@kenkaiiii/ggcoder 5.40.0 → 5.41.0

package/assets/skills/bulletproof/references/platform-playbooks.md

@@ -0,0 +1,161 @@
+# Platform Playbooks
+
+Per-target controls. Load only the sections recon says apply. Format: **control → what to check in code → why it fails in practice.**
+
+Snapshot 12 August 2026. **[V]** verified, **[S]** snapshot-volatile, **[U]** uncertain.
+
+---
+
+## Web & API
+
+The best-understood surface; the failures are still the same three.
+
+| Control | Check | Why it fails |
+|---|---|---|
+| **Authorization at the data layer** | Every query filtered by the acting user/tenant, enforced in one chokepoint (policy layer, RLS, scoped repository) — not per-handler | Per-handler checks are correct on the day they are written and drift on the fifth new endpoint. Object-level authorization (BOLA/IDOR) is the top API risk and CWE-862 is top-five |
+| **Parameterized queries** | No string concatenation or f-strings into SQL/NoSQL/LDAP/XPath; ORM `raw`/`literal`/`$where` calls audited individually | The ORM covers 95% and the last 5% is a report filter or a dynamic sort column |
+| **Output encoding** | Framework escaping left on; explicit unsafe sinks (`dangerouslySetInnerHTML`, `v-html`, `bypassSecurityTrust*`, `innerHTML`, raw template filters) each justified | XSS is still CWE-25 rank 1. Modern frameworks make the safe path default and the unsafe path a one-liner |
+| **Server-side validation** | A schema at every entry point, allowlist-shaped, rejecting unknown fields; never trust client validation | Mass assignment: the model accepts `is_admin` because the schema was permissive |
+| **CSRF** | State-changing routes require a token or `SameSite=Lax/Strict` cookies plus origin checks; API-token auth is exempt, cookie auth is not | Cookie-authenticated JSON endpoints assumed safe because "it's an API" |
+| **SSRF** | Any URL from input: allowlist hosts, resolve then validate the IP, block private and link-local ranges, disable redirects or re-validate each hop | Metadata endpoints on cloud hosts turn SSRF into credential theft. Folded into A01 in the 2025 Top 10 |
+| **Rate limits on credential paths** | Login, reset, MFA, token exchange, invite acceptance | These are the endpoints where volume converts directly to account takeover |
+| **Errors** | Generic message to the client, detail to the log; no stack traces, SQL text, or env in responses | A10:2025 is new and is exactly this: fail-open and mishandled exceptional conditions |
+
+**Backend-as-a-service (Supabase / Firebase / PocketBase and similar) — the highest-yield indie failure** [S]:
+
+1. RLS enabled on **every** table holding user data, including join tables and views.
+2. No `using (true)` policies. That is the generated default when a model is told to "add a policy" without a rule, and the dashboard still shows a green badge.
+3. Coverage for **all four verbs** — a common shape locks `SELECT` and leaves `INSERT`/`UPDATE`/`DELETE` open.
+4. **Service-role keys never in client code**, never in `NEXT_PUBLIC_*`/`VITE_*`/`EXPO_PUBLIC_*`. Grep the built bundle, not just the source.
+5. `auth.uid()` compared against the row's owner column, not merely present in the expression.
+6. Assume table names are known — generated schemas converge on `users`, `profiles`, `messages`, `orders`, `subscriptions`. The REST layer self-describes to anyone holding the public anon key.
+
+**Verification that actually proves it:** call the endpoint as user B for user A's row and require a 403/404. One such test per protected resource is worth more than a header audit.
+
+---
+
+## Mobile (iOS / Android)
+
+Standards [V]: **MASVS v2.1.0** (8 categories, no L1/L2 levels since v2.0.0) and **MASTG v2.0.0** (30 Jun 2026) with atomic, referenceable test IDs — cite `MASTG-TEST-####`, not chapter names. Mobile Top 10 is the **2024** edition, led by M1 Improper Credential Usage.
