@getarbiter/cli 0.5.0

package/dist/templates/scripts/verify-spotbugs.mjs.ejs

@@ -0,0 +1,216 @@
+#!/usr/bin/env node
+// <%= projectName %> — SpotBugs baseline manager
+// Generated by arbiter. Re-generate: arbiter update
+// Usage:
+//   node scripts/verify-spotbugs.mjs               # check against baseline
+//   node scripts/verify-spotbugs.mjs --update-baseline  # update baseline with non-security findings
+//   node scripts/verify-spotbugs.mjs --report-only      # print findings without failing
+//
+// Security-category bugs are NEVER baselined (INV-44):
+//   SQL_INJECTION, SQL_INJECTION_SPRING_JDBC, XSS_REQUEST_WRAPPER, XSS_SERVLET,
+//   COMMAND_INJECTION, XXE_DOCUMENT, XXE_XMLREADER, LDAP_INJECTION, HARD_CODE_PASSWORD
+
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { parseArgs } from "node:util";
+
+const SECURITY_HARD_BLOCK = new Set([
+  "SQL_INJECTION",
+  "SQL_INJECTION_SPRING_JDBC",
+  "XSS_REQUEST_WRAPPER",
+  "XSS_SERVLET",
+  "COMMAND_INJECTION",
+  "XXE_DOCUMENT",
+  "XXE_XMLREADER",
+  "LDAP_INJECTION",
+  "HARD_CODE_PASSWORD",
+]);
+
+const SPOTBUGS_XML = join("build", "reports", "spotbugs", "main.xml");
+const BASELINE_JSON = join("spotbugs-baseline.json");
+
+const { values: flags } = parseArgs({
+  options: {
+    "update-baseline": { type: "boolean", default: false },
+    "report-only": { type: "boolean", default: false },
+  },
+});
+
+const updateBaseline = flags["update-baseline"];
+const reportOnly = flags["report-only"];
+
+// ─── Parse SpotBugs XML ──────────────────────────────────────────────────────
+
+if (!existsSync(SPOTBUGS_XML)) {
+  console.error(`[spotbugs] XML report not found: ${SPOTBUGS_XML}`);
+  console.error("[spotbugs] Run SpotBugs first: ./gradlew spotbugsMain");
+  process.exit(1);
+}
+
+const xml = readFileSync(SPOTBUGS_XML, "utf-8");
+
+// Extract BugType:ClassName pairs via matchAll (no shell — pure string parsing)
+const bugInstancePattern =
+  /<BugInstance[^>]+type="([^"]+)"[^>]*>[\s\S]*?<Class[^>]+classname="([^"]+)"/g;
+
+/** @type {{ bugType: string; className: string }[]} */
+const findings = [...xml.matchAll(bugInstancePattern)].map((m) => ({
+  bugType: m[1],
+  className: m[2],
+}));
+
+// ─── Load Baseline ───────────────────────────────────────────────────────────
+
+/** @type {{ baselined: string[]; policy: string; maxSuppressions?: number }} */
+let baseline = {
+  baselined: [],
+  policy: "security-category bugs are never baselined",
+};
+if (existsSync(BASELINE_JSON)) {
+  try {
+    baseline = JSON.parse(readFileSync(BASELINE_JSON, "utf-8"));
+  } catch {
+    console.error(
+      "[spotbugs] Failed to parse spotbugs-baseline.json — using empty baseline",
+    );
+  }
+}
+
+const baselinedSet = new Set(baseline.baselined);
+
+// ─── Suppression-growth ratchet (INV-44, #1510) ──────────────────────────────
+// A suppressed finding never appears in the report, so the finding-baseline above
+// cannot see it — quality can silently backslide by ADDING <Match> entries to the
+// exclude filter. Ratchet the suppression COUNT: it may only grow with an explicit
+// baseline bump (the justification lives in the reviewed commit), never silently.
+const EXCLUDE_FILTER = join("config", "spotbugs-exclude.xml");
+
+/** Pure: count <Match> suppression entries in a SpotBugs exclude-filter XML. */
+export function countSuppressionMatches(xml) {
+  if (typeof xml !== "string") return 0;
+  return (xml.match(/<Match\b/g) || []).length;
+}
+
+const currentSuppressions = existsSync(EXCLUDE_FILTER)
+  ? countSuppressionMatches(readFileSync(EXCLUDE_FILTER, "utf-8"))
+  : 0;
+const baselineMaxSuppressions =
+  typeof baseline.maxSuppressions === "number" ? baseline.maxSuppressions : null;
+
+// ─── Classify Findings ───────────────────────────────────────────────────────
+
+/** @type {string[]} */
