@aegis-scan/skills 0.5.0 → 0.5.1

package/skills/compliance/aegis-native/brutaler-anwalt/references/stack-patterns/strapi/cms-pii-pattern.md

@@ -0,0 +1,301 @@
+---
+license: MIT (snippet)
+provider: Strapi v4 / v5 (Open-Source)
+last-checked: 2026-05-05
+purpose: Strapi User-Submission Lifecycle-Hook Pattern fuer PII-Filtering + Robots-Meta + DSE-Erinnerung.
+---
+
+# Strapi — CMS-PII Pattern
+
+## Trigger / Detection
+
+Repo enthaelt:
+- `@strapi/strapi` in `package.json`
+- `src/api/*/content-types/` Schema-Files
+- `src/api/*/controllers/*.js` / `services/*.js` / `routes/*.js`
+- Optional: `src/api/*/lifecycles.js` Hook-Files
+- Optional: `config/admin.js`, `config/server.js`
+
+Pattern: Strapi haelt User-generated-Content (Comments, Submissions, Form-Eintraege). Lifecycle-Hooks koennen PII-Felder filtern, Crawler-Indexing verhindern, DSE-Verweise erzwingen.
+
+## Default-Verhalten (was passiert ohne Konfiguration)
+
+- Strapi-Admin-Panel laed Tracker-Pixel von `<placeholder-strapi-marketplace-host>` → DSGVO-Verstoss bei aktivierten Telemetry-Settings
+- User-Submissions speichern alles was im Schema definiert ist — keine Auto-PII-Filterung
+- Keine `robots: noindex` auf User-Content-Pages → Suchmaschinen indizieren PII
+- Webhooks senden Klartext-Daten an externe Endpoints
+- Default-Server-Logs enthalten Klartext-IP
+
+## Compliance-Risiken
+
+| Risiko | Norm | Severity | Fix |
+|---|---|---|---|
+| Strapi-Telemetry leakt Repo-Metadata an Drittland | Art. 44 DSGVO | KRITISCH | `telemetryDisabled: true` in `config/server.js` |
+| User-Submission ohne PII-Filter | Art. 5 lit. c DSGVO | HOCH | Lifecycle-Hook `beforeCreate` |
+| Robots-Meta fehlt fuer User-Content | Art. 5 lit. f DSGVO | HOCH | `noindex,nofollow` in CMS-Frontend |
+| Webhook mit Klartext-PII | Art. 5 lit. f | HOCH | Webhook-Payload-Filter im Hook |
+| Admin-Panel ueber HTTP zugaenglich | Art. 32 DSGVO | KRITISCH | `admin.url` mit HTTPS + IP-Allowlist |
+| Default-Email-Templates mit Brand-Tracker | § 25 TDDDG | MITTEL | Custom Templates |
+
+## Code-Pattern (sanitized)
+
+```javascript
+// File: config/server.js
+module.exports = ({ env }) => ({
+  host: env('HOST', '0.0.0.0'),
+  port: env.int('PORT', 1337),
+  app: {
+    keys: env.array('APP_KEYS'),
+  },
+  webhooks: {
+    populateRelations: env.bool('WEBHOOKS_POPULATE_RELATIONS', false),
+  },
+  // KRITISCH: Strapi-Telemetry deaktivieren
+  telemetryDisabled: true,
+});
+```
+
+```javascript
+// File: config/admin.js
+module.exports = ({ env }) => ({
+  auth: {
+    secret: env('ADMIN_JWT_SECRET'),
+  },
+  apiToken: {
+    salt: env('API_TOKEN_SALT'),
+  },
+  transfer: {
+    token: {
+      salt: env('TRANSFER_TOKEN_SALT'),
+    },
+  },
+  flags: {
+    nps: false,                  // Net-Promoter-Score-Tracker AUS
+    promoteEE: false,            // Marketing-Promo AUS
+  },
+});
+```
+
+```javascript
+// File: src/api/comment/content-types/comment/schema.json
+{
+  "kind": "collectionType",
+  "collectionName": "comments",
+  "info": {
+    "singularName": "comment",
+    "pluralName": "comments",
+    "displayName": "Comment"
+  },
+  "options": {
+    "draftAndPublish": true
+  },
+  "attributes": {
+    "body": {
+      "type": "text",
+      "required": true,
+      "maxLength": 5000
+    },
+    "authorName": {
+      "type": "string",
+      "maxLength": 100
+    },
+    "authorEmail": {
+      "type": "email",
+      "private": true
+    },
+    "ipHash": {
+      "type": "string",
+      "maxLength": 16,
+      "private": true
+    },
+    "consentVersion": {
+      "type": "string",
+      "maxLength": 16
+    }
+  }
+}
+```
+
+```javascript
+// File: src/api/comment/content-types/comment/lifecycles.js
+const crypto = require('crypto');
+
+const PII_FIELDS = ['authorEmail', 'ipHash'];
+const FORBIDDEN_PATTERNS = [
+  /[\w.+-]+@[\w-]+\.[\w-]+/g,                       // Email-Pattern im body
+  /\bDE\d{2}[\d\s]{18,22}\b/g,                       // IBAN
