# Raw Finding Verification & Disposition Report

## 1. Executive Summary & Verification Reconciliation Table
All eleven original raw finding IDs plus newly discovered security/backend findings have received explicit audit dispositions:

| Original Finding ID | Original Title | Original Severity | Original Confidence | Disposition | Verified Evidence | Final Title | Final Severity | Final Confidence | Final Status | Resulting Finding IDs | Explanation |
| :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- |
| `ARCH-001` | Dual Authentication Flow Contract Mismatch between Frontend and Backend Services | HIGH | CONFIRMED | `REVISED` | `src/store/userStore.ts` & `backend/src/auth/auth.controller.ts` | Disconnected Authentication Protocols Between Storefront Client and Backend OTP API | HIGH | CONFIRMED | OPEN | `ARCH-001` | Title updated to clarify protocol desynchronization; severity HIGH retained as auth integration is broken. |
| `FE-001` | SPA Direct Window Location Manipulation Bypasses Routing State Management | MEDIUM | CONFIRMED | `REVISED` | `src/App.tsx#L92-L100` | Absence of Declarative Router Causes SPA State Desynchronization on Direct Links | MEDIUM | HIGH_CONFIDENCE | OPEN | `FE-001` | Confidence adjusted from CONFIRMED to HIGH_CONFIDENCE as runtime bounce rate claims were unverified static observations. |
| `BE-001` | Unsafe Floating Point arithmetic and Non-Atomic Calculation in Order Total Service | HIGH | CONFIRMED | `SPLIT` | `backend/src/orders/orders.service.ts#L10-L23` | Floating-Point Conversion in Monetary Order Total Calculations | HIGH | CONFIRMED | OPEN | `BE-001`, `BE-002` | Split into `BE-001` (monetary precision) and `BE-002` (N+1 query bottleneck during order creation). |
| `ADM-001` | Missing Role-Based Access Control (RBAC) Guard on Administrative Settings Endpoints | HIGH | CONFIRMED | `ACCEPTED` | `backend/src/settings/settings.controller.ts#L27-L109` | Missing Role-Based Access Control (RBAC) Guard on Administrative Settings Endpoints | HIGH | CONFIRMED | OPEN | `ADM-001` | Fully verified. Endpoints apply `JwtAuthGuard` without `RolesGuard` or `@Roles('Admin')`. |
| `DB-001` | Missing Explicit Unique Index Constraint on User Mobile Numbers in Database Schema | MEDIUM | CONFIRMED | `REJECTED_FALSE_POSITIVE` | `backend/prisma/schema.prisma#L15` | N/A | N/A | N/A | REJECTED | None | Contradicted by schema (`mobile String? @unique` exists). Rejected as false positive. |
| `SEC-001` | Insecure Default Hardcoded JWT Secret Key Fallback in Production Configuration | HIGH | CONFIRMED | `ACCEPTED` | `backend/src/auth/jwt.strategy.ts#L10-L15` | Insecure Default Hardcoded JWT Secret Key Fallback in Production Configuration | HIGH | CONFIRMED | OPEN | `SEC-001` | Verified fallback string `'super-secret-key-canina'` in `JwtStrategy`. |
| `SEC-002` | Predictable Deterministic Pseudo-Random Generation of One-Time Passwords (OTP) | HIGH | CONFIRMED | `SPLIT` | `backend/src/auth/auth.service.ts#L19` | Non-Cryptographic Random Generation of SMS OTP Authentication Codes | HIGH | CONFIRMED | OPEN | `SEC-002`, `SEC-003` | Retained `SEC-002` for `Math.random()` PRNG vulnerability and split `SEC-003` for plaintext OTP disclosure in response payload. |
| `TS-001` | Unsafe Implicit any Types and Loose State Typing in Core Application Component | MEDIUM | CONFIRMED | `REVISED` | `src/App.tsx#L55-L57` | Explicit `any` Type Annotations in Main Application State | LOW | CONFIRMED | OPEN | `TS-001` | Severity downgraded from MEDIUM to LOW as maintainability defect confined to local component state. |
| `TEST-001` | Stale Unit Test Specifications Asserting Obsolete Property Signatures | MEDIUM | CONFIRMED | `ACCEPTED` | `backend/src/*/*.spec.ts` | Stale Unit Test Specifications Asserting Obsolete Property Signatures | MEDIUM | CONFIRMED | OPEN | `TEST-001` | Verified across pets, settings, and users spec files. |
| `DEVOPS-001`| Absence of Automated CI/CD Workflow Definitions and Deployment Quality Gates | HIGH | CONFIRMED | `REVISED` | Entire repo root | Absence of Committed CI/CD Pipeline Workflow Definitions in Repository | MEDIUM | CONFIRMED | OPEN | `DEVOPS-001` | Severity adjusted from HIGH to MEDIUM; title clarified to repository-visible workflow scope. |
| `DOC-001` | Static Swagger Specification Desynchronization with Active NestJS Auth Endpoints | MEDIUM | CONFIRMED | `ACCEPTED` | `swagger.yml` vs `auth.controller.ts` | Static Swagger Specification Desynchronization with Active NestJS Auth Endpoints | MEDIUM | CONFIRMED | OPEN | `DOC-001` | Verified static file lists `/auth/login` while backend implements `/auth/send-otp`. |

---

## 2. Newly Discovered & Split Findings (Canonical IDs)
1. **`BE-002`** (NestJS Backend): Synchronous N+1 Query Lookup in Order Item Processing (`backend/src/orders/orders.service.ts#L13-L23`) - Severity: **MEDIUM**, Confidence: **CONFIRMED**.
2. **`SEC-003`** (Security): Plaintext OTP Disclosure in Public API Response Payload (`backend/src/auth/auth.service.ts#L24`) - Severity: **HIGH**, Confidence: **CONFIRMED**.
3. **`TS-002`** (TypeScript / Quality): Missing Required `slug` Field in Prisma Product Seed Script (`backend/prisma/seed.ts#L54`) - Severity: **MEDIUM**, Confidence: **CONFIRMED**.
4. **`TS-003`** (TypeScript / Quality): Non-Type-Only Import of Express Response in Decorated Controller (`backend/src/common/metrics.controller.ts#L18`) - Severity: **LOW**, Confidence: **CONFIRMED**.