+
+| Control | Check | Why it fails |
+|---|---|---|
+| **Credential storage** | iOS Keychain with `kSecAttrAccessibleWhenUnlockedThisDeviceOnly`; Android Keystore with `setUserAuthenticationRequired`, StrongBox where available | Defaults sync to cloud keychains and survive device backup |
+| **RN/Flutter/Expo storage** | `AsyncStorage` holding tokens is plaintext — unencrypted SQLite on Android, plist on iOS. Use `expo-secure-store` / `react-native-keychain` | Secure stores are small-value only; store a key there and encrypt the payload separately |
+| **Secrets in the bundle** | Grep the built bundle and `EXPO_PUBLIC_*`/`REACT_APP_*` for API keys | The JS bundle is shipped, readable, and extracted routinely |
+| **Exported components** | `android:exported` explicit on every activity/service/receiver with an intent filter; unexported unless required | Set to `true` to silence the build error, permanently |
+| **Intent redirection** | `getParcelableExtra(..., Intent.class)` then `startActivity` | A nested attacker-supplied intent gets launched with your app's privileges. Android 16 adds stricter opt-in resolution [S] — opt in |
+| **Deep / app links** | `android:autoVerify="true"` plus a served `assetlinks.json`; iOS `applinks:` entitlement plus AASA as `application/json`, no redirect | Verification propagation can take days [S] — a redeploy is not an instant fix. Never treat link parameters as authenticated |
+| **WebView bridges** | `addJavascriptInterface`, `loadDataWithBaseURL`, `setJavaScriptEnabled`; iOS `WKScriptMessageHandler` — validate `frameInfo.isMainFrame` and origin | The classic in-app RCE path; a bridge exposed to remote content is a native API for the page |
+| **Transport** | `networkSecurityConfig` for `cleartextTrafficPermitted="true"` and `<debug-overrides>`; iOS `NSAllowsArbitraryLoads` | Domain-specific overrides silently reopen cleartext |
+| **Pinning** | If pinned: pin an SPKI set including a backup, with documented rotation and a kill switch | Hard-pinning a leaf certificate now causes more outages than the MITM it prevents [U] |
+| **Backup / pasteboard** | `android:allowBackup`, `dataExtractionRules`; `UIPasteboard.general` for tokens | Auto Backup exfiltrates tokens off-device by default |
+| **Client-side gating** | Any entitlement, price, or role decided in the app | Re-decide server-side. The client binary is attacker-owned |
+
+**Store gates** [S]: Apple requires `PrivacyInfo.xcprivacy` privacy manifests with required-reason API declarations and signed binary dependencies for listed SDKs (rejection codes in the `ITMS-9105x` family). Google Play raised the minimum target API for new apps and updates in 2026 — check the current requirement before a release. Data-safety declarations must match real SDK behavior.
+
+---
+
+## Desktop
+
+**Electron** — two layers, and teams do only the first.
+
+- *Renderer config:* `contextIsolation: true`, `sandbox: true`, `nodeIntegration: false`, `nodeIntegrationInWorker/InSubFrames: false`, `webSecurity: true`, `allowRunningInsecureContent: false`, `webviewTag: false`, a `setWindowOpenHandler` and a `will-navigate` allowlist, and a preload that exposes a **narrow typed API** rather than `ipcRenderer` itself.
+- *Packaging fuses* [V], flipped at package time before signing so the OS enforces them: `RunAsNode`, `EnableNodeOptionsEnvironmentVariable`, `EnableNodeCliInspectArguments`, `GrantFileProtocolExtraPrivileges` → **false**; `EnableEmbeddedAsarIntegrityValidation`, `OnlyLoadAppFromAsar`, `EnableCookieEncryption` → **true**. Verify the packaged app, not the config file. Left on, a signed app becomes a living-off-the-land Node runtime with the app's privileges and entitlements. Tradeoff: disabling `RunAsNode` breaks `child_process.fork` — use `UtilityProcess`.
