GateTest for United States
US dev shops live inside four overlapping regimes — HIPAA for health, CCPA for consumer data, SOX for finance, PCI-DSS for cards. GateTest's 91 modules catch the technical findings each auditor looks for, in one scan, before code ships.
What devs in United States build with
Stack and host shapes we see across the United States dev market — GateTest is tuned for all of them.
The 3 modules most relevant in United States
Every United States scan runs all 91 modules — these three are the highest-signal for HIPAA + CCPA + SOX + PCI-DSS.
secretsSecurityAWS keys, GitHub tokens, Stripe keys, passwords, private keys, DB strings — caught before commit.
logPiiSecurityCredentials, tokens, request bodies and sensitive identifiers logged in plaintext.
dependenciesSecuritySupply-chain hygiene across npm, pip, Pipenv, Poetry, go.mod, Cargo, Bundler, Composer, Maven, Gradle.
HIPAA + CCPA + SOX + PCI-DSS — what GateTest catches
Each bullet ties a real GateTest module to a specific clause in the United States compliance landscape. Official source →
secretRotationsecretRotation module flags credentials older than 90 days (error) and 30 days (warning) using git-history-aware dating — directly maps to HIPAA's password-management standard.
secretssecrets module catches hardcoded API keys, AWS access tokens, GitHub PATs, Stripe live keys, JWTs and private keys before they reach the repo — the lowest bar for 'reasonable security' under CCPA's private right of action.
ssrfssrf module taints req.body / req.query / req.params and flags when tainted values reach fetch/axios/http.request without an allowlist — the technical SSRF / IDOR class PCI auditors ask about.
prSizeprSize module enforces a per-PR file + line cap and produces a timestamped report attached to every commit status — the same evidence a SOX auditor wants for change-management controls.
logPiilogPii module flags console.log / logger.info calls that dump req.body, JSON.stringify(user), or template-string interpolation of password/token/jwt — the GDPR/HIPAA logging violation that ships in nearly every codebase.
dependenciesdependencies module scans npm / pip / Poetry / go.mod / Cargo / Bundler / Composer / Maven / Gradle and flags wildcards, 'latest' pins, deprecated packages and missing lockfiles — produces the SBOM-adjacent evidence auditors collect.
Honest limitations
GateTest is a code-quality + security scanner — not a SOC 2 / HIPAA / ISO auditor. We catch the technical findings auditors look for, but the audit itself needs a qualified human assessor.
- ·GateTest produces technical findings — HIPAA / PCI / SOX audits still require a qualified human assessor (QSA for PCI, OCR for HIPAA).
- ·Data-residency claims (e.g. 'all data stored in us-east-1') depend on your host config; GateTest doesn't verify host region.
Who hires GateTest in United States
Pricing
Starting at $29 USD — paid via Stripe in your local currency.
Try it on your own repo
$29 Quick scan, no signup. Pay only when results land.
Run a United States scan — $29