+  /\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b/g,     // Credit-Card
+];
+
+module.exports = {
+  async beforeCreate(event) {
+    const { data, params } = event;
+
+    // 1. PII im Body herausfiltern
+    if (typeof data.body === 'string') {
+      for (const pattern of FORBIDDEN_PATTERNS) {
+        data.body = data.body.replace(pattern, '[REDACTED]');
+      }
+    }
+
+    // 2. IP-Hash setzen (statt Klartext)
+    const requestState = strapi.requestContext.get();
+    const ip = requestState?.request?.ip
+      ?? requestState?.request?.header?.['x-forwarded-for']?.split(',')[0]
+      ?? '';
+
+    const salt = strapi.config.get('server.ipHashSalt', '');
+    data.ipHash = crypto
+      .createHash('sha256')
+      .update(`${ip}${salt}`)
+      .digest('hex')
+      .slice(0, 16);
+
+    // 3. Consent-Pflicht: erfordere consentVersion
+    if (!data.consentVersion) {
+      throw new Error('Consent-Version Pflicht — User muss DSE bestaetigt haben');
+    }
+  },
+
+  async beforeUpdate(event) {
+    // PII-Felder duerfen nicht via Public-API ge-updated werden
+    const { data } = event;
+    for (const field of PII_FIELDS) {
+      if (field in data) {
+        delete data[field];
+      }
+    }
+  },
+
+  async afterDelete(event) {
+    // Cascade auf abhaengige Records (Mentions, Replies)
+    const { result } = event;
+    await strapi.db.query('api::reply.reply').deleteMany({
+      where: { parentComment: result.id },
+    });
+  },
+};
+```
+
+```javascript
+// File: src/api/comment/controllers/comment.js
+'use strict';
+
+const { createCoreController } = require('@strapi/strapi').factories;
+
+module.exports = createCoreController('api::comment.comment', ({ strapi }) => ({
+  async findOne(ctx) {
+    const { id } = ctx.params;
+    const entity = await strapi.entityService.findOne('api::comment.comment', id, {
+      // Niemals authorEmail / ipHash in API-Response
+      fields: ['body', 'authorName', 'createdAt', 'consentVersion'],
+    });
+
+    if (!entity) {
+      return ctx.notFound();
+    }
+
+    // Robots-Meta-Header fuer User-Content-Page
+    ctx.set('X-Robots-Tag', 'noindex, nofollow');
+
+    return { data: entity };
+  },
+}));
+```
+
+```javascript
+// File: src/middlewares/robots-noindex.js
+module.exports = (config, { strapi }) => {
+  return async (ctx, next) => {
+    await next();
+
+    // User-generated-Content-Routes: kein Indexing
+    if (ctx.request.url.startsWith('/api/comments/')
+        || ctx.request.url.startsWith('/api/submissions/')) {
+      ctx.set('X-Robots-Tag', 'noindex, nofollow');
+    }
+  };
+};
+```
+
+```javascript
+// File: config/middlewares.js
+module.exports = [
+  'strapi::errors',
+  'strapi::security',
+  'strapi::cors',
+  'strapi::poweredBy',  // Sicherstellen: poweredBy=false (siehe unten)
+  'strapi::logger',
+  'strapi::query',
+  'strapi::body',
+  'strapi::session',
+  'strapi::favicon',
+  'strapi::public',
+  { resolve: './src/middlewares/robots-noindex' },
+];
+```
+
+## AVV / DPA
+
+- Strapi-Hosting (self-host EU / Strapi Cloud EU) — Art. 28 DSGVO
+- Datenbank (Postgres EU / SQLite local) — AVV
+- Media-Storage (S3 EU / Cloudinary EU) — AVV
+- Webhook-Empfaenger — pro externes System AVV
+- Telemetry MUSS aus sein (siehe `config/server.js`)
+
+## DSE-Wording-Vorlage
+
+```markdown
+### User-generierter Content (Kommentare, Formulare)
+
+Wenn Sie auf unserer Webseite Inhalte einreichen (z.B. Kommentare, Formulare),
+verarbeiten wir folgende Daten:
+
+| Feld | Verarbeitung | Speicherung |
+|---|---|---|
+| Inhalt (Body) | PII automatisch entfernt (E-Mail/IBAN/CC-Patterns redacted) | Bis Loeschung |
+| Name (optional) | wird mit Inhalt veroeffentlicht | Bis Loeschung |
+| E-Mail | nur intern (private), nicht oeffentlich | Bis Loeschung |
+| IP-Hash | SHA-256 mit Salt, gekuerzt (Spam-Schutz) | 90 Tage |
+
+**Veroeffentlichung:** Inhalte werden mit `noindex,nofollow` markiert,
+sodass Suchmaschinen sie nicht indizieren.
