# StratoFusion CASA Tier 2 Readiness Evidence Pack Last updated: 2026-08-25 Status: local engineering candidate ready for authorized evidence collection; assessor submission is a no-go while external prerequisites remain open. All locally applicable gates pass, with 28 controls classified local pass, 8 partial, 12 evidence required, and 0 blocked. Production Clerk authenticator and backup-code strategies are enabled, both configured administrators are enrolled, and the current second-administrator session rendered the protected production admin boundary. A redacted missing/malformed/unverified `fva` rejection trace remains open. The candidate now enforces a 10-minute maximum second-factor age, with deployment and stale-claim runtime evidence pending. Production deployment/recheck and credential-backed active testing also remain open; Google deadline confirmation is tracked operationally but is not a release gate under the product owner's current direction. This document does not claim certification, verification, an LoV, or a guaranteed pass. Current decision/evidence sources: - [Google OAuth and CASA Engagement, 2026-08-03](./GOOGLE_OAUTH_CASA_ENGAGEMENT_2026-08-03.md). - [CASA v2.1.1 48-test Control Matrix](./CASA_V2_1_1_CONTROL_MATRIX_2026-08-03.md). > Evidence-date notice: sections that explicitly say 2026-05-13 are retained as > historical evidence from before the OVHcloud cutover. The 2026-08-03 > engagement and control matrix above supersede their status conclusions. > References to the former shared-development hostname or its OAuth client are > also point-in-time audit evidence, not current deployment instructions; use > the shared-development retirement runbook for current status. ## Official Sources Checked - App Defense Alliance CASA overview: https://appdefensealliance.dev/casa. - CASA requirements: https://appdefensealliance.dev/casa/casa-requirements. - CASA tiering: https://appdefensealliance.dev/casa/casa-tiering. - CASA assurance levels: https://appdefensealliance.dev/casa/casa-tiering. - CASA authorized assessors: https://appdefensealliance.dev/casa/casa-assessors. - CASA v2.1.1 specification: https://github.com/appdefensealliance/ASA-WG/blob/main/CASA/CASA%20Specification.md. - CASA v2.1.1 test guide: https://github.com/appdefensealliance/ASA-WG/blob/main/CASA/CASA%20Test%20Guide.md. - Google OAuth restricted scope verification: https://developers.google.com/identity/protocols/oauth2/production-readiness/restricted-scope-verification. - Google OAuth API scope catalog: https://developers.google.com/identity/protocols/oauth2/scopes. ## Assessment Scope The audit covered the Next.js app, public API routes, provider OAuth/token handling, upload/download session flows, the OVHcloud VM rclone worker and stopped Fly.io recovery configuration, security headers, dependency posture, deployment supply chain, and repository security-audit scripts. Inventory notes: - `src/app/api` contains 117 route handlers. - The centralized request-integrity scan identifies 71 route modules exporting a mutating API method. - Middleware intentionally keeps broad public matchers for provider, rclone, cron, webhook, and event routes, so sensitive handlers need route-level authentication and ownership checks. - The local security-audit scripts are under `scripts/security-audit/`. - The restricted Google Drive scope used by full cloud storage operations is `https://www.googleapis.com/auth/drive`. ## CASA/ASVS Audit Plan | Area | ASVS/CWE focus | Evidence reviewed | | -------------------------------- | ---------------------------------------- | ---------------------------------------------------------------------------------- | | Authentication and authorization | ASVS V2/V4, CWE-862, CWE-863, CWE-639 | Middleware, route handlers, Clerk role helpers, operation ownership checks | | OAuth and token protection | ASVS V2/V3/V8, CWE-312, CWE-522, CWE-532 | Token encryption, token refresh, service-account persistence, logging | | Google restricted scope use | ASVS V1/V2/V8, CWE-200 | OAuth scope builder, Drive upload/download/copy/delete/search routes, privacy