Applications & Fraud

Application Security

Code, dependency, secret, infrastructure and logic-flaw findings · plain-English requirements · AI agents that fix · developer training

Security requirements are written in plain English. The engine compiles each one into checks that run on every pull request across the repositories in scope, including code written by AI assistants.

Requirements

Requirement	Plain-English rule	Repositories	Checks	Violations	Mode	Status
REQ-01	Customer and subject data must be encrypted at rest with field-level keys	afcos-core, grc-platform, client-portal	6	0	Block merge	Active
REQ-02	Every endpoint that returns STR data must check the caller’s RO scope	afcos-core, goaml-bridge	4	1	Block merge	Active
REQ-03	The Whistleblower Portal must never log IP addresses or user agents	wb-portal	5	0	Block merge	Active
REQ-04	Outbound HTTP calls must go through the egress proxy	all	3	2	Warn on pull request	Active