code detected?"} + Detect -->|No| NA["Minimal report
21 ร NOT APPLICABLE"] + + Detect -->|Yes| Engine + subgraph Engine["Deterministic CLI โ cli/dsgai_scan.py ยท stdlib + ripgrep ยท no LLM"] + direction TB + Scan[Scan 21 DSGAI controls
107 PCRE rules] + CVE[CVE enrichment
6 ecosystems ยท cached] + Scan --> Out[DSGAI-scan.json
+ SARIF 2.1.0] + CVE --> Out + end + CVE -. package + version only .-> Sources((OSV ยท NVD)) + + Out --> Skill[Claude Code skill
classify ยท judge ยท prose] + Skill --> Report[Timestamped HTML report
STRICT-redacted] + Out --> Renderer[cli/dsgai_report.py
deterministic HTML] + Renderer --> Report + Out --> CodeScan[GitHub Code Scanning] -Required repo secret: `ANTHROPIC_API_KEY`. Optional: `NVD_API_KEY` (raises rate limit). `GITHUB_TOKEN` is auto-provided by Actions. + Report --> Auditor([Auditor / GRC]) + Report --> Ticket([Jira / backlog]) + CodeScan --> PR([PR annotations]) -```yaml -# .github/workflows/dsgai-scan.yml -name: OWASP DSGAI Compliance Scan -on: - pull_request: { branches: [main] } - workflow_dispatch: -# ... full workflow body in ./integrations/dsgai-scan.yml + style Engine fill:#0f172a,color:#fff + style Skill fill:#7c3aed,color:#fff + style Report fill:#16a34a,color:#fff + style CodeScan fill:#0b7285,color:#fff + style NA fill:#6b7280,color:#fff + style Sources fill:#e0e7ff,color:#1e1b4b ``` -See [`integrations/dsgai-scan.yml`](integrations/dsgai-scan.yml) for the complete workflow. - -### Pre-commit Hook (fast secret scan only) +**Value-bearing rules never surface the secret.** Credential/PII patterns run through ripgrep in erase-the-match mode (`rg -o --replace ''`), so the matched value is destroyed *inside ripgrep* before anything is emitted โ it cannot reach the report, the checkpoint, or a tool call. See [How redaction works](#how-redaction-works). -A pre-commit hook that runs a fast subset (DSGAI02 hardcoded LLM API key scan) to block secrets before commit. See [`integrations/pre-commit-hook.md`](integrations/pre-commit-hook.md) for the recipe. +## Features ---- - -## What Gets Scanned - -All 21 DSGAI risks from the OWASP GenAI Data Security framework: - -| Risk | Control Area | Scope | +| | | +|---|---| +| ๐ฏ **Deterministic engine** | 107 PCRE rules, run via `rg --pcre2`. Identical findings on identical input โ a compliance report you can diff, not an LLM opinion. | +| ๐ **Redaction by construction** | Value-bearing matches are erased inside ripgrep; the checkpoint schema *forbids* content fields (machine-checked). | +| ๐งพ **SARIF 2.1.0 โ Code Scanning** | Native GitHub Code Scanning annotations on changed lines, plus a portable artifact. | +| ๐ **CVE enrichment, no hallucination** | The CLI queries OSV (+ NVD for CVSS) per pinned version across **6 ecosystems**; the LLM never transcribes CVE data. Cached, offline-capable. | +| ๐ **Multi-language** | Python, JS/TS, Java, Kotlin, Go, and credential coverage for **C#, Rust, Ruby**. | +| ๐งฐ **Ships with the ecosystem** | A [gitleaks](integrations/gitleaks/dsgai.toml) rule pack and a [Semgrep](dist/dsgai.semgrep.yaml) export so incumbent toolchains carry the framework. | +| ๐๏ธ **Team-scale controls** | Inline `# dsgai-ignore` suppressions (with reasons), a **baseline** so CI gates only on new findings, and incremental `--diff` scans. | +| โ **Tested & gated** | A public [vulnerable fixture app](tests/fixtures/vulnerable-app/) with a line-pinned answer sheet and a CI self-test that makes external rule PRs safe to merge. | +| ๐ฃ๏ธ **Honest reporting** | STRICT mode renders stable file IDs, never the secret; the report declares its own residual risk instead of implying it can be published as-is. | + +### The 21 DSGAI controls + +
+
-| Tier | Colour | Meaning | Example |
-|---|---|---|---|
-| **Tier 1** | ๐ด Red | Fix today. FAIL items + exploitable CVEs affecting your repo. | Hardcoded `sk-` API key; unauthenticated vector store; `torch.load()` unsafe pickle. |
-| **Tier 2** | ๐ก Yellow | Architecture backlog. WARN items + structural improvements. | Add circuit breaker; centralize PII redaction middleware; replace third-party LLM call with internal gateway. |
-| **Tier 3** | ๐ต Blue | Maturity program. NOT VALIDATED items needing process evidence. | Run quarterly red-team exercise; complete DPIA; commission AppSec architecture review. |
+## Usage
-Vendor attestations to request from BUY/BOTH controls render as a separate ๐ฃ purple card.
