@cdxgen/cdxgen 0.0.1 → 13.0.0

package/data/rules/container-risk.yaml

@@ -0,0 +1,353 @@
+- id: CTR-001
+  name: "Container image ships setuid/setgid GTFOBins execution primitive"
+  description: "Known GTFOBins execution helpers become materially riskier when the image keeps the binary setuid or setgid."
+  severity: critical
+  category: container-risk
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:gtfobins:matched') = 'true'
+      and (
+        $listContains($prop($, 'cdx:gtfobins:functions'), 'shell')
+        or $listContains($prop($, 'cdx:gtfobins:functions'), 'command')
+        or $listContains($prop($, 'cdx:gtfobins:functions'), 'reverse-shell')
+        or $listContains($prop($, 'cdx:gtfobins:functions'), 'bind-shell')
+      )
+      and (
+        $prop($, 'internal:has_setuid') = 'true'
+        or $prop($, 'internal:has_setgid') = 'true'
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl,
+      "file": $prop($, 'internal:SrcFile')
+    }
+  message: "Executable '{{ name }}' at '{{ $prop($, 'internal:SrcFile') }}' combines GTFOBins execution features with setuid/setgid permissions"
+  mitigation: "Remove the setuid/setgid bit, replace the image with a slimmer base, and keep container privilege boundaries strict (no host mounts, no privileged mode, no extra capabilities)."
+  attack:
+    tactics: [TA0004]
+    techniques: [T1548, T1611]
+  evidence: |
+    {
+      "canonicalName": $prop($, 'cdx:gtfobins:name'),
+      "functions": $prop($, 'cdx:gtfobins:functions'),
+      "contexts": $prop($, 'cdx:gtfobins:contexts'),
+      "riskTags": $prop($, 'cdx:gtfobins:riskTags'),
+      "srcFile": $prop($, 'internal:SrcFile'),
+      "reference": $prop($, 'cdx:gtfobins:reference')
+    }
+
+- id: CTR-002
+  name: "Container image includes privileged container-escape helper"
+  description: "Container runtime or namespace-management helpers that are already classified as GTFOBins can accelerate container breakout when runtime isolation is weakened."
+  severity: critical
+  category: container-risk
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:gtfobins:matched') = 'true'
+      and $listContains($prop($, 'cdx:gtfobins:riskTags'), 'container-escape')
+      and (
+        $prop($, 'internal:has_setuid') = 'true'
+        or $prop($, 'internal:has_setgid') = 'true'
+        or $listContains($prop($, 'cdx:gtfobins:privilegedContexts'), 'capabilities')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl,
+      "file": $prop($, 'internal:SrcFile')
+    }
+  message: "Container-escape helper '{{ name }}' is present at '{{ $prop($, 'internal:SrcFile') }}' with elevated execution semantics"
+  mitigation: "Remove container runtime and namespace-management tooling from application images, avoid CAP_SYS_ADMIN-like capability grants, and block access to the Docker/containerd sockets."
+  attack:
+    tactics: [TA0004]
+    techniques: [T1611]
+  evidence: |
+    {
+      "canonicalName": $prop($, 'cdx:gtfobins:name'),
+      "privilegedContexts": $prop($, 'cdx:gtfobins:privilegedContexts'),
+      "riskTags": $prop($, 'cdx:gtfobins:riskTags'),
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+
+- id: CTR-003
+  name: "Container image includes privileged GTFOBins library-load or escalation primitive"
+  description: "GTFOBins entries that can load attacker-controlled shared libraries or directly escalate privileges are strong hardening failures in container images."