docs | | API input validation and errors | ASVS V5/V7/V11, CWE-20, CWE-79, CWE-209 | Provider routes, download sessions, delete flow, debug routes, audit scanners | | rclone/Fly service | ASVS V5/V9/V12, CWE-78, CWE-200 | Fly auth middleware, rclone command construction, operation status/cancel APIs | | Upload/download sessions | ASVS V4/V8/V13, CWE-639, CWE-613 | Session route handlers, signed Fly download/upload URL creation | | Headers/platform config | ASVS V14, CWE-693, CWE-1021 | `next.config.js`, `vercel.json`, public docs exposure | | Data retention and logging | ASVS V7/V8/V10, CWE-532 | Operation logs, audit logs, AI/indexing docs, token scrubbers | | Dependency scanning | ASVS V14.2, CWE-1104 | `pnpm audit`, direct dependency upgrades, overrides | ## Findings | Status | Severity | Finding | Mapping | Affected files | Resolution | | ------------------------------------------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Fixed locally | Critical | Clerk middleware and Next.js advisories were present in lockfile dependencies. | CASA 6.1.1, CWE-1104 | `package.json`, `pnpm-lock.yaml` | `next` resolves to 15.5.21; Sharp, PostCSS, brace-expansion, UUID, esbuild, and Babel transitive advisories are patched. `pnpm audit --prod` reports no known vulnerabilities. | | Fixed | High | Production dependencies had high audit findings in Drizzle and glob tooling paths. | ASVS 14.2, CWE-1104 | `package.json`, `pnpm-lock.yaml` | Upgraded `drizzle-orm` to `^0.45.2`; added PNPM overrides for vulnerable transitive production packages. `pnpm audit --prod` is clean. | | Fixed | High | `/dev/docs` was publicly allowlisted, exposing an internal route namespace in production. | ASVS 4.1/14.4, CWE-862 | `src/middleware.ts`, `src/lib/public-routes.ts`, docs routes/components | Public docs now render under `/docs`; `/dev/docs` is no longer public and remains protected by dev role middleware. | | Fixed | Medium | Debug/service-health handlers relied on middleware without route-level role checks. | ASVS 4.1, CWE-862, CWE-200 | `src/app/api/debug/file-id-lookup/route.ts`, `src/app/api/dev/rclone-health/route.ts` | Added authenticated dev-or-admin checks and sanitized error responses. | | Fixed | Medium | Download-session route could rely on downstream token resolution instead of explicit caller auth. | ASVS 4.1/8.3, CWE-639 | `src/app/api/download/session/route.ts` | Added explicit 401 before provider-token lookup. | | Fixed | Medium | Delete and delete-stream flows could return raw provider errors to clients. | ASVS 7.4/8.3, CWE-209, CWE-532 | `src/app/api/delete/*`, `src/lib/security/error-sanitizer.ts` | Added explicit auth and centralized user-facing error sanitization. | | Fixed | Medium | Core web security headers were incomplete. | ASVS 14.4, CWE-693, CWE-1021 | `next.config.js`, `vercel.json` | Added HSTS, CSP frame/object/base restrictions, X-Frame-Options, nosniff, Referrer-Policy, and Permissions-Policy. | | Fixed | Low | Local security-audit scripts produced false positives for static JSON-LD and local Codex caches. | ASVS 14.2 | `scripts/security-audit/*` | Allowlisted static `JSON.stringify` JSON-LD and excluded local cache/build folders. OAuth client IDs are documented as public identifiers, not secrets. | | Fixed locally; production evidence partial | High | Admin routes required role but did not require signed second-factor session evidence. | CASA 3.3.1, ASVS V2/V4 | `src/lib/auth/admin-access-policy.ts`, admin middleware/layout/API routes | All admin boundaries fail closed unless Clerk `fva[1]` records second-factor verification within 10 minutes. Both configured admins are enrolled and a current admin session rendered the protected production boundary; deployed stale/missing/unverified rejection evidence remains open. | | Fixed locally | High | Account-scoped browser data could remain after application or Clerk-hosted sign-out. | CASA 6.6.1, CWE-922 | `src/lib/auth/browser-logout.ts`, `ServiceManagerContext`, `AuthWrapper` | Logout clears all app-origin local/session storage and deletes encrypted provider tokens while deliberately