+### Deterministic CLI
----
+`cli/dsgai_scan.py` is a single stdlib-only file that shells out to ripgrep. Subcommands:
-## Evidence Safety โ Structural vs Value-Bearing Patterns
+| Command | What it does |
+|---|---|
+| `scan [path]` | Run the ruleset; emit `DSGAI-scan.json`, SARIF, and/or a table. |
+| `detect [path]` | Exit 0 if the repo contains GenAI/agentic signals, 1 otherwise. |
+| `doctor` | Check Python, ripgrep + PCRE2, and that the ruleset loads. |
+| `baseline [path]` | Snapshot current findings to a baseline file. |
+| `cve [path]` | CVE enrichment only, from dependency manifests. |
-When the skill scans your codebase and finds a match, it needs to include that evidence in the report. Not all matches are equal โ some show *architectural gaps* (safe to display), others target *credential and PII-bearing lines* (must never appear in a shareable report).
+Key `scan` flags (all combinable):
-### Structural Patterns [STRUCTURAL]
+| Flag | Effect |
+|---|---|
+| `--sarif FILE` | Write SARIF 2.1.0 for GitHub Code Scanning. |
+| `--json-out FILE` | Write the `DSGAI-scan.json` checkpoint. |
+| `--internal` | Render full paths (default STRICT renders file IDs). |
+| `--scope PATH` | Restrict the scan to a sub-directory. |
+| `--exclude PATH` | Exclude a path/glob (repeatable). |
+| `--diff REF` | Incremental: only files changed vs `REF`. |
+| `--baseline FILE` | Gate only on findings **not** in the baseline. |
+| `--no-cve` / `--offline` / `--refresh-cve` | Control CVE enrichment & caching. |
+| `--fail-on {fail,warn}` | Exit non-zero at this threshold (CI gating). |
+
+Suppress a finding inline (a reason is required, and it stays visible in a *Suppressed* section):
+
+```python
+db.execute(query) # dsgai-ignore: P12.1 reason="reviewed 2026-07 โ ORM param binding"
+```
-The match shows a code *pattern* โ a missing import, an absent decorator, a function call without a required argument. The matched line contains no runtime secret or PII. It is reproduced in the evidence block because it proves the finding without exposing anything sensitive.
+### Claude Code skill
-**Examples (safe to show):**
-```
-# DSGAI04 โ torch.load() without weights_only=True
-loader.py:22 โ model = torch.load(model_path)
+The skill prefers the bundled CLI and falls back to an in-context scan if it isn't present; the report header names which engine ran.
-# DSGAI06 โ MCP server binding all interfaces with no auth middleware
-server.py:42 โ uvicorn.run(app, host="0.0.0.0", port=8001)
+| Command | What it does |
+|---|---|
+| `/dsgai_scanner_tool` | Full scan. STRICT redaction, CVE enrichment, whole repo. |
+| `/dsgai_scanner_tool --internal` | Full file paths (team-internal report). |
+| `/dsgai_scanner_tool --no-cve` | Skip CVE lookups (air-gapped / offline). |
+| `/dsgai_scanner_tool --scope app/agents/` | Scan one sub-directory (monorepos). |
+| `/dsgai_scanner_tool --diff main --baseline dsgai-baseline.json` | Incremental, gated on new findings. |
-# DSGAI20 โ FastAPI endpoint missing rate-limiting decorator
-main.py:55 โ @app.post("/chat") # no @limiter.limit decorator
+### Other AI coding tools
-# DSGAI05 โ similarity_search() missing access-control filter
-retriever.py:41 โ results = vectorstore.similarity_search(query, k=5)
-```
+The tool-neutral variant [`dsgai_scanner_prompt.md`](dsgai_scanner_prompt.md) is generated from the skill (so the two never drift) and works with any assistant that can run shell commands โ Cursor, Copilot Chat, ChatGPT, Gemini. Paste it as instructions and give the model access to your files and a shell.