+const securityFindings = [];
+/** @type {string[]} */
+const newNonSecurity = [];
+/** @type {string[]} */
+const baselinedFindings = [];
+/** @type {string[]} */
+const resolvedFindings = [];
+
+const currentKeys = new Set();
+for (const f of findings) {
+  const key = `${f.bugType}:${f.className}`;
+  currentKeys.add(key);
+  if (SECURITY_HARD_BLOCK.has(f.bugType)) {
+    securityFindings.push(key);
+  } else if (baselinedSet.has(key)) {
+    baselinedFindings.push(key);
+  } else {
+    newNonSecurity.push(key);
+  }
+}
+
+for (const key of baselinedSet) {
+  if (!currentKeys.has(key)) {
+    resolvedFindings.push(key);
+  }
+}
+
+// ─── Report ──────────────────────────────────────────────────────────────────
+
+if (resolvedFindings.length > 0) {
+  console.log("[spotbugs] Resolved findings (no longer present):");
+  for (const k of resolvedFindings) console.log(`  ✓ ${k}`);
+}
+
+if (baselinedFindings.length > 0) {
+  console.log("[spotbugs] Baselined findings (known, tracked):");
+  for (const k of baselinedFindings) console.log(`  ~ ${k}`);
+}
+
+if (securityFindings.length > 0) {
+  console.error("[spotbugs] SECURITY FINDINGS — never baselined (INV-44):");
+  for (const k of securityFindings) console.error(`  ✗ ${k}`);
+}
+
+if (newNonSecurity.length > 0) {
+  console.log("[spotbugs] New non-security findings:");
+  for (const k of newNonSecurity) console.log(`  ! ${k}`);
+}
+
+// ─── Update Baseline ─────────────────────────────────────────────────────────
+
+if (updateBaseline) {
+  if (securityFindings.length > 0) {
+    console.error(
+      "[spotbugs] Cannot update baseline: security-category findings present. Fix them first.",
+    );
+    process.exit(1);
+  }
+  const newBaseline = {
+    baselined: Array.from(new Set([...baselinedSet, ...newNonSecurity])).sort(),
+    policy: baseline.policy,
+    // #1510: record the accepted suppression count so future growth is gated.
+    maxSuppressions: currentSuppressions,
+  };
+  writeFileSync(BASELINE_JSON, JSON.stringify(newBaseline, null, 2) + "\n");
+  console.log(
+    `[spotbugs] Baseline updated: ${newBaseline.baselined.length} entries, ${currentSuppressions} suppression(s)`,
+  );
+  process.exit(0);
+}
+
+// ─── Verdict ─────────────────────────────────────────────────────────────────
+
+if (reportOnly) {
+  console.log(
+    `[spotbugs] Report-only mode. Total findings: ${findings.length}`,
+  );
+  process.exit(0);
+}
+
+if (securityFindings.length > 0) {
+  console.error(
+    `[spotbugs] Gate FAILED: ${securityFindings.length} security-category finding(s) — never baselineable.`,
+  );
+  process.exit(1);
+}
+
+if (newNonSecurity.length > 0) {
+  console.error(
+    `[spotbugs] Gate FAILED: ${newNonSecurity.length} new non-security finding(s). ` +
+      "Run with --update-baseline to add to baseline after review.",
+  );
+  process.exit(1);
+}
+
+// #1510: suppression-growth ratchet. First run (no recorded max) seeds the count and
+// passes; afterwards an unjustified new <Match> in config/spotbugs-exclude.xml is red.
+if (baselineMaxSuppressions === null) {
+  const seeded = { ...baseline, maxSuppressions: currentSuppressions };
+  writeFileSync(BASELINE_JSON, JSON.stringify(seeded, null, 2) + "\n");
+  console.log(
+    `[spotbugs] Seeded suppression baseline: ${currentSuppressions} <Match> entry(ies).`,
+  );
+} else if (currentSuppressions > baselineMaxSuppressions) {
+  console.error(
+    `[spotbugs] Gate FAILED: suppression count grew ${baselineMaxSuppressions} → ${currentSuppressions} ` +
+      "in config/spotbugs-exclude.xml. A new suppression hides a finding — fix the root cause, " +
+      "or run --update-baseline to accept it (the justification lives in the reviewed commit).",
+  );
+  process.exit(1);
+}
+
+console.log("[spotbugs] Gate PASSED.");
+process.exit(0);

