Dhahab · Dira

Startup Security
Readiness Report

Meridian Labs (Sample)
Security Readiness Report
Engagement DHB-20260801-MERIDIAN-LABS-SA · August 01, 2026
Prepared by Yusuf Gadelrab · DHAHAB
CONFIDENTIAL — prepared for the named client. Do not redistribute.

Executive summary

We assessed Meridian Labs (Sample)'s codebase — 3 files and 0 third-party dependencies — across seven domains: hardcoded credentials, configuration and infrastructure, dependency vulnerabilities, dependency licensing, git history, security-readiness process evidence.

Overall security grade: C. Workable, but at least one issue here would be raised by a buyer's security team. Startup readiness score: 0% — “Pre-security”. Security process evidence is largely absent. The good news: most of the missing items are files and configuration, not months of engineering.

Security grade
C
Workable, but at least one issue here would be raise
Findings
20
0 critical · 2 high
Readiness
0%
Pre-security
Risk score
34
0 best · 100 worst

The three moves that matter most

  1. SQL built by string concatenation — A misconfiguration that widens your attack surface or fails a security review. Use parameterized queries / bound placeholders.
  2. TLS verification disabled — A misconfiguration that widens your attack surface or fails a security review. Never disable certificate verification; pin a CA bundle instead.
  3. Missing: Dependencies are lock-pinned — Missing process evidence a buyer's security questionnaire asks for. Commit a lockfile (package-lock.json / uv.lock / poetry.lock / Cargo.lock).

7 of the findings are quick wins — single-file or single-setting fixes, most automatable with `dira fix --apply`.

Nothing found here is unusual for a company at this stage — what matters to an enterprise buyer is the trajectory. Close the Week 1 items, re-run the scan, and you walk into the next security questionnaire with evidence instead of promises.

Prioritized findings

P0 fix this week · P1 this month · P2 this quarter · P3 housekeeping. One row per issue type; counts show total occurrences.

PriorityFindingImpactEffortWhat it means / what to do
P1high
SQL built by string concatenation
setup_fixture.sh:30
HighLowA misconfiguration that widens your attack surface or fails a security review.
Fix: Use parameterized queries / bound placeholders.
P1high
TLS verification disabled
setup_fixture.sh:34
HighLowA misconfiguration that widens your attack surface or fails a security review.
Fix: Never disable certificate verification; pin a CA bundle instead.
P2medium
Missing: Dependencies are lock-pinned
ModerateLowMissing process evidence a buyer's security questionnaire asks for.
Fix: Commit a lockfile (package-lock.json / uv.lock / poetry.lock / Cargo.lock).
P2medium
Missing: Automated dependency updates
ModerateLowMissing process evidence a buyer's security questionnaire asks for.
Fix: Add .github/dependabot.yml or renovate.json.
P2medium
Missing: Secret scanning in CI
ModerateLowMissing process evidence a buyer's security questionnaire asks for.
Fix: Add dira / gitleaks / trufflehog as a required CI job and a pre-commit hook.
P2medium
Missing: Automated tests present
ModerateHighMissing process evidence a buyer's security questionnaire asks for.
Fix: Add a tests/ directory and wire it into CI.
P3low
Missing: Code review ownership defined
LowLowMissing process evidence a buyer's security questionnaire asks for.
Fix: Add a CODEOWNERS file and require review on the default branch.
P3low
Missing: Vulnerability disclosure policy
LowLowMissing process evidence a buyer's security questionnaire asks for.
Fix: Add SECURITY.md with a contact address and response SLA.
P3low
Missing: Continuous integration configured
LowMediumMissing process evidence a buyer's security questionnaire asks for.
Fix: Add a CI workflow that installs, lints, and tests on every PR.
P3low
Missing: Static analysis / code scanning
LowMediumMissing process evidence a buyer's security questionnaire asks for.
Fix: Enable CodeQL, Semgrep, bandit, or gosec in CI.
P3low
Missing: Error tracking / monitoring wired in
LowMediumMissing process evidence a buyer's security questionnaire asks for.
Fix: Wire in Sentry, OpenTelemetry, Datadog, or equivalent, with alerting.
P3low
Missing: Incident response / runbook documented
LowMediumMissing process evidence a buyer's security questionnaire asks for.
Fix: Add docs/INCIDENT-RESPONSE.md: severities, on-call, comms, 72h notification path.
P3low
Missing: Backup / recovery documented
LowMediumMissing process evidence a buyer's security questionnaire asks for.
Fix: Document backup schedule, retention, and a tested restore procedure.
P3low
Missing: Infrastructure as code
LowHighMissing process evidence a buyer's security questionnaire asks for.
Fix: Move infra into Terraform / Pulumi / CloudFormation / compose files.
P3low
Missing: Vetted auth implementation
LowHighMissing process evidence a buyer's security questionnaire asks for.
Fix: Use a vetted provider/library (Auth0, Clerk, Supabase Auth, NextAuth, Devise, Django auth).
P3info
Missing: Pre-commit hooks
LowLowMissing process evidence a buyer's security questionnaire asks for.
Fix: Add .pre-commit-config.yaml (or husky) with a secret-scan hook.
P3info
Missing: Config documented without secrets
LowLowMissing process evidence a buyer's security questionnaire asks for.
Fix: Add .env.example listing every required variable with empty values.
P3info
Missing: License declared
LowLowMissing process evidence a buyer's security questionnaire asks for.
Fix: Add a LICENSE file.
P3info
Missing: Reproducible build/runtime definition
LowMediumMissing process evidence a buyer's security questionnaire asks for.
Fix: Add a Dockerfile (non-root, pinned base image).
P3info
Missing: Privacy policy / data handling documented
LowMediumMissing process evidence a buyer's security questionnaire asks for.
Fix: Publish a privacy policy and record what personal data you store and where.

