meridian scan plane

plane

Open-source project management and issue tracking tool — github.com/makeplane/plane

Applicable Controls
544
Implemented
71
Files Scanned
3967
Regulations Applicable
5
01 — Repository Overview

What Meridian scanned

plane — 3,967 files, 398,228 lines, across javascript, python, tsx, typescript.

This repository primarily uses JavaScript and Python for web applications due to the inclusion of Django, Express, React, and Next.js in its frameworks. The heavy use of these frameworks suggests the presence of interactive, possibly dynamic web content and back-end services delivered through a modern web architecture. The repository also employs the OpenAI SDK, which implies some level of AI-driven features or functionalities.

Architecture: Full stack web application

Technology Stack

javascript python tsx typescript Django Express Next.js React Celery OpenTelemetry Redis Docker Docker Compose GitHub Actions

Business Signals

Stores personal data: True Uses AI: True Primary jurisdiction: United States Processes payments: True Regulated financial entity: False Offers goods/services to the EU: True Monitors individuals in the EU: False Offers goods/services to India: False AI role: Provider AI output used in the EU: True High-risk AI use case indicated: False General-purpose AI model provider: False
02 — What Meridian Detected

Compliance Readiness

Every capability Meridian evaluated, grouped by what's actually true about it — implemented in code, fixable in code, or something only documentation or an operational process can demonstrate.

Implemented (4)

  • Authentication
  • Cross Border Transfer Controls
  • Data Classification
  • Data Lifecycle Management

Code Improvement Recommended (7)

  • Access Control
  • Audit Logging
  • Consent Management
  • Data Retention
  • Encryption At Rest
  • Encryption In Transit
  • Key Management

Requires Documentation (15)

  • Asset Inventory
  • Backup And Recovery
  • Business Impact Analysis
  • Configuration Management
  • Data Deletion
  • Data Masking
  • Data Protection Impact Assessment
  • Data Subject Request Handling
  • Grievance Redressal
  • Incident Response Plan
  • Information Security Policy
  • Log Retention
  • Policy Management
  • Privacy Impact Assessment
  • Records Of Processing

Requires Operational Evidence (23)

  • AI Risk Assessment
  • Access Review
  • BCP And DR Testing
  • Bias Detection
  • Change Management
  • Data Loss Prevention
  • Data Quality Management
  • Governance Framework
  • Incident Detection
  • Maker Checker
  • Model Monitoring
  • Model Testing
  • Patch Management
  • Penetration Testing
  • Physical Access Control
  • Privileged Access Management
  • Regulatory Change Monitoring
  • Regulatory Reporting
  • SOC Operations
  • Security Awareness Training
  • Third Party Risk Assessment
  • Vendor Contract Management
  • Vulnerability Scanning
03 — Applicable Regulations

Compliance Scope

Determined from what Meridian found in the repository and the business signals above — not every one of the 17 supported frameworks, only the ones that actually apply.

GDPRStatutory lawPrivacy & Data Protection
Your application stores or processes personal data of individuals in the European Union.
Required: matched on stores_personal_data, offers_goods_services_to_eu.
In force since May 2018; applies extraterritorially to organizations offering goods or services to, or monitoring, individuals in the EU.
EU AI ActStatutory lawAI Governance & Responsible AI
Your repository deploys AI models or AI-powered systems.
Required: matched on ai_usage.
In force since August 2024 with phased application — prohibited practices first, general-purpose AI and high-risk obligations phasing in later; verify current phase-in dates. - **AI risk context:** role: Provider; output used in the EU: yes; high-risk use case indicated: no; general-purpose model provider: no
PCI DSSContractual standardPayments & Financial Security
Your application processes payments or handles cardholder data.
Required: matched on processes_payments.
An industry standard enforced through card-network and acquirer agreements, not a statute; applies to entities that store, process, or transmit cardholder data.
SOC 2 Trust Services CriteriaVoluntary attestationTrust & Assurance
Your application is in production and handles customer data requiring independent assurance.
Optional: base condition met, but no additional signal beyond production.
A voluntary attestation framework (AICPA Trust Services Criteria) driven by customer and contractual demand, not law.
NIST AI RMFVoluntary attestationAI Governance & Responsible AI
Your application develops, deploys, or uses AI/ML systems.
Required: matched on ai_usage.
AI RMF 1.0 released January 2023 by NIST; a voluntary risk-management framework, not a binding regulation -- adopted for market trust and structured AI governance, not because it is legally required.