package/dist/templates/scripts/verify-tokens.mjs.ejs

@@ -0,0 +1,177 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// CATALOG: INV-105 enforcement — design token discipline gate (#1127).
+// Checks:
+//   A) No raw hex/rgb colors in component source files
+//   B) No phantom token references (token name not in design-tokens.json)
+//   C) No direct foundation/primitive token refs in component files
+// Exit 1 if any violation found (HARD gate — L2+).
+// Framework-aware: scans appropriate file extensions per detected framework.
+
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs'
+import { extname, join, relative } from 'node:path'
+<%
+const _fw = (typeof frontend !== 'undefined' && frontend && frontend.framework)
+  ? frontend.framework : 'react'
+const _exts = _fw === 'vue'
+  ? ['.ts', '.vue', '.css', '.scss']
+  : _fw === 'svelte'
+  ? ['.ts', '.svelte', '.css', '.scss']
+  : ['.ts', '.tsx', '.jsx', '.css', '.scss']
+const _extList = JSON.stringify(_exts)
+%>
+const ROOT = process.cwd()
+const SRC = join(ROOT, 'src')
+const TOKENS_FILE = join(ROOT, 'design-tokens.json')
+const SOURCE_EXTS = new Set(<%- _extList %>)
+
+// Raw color patterns that should never appear in component files
+const RAW_HEX_PATTERN = /#[0-9a-fA-F]{3,8}\b/g
+const RAW_RGB_PATTERN = /\brgba?\s*\(/g
+const RAW_HSL_PATTERN = /\bhsla?\s*\(/g
+
+// Foundation/primitive token prefix that should NOT be used in components
+const FOUNDATION_PREFIX_PATTERN = /var\(--f-[a-z]/
+
+let violations = 0
+
+// Build a set of valid semantic token CSS var names from design-tokens.json
+function buildTokenVarNames(tokens, prefix = '--') {
+  const names = new Set()
+  for (const [key, value] of Object.entries(tokens)) {
+    if (key.startsWith('$')) continue
+    const cssVarName = `${prefix}${key}`
+    if (typeof value === 'object' && value !== null && !('$value' in value)) {
+      // Nested group — recurse
+      for (const name of buildTokenVarNames(value, `${cssVarName}-`)) {
+        names.add(name)
+      }
+    } else if ('$value' in value) {
+      names.add(cssVarName)
+    }
+  }
+  return names
+}
+
+let validTokenNames = new Set()
+let tokensLoaded = false
+if (existsSync(TOKENS_FILE)) {
+  // Parse failure is fatal — phantom token check cannot run on a corrupt token file.
+  // Silently continuing would produce false-negatives (INV-105 passes with no phantom detection).
+  try {
+    const tokens = JSON.parse(readFileSync(TOKENS_FILE, 'utf-8'))
+    validTokenNames = buildTokenVarNames(tokens)
+    tokensLoaded = true
+  } catch (err) {
+    process.stderr.write(
+      `[INV-105] FATAL: failed to parse design-tokens.json: ${err.message}\n` +
+        `  Phantom token check cannot run. Fix design-tokens.json or delete it to skip.\n`,
+    )
+    process.exit(1)
+  }
+} else {
+  process.stderr.write(
+    '[INV-105] WARNING: design-tokens.json not found — phantom token check skipped\n',
+  )
+}
+
+function checkFile(absPath) {
+  const rel = relative(ROOT, absPath)
+  let content
+  try {
