@cubis/foundry 0.3.82 → 0.3.84

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/vibesec/evals/evals.json

@@ -1,68 +0,0 @@
-[
-  {
-    "id": "vibesec-quick-assessment",
-    "title": "Quick security vibe check on a Node.js project",
-    "description": "Given a project description with multiple security issues, the skill should identify the most critical problems and assign an overall vibe rating.",
-    "prompt": "Run a vibe check on this Node.js project:\n\n- package.json has 47 dependencies, last updated 14 months ago\n- .env file is committed to git with DATABASE_URL containing credentials\n- express app has no helmet middleware, no rate limiting\n- CORS is set to Access-Control-Allow-Origin: *\n- Error handler sends full stack traces in production\n- No Content-Security-Policy header\n- Using jsonwebtoken 8.5.1 (known vulnerability)\n- Docker container runs as root\n- No .gitignore entry for .env",
-    "assertions": [
-      {
-        "type": "content_matches_regex",
-        "value": "RED|ORANGE|red|orange",
-        "description": "Must assign a negative vibe rating (RED or ORANGE) given the severity of issues"
-      },
-      {
-        "type": "content_matches_regex",
-        "value": "\\.env|secret|credential|DATABASE_URL",
-        "description": "Must flag the committed .env file with credentials as a critical issue"
-      },
-      {
-        "type": "content_matches_regex",
-        "value": "CORS|Access-Control|origin.*\\*",
-        "description": "Must identify the wildcard CORS configuration as a security issue"
-      },
-      {
-        "type": "content_matches_regex",
-        "value": "stack trace|error|debug|production",
-        "description": "Must flag stack trace exposure in production"
-      },
-      {
-        "type": "content_matches_regex",
-        "value": "root|container|Docker|privilege",
-        "description": "Must flag the container running as root"
-      }
-    ]
-  },
-  {
-    "id": "vibesec-dependency-audit",
-    "title": "Dependency health audit for a Python project",
-    "description": "Given dependency information with vulnerabilities and outdated packages, the skill should assess dependency health and recommend actions.",
-    "prompt": "Assess the dependency health for our Python project:\n\n```\nrequirements.txt:\nDjango==3.2.0\nrequests==2.25.0\nPillow==8.0.0\ncryptography==3.3\nPyYAML==5.3\nparamiko==2.7.1\nurllib3==1.26.2\ncelery==5.0.0\n```\n\nWe're running Python 3.11 in production. The project handles financial transactions.",
-    "assertions": [
-      {
-        "type": "content_matches_regex",
-        "value": "Django.*3\\.2|outdated|end.of.life|EOL|upgrade|update",
-        "description": "Must flag Django 3.2 as outdated and recommend upgrading"
-      },
-      {
-        "type": "content_matches_regex",
-        "value": "Pillow|CVE|vulnerability|vulnerab",
-        "description": "Must identify known vulnerabilities in outdated Pillow version"
-      },
-      {
-        "type": "content_matches_regex",
-        "value": "PyYAML|YAML|deserializ|unsafe",
-        "description": "Must flag PyYAML 5.3 for known deserialization vulnerabilities"
-      },
-      {
-        "type": "content_matches_regex",
-        "value": "pip.audit|safety|dependabot|renovate|scan",
-        "description": "Must recommend a dependency scanning tool"
-      },
-      {
-        "type": "content_matches_regex",
-        "value": "financial|critical|high.*risk|sensitive|priority",
-        "description": "Must note that financial transaction context raises the risk severity"
-      }
-    ]
-  }
-]

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/vibesec/examples/01-nodejs-quick-assessment.md

@@ -1,79 +0,0 @@
-# Example 1: Quick Security Vibe Check on a Next.js Project
-
-## User Prompt
-
-> Run a vibe check on our Next.js e-commerce project. Here is what I can tell you:
-> - Next.js 13.4, React 18, TypeScript
-> - Using NextAuth with Google and GitHub providers
-> - Prisma ORM with PostgreSQL
-> - Stripe for payments
-> - Docker Compose for local dev, Vercel for production
-> - Last dependency update was 5 months ago
-> - .env.local is gitignored but .env.example contains real API key patterns
-> - No CSP headers configured
-> - Images uploaded to S3 with public-read ACL
-
-## Expected Response
-
-### VibeSec Report
-
-### Overall Vibe: YELLOW
-
-This project has a reasonable foundation (typed language, ORM, managed auth) but has several configuration-level gaps that could be exploited. No showstoppers, but action needed before the next release.
