🛡️ @ellistevo/openclaw-compliance

Static compliance auditor for codebases. Scans for SOC2, GDPR, and HIPAA issues — hardcoded secrets, PII logging, SQL injection, missing encryption, and more. Generates professional HTML reports ready for auditor review.

Install

npm install -g @ellistevo/openclaw-compliance

CLI Usage

# Scan current directory for all frameworks
compliance-audit

# Scan a specific directory
compliance-audit /path/to/project

# Only SOC2 + GDPR, output HTML report
compliance-audit ./src -f SOC2,GDPR -o report.html

# JSON output for CI/CD pipelines
compliance-audit . --json

# Only high/critical findings
compliance-audit . -s high

Options

| Flag | Description | Default | |------|-------------|---------| | -f, --frameworks | Comma-separated: SOC2, GDPR, HIPAA | SOC2,GDPR,HIPAA | | -s, --severity | Minimum severity: critical, high, medium, low, info | info | | -o, --output | Write HTML report to file | — | | --json | JSON output | false |

Exit Codes

| Code | Meaning | |------|---------| | 0 | No issues | | 1 | Issues found (no criticals) | | 2 | Critical issues found |

Programmatic Usage

import { scan, generateHTML } from '@ellistevo/openclaw-compliance';

const result = await scan('/path/to/project', {
  frameworks: ['SOC2', 'GDPR'],
  severity: 'high',
});

console.log(`Found ${result.stats.totalFindings} issues`);

// Generate HTML report
const html = generateHTML(result);

What It Detects

🔐 Secrets & Credentials (SEC-001 → SEC-003)

• Hardcoded API keys (AWS, Google, GitHub, Stripe, Slack)
• Embedded passwords and private keys
• Database connection strings with credentials

🔑 Authentication (AUTH-001 → AUTH-002)

• Route handlers without auth middleware
• Disabled security headers (CSP, CORS wildcards)

🔒 Encryption (ENC-001 → ENC-002)

• HTTP URLs instead of HTTPS
• Weak cryptographic algorithms (MD5, SHA1, DES)

💉 Injection (INJ-001 → INJ-002)

• SQL injection via string concatenation/template literals
• Command injection via dynamic shell execution

👤 PII & Privacy (PII-001 → PII-002)

• Logging PII/PHI to console or files
• Storing sensitive fields without encryption

🇪🇺 GDPR (GDPR-001 → GDPR-003)

• Data collection without consent patterns
• Missing right-to-erasure / data deletion endpoints
• No privacy policy references

🏥 HIPAA (HIPAA-001 → HIPAA-002)

• PHI access without role-based access control
• Missing audit trail/logging

⚙️ Infrastructure (INFRA-001 → INFRA-003)

• Debug mode enabled
• Missing rate limiting
• No input validation

CI/CD Integration

# GitHub Actions
- name: Compliance Audit
  run: npx @ellistevo/openclaw-compliance . --json -s high -o compliance-report.html

- name: Upload Report
  uses: actions/upload-artifact@v4
  with:
    name: compliance-report
    path: compliance-report.html

License

MIT