Pass Cyber Essentials Plus without a pre-audit panic.

What CE+ actually requires from your codebase

Cyber Essentials Plus is a UK government-backed certification with a specific technical control set — not the loose "best practice" checklists you'll see in most blog posts. The five controls that touch your code directly are:

• Patch management. All software receiving updates must be supported and patched within 14 days of a high/critical CVE. RepoWarden tracks installed versions vs CVE-fixed versions on every dep, every workspace.
• Secure configuration. No default credentials, no debug endpoints reachable from the internet, secure cookie flags, hardened CSP. Scan checks every route handler and config file.
• Access control. Authentication and authorisation present on protected endpoints; sessions expire; admin functions gated. Scan inspects auth middleware and role checks.
• Malware protection. Supply-chain risk: typosquat detection, install-script abuse, post-install network calls. Scan flags suspect deps before they ship.
• Firewall configuration. Mostly infrastructure but app-side: rate limiting on auth endpoints, request size caps, no SSRF surface. Scan reads route handlers for missing guards.

Why "prove it or drop it" matters

Most LLM-driven security tools hallucinate. They report SQL injection in code that uses parameterised queries, or flag a CVE in a dep your project doesn't actually use. To an assessor that's worse than no report — it costs trust and time.

RepoWarden's scanner runs under strict rules of engagement: every high/critical finding must include a working reproduction step or get downgraded. Every claim is then mechanically verified — file existence, line number, CVE-vs-version match — before it lands on your kanban. Findings that fail verification are dropped silently. You see the survivors.

How the scan works

1. Daily cron checks each Business-plan repo's HEAD SHA. Skips when nothing has changed since the last scan.
2. Otherwise, our runner clones at HEAD and packs a high-signal subset of source files (auth, routes, db, config first).
3. Anthropic Claude Opus 4.7 audits the bundle against the CE+ control set, emitting structured JSON findings.
4. Each finding is mechanically verified against the live code. Hallucinations get dropped. Survivors become kanban tickets with file/line evidence and a suggested fix.
5. The full scan history is at /repos/<your-repo>/security — show it to your assessor.

FAQ

Does this replace a CE+ assessor? No — CE+ is an audited certification. RepoWarden gets you to a clean state before the assessor arrives. Far cheaper than a re-audit fee.

Will it create noise tickets? No. We deliberately drop findings the verifier can't ground in real code. The trade-off is a quieter kanban over a busy one.

How often does it run? Once a month at most, per repo. We skip if HEAD hasn't changed.

What about non-CE+ best practice? Findings include a ceFailure flag — those that directly cause a CE+ failure are tagged, the rest are general hygiene improvements.