+
+**Rechtsgrundlage:** Art. 6 Abs. 1 lit. b DSGVO (Vertrag) +
+Art. 6 Abs. 1 lit. f DSGVO (Spam-Schutz).
+**Loeschung:** auf Anfrage via [Account-Dashboard](#account) oder
+E-Mail an <placeholder-email>.
+```
+
+## Verify-Commands (Live-Probe)
+
+```bash
+# 1. Telemetry deaktiviert
+grep -r "telemetryDisabled" config/
+# Erwartung: telemetryDisabled: true
+
+# 2. PII-Filter wirkt (Test-Submission)
+curl -X POST https://<placeholder-domain>/api/comments \
+  -H "Content-Type: application/json" \
+  -d '{"data":{"body":"Mein Kontakt: test@example.com","consentVersion":"1.0"}}' \
+  -H "Authorization: Bearer <placeholder-token>" -i
+# Erwartung: 200, Body in DB enthaelt "[REDACTED]" statt Email
+
+# 3. authorEmail nicht in API-Response
+curl https://<placeholder-domain>/api/comments/<id> | jq .
+# Erwartung: kein "authorEmail"-Feld
+
+# 4. Robots-Meta-Header gesetzt
+curl -sI https://<placeholder-domain>/api/comments/<id> | grep -i "x-robots-tag"
+# Erwartung: X-Robots-Tag: noindex, nofollow
+
+# 5. Strapi-Admin telemetry blockiert
+# DevTools-Network-Tab beim Admin-Login: kein Call zu Strapi-Marketplace
+```
+
+## Cross-References
+
+- AEGIS-Scanner: `cms-pii-checker.ts`, `tracking-scan.ts`, `data-transfer-checker.ts`
+- Skill-Reference: `references/dsgvo.md` Art. 5 (Min), Art. 32 (Sicherheit)
+- BGH-Rechtsprechung: `references/bgh-urteile.md`
+- Audit-Pattern: `references/audit-patterns.md` Phase 5 (CMS-Audit), Phase 3 (Drittland)

package/skills/compliance/aegis-native/brutaler-anwalt/references/stack-patterns/strapi/notice-and-action-plugin.md

@@ -0,0 +1,371 @@
+---
+license: MIT (snippet)
+provider: Strapi v4 / v5 (Open-Source)
+last-checked: 2026-05-05
+purpose: Strapi Plugin Pattern fuer DSA Art. 16 Notice-and-Action Compliance.
+---
+
+# Strapi — Notice-and-Action Plugin Pattern (DSA Art. 16)
+
+## Trigger / Detection
+
+Repo enthaelt:
+- `@strapi/strapi` mit User-Generated-Content (Comments, Submissions, Reviews)
+- Optional: `src/plugins/notice-and-action/` Custom-Plugin
+- Service-Provider faellt unter DSA (Digital Services Act EU 2022/2065)
+- Optional: `src/api/dsa-report/` Content-Type fuer Reports
+
+DSA Art. 16: Hosting-Provider muessen einen Mechanismus zur Meldung rechtswidriger Inhalte bereitstellen ("Notice-and-Action"). Pflicht seit 17. Februar 2024 fuer alle Hosting-Provider (auch kleine).
