@cubis/foundry 0.3.83 → 0.3.84

package/workflows/skills/t3-stack/references/trpc-patterns.md

@@ -1,196 +0,0 @@
-# tRPC Patterns
-
-Load this when designing tRPC routers, procedures, middleware, error handling, or server-side callers in a T3 Stack application.
-
-## Router structure
-
-```typescript
-// src/server/api/root.ts
-import { createTRPCRouter } from "~/server/api/trpc";
-import { userRouter } from "./routers/user";
-import { postRouter } from "./routers/post";
-
-export const appRouter = createTRPCRouter({
-  user: userRouter,
-  post: postRouter,
-});
-
-export type AppRouter = typeof appRouter;
-```
-
-- One router per domain entity or bounded context.
-- The root router re-exports all sub-routers and exposes `AppRouter` as the single type import for the client.
-- Never define procedures directly on the root router.
-
-## Procedure types
-
-```typescript
-import { createTRPCRouter, publicProcedure, protectedProcedure } from "~/server/api/trpc";
-import { z } from "zod";
-
-export const postRouter = createTRPCRouter({
-  // Public: no auth required
-  getPublished: publicProcedure
-    .input(z.object({ cursor: z.string().optional(), limit: z.number().min(1).max(50).default(20) }))
-    .query(async ({ ctx, input }) => {
-      return ctx.db.post.findMany({
-        where: { published: true },
-        take: input.limit + 1,
-        cursor: input.cursor ? { id: input.cursor } : undefined,
-        orderBy: { createdAt: "desc" },
-      });
-    }),
-
-  // Protected: requires authenticated session
-  create: protectedProcedure
-    .input(z.object({ title: z.string().min(1).max(200), body: z.string().min(1) }))
-    .mutation(async ({ ctx, input }) => {
-      return ctx.db.post.create({
-        data: { ...input, authorId: ctx.session.user.id },
-      });
-    }),
-});
-```
-
-- Use `publicProcedure` for reads that do not require auth.
-- Use `protectedProcedure` for any operation that reads or writes user-specific data.
-- Always attach Zod schemas to `.input()` even for simple inputs.
-
-## Custom middleware
-
-```typescript
-// src/server/api/trpc.ts
-import { TRPCError, initTRPC } from "@trpc/server";
-
-const t = initTRPC.context<typeof createTRPCContext>().create({
-  transformer: superjson,
-  errorFormatter({ shape, error }) {
-    return { ...shape, data: { ...shape.data, zodError: error.cause instanceof ZodError ? error.cause.flatten() : null } };
-  },
-});
-
-// Auth middleware — enforces session presence
-const enforceUserIsAuthed = t.middleware(({ ctx, next }) => {
-  if (!ctx.session?.user) {
-    throw new TRPCError({ code: "UNAUTHORIZED" });
-  }
-  return next({ ctx: { session: { ...ctx.session, user: ctx.session.user } } });
-});
-
-// Role-based middleware — stacks on top of auth
-const enforceUserIsAdmin = t.middleware(({ ctx, next }) => {
-  if (ctx.session?.user?.role !== "ADMIN") {
-    throw new TRPCError({ code: "FORBIDDEN", message: "Admin access required." });
-  }
-  return next({ ctx });
-});
-
-export const publicProcedure = t.procedure;
-export const protectedProcedure = t.procedure.use(enforceUserIsAuthed);
-export const adminProcedure = t.procedure.use(enforceUserIsAuthed).use(enforceUserIsAdmin);
-```
-
-- Middleware chains execute in order. Auth must come before role checks.
-- Each middleware narrows the context type so downstream procedures have typed access.
-- Never duplicate auth checks inside procedure handlers when middleware already handles them.
