# CASA v2.1.1 Control Matrix Date: 2026-08-03 Baseline: App Defense Alliance CASA Specification and Test Guide v2.1.1, 2026-06-03. The guide defines 48 tests. This is readiness evidence, not an LoV or independent assessment. Status meanings: - `Ready`: local code/config or passive production evidence supports the test. - `Inherited`: Clerk/provider control; obtain vendor/config evidence from lab. - `Partial`: evidence exists but dynamic validation or remediation remains. - `Gap`: a required control is not evidenced and is a release blocker. Local fixes in this engagement are not production evidence until an approved deployment and recheck occur. ## Authentication | ID | Status | StratoFusion evidence | Remaining verification | | ----- | --------- | ----------------------------------------------------------------- | ----------------------------------------- | | 1.1.1 | Inherited | Clerk authentication; app/provider rate limiting | Clerk brute-force policy and dynamic test | | 1.1.2 | Inherited | Clerk owns initial credentials/activation | Clerk expiry/randomness evidence | | 1.1.3 | Inherited | App stores no user passwords | Clerk password-storage attestation | | 1.2.1 | Ready | No application default credentials; public surface/passive review | Lab credential sweep | | 1.3.1 | Inherited | Clerk owns out-of-band verifiers | Clerk expiry evidence | | 1.3.2 | Inherited | Clerk owns out-of-band verifiers | Clerk one-use evidence | | 1.3.3 | Inherited | Clerk owns out-of-band verifiers | Clerk randomness evidence | | 1.3.4 | Inherited | Clerk owns out-of-band verifiers | Clerk rate-limit evidence | ## Session Management | ID | Status | StratoFusion evidence | Remaining verification | | ----- | --------- | -------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- | | 2.1.1 | Ready | Provider codes remain callback parameters; tokens are not placed in URLs; log scanner passes | Lab traffic review | | 2.2.1 | Partial | Clerk sign-out and auto-logout exist | Prove server session invalidation and all-device behavior dynamically | | 2.2.2 | Inherited | Password change/session management is Clerk-owned | Clerk configuration evidence | | 2.2.3 | Inherited | Clerk signs session tokens | Confirm configured maximum stateless lifetime is at most 24h | | 2.3.1 | Inherited | Clerk production cookies observed behind HTTPS | Capture authenticated `Secure` cookie evidence without recording values | | 2.3.2 | Inherited | Clerk owns session cookies | Capture `HttpOnly` attribute without recording values | | 2.3.3 | Ready | User auth uses Clerk sessions; service secrets stay server-side | Lab traffic review | | 2.3.4 | Inherited | Clerk JWT/session integrity | Clerk signing/replay evidence | | 2.4.1 | Ready | Sensitive routes require a full authenticated session and ownership | Dynamic negative tests | ## Access Control | ID | Status | StratoFusion evidence | Remaining verification | | ----- | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------- | | 3.1.1 | Ready | Route-level auth scan passes; ownership is enforced in trusted server/services | Lab role matrix | | 3.1.2 | Ready | User/provider/account identifiers are re-resolved server-side | ID tampering tests | | 3.1.3 | Ready | High-risk handlers fail closed; error sanitizer and auth tests | Broad exception-path DAST | | 3.1.4 | Ready | Delete/download/operation ownership security tests | Cross-user CRUD DAST | | 3.1.5 | Partial | OAuth state HMAC, Clerk controls, webhook signatures, non-GET mutations | Complete CSRF/automation DAST across legacy routes | | 3.1.6 | Ready | Next/Caddy do not expose filesystem directory indexes | Lab path sweep | | 3.2.1 | Ready | Direct providers use authorization-code flows; no implicit/password grant | Provider traffic capture | | 3.2.2 | Ready locally | `oauth-state.ts` signs state with HMAC-SHA256, adds random nonce/10-minute expiry, validates fixed callback origins, and rejects legacy/tampered state | Deploy and perform end-to-end Google/OneDrive/Dropbox callbacks | | 3.3.1 | Partial | Both configured admins are enrolled; candidate admin boundaries require signed second-factor verification no older than 10 minutes | Deploy and retain redacted stale/missing/unverified rejection evidence | ## Communications And Cryptography | ID | Status | StratoFusion evidence | Remaining verification | | ----- | ------ | ------------------------------------------------------------------------------ | ----------------------------------------------- | | 4.1.1 | Ready | Public app/legal/rclone connections use HTTPS; HSTS and strong headers present | Lab TLS protocol/cipher scan | | 4.1.2 | Ready | Default certificate validation