-### Value-Bearing Patterns [VALUE-BEARING โ ๏ธ]
+## CI/CD and Code Scanning
-The match specifically targets lines where the *content IS the sensitive value* โ a credential assignment, a secret key, a connection string, or a log statement that may contain PII. Reproducing this in a shareable report would leak the actual value.
+### GitHub Action โ [`integrations/dsgai-scan.yml`](integrations/dsgai-scan.yml)
-The skill applies a **six-step protocol** (V1โV6, defined in the skill file) that guarantees the matched value never enters the report, the on-disk checkpoint file, or any persistent tool call. Additionally, every STRUCTURAL match is swept for accidental secret patterns before display.
+A hardened, **two-job** workflow. The design keeps secrets away from any job that reads untrusted code:
-**What the report shows for value-bearing findings:**
-```
-config.py:12 โ hardcoded OpenAI API key pattern detected (value redacted โ review file directly)
-config.py:18 โ hardcoded vector store auth token pattern detected (value redacted โ review file directly)
-logging.py:28 โ prompt logging statement detected (content redacted โ review file directly)
-```
+- **`scan`** โ runs the **deterministic CLI only**: no LLM, no API key, no network egress with a secret. Safe on fork PRs. Uploads **SARIF to Code Scanning** (same-repo) and the checkpoint as an artifact.
+- **`narrate`** โ renders the HTML report **deterministically** (`cli/dsgai_report.py`); no LLM, no secret either.
-The four DSGAI controls whose scans are classified VALUE-BEARING:
+All third-party actions are **pinned by commit SHA**. Gating is **report-only by default** โ set the repo variable `DSGAI_FAIL_ON` to `fail` or `warn` to break the build. No `ANTHROPIC_API_KEY` is required.
-| Control | Why value-bearing |
-|---|---|
-| **DSGAI02** โ Agentic Credential Management | Matches lines containing actual API keys, database passwords, JWT secrets, cloud credentials |
-| **DSGAI13** โ Vector Store Security | May match lines where vector store auth tokens are hardcoded as literal values |
-| **DSGAI14** โ AI Telemetry Security | Matches log statements whose format strings reference PII fields or contain inline test data |
-| **DSGAI15** โ Context Window Security | Matches system prompt construction that may embed credential strings or sensitive config |
+> [!IMPORTANT]
+> CI always scans in STRICT mode (file IDs, never full paths or values). Don't pass `--internal` in a workflow whose artifacts or logs are visible beyond your team.
-All 17 remaining controls (DSGAI01, 03โ12, 16โ21) are **STRUCTURAL** โ matched content is always safe to show (after defense-in-depth secret sweep).
+### Pre-commit โ gitleaks pack + portable fallback
----
+Block hardcoded credentials before they land. Recommended path is the [gitleaks rule pack](integrations/gitleaks/dsgai.toml) (entropy-aware, cross-platform); a zero-dependency [ripgrep script](integrations/dsgai-secret-scan.sh) is provided as a bash-3.2-safe fallback. See [`integrations/pre-commit-hook.md`](integrations/pre-commit-hook.md).
-## Report Output
+### Semgrep pack
-Every control is rated PASS / WARN / FAIL / NOT VALIDATED / NOT APPLICABLE / VENDOR ATTESTATION REQUIRED โ click to expand the full list.
