@vitronai/alethia 0.8.0 → 0.8.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +73 -41
- package/demo/admin-panel.html +326 -36
- package/demo/agent-oversight.html +354 -49
- package/demo/claude-code-app.html +688 -94
- package/demo/crypto-readiness.html +611 -177
- package/demo/ea1-stress-test.html +262 -34
- package/demo/ecommerce.html +1116 -0
- package/demo/financial-dashboard.html +298 -34
- package/demo/incident-response.html +636 -196
- package/demo/intentional-failures.html +157 -0
- package/demo/nist-compliance.html +458 -102
- package/demo/threat-intel.html +310 -51
- package/demo/wcag-audit.html +495 -84
- package/dist/index.d.ts +2 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +145 -2
- package/dist/index.js.map +1 -1
- package/package.json +2 -2
- package/skills/alethia/SKILL.md +15 -5
|
@@ -2,129 +2,485 @@
|
|
|
2
2
|
<html lang="en">
|
|
3
3
|
<head>
|
|
4
4
|
<meta charset="utf-8">
|
|
5
|
-
<title>Federal Asset Management
|
|
5
|
+
<title>NIST SP 800-53 Compliance — Federal Asset Management</title>
|
|
6
6
|
<style>
|
|
7
|
+
:root {
|
|
8
|
+
--bg-0: #060a14;
|
|
9
|
+
--bg-1: #0d1426;
|
|
10
|
+
--bg-2: #131b30;
|
|
11
|
+
--bg-3: #1a2440;
|
|
12
|
+
--line: #1f2a47;
|
|
13
|
+
--line-soft: #182039;
|
|
14
|
+
--ink: #e6ecf5;
|
|
15
|
+
--ink-muted: #9aa6c2;
|
|
16
|
+
--ink-faint: #677295;
|
|
17
|
+
--ink-dim: #4a5577;
|
|
18
|
+
--blue: #60a5fa;
|
|
19
|
+
--blue-soft: rgba(96,165,250,.12);
|
|
20
|
+
--indigo: #818cf8;
|
|
21
|
+
--indigo-soft: rgba(129,140,248,.12);
|
|
22
|
+
--rose: #f87171;
|
|
23
|
+
--rose-soft: rgba(248,113,113,.12);
|
|
24
|
+
--amber: #fbbf24;
|
|
25
|
+
--amber-soft: rgba(251,191,36,.12);
|
|
26
|
+
--emerald: #34d399;
|
|
27
|
+
--emerald-soft: rgba(52,211,153,.12);
|
|
28
|
+
}
|
|
7
29
|
* { box-sizing: border-box; margin: 0; padding: 0; }
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
.
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
30
|
+
html { color-scheme: dark; }
|
|
31
|
+
body {
|
|
32
|
+
font-family: ui-sans-serif, -apple-system, system-ui, "Inter", sans-serif;
|
|
33
|
+
background:
|
|
34
|
+
radial-gradient(1100px 600px at 0% -10%, rgba(96,165,250,.07), transparent 55%),
|
|
35
|
+
radial-gradient(900px 500px at 105% 110%, rgba(129,140,248,.05), transparent 55%),
|
|
36
|
+
var(--bg-0);
|
|
37
|
+
background-attachment: fixed;
|
|
38
|
+
color: var(--ink);
|
|
39
|
+
min-height: 100vh;
|
|
40
|
+
-webkit-font-smoothing: antialiased;
|
|
41
|
+
letter-spacing: -.005em;
|
|
42
|
+
font-size: 13.5px;
|
|
43
|
+
}
|
|
44
|
+
|
|
45
|
+
.topbar {
|
|
46
|
+
display: flex;
|
|
47
|
+
align-items: center;
|
|
48
|
+
justify-content: space-between;
|
|
49
|
+
padding: 12px 20px;
|
|
50
|
+
border-bottom: 1px solid var(--line-soft);
|
|
51
|
+
background: rgba(6,10,20,.7);
|
|
52
|
+
backdrop-filter: saturate(140%) blur(8px);
|
|
53
|
+
position: sticky;