preserving connected-account metadata and user preferences; Clerk invalidation evidence remains open. | | Fixed locally | High | Mutating API routes lacked one fail-closed, API-wide cross-origin request-integrity boundary. | CASA 3.1.5, CWE-352 | `src/lib/auth/request-integrity.ts`, `src/middleware.ts`, authorization scan | All 71 mutating route modules are covered before handler dispatch; cross-site/sibling-origin and unverifiable cookie-bearing mutations return non-cacheable `403` responses. Credentialless machine endpoints retain handler authentication. | | Fixed locally | High | Cross-user negative evidence was incomplete across resource families. | CASA 3.1.1/3.1.2/3.1.4, CWE-639 | service-account, job, operation, and indexing route tests | Two-user tests reuse identifiers and prove foreign identities cannot reach provider, worker, or mutation calls. | | Fixed locally | High | OpenXML extraction relied on parser behavior without a pre-decompression package-expansion policy. | CASA 5.2.1, CWE-409/CWE-22 | DOCX/XLSX/PPTX extraction and package-guard tests | Central-directory metadata is validated before parsing, with entry, expansion, ratio, encryption, ZIP64, path, and consistency limits. | | Fixed locally | High | Worker traversal validation did not canonicalize nested encodings and Unicode/mixed separators first. | CASA 5.1.10, CWE-22 | worker validation middleware and tests | Bounded decoding, residual-encoding rejection, NFKC/slash canonicalization, and drive/UNC/system-path checks run before rclone launch. | | Fixed locally | High | Configured worker targets and download proxy redirects allowed a broader outbound-request surface than required. | CASA 5.1.5, CWE-918 | rclone URL helper and download stream route | Remote targets require public pathless HTTPS, the fixed loopback development target is explicit, tokens are bounded, and upstream redirects are refused. DNS-rebinding DAST remains open. | | Fixed locally | Medium | Provider-supplied SharePoint URLs were rendered directly into an external anchor. | CASA 5.1.4/5.1.7, CWE-79/CWE-601 | SharePoint sites component and safe URL helper | Links render only for credential-free, port-free HTTPS `sharepoint.com` hosts; unsafe values render no anchor. | | Partially resolved; deploy pending | High | Production now serves the configured security headers and `/dev/docs` returns only the authenticated-app initializer to an anonymous client. Production `/robots.txt` and `/sitemap.xml` still redirect to sign-in. | CASA 3.1/4.1/6.2, CWE-862, CWE-693 | OVH production and uncommitted crawler-route work | Deploy the already-present public crawler routes after approval, then repeat crawler and anonymous docs checks. | | Fixed locally; deploy pending | High | Direct-provider OAuth `state` was unsigned JSON and carried the popup user ID. | CASA 3.2.2, CWE-352 | `src/lib/oauth-state.ts`, provider callback routes and tests | HMAC-SHA256 signature, random nonce, ten-minute expiry, strict schema, authenticated popup binding, and fail-closed callback handling implemented. Deploy and perform provider E2E callbacks. | | Monitored development-only risk | High/Low | Full `pnpm audit` reports two high `image-size` and one low `elliptic` advisory only below `@storybook/nextjs`; upstream lists no patched version. | CASA 6.1.1, ASVS 14.2, CWE-1104 | non-deployed Storybook dependency tree | Both production graphs audit at zero. Reachability, compensating controls, owner, and review date are recorded in private Phase 1 evidence; no assessor acceptance is claimed. | | Needs assessor clarification | Medium | Several legacy API routes still return provider or library error strings in some failure paths. | ASVS 7.4, CWE-209 | broad `src/app/api` surface | Highest-risk debug/delete/download flows were fixed. A full API-wide error contract migration should be completed or accepted by the lab as residual risk. | | Historical evidence captured | Medium | Live database scoping/encryption checks previously lacked environment-specific evidence. | ASVS V4/V8 | `scripts/security-audit/01-token-encryption.ts`, `06-db-security-check.ts` | Re-run