+- Electron's own position [V]: it is not a browser, and displaying arbitrary untrusted content is a risk it is not designed to contain.
+
+**Tauri v2** — capability-scoped, and the defaults are good until someone widens them.
+
+- Grep `src-tauri/capabilities/*.json` for: window label **globs** (a capability granted to `app-*` is granted to every future window with that prefix — boundaries are label-based); `remote.urls` (exposes the API to remote origins; on Linux and Android an embedded iframe cannot be distinguished from the window [V]); `fs:allow-*` without a matching deny scope; `shell:allow-execute`.
+- Every registered command is callable from every window unless a capability restricts it. Least privilege means per-window capabilities, not one default file.
+- `"csp": null` disables Tauri's CSP injection — set a real policy.
+- Updater signature verification cannot be disabled [V], so the residual risk is **private key custody**, not transport. The signing key lives in CI secrets, never a `.env`.
+
+**Cross-desktop, all frameworks:**
+
+| Control | Check | Why it fails |
+|---|---|---|
+| **Loopback HTTP servers** | Bind `127.0.0.1` explicitly (never `0.0.0.0`), require a per-launch bearer token, validate `Origin` and `Host` | Any local process — and, via DNS rebinding, any web page the user visits — can reach an unauthenticated loopback port |
+| **Local IPC** | Unix socket at `0700` with peer-credential checks; Windows named pipe with an explicit DACL and `PIPE_REJECT_REMOTE_CLIENTS` | Default pipe ACLs are broader than you expect |
+| **Deep links** | Custom schemes are first-come-first-served (Windows) or last-registered-wins (macOS); any app can claim yours | Never treat a deep-link parameter as authenticated; bind auth codes to a state/nonce you generated |
+| **Updater** | Verify the signature **before** unpacking; pin the public key in the binary; include version and target in the signed payload | Rollback and cross-target swaps are the bugs left after signing is added. Design key rotation before you need it |
+| **Signing** | macOS: Developer ID, `--options runtime`, `--timestamp`, `notarytool`, then `stapler staple` so offline machines verify. Every nested binary and sidecar signed individually | Certificate validity was cut to 460 days for certificates issued from 1 Mar 2026 [S], and keys must be in certified hardware — build rotation into the release pipeline and always timestamp |
+
+---
+
+## CLI & developer tooling
+
+The distinguishing risk: **these programs open repositories, files, and projects that the user did not write.** Everything in the workspace is attacker-controlled input.
+
+1. **Shelling out.** Grep `shell: true`, `execSync`, `exec(`, backtick or f-string interpolation into `bash -c`, `os.system`, `subprocess` with `shell=True`. Use `spawn(file, args)` with an argument array. Where a shell is genuinely required, the invariant is that no model-derived or repo-derived string reaches it uninterpolated.
+2. **PATH and search-order hijack.** Bare command names in spawn calls resolve through `PATH`. Never prepend `.` or a repo-relative `node_modules/.bin` when the repo is untrusted; resolve to absolute paths.
+3. **Repo config is data, not code.** A malicious repository ships `.git/config` (`core.fsmonitor` and `core.pager` are code execution), `.vscode/tasks.json` with `runOn: folderOpen`, agent hook configs, `Makefile`, `package.json` scripts, editor and linter plugin paths. **The CHAINDROP worm used exactly the editor-task and agent-hook vectors** [V]. Never honor a repo-supplied plugin, loader, or interpreter path.
+4. **Terminal escape injection.** Untrusted file contents, git refs, branch names, and tool output printed raw can emit OSC 8 hyperlinks, OSC 52 clipboard writes, and cursor/title sequences that some terminals echo back as input. Strip C0/C1, CSI and OSC sequences from untrusted strings before writing to a TTY.
+5. **Symlinks and TOCTOU.** `existsSync` then `writeFile` is a race. Resolve with `realpath`, verify containment **after** opening, use `O_NOFOLLOW`/`openat` where available, and reject `..` and absolute entries when extracting archives.