+
+## Default-Verhalten (was passiert ohne Konfiguration)
+
+- Strapi hat keinen Built-in DSA-Report-Mechanismus
+- User koennen Inhalte nicht strukturiert melden → manuelle E-Mail-Bearbeitung
+- Keine Transparenz-Berichte → DSA Art. 15 Verstoss bei aktiveren Diensten
+- Kein Audit-Trail fuer Moderations-Entscheidungen
+- Keine Begruendung-Pflicht-Antwort an Reporter
+
+## Compliance-Risiken
+
+| Risiko | Norm | Severity | Fix |
+|---|---|---|---|
+| Kein Notice-and-Action-Mechanismus | DSA Art. 16 | KRITISCH | Plugin mit Report-Endpoint |
+| Reporter erhaelt keine Bestaetigung | DSA Art. 16 Abs. 5 | HOCH | Auto-Confirmation-Mail |
+| Keine Begruendung an Uploader bei Removal | DSA Art. 17 | HOCH | Statement-of-Reasons-Workflow |
+| Keine Transparenz-Reports | DSA Art. 15/24 | MITTEL (HOCH bei VLOP) | Annual-Report-Worker |
+| Trusted-Flagger-Privileg fehlt | DSA Art. 22 | NIEDRIG (Optional) | Role-based Priority |
+| Kein Beschwerde-System | DSA Art. 20 | HOCH | Internal-Complaint-Endpoint |
+
+## Code-Pattern (sanitized)
+
+```javascript
+// File: src/api/dsa-report/content-types/dsa-report/schema.json
+{
+  "kind": "collectionType",
+  "collectionName": "dsa_reports",
+  "info": {
+    "singularName": "dsa-report",
+    "pluralName": "dsa-reports",
+    "displayName": "DSA Report"
+  },
+  "options": {
+    "draftAndPublish": false
+  },
+  "attributes": {
+    "reportedContentType": {
+      "type": "enumeration",
+      "enum": ["comment", "submission", "upload", "review"],
+      "required": true
+    },
+    "reportedContentId": {
+      "type": "string",
+      "required": true
+    },
+    "category": {
+      "type": "enumeration",
+      "enum": [
+        "illegal_hate_speech",
+        "terrorism_extremism",
+        "child_sexual_abuse_material",
+        "intellectual_property_violation",
+        "data_protection_violation",
+        "consumer_protection_violation",
+        "other_illegal"
+      ],
+      "required": true
+    },
+    "explanation": {
+      "type": "text",
+      "required": true,
+      "maxLength": 5000
+    },
+    "reporterEmail": {
+      "type": "email",
+      "required": true,
+      "private": true
+    },
+    "reporterIpHash": {
+      "type": "string",
+      "maxLength": 16,
+      "private": true
+    },
+    "isTrustedFlagger": {
+      "type": "boolean",
+      "default": false
+    },
+    "status": {
+      "type": "enumeration",
+      "enum": ["received", "in_review", "actioned", "rejected", "appealed"],
+      "default": "received"
+    },
+    "actionTaken": {
+      "type": "enumeration",
+      "enum": ["none", "removed", "demoted", "warning", "account_suspended"]
+    },
+    "statementOfReasons": {
+      "type": "text",
+      "maxLength": 5000
+    },
+    "submittedAt": {
+      "type": "datetime",
+      "required": true
+    },
+    "actionedAt": {
+      "type": "datetime"
+    }
+  }
+}
+```
+
+```javascript
+// File: src/api/dsa-report/controllers/dsa-report.js
+'use strict';
+
+const crypto = require('crypto');
+
+module.exports = ({ strapi }) => ({
+  async create(ctx) {
+    const {
+      reportedContentType,
+      reportedContentId,
+      category,
+      explanation,
+      reporterEmail,
+    } = ctx.request.body.data ?? {};
+
+    // Validation
+    if (!reportedContentType || !reportedContentId || !category || !explanation || !reporterEmail) {
+      return ctx.badRequest('Pflichtfelder fehlen');
+    }
+    if (typeof explanation !== 'string' || explanation.length < 50) {
+      return ctx.badRequest('Begruendung mindestens 50 Zeichen');
+    }
+
+    // IP-Hash
+    const ip = ctx.request.ip
+      ?? ctx.request.header['x-forwarded-for']?.split(',')[0]
+      ?? '';
+    const salt = strapi.config.get('server.ipHashSalt', '');
+    const ipHash = crypto.createHash('sha256').update(`${ip}${salt}`).digest('hex').slice(0, 16);
+
+    // Trusted-Flagger-Check (sofern Email auf Allowlist)
+    const trustedList = strapi.config.get('server.trustedFlaggers', []);