|
|
54
|
+
top: 0;
|
|
55
|
+
z-index: 5;
|
|
56
|
+
}
|
|
57
|
+
.brand { display: flex; align-items: center; gap: 10px; font-weight: 600; }
|
|
58
|
+
.brand-mark {
|
|
59
|
+
width: 26px; height: 26px;
|
|
60
|
+
border-radius: 7px;
|
|
61
|
+
background: linear-gradient(135deg, var(--blue), var(--indigo));
|
|
62
|
+
display: grid;
|
|
63
|
+
place-items: center;
|
|
64
|
+
box-shadow: 0 4px 14px rgba(96,165,250,.3), inset 0 1px 0 rgba(255,255,255,.2);
|
|
65
|
+
}
|
|
66
|
+
.brand-mark svg { color: #fff; }
|
|
67
|
+
.brand-name { letter-spacing: -.01em; }
|
|
68
|
+
.brand-eyebrow { font-size: 11px; color: var(--ink-faint); font-weight: 500; }
|
|
69
|
+
.clearance {
|
|
70
|
+
padding: 4px 11px;
|
|
71
|
+
border-radius: 4px;
|
|
72
|
+
background: rgba(96,165,250,.16);
|
|
73
|
+
border: 1px solid rgba(96,165,250,.4);
|
|
74
|
+
color: var(--blue);
|
|
75
|
+
font-size: 11px;
|
|
76
|
+
font-weight: 700;
|
|
77
|
+
letter-spacing: .14em;
|
|
78
|
+
}
|
|
79
|
+
|
|
80
|
+
.container {
|
|
81
|
+
max-width: 1180px;
|
|
82
|
+
margin: 0 auto;
|
|
83
|
+
padding: 20px;
|
|
84
|
+
}
|
|
85
|
+
|
|
86
|
+
.summary {
|
|
87
|
+
display: grid;
|
|
88
|
+
grid-template-columns: 1fr 1fr 1fr;
|
|
89
|
+
gap: 12px;
|
|
90
|
+
margin-bottom: 16px;
|
|
91
|
+
}
|
|
92
|
+
.summary-card {
|
|
93
|
+
background: var(--bg-1);
|
|
94
|
+
border: 1px solid var(--line);
|
|
95
|
+
border-radius: 12px;
|
|
96
|
+
padding: 14px 16px;
|
|
97
|
+
position: relative;
|
|
98
|
+
overflow: hidden;
|
|
99
|
+
transition: border-color .15s, transform .15s;
|
|
100
|
+
}
|
|
101
|
+
.summary-card:hover { border-color: #2c3960; transform: translateY(-1px); }
|
|
102
|
+
.summary-card::after {
|
|
103
|
+
content: "";
|
|
104
|
+
position: absolute;
|
|
105
|
+
inset: 0;
|
|
106
|
+
pointer-events: none;
|
|
107
|
+
background: radial-gradient(160px 90px at 100% 0%, var(--c-soft, rgba(255,255,255,.04)), transparent 70%);
|
|
108
|
+
}
|
|
109
|
+
.summary-card .head {
|
|
110
|
+
display: flex; align-items: center; gap: 6px;
|
|
111
|
+
font-size: 11px;
|
|
112
|
+
font-weight: 600;
|
|
113
|
+
letter-spacing: .08em;
|
|
114
|
+
text-transform: uppercase;
|
|
115
|
+
color: var(--ink-faint);
|
|
116
|
+
}
|
|
117
|
+
.summary-card .head .dot {
|
|
118
|
+
width: 6px; height: 6px;
|
|
119
|
+
border-radius: 50%;
|
|
120
|
+
background: var(--c, var(--ink-faint));
|
|
121
|
+
box-shadow: 0 0 8px var(--c, transparent);
|
|
122
|
+
}
|
|
123
|
+
.summary-card .val {
|
|
124
|
+
font-size: 26px;
|
|
125
|
+
font-weight: 700;
|
|
126
|
+
letter-spacing: -.022em;
|
|
127
|
+
color: #fff;
|
|
128
|
+
margin-top: 6px;
|
|
129
|
+
line-height: 1.05;
|
|
130
|
+
}
|
|
131
|
+
.summary-card .sub {
|
|
132
|
+
font-size: 11.5px;
|
|
133
|
+
color: var(--ink-muted);
|
|
134
|
+
margin-top: 2px;
|
|
135
|
+
}
|
|
136
|
+
.card-violations { --c: var(--rose); --c-soft: rgba(248,113,113,.10); }
