@cubis/foundry 0.3.10

package/Ai Agent Workflow/powers/security-reviewer/steering/sast-tools.md

@@ -0,0 +1,120 @@
+# SAST Tools
+
+> Reference for: Security Reviewer
+> Load when: Running automated security scans
+
+## JavaScript/TypeScript
+
+```bash
+# Dependency vulnerabilities
+npm audit
+npm audit --json > npm-audit.json
+
+# ESLint security plugin
+npm install eslint-plugin-security --save-dev
+npx eslint --ext .js,.ts . --plugin security
+
+# Snyk
+npx snyk test
+npx snyk code test
+```
+
+## Python
+
+```bash
+# Bandit - Python SAST
+pip install bandit
+bandit -r . -f json -o bandit-report.json
+bandit -r . -ll  # Only high severity
+
+# Safety - Dependency check
+pip install safety
+safety check
+safety check -r requirements.txt --json > safety-report.json
+
+# Pyup Safety
+pip install pyupio-safety
+pyupio-safety check
+```
+
+## Go
+
+```bash
+# GoSec - Go security checker
+go install github.com/securego/gosec/v2/cmd/gosec@latest
+gosec ./...
+gosec -fmt=json -out=gosec-report.json ./...
+
+# Go vulnerability database
+go install golang.org/x/vuln/cmd/govulncheck@latest
+govulncheck ./...
+```
+
+## Multi-Language Tools
+
+```bash
+# Semgrep - Universal SAST
+pip install semgrep
+semgrep --config=auto .
+semgrep --config=p/security-audit .
+semgrep --config=p/owasp-top-ten .
+
+# Trivy - Comprehensive scanner
+brew install trivy
+trivy fs .
+trivy fs --security-checks vuln,secret,config .
+
+# SonarQube (requires server)
+sonar-scanner -Dsonar.projectKey=myproject
+```
+
+## CI/CD Integration
+
+### GitHub Actions
+
+```yaml
+- name: Run Semgrep
+  uses: returntocorp/semgrep-action@v1
+  with:
+    config: p/security-audit
+
+- name: Run npm audit
+  run: npm audit --audit-level=high
+
+- name: Run Trivy
+  uses: aquasecurity/trivy-action@master
+  with:
+    scan-type: 'fs'
+    severity: 'CRITICAL,HIGH'
+```
+
+### GitLab CI
+
+```yaml
+security-scan:
+  image: returntocorp/semgrep
+  script:
+    - semgrep --config=auto --json -o semgrep.json .
+  artifacts:
+    reports:
+      sast: semgrep.json
+```
+
+## Quick Reference
+
+| Language | Primary Tool | Dependency Check |
+|----------|--------------|------------------|
+| JavaScript | ESLint + security | npm audit |
+| TypeScript | ESLint + security | npm audit |
+| Python | Bandit | Safety |
+| Go | GoSec | govulncheck |
+| Java | SpotBugs | OWASP Dependency-Check |
+| Ruby | Brakeman | bundler-audit |
+
+| Tool | Strengths | Best For |
+|------|-----------|----------|
+| Semgrep | Multi-language, custom rules | General SAST |
+| Trivy | Container + code + secrets | Comprehensive |
+| Bandit | Python-specific | Python projects |
+| GoSec | Go-specific | Go projects |
+| npm audit | Built-in, fast | Node.js deps |