on 2026-05-13 with private, untracked local, former-development, and production `DATABASE_URL` values. Token encryption and DB ownership checks passed at that time; the shared environment is now retired. | | Evidence captured | Medium | Actual Google Cloud OAuth consent-screen scopes must be verified against production project configuration. | ASVS V1/V2/V8 | Google Cloud Console, OAuth video/demo evidence | Google Auth Platform evidence was captured for project `statafusion`/`StratoFusion`: verified branding, authorized domains, audience status, OAuth clients list, and data-access scopes. No client secrets were opened or exported. | ## Environment Matrix | Environment | App URL / entry point | Application runtime | Rclone URL/status | Database source | Audit mode | | ------------------ | ------------------------------------------- | ------------------------------------------ | ------------------------------------------ | ---------------------------- | ------------------------------------------------- | | Local | `http://localhost:3000` | local Node.js | `http://localhost:3001` | local PostgreSQL | Read-only by default | | Local VM rehearsal | operator-selected local address | documented local VM | local VM worker | isolated local-VM PostgreSQL | Read-only by default | | CI | test runner | ephemeral validation | mocked or ephemeral | isolated test database | deterministic automated checks | | Temporary staging | explicitly approved migration/rehearsal URL | time-bounded, exact-release rehearsal only | explicitly approved rehearsal worker | isolated rehearsal database | approval-specific | | Production | `https://stratofusion.io` | OVHcloud VM Compose | `https://rclone.stratofusion.io` on the VM | Compose PostgreSQL | Read-only unless an approved test requires writes | `DATABASE_URL` handling on 2026-05-13: `.env.local`, `.env.development`, and `.env.production` were present, untracked, and contained distinct database URLs. Values were loaded only into the current PowerShell process for audit commands and were not printed, committed, screenshotted, or copied into this evidence pack. Production `DATABASE_URL` was used only for read-only token-encryption and ownership checks after explicit approval. ## Architecture and Data Flow Summary StratoFusion is a Next.js SaaS app backed by Clerk authentication, PostgreSQL, and an rclone worker. Current production runs the app, PostgreSQL, and worker in the OVHcloud VM Compose stack. Browser code talks to Next API routes. Next resolves the authenticated Clerk user, enforces that user's account boundary, and calls provider SDKs or the authenticated rclone service. The worker performs data-plane transfers; Next and PostgreSQL retain operation metadata, status, and bounded logs. Stopped Fly apps preserve the previous deployment only. Provider-specific IDs and paths are adapted into canonical app models before UI rendering. Business behavior remains in route handlers, services, domain utilities, and provider adapters rather than render-only UI components. ## OAuth Token Handling Summary - Provider OAuth tokens are stored server-side and encrypted at rest through `src/lib/security/token-encryption.ts`. - Browser code receives operation/session metadata, not provider refresh tokens, access tokens, client secrets, or rclone configs. - Token refresh runs server-side through shared auth/token-refresh helpers. - Operation logging scrubs sensitive keys and now sanitizes high-risk public error responses in delete/download/debug flows. - Dev token inspection endpoints require server-side dev-or-admin checks and do not return raw token values. ## Google Drive Restricted-Scope Data Use StratoFusion uses Google Drive access for user-authorized file listing, search, upload, download, copy, move, delete, backup, and sync operations. Google’s scope catalog describes `https://www.googleapis.com/auth/drive` as full Drive file access, so privacy and security evidence must clearly tie this restricted access to user-requested cloud storage operations. Current posture: - Drive operations are initiated