@blamejs/exceptd-skills 0.16.15 → 0.16.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/AGENTS.md +2 -1
- package/CHANGELOG.md +4 -0
- package/README.md +5 -5
- package/bin/exceptd.js +2 -1
- package/data/_indexes/_meta.json +16 -15
- package/data/_indexes/activity-feed.json +9 -2
- package/data/_indexes/chains.json +4216 -629
- package/data/_indexes/currency.json +10 -1
- package/data/_indexes/frequency.json +100 -52
- package/data/_indexes/handoff-dag.json +5 -1
- package/data/_indexes/jurisdiction-map.json +6 -3
- package/data/_indexes/section-offsets.json +85 -0
- package/data/_indexes/stale-content.json +1 -1
- package/data/_indexes/summary-cards.json +40 -0
- package/data/_indexes/token-budget.json +53 -3
- package/data/_indexes/trigger-table.json +50 -1
- package/data/_indexes/xref.json +26 -1
- package/data/cwe-catalog.json +15 -4
- package/data/playbooks/cloud-iam-incident.json +26 -5
- package/data/playbooks/framework.json +1 -0
- package/data/playbooks/multitenancy-isolation.json +660 -0
- package/manifest-snapshot.json +56 -2
- package/manifest-snapshot.sha256 +1 -1
- package/manifest.json +107 -49
- package/package.json +2 -2
- package/sbom.cdx.json +60 -30
- package/skills/multitenancy-isolation/skill.md +83 -0
|
@@ -1119,7 +1119,8 @@
|
|
|
1119
1119
|
"api-security"
|
|
1120
1120
|
],
|
|
1121
1121
|
"bola": [
|
|
1122
|
-
"api-security"
|
|
1122
|
+
"api-security",
|
|
1123
|
+
"multitenancy-isolation"
|
|
1123
1124
|
],
|
|
1124
1125
|
"bfla": [
|
|
1125
1126
|
"api-security"
|
|
@@ -1881,5 +1882,53 @@
|
|
|
1881
1882
|
],
|
|
1882
1883
|
"update channel": [
|
|
1883
1884
|
"self-update-integrity"
|
|
1885
|
+
],
|
|
1886
|
+
"multitenancy isolation": [
|
|
1887
|
+
"multitenancy-isolation"
|
|
1888
|
+
],
|
|
1889
|
+
"multi tenant": [
|
|
1890
|
+
"multitenancy-isolation"
|
|
1891
|
+
],
|
|
1892
|
+
"cross tenant": [
|
|
1893
|
+
"multitenancy-isolation"
|
|
1894
|
+
],
|
|
1895
|
+
"tenant isolation": [
|
|
1896
|
+
"multitenancy-isolation"
|
|
1897
|
+
],
|
|
1898
|
+
"row level security": [
|
|
1899
|
+
"multitenancy-isolation"
|
|
1900
|
+
],
|
|
1901
|
+
"rls": [
|
|
1902
|
+
"multitenancy-isolation"
|
|
1903
|
+
],
|
|
1904
|
+
"broken object level authorization": [
|
|
1905
|
+
"multitenancy-isolation"
|
|
1906
|
+
],
|
|
1907
|
+
"idor": [
|
|
1908
|
+
"multitenancy-isolation"
|
|
1909
|
+
],
|
|
1910
|
+
"noisy neighbour": [
|
|
1911
|
+
"multitenancy-isolation"
|
|
1912
|
+
],
|
|
1913
|
+
"rapid reset": [
|
|
1914
|
+
"multitenancy-isolation"
|
|
1915
|
+
],
|
|
1916
|
+
"rate limit": [
|
|
1917
|
+
"multitenancy-isolation"
|
|
1918
|
+
],
|
|
1919
|
+
"per tenant quota": [