+  severity: high
+  category: container-risk
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:gtfobins:matched') = 'true'
+      and (
+        $listContains($prop($, 'cdx:gtfobins:functions'), 'library-load')
+        or $listContains($prop($, 'cdx:gtfobins:functions'), 'privilege-escalation')
+      )
+      and (
+        $prop($, 'internal:has_setuid') = 'true'
+        or $prop($, 'internal:has_setgid') = 'true'
+        or $listContains($prop($, 'cdx:gtfobins:privilegedContexts'), 'sudo')
+        or $listContains($prop($, 'cdx:gtfobins:privilegedContexts'), 'suid')
+        or $listContains($prop($, 'cdx:gtfobins:privilegedContexts'), 'capabilities')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl,
+      "file": $prop($, 'internal:SrcFile')
+    }
+  message: "Binary '{{ name }}' exposes GTFOBins privilege-escalation or library-load behavior in a privileged execution context"
+  mitigation: "Remove the helper from the image where possible, strip privileged bits/capabilities, and keep writable mounts away from privileged processes."
+  attack:
+    tactics: [TA0002, TA0004, TA0005]
+    techniques: [T1574, T1548]
+  evidence: |
+    {
+      "canonicalName": $prop($, 'cdx:gtfobins:name'),
+      "functions": $prop($, 'cdx:gtfobins:functions'),
+      "privilegedContexts": $prop($, 'cdx:gtfobins:privilegedContexts'),
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+
+- id: CTR-004
+  name: "Container image retains privileged GTFOBins exfiltration primitive"
+  description: "A GTFOBins helper that can read local files or upload data becomes especially dangerous when it also runs with setuid/setgid or other elevated contexts."
+  severity: high
+  category: container-risk
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:gtfobins:matched') = 'true'
+      and (
+        $listContains($prop($, 'cdx:gtfobins:riskTags'), 'data-exfiltration')
+        or $listContains($prop($, 'cdx:gtfobins:functions'), 'upload')
+      )
+      and (
+        $prop($, 'internal:has_setuid') = 'true'
+        or $prop($, 'internal:has_setgid') = 'true'
+        or $listContains($prop($, 'cdx:gtfobins:privilegedContexts'), 'sudo')
+        or $listContains($prop($, 'cdx:gtfobins:privilegedContexts'), 'suid')
+        or $listContains($prop($, 'cdx:gtfobins:privilegedContexts'), 'capabilities')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl,
+      "file": $prop($, 'internal:SrcFile')
+    }
+  message: "Binary '{{ name }}' can read or exfiltrate local data from a privileged execution path"
+  mitigation: "Drop privileged bits, keep secrets off the image filesystem, and remove unnecessary upload/file-read helpers from runtime images."
+  attack:
+    tactics: [TA0009, TA0010]
+    techniques: [T1005, T1041]
+  evidence: |
+    {
+      "canonicalName": $prop($, 'cdx:gtfobins:name'),
+      "functions": $prop($, 'cdx:gtfobins:functions'),
+      "privilegedContexts": $prop($, 'cdx:gtfobins:privilegedContexts'),
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+
+- id: CTR-005
+  name: "Container image includes mutable-path GTFOBins remote-execution helper"
+  description: "Remote-execution-capable GTFOBins helpers under mutable or non-standard image paths often indicate an avoidable attack toolkit or image tampering."
+  severity: medium
+  category: container-risk
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:gtfobins:matched') = 'true'
+      and (
+        $listContains($prop($, 'cdx:gtfobins:functions'), 'reverse-shell')
+        or $listContains($prop($, 'cdx:gtfobins:functions'), 'bind-shell')
+        or (
+          (
+            $listContains($prop($, 'cdx:gtfobins:functions'), 'shell')
+            or $listContains($prop($, 'cdx:gtfobins:functions'), 'command')
+          )
+          and (
+            $listContains($prop($, 'cdx:gtfobins:functions'), 'upload')
+            or $listContains($prop($, 'cdx:gtfobins:functions'), 'download')
+          )
+        )
+      )
+      and (
+        $startsWith($prop($, 'internal:SrcFile'), '/usr/local/')
+        or $startsWith($prop($, 'internal:SrcFile'), '/opt/')
+        or $startsWith($prop($, 'internal:SrcFile'), '/app/')
+        or $startsWith($prop($, 'internal:SrcFile'), '/tmp/')
+        or $startsWith($prop($, 'internal:SrcFile'), '/var/tmp/')
+        or $startsWith($prop($, 'internal:SrcFile'), '/root/')
+        or $startsWith($prop($, 'internal:SrcFile'), '/home/')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl,
+      "file": $prop($, 'internal:SrcFile')
+    }
+  message: "GTFOBins remote-execution helper '{{ name }}' is present in mutable image path '{{ $prop($, 'internal:SrcFile') }}'"
+  mitigation: "Keep runtime images immutable and minimal, move administrative tooling to separate debug images, and investigate how the helper entered the image."