-
-### Quick Stats
-
-- Hardcoded secrets found: 0 committed, 1 risky pattern (.env.example)
-- Vulnerable dependencies: Likely (5 months without updates)
-- Config issues: 3 (CSP, S3 ACL, .env.example)
-- Missing security headers: CSP, Permissions-Policy
-
-### Top 5 Issues (Fix These First)
-
-1. **Missing Content-Security-Policy header** — Without CSP, any XSS vulnerability can load arbitrary scripts, exfiltrate data, and hijack sessions. Add a strict CSP in `next.config.js` or middleware. This is the highest-leverage fix.
-
-2. **S3 public-read ACL on image uploads** — Public-read means anyone with the URL can access uploaded images. If users upload sensitive documents or if S3 keys are guessable, this is a data exposure risk. Switch to private ACL with signed URLs for access.
-
-3. **Stale dependencies (5 months)** — Run `npm audit` immediately. Next.js, Prisma, and NextAuth have all had security patches in the last 5 months. Especially check for Next.js server-action vulnerabilities.
-
-4. **.env.example with real API key patterns** — If `.env.example` contains keys that look like real keys (even expired ones), contributors may accidentally commit real keys thinking it is safe. Use clearly fake placeholder values like `sk_test_REPLACE_ME`.
-
-5. **No Permissions-Policy header** — Without this header, embedded content can access camera, microphone, geolocation, and payment APIs. Add `Permissions-Policy: camera=(), microphone=(), geolocation=()` at minimum.
-
-### Secrets Scan
-
-- `.env.local` — properly gitignored
-- `.env.example` — contains patterns resembling real API keys. Replace with obvious placeholders
-- Source code — no hardcoded secrets detected in a surface scan
-- **Recommendation:** Add `gitleaks` as a pre-commit hook
-
-### Dependency Health
-
-- **Last updated:** 5 months ago — likely has known vulnerabilities
-- **Action:** Run `npm audit --production` and address critical/high findings
-- **Ongoing:** Enable Dependabot or Renovate for automated dependency PRs
-
-### Configuration Review
-
-| Config | Status | Issue |
-|--------|--------|-------|
-| NextAuth | OK | Standard OAuth providers, verify callback URLs are restricted |
-| Prisma | OK | ORM prevents SQL injection by default |
-| Docker Compose | Check | Verify no ports exposed beyond localhost |
-| Vercel | Check | Verify environment variables are set as secrets, not plaintext |
-| S3 | Issue | Public-read ACL on uploads |
-
-### Header & Transport Check
-
-| Header | Status |
-|--------|--------|
-| HTTPS | OK (Vercel enforces) |
-| HSTS | OK (Vercel default) |
-| CSP | Missing |
-| X-Frame-Options | Check — may need explicit config |
-| Permissions-Policy | Missing |
-| X-Content-Type-Options | Check |
-
-### Recommendation
-
-**No full audit needed yet**, but address the top 5 issues before the next release. Schedule a focused review of the S3 upload flow and NextAuth callback configuration. Set up automated dependency updates.