-
-## Error handling
-
-```typescript
-import { TRPCError } from "@trpc/server";
-
-// Use structured error codes
-throw new TRPCError({ code: "NOT_FOUND", message: "Post not found." });
-throw new TRPCError({ code: "FORBIDDEN", message: "You do not own this resource." });
-throw new TRPCError({ code: "BAD_REQUEST", message: "Invalid input." });
-throw new TRPCError({ code: "INTERNAL_SERVER_ERROR", message: "Unexpected failure." });
-
-// Wrap external service errors
-try {
-  await stripeClient.charges.create(chargeData);
-} catch (err) {
-  throw new TRPCError({
-    code: "INTERNAL_SERVER_ERROR",
-    message: "Payment processing failed.",
-    cause: err,
-  });
-}
-```
-
-- Always use `TRPCError` instead of generic `throw new Error()`.
-- Map HTTP-like codes: `NOT_FOUND`, `UNAUTHORIZED`, `FORBIDDEN`, `BAD_REQUEST`, `INTERNAL_SERVER_ERROR`.
-- Attach the original error as `cause` for server-side debugging without leaking details to clients.
-
-## Server-side callers (React Server Components)
-
-```typescript
-// src/trpc/server.ts
-import { createCallerFactory } from "~/server/api/trpc";
-import { appRouter } from "~/server/api/root";
-import { createTRPCContext } from "~/server/api/trpc";
-import { headers } from "next/headers";
-import { cache } from "react";
-
-const createContext = cache(async () => {
-  const heads = new Headers(await headers());
-  heads.set("x-trpc-source", "rsc");
-  return createTRPCContext({ headers: heads });
-});
-
-const callerFactory = createCallerFactory(appRouter);
-export const api = callerFactory(createContext);
-```
-
-```typescript
-// app/dashboard/page.tsx (React Server Component)
-import { api } from "~/trpc/server";
-
-export default async function DashboardPage() {
-  const posts = await api.post.getPublished({ limit: 10 });
-  return <PostList posts={posts} />;
-}
-```
-
-- Server callers bypass the HTTP layer entirely — no network round-trip.
-- Use `cache()` from React to deduplicate context creation within a single render.
-- Never import the server caller in client components (`"use client"`).
-
-## Client-side usage with React Query
-
-```typescript
-// src/trpc/react.tsx
-"use client";
-import { createTRPCReact } from "@trpc/react-query";
-import type { AppRouter } from "~/server/api/root";
-
-export const api = createTRPCReact<AppRouter>();
-```
-
-```typescript
-// Client component
-"use client";
-import { api } from "~/trpc/react";
-
-export function CreatePostForm() {
-  const utils = api.useUtils();
-  const createPost = api.post.create.useMutation({
-    onSuccess: () => utils.post.getPublished.invalidate(),
-  });
-
-  return (
-    <form onSubmit={(e) => {
-      e.preventDefault();
-      const data = new FormData(e.currentTarget);
-      createPost.mutate({ title: data.get("title") as string, body: data.get("body") as string });
-    }}>
-      <input name="title" required />
-      <textarea name="body" required />
-      <button type="submit" disabled={createPost.isPending}>Create</button>
-    </form>
-  );
-}
-```
-
-- Import `api` from `~/trpc/react` (not `~/trpc/server`) in client components.
-- Invalidate related queries after mutations to keep the UI consistent.
-- Use `isPending` (not the deprecated `isLoading`) for mutation state.

package/workflows/skills/vibesec/SKILL.md

@@ -1,94 +0,0 @@
----
-name: vibesec
-description: "Perform a lightweight security vibe check on codebases, configurations, and dependencies. Quick assessment of common security pitfalls, dependency health, and configuration hygiene without a full audit."
-license: MIT
-metadata:
-  author: cubis-foundry
-  version: "3.0"
-compatibility: "Claude Code, Codex, GitHub Copilot"
----
-
-# VibeSec — Lightweight Security Vibe Check
-
-## Purpose
-
-Deliver a fast, opinionated security assessment that catches the most common and impactful issues in minutes rather than days. VibeSec is not a replacement for a full security audit; it is a triage pass that identifies the biggest risks so teams can prioritize deeper review where it matters most.