Not Applicable (13)

DPDPA 2023
Excluded: none of 'primary_jurisdiction', 'offers_goods_services_to_india' match the conditions required for this framework.
DPDPA Rules, 2025
Excluded: none of 'primary_jurisdiction', 'offers_goods_services_to_india' match the conditions required for this framework.
RBI FREE-AI Framework
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
SEBI AI/ML Guidelines
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI Digital Payment Security Controls
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI IT Governance & Risk Controls
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.

+ 7 more in the full report.

04 — Enterprise Readiness

What an enterprise security review would ask about first

Detected (1)

  • Authentication

Recommended Improvements (6)

  • Access Control
  • Audit Logging
  • Encryption At Rest
  • Encryption In Transit
  • Key Management
  • Data Retention

Operational Requirements (6)

  • Privileged Access Management
  • BCP And DR Testing
  • Penetration Testing
  • Third Party Risk Assessment
  • Vendor Contract Management
  • Security Awareness Training

Documentation Required (2)

  • Incident Response Plan
  • Information Security Policy
05 — Top Priorities

What matters most

  1. Access ControlCRITICAL
    Can the organization (as a non-EU controller/processor) demonstrate that it has designated a representative in the Union?
  2. AuthenticationCRITICAL
    Can the multi-tenant service provider demonstrate logical separation between provider and customer environments with authorization controls?
  3. Encryption In TransitCRITICAL
    Can the designated entity demonstrate that response procedures are in place for cleartext PAN found outside the CDE?
  4. Encryption At RestCRITICAL
    Can the designated entity demonstrate that response procedures are in place for cleartext PAN found outside the CDE?
  5. Key ManagementCRITICAL
    Can the designated entity demonstrate that response procedures are in place for cleartext PAN found outside the CDE?
06 — Recommendations

Recommended actions, by effort

Quick Wins (7)

  • Access Control
  • Authentication
  • Encryption In Transit
  • Encryption At Rest
  • Patch Management
  • Vulnerability Scanning
  • Log Retention

Medium Effort (22)

  • Key Management
  • Privileged Access Management
  • Consent Management
  • Data Subject Request Handling
  • Audit Logging
  • Incident Response Plan
  • Backup And Recovery
  • Data Retention
  • Model Testing
  • Maker Checker
  • Records Of Processing
  • Grievance Redressal
  • Data Masking
  • Business Impact Analysis
  • Asset Inventory
  • Configuration Management
  • Data Lifecycle Management
  • Information Security Policy
  • Data Classification
  • Security Awareness Training
  • Policy Management
  • Data Quality Management

Strategic Initiatives (8)

  • Bias Detection
  • AI Risk Assessment
  • Data Loss Prevention
  • Privacy Impact Assessment
  • Data Protection Impact Assessment
  • Penetration Testing
  • Model Monitoring
  • Physical Access Control
07 — Compliance Roadmap

Now, next, later

Now · Quick Wins
  • Access Control
  • Authentication
  • Encryption In Transit
  • Encryption At Rest
  • Patch Management
  • Vulnerability Scanning
  • Log Retention
Next · Medium Effort
  • Key Management
  • Privileged Access Management
  • Consent Management
  • Data Subject Request Handling
  • Audit Logging
  • Incident Response Plan
  • Backup And Recovery
  • Data Retention
  • Model Testing
  • Maker Checker
  • Records Of Processing
  • Grievance Redressal
  • Data Masking
  • Business Impact Analysis
  • Asset Inventory
  • Configuration Management
  • Data Lifecycle Management
  • Information Security Policy
  • Data Classification
  • Security Awareness Training
  • Policy Management
  • Data Quality Management
Later · Strategic Initiatives
  • Bias Detection
  • AI Risk Assessment
  • Data Loss Prevention
  • Privacy Impact Assessment
  • Data Protection Impact Assessment
  • Penetration Testing
  • Model Monitoring
  • Physical Access Control
08 — Technical Findings

Evidence, for engineers

187 critical/high findings, each with file:line evidence traced back to the exact code that was or wasn't found — not shown here by design (this page is the summary; the full report is the audit trail). Open the full report below.