Choose at least one archetype and one data classification, then generate.
Risk profile
Paranoia level
Detection-only PL
Inbound threshold
Outbound threshold
ASVS target
Protection coverage score (indicative)
Rule families & local rules
ID
Name
Level
Status
Reason
Threat references
No coraza.conf or Caddyfile is generated because Caddy + Coraza is not selected. The configuration for the selected WAF is on the Vendors tab.
coraza.conf
Rate-limit zones
Zone
Path
Methods
Limit
Key
Bot management controls
OWASP risks and controls
Every item of the selected frameworks. Required items apply to this profile; recommended items are good practice. Edge is what the primary WAF () does about it.
Protection coverage score
Tick Implemented for controls your application, pipeline or mobile client already has. Items a selected product covers start ticked: untick one if that product feature is not enabled in your deployment, and it scores 0. Tick N/A for an item that does not apply to this application: Implemented is cleared and the item is left out of the score. Products score what they cover; attested items score in full and are reported as self-attested in the MD / PDF report. Untick In scope to leave a layer your group does not own out of the score; the choice is kept in this browser and goes into the MD / PDF report.
In scope
Layer
Points
Score
Target
Gaps
By ITSG-33 control family
Family
Points
Score
Vendor to OWASP mapping
edge: the product mitigates the risk when configured · partial: it helps or detects, the application must still fix it · none: an application or pipeline control.
ID
Risk
Controls
Pipeline tests
Function
Practice
This baseline
Control cross-walk
Standard
Control
Requirement
OWASP
Implementation
MD and PDF contain the full baseline report: summary, OWASP coverage, WAF and bot controls, vendor mapping, engineering baselines, this matrix and the configuration. The CSV, MD and PDF downloads list only the standard selected above (All lists both).