-
-## When to Use
-
-- Quick security sanity check before a release or PR merge
-- Onboarding onto an unfamiliar codebase and need a security first impression
-- Auditing dependency health and known vulnerabilities
-- Reviewing configuration files for security misconfigurations
-- Assessing whether a project needs a full security audit
-- Checking for hardcoded secrets, weak defaults, and missing security headers
-
-## Instructions
-
-1. **Scan for hardcoded secrets and credentials** — Search for API keys, passwords, tokens, and private keys in source code, config files, and environment templates because leaked secrets are the fastest path to a breach.
-
-2. **Check dependency health** — Run `npm audit`, `pip-audit`, `cargo audit`, or the ecosystem equivalent and review the output because vulnerable dependencies are the most common real-world attack vector.
-
-3. **Review dependency age and maintenance** — Flag dependencies that have not been updated in 12+ months or have known maintainer abandonment because unmaintained packages accumulate vulnerabilities silently.
-
-4. **Inspect environment and configuration files** — Check `.env`, `docker-compose.yml`, `nginx.conf`, cloud IAM policies, and similar files for overly permissive settings, debug modes left on, and default credentials because misconfigurations are exploitable without any code vulnerability.
-
-5. **Verify HTTPS and TLS configuration** — Confirm that all external communications use TLS, certificates are valid, and insecure protocol fallbacks are disabled because cleartext transport exposes all other security measures.
-
-6. **Check authentication defaults** — Verify that default passwords are changed, admin endpoints are protected, MFA is available, and session timeouts are reasonable because weak authentication defaults are low-effort, high-impact targets.
-
-7. **Look for common injection points** — Spot-check user input handling for SQL concatenation, unsanitized HTML rendering, command string building, and path concatenation because injection vulnerabilities have the highest exploitability.
-
-8. **Review CORS and CSP headers** — Check for `Access-Control-Allow-Origin: *`, missing Content-Security-Policy, and absent X-Frame-Options because permissive headers enable cross-origin attacks.
-
-9. **Assess logging and error exposure** — Verify that stack traces are not exposed to users, sensitive data is not logged, and security events are captured because information leaks aid attackers and missing logs delay incident response.
-
-10. **Check for exposed debug endpoints** — Search for `/debug`, `/actuator`, `/phpinfo`, `/__debug__`, GraphQL introspection, and similar endpoints because debug interfaces provide reconnaissance information and sometimes direct code execution.
-
-11. **Evaluate Docker and container security** — Check for containers running as root, unscanned base images, exposed ports, and secrets mounted as environment variables because container misconfigurations amplify application vulnerabilities.
-
-12. **Produce a vibe check summary with risk rating** — Assign an overall vibe (Green/Yellow/Orange/Red) and list the top 5 issues to fix first because a clear, prioritized summary drives immediate action.
-
-13. **Recommend whether a full audit is needed** — Based on findings, state whether the codebase needs a comprehensive security review, a targeted deep-dive on specific areas, or is reasonably healthy because this guides resource allocation decisions.
-
-## Output Format
-
-```
-## VibeSec Report
-
-### Overall Vibe: [GREEN / YELLOW / ORANGE / RED]
-
-### Quick Stats
-- Hardcoded secrets found: [count]
-- Vulnerable dependencies: [critical/high/medium/low]
-- Config issues: [count]
-- Missing security headers: [list]
-
-### Top 5 Issues (Fix These First)
-1. [Issue — why it matters — how to fix]
-2. ...
-
-### Secrets Scan
-[Results or clean bill]
-
-### Dependency Health
-[Vulnerability counts, outdated packages, unmaintained deps]
-
-### Configuration Review
-[Findings per config file]
-
-### Header & Transport Check
-[Missing headers, TLS issues]
-
-### Recommendation
-[Full audit needed? Targeted review? Ship it?]
