COMPLIANCE REPORTS

Compliance Reports

Compliance reports map your scan findings to three industry frameworks: OWASP Top 10, SOC2 Trust Services Criteria, and PCI-DSS v4.0. The output is a print-ready HTML page you can save as a PDF with one click — suitable for audit submissions, security reviews, and customer questionnaires.

Compliance reports require the Pro plan or above.

What the report contains

OWASP TOP 10 — 2021

Each of the 10 categories is marked PASS, FAIL, or N/A. Failing categories show the exact findings that triggered them with file, line, and severity.

SOC2 TRUST SERVICES

10 SOC2 CC controls mapped to the OWASP categories they govern. Each control shows its status and the number of affected findings.

PCI-DSS V4.0

11 PCI-DSS requirements mapped to findings. Includes Req 6.2 (secure development), Req 8.2 (authentication), Req 10.2 (audit logs), and more.

How the mapping works

CodeScan resolves each finding to an OWASP Top 10 category using three fallback layers, in order:

Explicit OWASP tag

The scan result already carries an owasp field (e.g. "A03:2021"). This is used directly when present.

CWE lookup

If the finding has a CWE ID, it is matched against the CWE-to-OWASP mapping table (e.g. CWE-89 → A03:2021 Injection).

Keyword match

If neither field is present, the category and title are matched against known keywords (e.g. "sql injection" → A03:2021, "hardcoded secret" → A02:2021).

Once findings are mapped to OWASP categories, SOC2 and PCI-DSS controls are derived automatically. For example, a finding under A03:2021 (Injection) causes SOC2 CC6.6 and CC6.8 to fail, and PCI-DSS Req 6.2 and Req 6.4 to fail.

OWASP Top 10 coverage

ID	Category	Common finding types
A01:2021	Broken Access Control	IDOR, path traversal, CSRF, missing auth checks
A02:2021	Cryptographic Failures	Hardcoded secrets, weak ciphers, plaintext transmission, MD5/SHA1
A03:2021	Injection	SQL injection, XSS, command injection, template injection
A04:2021	Insecure Design	Unrestricted file upload, race conditions, mass assignment
A05:2021	Security Misconfiguration	Insecure cookies, CORS misconfig, debug mode, XXE, exposed secrets
A06:2021	Vulnerable & Outdated Components	Dependency vulns from package.json, pom.xml, requirements.txt
A07:2021	Identification & Authentication Failures	Weak passwords, session fixation, missing MFA, credential exposure
A08:2021	Software & Data Integrity Failures	Insecure deserialization, pickle.loads, yaml.load, supply chain
A09:2021	Security Logging & Monitoring Failures	Sensitive data in logs, log injection, missing audit trail
A10:2021	Server-Side Request Forgery	SSRF, unvalidated URL fetch, internal service requests

Generating a compliance report

From the CLI

Add --compliance-out to any scan. The report saves as an HTML file — open it in any browser and click Download as PDF.

codescan scan --dir ./src --compliance-out compliance-report.html

Combined with gate and SARIF

codescan scan --dir ./src \
  --gate \
  --sarif-out results.sarif \
  --compliance-out compliance-report.html \
  --save-history

From the API

Send your scan results to /api/compliance. Use format: "html" to get the print-ready page, or omit it for structured JSON.

# JSON response (default)
POST https://codesscan.com/api/compliance
Authorization: Bearer <token>
Content-Type: application/json

{
  "results": [ /* FileScanResult[] from /api/scan */ ],
  "target": "./src"
}

# HTML response — send to browser or save as file
POST https://codesscan.com/api/compliance
{ "results": [...], "target": "./src", "format": "html" }

JSON response structure

{
  "generated": "2026-05-13T09:15:00Z",
  "target":    "./src",
  "totalFiles": 12,
  "totalFindings": 7,
  "critical": 0, "high": 2, "medium": 4, "low": 1,

  "owaspRows": [
    {
      "category": { "id": "A03:2021", "name": "Injection", ... },
      "findings":  [ { "file": "api/db.ts", "line": 42, "severity": "high", ... } ],
      "status":    "FAIL"
    },
    { "category": { "id": "A01:2021", ... }, "findings": [], "status": "PASS" },
    ...
  ],
  "owaspCoverage": { "pass": 8, "fail": 2, "notTested": 0 },

  "soc2": [
    { "id": "CC6.6", "name": "Security Against Threats", "status": "FAIL", "affectedFindings": 2, ... },
    { "id": "CC6.1", "name": "Logical Access Controls",  "status": "PASS", "affectedFindings": 0, ... },
    ...
  ],
  "soc2Status": "FAIL",

  "pciDss": [
    { "id": "Req 6.2", "name": "Bespoke Software Security", "status": "FAIL", "affectedFindings": 2, ... },
    ...
  ],
  "pciDssStatus": "FAIL"
}

In GitHub Actions

Upload the compliance report as a build artifact so your team can download it from every CI run:

- name: Run CodeScan
  run: |
    npx codescan-flowlog scan \
      --dir ./src \
      --gate \
      --compliance-out compliance-report.html \
      --sarif-out results.sarif \
      --pr-comment
  env:
    CODESCAN_TOKEN: ${{ secrets.CODESCAN_TOKEN }}
    GITHUB_TOKEN:   ${{ secrets.GITHUB_TOKEN }}

- name: Upload compliance report
  if: always()
  uses: actions/upload-artifact@v4
  with:
    name: compliance-report
    path: compliance-report.html

Plan availability

Feature	Free	Starter	Pro	Team	Business
OWASP mapping (in scan output)	✓	✓	✓	✓	✓
Compliance report JSON (API)	—	—	✓	✓	✓
Compliance report HTML / PDF	—	—	✓	✓	✓
SOC2 checklist	—	—	✓	✓	✓
PCI-DSS checklist	—	—	✓	✓	✓