|
|
137
|
+
.card-controls { --c: var(--blue); --c-soft: rgba(96,165,250,.10); }
|
|
138
|
+
.card-pass { --c: var(--emerald); --c-soft: rgba(52,211,153,.10); }
|
|
139
|
+
|
|
140
|
+
.grid {
|
|
141
|
+
display: grid;
|
|
142
|
+
grid-template-columns: 1fr 1fr;
|
|
143
|
+
gap: 14px;
|
|
144
|
+
}
|
|
145
|
+
.panel {
|
|
146
|
+
background: var(--bg-1);
|
|
147
|
+
border: 1px solid var(--line);
|
|
148
|
+
border-radius: 12px;
|
|
149
|
+
padding: 16px;
|
|
150
|
+
box-shadow:
|
|
151
|
+
inset 0 1px 0 rgba(255,255,255,.03),
|
|
152
|
+
0 2px 6px rgba(0,0,0,.18);
|
|
153
|
+
}
|
|
154
|
+
.panel.full-width { grid-column: 1 / -1; }
|
|
155
|
+
.panel-head {
|
|
156
|
+
display: flex;
|
|
157
|
+
align-items: center;
|
|
158
|
+
justify-content: space-between;
|
|
159
|
+
margin-bottom: 12px;
|
|
160
|
+
}
|
|
161
|
+
.panel-head h2 {
|
|
162
|
+
font-size: 11.5px;
|
|
163
|
+
font-weight: 600;
|
|
164
|
+
letter-spacing: .08em;
|
|
165
|
+
text-transform: uppercase;
|
|
166
|
+
color: var(--ink-muted);
|
|
167
|
+
display: flex;
|
|
168
|
+
align-items: center;
|
|
169
|
+
gap: 7px;
|
|
170
|
+
}
|
|
171
|
+
.panel-head h2 .dot {
|
|
172
|
+
width: 6px; height: 6px;
|
|
173
|
+
border-radius: 50%;
|
|
174
|
+
background: var(--blue);
|
|
175
|
+
box-shadow: 0 0 8px var(--blue);
|
|
176
|
+
}
|
|
177
|
+
.panel-head .pill {
|
|
178
|
+
font-size: 10.5px;
|
|
179
|
+
padding: 2px 8px;
|
|
180
|
+
border-radius: 999px;
|
|
181
|
+
background: var(--bg-3);
|
|
182
|
+
color: var(--ink-faint);
|
|
183
|
+
font-weight: 500;
|
|
184
|
+
}
|
|
185
|
+
|
|
186
|
+
/* Findings */
|
|
187
|
+
.finding {
|
|
188
|
+
padding: 12px;
|
|
189
|
+
border-radius: 10px;
|
|
190
|
+
border: 1px solid var(--line);
|
|
191
|
+
background: var(--bg-2);
|
|
192
|
+
margin-bottom: 8px;
|
|
193
|
+
border-left: 3px solid var(--rose);
|
|
194
|
+
transition: border-color .15s, background .15s;
|
|
195
|
+
}
|
|
196
|
+
.finding:hover { background: var(--bg-3); }
|
|
197
|
+
.finding:last-child { margin-bottom: 0; }
|
|
198
|
+
.finding-head {
|
|
199
|
+
display: flex;
|
|
200
|
+
align-items: center;
|
|
201
|
+
gap: 8px;
|
|
202
|
+
margin-bottom: 4px;
|
|
203
|
+
}
|
|
204
|
+
.ctrl-tag {
|
|
205
|
+
font-family: ui-monospace, monospace;
|
|
206
|
+
font-size: 10.5px;
|
|
207
|
+
padding: 2px 7px;
|
|
208
|
+
border-radius: 4px;
|
|
209
|
+
background: var(--rose-soft);
|
|
210
|
+
color: var(--rose);
|
|
211
|
+
border: 1px solid rgba(248,113,113,.3);
|
|
212
|
+
font-weight: 700;
|
|
213
|
+
letter-spacing: .04em;
|
|
214
|
+
}
|
|
215
|
+
.finding-title {
|
|
216
|
+
font-size: 13px;
|
|
217
|
+
font-weight: 600;
|
|
218
|
+
color: var(--ink);
|
|
219
|
+
}
|
|
220
|
+
.finding-desc {
|
|
221
|
+
font-size: 12.5px;
|
|
222
|
+
color: var(--ink-muted);
|
|
223
|
+
line-height: 1.5;
|
|
224
|
+
margin-bottom: 8px;