-```
-
-## References
-
-| Topic | Reference | Load When |
-|-------|-----------|-----------|
-| Quick Security Checks | `references/quick-checks.md` | Running the initial scan pass |
-| Dependency Audit Guide | `references/dependency-audit.md` | Assessing dependency health |
-| Configuration Review | `references/config-review.md` | Inspecting config files |
-| Common Security Pitfalls | `references/common-pitfalls.md` | Identifying frequent mistakes |

package/workflows/skills/vibesec/evals/assertions.md

@@ -1,25 +0,0 @@
-# Eval Assertions — VibeSec
-
-## Eval 1: Quick Security Vibe Check
-
-**ID:** `vibesec-quick-assessment`
-
-| # | Assertion Type | Expected Value | Rationale |
-|---|---------------|----------------|-----------|
-| 1 | content_matches_regex | `RED\|ORANGE\|red\|orange` | Given committed secrets, wildcard CORS, root containers, and stack trace leaks, the vibe must be RED or ORANGE. |
-| 2 | content_matches_regex | `\\.env\|secret\|credential\|DATABASE_URL` | The committed .env file with database credentials is the most critical finding and must be flagged immediately. |
-| 3 | content_matches_regex | `CORS\|Access-Control\|origin.*\\*` | Wildcard CORS is a commonly exploited misconfiguration that enables cross-origin attacks. Must be identified. |
-| 4 | content_matches_regex | `stack trace\|error\|debug\|production` | Stack trace exposure in production leaks internal architecture details to attackers. Must be flagged. |
-| 5 | content_matches_regex | `root\|container\|Docker\|privilege` | Containers running as root amplify any container escape vulnerability. Must be identified. |
-
-## Eval 2: Dependency Health Audit
-
-**ID:** `vibesec-dependency-audit`
-
-| # | Assertion Type | Expected Value | Rationale |
-|---|---------------|----------------|-----------|
-| 1 | content_matches_regex | `Django.*3\\.2\|outdated\|end.of.life\|EOL\|upgrade\|update` | Django 3.2 is past end-of-life and must be flagged for upgrade, especially for a financial application. |
-| 2 | content_matches_regex | `Pillow\|CVE\|vulnerability\|vulnerab` | Pillow 8.0.0 has multiple known CVEs and must be identified as vulnerable. |
-| 3 | content_matches_regex | `PyYAML\|YAML\|deserializ\|unsafe` | PyYAML 5.3 has known unsafe deserialization vulnerabilities (CVE-2020-14343) that must be flagged. |
-| 4 | content_matches_regex | `pip.audit\|safety\|dependabot\|renovate\|scan` | Must recommend an automated dependency scanning tool for ongoing monitoring. |
-| 5 | content_matches_regex | `financial\|critical\|high.*risk\|sensitive\|priority` | The financial transaction context must elevate the risk assessment and urgency of remediation. |

package/workflows/skills/vibesec/evals/evals.json

@@ -1,68 +0,0 @@
-[
-  {
-    "id": "vibesec-quick-assessment",
-    "title": "Quick security vibe check on a Node.js project",
-    "description": "Given a project description with multiple security issues, the skill should identify the most critical problems and assign an overall vibe rating.",
-    "prompt": "Run a vibe check on this Node.js project:\n\n- package.json has 47 dependencies, last updated 14 months ago\n- .env file is committed to git with DATABASE_URL containing credentials\n- express app has no helmet middleware, no rate limiting\n- CORS is set to Access-Control-Allow-Origin: *\n- Error handler sends full stack traces in production\n- No Content-Security-Policy header\n- Using jsonwebtoken 8.5.1 (known vulnerability)\n- Docker container runs as root\n- No .gitignore entry for .env",
-    "assertions": [
-      {
-        "type": "content_matches_regex",
-        "value": "RED|ORANGE|red|orange",
-        "description": "Must assign a negative vibe rating (RED or ORANGE) given the severity of issues"
-      },
-      {
-        "type": "content_matches_regex",
-        "value": "\\.env|secret|credential|DATABASE_URL",
