Audit & Assessment Log

Owner	Classification	Version	Effective	Next review	Status
Sekhar Prakash	Internal	0.2	2026-08-27	2026-11-27	Draft

Purpose. Chronological record of every security assessment performed against the platform — internal reviews, automated scans, and independent audits — with scope, outcome, and a link to the source report or issue. This is the authoritative history of what has been assessed, when, and by whom. Assessments predating this portal (January–June 2026) were recorded in the architecture and blitz repositories; they are included here to preserve the continuous timeline. See Programme History.

How to read

Each row is one assessment event. "Result" summarises the outcome; the linked report or issue holds the detail. Recurring/verification passes are listed as separate dated rows to preserve the timeline. Planned assessments are listed with status ⚪ until performed.

Assessment log

Date	Assessment	Type	Scope	Assessor	Result	Report / issue	Status
2026-09-23/24	F-25 runtime re-measurement + F-48 verification	Runtime scan (all 429 controllers imported, resolved schemas) · code trace · runtime probes	blitz origin/main @ 03ea2f713 / 0313548ab	Internal	F-25: 55 old routes fixed/disproved; real scope 39 Tier-1 + 2 Rule-3 (P0) and 47 Tier-2 (→ F-54); lint:security R1/R5 moved to the runtime scan with fail-loud on incomplete scans. F-48 resolved (bypass keyed on id; signup gated; verified at runtime). ➕ F-53 raised (SSO binding, P1)	blitz#1014 · blitz#1559 · blitz#1573	🟢
2026-09-15	P1 re-verification pass	Manual review · code trace · bun audit	12 open P1 security issues across blitz origin/main @ 78f1bde2, blitz-ui @ 4f6e16e3, fin-infra main	Internal	0 of 12 P1s fixed. ✅ GCP key regeneration confirmed (F-34/F-35 Open→Partial) — credential dead; blobs remain in both histories, .gitleaks.toml still absent in both repos, LinkedIn client id/secret rotation unconfirmed, and restrictions on the new key unverified (it is a client-side build var, so restrictions are the durable control). ⚠️ F-30 regressed 93→161 CVEs (2→4 critical) — drift went unnoticed because SCA is still not in CI (D14-02). F-42 reachability CONFIRMED by code trace — source_filter is t.Any() on tenant-authenticated write routes reaching raw SQL; severity held at P1. F-07 corrected — the 2026-09-09 'no longer cookies' note was half the system: blitz-ui still writes tokens to JS-readable cookies (~16 sites), access token 24h not the 5-min target, refresh never invalidated. F-28 root cause widened — the app logs tokens itself (signin.controller.ts:252 full refresh token at INFO; authenticator.ts:219 unredacted bearer; no pino redact anywhere), so removing ?token= does not close the leak; folded into blitz#1017 rather than filed separately. F-10 widened to three production TLS call sites. F-05 scoping answered — static headers can move to the edge, CSP cannot. Evidence comments posted to all 12 issues	Findings	🟢
2026-09-15	CI control-set change	Control review	blitz, blitz-ui, fin-infra	Internal	Lockfile guard + import guard withdrawn after efficacy review: 504 runs / 1 genuine catch (0.2%) and 312 runs / 0 catches respectively, at ~750 billed min/month. Org ruleset DefaultBranchProtection required_status_checks rule removed — branch protection (PR required, no force-push, no deletion) unchanged. bun audit added to each repo's weekly Dependency Health workflow (blitz gated at critical; blitz-ui report-only pending triage of 161 CVEs). Dead backport.yml / cherry-pick-ancestry-check.yml deleted (0 useful runs). Net: no merge-blocking security check remains; SCA moves from absent to weekly non-blocking	Control Register	🟢
2026-09-10	Posture reconciliation + independent GRC review	Manual review · live issue query · gitleaks	blitz, blitz-ui, fin-infra main; docs portal	Internal	P0 8→4 — F-01 (tenant binding), F-03/F-39 (SQLi), F-40 (password hashing) verified fixed in code and closed. F-42 raised (recon.filter.ts raw-SQL passthrough). D7 re-scored 🔴→🟠. F-34 + F-35 re-confirmed by gitleaks across both full histories (blitz-ui 2036 commits → 8 hits; blitz 2785 commits/809 MB → 39 hits — counts match the register exactly). The GCP API key is the same credential in both repos (verified by hash comparison): blitz-ui src/apps/ui/.env.production @ 102da79 and blitz railway-iac/shared/variables.ts @ 71f9f15. Both removed from HEAD, both still reachable in history. LinkedIn client id/secret pairs recorded as a second exposed credential class. Programme-level gaps recorded: risk register unpopulated, evidence register empty, no threat model, controls.yml not built	Findings	🟢
2026-08-26	Posture re-verification	Manual review	blitz origin/main	Internal	P0 count 5→8; F-39/40/41 confirmed; F-38 risk-accepted	Findings	🟢
2026-08-06	Posture re-verification	Manual review	blitz origin/main	Internal	F-02 backend RBAC resolved; F-25 reopened; F-38 raised	Findings	🟢
2026-07-18	Dependency lockfile remediation	SCA	3 repos	Internal	F-36 resolved; lockfile guard added; CVE baseline 190	blitz#1104	🟢
2026-07-10	Posture re-verification	Manual review	blitz origin/main	Internal	F-13 (ALB/TLS) resolved; partial progress on 6 items	Findings	🟢
2026-Q3	Dependency scan	SCA (bun audit)	blitz, blitz-ui	Internal	190 CVEs (blitz 97, blitz-ui 93) vs committed lockfiles	fin-infra#40	🟠 ad-hoc
2026-Q3	Secret scanning	Secret scan (gitleaks)	git history, 3 repos	Internal	blitz 39, blitz-ui 8 hits; real GCP keys → rotate	blitz#1019	🟠 ad-hoc
2026-Q3	IaC scan	IaC (Snyk)	fin-infra Terraform	Internal	0 critical/high, 3 medium (SG ingress ×2, RDS IAM)	fin-infra#40	🟠 ad-hoc
2026-Q3	Container image scan	Image (Trivy)	base images	Internal	oven/bun:slim 1C/7H; images unpinned	fin-infra#35	🟠 ad-hoc
2026-04-07	Authentication & access-control review	Design review	Auth/IAM	Internal	Access strategy defined (BetterAuth; SSO decision open)	FINAISSE-AUTH-STRATEGY (pre-portal)	🟢
2026-03-11	Backend security posture assessment	Manual review	blitz backend	Internal	Baseline posture; critical — no input sanitisation before LLM calls	SECURITY-POSTURE (blitz)	🟢
2026-01-22	Platform security & performance assessment	Manual review	platform	Internal	Initial assessment; RBAC/pagination findings raised (F-25–F-28)	SECURITY-AND-PERFORMANCE-GAPS (pre-portal)	🟢
—	SAST	Code (CodeQL/Semgrep)	3 repos	Pending	Not yet run	fin-infra#40	⚪ planned
—	DAST	Runtime (ZAP)	staging	Pending	Not yet run	—	⚪ planned
—	Cloud posture (CSPM)	Prowler / Security Hub	AWS	Pending	Enabled at AWS go-live	—	⚪ planned
—	Independent penetration test	3rd-party	full platform	Pending	Vendor/budget decision open	fin-infra#39	⚪ planned