|
|
225
|
+
}
|
|
226
|
+
.finding-evidence {
|
|
227
|
+
padding: 8px 10px;
|
|
228
|
+
border-radius: 6px;
|
|
229
|
+
background: var(--bg-0);
|
|
230
|
+
border: 1px solid var(--line-soft);
|
|
231
|
+
font-family: ui-monospace, monospace;
|
|
232
|
+
font-size: 11.5px;
|
|
233
|
+
color: var(--ink-muted);
|
|
234
|
+
line-height: 1.55;
|
|
235
|
+
white-space: pre-wrap;
|
|
236
|
+
}
|
|
237
|
+
.finding-evidence.error {
|
|
238
|
+
background: rgba(248,113,113,.05);
|
|
239
|
+
border-color: rgba(248,113,113,.2);
|
|
240
|
+
color: #fca5a5;
|
|
241
|
+
}
|
|
242
|
+
.finding-evidence.warn {
|
|
243
|
+
background: rgba(251,191,36,.05);
|
|
244
|
+
border-color: rgba(251,191,36,.2);
|
|
245
|
+
color: #fde68a;
|
|
246
|
+
}
|
|
247
|
+
.finding-form {
|
|
248
|
+
display: flex;
|
|
249
|
+
flex-direction: column;
|
|
250
|
+
gap: 6px;
|
|
251
|
+
margin-top: 8px;
|
|
252
|
+
}
|
|
253
|
+
.finding-form input, .finding-form select {
|
|
254
|
+
padding: 6px 9px;
|
|
255
|
+
border-radius: 6px;
|
|
256
|
+
border: 1px solid var(--line);
|
|
257
|
+
background: var(--bg-0);
|
|
258
|
+
color: var(--ink);
|
|
259
|
+
font: inherit;
|
|
260
|
+
font-size: 12px;
|
|
261
|
+
outline: none;
|
|
262
|
+
}
|
|
263
|
+
.finding-form input::placeholder { color: var(--ink-dim); }
|
|
264
|
+
.finding-form input:focus { border-color: var(--blue); box-shadow: 0 0 0 3px var(--blue-soft); }
|
|
265
|
+
|
|
266
|
+
/* Compliant table */
|
|
267
|
+
table.compliant {
|
|
268
|
+
width: 100%;
|
|
269
|
+
border-collapse: separate;
|
|
270
|
+
border-spacing: 0;
|
|
271
|
+
font-size: 12.5px;
|
|
272
|
+
}
|
|
273
|
+
table.compliant th {
|
|
274
|
+
text-align: left;
|
|
275
|
+
padding: 8px 10px;
|
|
276
|
+
color: var(--ink-faint);
|
|
277
|
+
font-size: 10.5px;
|
|
278
|
+
font-weight: 600;
|
|
279
|
+
letter-spacing: .08em;
|
|
280
|
+
text-transform: uppercase;
|
|
281
|
+
border-bottom: 1px solid var(--line);
|
|
282
|
+
}
|
|
283
|
+
table.compliant td {
|
|
284
|
+
padding: 9px 10px;
|
|
285
|
+
border-bottom: 1px solid var(--line-soft);
|
|
286
|
+
color: var(--ink);
|
|
287
|
+
}
|
|
288
|
+
table.compliant tr:last-child td { border-bottom: none; }
|
|
289
|
+
table.compliant tr:hover td { background: rgba(255,255,255,.015); }
|
|
290
|
+
.ctrl-name {
|
|
291
|
+
font-family: ui-monospace, monospace;
|
|
292
|
+
color: var(--blue);
|
|
293
|
+
font-size: 12px;
|
|
294
|
+
}
|
|
295
|
+
.badge {
|
|
296
|
+
padding: 2px 9px;
|
|
297
|
+
border-radius: 999px;
|
|
298
|
+
font-size: 10.5px;
|
|
299
|
+
font-weight: 700;
|
|
300
|
+
letter-spacing: .04em;
|
|
301
|
+
text-transform: uppercase;
|
|
302
|
+
}
|
|
303
|
+
.badge-pass { background: var(--emerald-soft); color: var(--emerald); border: 1px solid rgba(52,211,153,.3); }
|
|
304
|
+
.badge-fail { background: var(--rose-soft); color: var(--rose); border: 1px solid rgba(248,113,113,.3); }