by authenticated users or authenticated scheduled jobs tied to the user/account boundary. - Disconnect/reconnect and token-clear flows are present in auth/provider handling and documented in privacy/security docs. - Privacy architecture docs describe metadata/content handling and the rclone/Fly data plane. - Exact Google scope requested in the app code: `https://www.googleapis.com/auth/drive`, via `src/lib/oauth/scope-builder.ts` and `src/config/services/google.config.ts`. - Production privacy policy and privacy architecture pages were reachable on 2026-05-13 at `/legal/privacy` and `/docs/privacy-architecture`. - Google Cloud Console evidence was captured on 2026-05-13 from the Google Auth Platform project `statafusion`/`StratoFusion`. - Final submission should include the captured Google Cloud screenshots plus demo video coverage. This pass did not open OAuth client detail pages and did not export client secrets. ## Google OAuth Console Evidence Captured non-secret evidence files are under `output/playwright/casa-google-oauth/`: | Evidence | File | | ---------------------------------------------------------------- | --------------------------------------- | | Branding, app name, support email, verification status, app URLs | `01-google-auth-branding.png` | | Authorized domains and developer contacts | `02-google-auth-branding-domains.png` | | Data access and exact scopes | `03-google-auth-data-access-scopes.png` | | OAuth clients list | `04-google-auth-clients-list.png` | | Audience, publishing status, user type, OAuth user cap | `05-google-auth-audience.png` | Console facts captured: - Project/application: `StratoFusion` in Google Cloud project `statafusion`. - Branding verification status: verified and being shown to users. - Application home page: `https://stratofusion.io`. - Privacy policy: `https://stratofusion.io/legal/privacy`. - Terms of Service: `https://stratofusion.io/legal/terms`. - Authorized domains: `accounts.dev`, `stratofusion.io`. - Publishing status: in production. - User type: external. - OAuth clients visible: `stratofusion-prod`, `stratofusion-dev`, and `stratofusion-local`, all type `Web application`, created 20 Mar 2026. - Non-sensitive scopes visible: `.../auth/userinfo.email`, `.../auth/userinfo.profile`, and `openid`. - Sensitive scopes: no rows displayed. - Restricted Drive scope visible: `.../auth/drive`, described by Google as "See, edit, create and delete all of your Google Drive files". - Restricted-scope use selection: "Drive sync client, Drive productivity and Drive backup". ## Rclone Worker Security Summary - Fly service routes require service-to-service auth except documented public health/docs/stream endpoints. - rclone execution paths use argument arrays and are scanned for `shell: true` or template-literal command execution. - Worker paths are decoded and canonicalized before traversal, drive/UNC, null, and system-path rejection; the regression corpus proves no rclone launch is reached for those inputs. - Temporary rclone configs are lifecycle-managed and covered by Fly audit checks. - Operation status/cancel routes require authenticated user ownership checks before returning or mutating operation data. - rclone commands must continue to default to `--dry-run` unless an approved user task explicitly authorizes non-dry-run destructive behavior. ## Security Headers Summary Configured in both `next.config.js` and `vercel.json`: - `Strict-Transport-Security: max-age=63072000; includeSubDomains; preload`. - `Content-Security-Policy` with `base-uri 'self'`, `object-src 'none'`, `frame-ancestors 'none'`, and restricted `form-action`. - `X-Frame-Options: DENY`. - `X-Content-Type-Options: nosniff`. - `Referrer-Policy: strict-origin-when-cross-origin`. - `Permissions-Policy` disables camera, microphone, geolocation, payment, USB, and browsing topics. - `Cross-Origin-Opener-Policy: unsafe-none` remains because OAuth popup compatibility requires it; OAuth state and same-origin BroadcastChannel handling remain the compensating controls. Deployed verification on 2026-05-13: - Local `localhost:3000` responses