succeeded for public origins | Record certificate chain/expiry in lab evidence | | 4.1.3 | Ready | OAuth tokens use AES-256-GCM; no weak crypto found in review | Assessor crypto inventory | | 4.1.4 | Ready | GCM auth failures throw; crypto module tests cover wrong-key failure | Lab negative verification | ## Data Validation And Files | ID | Status | StratoFusion evidence | Remaining verification | | ------ | ------- | ------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | | 5.1.1 | Partial | Typed parsing and route validation are widespread | Parameter-pollution DAST for the complete API surface | | 5.1.2 | Ready | OAuth success/error origins are configured and allowlisted; host-policy tests pass | Open-redirect DAST | | 5.1.3 | Ready | Local scanner found no `eval()`/dynamic shell execution | Lab SAST | | 5.1.4 | Ready | React escapes output; structured data escapes `<`; Mermaid strict mode | Manual template-injection test | | 5.1.5 | Partial | Provider endpoints are constants and callback origins are allowlisted | Full SSRF inventory/DAST for server-side fetch paths | | 5.1.6 | Ready | No XPath engine/use found; XML parsing does not construct XPath expressions | Malformed XML tests where applicable | | 5.1.7 | Ready | React escaping, CSP, strict Mermaid rendering, focused XSS review | Authenticated XSS DAST | | 5.1.8 | Ready | Drizzle parameterizes database operations; no dynamic SQL issue found | Injection DAST | | 5.1.9 | Ready | rclone uses argument arrays; scanner found no `shell: true` or template-literal exec | Worker command-injection tests | | 5.1.10 | Partial | Provider/path normalization and containment tests exist | Complete traversal/LFI/RFI DAST across download/export routes | | 5.2.1 | Ready | Uploads stream to storage providers and are not executed by the app; size/type metadata is validated where required | Malicious upload DAST and storage response-header check | ## Configuration | ID | Status | StratoFusion evidence | Remaining verification | | ----- | ------------- | --------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- | | 6.1.1 | Ready locally | `pnpm audit --prod`: no known vulnerabilities after Next 15.5.21 and transitive patches | Deploy rebuilt image; lab SCA | | 6.2.1 | Ready | Production environment validation and restricted dev/admin routes | Lab debug-endpoint sweep | | 6.3.1 | Ready | Authorization uses Clerk/route ownership; request `Origin` is only CORS context, not identity | Header-tampering DAST | | 6.4.1 | Ready | Known production/rehearsal names resolve to owned VM/Vercel endpoints; no dangling name found | Full authoritative DNS inventory and takeover scan | | 6.5.1 | Ready | Secret/log scanner passes; token encryption and error sanitization exist | Runtime log sample review without secret export | | 6.6.1 | Partial | In-memory auth state and OAuth storage keys are cleared in relevant flows | Centralize/verify security-sensitive browser-storage clearing on logout | | 6.7.1 | Ready | Secrets are server-side env values; provider tokens are AES-256-GCM encrypted at rest | Production secret-store and key-rotation evidence | ## Blocker And Retest Register | Priority | Action | Evidence needed | | -------- | -------------------------------------------------------------------------------- | ---------------------------------------------- | | P0 | Obtain written lab mapping from Google's `Tier 2` notice to current AL/product | Quote/engagement letter | | P0 | Obtain deadline extension | Lab/Google written confirmation | | P0 | Enforce or prove MFA for every exposed admin account | Clerk policy capture plus login test | | P0 | Deploy signed OAuth state and public crawler routes | Immutable image revision and production probes | | P1 | Complete CSRF, parameter pollution, SSRF, traversal, XSS, upload, and authz DAST | Lab-approved scan output | | P1 | Verify session lifetimes/cookie flags/logout storage | Redacted browser evidence and test results | | P1 | Capture production secret-management and key-rotation evidence | Redacted configuration/process evidence | ## Reproducible Local Evidence ```powershell pnpm env:guard pnpm audit --prod pnpm exec tsx scripts/security-audit/01-token-encryption.ts pnpm exec tsx scripts/security-audit/02-api-authz-scan.ts pnpm exec tsx scripts/security-audit/03-input-validation-scan.ts pnpm exec tsx scripts/security-audit/04-secrets-and-logging-scan.ts pnpm exec vitest run src/lib/__tests__/oauth-helpers.test.ts src/app/api/google/__tests__/route.test.ts pnpm lint pnpm typecheck pnpm build ``` Do not run active production scans or destructive rclone checks without the separate approvals required by the engagement scope.