|
|
305
|
+
|
|
306
|
+
.audit-log {
|
|
307
|
+
margin-top: 10px;
|
|
308
|
+
padding: 10px 12px;
|
|
309
|
+
border-radius: 8px;
|
|
310
|
+
background: var(--bg-0);
|
|
311
|
+
border: 1px solid var(--line-soft);
|
|
312
|
+
font-family: ui-monospace, monospace;
|
|
313
|
+
font-size: 11px;
|
|
314
|
+
color: var(--ink-faint);
|
|
315
|
+
line-height: 1.6;
|
|
316
|
+
}
|
|
317
|
+
|
|
318
|
+
button {
|
|
319
|
+
font: inherit;
|
|
320
|
+
cursor: pointer;
|
|
321
|
+
transition: background .15s, border-color .15s, color .15s;
|
|
322
|
+
}
|
|
323
|
+
.btn {
|
|
324
|
+
padding: 6px 12px;
|
|
325
|
+
border-radius: 7px;
|
|
326
|
+
border: 1px solid var(--line);
|
|
327
|
+
background: var(--bg-2);
|
|
328
|
+
color: var(--ink-muted);
|
|
329
|
+
font-size: 12px;
|
|
330
|
+
font-weight: 600;
|
|
331
|
+
}
|
|
332
|
+
.btn:hover { background: var(--bg-3); border-color: #2c3960; color: var(--ink); }
|
|
333
|
+
.btn-primary {
|
|
334
|
+
border-color: rgba(96,165,250,.4);
|
|
335
|
+
color: var(--blue);
|
|
336
|
+
}
|
|
337
|
+
.btn-primary:hover { background: var(--blue-soft); border-color: var(--blue); }
|
|
31
338
|
</style>
|
|
32
339
|
</head>
|
|
33
340
|
<body>
|
|
34
|
-
<h1>NIST 800-53 Compliance Audit — Negative Test</h1>
|
|
35
|
-
<p class="subtitle">This page deliberately violates NIST SP 800-53 Rev. 5 web application security controls. Alethia's compliance audit should flag all violations.</p>
|
|
36
|
-
|
|
37
|
-
<div class="score-bar">
|
|
38
|
-
<div><span class="score-label">Expected NIST findings:</span> <span class="score-value score-bad">6+</span></div>
|
|
39
|
-
<div><span class="score-label">Controls tested:</span> <span class="score-value" style="color:#7eb8da">7</span></div>
|
|
40
|
-
</div>
|
|
41
341
|
|
|
42
|
-
<div class="
|
|
43
|
-
<div class="
|
|
44
|
-
<
|
|
45
|
-
|
|
46
|
-
<span class="finding-control">VIOLATION: AC-7</span>
|
|
47
|
-
<div class="finding-desc">Login form with no lockout after failed attempts</div>
|
|
48
|
-
<span class="expect-flag">SHOULD FLAG</span>
|
|
342
|
+
<div class="topbar">
|
|
343
|
+
<div class="brand">
|
|
344
|
+
<div class="brand-mark">
|
|
345
|
+
<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"></path></svg>
|
|
49
346
|
</div>
|
|
50
|
-
<
|
|
51
|
-
<
|
|
52
|
-
<
|
|
53
|
-
<button type="button">Sign In</button>
|
|
54
|
-
</form>
|
|
55
|
-
</div>
|
|
56
|
-
|
|
57
|
-
<div class="panel">
|
|
58
|
-
<h2>AC-8: No Security Banner</h2>
|
|
59
|
-
<div class="finding">
|
|
60
|
-
<span class="finding-control">VIOLATION: AC-8</span>
|
|
61
|
-
<div class="finding-desc">Federal system without system use notification or classification banner</div>
|
|
62
|
-
<span class="expect-flag">SHOULD FLAG</span>
|
|
347
|
+
<div>
|
|
348
|
+
<div class="brand-name">NIST SP 800-53 Compliance Audit</div>
|
|
349
|
+