+  attack:
+    tactics: [TA0008, TA0011]
+    techniques: [T1105, T1570]
+  evidence: |
+    {
+      "canonicalName": $prop($, 'cdx:gtfobins:name'),
+      "functions": $prop($, 'cdx:gtfobins:functions'),
+      "riskTags": $prop($, 'cdx:gtfobins:riskTags'),
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+
+- id: CTR-006
+  name: "Container image ships dedicated offensive container toolkit"
+  description: "Dedicated container or Kubernetes intrusion toolkits such as Peirates, CDK, or DEEPCE should not ship inside production runtime images."
+  severity: high
+  category: container-risk
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:container:matched') = 'true'
+      and $listContains($prop($, 'cdx:container:riskTags'), 'offensive-toolkit')
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl,
+      "file": $prop($, 'internal:SrcFile')
+    }
+  message: "Dedicated offensive toolkit '{{ name }}' is present at '{{ $prop($, 'internal:SrcFile') }}'"
+  mitigation: "Remove offensive testing binaries from runtime images, rebuild from a minimal trusted base, and keep container debugging or red-team tooling in separate break-glass images."
+  attack:
+    tactics: [TA0002, TA0004, TA0006, TA0007]
+    techniques: [T1552.007, T1609, T1611, T1613]
+  evidence: |
+    {
+      "canonicalName": $prop($, 'cdx:container:name'),
+      "offenseTools": $prop($, 'cdx:container:offenseTools'),
+      "riskTags": $prop($, 'cdx:container:riskTags'),
+      "attackTechniques": $prop($, 'cdx:container:attackTechniques'),
+      "knowledgeSources": $prop($, 'cdx:container:knowledgeSources'),
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+
+- id: CTR-007
+  name: "Container image includes seccomp-sensitive namespace escape helper"
+  description: "Helpers that rely on syscalls blocked by Docker's default seccomp profile become materially riskier when operators use `seccomp=unconfined` or permissive custom profiles."
+  severity: medium
+  category: container-risk
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:container:matched') = 'true'
+      and $prop($, 'cdx:container:seccompProfile') = 'docker-default'
+      and $prop($, 'cdx:container:seccompBlockedSyscalls') != ''
+      and (
+        $listContains($prop($, 'cdx:container:riskTags'), 'container-escape')
+        or $listContains($prop($, 'cdx:container:riskTags'), 'namespace-escape')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl,
+      "file": $prop($, 'internal:SrcFile')
+    }
+  message: "Seccomp-sensitive escape helper '{{ name }}' is present at '{{ $prop($, 'internal:SrcFile') }}' and depends on syscalls blocked by the Docker default seccomp profile"
+  mitigation: "Keep Docker or OCI runtimes on the default seccomp profile, never use `seccomp=unconfined` for app workloads, and review custom profiles so they do not allow namespace or host-escape syscalls without a clear need."
+  attack:
+    tactics: [TA0004]
+    techniques: [T1611]
+  evidence: |
+    {
+      "canonicalName": $prop($, 'cdx:container:name'),
+      "offenseTools": $prop($, 'cdx:container:offenseTools'),
+      "riskTags": $prop($, 'cdx:container:riskTags'),
+      "seccompProfile": $prop($, 'cdx:container:seccompProfile'),
+      "seccompBlockedSyscalls": $prop($, 'cdx:container:seccompBlockedSyscalls'),
+      "knowledgeSources": $prop($, 'cdx:container:knowledgeSources'),
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+
+- id: CTR-008
+  name: "Container dependency relies on the mutable 'latest' tag"
+  description: "Using the 'latest' tag for container image dependencies undermines supply chain reproducibility and makes SBOM attestations fragile since the underlying image can change without notice."
