About FASE · Framework for Application Security Assurance
Eight areas of SaaS security. Here's where FASE stands on each.
FASE is built to find risks, verify controls, prove tenant isolation and support a release decision. Some of that runs in the hosted service today. Some runs only in the local FASE app, some is a checklist you work through yourself, and some isn't built. This page shows which is which.
- 9Hosted now
- 21Local app only
- 8Guided manual check
- 5Not built yet
Capability map
Pick an area to see what's checked.
01 / 08
Code & application security
Static analysis of one commit in a throwaway sandbox, with secrets detection.
- Secure coding (OWASP Top 10)Semgrep, with a small set of FASE rules. Partial coverage.Hosted
- Static code analysis (SAST)Semgrep runs on every scan.Hosted
- Secrets and hard-coded credentialsGitleaks on current files. Git history isn't scanned.Hosted
- Input validation and output encodingOnly where a Semgrep rule exists for the pattern.Hosted
- Business logic and abuse casesLogic flaws are mostly out of reach for scanners.Manual
02 / 08
Dependencies & supply chain
Known-vulnerable packages from lock files, plus container and build files.
- Known vulnerabilities (CVEs)OSV-Scanner. Needs a lock file, and covers some ecosystems only.Hosted
- Outdated and high-risk packagesNot yet
- Licence and compliance checksNot yet
- Container and build securityTrivy reads Dockerfiles and build configuration.Hosted
03 / 08
Infrastructure & configuration
Infrastructure-as-code from the repository, and live headers from a staging target.
- Hosting and environment hardeningTrivy on infrastructure-as-code files. Accuracy isn't benchmarked yet.Hosted
- Secure configuration (headers, CORS, TLS)Checked against a running staging target.Local app
- Access controls and least privilegeRecorded as a control with evidence.Manual
- Secrets and environment managementGitleaks flags committed secrets and .env files.Hosted
- Logging and monitoring configurationRecorded as a control with evidence.Manual
04 / 08
Authentication & access control
Signed-in testing against staging, with roles checked from the user’s side.
- User registration and verificationAuthenticated sessions against staging.Local app
- Multi-factor authentication (MFA)Manual
- Session management and timeoutLocal app
- Password policy and account lockoutManual
- Role-based access control (RBAC)Compares what each role can reach.Local app
- Privileged access reviewManual
05 / 08
Multi-tenancy & data protection
Checks that one customer can’t read another’s data, including Supabase row-level security.
- Tenant isolation testing (Supabase RLS)Runs queries as each tenant against staging.Local app
- Cross-tenant access preventionLocal app
- Data access and ownership controlsLocal app
- Encryption in transit (TLS)Local app
- Encryption at restManual
- Data segregation and retentionManual
06 / 08
Application testing (DAST)
Tests the running application, not just its code, and only ever a staging target you own.
- Authenticated vulnerability scanningLocal app
- Dynamic application testing (ZAP)OWASP ZAP against staging.Local app
- API security testing (REST)Local app
- API security testing (GraphQL)Not yet
- Common misconfigurationsLocal app
- Exposed endpoints and sensitive dataLocal app
07 / 08
Vulnerability & remediation
Turns findings into owned, tracked work and checks that fixes hold.
- Risk scoring (CVSS) and prioritisationSeverity as reported by each scanner.Hosted
- Remediation tracking and ownershipLocal app
- Verification and re-testingLocal app
- Security debt and trend analysisLocal app
- Time-to-remediate metricsNot yet
08 / 08
Assurance & release governance
Collects the evidence into a report and records who approved the release.
- Consolidated security assessment reportLocal app
- Evidence and test artefact storageLocal app
- Compliance alignment (OWASP)Local app
- Compliance alignment (ISO 27001)Not yet
- Release readiness (go / no-go)Local app
- Audit trail and stakeholder sign-offLocal app
The FASE workflow
From first scan to a release decision.
A repeatable process that leaves evidence at every step. Pick a step, or let it play.
Scan
Assess code, dependencies and configuration from one commit.
- Four scanners in a throwaway sandbox · Hosted
- Shows which scanners didn't run · Hosted
- Authenticated scan of staging · Local app
Verify
Test security, access and tenant isolation against a running staging target.
- ZAP against staging · Local app
- Row-level security as each tenant · Local app
- Role-by-role access comparison · Local app
Remediate
Give each finding an owner and check the fix.
- Findings with severity and file · Hosted
- Owners and remediation tracking · Local app
- Re-test after a fix · Local app
Assure
Collect evidence into a report a reviewer can follow.
- Evidence records per control · Local app
- Assessment report and export · Local app
- ISO 27001 mapping · Not yet
Release
Approve or block the release with the full picture in front of you.
- Go / no-go decision · Local app
- Reviewer sign-off and audit trail · Local app
Coverage & standards
What the checks line up with.
Alignment means a finding or control is tagged to a standard. It isn't certification against it.
- Hosted
OWASP Top 10
Semgrep findings are tagged with OWASP categories.
- Hosted
CWE / CVE
Code findings carry CWE IDs, and package findings carry CVE and OSV IDs.
- Not yet
ISO 27001 controls
Mapping controls to Annex A isn't built.
- Local app
SaaS best practice
Tenant isolation and access checks in the local app.
See what a scan of your repository finds.
FASE is in a pilot. Create your organisation and ask for FASE local. There's nothing to pay.