|
|
1920
|
+
"multitenancy-isolation"
|
|
1921
|
+
],
|
|
1922
|
+
"circuit breaker": [
|
|
1923
|
+
"multitenancy-isolation"
|
|
1924
|
+
],
|
|
1925
|
+
"distributed lock fencing": [
|
|
1926
|
+
"multitenancy-isolation"
|
|
1927
|
+
],
|
|
1928
|
+
"resource exhaustion": [
|
|
1929
|
+
"multitenancy-isolation"
|
|
1930
|
+
],
|
|
1931
|
+
"denial of service": [
|
|
1932
|
+
"multitenancy-isolation"
|
|
1884
1933
|
]
|
|
1885
1934
|
}
|
package/data/_indexes/xref.json
CHANGED
|
@@ -204,6 +204,7 @@
|
|
|
204
204
|
"identity-assurance",
|
|
205
205
|
"idp-incident-response",
|
|
206
206
|
"mail-server-hardening",
|
|
207
|
+
"multitenancy-isolation",
|
|
207
208
|
"sector-financial",
|
|
208
209
|
"vc-wallet-trust",
|
|
209
210
|
"webapp-security"
|
|
@@ -237,13 +238,23 @@
|
|
|
237
238
|
"mail-server-hardening"
|
|
238
239
|
],
|
|
239
240
|
"CWE-400": [
|
|
240
|
-
"mail-server-hardening"
|
|
241
|
+
"mail-server-hardening",
|
|
242
|
+
"multitenancy-isolation"
|
|
241
243
|
],
|
|
242
244
|
"CWE-778": [
|
|
243
245
|
"audit-log-integrity"
|
|
244
246
|
],
|
|
245
247
|
"CWE-353": [
|
|
246
248
|
"self-update-integrity"
|
|
249
|
+
],
|
|
250
|
+
"CWE-639": [
|
|
251
|
+
"multitenancy-isolation"
|
|
252
|
+
],
|
|
253
|
+
"CWE-770": [
|
|
254
|
+
"multitenancy-isolation"
|
|
255
|
+
],
|
|
256
|
+
"CWE-668": [
|
|
257
|
+
"multitenancy-isolation"
|
|
247
258
|
]
|
|
248
259
|
},
|
|
249
260
|
"d3fend_refs": {
|
|
@@ -612,6 +623,7 @@
|
|
|
612
623
|
"sector-telecom"
|
|
613
624
|
],
|
|
614
625
|
"AU-ISM-1556": [
|
|
626
|
+
"multitenancy-isolation",
|
|
615
627
|
"sector-telecom",
|
|
616
628
|
"self-update-integrity"
|
|
617
629
|
],
|
|
@@ -699,6 +711,7 @@
|
|
|
699
711
|
"NIS2-Art21-network-security": [
|
|
700
712
|
"audit-log-integrity",
|
|
701
713
|
"mail-server-hardening",
|
|
714
|
+
"multitenancy-isolation",
|
|
702
715
|
"network-trust",
|
|
703
716
|
"self-update-integrity"
|
|
704
717
|
],
|
|
@@ -706,6 +719,7 @@
|
|
|
706
719
|
"network-trust"
|
|
707
720
|
],
|
|
708
721
|
"UK-CAF-B4": [
|
|
722
|
+
"multitenancy-isolation",
|
|
709
723
|
"network-trust",
|
|
710
724
|
"self-update-integrity"
|
|
711
725
|
],
|
|
@@ -714,6 +728,9 @@
|
|
|
714
728
|
],
|
|
715
729
|
"NIST-800-53-SR-11": [
|
|
716
730
|
"self-update-integrity"
|
|
731
|
+
],
|
|
732
|
+
"NIST-800-53-AC-3": [
|
|
733
|
+
"multitenancy-isolation"
|
|
717
734
|
]
|
|
718
735
|
},
|
|
719
736
|
"atlas_refs": {
|
|
@@ -857,6 +874,7 @@
|
|
|
857
874
|
"email-security-anti-phishing",
|
|
858
875
|
"identity-assurance",
|
|
859
876
|
"incident-response-playbook",
|
|
877
|
+
"multitenancy-isolation",
|
|
860
878
|
"ransomware-response",