-        "description": "Must flag the committed .env file with credentials as a critical issue"
-      },
-      {
-        "type": "content_matches_regex",
-        "value": "CORS|Access-Control|origin.*\\*",
-        "description": "Must identify the wildcard CORS configuration as a security issue"
-      },
-      {
-        "type": "content_matches_regex",
-        "value": "stack trace|error|debug|production",
-        "description": "Must flag stack trace exposure in production"
-      },
-      {
-        "type": "content_matches_regex",
-        "value": "root|container|Docker|privilege",
-        "description": "Must flag the container running as root"
-      }
-    ]
-  },
-  {
-    "id": "vibesec-dependency-audit",
-    "title": "Dependency health audit for a Python project",
-    "description": "Given dependency information with vulnerabilities and outdated packages, the skill should assess dependency health and recommend actions.",
-    "prompt": "Assess the dependency health for our Python project:\n\n```\nrequirements.txt:\nDjango==3.2.0\nrequests==2.25.0\nPillow==8.0.0\ncryptography==3.3\nPyYAML==5.3\nparamiko==2.7.1\nurllib3==1.26.2\ncelery==5.0.0\n```\n\nWe're running Python 3.11 in production. The project handles financial transactions.",
-    "assertions": [
-      {
-        "type": "content_matches_regex",
-        "value": "Django.*3\\.2|outdated|end.of.life|EOL|upgrade|update",
-        "description": "Must flag Django 3.2 as outdated and recommend upgrading"
-      },
-      {
-        "type": "content_matches_regex",
-        "value": "Pillow|CVE|vulnerability|vulnerab",
-        "description": "Must identify known vulnerabilities in outdated Pillow version"
-      },
-      {
-        "type": "content_matches_regex",
-        "value": "PyYAML|YAML|deserializ|unsafe",
-        "description": "Must flag PyYAML 5.3 for known deserialization vulnerabilities"
-      },
-      {
-        "type": "content_matches_regex",
-        "value": "pip.audit|safety|dependabot|renovate|scan",
-        "description": "Must recommend a dependency scanning tool"
-      },
-      {
-        "type": "content_matches_regex",
-        "value": "financial|critical|high.*risk|sensitive|priority",
-        "description": "Must note that financial transaction context raises the risk severity"
-      }
-    ]
-  }
-]

package/workflows/skills/vibesec/examples/01-nodejs-quick-assessment.md

@@ -1,79 +0,0 @@
-# Example 1: Quick Security Vibe Check on a Next.js Project
-
-## User Prompt
-
-> Run a vibe check on our Next.js e-commerce project. Here is what I can tell you:
-> - Next.js 13.4, React 18, TypeScript
-> - Using NextAuth with Google and GitHub providers
-> - Prisma ORM with PostgreSQL
-> - Stripe for payments
-> - Docker Compose for local dev, Vercel for production
-> - Last dependency update was 5 months ago
-> - .env.local is gitignored but .env.example contains real API key patterns
-> - No CSP headers configured
-> - Images uploaded to S3 with public-read ACL
-
-## Expected Response
-
-### VibeSec Report
-
-### Overall Vibe: YELLOW
-
-This project has a reasonable foundation (typed language, ORM, managed auth) but has several configuration-level gaps that could be exploited. No showstoppers, but action needed before the next release.
-
-### Quick Stats
-
-- Hardcoded secrets found: 0 committed, 1 risky pattern (.env.example)
-- Vulnerable dependencies: Likely (5 months without updates)
-- Config issues: 3 (CSP, S3 ACL, .env.example)
-- Missing security headers: CSP, Permissions-Policy
-
-### Top 5 Issues (Fix These First)
-
-1. **Missing Content-Security-Policy header** — Without CSP, any XSS vulnerability can load arbitrary scripts, exfiltrate data, and hijack sessions. Add a strict CSP in `next.config.js` or middleware. This is the highest-leverage fix.