+ +| Risk | Control | Responsibility | |---|---|---| | DSGAI01 | Training Data Privacy | BOTH | -| DSGAI02 | Agentic Identity & Credential Management | BUILD | -| DSGAI03 | Shadow AI & Unauthorized Data Flows | BOTH | +| DSGAI02 | Agentic Identity & Credential Management | BUILD | +| DSGAI03 | Shadow AI & Unauthorized Data Flows | BOTH | | DSGAI04 | AI Supply Chain Security | BUILD | | DSGAI05 | RAG Data Security | BUILD | -| DSGAI06 | MCP & Plugin Security | BUILD | +| DSGAI06 | MCP & Plugin Security | BUILD | | DSGAI07 | Data Lifecycle Management | BUILD | -| DSGAI08 | Regulatory & Privacy Compliance | BOTH | +| DSGAI08 | Regulatory & Privacy Compliance | BOTH | | DSGAI09 | Multimodal AI Data Security | BOTH | | DSGAI10 | Synthetic Data Security | BUILD | | DSGAI11 | Multi-Tenant Data Isolation | BUILD | | DSGAI12 | Database Agent Security | BUILD | | DSGAI13 | Vector Store Security | BUILD | -| DSGAI14 | AI Telemetry & Observability Security | BUILD | +| DSGAI14 | AI Telemetry & Observability Security | BUILD | | DSGAI15 | Context Window Data Security | BUILD | -| DSGAI16 | AI IDE Plugin & Extension Security | BUILD | -| DSGAI17 | AI System Resilience & Availability | BUILD | +| DSGAI16 | AI IDE Plugin & Extension Security | BUILD | +| DSGAI17 | AI System Resilience & Availability | BUILD | | DSGAI18 | Model Output Data Security | BUILD | | DSGAI19 | AI Data Labeling Security | BUILD | | DSGAI20 | Inference API Security | BOTH | | DSGAI21 | Knowledge Store Security | BUILD | -Each control is rated: **PASS** / **WARN** / **FAIL** / **NOT VALIDATED** / **NOT APPLICABLE** / **VENDOR ATTESTATION REQUIRED**. - -> **VENDOR ATTESTATION REQUIRED** is new in v0.2. For BUY-tagged controls and the BUY portions of BOTH-tagged controls, the code scan cannot determine compliance โ the report lists exactly which vendor attestations to request (e.g. SOC 2 report, training data retention policy, rate-limit documentation). - -### Remediation Tiers +**[BUILD]** you implement (scanned mechanically) ยท **[BUY]** the vendor is responsible (emits a *Vendor Attestation Required* callout) ยท **[BOTH]** shared. See the **Reference โ Scope annotation** section below. -Each finding in the Recommendations section is tagged with one of three tiers so teams can sequence work: +
- 
-
- DSGAI report rendered deterministically (cli/dsgai_report.py) from a scan of the public fixture app โ STRICT mode, file IDs + line numbers only, zero real-repo disclosure. Fully reproducible.
-
+
+
+ Rendered deterministically by cli/dsgai_report.py from a scan of the public fixture app โ STRICT mode, file IDs + line numbers only, zero real-repo disclosure. Fully reproducible.
+
+Checkpoint file โ
----
+The CLI writes a schema-validated checkpoint alongside the report: framework/ruleset versions, per-control statuses, findings (control, rule ID, rendered path, line, status), suppressed findings, and CVEs. It carries **no** match content by construction. In STRICT mode it holds file IDs, not full paths โ but it still records which controls fail and where, so treat it as a security artifact (commit only if your threat model allows, or `.gitignore` it).
-## Exporting to PDF
+
-**Option 1 โ Browser print (simplest):**
-Open `DSGAI-report.html` in Chrome or Edge โ `Ctrl+P` / `Cmd+P` โ Save as PDF. All cards expand automatically for print.
+Checkpoint file โ DSGAI-scan.json
----
+The CLI writes a schema-validated checkpoint alongside the report: framework/ruleset versions, per-control statuses, findings (control, rule ID, rendered path, line, status), suppressed findings, and CVEs. It carries **no** match content by construction. In STRICT mode it holds file IDs, not full paths โ but it still records which controls fail and where, so treat it as a security artifact (commit only if your threat model allows, or `.gitignore` it).
-## Exporting to PDF
+
+.html"
```
----
-
-## Scope Annotation
-
-Each DSGAI control is tagged by responsibility:
-
-- **[BUILD]** โ your team implements this in the codebase. Scanned mechanically.
-- **[BUY]** โ the LLM provider / SaaS vendor is responsible. Emits a `VENDOR ATTESTATION REQUIRED` callout listing what to request.
-- **[BOTH]** โ shared responsibility. The BUILD portion is scanned; the BUY portion emits a vendor attestation callout.
+
-Controls with BUY-side aspects (DSGAI01, 08, 09, 20) generate a consolidated "Vendor Attestations to Request" recommendation card.