package/Ai Agent Workflow/powers/security-reviewer/steering/secret-scanning.md

@@ -0,0 +1,128 @@
+# Secret Scanning
+
+> Reference for: Security Reviewer
+> Load when: Scanning for hardcoded secrets
+
+## Gitleaks
+
+```bash
+# Install
+brew install gitleaks
+
+# Scan current directory
+gitleaks detect --source . --verbose
+
+# Scan with report
+gitleaks detect --source . -f json -r gitleaks-report.json
+
+# Scan git history
+gitleaks detect --source . --log-opts="--all"
+
+# Use baseline (ignore known)
+gitleaks detect --baseline-path .gitleaks-baseline.json
+```
+
+## TruffleHog
+
+```bash
+# Install
+pip install trufflehog
+
+# Scan filesystem
+trufflehog filesystem .
+
+# Scan git repo
+trufflehog git file://. --since-commit HEAD~100
+
+# Scan with JSON output
+trufflehog filesystem . --json > trufflehog-report.json
+```
+
+## Manual Grep Patterns
+
+```bash
+# Common secret patterns
+grep -rn "api_key\|apikey\|api-key" --include="*.{ts,js,py}" .
+grep -rn "secret\|password\|passwd" --include="*.{ts,js,py}" .
+grep -rn "private_key\|privatekey" --include="*.{ts,js,py}" .
+grep -rn "access_token\|accesstoken" --include="*.{ts,js,py}" .
+
+# AWS credentials
+grep -rn "AKIA[0-9A-Z]{16}" .
+grep -rn "aws_secret_access_key" .
+
+# Base64 encoded (potential secrets)
+grep -rn "[A-Za-z0-9+/]{40,}=" .
+
+# JWT tokens
+grep -rn "eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\." .
+```
+
+## Common Secret Patterns
+
+| Type | Pattern | Example |
+|------|---------|---------|
+| AWS Access Key | `AKIA[0-9A-Z]{16}` | AKIAIOSFODNN7EXAMPLE |
+| AWS Secret Key | 40 char base64 | wJalrXUtnFEMI/K7MDENG... |
+| GitHub Token | `ghp_[A-Za-z0-9]{36}` | ghp_xxxxxxxxxxxx |
+| Slack Token | `xox[baprs]-` | xoxb-xxx-xxx |
+| Stripe Key | `sk_live_[A-Za-z0-9]{24}` | sk_live_xxxx |
+| Private Key | `-----BEGIN.*PRIVATE KEY-----` | RSA/EC keys |
+| JWT | `eyJ[A-Za-z0-9_-]*\.eyJ` | Encoded tokens |
+
+## Pre-commit Hook
+
+```yaml
+# .pre-commit-config.yaml
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.18.0
+    hooks:
+      - id: gitleaks
+```
+
+## CI/CD Integration
+
+```yaml
+# GitHub Actions
+- name: Gitleaks
+  uses: gitleaks/gitleaks-action@v2
+  env:
+    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+# GitLab CI
+secret_detection:
+  image: zricethezav/gitleaks
+  script:
+    - gitleaks detect --source . -f sarif -r gl-secret-detection-report.sarif
+  artifacts:
+    reports:
+      secret_detection: gl-secret-detection-report.sarif
+```
+
+## Remediation Steps
+
+1. **Rotate immediately** - Consider secret compromised
+2. **Remove from history** - Use git filter-branch or BFG
+3. **Add to .gitignore** - Prevent future commits
+4. **Use env variables** - Move to environment
+5. **Use secret manager** - AWS Secrets Manager, Vault
+
+```bash
+# Remove from git history (BFG)
+bfg --replace-text passwords.txt repo.git
+
+# Or git filter-branch
+git filter-branch --force --index-filter \
+  "git rm --cached --ignore-unmatch path/to/secret" \
+  --prune-empty --tag-name-filter cat -- --all
+```
+
+## Quick Reference
+
+| Tool | Best For | Speed |
+|------|----------|-------|
+| Gitleaks | Git history | Fast |
+| TruffleHog | Deep scanning | Medium |
+| grep | Quick checks | Fast |
+| GitHub Secret Scanning | GitHub repos | Auto |

package/Ai Agent Workflow/powers/security-reviewer/steering/vulnerability-patterns.md