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/vibesec/examples/02-dependency-health-audit.md

@@ -1,96 +0,0 @@
-# Example 2: Dependency Health Audit for a Django Project
-
-## User Prompt
-
-> Audit the dependency health of our Django REST API project that handles healthcare data:
->
-> ```
-> Django==3.2.18
-> djangorestframework==3.14.0
-> celery==5.2.7
-> redis==4.5.1
-> Pillow==9.4.0
-> cryptography==39.0.0
-> boto3==1.26.0
-> psycopg2-binary==2.9.5
-> gunicorn==20.1.0
-> requests==2.28.1
-> PyJWT==2.6.0
-> django-cors-headers==3.13.0
-> ```
->
-> We process HIPAA-regulated patient data.
-
-## Expected Response
-
-### VibeSec Dependency Audit
-
-### Overall Vibe: ORANGE
-
-Multiple outdated packages with known CVEs in a HIPAA-regulated healthcare context. The regulatory environment and data sensitivity elevate every finding by at least one severity level. Immediate action required.
-
-### Dependency Health Summary
-
-| Package | Installed | Latest Stable | Status | Risk |
-|---------|-----------|---------------|--------|------|
-| Django | 3.2.18 | 5.1.x | End-of-life (April 2024) | Critical |
-| djangorestframework | 3.14.0 | 3.15.x | Minor update available | Low |
-| celery | 5.2.7 | 5.4.x | Outdated, security fixes in 5.3+ | Medium |
-| redis | 4.5.1 | 5.2.x | Major version behind | Medium |
-| Pillow | 9.4.0 | 11.x | Multiple CVEs (buffer overflow, DoS) | High |
-| cryptography | 39.0.0 | 44.x | Multiple CVEs, OpenSSL updates | Critical |
-| boto3 | 1.26.0 | 1.35.x | Very outdated, missing security patches | Medium |
-| psycopg2-binary | 2.9.5 | 2.9.9 | Minor update | Low |
-| gunicorn | 20.1.0 | 22.x | HTTP request smuggling fix in 21.x | High |
-| requests | 2.28.1 | 2.32.x | CVE-2023-32681 (proxy auth leak) | High |
-| PyJWT | 2.6.0 | 2.9.x | Algorithm confusion fix in 2.8+ | Medium |
-| django-cors-headers | 3.13.0 | 4.6.x | Feature updates, no critical CVEs | Low |
-
-### Critical Findings
-
-**1. Django 3.2 — End of Life (CRITICAL)**
-Django 3.2 LTS reached end-of-life in April 2024 and no longer receives security patches. In a HIPAA context, running unsupported software is a compliance violation.
-- **Action:** Upgrade to Django 5.0+ or at minimum Django 4.2 LTS
-- **Effort:** Medium-high (breaking changes in URL routing, middleware, and form rendering)
-
-**2. cryptography 39.0.0 — Multiple CVEs (CRITICAL)**
-This version is affected by CVEs in the underlying OpenSSL and Rust bindings. The `cryptography` package is foundational — everything depending on it (TLS, token signing, encryption) is affected.
-- **Action:** Upgrade to cryptography >= 43.0
-- **Effort:** Low (usually backwards-compatible)
-
-**3. Pillow 9.4.0 — Buffer Overflow CVEs (HIGH)**
-Multiple CVEs including buffer overflow and denial-of-service in image parsing. If the application processes user-uploaded images, this is exploitable.
-- **Action:** Upgrade to Pillow >= 10.3
-- **Effort:** Low-medium (some deprecated function removals)
-
-**4. gunicorn 20.1.0 — HTTP Request Smuggling (HIGH)**
-CVE-2024-1135 (HTTP request smuggling) affects versions before 22.0. Request smuggling can bypass authentication and authorization controls.
-- **Action:** Upgrade to gunicorn >= 22.0
-- **Effort:** Low
-
-**5. requests 2.28.1 — Proxy Auth Credential Leak (HIGH)**
-CVE-2023-32681 allows proxy authentication credentials to leak to the destination server.
-- **Action:** Upgrade to requests >= 2.31.0
-- **Effort:** Low
-
-### HIPAA Compliance Impact
-
-Running end-of-life software and packages with known vulnerabilities violates the HIPAA Security Rule requirements for:
-- **164.308(a)(5)(ii)(B):** Protection from malicious software
-- **164.312(e)(2)(ii):** Encryption mechanism integrity
-- **164.306(a)(1):** Ensure confidentiality of ePHI
-
-A breach traceable to a known, unpatched CVE would significantly increase regulatory penalties.