+6. **Install-time execution.** `preinstall`/`postinstall` run arbitrary code with full developer privileges before anything is evaluated. Set `ignore-scripts` with an explicit allowlist for the few packages that need builds. See `supply-chain.md`.
+7. **Credentials on disk.** Token files at `0600`, never logged, redacted from diagnostics and crash reports, and outside any directory the tool uploads. Prefer the OS keychain where available.
+8. **`curl | sh` installers.** If you ship one: HTTPS only, pinned to an immutable release URL rather than `latest`, verifying a published checksum or signature before executing anything.
+9. **Sandboxing untrusted content.** macOS seatbelt, Linux Landlock (check the ABI at runtime and degrade gracefully; a descriptor opened before restriction stays usable, so use `O_CLOEXEC`), or a container with `--network none`. Most analysis tasks need no network at all.
+
+---
+
+## Embedded, IoT & firmware
+
+**Regulatory dates that drive engineering** [V]: the EU Cyber Resilience Act is in force since 10 Dec 2024 and fully applicable 11 Dec 2027, with **Article 14 reporting obligations starting 11 September 2026** — early warning within 24 hours, full notification within 72 hours, final report within 14 days once a fix exists. Two traps: only *actively exploited* vulnerabilities trigger reporting, and it applies to products already on the market, so shipping date is irrelevant. UK PSTI has been enforced since Apr 2024 — unique or user-set passwords, a disclosure programme, and a published support period. The US Cyber Trust Mark remains voluntary with administration in flux [S]; do not plan around it as a market gate.
+
+**Device controls:** hardware root of trust with secure boot and anti-rollback counters; OTA images signed and verified **before** flashing to an inactive slot, with A/B plus watchdog rollback; JTAG/SWD fused off and UART consoles disabled in production builds (grep build configs for debug flags and fuse-burn steps); no shared per-fleet keys — per-device identity or a compromise is fleet-wide; an SBOM generated in CI per firmware version and retained, because you cannot answer "which units are affected" in 24 hours without one.
+
+---
+
+## Smart contracts & web3
+
+**The strategic read** [S]: losses are dominated by key management, privileged-role governance, and oracle or collateral *configuration* — not arithmetic bugs. Multiple 2025–2026 nine-figure incidents hit protocols that had been audited by reputable firms; at least one turned on a months-long social-engineering campaign that obtained administrative control and then whitelisted a manipulable asset.
+
+Grep priorities in this order: privileged setters without timelock and multisig; `onlyOwner` on collateral, oracle, or fee parameters; unbounded proxy `upgradeTo`; uninitialized implementations and missing `initializer`; spot prices read from `getReserves`/`slot0` used as an oracle; `ecrecover` without nonce, deadline, and chain ID (use EIP-712); cross-chain message verification that trusts a sender field; and reentrancy on external calls before state writes.
+
+**Compiler** [V]: current is **0.8.36** (9 Jul 2026). Two upgrade-forcing releases in the window — 0.8.34 (Feb 2026) fixed a high-severity storage-clearing bug in the IR pipeline, and 0.8.32 (Dec 2025) fixed a lost storage array write. Since 0.8.31 the default EVM target moved, so **pin `evmVersion` explicitly** or a compiler bump silently retargets your chain. Deprecated before 0.9.0: `send`/`transfer` on `address`, ABI coder v1, virtual modifiers.
+
+**CI gates:** Slither failing on high/medium, Foundry invariant and fuzz suites with bounded handlers (property tests catch the economic bugs unit tests miss), Echidna, and storage-layout diffing on every upgradeable deploy.