|
|
861
879
|
"sector-energy",
|
|
862
880
|
"sector-financial",
|
|
@@ -875,6 +893,7 @@
|
|
|
875
893
|
"T1530": [
|
|
876
894
|
"cloud-security",
|
|
877
895
|
"dlp-gap-analysis",
|
|
896
|
+
"multitenancy-isolation",
|
|
878
897
|
"sector-healthcare"
|
|
879
898
|
],
|
|
880
899
|
"T1213": [
|
|
@@ -992,6 +1011,12 @@
|
|
|
992
1011
|
],
|
|
993
1012
|
"T1574": [
|
|
994
1013
|
"self-update-integrity"
|
|
1014
|
+
],
|
|
1015
|
+
"T1499": [
|
|
1016
|
+
"multitenancy-isolation"
|
|
1017
|
+
],
|
|
1018
|
+
"T1499.001": [
|
|
1019
|
+
"multitenancy-isolation"
|
|
995
1020
|
]
|
|
996
1021
|
},
|
|
997
1022
|
"rfc_refs": {
|
package/data/cwe-catalog.json
CHANGED
|
@@ -1844,6 +1844,7 @@
|
|
|
1844
1844
|
"identity-assurance",
|
|
1845
1845
|
"idp-incident-response",
|
|
1846
1846
|
"mail-server-hardening",
|
|
1847
|
+
"multitenancy-isolation",
|
|
1847
1848
|
"sector-financial",
|
|
1848
1849
|
"vc-wallet-trust",
|
|
1849
1850
|
"webapp-security"
|
|
@@ -3070,7 +3071,8 @@
|
|
|
3070
3071
|
"_auto_imported": true,
|
|
3071
3072
|
"_intake_method": "v0.13.18-bulk-mitre-cwe-curated",
|
|
3072
3073
|
"skills_referencing": [
|
|
3073
|
-
"mail-server-hardening"
|
|
3074
|
+
"mail-server-hardening",
|
|
3075
|
+
"multitenancy-isolation"
|
|
3074
3076
|
]
|
|
3075
3077
|
},
|
|
3076
3078
|
"CWE-285": {
|
|
@@ -3577,7 +3579,10 @@
|
|
|
3577
3579
|
"last_verified": "2026-05-19",
|
|
3578
3580
|
"notes": "Bulk-imported v0.13.18 from the canonical MITRE Top 25 + commonly-referenced-class expansion.",
|
|
3579
3581
|
"_auto_imported": true,
|
|
3580
|
-
"_intake_method": "v0.13.18-bulk-mitre-cwe-curated"
|
|
3582
|
+
"_intake_method": "v0.13.18-bulk-mitre-cwe-curated",
|
|
3583
|
+
"skills_referencing": [
|
|
3584
|
+
"multitenancy-isolation"
|
|
3585
|
+
]
|
|
3581
3586
|
},
|
|
3582
3587
|
"CWE-640": {
|
|
3583
3588
|
"id": "CWE-640",
|
|
@@ -3773,7 +3778,10 @@
|
|
|
3773
3778
|
"last_verified": "2026-05-19",
|
|
3774
3779
|
"notes": "Bulk-imported v0.13.18 from the canonical MITRE Top 25 + commonly-referenced-class expansion.",
|
|
3775
3780
|
"_auto_imported": true,
|
|
3776
|
-
"_intake_method": "v0.13.18-bulk-mitre-cwe-curated"
|
|
3781
|
+
"_intake_method": "v0.13.18-bulk-mitre-cwe-curated",
|
|
3782
|
+
"skills_referencing": [
|
|
3783
|
+
"multitenancy-isolation"
|
|
3784
|
+
]
|
|
3777
3785
|
},
|
|
3778
3786
|
"CWE-772": {
|
|
3779
3787
|
"id": "CWE-772",
|
|
@@ -4462,7 +4470,10 @@
|
|
|
4462
4470
|
"CVE-2024-21626"
|
|
4463
4471
|
],
|
|
4464
4472
|
"last_verified": "2026-05-19",
|
|
4465
|
-
"notes": "Added v0.13.19 to back the runc /proc/self/fd container-escape (CVE-2024-21626) cwe_refs entry."
