Standards
14 standards. Three pillars.
We check your code against each one and give you evidence. We don't certify — your assessor or auditor does that, with our proof.
Security — Is your code safe?
| Standard | What we check |
|---|---|
| OWASP Top 10 (2025) | Injection, broken access control, exposed secrets, misconfiguration, vulnerable components |
| CWE Top 25 | The 25 most dangerous software weaknesses, each finding tagged |
| OWASP ASVS 5.0 | Authentication, sessions, input validation, cryptography, logging — line by line |
| OWASP API Security Top 10 | Unauthenticated endpoints, broken object-level access, excessive data exposure |
| OWASP Top 10 for LLM Applications | Prompt injection, data leaking to AI models, trusting AI output |
| OWASP Proactive Controls | Whether the right secure patterns are actually used |
| SEI CERT Secure Coding | Language-specific secure coding rules |
| Supply chain & SBOM | Known-vulnerable libraries, unpinned packages, full software bill of materials |
| Secrets & data exposure | Hardcoded keys, personal data in logs, open database access rules |
Quality — Is your code well built?
| Standard | What we check |
|---|---|
| ISO/IEC 5055 (CISQ) | Automated code quality: security, reliability, performance, maintainability |
| ISO/IEC 25010 | Maintainability, reliability, testability, dead code, blast radius |
| Testing & delivery | Tests exist and run, CI in place, builds gated |
Resilience — Will your code stay up?
| Standard | What we check |
|---|---|
| DORA | 24 checks across resilience, observability, testing & delivery, and third-party risk |
| NIST SSDF (SP 800-218) | Secure build, review, testing and vulnerability handling in the repo |
Live app & pen test compliance support
Our live-app scan and pen testing map findings to these frameworks.
Live app scan
Cyber EssentialsISO 27001/27002ISO 27701NIST CSF 2.0NCSC CAFSOC 2OWASP Top 10OWASP API Top 10MITRE ATT&CKGDPR Art. 32
Pen testing
PCI DSSISO 27001Cyber Essentials PlusSOC 2GDPRHIPAADORANIS2