-
-2. **S3 public-read ACL on image uploads** — Public-read means anyone with the URL can access uploaded images. If users upload sensitive documents or if S3 keys are guessable, this is a data exposure risk. Switch to private ACL with signed URLs for access.
-
-3. **Stale dependencies (5 months)** — Run `npm audit` immediately. Next.js, Prisma, and NextAuth have all had security patches in the last 5 months. Especially check for Next.js server-action vulnerabilities.
-
-4. **.env.example with real API key patterns** — If `.env.example` contains keys that look like real keys (even expired ones), contributors may accidentally commit real keys thinking it is safe. Use clearly fake placeholder values like `sk_test_REPLACE_ME`.
-
-5. **No Permissions-Policy header** — Without this header, embedded content can access camera, microphone, geolocation, and payment APIs. Add `Permissions-Policy: camera=(), microphone=(), geolocation=()` at minimum.
-
-### Secrets Scan
-
-- `.env.local` — properly gitignored
-- `.env.example` — contains patterns resembling real API keys. Replace with obvious placeholders
-- Source code — no hardcoded secrets detected in a surface scan
-- **Recommendation:** Add `gitleaks` as a pre-commit hook
-
-### Dependency Health
-
-- **Last updated:** 5 months ago — likely has known vulnerabilities
-- **Action:** Run `npm audit --production` and address critical/high findings
-- **Ongoing:** Enable Dependabot or Renovate for automated dependency PRs
-
-### Configuration Review
-
-| Config | Status | Issue |
-|--------|--------|-------|
-| NextAuth | OK | Standard OAuth providers, verify callback URLs are restricted |
-| Prisma | OK | ORM prevents SQL injection by default |
-| Docker Compose | Check | Verify no ports exposed beyond localhost |
-| Vercel | Check | Verify environment variables are set as secrets, not plaintext |
-| S3 | Issue | Public-read ACL on uploads |
-
-### Header & Transport Check
-
-| Header | Status |
-|--------|--------|
-| HTTPS | OK (Vercel enforces) |
-| HSTS | OK (Vercel default) |
-| CSP | Missing |
-| X-Frame-Options | Check — may need explicit config |
-| Permissions-Policy | Missing |
-| X-Content-Type-Options | Check |
-
-### Recommendation
-
-**No full audit needed yet**, but address the top 5 issues before the next release. Schedule a focused review of the S3 upload flow and NextAuth callback configuration. Set up automated dependency updates.

package/workflows/skills/vibesec/examples/02-dependency-health-audit.md

@@ -1,96 +0,0 @@
-# Example 2: Dependency Health Audit for a Django Project
-
-## User Prompt
-
-> Audit the dependency health of our Django REST API project that handles healthcare data:
->
-> ```
-> Django==3.2.18
-> djangorestframework==3.14.0
-> celery==5.2.7
-> redis==4.5.1
-> Pillow==9.4.0
-> cryptography==39.0.0
-> boto3==1.26.0
-> psycopg2-binary==2.9.5
-> gunicorn==20.1.0
-> requests==2.28.1
-> PyJWT==2.6.0
-> django-cors-headers==3.13.0
-> ```
->
-> We process HIPAA-regulated patient data.
-
-## Expected Response
-
-### VibeSec Dependency Audit
-
-### Overall Vibe: ORANGE
-
-Multiple outdated packages with known CVEs in a HIPAA-regulated healthcare context. The regulatory environment and data sensitivity elevate every finding by at least one severity level. Immediate action required.