+Export to PDF
-**Option 2 โ Chrome headless (scriptable):** +**Browser:** open the report in Chrome/Edge โ `Ctrl/Cmd+P` โ Save as PDF (cards expand for print). +**Headless:** ```bash -# macOS -"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" \ - --headless=new --print-to-pdf=DSGAI-report.pdf \ - --print-to-pdf-no-header "file://$(pwd)/DSGAI-report.html" - -# Linux google-chrome --headless=new --print-to-pdf=DSGAI-report.pdf \ - --print-to-pdf-no-header "file://$(pwd)/DSGAI-report.html" -``` - -```powershell -# Windows (PowerShell) -& "C:\Program Files\Google\Chrome\Application\chrome.exe" ` - --headless=new --print-to-pdf=DSGAI-report.pdf ` - --print-to-pdf-no-header "file:///$((Get-Location).Path)/DSGAI-report.html" + --print-to-pdf-no-header "file://$(pwd)/dsgai-reports/DSGAI-report-
+
-**OWASP GenAI Data Security Risks and Mitigations 2026 (v1.0, March 2026)**
-[https://genai.owasp.org/resource/owasp-genai-data-security-risks-mitigations-2026/](https://genai.owasp.org/resource/owasp-genai-data-security-risks-mitigations-2026/)
+Scope annotation โ BUILD / BUY / BOTH
---- +Each control is tagged by responsibility. **[BUILD]** controls are scanned mechanically. **[BUY]** controls (the vendor's responsibility) emit a `VENDOR ATTESTATION REQUIRED` callout listing exactly what to request (e.g. SOC 2 report, data-retention policy, rate-limit documentation). **[BOTH]** controls scan the BUILD portion and emit an attestation callout for the BUY portion. Controls with BUY aspects (DSGAI01, 08, 09, 20) consolidate into one *Vendor Attestations to Request* card. -## Based On +
+
-## Cost & runtime
+## Cost and runtime
-- **CLI-only mode: $0.** `python cli/dsgai_scan.py scan .` uses no LLM โ just ripgrep. Reproducible findings + SARIF in seconds. This is what the hardened GitHub Action runs on every PR (including fork PRs, since it needs no secrets).
-- **Skill mode (LLM orchestration):** a full scan of the public fixture app renders in roughly **1โ3 minutes** in Claude Code; token cost depends on repo size and the report prose. The deterministic engine does the matching; the model only classifies, writes remediation prose, and renders the report โ so cost scales with findings, not lines of code.
-- **Fork PRs:** the Action's scan job runs on forks and uploads the SARIF as an artifact (Code Scanning upload is skipped โ fork tokens can't write security events); the LLM narration job is skipped on forks by design.
-- Incremental `--diff` scans (seconds, near-zero cost) are planned for **v0.4**.
+- **CLI-only mode: $0.** `python cli/dsgai_scan.py scan .` uses no LLM โ just ripgrep. Reproducible findings + SARIF in seconds. This is what the Action runs on every PR (including forks, since it needs no secrets).
+- **Skill mode:** a full scan of the fixture app renders in ~1โ3 minutes in Claude Code; token cost scales with findings and report prose, not lines of code โ the deterministic engine does the matching.
+- Everything runs **locally**. Only package names + pinned versions go to public CVE databases, and only if you don't pass `--no-cve`.
## Contributing
+> [!TIP]
> **Found a wrong result? That's a contribution.** Run the scan on your repo and file a
-> [false-positive](../.github/ISSUE_TEMPLATE/scanner-false-positive.yml) or
-> [false-negative](../.github/ISSUE_TEMPLATE/scanner-false-negative.yml) issue โ every
-> accepted report becomes a permanent, credited test case. No code required.
-
-This is an OWASP project. Contributions welcome โ open an issue or PR against [GenAI-Security-Project/GenAI-Data-Security-Initiative](https://github.com/GenAI-Security-Project/GenAI-Data-Security-Initiative).
+> [false-positive](https://github.com/GenAI-Security-Project/GenAI-Data-Security-Initiative/issues/new?template=scanner-false-positive.yml) or
+> [false-negative](https://github.com/GenAI-Security-Project/GenAI-Data-Security-Initiative/issues/new?template=scanner-false-negative.yml) issue โ every accepted
+> report becomes a permanent, credited test case in the fixture corpus. No code required.