-
-### Recommended Actions
-
-1. **Immediate:** Upgrade `cryptography`, `requests`, `gunicorn`, `Pillow` (low effort, high impact)
-2. **This sprint:** Plan Django 4.2 LTS migration path
-3. **Ongoing:** Enable `pip-audit` in CI, configure Dependabot for automated PRs
-4. **Audit:** Run `pip-audit --strict` and address all findings before next deployment
-
-```bash
-# Quick fix for low-effort upgrades
-pip install --upgrade cryptography requests gunicorn Pillow PyJWT
-pip-audit --strict
-```

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/vibesec/references/common-pitfalls.md

@@ -1,283 +0,0 @@
-# Common Security Pitfalls Reference
-
-## Overview
-
-This reference catalogs the most frequently encountered security mistakes in modern web applications, APIs, and cloud-native architectures. Each pitfall includes the vulnerable pattern, why it matters, and the fix.
-
-## Authentication Pitfalls
-
-### 1. Storing Passwords in Plaintext or Weak Hash
-
-**Vulnerable:**
-```python
-# MD5 — broken, rainbow-tableable
-password_hash = hashlib.md5(password.encode()).hexdigest()
-
-# SHA-256 without salt — rainbow-tableable
-password_hash = hashlib.sha256(password.encode()).hexdigest()
-```
-
-**Fixed:**
-```python
-# bcrypt with cost factor (recommended)
-import bcrypt
-password_hash = bcrypt.hashpw(password.encode(), bcrypt.gensalt(rounds=12))
-
-# Argon2 (modern, memory-hard)
-from argon2 import PasswordHasher
-ph = PasswordHasher()
-password_hash = ph.hash(password)
-```
-
-### 2. JWT Without Expiration
-
-**Vulnerable:**
-```javascript
-const token = jwt.sign({ userId: user.id }, secret);
-// Token is valid forever
-```
-
-**Fixed:**
-```javascript
-const token = jwt.sign({ userId: user.id }, secret, {
-  expiresIn: '1h',
-  issuer: 'auth.myapp.com',
-  audience: 'api.myapp.com'
-});
-```
-
-### 3. Session Fixation
-
-**Vulnerable:** Session ID does not change after login.
-
-**Fixed:** Regenerate session ID after authentication:
-```javascript
-req.session.regenerate((err) => {
-  req.session.userId = user.id;
-  // ... continue
-});
-```
-
-## Input Handling Pitfalls
-
-### 4. SQL Injection via String Concatenation
-
-**Vulnerable:**
-```javascript
-db.query(`SELECT * FROM users WHERE email = '${email}'`);
-```
-
-**Fixed:**
-```javascript
-db.query('SELECT * FROM users WHERE email = $1', [email]);
-```
-
-### 5. Command Injection
-
-**Vulnerable:**
-```python
-import os
-os.system(f"ping -c 4 {user_input}")
-# User input: "8.8.8.8; cat /etc/passwd"
-```
-
-**Fixed:**
-```python
-import subprocess
-subprocess.run(["ping", "-c", "4", user_input], check=True)
-# Arguments are passed as array — shell interpretation disabled
-```
-
-### 6. Path Traversal
-
-**Vulnerable:**
-```javascript
-const filePath = `./uploads/${req.params.filename}`;
-res.sendFile(filePath);
-// Attack: GET /files/../../../etc/passwd
-```
-
-**Fixed:**
-```javascript
-const path = require('path');
-const safePath = path.join('./uploads', path.basename(req.params.filename));
-// path.basename strips directory traversal sequences
-```
-
-### 7. Mass Assignment
-
-**Vulnerable:**
-```javascript
-// User can set any field including isAdmin
-const user = await User.create(req.body);
-```
-
-**Fixed:**
-```javascript
-// Explicitly pick allowed fields
-const { name, email } = req.body;
-const user = await User.create({ name, email, isAdmin: false });
-```
-
-## Configuration Pitfalls
-
-### 8. Debug Mode in Production
-
-**Vulnerable:** Django with `DEBUG = True`, Express with `NODE_ENV=development`, Spring Boot Actuator endpoints exposed.