+    content = readFileSync(absPath, 'utf-8')
+  } catch {
+    return
+  }
+
+  const lines = content.split('\n')
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i]
+    const lineNum = i + 1
+
+    // A) Raw hex colors
+    const hexMatches = line.match(RAW_HEX_PATTERN) ?? []
+    // Allow hex in comments, string literals in test files, and token definitions
+    const isTokenDef = /"\$value"\s*:/.test(line) || /'\$value'\s*:/.test(line)
+    const isComment = /^\s*(\/\/|\/\*|\*|<!--)/.test(line)
+    if (!isTokenDef && !isComment && hexMatches.length > 0) {
+      for (const hex of hexMatches) {
+        process.stderr.write(
+          `[INV-105] ${rel}:${lineNum}: raw hex color ${hex} — use a semantic token instead\n`,
+        )
+        violations++
+      }
+    }
+
+    // B) Raw rgb/hsl functions (excluding CSS custom property definitions)
+    if (!isTokenDef && !isComment && (RAW_RGB_PATTERN.test(line) || RAW_HSL_PATTERN.test(line))) {
+      process.stderr.write(
+        `[INV-105] ${rel}:${lineNum}: raw color function — use a semantic token instead\n`,
+      )
+      violations++
+    }
+    RAW_RGB_PATTERN.lastIndex = 0
+    RAW_HSL_PATTERN.lastIndex = 0
+
+    // C) Foundation/primitive token refs
+    if (FOUNDATION_PREFIX_PATTERN.test(line) && !isComment) {
+      process.stderr.write(
+        `[INV-105] ${rel}:${lineNum}: foundation token (--f-*) used in component — use semantic token instead\n`,
+      )
+      violations++
+    }
+  }
+
+  // B) Phantom token detection (var(--something) not in design-tokens.json)
+  if (tokensLoaded && (absPath.endsWith('.css') || absPath.endsWith('.scss'))) {
+    const cssVarRefs = [...content.matchAll(/var\((--[a-z][a-z0-9-]*)\)/g)].map((m) => m[1])
+    for (const varName of cssVarRefs) {
+      if (!validTokenNames.has(varName) && !varName.startsWith('--f-')) {
+        // Phantom: referenced but not defined in token file
+        process.stderr.write(
+          `[INV-105] ${rel}: phantom token reference: ${varName} not in design-tokens.json\n`,
+        )
+        violations++
+      }
+    }
+  }
+}
+
+function walkSrc(dir) {
+  if (!existsSync(dir)) return
+  let entries
+  try {
+    entries = readdirSync(dir)
+  } catch {
+    return
+  }
+  for (const entry of entries) {
+    const full = join(dir, entry)
+    let st
+    try {
+      st = statSync(full)
+    } catch {
+      continue
+    }
+    if (st.isDirectory()) {
+      if (entry === 'node_modules' || entry === '.git' || entry === '__tests__') continue
+      walkSrc(full)
+    } else if (st.isFile() && SOURCE_EXTS.has(extname(entry))) {
+      checkFile(full)
+    }
+  }
+}
+
+walkSrc(SRC)
+
+if (violations > 0) {
+  process.stderr.write(
+    `\n[verify-tokens] ${violations} violation(s) found.\n` +
+      `  INV-105: Use semantic tokens from design-tokens.json, not raw colors.\n` +
+      `  See docs/GOVERNANCE/FE_DESIGN_PRINCIPLES.md P1.\n`,
+  )
+  process.exit(1)
+}
+
+process.stdout.write('[verify-tokens] design token discipline OK (INV-105)\n')