-When proposing new scan patterns:
-1. Classify them as STRUCTURAL or VALUE-BEARING (use the table in the skill's Step 2)
-2. Validate the PCRE pattern with `rg --pcre2 'pattern' .` against a real repo
-3. For VALUE-BEARING patterns, prove the value never escapes by inspecting `DSGAI-scan.json` after a test run
+Detection rules live as data in [`rules/dsgai-rules.yaml`](rules/dsgai-rules.yaml) (schema-validated, compiled to JSON). To add or fix a rule, see [`rules/README.md`](rules/README.md) and the full guide in [`CONTRIBUTING.md`](CONTRIBUTING.md); the [`ROADMAP.md`](ROADMAP.md) tracks what's planned. Every rule ships with positive **and** negative fixture cases โ the CI self-test is the gate.
-See [`CONTRIBUTING.md`](CONTRIBUTING.md) for the full contributor guide and the
-[`ROADMAP.md`](ROADMAP.md) for what's planned.
+### Non-goals
-## Non-goals
+To stay maintainable and trustworthy, some things are deliberately out of scope:
-To keep the scanner maintainable and trustworthy, some things are deliberately out of scope:
-
-- **We will not reimplement general-purpose secret scanning.** We ship a gitleaks rule
- pack instead (see `integrations/gitleaks/`) and lean on battle-tested tooling for
- entropy-based detection.
-- **We will not become a general-purpose SAST tool.** Scope is the 21 DSGAI controls and
- the GenAI-specific patterns behind them โ not every code smell in a repo.
-- **We will not add rules without fixture test cases.** A rule with no positive *and*
- negative test has no defined precision, so it doesn't merge.
-- **We will not accept changes that weaken the redaction guarantees.** Value-bearing
- matches never enter a report, checkpoint, or persisted tool call โ that property is
- non-negotiable.
-
----
+- **No general-purpose secret scanning** โ we ship a gitleaks pack and lean on battle-tested tooling instead.
+- **No general SAST** โ scope is the 21 DSGAI controls, not every code smell.
+- **No rules without fixture tests** โ a rule with no positive *and* negative case has no defined precision.
+- **No changes that weaken the redaction guarantee** โ that property is non-negotiable.
## License
-This skill is based on materials licensed under [Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0)](https://creativecommons.org/licenses/by-sa/4.0/legalcode).
+Based on the **OWASP GenAI Data Security Risks and Mitigations 2026 (v1.0, March 2026)**, licensed under [Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0)](https://creativecommons.org/licenses/by-sa/4.0/legalcode). *(A split that keeps framework text under CC BY-SA 4.0 while re-licensing the executable code under Apache-2.0 is under review with OWASP leadership.)*
-**Original work:** OWASP GenAI Data Security Risks and Mitigations 2026 (v1.0, March 2026) by the [OWASP GenAI Data Security Initiative](https://genai.owasp.org/initiative/data-security/), led by [Emmanuel Guilherme Junior](https://www.linkedin.com/in/emmanuelgjr/).
+**Framework & scanner** by the [OWASP GenAI Data Security Initiative](https://genai.owasp.org/initiative/data-security/), led by [Emmanuel Guilherme Junior](https://www.linkedin.com/in/emmanuelgjr/). v0.1 groundwork by Harish Ramachandran.
-**This adaptation:** Created by [Harish Ramachandran](https://www.linkedin.com/in/harish-ramachandran-a8026443/). You are free to share and adapt this skill for any purpose, including commercial use, under the same CC BY-SA 4.0 terms.
+Remediation tiers
-[OWASP GenAI Data Security Initiative](https://genai.owasp.org/initiative/data-security/) โ led by [Emmanuel Guilherme Junior](https://www.linkedin.com/in/emmanuelgjr/). +| Tier | Meaning | Example | +|---|---|---| +| ๐ด **Tier 1** โ fix today | FAIL items + exploitable CVEs | Hardcoded `sk-` key; unauthenticated vector store; unsafe `torch.load()` | +| ๐ก **Tier 2** โ architecture backlog | WARN + structural gaps | Add a circuit breaker; centralize PII redaction; route via an internal LLM gateway | +| ๐ต **Tier 3** โ maturity program | NOT VALIDATED (process evidence) | Quarterly red-team; complete a DPIA; commission an AppSec review | ---- +
+Part of the OWASP GenAI Data Security Initiative ยท genai.owasp.org
+