Security controls and remediation
Control matrix
Section titled “Control matrix”The registry below is web-security/1. Adapter names describe supported evidence mechanisms, not tools guaranteed to have run. Every row needs complete, identity-bound evidence for its declared targets. EVID controls have integrity scope; other rows have application scope. Missing applicability is unknown, not a free exclusion.
| Control ID | Family / scope | Reviewed purpose | Required evidence | Supported mechanisms | Evidence limit |
|---|---|---|---|---|---|
CSP-01 |
CSP / application | Enforced response policy | source, runtime | csp-source, http-runtime | Source alone cannot prove deployed headers, nonce entropy or cache variants. |
CSP-02 |
CSP / application | Effective script restrictions and policy composition | source, runtime | csp-source, http-runtime | Source alone cannot prove deployed headers, nonce entropy or cache variants. |
CSP-03 |
CSP / application | Nonce/hash authorization, matching and reuse evidence | source, build, runtime | csp-source, production-build, http-runtime | Source alone cannot prove deployed headers, nonce entropy or cache variants. |
CSP-04 |
CSP / application | Declared render mode and source/build/runtime association | source, build, runtime | render-source, production-build, http-runtime | Source alone cannot prove deployed headers, nonce entropy or cache variants. |
CSP-05 |
CSP / application | Object and base restrictions | source, runtime | csp-source, http-runtime | Source alone cannot prove deployed headers, nonce entropy or cache variants. |
CSP-06 |
CSP / application | Embedding and form destinations | source, runtime | csp-source, http-runtime | Source alone cannot prove deployed headers, nonce entropy or cache variants. |
XSS-01 |
XSS / application | HTML injection sinks and bounded data flow | source | html-ast, semgrep | Bounded AST/data-flow support; unresolved dynamic or cross-file flows stay incomplete. |
XSS-02 |
XSS / application | Resolved sanitizer identity and configuration | source | html-ast, dependency-resolution | Bounded AST/data-flow support; unresolved dynamic or cross-file flows stay incomplete. |
XSS-03 |
XSS / application | Inline script and structured JSON output | source, build | html-ast, production-build | Bounded AST/data-flow support; unresolved dynamic or cross-file flows stay incomplete. |
XSS-04 |
XSS / application | Client/server HTML trust boundaries | source | html-ast, boundary-source | Bounded AST/data-flow support; unresolved dynamic or cross-file flows stay incomplete. |
CSRF-01 |
CSRF / application | Auth modes and mutation inventory, including GET candidates | source | surface-inventory, request-source | Declared targets and reviewed scenarios only; no blanket action/route coverage. |
CSRF-02 |
CSRF / application | Cookie mutation origin/token protection | source, behavioral | request-source, request-behavior | Declared targets and reviewed scenarios only; no blanket action/route coverage. |
CSRF-03 |
CSRF / application | Trusted origins, proxy and action boundaries | source, behavioral | request-source, request-behavior | Declared targets and reviewed scenarios only; no blanket action/route coverage. |
CSRF-04 |
CSRF / application | Negative/positive mutation scenarios | behavioral | request-behavior | Declared targets and reviewed scenarios only; no blanket action/route coverage. |
HTTP-01 |
HTTP / application | Observed security headers and production TLS context | runtime | http-runtime | Exact observed scope; private cache/session behavior needs bound fixtures. |
HTTP-02 |
HTTP / application | Cookie attributes and session lifecycle | source, runtime, behavioral | request-source, http-runtime, request-behavior | Exact observed scope; private cache/session behavior needs bound fixtures. |
HTTP-03 |
HTTP / application | CORS origin/credential behavior | source, behavioral | request-source, request-behavior | Exact observed scope; private cache/session behavior needs bound fixtures. |
HTTP-04 |
HTTP / application | Authenticated cache isolation, logout and revocation | source, behavioral | request-source, request-behavior | Exact observed scope; private cache/session behavior needs bound fixtures. |
BOUND-01 |
BOUND / application | Server-side object/role/tenant authorization matrix | source, behavioral | request-source, authz-behavior | Declared feature and persona fixtures only; unknown applicability is incomplete. |
BOUND-02 |
BOUND / application | Public bundle secret and source-map boundaries | source, build | boundary-source, production-build | Declared feature and persona fixtures only; unknown applicability is incomplete. |
BOUND-03 |
BOUND / application | Outbound URL/SSRF and redirect boundaries | source, behavioral | boundary-source, outbound-fixture | Declared feature and persona fixtures only; unknown applicability is incomplete. |
BOUND-04 |
BOUND / application | Upload content/type/storage boundaries | source, behavioral | boundary-source, upload-fixture | Declared feature and persona fixtures only; unknown applicability is incomplete. |
DEP-01 |
DEP / application | Resolved dependencies and known advisory context | source | dependency-resolution, advisory-audit | Supported lockfiles and established runtime context; metadata is not code-safety proof. |
DEP-02 |
DEP / application | Build/runtime exposure context | build, runtime | production-build, http-runtime | Supported lockfiles and established runtime context; metadata is not code-safety proof. |
DEP-03 |