+    const isTrusted = trustedList.includes(reporterEmail.toLowerCase());
+
+    const report = await strapi.entityService.create('api::dsa-report.dsa-report', {
+      data: {
+        reportedContentType,
+        reportedContentId,
+        category,
+        explanation: explanation.slice(0, 5000),
+        reporterEmail,
+        reporterIpHash: ipHash,
+        isTrustedFlagger: isTrusted,
+        status: 'received',
+        submittedAt: new Date(),
+      },
+    });
+
+    // Auto-Confirmation an Reporter (DSA Art. 16 Abs. 5)
+    await strapi.plugins.email.services.email.send({
+      to: reporterEmail,
+      subject: `Bestaetigung Ihrer Meldung [Ref: ${report.id}]`,
+      text: buildConfirmationMail(report),
+    });
+
+    // Optional: Trusted-Flagger gehen sofort in Priority-Queue
+    if (isTrusted) {
+      await strapi.service('api::dsa-report.dsa-report').prioritize(report.id);
+    }
+
+    return {
+      data: {
+        id: report.id,
+        status: 'received',
+        submittedAt: report.submittedAt,
+      },
+    };
+  },
+
+  async findOne(ctx) {
+    // Reporter darf nur eigene Reports sehen
+    const { id } = ctx.params;
+    const report = await strapi.entityService.findOne('api::dsa-report.dsa-report', id, {
+      fields: ['status', 'category', 'submittedAt', 'actionedAt', 'statementOfReasons', 'actionTaken'],
+    });
+    if (!report) return ctx.notFound();
+    return { data: report };
+  },
+});
+
+function buildConfirmationMail(report) {
+  return `
+Wir haben Ihre Meldung erhalten.
+
+Referenz: ${report.id}
+Eingegangen am: ${report.submittedAt}
+Kategorie: ${report.category}
+
+Wir werden Ihre Meldung gemaess DSA Art. 16 unverzueglich pruefen und Ihnen
+das Ergebnis mit Begruendung mitteilen.
+
+Bei Fragen: <placeholder-email>
+  `.trim();
+}
+```
+
+```javascript
+// File: src/api/dsa-report/services/dsa-report.js
+'use strict';
+
+const { createCoreService } = require('@strapi/strapi').factories;
+
+module.exports = createCoreService('api::dsa-report.dsa-report', ({ strapi }) => ({
+  async actionReport(reportId, action, statementOfReasons) {
+    const report = await strapi.entityService.findOne('api::dsa-report.dsa-report', reportId);
+    if (!report) throw new Error('Report not found');
+
+    // 1. Action ausfuehren
+    if (action === 'removed') {
+      await strapi.entityService.delete(
+        `api::${report.reportedContentType}.${report.reportedContentType}`,
+        report.reportedContentId,
+      );
+    }
+
+    // 2. Report-Status aktualisieren
+    await strapi.entityService.update('api::dsa-report.dsa-report', reportId, {
+      data: {
+        status: 'actioned',
+        actionTaken: action,
+        statementOfReasons,
+        actionedAt: new Date(),
+      },
+    });
+
+    // 3. Reporter informieren
+    await strapi.plugins.email.services.email.send({
+      to: report.reporterEmail,
+      subject: `Ihre Meldung wurde bearbeitet [Ref: ${reportId}]`,
+      text: `Status: ${action}\n\nBegruendung:\n${statementOfReasons}`,
+    });
+
+    // 4. Uploader informieren (DSA Art. 17 Statement of Reasons)
+    if (action === 'removed') {
+      await this.notifyUploader(report.reportedContentType, report.reportedContentId, statementOfReasons);
+    }
+  },
+
+  async prioritize(reportId) {
+    // Trusted-Flagger-Reports priorisieren in Moderations-Queue
+    await strapi.entityService.update('api::dsa-report.dsa-report', reportId, {
+      data: { status: 'in_review' },
+    });
+  },
+
+  async notifyUploader(contentType, contentId, reason) {
+    const content = await strapi.entityService.findOne(`api::${contentType}.${contentType}`, contentId, {
+      populate: ['author'],
+    });
+    if (!content?.author?.email) return;
+
+    await strapi.plugins.email.services.email.send({
+      to: content.author.email,
+      subject: 'Ihr Inhalt wurde wegen einer Meldung entfernt',
+      text: `
+Ihr Inhalt (${contentType} #${contentId}) wurde aufgrund einer Meldung entfernt.