30-day remediation roadmap

Week 1 — Stop the bleeding + quick wins
Weeks 2–3 — Structural fixes
Week 4 — Housekeeping, attestations, and re-scan

Security readiness scorecard · 0%

0 of 80 points · 18 checks weighted by what enterprise security reviews actually ask.

CheckPtsWhy it matters / how to close it
Dependencies are lock-pinned6Unpinned deps mean an attacker who takes over a maintainer account ships straight to prod.
Close it: Commit a lockfile (package-lock.json / uv.lock / poetry.lock / Cargo.lock).
Automated dependency updates6Most breaches start with a known CVE nobody upgraded.
Close it: Add .github/dependabot.yml or renovate.json.
Continuous integration configured5No CI means nothing is verified before it ships.
Close it: Add a CI workflow that installs, lints, and tests on every PR.
Automated tests present6Security fixes you cannot regression-test get silently reverted.
Close it: Add a tests/ directory and wire it into CI.
Secret scanning in CI8Committed keys are the single most common startup breach; catch them before merge.
Close it: Add dira / gitleaks / trufflehog as a required CI job and a pre-commit hook.
Static analysis / code scanning5Buyers ask for evidence of SAST in every security questionnaire.
Close it: Enable CodeQL, Semgrep, bandit, or gosec in CI.
Pre-commit hooks3The cheapest place to stop a secret is the developer's laptop.
Close it: Add .pre-commit-config.yaml (or husky) with a secret-scan hook.
Code review ownership defined4Unreviewed merges to main are the top finding in SOC 2 change-management.
Close it: Add a CODEOWNERS file and require review on the default branch.
Vulnerability disclosure policy4Researchers need a place to report; auditors check for one.
Close it: Add SECURITY.md with a contact address and response SLA.
Config documented without secrets3An .env.example proves config is externalised rather than hardcoded.
Close it: Add .env.example listing every required variable with empty values.
Infrastructure as code4Click-ops infrastructure cannot be reviewed, diffed, or restored.
Close it: Move infra into Terraform / Pulumi / CloudFormation / compose files.
Reproducible build/runtime definition3A Dockerfile makes the runtime auditable and patchable.
Close it: Add a Dockerfile (non-root, pinned base image).
Error tracking / monitoring wired in5You cannot respond to an incident you never see.
Close it: Wire in Sentry, OpenTelemetry, Datadog, or equivalent, with alerting.
Vetted auth implementation4Hand-rolled auth is where startups lose customer data.
Close it: Use a vetted provider/library (Auth0, Clerk, Supabase Auth, NextAuth, Devise, Django auth).
Incident response / runbook documented5Enterprise contracts require a documented breach-notification process.
Close it: Add docs/INCIDENT-RESPONSE.md: severities, on-call, comms, 72h notification path.
Backup / recovery documented4Ransomware and a bad migration have the same fix: tested restores.
Close it: Document backup schedule, retention, and a tested restore procedure.
Privacy policy / data handling documented3Required before you can legally take EU or enterprise customer data.
Close it: Publish a privacy policy and record what personal data you store and where.
License declared2Diligence flags unlicensed code as an IP risk.
Close it: Add a LICENSE file.