Re-verification pass notes

Per-pass notes from each manual re-verification (relocated from the Findings Register 2026-08-27 so the register holds current state only). Each against origin/main.

2026-08-26 — P0 count 5 → 8

• New P0s:
  • F-39 — 2nd SQL injection, $queryRawUnsafe incl. ORDER BY
  • F-40 — weak password hashing (salted SHA-256, no KDF)
  • F-41 — no signin brute-force protection
• Closed, risk-accepted (not fixed): F-38 Temporal tenant-scoping — reactivates when RBAC is seeded
• Still open, unchanged: F-01, F-03, F-04, F-25, F-26

2026-08-06 — biggest app-P0 movement

• Resolved: F-02 backend RBAC — server-side requirePermission (403 by default), catalogue + grants seeded
• Partial: F-25 (create path fixed; update path still client-settable — reopened) · F-03 (validated except sourceentity)
• New: F-38 (Temporal visibility not tenant-scoped — latent)
• Still open: F-01 · F-26

2026-07-18 — dependency integrity

• Resolved: F-36 — bun.lock committed + --frozen-lockfile across all builds; a reusable lockfile guard was added to block regressions (withdrawn 2026-09-15 — see the Control Register) (blitz#1104, blitz-ui#715/#716, fin-infra#53/#54)
• New: F-37 (no branch protection on main in blitz / blitz-ui)
• Note: authoritative CVE counts vs committed lockfile — blitz 97, blitz-ui 93 (190 total); F-29/F-30 updated

2026-07-10

• Resolved: F-13 (ALB/TLS)
• Partial progress: F-03, F-11, F-12, F-18, F-22, F-27; frontend RBAC route guards added (backend F-02 still open)

Source of detail

Assessment methodology and lens coverage are defined in Coverage & Methodology. Individual findings are tracked in the Findings Register; formal audit reports (SOC 2, SOC 1) will be linked here once available.

Related

• → Coverage & Methodology — assessment lenses and gaps
• → Findings Register — findings produced by these assessments
• → Framework & Cert Register — external audit/certification track

Revision history

Version	Date	Author	Change
0.1	2026-08-27	Sekhar Prakash	Initial log seeded from coverage history.

Finaisse Internal — Confidential. Not for external distribution.