Control Catalog

Control catalog

Catalog version 2026.10-m4. Generated from pandaward capabilities --json.

Domains

ID	Name
A	Asset inventory, architecture and threat model
B	Authentication, sessions and identity
C	Authorization, roles and tenant isolation
D	Input, output, injection and data flow
E	Secrets, cryptography, privacy and storage
F	Business logic, integrity and financial workflows
G	API contracts, integrations and messaging
H	Web frontend, browser and client-side controls
I	Dependencies, SBOM and software supply chain
J	Cloud, infrastructure, network and IaC
K	Android application security
L	iOS application security
M	Dynamic application/API security testing
N	CI/CD, source control and release security
O	Observability, detection and recovery
P	AI/LLM, agents, prompts and MCP
Q	Availability, concurrency and abuse resistance
R	Reporting, governance and remediation assurance

Methods

• static: decided by a built-in offline adapter
• external: decided by an optional scanner you installed
• runtime: needs an approved runtime profile
• manual: needs manual-assisted review and a human decision

Control titles are narrow on purpose: PASS means exactly what the title says and nothing more.

Controls

Control	Domain	Method	Title	Requires	References
A-001	A	static	Repository inventory walk completed without unreadable or skipped files	any
A-002	A	static	Externally reachable routes enumerated with file references	web
A-003	A	static	Declared API contract (OpenAPI) matches discovered routes	openapi
A-004	A	manual	Asset owners, trust boundaries and abuse cases reviewed	any
B-001	B	static	JWT verification is not disabled and does not accept the 'none' algorithm	code	CWE-347
B-002	B	static	Session cookies are not explicitly configured without Secure/HttpOnly	web	CWE-614, CWE-1004
B-003	B	runtime	Login, reset and MFA state machine tested with negative cases	auth	API2:2023
B-004	B	runtime	Session expiry and revocation enforced server-side	auth	CWE-613
C-001	C	runtime	Object-level authorization enforced on parameterized routes (BOLA)	param_routes	API1:2023, CWE-639
C-002	C	runtime	Function-level authorization enforced on privileged routes	admin_routes	API5:2023, CWE-285
C-003	C	manual	Authorization checks reviewed for every route handler	web	CWE-862
D-001	D	static	No dynamic code evaluation (eval/new Function/exec of strings)	code	CWE-95
D-002	D	static	No shell command construction through a shell interpreter	code	CWE-78
D-003	D	static	No SQL statements built by string concatenation or interpolation	code	CWE-89
D-004	D	static	No unsafe deserialization APIs on untrusted data	code	CWE-502
D-005	D	runtime	Injection probes executed against approved target	web
D-006	D	external	Semgrep data-flow rules (SSRF, path traversal, template injection) and project rules report no findings	code
E-001	E	static	No high-confidence secret patterns in repository files	any	CWE-798
E-002	E	static	Environment and credential files are not tracked in git	git	CWE-538
E-003	E	static	TLS certificate verification is not disabled in code	code	CWE-295
E-004	E	static	No weak hash or non-cryptographic random used for security values	code	CWE-327, CWE-338
E-005	E	external	Gitleaks reports no secrets	any	CWE-798
F-001	F	manual	Business invariants for money and entitlement flows documented and reviewed	payments
F-002	F	runtime	Idempotency and double-processing tested with synthetic fixtures	payments	CWE-362
G-001	G	static	Webhook handlers verify a signature before acting on the payload	webhooks	CWE-345
G-002	G	runtime	Runtime API authorization matches the declared contract	web	API1:2023, API3:2023
H-001	H	static	No raw HTML injection sinks (innerHTML, dangerouslySetInnerHTML, v-html,	safe)	code
H-002	H	static	CORS is not configured as wildcard together with credentials	web	CWE-942
H-003	H	runtime	Security response headers present on approved deployed target	any	CWE-693
I-001	I	static	Every package manifest has a committed lockfile	packages	CWE-829
I-002	I	static	Dependencies with install-time scripts are listed for review	npm_lock	CWE-506
I-003	I	external	No known-vulnerable dependencies in an advisory database	packages	CWE-1395
I-004	I	static	Python requirements pinned to exact versions	python_reqs	CWE-829
J-001	J	static	Container images do not run as root	dockerfile	CWE-250
J-002	J	static	Container base images pinned (no latest or missing tag)	dockerfile	CWE-829
J-003	J	static	No privileged containers or host networking in compose/Kubernetes	orchestration	CWE-250
J-004	J	static	IaC does not expose public storage or world-open admin ports	terraform	CWE-284
J-005	J	external	Trivy reports no IaC misconfigurations	iac
K-001	K	static	Android manifest: not debuggable, no backup, no cleartext traffic	android	CWE-489, CWE-530, CWE-319
K-002	K	static	Android exported components protected by permission	android	CWE-926
K-003	K	runtime	Android runtime storage and transport verified on emulator	android
K-004	K	static	Android app does not keep credentials in plain SharedPreferences or world-accessible storage	android	CWE-312, CWE-276
K-005	K	external	Built APK manifest: not debuggable, no backup or cleartext, no unprotected exported components	apk	CWE-489, CWE-926
L-001	L	static	iOS App Transport Security does not allow arbitrary loads	ios	CWE-319
L-002	L	runtime	iOS keychain and storage verified on simulator	ios
L-003	L	static	iOS entitlements do not allow debugging outside debug builds	ios	CWE-489
L-004	L	static	iOS credentials kept in the Keychain with a restrictive accessibility class, not in UserDefaults	ios	CWE-922, CWE-312
M-001	M	runtime	Passive DAST (ZAP baseline) against approved target	web
N-001	N	static	Third-party GitHub Actions pinned to a full commit SHA	github_workflows	CWE-829
N-002	N	static	No untrusted event data interpolated into run: scripts	github_workflows	CWE-78
N-003	N	static	pull_request_target workflows do not check out untrusted PR code	github_workflows	CWE-829
N-004	N	static	Workflow GITHUB_TOKEN permissions declared explicitly	github_workflows	CWE-250
O-001	O	manual	Security events logged and alerted (privilege changes, auth failures)	web
O-002	O	static	Secrets and credentials not written to logs	code	CWE-532
P-001	P	static	Model output is not executed as code or shell	llm	CWE-94
P-002	P	static	MCP server configs pinned and free of inline credentials	mcp_config	CWE-829, CWE-798
P-003	P	runtime	Prompt-injection and tool-authorization cases tested	llm
Q-001	Q	manual	Rate limiting applied to authentication and expensive routes	web	API4:2023, CWE-770
Q-002	Q	runtime	Concurrency and duplicate-action tests on stateful flows	payments	CWE-362
R-001	R	static	All evidence artifacts of this assessment verify against recorded SHA-256	any
R-002	R	external	Imported third-party analyzer results (SARIF) report no findings	sarif

References use CWE identifiers and OWASP API Security Top 10 2023 categories. Requirement-level ASVS and MASVS identifiers will be added from the official versioned catalogs rather than invented.