-
-### Dependency Health Summary
-
-| Package | Installed | Latest Stable | Status | Risk |
-|---------|-----------|---------------|--------|------|
-| Django | 3.2.18 | 5.1.x | End-of-life (April 2024) | Critical |
-| djangorestframework | 3.14.0 | 3.15.x | Minor update available | Low |
-| celery | 5.2.7 | 5.4.x | Outdated, security fixes in 5.3+ | Medium |
-| redis | 4.5.1 | 5.2.x | Major version behind | Medium |
-| Pillow | 9.4.0 | 11.x | Multiple CVEs (buffer overflow, DoS) | High |
-| cryptography | 39.0.0 | 44.x | Multiple CVEs, OpenSSL updates | Critical |
-| boto3 | 1.26.0 | 1.35.x | Very outdated, missing security patches | Medium |
-| psycopg2-binary | 2.9.5 | 2.9.9 | Minor update | Low |
-| gunicorn | 20.1.0 | 22.x | HTTP request smuggling fix in 21.x | High |
-| requests | 2.28.1 | 2.32.x | CVE-2023-32681 (proxy auth leak) | High |
-| PyJWT | 2.6.0 | 2.9.x | Algorithm confusion fix in 2.8+ | Medium |
-| django-cors-headers | 3.13.0 | 4.6.x | Feature updates, no critical CVEs | Low |
-
-### Critical Findings
-
-**1. Django 3.2 — End of Life (CRITICAL)**
-Django 3.2 LTS reached end-of-life in April 2024 and no longer receives security patches. In a HIPAA context, running unsupported software is a compliance violation.
-- **Action:** Upgrade to Django 5.0+ or at minimum Django 4.2 LTS
-- **Effort:** Medium-high (breaking changes in URL routing, middleware, and form rendering)
-
-**2. cryptography 39.0.0 — Multiple CVEs (CRITICAL)**
-This version is affected by CVEs in the underlying OpenSSL and Rust bindings. The `cryptography` package is foundational — everything depending on it (TLS, token signing, encryption) is affected.
-- **Action:** Upgrade to cryptography >= 43.0
-- **Effort:** Low (usually backwards-compatible)
-
-**3. Pillow 9.4.0 — Buffer Overflow CVEs (HIGH)**
-Multiple CVEs including buffer overflow and denial-of-service in image parsing. If the application processes user-uploaded images, this is exploitable.
-- **Action:** Upgrade to Pillow >= 10.3
-- **Effort:** Low-medium (some deprecated function removals)
-
-**4. gunicorn 20.1.0 — HTTP Request Smuggling (HIGH)**
-CVE-2024-1135 (HTTP request smuggling) affects versions before 22.0. Request smuggling can bypass authentication and authorization controls.
-- **Action:** Upgrade to gunicorn >= 22.0
-- **Effort:** Low
-
-**5. requests 2.28.1 — Proxy Auth Credential Leak (HIGH)**
-CVE-2023-32681 allows proxy authentication credentials to leak to the destination server.
-- **Action:** Upgrade to requests >= 2.31.0
-- **Effort:** Low
-
-### HIPAA Compliance Impact
-
-Running end-of-life software and packages with known vulnerabilities violates the HIPAA Security Rule requirements for:
-- **164.308(a)(5)(ii)(B):** Protection from malicious software
-- **164.312(e)(2)(ii):** Encryption mechanism integrity
-- **164.306(a)(1):** Ensure confidentiality of ePHI
-
-A breach traceable to a known, unpatched CVE would significantly increase regulatory penalties.
-
-### Recommended Actions
-
-1. **Immediate:** Upgrade `cryptography`, `requests`, `gunicorn`, `Pillow` (low effort, high impact)
-2. **This sprint:** Plan Django 4.2 LTS migration path
-3. **Ongoing:** Enable `pip-audit` in CI, configure Dependabot for automated PRs
-4. **Audit:** Run `pip-audit --strict` and address all findings before next deployment
-
-```bash
-# Quick fix for low-effort upgrades
-pip install --upgrade cryptography requests gunicorn Pillow PyJWT
-pip-audit --strict
-```