+
+Begruendung:
+${reason}
+
+Sie haben das Recht zur Beschwerde gemaess DSA Art. 20 binnen 6 Monaten.
+Beschwerde-Endpoint: <placeholder-domain>/api/dsa-complaints
+      `.trim(),
+    });
+  },
+}));
+```
+
+```javascript
+// File: src/api/dsa-report/routes/dsa-report.js
+module.exports = {
+  routes: [
+    {
+      method: 'POST',
+      path: '/dsa-reports',
+      handler: 'dsa-report.create',
+      config: { auth: false },  // Auch Nicht-User koennen melden
+    },
+    {
+      method: 'GET',
+      path: '/dsa-reports/:id',
+      handler: 'dsa-report.findOne',
+      config: { auth: false },  // Nur via Reference-ID + Email-Match
+    },
+  ],
+};
+```
+
+## AVV / DPA
+
+- Strapi-Hosting — Art. 28 DSGVO
+- Datenbank fuer Reports — AVV mit Backup-Rotation
+- Mailer fuer Bestaetigungen + Statement-of-Reasons — AVV mit EU-Hosting
+
+## DSE-Wording-Vorlage
+
+```markdown
+### Meldung rechtswidriger Inhalte (DSA Art. 16)
+
+Sie koennen rechtswidrige Inhalte auf dieser Plattform jederzeit melden.
+
+**Meldekanal:** [Inhalt melden](https://<placeholder-domain>/report) oder
+E-Mail an <placeholder-email>.
+
+**Was geschieht mit Ihrer Meldung:**
+
+1. **Bestaetigung** binnen 24 Stunden mit Referenz-Nummer
+2. **Pruefung** durch unser Moderations-Team (Trusted-Flagger werden priorisiert)
+3. **Entscheidung** mit Begruendung an Sie und ggf. an den Uploader
+4. **Beschwerde-Recht** binnen 6 Monaten gemaess DSA Art. 20
+
+**Verarbeitete Daten Ihrer Meldung:**
+- E-Mail-Adresse (zur Antwort)
+- IP-Hash (Anti-Spam)
+- Beschreibung der gemeldeten Verletzung
+- Referenz auf gemeldeten Inhalt
+
+**Speicherdauer:** 5 Jahre nach Abschluss (Beweisfunktion bei Rechtsstreit).
+**Rechtsgrundlage:** Art. 6 Abs. 1 lit. c DSGVO (gesetzliche Verpflichtung
+DSA Art. 16) + lit. f (berechtigtes Interesse Plattform-Sicherheit).
+```
+
+## Verify-Commands (Live-Probe)
+
+```bash
+# 1. Report-Endpoint erreichbar
+curl -X POST https://<placeholder-domain>/api/dsa-reports \
+  -H "Content-Type: application/json" \
+  -d '{"data":{"reportedContentType":"comment","reportedContentId":"42","category":"illegal_hate_speech","explanation":"<placeholder-min-50-chars-explanation-text>","reporterEmail":"reporter@example.com"}}' -i
+# Erwartung: 200 mit { id, status: "received" }
+
+# 2. Bestaetigungs-Mail wird gesendet
+# (Mail-Provider-Logs pruefen)
+
+# 3. Validation: zu kurze Begruendung blockt
+curl -X POST https://<placeholder-domain>/api/dsa-reports \
+  -d '{"data":{"category":"other_illegal","explanation":"kurz","reporterEmail":"x@x.de"}}' -i
+# Erwartung: 400
+
+# 4. Trusted-Flagger-Privileg
+# Setze Email auf trusted-flaggers-Allowlist und sende Report
+# Erwartung: status sofort "in_review"
+```
+
+## Cross-References
+
+- AEGIS-Scanner: `dsa-compliance-checker.ts`, `cms-pii-checker.ts`, `audit-trail-checker.ts`
+- Skill-Reference: `references/dsgvo.md` (Datenschutz-Aspekt)
+- DSA: VO (EU) 2022/2065 Art. 14, 16, 17, 20, 22 (Notice-and-Action, Statement of Reasons, Beschwerde, Trusted Flagger)
+- BGH-Rechtsprechung: `references/bgh-urteile.md`
+- Audit-Pattern: `references/audit-patterns.md` Phase 5 (CMS-Audit), Phase 8 (DSA-Compliance)