| Finding | Store | Issue | Who can reach it | Records | Risk | Status | |
|---|---|---|---|---|---|---|---|
| DX-301 | export-2026-09.csv | Unencrypted export of NID and phone numbers on a shared drive | 214 users | 212 k | Critical | Open | |
| DX-298 | analytics-lake | Group "all-analysts" can read raw tables, not only tokenised views | 96 users | 4.9 bn rows | High | Open | |
| DX-295 | grc-db backup | Backup copy kept beyond retention | Backup operators | 2.4 M | Medium | Open | |
| DX-290 | evidence-vault | Public link created in 2025, never used | Anyone with link | 1 object | High | Remediated |
R = min(100, 2.5 × S × E × log10(1 + N) × B) S = sensitivity of the most sensitive type (1–5) E = exposure: 1 public · 0.6 broad internal · 0.3 role-based · 0.1 owner-only N = records B = breadth: 1 + log10(identities with access) / 3