+  severity: medium
+  category: container-risk
+  dry-run-support: full
+  condition: |
+    components[
+      type = 'container'
+      and (
+        $contains(name, ':latest') or $contains(version, 'latest') or $not($exists(version)) or version = ''
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Container component '{{ name }}' uses the mutable 'latest' tag or lacks a pinned version"
+  mitigation: "Pin the container dependency to a specific immutable digest (e.g., using @sha256:...) or a stable release tag to ensure reproducibility and reliable attestations."
+  evidence: |
+    {
+      "name": name,
+      "version": version,
+      "purl": purl
+    }
+
+- id: CTR-009
+  name: "Container dependency lacks attached SBOM"
+  description: "Container dependencies should have an attached SBOM (attestation) in the container registry to verify their software bill of materials."
+  severity: medium
+  category: container-risk
+  dry-run-support: full
+  condition: |
+    components[
+      type = 'container'
+      and $not($hasSbom($))
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Container component '{{ name }}' lacks an attached SBOM in the registry"
+  mitigation: "Generate an SBOM and attach it to the container image using the attach feature (cdx-sign --attach)."
+  evidence: |
+    {
+      "name": name,
+      "purl": purl
+    }
+
+- id: CTR-010
+  name: "Container dependency lacks signed SBOM attestation"
+  description: "Container dependencies should have a cryptographically signed SBOM attestation in the container registry to ensure authenticity and integrity."
+  severity: medium
+  category: container-risk
+  dry-run-support: full
+  condition: |
+    components[
+      type = 'container'
+      and $hasSbom($)
+      and $not($hasSignedSbom($))
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Container component '{{ name }}' lacks a signed SBOM attestation in the registry"
+  mitigation: "Sign the container SBOM using a private key and attach the signed version to the registry (cdx-sign -k private.key --attach <tag>)."
+  evidence: |
+    {
+      "name": name,
+      "purl": purl
+    }

package/data/rules/dependency-sources.yaml

@@ -0,0 +1,236 @@
+# Dependency Source Integrity Rules
+# Category: dependency-source
+# Evaluates package manager data for non-registry, local, or mutable sources
+- id: PKG-001
+  name: "Install script from direct manifest source"
+  description: "npm packages with install scripts declared from git, URL, or local path sources in the manifest increase supply chain attack surface"
+  severity: high
+  category: dependency-source
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:npm:hasInstallScript') = 'true'
+      and $hasProp($, 'cdx:npm:manifestSourceType')
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "npm package '{{ name }}@{{ version }}' executes install script from manifest-declared source type(s): {{ $prop($, 'cdx:npm:manifestSourceType') }}"
+  mitigation: "Avoid git, URL, or local-path dependencies with lifecycle hooks; use registry-published dependencies or vendor explicitly"
+  evidence: |
+    {
+      "manifestSourceType": $prop($, 'cdx:npm:manifestSourceType'),
+      "manifestSource": $prop($, 'cdx:npm:manifestSource'),
+      "riskyScripts": $prop($, 'cdx:npm:risky_scripts'),
+      "resolvedPath": $prop($, 'cdx:npm:resolvedPath'),
+      "isLink": $prop($, 'cdx:npm:isLink')
+    }
+- id: PKG-002
+  name: "Go module uses local replacement"
+  description: "Go modules with local_dir replacements are non-hermetic and may not be reproducible"
+  severity: high
+  category: dependency-source
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:go:local_dir')
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Go module '{{ name }}' uses local replacement: {{ $prop($, 'cdx:go:local_dir') }}"
+  mitigation: "Use published module versions or vendor dependencies explicitly for reproducible builds"
+  evidence: |