-
-**Impact:** Stack traces reveal file paths, versions, query parameters, and framework internals.
-
-### 9. CORS Wildcard
-
-**Vulnerable:**
-```javascript
-app.use(cors({ origin: '*' }));
-```
-
-**Impact:** Any website can make authenticated requests to your API.
-
-**Fixed:**
-```javascript
-app.use(cors({
-  origin: ['https://myapp.com', 'https://admin.myapp.com'],
-  credentials: true
-}));
-```
-
-### 10. Missing Rate Limiting
-
-**Vulnerable:** Login endpoint accepts unlimited requests.
-
-**Impact:** Brute-force attacks, credential stuffing.
-
-**Fixed:**
-```javascript
-const rateLimit = require('express-rate-limit');
-const loginLimiter = rateLimit({
-  windowMs: 15 * 60 * 1000, // 15 minutes
-  max: 5, // 5 attempts per window
-  message: 'Too many login attempts'
-});
-app.post('/login', loginLimiter, loginHandler);
-```
-
-## Cryptography Pitfalls
-
-### 11. Hardcoded Secrets
-
-**Vulnerable:**
-```javascript
-const JWT_SECRET = 'my-super-secret-key-2024';
-```
-
-**Fixed:**
-```javascript
-const JWT_SECRET = process.env.JWT_SECRET;
-if (!JWT_SECRET) throw new Error('JWT_SECRET environment variable required');
-```
-
-### 12. Insecure Random for Security-Sensitive Values
-
-**Vulnerable:**
-```javascript
-// Math.random() is NOT cryptographically secure
-const token = Math.random().toString(36).substring(2);
-```
-
-**Fixed:**
-```javascript
-const crypto = require('crypto');
-const token = crypto.randomBytes(32).toString('hex');
-```
-
-## API Pitfalls
-
-### 13. Exposing Internal IDs
-
-**Vulnerable:** Sequential integer IDs allow enumeration (`/api/users/1`, `/api/users/2`, ...).
-
-**Fixed:** Use UUIDs or opaque tokens for external-facing identifiers.
-
-### 14. Over-Fetching in API Responses
-
-**Vulnerable:**
-```javascript
-app.get('/api/users/:id', async (req, res) => {
-  const user = await User.findById(req.params.id);
-  res.json(user); // Includes password_hash, internal_notes, etc.
-});
-```
-
-**Fixed:**
-```javascript
-const user = await User.findById(req.params.id)
-  .select('id name email avatar createdAt');
-res.json(user);
-```
-
-### 15. Missing Content-Type Validation
-
-**Vulnerable:** API accepts any content type, potentially enabling XXE or other parser-specific attacks.
-
-**Fixed:**
-```javascript
-app.use(express.json({ type: 'application/json', limit: '1mb' }));
-// Reject requests with wrong Content-Type
-```
-
-## Error Handling Pitfalls
-
-### 16. Leaking Stack Traces
-
-**Vulnerable:**
-```javascript
-app.use((err, req, res, next) => {
-  res.status(500).json({ error: err.message, stack: err.stack });
-});
-```
-
-**Fixed:**
-```javascript
-app.use((err, req, res, next) => {
-  console.error(err); // Log internally
-  res.status(500).json({ error: 'Internal server error' });
-});
-```
-
-## Dependency Pitfalls
-
-### 17. No Lockfile
-
-**Vulnerable:** Only `package.json` with ranges — builds are non-reproducible and vulnerable to supply chain attacks.