package/dist/templates/security/RISK_ASSESSMENT.md.ejs

@@ -0,0 +1,35 @@
+# Risk Assessment
+
+> ISO 27001:2022 §6.1.2 — Information security risk assessment
+
+_Generated by arbiter at L3 governance level. Review and update annually or after significant architecture changes._
+
+## Probability × Impact Matrix (P×I)
+
+| Probability \ Impact | Low (1) | Medium (2) | High (3) | Critical (4) |
+|----------------------|---------|-----------|---------|-------------|
+| **Unlikely (1)**     | 1       | 2         | 3       | 4           |
+| **Possible (2)**     | 2       | 4         | 6       | 8           |
+| **Likely (3)**       | 3       | 6         | 9       | 12          |
+| **Almost Certain (4)**| 4      | 8         | 12      | 16          |
+
+### Risk Thresholds
+
+| Score | Tier       | Action Required                                  |
+|-------|------------|--------------------------------------------------|
+| ≤ 4   | Low        | Monitor; no immediate action required            |
+| 5–8   | Medium     | Mitigate within 90 days; document in backlog     |
+| 9–12  | High       | Mitigate within 30 days; notify security team    |
+| > 12  | Critical   | Immediate mitigation; escalate to management     |
+
+## Risk Register
+
+| ID   | Threat          | Asset             | P | I | Score | Tier | Mitigation             | Owner | Due Date |
+|------|-----------------|-------------------|---|---|-------|------|------------------------|-------|----------|
+| R-001| _Example threat_| _Affected asset_  | 2 | 3 | 6     | Medium | _Describe mitigation_ | TBD   | TBD      |
+
+## Review History
+
+| Date | Reviewer | Changes |
+|------|----------|---------|
+| _YYYY-MM-DD_ | _Name_ | Initial assessment |

package/dist/templates/security/STRIDE.md.ejs

@@ -0,0 +1,24 @@
+# STRIDE Threat Model — <%= projectName %>
+
+<!-- arbiter-managed: claim-verified-governance (INV-90) -->
+<!-- HIGH and CRITICAL threats require a @Security:<id>-tagged test. -->
+<!-- Run: node scripts/check-stride-traceability.mjs to verify. -->
+
+## Threat Register
+
+| ID | Threat | Category | Severity | Mitigation | Status |
+|----|--------|----------|----------|------------|--------|
+
+<!--
+## How to use this table
+
+1. Add a row for each identified threat.
+2. Set Severity: CRITICAL, HIGH, MEDIUM, or LOW.
+3. For HIGH and CRITICAL threats, annotate the verifying test with:
+       // @Security:<id>
+   where <id> matches the ID column (e.g., // @Security:S001).
+4. Run: node scripts/check-stride-traceability.mjs
+
+Categories: S=Spoofing, T=Tampering, R=Repudiation, I=Information Disclosure, D=Denial of Service, E=Elevation of Privilege
+Status: OPEN | MITIGATED | ACCEPTED
+-->

package/dist/templates/security/gitleaks.toml.ejs

@@ -0,0 +1,21 @@
+# <%- projectName %> — Gitleaks configuration
+# Generated by arbiter. Managed file — do not delete.
+# Docs: https://github.com/gitleaks/gitleaks
+
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Project-level allowlist (see suppressions/.gitleaksignore)"
+paths = [
+  '''suppressions/\.gitleaksignore''',
+  '''\.gitleaks\.toml''',
+  # Arbiter render-hash baseline (fleet provenance — committed by design). Its
+  # path->sha256 entries are content hashes, not secrets; allowlist the path so
+  # gitleaks' generic-api-key rule does not flag them and block the push.
+  '''\.arbiter-generated-manifest\.json''',
+]
+
+# Paths that gitleaks scans are controlled via .gitleaksignore
+# Individual fingerprint suppressions go in suppressions/.gitleaksignore
+# (managed by arbiter suppression system with expiry enforcement)