Appendix — SOC 2 & vendor-questionnaire readiness

When an enterprise prospect sends a security questionnaire, these are the questions behind it. “Evidenced” means this assessment found repository evidence you can point to; “gap” means answer honestly and attach the roadmap date. Buyers accept gaps with dates — they reject surprises.

StatusBuyer questionSOC 2 controlYour answer today
GapDo you pin and verify third-party dependency versions?CC8.1 — Change managementNot yet — say so, and commit to a date. Close it: Commit a lockfile (package-lock.json / uv.lock / poetry.lock / Cargo.lock).
GapHow do you identify and remediate vulnerable dependencies?CC7.1 — Vulnerability managementNot yet — say so, and commit to a date. Close it: Add .github/dependabot.yml or renovate.json.
GapAre changes built and tested automatically before deployment?CC8.1 — Change managementNot yet — say so, and commit to a date. Close it: Add a CI workflow that installs, lints, and tests on every PR.
GapDo you maintain automated tests that run before release?CC8.1 — Change managementNot yet — say so, and commit to a date. Close it: Add a tests/ directory and wire it into CI.
GapWhat controls prevent credentials from being committed to source code?CC6.1 — Logical access controlsNot yet — say so, and commit to a date. Close it: Add dira / gitleaks / trufflehog as a required CI job and a pre-commit hook.
GapDo you perform static application security testing (SAST)?CC7.1 — Vulnerability managementNot yet — say so, and commit to a date. Close it: Enable CodeQL, Semgrep, bandit, or gosec in CI.
GapWhat controls run on developer machines before code is pushed?CC8.1 — Change managementNot yet — say so, and commit to a date. Close it: Add .pre-commit-config.yaml (or husky) with a secret-scan hook.
GapIs peer review required before changes reach the default branch?CC8.1 — Change managementNot yet — say so, and commit to a date. Close it: Add a CODEOWNERS file and require review on the default branch.
GapDo you operate a vulnerability disclosure process with a response SLA?CC2.3 / CC7.3 — Communication & incident reportingNot yet — say so, and commit to a date. Close it: Add SECURITY.md with a contact address and response SLA.
GapIs application configuration externalised from source code?CC6.1 — Logical access controlsNot yet — say so, and commit to a date. Close it: Add .env.example listing every required variable with empty values.
GapIs infrastructure defined as code and subject to review?CC8.1 — Change managementNot yet — say so, and commit to a date. Close it: Move infra into Terraform / Pulumi / CloudFormation / compose files.
GapAre build and runtime environments reproducible and auditable?CC8.1 — Change managementNot yet — say so, and commit to a date. Close it: Add a Dockerfile (non-root, pinned base image).
GapHow do you detect, alert on, and investigate anomalous activity?CC7.2 — System monitoringNot yet — say so, and commit to a date. Close it: Wire in Sentry, OpenTelemetry, Datadog, or equivalent, with alerting.
GapHow is authentication implemented, and is it a vetted provider or library?CC6.1 — Logical access controlsNot yet — say so, and commit to a date. Close it: Use a vetted provider/library (Auth0, Clerk, Supabase Auth, NextAuth, Devise, Django auth).
GapDo you have a documented incident response plan including customer notification timelines?CC7.3 / CC7.4 — Incident managementNot yet — say so, and commit to a date. Close it: Add docs/INCIDENT-RESPONSE.md: severities, on-call, comms, 72h notification path.
GapDescribe your backup schedule, retention, and most recent tested restore.A1.2 — Availability & recoveryNot yet — say so, and commit to a date. Close it: Document backup schedule, retention, and a tested restore procedure.
GapDo you publish a privacy policy and maintain a record of personal data processing?P1–P8 — Privacy criteriaNot yet — say so, and commit to a date. Close it: Publish a privacy policy and record what personal data you store and where.
GapIs the intellectual-property status of your codebase and dependencies documented?CC1.x — Governance (IP diligence)Not yet — say so, and commit to a date. Close it: Add a LICENSE file.

Manual attestations — outside a repository’s evidence

These cannot be verified from code. Complete and keep them current; every serious questionnaire asks.

Methodology & scope

Static analysis of ~/src/meridian-labs — 3 files, ruleset v1.5.0, 0.02s. Scanners: hardcoded credentials (pattern + entropy, redacted), configuration/IaC, dependency CVEs via OSV.dev, dependency licensing, git history, security-readiness process evidence, and live TLS/header checks where a target was authorized.