NZCountry-specific compliance
GateTest for Aotearoa New Zealand
GateTest is built in Aotearoa. The Privacy Act 2020 and the NZISM together set the technical baseline for any product holding NZ personal information. We catch the technical findings the OPC and NZISM assessors care about — and our home-market customers get the closest support loop.
What devs in Aotearoa New Zealand build with
Stack and host shapes we see across the Aotearoa New Zealand dev market — GateTest is tuned for all of them.
The 3 modules most relevant in Aotearoa New Zealand
A Full scan runs every one of the 122 modules that applies to your repository — these three are the highest-signal for Privacy Act 2020 + NZISM.
secretsSecurityAWS keys, GitHub tokens, Stripe keys, passwords, private keys, DB strings — caught before commit.
logPiiSecurityCredentials, tokens, request bodies and sensitive identifiers logged in plaintext.
webHeadersSecurityCSP / HSTS / XFO / CORS misconfig across Next.js, Vercel, Netlify, Express, Fastify, nginx.
Privacy Act 2020 + NZISM — what GateTest catches
Each bullet ties a real GateTest module to a specific clause in the Aotearoa New Zealand compliance landscape. Official source →
secretssecrets module catches hardcoded credentials before commit — the most common IPP 5 failure cited in OPC compliance notices.
logPiilogPii flags PII written to console / logger / structlog / pino calls — including JSON.stringify(req.body) and template-string interpolation of password/token/jwt.
webHeaderswebHeaders flags CSP unsafe-eval / unsafe-inline, missing HSTS, wildcard CORS with credentials, missing X-Content-Type-Options — the headers NZISM web-application-security control explicitly lists.
errorSwallowerrorSwallow catches empty catch blocks, .catch(() => {}) on Promise chains, and Node-callback (err, ...) handlers that ignore err — the silent-failure path that turns a breach into a silent breach.
dependenciesdependencies flags wildcard and 'latest' pins, deprecated packages and missing lockfiles, and the security module's npm audit surfaces known advisories in npm projects. The NZISM patching control treats outdated runtime dependencies as a finding.
Honest limitations
GateTest is a code-quality + security scanner — not a compliance auditor, and it offers no SOC 2 compliance scan and no penetration testing. It reports code-level findings; any SOC 2, HIPAA or ISO audit needs a qualified human assessor.
- GateTest is not an NZISM-certified assessor — we surface the technical findings; GCSB-recognised assessors run the certification.
- Privacy Act 2020 has extraterritorial reach; if you hold NZ personal information from offshore, you still need the same controls.
Who hires GateTest in Aotearoa New Zealand
Pricing
Starting at $29 USD — one-time, charged via Stripe at checkout.
Try it on your own repo
$29 Quick scan, no signup. One-time charge per scan — no subscription required (Continuous, $49/mo, is optional if you want every push scanned).
Run a Aotearoa New Zealand scan — $29