<div class="brand-eyebrow">Federal Asset Management System · Rev. 5</div>
|
|
63
350
|
</div>
|
|
64
|
-
<p style="color:#5a7a9e;font-size:0.75rem;margin-top:0.5rem">This page has no classification banner, no authorized use warning, and no consent notice — required for all federal information systems.</p>
|
|
65
351
|
</div>
|
|
352
|
+
<span class="clearance">FOR OFFICIAL USE</span>
|
|
353
|
+
</div>
|
|
66
354
|
|
|
67
|
-
|
|
68
|
-
<h2>AC-12: No Session Timeout</h2>
|
|
69
|
-
<div class="finding">
|
|
70
|
-
<span class="finding-control">VIOLATION: AC-12</span>
|
|
71
|
-
<div class="finding-desc">No session timeout or inactivity lock mechanism</div>
|
|
72
|
-
<span class="expect-flag">SHOULD FLAG</span>
|
|
73
|
-
</div>
|
|
74
|
-
<p style="color:#5a7a9e;font-size:0.75rem;margin-top:0.5rem">Sessions persist indefinitely. No meta refresh, no session timer, no inactivity warning. NIST requires automatic termination after a defined period.</p>
|
|
75
|
-
</div>
|
|
355
|
+
<div class="container">
|
|
76
356
|
|
|
77
|
-
<div class="
|
|
78
|
-
<
|
|
79
|
-
|
|
80
|
-
<
|
|
81
|
-
<div class="
|
|
82
|
-
|
|
357
|
+
<div class="summary">
|
|
358
|
+
<div class="summary-card card-violations">
|
|
359
|
+
<div class="head"><span class="dot"></span>Violations</div>
|
|
360
|
+
<div class="val">6</div>
|
|
361
|
+
<div class="sub">controls flagged</div>
|
|
362
|
+
</div>
|
|
363
|
+
<div class="summary-card card-controls">
|
|
364
|
+
<div class="head"><span class="dot"></span>Controls Tested</div>
|
|
365
|
+
<div class="val">7</div>
|
|
366
|
+
<div class="sub">Access Control · System Integrity · IA</div>
|
|
367
|
+
</div>
|
|
368
|
+
<div class="summary-card card-pass">
|
|
369
|
+
<div class="head"><span class="dot"></span>Compliant</div>
|
|
370
|
+
<div class="val">2</div>
|
|
371
|
+
<div class="sub">SC-13 · AU-2</div>
|
|
83
372
|
</div>
|
|
84
|
-
<input type="email" placeholder="Email — no pattern, no required" />
|
|
85
|
-
<input type="tel" placeholder="Phone — no pattern, no maxlength" />
|
|
86
|
-
<input type="text" placeholder="SSN — no maxlength, no pattern" />
|
|
87
|
-
<input type="text" placeholder="Notes — unrestricted input" />
|
|
88
373
|
</div>
|
|
89
374
|
|
|
90
|
-
<div class="
|
|
91
|
-
<
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
375
|
+
<div class="grid">
|
|
376
|
+
<div class="panel">
|
|
377
|
+
<div class="panel-head">
|
|
378
|
+
<h2><span class="dot" style="background: var(--rose); box-shadow: 0 0 8px var(--rose);"></span>Access Control Violations</h2>
|
|
379
|
+
<span class="pill">3 findings</span>
|
|
380
|
+
</div>
|
|
381
|
+
|
|
382
|
+
<div class="finding">
|
|
383
|
+
<div class="finding-head">
|
|
384
|
+
<span class="ctrl-tag">AC-7</span>
|
|
385
|
+
<span class="finding-title">No Login Attempt Limiting</span>
|
|
386
|
+
</div>
|
|
387
|
+
