Assurance · What to fix first

Remediation roadmap

Ranked by risk and effort. Safety net first, then independence — tracked as the in-house team executes.

Roadmap progress

3 of 8 complete

38%

1
Transfer the Bitbucket repo to a Northwind-owned org
The repo lives at bitbucket.org/vantagedigital — vendor controls access. Transferring it gives Northwind ownership of the codebase and its history.
Critical~5d effort
done
2
Obtain vantage/* package source or code escrow
Without the source for the 63 framework packages, a vendor departure is catastrophic. Source or escrow removes the single largest lock-in.
Critical~20d effort
in progress
3
Mirror the private Composer registry to Northwind infra
Eliminates composer.vantagedigital.com as a single point of failure so composer install works from Northwind-controlled infrastructure.
Critical~10d effort
done
4
Rotate exposed AWS keys and move to Secrets Manager
Plaintext credentials in the repo are an immediate security risk. Rotating and vaulting them closes the breach vectors — cheap and urgent.
Critical~2d effort
done
5
Fork @vantage/ui & @vantage/state to a Northwind npm scope
MIT-licensed — fork now, while the relationship is active, so the frontend never depends on a vendor-published package again.
High~5d effort
in progress
6
Obtain the ffl-docker repo and Docker build context
Required for local development and CI so Northwind can build the container environment without the vendor's ECR image.
High~5d effort
in progress
7
Embed a QA engineer: E2E tests + independent build verification
Builds the missing safety net and — via the 18-item build checklist — proves whether Northwind can compile, run and deploy Grants Manager V3 on its own.
Critical~30d effort
in progress
8
Document infrastructure as code (Terraform/CloudFormation)
No IaC exists for RDS, Elasticsearch, StarRocks or Kafka. Codifying it makes infrastructure reproducible and recovery testable.
High~14d effort
open