OWASP Top 10:2025 coverage with a signed evidence trail - mapped automatically to ISO 27001, SOC 2, NIS2 and Qatar's National Information Assurance (NIA) Standard v2.1.
Any authenticated user can enumerate other users' records by changing the id. CVSS 8.1. Fix: object-level authorization check. Effort: 3 hr.
Reachable by a standard user - tested, succeeded. CVSS 7.7. Fix: enforce role claim server-side. Effort: 2 hr.
Changing the org parameter returns another entity's report list. CVSS 7.1. Fix: derive the tenant from the session, never from the request. Effort: 2 hr.
Trending down as the team remediates - each closure is signed and timestamped, so the improvement is provable.
This is the view auditors ask for - and the one that turns a security report into a certification artefact.
| Finding | OWASP | ISO 27001:2022 | SOC 2 | NIS2 | Qatar NIA Standard v2.1 |
|---|
Each state transition is hash-chained to the last and signed. An auditor replays the lifecycle of any finding offline - detection to verified-fixed - without trusting Spark's servers.