<div class="finding-desc">Login form with no lockout after failed attempts. Brute-force resistance not enforced.</div>
|
|
388
|
+
<form class="finding-form" onsubmit="return false;">
|
|
389
|
+
<input type="text" placeholder="Username" />
|
|
390
|
+
<input type="password" placeholder="Password" aria-label="Password" />
|
|
391
|
+
<button type="button" class="btn btn-primary">Sign In</button>
|
|
392
|
+
</form>
|
|
393
|
+
</div>
|
|
394
|
+
|
|
395
|
+
<div class="finding">
|
|
396
|
+
<div class="finding-head">
|
|
397
|
+
<span class="ctrl-tag">AC-8</span>
|
|
398
|
+
<span class="finding-title">No Security Banner</span>
|
|
399
|
+
</div>
|
|
400
|
+
<div class="finding-desc">Federal system without system-use notification or classification banner. Required for all federal information systems.</div>
|
|
401
|
+
</div>
|
|
402
|
+
|
|
403
|
+
<div class="finding">
|
|
404
|
+
<div class="finding-head">
|
|
405
|
+
<span class="ctrl-tag">AC-12</span>
|
|
406
|
+
<span class="finding-title">No Session Timeout</span>
|
|
407
|
+
</div>
|
|
408
|
+
<div class="finding-desc">Sessions persist indefinitely. No meta refresh, no inactivity warning. NIST requires automatic termination after a defined period.</div>
|
|
409
|
+
</div>
|
|
96
410
|
</div>
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
411
|
+
|
|
412
|
+
<div class="panel">
|
|
413
|
+
<div class="panel-head">
|
|
414
|
+
<h2><span class="dot" style="background: var(--rose); box-shadow: 0 0 8px var(--rose);"></span>System Integrity Violations</h2>
|
|
415
|
+
<span class="pill">2 findings</span>
|
|
416
|
+
</div>
|
|
417
|
+
|
|
418
|
+
<div class="finding">
|
|
419
|
+
<div class="finding-head">
|
|
420
|
+
<span class="ctrl-tag">SI-10</span>
|
|
421
|
+
<span class="finding-title">Missing Input Validation</span>
|
|
422
|
+
</div>
|
|
423
|
+
<div class="finding-desc">Form fields without pattern, maxlength, or required attributes. Sanitization not enforced at the boundary.</div>
|
|
424
|
+
<form class="finding-form" onsubmit="return false;">
|
|
425
|
+
<input type="email" placeholder="Email — no pattern, no required" />
|
|
426
|
+
<input type="tel" placeholder="Phone — no pattern, no maxlength" />
|
|
427
|
+
<input type="text" placeholder="SSN — no maxlength, no pattern" />
|
|
428
|
+
<input type="text" placeholder="Notes — unrestricted input" />
|
|
429
|
+
</form>
|
|
430
|
+
</div>
|
|
431
|
+
|
|
432
|
+
<div class="finding">
|
|
433
|
+
<div class="finding-head">
|
|
434
|
+
<span class="ctrl-tag">SI-11</span>
|
|
435
|
+
<span class="finding-title">Information Leakage in Errors</span>
|
|
436
|
+
</div>
|
|
437
|
+
<div class="finding-desc">Error messages expose internal implementation details — paths, stack traces, raw SQL.</div>
|
|
438
|
+
<div class="finding-evidence error" role="alert">Error: Unhandled exception at line 247 in /app/controllers/UserController.js
|
|
439
|
+
