decisions →. These are cost/vendor/scope calls that gate the work, not engineering tasks.
P0 blockers (must fix before production)
| Finding | What | Tracked by |
|---|---|---|
| F-01 Tenant isolation | Request x-blitz-tenant-id header not bound to JWT claim → cross-tenant data access | blitz#992 |
| F-02 RBAC not enforced | Any authenticated user can post/delete journals, approve payments | blitz#671 · blitz-ui#314 |
| F-03 SQL injection | Unparameterized sourceentity in matching output service | blitz#998 |
| F-04 Permissive CORS | origin:()=>true + credentials on all services incl. admin API | blitz#999 |
| F-25 Mass-assignment | Client sets createdby/approvedby/assignee → impersonation + audit falsification | blitz#1014 |
| F-26 BOLA filter | /filter accepts arbitrary WHERE fields → enumerate any user's data | blitz#1015 |
Domain maturity — 20 domains
🔴 critical gaps · 🟠 partial · 🟢 healthy · 0 🟢 / 9 🟠 / 11 🔴
AWS production go-live gate
Production is gated on must-have controls plus the application P0s above.
| Gate | Status |
|---|---|
| App blockers (tenant isolation, RBAC, SQLi, CORS, MFA) | 🔴 open (F-03 partial) |
| Detection baseline (CloudTrail, GuardDuty, Security Hub, VPC Flow Logs) | 🟠 partial — GuardDuty + Flow Logs in; CloudTrail + Security Hub still out |
| Edge (WAF, ALB + TLS, HTTPS-only) | 🟢 ALB + ACM TLS + 80→443 + WAF in (F-13 ✅) |
| IAM least-privilege + KMS CMKs | 🟠 partial — CMKs + Identity Center in; IAM wildcards remain |
| Independent validation (penetration test) | 🔴 not started |
Full gate: AWS Production Security Gate →
Explore
Other docs: Platform Operations · Architecture · Runbooks
Access & handling
This site is restricted to @finaisse.com (Cloudflare Zero Trust + GitHub Identity) — the same audience that can read the private repos and issues. It is nonetheless internal-confidential: do not share findings, issue links, or screenshots outside Finaisse. Exploit detail lives in the linked issues, not on this site.