package/dist/templates/security/zap/baseline-auth.context.ejs

@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<!-- ZAP baseline authentication context — <%= projectName %> -->
+<!-- Generated by arbiter (#898). Customise loginUrl and credentials for your stack. -->
+<!-- Reference: https://www.zaproxy.org/docs/desktop/addons/authentication/ -->
+<Context>
+  <name><%= projectName %>-baseline-auth</name>
+  <desc>Authenticated baseline DAST context for <%= projectName %></desc>
+  <inscope>true</inscope>
+  <incregexes>http://localhost:8080.*</incregexes>
+
+  <authentication>
+    <!-- type 2 = Form-based authentication -->
+    <type>2</type>
+    <strategy>
+      <!-- Login URL: replace with your application's login endpoint -->
+      <loginUrl>http://localhost:8080/login</loginUrl>
+      <!-- Login request POST body: replace field names to match your form -->
+      <loginRequestData>username={%username%}&amp;password={%password%}</loginRequestData>
+      <!-- Regex that matches on the response when authentication FAILS -->
+      <loggedOutIndicatorPattern>(?i)sign.?in|log.?in|authentication.?required|unauthorized</loggedOutIndicatorPattern>
+      <!-- Regex that matches on the response when authentication SUCCEEDS -->
+      <loggedInIndicatorPattern>(?i)dashboard|welcome|logout|sign.?out</loggedInIndicatorPattern>
+    </strategy>
+  </authentication>
+
+  <sessionManagement>
+    <!-- type 0 = Cookie-based session management (most web apps) -->
+    <type>0</type>
+  </sessionManagement>
+
+  <users>
+    <user>
+      <id>1</id>
+      <name>zap-test-user</name>
+      <!-- Credentials: replace with a non-privileged test account -->
+      <credentials>
+        <username>zap_test_user</username>
+        <password>REPLACE_WITH_TEST_PASSWORD</password>
+      </credentials>
+      <enabled>true</enabled>
+    </user>
+  </users>
+
+  <forcedUser>1</forcedUser>
+
+  <technology>
+    <!-- Include/exclude technologies as relevant to your stack -->
+    <include>Db.MySQL</include>
+    <include>Db.PostgreSQL</include>
+    <include>Language.Java</include>
+    <include>Language.JavaScript</include>
+    <include>Language.Python</include>
+    <include>OS.Linux</include>
+    <include>WS.Apache</include>
+    <include>WS.Nginx</include>
+    <include>WS.Tomcat</include>
+  </technology>
+</Context>

