One Scan. Twenty Regulations.

Risk Audit — 8-Factor File Scoring

ckb audit evaluates every file on a 0-100 risk scale using 8 weighted factors. The result: a prioritized list of your riskiest files with actionable recommendations.

Complexity is calculated via tree-sitter AST analysis — cyclomatic and cognitive complexity per function across Go, TypeScript, Python, Java, Kotlin, Rust, Ruby, and C/C++.

{
  "items": [
    {
      "file": "drivers/modbus/handler.go",
      "riskScore": 78.5,
      "riskLevel": "high",
      "recommendation": "Security-sensitive code; review before changes",
      "factors": [
        { "factor": "security_sensitive", "value": "password, token, key", "contribution": 15.0 },
        { "factor": "bus_factor", "value": "1 (alice only)", "contribution": 15.0 },
        { "factor": "complexity", "value": "42", "contribution": 8.4 },
        { "factor": "test_coverage", "value": "no tests found", "contribution": 15.0 }
      ],
      "functionComplexity": [
        { "name": "handleModbusWrite", "cyclomatic": 18, "cognitive": 12, "lines": 86 },
        { "name": "parseRegisterMap", "cyclomatic": 14, "cognitive": 9, "lines": 65 }
      ]
    }
  ],
  "quickWins": [
    { "action": "Add tests", "target": "drivers/modbus/handler.go", "effort": "medium", "impact": "high" },
    { "action": "Assign backup owner", "target": "protocol/iec104/stack.go", "effort": "low", "impact": "medium" }
  ]
}

Use --quick-wins to surface files where low effort yields high impact — like adding tests to untested complex code or assigning a backup owner to single-author files.

131 Checks Across 8 Categories

Every check references the specific regulatory article, includes a CWE ID where applicable, a confidence score, and an actionable recommendation.

20 Regulatory Frameworks

Every finding is automatically mapped to the regulations it violates. No manual tagging, no external databases.

Auto-Detect Applicable Frameworks

ckb audit compliance --recommend scans your codebase for indicators — HTTP handlers, PII fields, payment SDKs, ML imports — and recommends frameworks with confidence scores.

Always recommended (universally applicable): ISO 27001 (0.95 confidence), OWASP ASVS (0.90 confidence).

Cross-Framework Mapping

A single finding can violate multiple regulations simultaneously. CKB maps each finding to every applicable framework — one scan replaces separate audits. A hardcoded credential triggers findings in 9 frameworks at once.

From 11,356 to ~50 Findings

In v8.3 we rewrote the false-positive filtering for the compliance engine. Confidence scoring, context-aware analysis, and AST-based checks replaced naive pattern matching.

Scoring & Verdicts

Each framework is scored individually, then aggregated into a total compliance score. CI mode returns exit codes so you can gate deployments on compliance.

Per-framework score: (passed checks / total checks) × 100. Use --fail-on=error|warning|none to set the severity gate.

How CKB Compares

Most tools check for vulnerabilities. CKB maps findings to the regulatory language auditors actually ask about.

CI/CD Integration

Gate pull requests on compliance. Output as SARIF for GitHub Code Scanning, or markdown for PR comments. Weekly risk audits via cron to catch drift.

name: Compliance Audit
on:
  pull_request:
    types: [opened, synchronize, reopened]

env:
  FRAMEWORKS: "iec62443,iso27001,owasp-asvs"
  FAIL_ON: "error"

jobs:
  compliance:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install CKB
        run: npm install -g @tastehub/ckb

      - name: Initialize CKB
        run: ckb init && ckb index

      - name: Run Compliance Audit
        run: |
          ckb audit compliance \
            --framework="${FRAMEWORKS}" \
            --ci --fail-on="${FAIL_ON}" \
            --format=json > compliance.json

      - name: Upload SARIF to GitHub Code Scanning
        run: |
          ckb audit compliance \
            --framework="${FRAMEWORKS}" \
            --format=sarif > compliance.sarif

Configuration

Customize PII patterns, AI component paths, SIL levels, and default frameworks per repository via .ckb/config.json.

{
  "compliance": {
    "piiFieldPatterns": ["customer_id", "tax_number"],
    "aiComponentPaths": ["src/ml/**", "models/**"],
    "silLevel": 2,
    "specialCategoryPaths": ["src/health/**", "src/biometric/**"],
    "defaultFrameworks": ["iec62443", "iso27001"]
  }
}

Quick Start

Four output formats: human, JSON, markdown, and SARIF. Use --recommend to auto-detect, or specify frameworks directly.

======================================================
  CKB COMPLIANCE AUDIT REPORT
======================================================

  Repository:   myapp
  Verdict:      WARN
  Score:        72/100
  Files:        245 scanned, 12 with issues
  Findings:     18 total (3 errors, 8 warnings)

FRAMEWORK COVERAGE
------------------------------------------------------
  GDPR                    12 checks  score=75%
  ISO 27001:2022          15 checks  score=80%
  OWASP ASVS 4.0          13 checks  score=76%

CHECK RESULTS
------------------------------------------------------
  gdpr/weak-pii-crypto   FAIL  Art. 32 GDPR
    Also violates: ISO 27001 A.8.24, NIST SC-13,
    PCI DSS 4.2.1, ASVS V6.2.5 (CWE-327)

Finding 2/7: PII logged without redaction
  File: api/handler.go:118
  Check: pii-in-logs (high)
  Regulations:
    GDPR     Art. 5(1)(f)
    CCPA     1798.150
    HIPAA    164.312(b)

Summary by Framework:
  PCI DSS    3 findings
  HIPAA      2 findings
  GDPR       2 findings

What It Detects — and What It Doesn't