acme/payments-api against OWASP ASVS 5.0, Level 2
1 · Where things stand
9 gaps across 105 controls.
Controls with evidence in the code that they are not met.
Checked by code and nothing was found. That is not the same as met.
Controls that code alone cannot show, such as policies and documents.
Three gaps are critical, and two of them sit in code that handles refunds and webhooks. Fix the SQL query in the refund lookup and move the webhook signing key out of the code first. The OS command injection in the export endpoint was fixed in this run and re-scanned clean.
2 · Coverage by chapter
Where the gaps are.
The five ASVS chapters with requirements that code can show at Level 2. Each control is counted once.
| Chapter | Controls | Gaps | No finding | Needs a person | Split |
|---|---|---|---|---|---|
| All chapters | 105 | 9 | 52 | 44 |
3 · Gaps
Each gap, with its evidence.
Most severe first. Open a gap to see the path the data takes, the AI review and the fix.
4 · Needs a person
44 controls GapScan cannot decide.
These ask for documents, processes or behaviour at run time. GapScan lists them so they are not forgotten, and leaves the decision to your reviewer. Four examples:
5 · What ran
Tools and what they covered.
A tool that did not finish is reported here, never hidden.
| Tool | Status | What it means for this report |
|---|---|---|
| Semgrep with GapScan rules | Ran | Code patterns checked in every file. |
| GapScan data-flow engine | Ran | Request data followed across files to each sink. |
| Bandit | Ran | Python security checks done. |
| Gitleaks | Ran | Secrets searched for. Values are redacted. |
| OSV-Scanner | Ran | Dependencies checked against the local advisory snapshot of 20 Oct 2026. |
| Trivy | Ran | Container image and Dockerfile checked. |
| Checkov | Timed out | Kubernetes files were not checked. V13 results may miss configuration gaps. |
6 · AI review
How the AI review went.
Every verdict is advice from a model running on this machine. It is checked against a fixed format before it is accepted, and a reviewer decides.
of 128 findings reviewed
each with a written reason you can check
4 of them contain text that tries to instruct the AI reviewer
7 · Limits
What this report cannot tell you.
- It is not a certificate. This report shows coverage and gaps against ASVS. It does not say the software is compliant.
- No finding is not the same as met. Tools find known patterns. A clean result means none were found.
- Some flaws are out of reach. Business logic, run-time behaviour and who may do what are not covered.
- One tool timed out. Kubernetes configuration was not checked in this run.
- Advisory data is a snapshot. It is only as current as the last bundle imported on this machine.
Coming with the cloud service
Closed gaps get a signed record.
In the cloud service, a gap closed by a clean re-scan becomes a signed record that you can give an auditor or attach to a customer questionnaire.
- Gap
- ASVS V1.2.5 · OS command injection
- Opened
- commit 3f9c2a1 · run #41
- Closed
- commit 8be41d0 · run #42 re-scan clean
- Evidence
- trace, AI review, diff, re-scan log