DEP / application | Workflow pins, permissions and install context | source | workflow-source, dependency-resolution | Supported lockfiles and established runtime context; metadata is not code-safety proof. |
EVID-01 |
EVID / integrity | Commit/input/build/deployment identity consistency | source, build, runtime | identity-binding | Identity/completeness/authority checks do not certify scanner execution. |
EVID-02 |
EVID / integrity | Narrow provenance receipt and authority | operational | provenance-receipt | Identity/completeness/authority checks do not certify scanner execution. |
EVID-03 |
EVID / integrity | Scanner completeness and diagnostics status | source | scanner-diagnostics | Identity/completeness/authority checks do not certify scanner execution. |
sast:semgrep |
SAST / application | Native SAST aggregate; preserve scanner rule IDs | source | semgrep | Native scanner rule IDs retained; unavailable or partial tools cannot prove zero findings. |
secrets:gitleaks |
SECRETS / application | Native secret aggregate; redact and rotate | source | gitleaks | Current-source scope, redacted findings; history and rotation need separate review. |
Render mode, CSP and cache
Section titled “Render mode, CSP and cache”| Declared mode | Recommended fix | Proof still required |
|---|---|---|
static |
Externalize trusted executable code or use hashes computed from exact emitted bytes; deploy the matching response policy. | Inspect production build artifacts and actual edge responses. An allowlisted source file does not prove the CDN header. |
ssr |
For a nonce design, generate a new unpredictable CSPRNG nonce per response and propagate the same value to the policy and intended scripts. | Bind source generation, emitted build and runtime response/body. Two varying samples or nonce length alone do not prove entropy. |
isr / hybrid |
Review cached HTML and policy as one unit; avoid reusing a per-request nonce through a shared cache. Choose an appropriate hash/static strategy or explicitly dynamic response. | Verify the actual cache/deployment path. A source render label or matched artifact alone does not establish safe invalidation. |
unknown |
Review each route and declare its actual mode. | Remains incomplete until resolved; no inferred SSR or default pass. |
The runtime collector permits at most 3 physical wire GET requests per route, counting redirects, with an independent maximum of 3 same-origin redirects. A redirect-heavy path may exhaust the request budget before two complete nonce samples. Declare the canonical route after review; do not silently raise traffic. A 15-second timer covers DNS/connect/TLS/body. Public origins are pinned after checking all resolved addresses. Runtime HTML stays local and minimized evidence is projected; this is bounded observation, not exploitation or flooding.
The built SaaS denies inline style attributes and browser Wasm. Trusted Astro documentation has an evidenced style-attribute exception and narrow Pagefind Wasm permission. Both externalize executable inline scripts; this owner-specific design is not a universal strict-CSP claim. Verify actual production HTTPS/CDN/header behavior for each deployment. The Cloudflare provider analytics beacon is currently blocked by the strict CSP; this remains a known operational limitation. See Next.js CSP guidance and MDN script policy semantics.
HTML and request remediation
Section titled “HTML and request remediation”Use React text rendering for text. Rich HTML needs a reviewed, resolved sanitizer and configuration immediately before the sink; custom wrappers, cross-file flows and unresolved initialization can remain incomplete. Serialize structured JSON safely for its actual script context. A candidate source pattern is not a confirmed exploit, and a clean static scan does not cover every dynamic flow. React documents the risk of untrusted HTML in its DOM reference.
| Auth mode | Review and behavioral evidence |
|---|---|
cookie / mixed |
CSRF origin/token/session binding, missing/null/sibling origins, simple form content types, trusted proxy handling; cookie flags, expiry/reset/revoke/logout and private cache isolation. SameSite is defense in depth. |
bearer |
Verify explicit Authorization handling and cookie rejection; allowlisted CORS and credential behavior; authorization per object/tenant. A bearer label alone does not prove cookie fallback is absent. |
service |
Explicit service credentials, intended caller and cookie rejection; server authorization and outbound URL constraints. |
none |
Confirm the route is intentionally public, does not mutate via GET and exposes no tenant data. Public status does not waive build, CSP or cache review. |
Server Actions and route handlers need their own declared scope; one adapter’s protection does not cover the other automatically. Test the negative cases on isolated, explicitly authorized fixtures. Request fixtures need both allowed and denied personas. CORS alone does not provide CSRF protection; follow the OWASP CSRF guidance.
BOUND checks need evidence for server object/tenant isolation, client-bundle secret exposure, outbound URLs and uploads when applicable. Resolve public/private runtime context for dependency findings; integrity metadata and an action pin are not proof of safe code. Keep >=X.Y.Z dependency floors, compatibility review and advisory checks separate. Fix confirmed secrets by revoking/rotating first, then removing their source and reviewing reachable history. Findings and missing proof remain visible through evidence collection and report trust.