-
-**Fixed:** Always commit lockfiles (`package-lock.json`, `yarn.lock`, `poetry.lock`). Use `npm ci` instead of `npm install` in CI.
-
-### 18. Ignoring Audit Warnings
-
-**Vulnerable:** `npm audit` shows 47 vulnerabilities, all ignored.
-
-**Fixed:** Triage each finding. Update what can be updated. Document accepted risks. Block PRs on critical/high.
-
-## Container Pitfalls
-
-### 19. Running as Root in Container
-
-**Vulnerable:** No `USER` directive in Dockerfile.
-
-**Impact:** Container escape gives root on host. Any file write vulnerability has maximum impact.
-
-**Fixed:**
-```dockerfile
-RUN adduser -D appuser
-USER appuser
-```
-
-### 20. Secrets in Docker Layers
-
-**Vulnerable:**
-```dockerfile
-COPY .env .
-RUN npm install  # .env is in a layer even if deleted later
-```
-
-**Fixed:** Use `.dockerignore` to exclude secrets. Mount secrets at runtime.

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/vibesec/references/config-review.md

@@ -1,164 +0,0 @@
-# Configuration Review Reference
-
-## Overview
-
-Security misconfigurations are consistently in the OWASP Top 10 because they are common, easy to exploit, and often invisible to developers. This reference covers security review patterns for common configuration files.
-
-## Environment Files
-
-### .env / .env.local / .env.production
-
-| Check | Red Flag | Fix |
-|-------|----------|-----|
-| Committed to git | `.env` in repo | Add to `.gitignore`, rotate all secrets |
-| Plaintext secrets | `DB_PASSWORD=actual_password` | Use secrets manager, reference by name |
-| Debug mode | `DEBUG=true`, `NODE_ENV=development` | Ensure production values in deployment |
-| Verbose logging | `LOG_LEVEL=debug` | Set to `warn` or `error` in production |
-| Wildcard origins | `CORS_ORIGIN=*` | Specify allowed origins explicitly |
-
-### .env.example Pattern
-
-```bash
-# GOOD — clearly fake values
-DATABASE_URL=postgresql://user:CHANGE_ME@localhost:5432/mydb
-STRIPE_API_KEY=sk_test_REPLACE_WITH_YOUR_KEY
-JWT_SECRET=GENERATE_A_RANDOM_STRING_HERE
-
-# BAD — looks like real credentials
-DATABASE_URL=postgresql://admin:xK9m2pLq@db.internal:5432/prod
-STRIPE_API_KEY=sk_test_51ABC123DEF456GHI789
-JWT_SECRET=a7b3c9d1e5f2g8h4
-```
-
-## Docker Configuration
-
-### docker-compose.yml
-
-| Check | Red Flag | Fix |
-|-------|----------|-----|
-| Secrets in environment | `PASSWORD: actual_value` | Use Docker secrets or external file |
-| Port exposure | `ports: "0.0.0.0:5432:5432"` | Bind to localhost: `"127.0.0.1:5432:5432"` |
-| Privileged mode | `privileged: true` | Remove unless absolutely required |
-| Root user | No `user:` directive | Add `user: "1000:1000"` |
-| Latest tag | `image: nginx:latest` | Pin to specific version |
-| No resource limits | Missing `deploy.resources` | Set CPU and memory limits |
-| Host network | `network_mode: host` | Use bridge networking |
-
-### Dockerfile
-
-```dockerfile
-# GOOD
-FROM node:20-alpine@sha256:abc123...
-RUN addgroup -S appgroup && adduser -S appuser -G appgroup
-USER appuser
-COPY --chown=appuser:appgroup . .
-EXPOSE 3000
-HEALTHCHECK CMD curl -f http://localhost:3000/health || exit 1
-
-# BAD
-FROM node:latest
-COPY . .