|
|
4473
|
+
"notes": "Added v0.13.19 to back the runc /proc/self/fd container-escape (CVE-2024-21626) cwe_refs entry.",
|
|
4474
|
+
"skills_referencing": [
|
|
4475
|
+
"multitenancy-isolation"
|
|
4476
|
+
]
|
|
4466
4477
|
},
|
|
4467
4478
|
"CWE-340": {
|
|
4468
4479
|
"id": "CWE-340",
|
|
@@ -60,7 +60,8 @@
|
|
|
60
60
|
}
|
|
61
61
|
],
|
|
62
62
|
"fed_by": [
|
|
63
|
-
"identity-sso-compromise"
|
|
63
|
+
"identity-sso-compromise",
|
|
64
|
+
"multitenancy-isolation"
|
|
64
65
|
]
|
|
65
66
|
},
|
|
66
67
|
"domain": {
|
|
@@ -976,7 +977,15 @@
|
|
|
976
977
|
"rotation_ownership_identified == true"
|
|
977
978
|
],
|
|
978
979
|
"priority": 1,
|
|
979
|
-
"for_signals": [
|
|
980
|
+
"for_signals": [
|
|
981
|
+
"root_login_from_new_asn",
|
|
982
|
+
"iam_access_key_created_no_iac_ticket",
|
|
983
|
+
"mass_iam_user_creation_outside_iac",
|
|
984
|
+
"cross_account_assume_role_anomaly",
|
|
985
|
+
"kms_key_policy_self_grant",
|
|
986
|
+
"s3_bucket_policy_public_grant",
|
|
987
|
+
"cloudtrail_logging_disabled_event"
|
|
988
|
+
],
|
|
980
989
|
"compensating_controls": [
|
|
981
990
|
"session-revocation",
|
|
982
991
|
"audit-log-review-for-misuse-window",
|
|
@@ -992,7 +1001,15 @@
|
|
|
992
1001
|
"iam_read_only_across_org == true"
|
|
993
1002
|
],
|
|
994
1003
|
"priority": 2,
|
|
995
|
-
"for_signals": [
|
|
1004
|
+
"for_signals": [
|
|
1005
|
+
"cross_account_assume_role_anomaly",
|
|
1006
|
+
"mass_iam_user_creation_outside_iac",
|
|
1007
|
+
"iam_access_key_created_no_iac_ticket",
|
|
1008
|
+
"kms_key_policy_self_grant",
|
|
1009
|
+
"s3_bucket_policy_public_grant",
|
|
1010
|
+
"gpu_instance_creation_spike",
|
|
1011
|
+
"unused_region_resource_creation"
|
|
1012
|
+
],
|
|
996
1013
|
"compensating_controls": [
|
|
997
1014
|
"iam-event-review-completed",
|
|
998
1015
|
"scp-tightened",
|
|
@@ -1007,7 +1024,9 @@
|
|
|
1007
1024
|
"imdsv2_migration_blocker_inventory_complete == true"
|
|
1008
1025
|
],
|
|
1009
1026
|
"priority": 2,
|
|
1010
|
-
"for_signals": [
|
|
1027
|
+
"for_signals": [
|
|
1028
|
+
"imds_v1_legacy_access"
|
|
1029
|
+
],
|
|
1011
1030
|
"compensating_controls": [
|
|
1012
1031
|
"imdsv2-enforced-org-wide",
|
|
1013
1032
|
"scp-deny-imdsv1-launch"
|
|
@@ -1021,7 +1040,9 @@
|
|
|
1021
1040
|
"federated_trust_inventory_complete == true"
|
|
1022
1041
|
],
|
|
1023
1042
|
"priority": 2,
|
|
1024
|
-
"for_signals": [
|
|
1043
|
+
"for_signals": [
|
|
1044
|
+
"cross_account_assume_role_anomaly"
|
|
1045
|
+
],
|
|
1025
1046
|
"compensating_controls": [
|
|
1026
1047
|
"federated-trust-tightened",
|
|
1027
1048
|
"conditional-access-mfa-required-on-admin"
|