included the configured header set, but the already-running dev server returned `500` for public pages after `.next` cleanup during typecheck. Local `/dev/docs` returned `307`, consistent with protection. - `https://dev.stratofusion.io` and `https://stratofusion.io` returned only `Strict-Transport-Security` from the expected header set. `X-Content-Type-Options`, `X-Frame-Options`, `Referrer-Policy`, `Permissions-Policy`, and `Content-Security-Policy` were missing on deployed responses. - `/docs` returned `200` on production as expected. `/dev/docs` returned `200` on both deployed dev and production, so deployed internal-docs exposure must be remediated before lab submission. ## Current Verification Results (2026-08-25) | Command/check | Result | | ----------------------------------- | ---------------------------------------------------------------------------------------------------- | | Frozen root and worker installs | Pass; lockfiles current. | | `pnpm env:guard` | Pass; native PowerShell confirmed and WSL rejected by policy. | | `pnpm check` | Pass. | | Full `pnpm test` | Pass; 558 files and 3,687 tests passed, 37 intentionally skipped. | | Full worker tests | Pass; 32 suites and 239 tests passed. | | `pnpm build` | Pass; production compile/generate completed with 100 static pages. | | Credential-free production-mode E2E | Pass; 3 tests. | | Credential-backed E2E | Not complete; 8 tests safely skipped without isolated auth/service prerequisites. | | `pnpm casa:security` | Pass; zero production advisories, six scans, SBOM/deploy/handoff guards green. | | Current control classification | 28 local pass, 8 partial, 12 evidence required, 0 blocked; production Clerk MFA evidence is partial. | ## Historical Verification Results (2026-05-13) Run locally on Windows 11 with PowerShell and PNPM: | Command | Result | | ----------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `pnpm env:guard` | Pass; warned that bare `bash` resolves to WSL and Git Bash is available explicitly. | | `pnpm install --frozen-lockfile` | Pass; lockfile already up to date. | | `pnpm lint` | Pass. | | `pnpm typecheck` | Pass. | | `pnpm audit --prod` | Pass; no known production vulnerabilities. | | `pnpm exec tsx scripts/security-audit/01-token-encryption.ts` through `06-db-security-check.ts` with `.env.local` | Pass; token encryption verified 13 `user_service_tokens` rows and DB ownership checks completed. | | `pnpm exec tsx scripts/security-audit/01-token-encryption.ts` through `06-db-security-check.ts` with `.env.development` | Pass; token encryption verified 13 `user_service_tokens` rows and DB ownership checks completed. | | `pnpm exec tsx scripts/security-audit/01-token-encryption.ts` with `.env.production` | Pass; token encryption verified 76 `user_service_tokens` rows from the live production database. | | `pnpm exec tsx scripts/security-audit/06-db-security-check.ts` with `.env.production` | Pass; live production ownership checks completed against `user_service_tokens` and `transfer_operations`. | | Local/deployed header probes | Mixed; local header config present, deployed dev/prod missing configured headers except HSTS. | | Local/dev/prod Fly `/health` probes | Pass; local, dev, and production Fly health endpoints returned `200`. | | Production docs exposure probes | Mixed; `/docs`, `/legal/privacy`, and `/docs/privacy-architecture` returned `200`; `/dev/docs` also returned `200` and must be protected in the deployed app. | | `pnpm audit` | Fails only on dev dependency advisories: Vite moderate through Storybook/Vitest and Elliptic low through Storybook polyfills. | Google Cloud Console export status: completed for non-secret branding, authorized-domain, audience, OAuth-client-list, and data-access/scope pages. Playwright/E2E was not run for this pass because this was an audit evidence update and no user workflow UI code changed. ## Test Accounts and Staging Checklist Do not place credentials in this file. Use the separately provided test account handoff outside the evidence pack. Before authorized lab access: - Confirm `https://stratofusion.io` is the