+    {
+      "localDir": $prop($, 'cdx:go:local_dir'),
+      "toolchain": $prop($, 'cdx:go:toolchain')
+    }
+- id: PKG-003
+  name: "Swift local checkout in build"
+  description: "Swift packages with localCheckoutPath indicate developer-only dependencies not suitable for release"
+  severity: high
+  category: dependency-source
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:swift:localCheckoutPath')
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Swift package '{{ name }}' uses local checkout: {{ $prop($, 'cdx:swift:localCheckoutPath') }}"
+  mitigation: "Use remote package references (URL or registry) for release artifacts"
+  evidence: |
+    {
+      "checkoutPath": $prop($, 'cdx:swift:localCheckoutPath'),
+      "packageName": $prop($, 'cdx:swift:packageName')
+    }
+- id: PKG-004
+  name: "Nix flake missing reproducibility metadata"
+  description: "Nix dependencies without revision or nar_hash cannot be verified for content integrity"
+  severity: high
+  category: dependency-source
+  dry-run-support: full
+  condition: |
+    components[
+      $startsWith(purl, 'pkg:nix/')
+      and (
+        $prop($, 'cdx:nix:revision') = null
+        or $prop($, 'cdx:nix:nar_hash') = null
+      )
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Nix package '{{ name }}' missing reproducibility metadata (revision or nar_hash)"
+  mitigation: "Ensure flake.lock includes both revision and nar_hash for content-addressed reproducibility"
+  evidence: |
+    {
+      "inputUrl": $prop($, 'cdx:nix:input_url'),
+      "ref": $prop($, 'cdx:nix:ref'),
+      "hasRevision": $hasProp($, 'cdx:nix:revision'),
+      "hasNarHash": $hasProp($, 'cdx:nix:nar_hash')
+    }
+- id: PKG-005
+  name: "Ruby gem tracks mutable branch"
+  description: "Ruby gems sourced from a git branch move whenever the branch moves. Bundler records the currently resolved revision in Gemfile.lock, but the Gemfile still asks for a branch, so the next bundle update will silently pull different code"
+  severity: medium
+  category: dependency-source
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:gem:remoteBranch')
+      and $hasProp($, 'cdx:gem:remoteRevision')
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Ruby gem '{{ name }}' tracks the mutable branch '{{ $prop($, 'cdx:gem:remoteBranch') }}', currently resolved to revision {{ $prop($, 'cdx:gem:remoteRevision') }}"
+  mitigation: "Pin to a specific revision in the Gemfile: gem 'foo', git: '...', ref: '<commit-sha>'"
+  evidence: |
+    {
+      "remote": $prop($, 'cdx:gem:remote'),
+      "branch": $prop($, 'cdx:gem:remoteBranch'),
+      "revision": $prop($, 'cdx:gem:remoteRevision'),
+      "tag": $prop($, 'cdx:gem:remoteTag')
+    }
+- id: PKG-006
+  name: "Python dependency from non-approved registry"
+  description: "PyPI packages from unapproved registries may introduce unvetted code"
+  severity: low
+  category: dependency-source
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:pypi:registry')
+      and $prop($, 'cdx:pypi:registry') != 'https://pypi.org/simple'
+      and $prop($, 'cdx:pypi:registry') != 'https://pypi.org'
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Python package '{{ name }}' sourced from non-default registry: {{ $prop($, 'cdx:pypi:registry') }}"
+  mitigation: "Verify registry trustworthiness"
+  evidence: |
+    {
+      "registry": $prop($, 'cdx:pypi:registry'),
+      "resolvedFrom": $prop($, 'cdx:pypi:resolved_from')
+    }
+- id: PKG-007
+  name: "Cargo dependency from mutable git source"
+  description: "Cargo git dependencies without revision or tag pinning can change unexpectedly and reduce build reproducibility"
+  severity: high
+  category: dependency-source
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:cargo:git')
+      and $prop($, 'cdx:cargo:gitRev') = null
+      and $prop($, 'cdx:cargo:gitTag') = null