package/dist/templates/security/zap/rules.tsv.ejs

@@ -0,0 +1,100 @@
+# ZAP passive/active scan rule overrides — <%= projectName %>
+# Generated by arbiter (#898). Commit to version control.
+# Format: id<TAB>action<TAB>threshold<TAB>description
+# action: IGNORE | WARN | FAIL
+# threshold: LOW | MEDIUM | HIGH (applies when action=WARN or FAIL)
+# id	action	threshold	description
+# Reference: https://www.zaproxy.org/docs/desktop/addons/alert-filters/
+10010	WARN	LOW	Secure pages include mixed content
+10011	WARN	LOW	Cookie Without Secure Flag
+10015	WARN	LOW	Incomplete or No Cache-control Header Set
+10016	WARN	LOW	Web Browser XSS Protection Not Enabled
+10017	WARN	LOW	Cross-Domain JavaScript Source File Inclusion
+10019	WARN	LOW	Content-Type Header Missing
+10020	WARN	MEDIUM	X-Frame-Options Header Not Set
+10021	WARN	LOW	X-Content-Type-Options Header Missing
+10023	WARN	LOW	Information Disclosure - Debug Error Messages
+10024	WARN	LOW	Information Disclosure - Sensitive Information in URL
+10025	WARN	LOW	Information Disclosure - Sensitive Information in HTTP Referrer Header
+10027	WARN	LOW	Information Disclosure - Suspicious Comments
+10028	WARN	MEDIUM	Open Redirect
+10029	WARN	MEDIUM	Cookie Poisoning
+10030	WARN	LOW	User Controllable Charset
+10031	WARN	LOW	User Controllable HTML Element Attribute (Potential XSS)
+10032	WARN	MEDIUM	Viewstate
+10036	WARN	HIGH	HTTP Server Response Header
+10037	WARN	LOW	Server Leaks Information via "X-Powered-By" HTTP Response Header
+10038	WARN	MEDIUM	Content Security Policy (CSP) Header Not Set
+10040	WARN	MEDIUM	Secure Pages Include Mixed Content (Including Scripts)
+10041	WARN	MEDIUM	HTTP to HTTPS Insecure Transition in Form Post
+10042	WARN	MEDIUM	HTTPS to HTTP Insecure Transition in Form Post
+10043	WARN	LOW	User Controllable JavaScript Event (XSS)
+10044	WARN	LOW	Big Redirect Detected (Potential Sensitive Information Leak)
+10045	WARN	MEDIUM	Source Code Disclosure - /WEB-INF folder
+10049	WARN	HIGH	Caching Suppressed Content
+10050	WARN	MEDIUM	Retrieved from Cache
+10052	WARN	MEDIUM	X-ChromeLogger-Data (XCOLD) Header Information Leak
+10054	WARN	MEDIUM	Cookie without SameSite Attribute
+10055	WARN	LOW	CSP
+10056	WARN	MEDIUM	X-Debug-Token Information Leak
+10057	WARN	HIGH	Username Hash Found
+10058	WARN	MEDIUM	GET for POST
+10061	WARN	MEDIUM	X-AspNet-Version Response Header
+10062	WARN	MEDIUM	PII Disclosure
+10063	WARN	HIGH	Permissions Policy Header Not Set
+10096	WARN	MEDIUM	Timestamp Disclosure
+10097	WARN	MEDIUM	Hash Disclosure
+10098	WARN	MEDIUM	Cross-Domain Misconfiguration
+10099	WARN	LOW	Source Code Disclosure
+10108	WARN	MEDIUM	Reverse Tabnabbing
+10109	WARN	LOW	Modern Web Application
+10110	WARN	LOW	Dangerous JS Functions
+10202	FAIL	HIGH	Absence of Anti-CSRF Tokens
+10208	WARN	MEDIUM	Private IP Disclosure
+10243	WARN	MEDIUM	Transition Redirect
+10244	FAIL	HIGH	Server Leaks Sensitive Information via HTTP Headers
+10246	WARN	MEDIUM	Authentication Credentials Captured
+10247	WARN	MEDIUM	HTTPS Content Available via HTTP
+10311	WARN	MEDIUM	Monitoring Service Found
+40003	FAIL	HIGH	CRLF Injection
+40008	FAIL	HIGH	Parameter Tampering
+40009	FAIL	HIGH	Server Side Include
+40012	FAIL	HIGH	Cross Site Scripting (Reflected)
+40013	FAIL	HIGH	Session Fixation
+40014	FAIL	HIGH	Cross Site Scripting (Persistent)
+40016	FAIL	HIGH	Cross Site Scripting (Persistent) - Prime
+40017	FAIL	HIGH	Cross Site Scripting (Persistent) - Spider
+40018	FAIL	HIGH	SQL Injection
+40019	FAIL	HIGH	SQL Injection - MySQL
+40020	FAIL	HIGH	SQL Injection - Hypersonic SQL
+40021	FAIL	HIGH	SQL Injection - Oracle
+40022	FAIL	HIGH	SQL Injection - PostgreSQL
+40023	FAIL	HIGH	Possible Username Enumeration
+40024	FAIL	HIGH	SQL Injection - SQLite
+40025	FAIL	HIGH	Proxy Disclosure
+40026	FAIL	HIGH	Cross Site Scripting (DOM Based)
+40027	FAIL	HIGH	SQL Injection - MsSQL
+40028	FAIL	HIGH	CSRF
+40029	FAIL	HIGH	Trace.axd Information Leak
+40032	FAIL	HIGH	.htaccess Information Leak
+40034	FAIL	HIGH	.env Information Leak
+40035	FAIL	HIGH	Hidden File Finder
+40036	FAIL	HIGH	HTML Injection
+40038	FAIL	HIGH	ReDoS (Regular Expression Denial of Service)
+40039	FAIL	HIGH	Unprotected API
+40042	FAIL	HIGH	Spring Actuator Information Leak
+40043	FAIL	HIGH	Log4Shell
+40044	FAIL	HIGH	Spring4Shell
+40045	FAIL	HIGH	Server Side Template Injection
+90001	WARN	MEDIUM	Insecure JSF ViewState
+90002	WARN	MEDIUM	Java Serialization Object
+90003	WARN	MEDIUM	Sub Resource Integrity Attribute Missing
+90004	WARN	MEDIUM	Insufficient Site Isolation Against Spectre Vulnerability
+90011	WARN	MEDIUM	Charset Mismatch
+90017	WARN	MEDIUM	XSLT Injection
+90019	WARN	MEDIUM	Server Side Code Injection
+90020	WARN	MEDIUM	Remote OS Command Injection
+90021	WARN	MEDIUM	XPath Injection
+90022	WARN	MEDIUM	Application Error Disclosure
+90033	WARN	MEDIUM	Loosely Scoped Cookie
+90034	WARN	MEDIUM	Cloud Metadata Potentially Exposed