app under assessment. - Provide one standard user with Google Drive connected. - Provide one standard user without provider connections for negative auth checks. - Provide one dev/admin user only if the lab needs to verify dev-only endpoints. - Confirm Google, OneDrive, and Dropbox test accounts contain non-sensitive sample files. - Confirm billing/test Stripe flows use test-mode data only. - Confirm no screenshots, HAR files, or logs include OAuth tokens, refresh tokens, auth headers, rclone configs, webhook signing secrets, or provider secrets. ## CASA Online Application Document Set Use these non-secret documents and public URLs for the CASA Tier 2 verification application and assessor handoff: | Purpose | Canonical document or URL | | ------------------------------------------------ | ---------------------------------------------------------------------- | | Main readiness evidence pack | `public/docs/security/CASA_TIER_2_READINESS.md` | | Security controls summary | `public/docs/SECURITY.md` | | Privacy/data-flow architecture | `public/docs/PRIVACY_ARCHITECTURE.md` | | Production privacy policy | `https://stratofusion.io/legal/privacy` | | Deployment and environment separation | `public/docs/DEPLOYMENT.md` | | API/control-plane reference | `public/docs/API_REFERENCE.md` | | rclone/Fly data-plane security | `public/docs/RCLONE_SERVICE.md` | | OAuth token refresh and storage | `public/docs/OAUTH_TOKEN_REFRESH_IMPLEMENTATION.md` | | Google OAuth client/runbook evidence | `public/docs/GOOGLE_OAUTH_ALIGNMENT_RUNBOOK_2026-04-07.md` | | Google OAuth verification video script/checklist | `public/docs/operations/GOOGLE_OAUTH_VERIFICATION_VIDEO_2026-04-07.md` | | Repo-aware audit report | `public/docs/operations/SECURITY_AUDIT_REPORT.md` | | Verification commands and test strategy | `public/docs/TESTING.md` | | Credential rotation process | `public/docs/CREDENTIAL_ROTATION_CHECKLIST.md` | ## Scan Commands and Submission Placeholders Use these as local readiness commands, not a substitute for lab instructions: ```powershell pnpm env:guard pnpm lint pnpm typecheck pnpm audit --prod pnpm exec tsx scripts/security-audit/01-token-encryption.ts pnpm exec tsx scripts/security-audit/02-api-authz-scan.ts pnpm exec tsx scripts/security-audit/03-input-validation-scan.ts pnpm exec tsx scripts/security-audit/04-secrets-and-logging-scan.ts pnpm exec tsx scripts/security-audit/05-fly-rclone-scan.ts pnpm exec tsx scripts/security-audit/06-db-security-check.ts ``` CASA portal placeholders: - AST configuration evidence: pending final SAST/DAST tool export. - AST results: pending lab-approved scan output. - OWASP Benchmark evidence for custom tools: pending if custom tools are used. - Self-attestation answers: pending assessor portal requirements. - Staging account checklist: pending secure handoff. - Production Google Cloud OAuth consent screen app name, domain verification status, audience status, clients list, and exact console scope list: captured in `output/playwright/casa-google-oauth/`. - Production deployment recheck: pending after the deployed app serves the configured headers and protects `/dev/docs`. ## Residual Risks and TAC/Lab Questions - Should dev-only dependency audit advisories be accepted when `pnpm audit --prod` is clean and Storybook is not deployed? - Does the lab require a full migration of all legacy API routes to generic public errors before assessment, or is targeted remediation plus documented residual risk acceptable? - Should `https://www.googleapis.com/auth/drive.file` be considered viable for any subset of StratoFusion flows, or does cross-account backup/sync/delete require full Drive scope as currently implemented? - Does the lab require the Google Cloud Console scope/domain screenshots in the CASA upload itself, or should they be provided as separate supporting attachments? - Should `/dev/docs` remain available to dev/admin users in production, or should all production docs use only `/docs` with `/dev/docs` disabled at deploy time? Current deployed behavior exposes `/dev/docs` publicly and is a blocker for production readiness.