@@ -0,0 +1,184 @@
+# Vulnerability Patterns
+
+> Reference for: Security Reviewer
+> Load when: Manual security code review
+
+## SQL Injection
+
+```typescript
+// VULNERABLE
+const query = `SELECT * FROM users WHERE id = ${userId}`;
+const query = `SELECT * FROM users WHERE name = '${name}'`;
+
+// SECURE - Parameterized queries
+const query = "SELECT * FROM users WHERE id = $1";
+db.query(query, [userId]);
+
+// SECURE - ORM
+const user = await User.findOne({ where: { id: userId } });
+```
+
+## NoSQL Injection (MongoDB)
+
+```typescript
+// VULNERABLE - Untrusted filter object
+const user = await users.findOne(req.body);
+
+// Attacker sends: { "email": "user@site.com", "password": { "$ne": null } }
+
+// VULNERABLE - Directly using input in query operators
+const user = await users.findOne({
+  email: req.body.email,
+  password: req.body.password,
+});
+
+// SECURE - Validate types and allowlist fields
+const email = String(req.body.email);
+const password = String(req.body.password);
+const user = await users.findOne({ email, password });
+
+// SECURE - Mongoose hardening
+mongoose.set("sanitizeFilter", true);
+mongoose.set("strictQuery", true);
+
+// SECURE - Allowlist query operators server-side only
+const allowed = { email, status: "active" };
+const user = await users.findOne(allowed);
+```
+
+## XSS (Cross-Site Scripting)
+
+```typescript
+// VULNERABLE - Direct HTML injection
+element.innerHTML = userInput;
+document.write(userInput);
+
+// SECURE - Text content
+element.textContent = userInput;
+
+// SECURE - Sanitization
+import DOMPurify from 'dompurify';
+element.innerHTML = DOMPurify.sanitize(userInput);
+
+// SECURE - React (auto-escaped)
+return <div>{userInput}</div>;
+
+// VULNERABLE - React dangerouslySetInnerHTML
+return <div dangerouslySetInnerHTML={{ __html: userInput }} />;
+```
+
+## Path Traversal
+
+```typescript
+// VULNERABLE
+const file = path.join(uploadDir, req.query.filename);
+res.sendFile(file);
+
+// SECURE - Validate and normalize
+const filename = path.basename(req.query.filename);
+const file = path.resolve(uploadDir, filename);
+
+if (!file.startsWith(path.resolve(uploadDir))) {
+  throw new Error("Invalid path");
+}
+res.sendFile(file);
+```
+
+## Command Injection
+
+```typescript
+// VULNERABLE
+exec(`ls ${userInput}`);
+exec("git clone " + repoUrl);
+
+// SECURE - Use arrays, avoid shell
+execFile("ls", [userInput]);
+spawn("git", ["clone", repoUrl]);
+
+// SECURE - Validation
+const allowedCommands = ["status", "log"];
+if (!allowedCommands.includes(cmd)) throw new Error("Invalid");
+```
+
+## IDOR (Insecure Direct Object Reference)
+
+```typescript
+// VULNERABLE - No authorization check
+app.get("/documents/:id", async (req, res) => {
+  const doc = await Document.findById(req.params.id);
+  res.json(doc);
+});
+
+// SECURE - Verify ownership
+app.get("/documents/:id", async (req, res) => {
+  const doc = await Document.findOne({
+    _id: req.params.id,
+    userId: req.user.id, // Ensure user owns document
+  });
+  if (!doc) return res.status(404).json({ error: "Not found" });
+  res.json(doc);
+});
+```
+
+## Insecure Deserialization
+
+```typescript
+// VULNERABLE - Python pickle
+import pickle
+data = pickle.loads(user_input)
+
+// SECURE - Use JSON
+import json
+data = json.loads(user_input)
+
+// VULNERABLE - Node.js
+const obj = eval('(' + userInput + ')');
+
+// SECURE
+const obj = JSON.parse(userInput);
+```
+
+## Sensitive Data Exposure
+
+```typescript
+// VULNERABLE - Logging sensitive data
+logger.info("User login", { email, password });
+console.log("Token:", authToken);
+
+// SECURE - Redact sensitive fields
+logger.info("User login", { email, password: "[REDACTED]" });
+
+// VULNERABLE - Error response exposes internals
+res.status(500).json({ error: err.stack });
+
+// SECURE - Generic error
+res.status(500).json({ error: "Internal server error" });
+```
+
+## Quick Reference
+
+| Vulnerability     | Input Vector    | Prevention                         |
+| ----------------- | --------------- | ---------------------------------- |
+| SQL Injection     | Query params    | Parameterized queries              |
+| NoSQL Injection   | JSON filters    | Allowlist fields, sanitize filters |
+| XSS               | User content    | Output encoding                    |
+| Path Traversal    | File paths      | path.basename + validation         |
+| Command Injection | Shell args      | execFile, no shell                 |
+| IDOR              | Resource IDs    | Authorization checks               |
+| Deserialization   | Serialized data | JSON only                          |
+| Data Exposure     | Logs, errors    | Redaction, generic errors          |
+
+## OWASP Top 10 Mapping
+
+| OWASP                         | Vulnerabilities                |
+| ----------------------------- | ------------------------------ |
+| A01 Broken Access Control     | IDOR, path traversal           |
+| A02 Cryptographic Failures    | Weak encryption, plaintext     |
+| A03 Injection                 | SQL, NoSQL, XSS, command       |
+| A04 Insecure Design           | Missing auth, IDOR             |
+| A05 Security Misconfiguration | Debug mode, default creds      |
+| A06 Vulnerable Components     | Outdated dependencies          |
+| A07 Auth Failures             | Weak passwords, session issues |
+| A08 Data Integrity            | Insecure deserialization       |
+| A09 Logging Failures          | Missing logs, exposed data     |
+| A10 SSRF                      | Unvalidated URLs               |