SQL query failed: SELECT * FROM users WHERE id = '${input}'
|
|
440
|
+
Stack trace: at UserController.findById (UserController.js:247)</div>
|
|
441
|
+
</div>
|
|
101
442
|
</div>
|
|
102
|
-
</div>
|
|
103
443
|
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
444
|
+
<div class="panel full-width">
|
|
445
|
+
<div class="panel-head">
|
|
446
|
+
<h2><span class="dot" style="background: var(--rose); box-shadow: 0 0 8px var(--rose);"></span>Identification & Authentication Violations</h2>
|
|
447
|
+
<span class="pill">1 finding</span>
|
|
448
|
+
</div>
|
|
449
|
+
|
|
450
|
+
<div class="finding">
|
|
451
|
+
<div class="finding-head">
|
|
452
|
+
<span class="ctrl-tag">IA-6</span>
|
|
453
|
+
<span class="finding-title">Unmasked Credential Fields</span>
|
|
454
|
+
</div>
|
|
455
|
+
<div class="finding-desc">Credential fields rendered as <code style="font-family: ui-monospace, monospace; font-size: 11.5px; color: var(--rose);">type="text"</code> — secrets visible in plaintext to anyone over the analyst's shoulder.</div>
|
|
456
|
+
<form class="finding-form" onsubmit="return false;">
|
|
457
|
+
<input type="text" placeholder="API Secret Key" name="secret" aria-label="API Secret" />
|
|
458
|
+
<input type="text" placeholder="Database Password" name="password" aria-label="Database Password" />
|
|
459
|
+
</form>
|
|
460
|
+
</div>
|
|
110
461
|
</div>
|
|
111
|
-
<input type="text" placeholder="API Secret Key" name="secret" aria-label="API Secret" />
|
|
112
|
-
<input type="text" placeholder="Database Password" name="password" aria-label="Database Password" />
|
|
113
|
-
</div>
|
|
114
462
|
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
<
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
463
|
+
<div class="panel full-width">
|
|
464
|
+
<div class="panel-head">
|
|
465
|
+
<h2><span class="dot" style="background: var(--emerald); box-shadow: 0 0 8px var(--emerald);"></span>Compliant Controls</h2>
|
|
466
|
+
<span class="pill">2 passing</span>
|
|
467
|
+
</div>
|
|
468
|
+
<table class="compliant">
|
|
469
|
+
<thead>
|
|
470
|
+
<tr><th>Control</th><th>Implementation</th><th>Status</th></tr>
|
|
471
|
+
</thead>
|
|
472
|
+
<tbody>
|
|
473
|
+
<tr><td><span class="ctrl-name">SC-13</span></td><td>All forms use relative URLs (no insecure HTTP)</td><td><span class="badge badge-pass">Pass</span></td></tr>
|
|
474
|
+
<tr><td><span class="ctrl-name">AU-2</span></td><td>Audit log present on page</td><td><span class="badge badge-pass">Pass</span></td></tr>
|
|
475
|
+
</tbody>
|
|
476
|
+
</table>
|
|
477
|
+
<div class="audit-log">
|
|
478
|
+
[2026-04-25T21:14:22Z] Page accessed by compliance-auditor<br>
|
|
479
|
+
[2026-04-25T21:14:28Z] Audit scan initiated · scope=full · controls=AC,SI,IA,SC,AU
|
|
480
|
+
</div>
|
|
126
481
|
</div>
|
|
127
482
|
</div>
|
|
128
483
|
</div>
|
|
484
|
+
|
|
129
485
|
</body>
|
|
130
486
|
</html>
|