Production dependency audit
0 reported vulnerabilities
0 Critical · 0 High · 0 Medium · 0 Low
384 production dependencies reviewed
SECURITY ACROSS THE OPERATING LIFECYCLE
Protect your operational information. Preserve evidence you can review.
StockIMS applies security controls across your identity, permissions, requests, files, backups, audit history, integrations, and deployment—not only at the login screen.
Employee identities, asset identifiers, licensing data, office infrastructure, documents, and operational history are treated as security-sensitive business information.
Review Technical EvidenceSecurity control planePolicy enforced
Protected operating path
Every material action crosses the same security boundary.
Identity, authorization, transaction integrity, and attributable evidence remain connected from request to record.
01
Identity
MFA verified
02
Authorization
Role + scope
03
Operation
Validated write
04
Evidence
Actor retained
Verified event record
- Actor
- operator_041
- Scope
- office_id:12
- Decision
- authorized
- Evidence
- audit#8A21
Controls resolved
- Session active
- Permission matched
- Event committed
- 107/107
- tests passed
- 0
- reported vulnerabilities
- 10/10
- OWASP categories reviewed
RELEASE-SPECIFIC ENGINEERING EVIDENCE
Recorded results, presented with their scope intact.
Automated quality and regression suite
107/107
107 passed · 0 failed
React Doctor
100/100
No diagnostics · no issues found
OWASP Top 10:2025
10/10
All categories reviewed through an engineering self-audit
Passive DAST
64 passed
0 failed passive checks
TypeScript and ESLint
Passed
0 TypeScript errors · 0 reported lint errors
The displayed figures come from reports generated on 12 June 2026.
These figures are release-specific engineering results. They are not a permanent guarantee against future vulnerabilities and do not represent third-party certification.
SIX SECURITY PROMISES
Security controls aligned with how an IT operations team actually works.
Each control area is expressed around your operational outcome, while the implementation remains available for your source-level review after acquisition.
01 / PROTECT IDENTITIES
Keep unauthorized users away from operational data.
Local and Microsoft identities enter through layered controls designed for secure account and session behavior.
- Local accounts and Microsoft Entra SSO
- TOTP multi-factor authentication
- Password-policy enforcement
- Authentication throttling and account lockout
- Disabled-account rejection
- Session invalidation after sensitive changes
02 / ENFORCE LEAST PRIVILEGE
Give each operator only the access their responsibility requires.
Start with a role, then narrow or adjust access for the user, office, licensing domain, or networking responsibility.
- Server-side permissions
- Custom roles and user overrides
- Office, license-category and networking scopes
- Direct-record authorization
- Owner-only administrative boundaries
- Permission-aware documents, exports, backups and Stocky answers
03 / TREAT REQUESTS AS UNTRUSTED
Validate requests, files, identifiers, and structured data before use.
Input controls reduce the risk that malformed or untrusted data reaches protected operations, files, or database records.
- CSRF protection and origin validation
- Schema validation
- Database operations without concatenating untrusted input
- Rate limiting and sanitized errors
- File, filename and path constraints
- Malformed image and unsafe SVG rejection
04 / PROTECT RECOVERY MATERIAL
Keep backups private, verifiable, and recoverable.
Backup value depends on confidentiality, integrity, and a controlled path back to service.
- Authenticated backup encryption
- Local or private S3-compatible storage
- Integrity verification
- Corruption, truncation and wrong-key rejection
- Controlled restore and operation locking
- Restore safety backup
05 / PRESERVE ACCOUNTABLE HISTORY
Retain context that explains material operational change.
Material operational, security, administrative, import/export, integration, and recovery actions produce attributable audit history.
- Actor, action, affected record and time
- Operational context and former-user attribution
- Safe identifier search
- Secret redaction and masked license keys
- Filtered audit exports
06 / DEPLOYMENT UNDER YOUR CONTROL
Keep infrastructure, data stores, and secrets under your control.
Deploy through Docker on your own servers or inside cloud infrastructure you control.
- Your private PostgreSQL
- Your persistent local or private S3-compatible storage
- Non-root runtime and restricted privileges
- Health checks and environment validation
- Your secrets and configuration
STOCKY AI BOUNDARY
AI assistance without bypassing access control.
Stocky operates through read-only application tools and respects the requesting user's effective permission and office scope. Your organization selects the AI provider, controls the credentials and model, and remains responsible for the provider's usage, retention, and data-processing terms.
OWASP-ALIGNED ENGINEERING
All ten OWASP Top 10:2025 categories reviewed.
This is an engineering self-audit, not an OWASP certification. The review connects each category to relevant application controls and release-specific evidence.
Broken Access Control
Server permissions, operating scopes, direct-record checks, and Owner boundaries.
Security Misconfiguration
Environment validation, private networking, restricted runtime, and health checks.
Software Supply Chain Failures
Lockfile builds, production dependency auditing, and versioned migrations.
Cryptographic Failures
Password hashing, protected MFA secrets, authenticated backup encryption, and HTTPS.
Injection
Schema validation and database operations that do not concatenate untrusted input.
Insecure Design
Least privilege, recovery safeguards, rate limits, protected QR workflows, and attribution.
Authentication Failures
Password policy, generic failures, throttling, lockout, MFA, and session invalidation.
Software or Data Integrity Failures
Verified backups, corruption rejection, controlled restore, and migrations.
Security Logging & Alerting Failures
Attributable history for material security, administrative, and recovery activity.
Mishandling of Exceptional Conditions
Sanitized failures, controlled recovery behavior, locks, and health monitoring.
EVIDENCE FOR YOUR CONTROL PROGRAM
Useful evidence for your control program.
StockIMS can contribute technical controls and historical evidence to your ISO 27001, SOC 2, cyber-insurance, internal-control, and IT-governance initiatives. Certification remains specific to your organization, people, processes, policies, and deployment.
ISO 27001SOC 2Cyber insuranceInternal controlIT governance
READY FOR YOUR TECHNICAL REVIEW
Evaluate the controls around the workflows your IT team performs every day.
Bring your permission model, identity-provider questions, deployment requirements, and audit use cases to a structured technical review.
START WITH THE OPERATIONAL GAP
Show us where control breaks down.
Choose the outcome you need. The inquiry maps it to the StockIMS operating model, so our first conversation starts with useful context—not a generic sales script.