-RUN npm install
-EXPOSE 3000 22 5432
-CMD ["node", "server.js"]
-```
-
-| Dockerfile Check | Red Flag | Fix |
-|-----------------|----------|-----|
-| Base image | `FROM *:latest` | Pin version and digest |
-| Running as root | No `USER` directive | Add non-root user |
-| Unnecessary ports | Multiple EXPOSE | Only expose application port |
-| COPY secrets | `COPY .env .` | Use .dockerignore, mount at runtime |
-| Build secrets | `ARG PASSWORD` | Use BuildKit secrets |
-| No healthcheck | Missing HEALTHCHECK | Add health check |
-
-## Nginx Configuration
-
-```nginx
-# Security-hardened nginx.conf
-server {
-    listen 443 ssl http2;
-    server_name example.com;
-
-    # TLS
-    ssl_certificate /etc/ssl/certs/cert.pem;
-    ssl_certificate_key /etc/ssl/private/key.pem;
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
-    ssl_prefer_server_ciphers off;
-
-    # Security headers
-    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-    add_header X-Frame-Options "DENY" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header Content-Security-Policy "default-src 'self'" always;
-    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-
-    # Disable information disclosure
-    server_tokens off;
-
-    # Prevent access to hidden files
-    location ~ /\. {
-        deny all;
-        return 404;
-    }
-}
-```
-
-| Nginx Check | Red Flag | Fix |
-|-------------|----------|-----|
-| server_tokens | `on` (default) | `server_tokens off;` |
-| SSL protocols | TLSv1, TLSv1.1 | Only TLSv1.2, TLSv1.3 |
-| Hidden files | No block for `/.` | Deny access to dotfiles |
-| Directory listing | `autoindex on` | `autoindex off` |
-| Large body | No `client_max_body_size` | Set appropriate limit |
-| Missing headers | No security headers | Add all security headers |
-
-## Cloud IAM Configuration
-
-### AWS
-
-| Check | Red Flag | Fix |
-|-------|----------|-----|
-| Root account usage | Root user has access keys | Delete root access keys, use IAM users |
-| Wildcard permissions | `"Action": "*"` | Use least-privilege policies |
-| Public S3 buckets | `PublicRead` or `PublicReadWrite` | Block public access at account level |
-| No MFA | IAM users without MFA | Enforce MFA for all console users |
-| Long-lived credentials | Access keys > 90 days | Rotate or migrate to IAM roles |
-| Cross-account | Overly permissive trust policies | Restrict to specific accounts and roles |
-
-### Kubernetes
-
-| Check | Red Flag | Fix |
-|-------|----------|-----|
-| Default namespace | Workloads in `default` | Use dedicated namespaces |
-| No network policies | All pods can communicate | Implement network policies |
-| Privileged pods | `securityContext.privileged: true` | Remove or justify |
-| No resource limits | Missing limits/requests | Set CPU and memory limits |
-| Host path mounts | `hostPath` volumes | Use PVCs instead |
-| Service account tokens | Auto-mounted when not needed | `automountServiceAccountToken: false` |
-
-## Database Configuration
-
-| Check | Red Flag | Fix |
-|-------|----------|-----|
-| Default port | PostgreSQL on 5432, MySQL on 3306 | Consider non-standard port (defense in depth) |
-| Public access | Listening on 0.0.0.0 | Bind to private interface |
-| Default credentials | Default admin password | Change immediately |
-| No encryption at rest | Unencrypted data files | Enable encryption |
-| No SSL connections | `sslmode=disable` | `sslmode=require` or `verify-full` |
-| Overly permissive roles | Application user has SUPERUSER | Grant only needed privileges |
-| No query logging | Audit logging disabled | Enable for security events |
-
-## Configuration Audit Checklist
-
-- [ ] No secrets in version control
-- [ ] Debug/development modes disabled in production
-- [ ] All communication encrypted (TLS 1.2+)
-- [ ] Security headers configured
-- [ ] Default credentials changed
-- [ ] Unnecessary services/ports disabled
-- [ ] Least-privilege access policies
-- [ ] Logging and monitoring enabled
-- [ ] Resource limits set (prevent DoS)
-- [ ] Backup encryption enabled