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Cargo dependency '{{ name }}@{{ version }}' tracks git source '{{ $prop($, 'cdx:cargo:git') }}' without an immutable revision pin"
+  mitigation: "Prefer crates.io releases or pin git dependencies with `rev = \"<commit-sha>\"` or a signed, reviewed tag"
+  evidence: |
+    {
+      "git": $prop($, 'cdx:cargo:git'),
+      "branch": $prop($, 'cdx:cargo:gitBranch'),
+      "tag": $prop($, 'cdx:cargo:gitTag'),
+      "dependencyKind": $prop($, 'cdx:cargo:dependencyKind')
+    }
+- id: PKG-008
+  name: "Cargo dependency from local path"
+  description: "Cargo path dependencies are local source references that reduce release reproducibility and may bypass registry review controls"
+  severity: high
+  category: dependency-source
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:cargo:path')
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Cargo dependency '{{ name }}@{{ version }}' uses local path source '{{ $prop($, 'cdx:cargo:path') }}'"
+  mitigation: "Use published crate versions for release builds or vendor the dependency explicitly with clear provenance review"
+  evidence: |
+    {
+      "path": $prop($, 'cdx:cargo:path'),
+      "dependencyKind": $prop($, 'cdx:cargo:dependencyKind'),
+      "target": $prop($, 'cdx:cargo:target')
+    }
+- id: PKG-009
+  name: "Collider package resolved from insecure HTTP origin"
+  description: "Collider lock entries that resolve from HTTP origins can be observed or modified in transit before wrap-hash verification occurs"
+  severity: medium
+  category: dependency-source
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:collider:originScheme') = 'http'
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Collider package '{{ name }}@{{ version }}' resolves from insecure origin '{{ $prop($, 'cdx:collider:origin') }}'"
+  mitigation: "Prefer HTTPS, trusted file:// repositories, or an authenticated internal mirror for Collider package origins"
+  evidence: |
+    {
+      "origin": $prop($, 'cdx:collider:origin'),
+      "originHost": $prop($, 'cdx:collider:originHost'),
+      "dependencyKind": $prop($, 'cdx:collider:dependencyKind')
+    }
+- id: PKG-010
+  name: "Collider origin required sanitization before BOM emission"
+  description: "Collider lock origin URLs should not carry credentials, query strings, or fragments because those values may embed secrets or unstable signed URLs"
+  severity: low
+  category: dependency-source
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:collider:originSanitized') = 'true'
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Collider package '{{ name }}@{{ version }}' had sensitive origin fields stripped before BOM emission"
+  mitigation: "Avoid embedding credentials or signed query parameters in Collider repository origin URLs; prefer stable repository base URLs"
+  evidence: |
+    {
+      "origin": $prop($, 'cdx:collider:origin'),
+      "originHost": $prop($, 'cdx:collider:originHost'),
+      "dependencyKind": $prop($, 'cdx:collider:dependencyKind')
+    }
+- id: PKG-011
+  name: "Python dependency uses direct manifest source"
+  description: "Python dependencies declared via git, direct URL, or local path in requirements or pyproject files bypass normal registry version mediation"
+  severity: high
+  category: dependency-source
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:pypi:manifestSourceType')
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Python package '{{ name }}@{{ version }}' is declared from manifest {{ $prop($, 'cdx:pypi:manifestSourceType') }} source '{{ $prop($, 'cdx:pypi:manifestSource') }}'"
+  mitigation: "Prefer registry-published releases for production builds, or pin and review direct git/URL/path sources explicitly"
+  evidence: |
+    {
+      "manifestSourceType": $prop($, 'cdx:pypi:manifestSourceType'),
+      "manifestSource": $prop($, 'cdx:pypi:manifestSource'),
+      "registry": $prop($, 'cdx:pypi:registry'),
+      "resolvedFrom": $prop($, 'cdx:pypi:resolved_from')
+    }