CASA v2.1.1 Control Matrix

Date: 2026-08-03

Baseline: App Defense Alliance CASA Specification and Test Guide v2.1.1, 2026-06-03. The guide defines 48 tests. This is readiness evidence, not an LoV or independent assessment.

Status meanings:

Ready: local code/config or passive production evidence supports the test.
Inherited: Clerk/provider control; obtain vendor/config evidence from lab.
Partial: evidence exists but dynamic validation or remediation remains.
Gap: a required control is not evidenced and is a release blocker.

Local fixes in this engagement are not production evidence until an approved deployment and recheck occur.

Authentication

ID	Status	StratoFusion evidence	Remaining verification
1.1.1	Inherited	Clerk authentication; app/provider rate limiting	Clerk brute-force policy and dynamic test
1.1.2	Inherited	Clerk owns initial credentials/activation	Clerk expiry/randomness evidence
1.1.3	Inherited	App stores no user passwords	Clerk password-storage attestation
1.2.1	Ready	No application default credentials; public surface/passive review	Lab credential sweep
1.3.1	Inherited	Clerk owns out-of-band verifiers	Clerk expiry evidence
1.3.2	Inherited	Clerk owns out-of-band verifiers	Clerk one-use evidence

ID	Status	StratoFusion evidence	Remaining verification
2.1.1	Ready	Provider codes remain callback parameters; tokens are not placed in URLs; log scanner passes	Lab traffic review
2.2.1	Partial	Clerk sign-out and auto-logout exist	Prove server session invalidation and all-device behavior dynamically
2.2.2	Inherited	Password change/session management is Clerk-owned	Clerk configuration evidence
2.2.3	Inherited	Clerk signs session tokens	Confirm configured maximum stateless lifetime is at most 24h
2.3.1	Inherited	Clerk production cookies observed behind HTTPS	Capture authenticated `Secure` cookie evidence without recording values
2.3.2	Inherited	Clerk owns session cookies	Capture `HttpOnly` attribute without recording values
2.3.3	Ready	User auth uses Clerk sessions; service secrets stay server-side	Lab traffic review
2.3.4	Inherited	Clerk JWT/session integrity	Clerk signing/replay evidence
2.4.1	Ready	Sensitive routes require a full authenticated session and ownership	Dynamic negative tests

ID	Status	StratoFusion evidence	Remaining verification
3.1.1	Ready	Route-level auth scan passes; ownership is enforced in trusted server/services	Lab role matrix
3.1.2	Ready	User/provider/account identifiers are re-resolved server-side	ID tampering tests
3.1.3	Ready	High-risk handlers fail closed; error sanitizer and auth tests	Broad exception-path DAST
3.1.4	Ready	Delete/download/operation ownership security tests	Cross-user CRUD DAST
3.1.5	Partial	OAuth state HMAC, Clerk controls, webhook signatures, non-GET mutations	Complete CSRF/automation DAST across legacy routes
3.1.6	Ready	Next/Caddy do not expose filesystem directory indexes	Lab path sweep
3.2.1	Ready	Direct providers use authorization-code flows; no implicit/password grant	Provider traffic capture
3.2.2	Ready locally	`oauth-state.ts` signs state with HMAC-SHA256, adds random nonce/10-minute expiry, validates fixed callback origins, and rejects legacy/tampered state	Deploy and perform end-to-end Google/OneDrive/Dropbox callbacks
3.3.1	Partial	Both configured admins are enrolled; candidate admin boundaries require signed second-factor verification no older than 10 minutes	Deploy and retain redacted stale/missing/unverified rejection evidence

ID	Status	StratoFusion evidence	Remaining verification
4.1.1	Ready	Public app/legal/rclone connections use HTTPS; HSTS and strong headers present	Lab TLS protocol/cipher scan
4.1.2	Ready	Default certificate validation succeeded for public origins	Record certificate chain/expiry in lab evidence
4.1.3	Ready	OAuth tokens use AES-256-GCM; no weak crypto found in review	Assessor crypto inventory
4.1.4	Ready	GCM auth failures throw; crypto module tests cover wrong-key failure	Lab negative verification

ID	Status	StratoFusion evidence	Remaining verification
5.1.1	Partial	Typed parsing and route validation are widespread	Parameter-pollution DAST for the complete API surface
5.1.2	Ready	OAuth success/error origins are configured and allowlisted; host-policy tests pass	Open-redirect DAST
5.1.3	Ready	Local scanner found no `eval()`/dynamic shell execution	Lab SAST
5.1.4	Ready	React escapes output; structured data escapes `<`; Mermaid strict mode	Manual template-injection test
5.1.5	Partial	Provider endpoints are constants and callback origins are allowlisted	Full SSRF inventory/DAST for server-side fetch paths
5.1.6	Ready	No XPath engine/use found; XML parsing does not construct XPath expressions	Malformed XML tests where applicable
5.1.7	Ready	React escaping, CSP, strict Mermaid rendering, focused XSS review	Authenticated XSS DAST
5.1.8	Ready	Drizzle parameterizes database operations; no dynamic SQL issue found	Injection DAST
5.1.9	Ready	rclone uses argument arrays; scanner found no `shell: true` or template-literal exec	Worker command-injection tests
5.1.10	Partial	Provider/path normalization and containment tests exist	Complete traversal/LFI/RFI DAST across download/export routes
5.2.1	Ready	Uploads stream to storage providers and are not executed by the app; size/type metadata is validated where required	Malicious upload DAST and storage response-header check

ID	Status	StratoFusion evidence	Remaining verification
6.1.1	Ready locally	`pnpm audit --prod`: no known vulnerabilities after Next 15.5.21 and transitive patches	Deploy rebuilt image; lab SCA
6.2.1	Ready	Production environment validation and restricted dev/admin routes	Lab debug-endpoint sweep
6.3.1	Ready	Authorization uses Clerk/route ownership; request `Origin` is only CORS context, not identity	Header-tampering DAST
6.4.1	Ready	Known production/rehearsal names resolve to owned VM/Vercel endpoints; no dangling name found	Full authoritative DNS inventory and takeover scan
6.5.1	Ready	Secret/log scanner passes; token encryption and error sanitization exist	Runtime log sample review without secret export
6.6.1	Partial	In-memory auth state and OAuth storage keys are cleared in relevant flows	Centralize/verify security-sensitive browser-storage clearing on logout
6.7.1	Ready	Secrets are server-side env values; provider tokens are AES-256-GCM encrypted at rest	Production secret-store and key-rotation evidence

CASA V2 1 1 CONTROL MATRIX 2026 08 03

CASA v2.1.1 Control Matrix

Authentication

Session Management

Access Control

Communications And Cryptography

Data Validation And Files

Configuration

Blocker And Retest Register

Reproducible Local Evidence

Priority	Action	Evidence needed
P0	Obtain written lab mapping from Google's `Tier 2` notice to current AL/product	Quote/engagement letter
P0	Obtain deadline extension	Lab/Google written confirmation
P0	Enforce or prove MFA for every exposed admin account	Clerk policy capture plus login test
P0	Deploy signed OAuth state and public crawler routes	Immutable image revision and production probes
P1	Complete CSRF, parameter pollution, SSRF, traversal, XSS, upload, and authz DAST	Lab-approved scan output
P1	Verify session lifetimes/cookie flags/logout storage	Redacted browser evidence and test results
P1	Capture production secret-management and key-rotation evidence	Redacted configuration/process evidence