+
+---
+
+## ML & AI pipelines
+
+| Control | Check | Why it fails |
+|---|---|---|
+| **Model deserialization** | The default flipped: `torch.load` is `weights_only=True` from PyTorch 2.6 [V]. So grep the **override** — `weights_only=False`, and `add_safe_globals`/`safe_globals` used to silence an error rather than allowlist a reviewed type | Re-running with `weights_only=False` makes the error go away and arbitrary code execution appear |
+| **Other loaders** | `pickle.load`, `joblib.load`, `dill`, `numpy.load(allow_pickle=True)`, Keras `.h5`/`.keras` with Lambda layers | A model file is a program. Prefer `.safetensors` and reject code-capable formats at the ingestion boundary |
+| **`trust_remote_code=True`** | Any occurrence | Equivalent to `curl \| sh` against a model hub |
+| **Model provenance** | Sign at train time, verify **in the loader** at load time (OpenSSF Model Signing / sigstore) [V]; pin dataset revisions by content hash, not by a mutable hub tag | A README instruction to "verify the hash" is not verification |
+| **Endpoint exposure** | Anything bound to `0.0.0.0`: experiment trackers, notebook servers, inference servers, dashboards, job-submission APIs, local model runtimes | Several 2025–2026 critical CVEs in this class chain auth bypass with traversal to unauthenticated RCE [S]; some job APIs are unauthenticated by design and must be network-isolated |
+| **Default credentials** | Auth config files shipped with defaults; notebooks started with empty tokens and `--allow-root` | Generic credential-harvesting scanners find these incidentally, which is how most of these get popped [V] |
+| **Model output** | Treat as untrusted input to whatever consumes it — never straight into `eval`, a shell, SQL, or `innerHTML` | This is LLM05 Improper Output Handling, and it is how a prompt injection becomes code execution |
+
+---
+
+## Games & client-side software
+
+Short, because one principle covers it: **the client is permanently untrusted input.** Anti-cheat raises cost; it never establishes trust.
+
+- Grep the server for accepting client-supplied position, damage, currency, inventory, score, or elapsed-time deltas. The server simulates; the client predicts and reconciles. Bound and rate-limit every accepted delta.
+- Licence keys, HMAC secrets and API tokens in a shipped binary are disclosed, not hidden — `strings` finds them immediately. Validate server-side; if offline validation is required, verify a signed per-user licence with an embedded public key and accept that it is tamperable.
+- Mods and user-generated content are the untrusted-repo problem again: sandbox the scripting runtime, disable filesystem/network/FFI access, and never deserialize UGC with a code-capable format.
+
+---
+
+## Language hot zones
+
+Apply only to languages actually present. A grep hit here is a lead, not a finding — trace the path before flagging.
+
+| Language | Check |
+|---|---|
+| **Node / TypeScript** | `child_process.exec`/`execSync`, `spawn(..., {shell:true})`, `eval`/`new Function`, `vm.runIn*`, prototype pollution via deep-merge helpers or `Object.assign({}, userJson)`, `node-serialize`, source maps in published packages, `JSON.parse` on untrusted input feeding an object used as a lookup table |
+| **Python** | `pickle.load`, `yaml.load` without `SafeLoader`, `eval`/`exec`, `subprocess.*(shell=True)`, `os.system`, Jinja2 with `autoescape=False`, `render_template_string` on user input, `requests(verify=False)`, XML parsing without `defusedxml`, `torch.load(weights_only=False)` |
+| **Go** | `exec.Command("sh", "-c", input)`, `text/template` where `html/template` was meant, unbounded `io.ReadAll`, unsynchronized map access, missing `http.Server` timeouts |
+| **Rust** | `unsafe` blocks with raw pointers, `Command::new("sh").arg("-c")`, deserializing untrusted input without bounds, `unwrap()` on attacker-influenced input in a service path |
+| **Java / JVM** | `ObjectInputStream` on untrusted bytes, JNDI lookups from input, `Runtime.exec(String)`, XXE in default XML parsers, expression-language injection |
+| **Ruby** | `eval`/`instance_eval`, `Marshal.load`, `YAML.load` rather than `safe_load`, `system` with interpolation, mass assignment without strong parameters |
+| **PHP** | `unserialize`, `eval`, `assert(string)`, `include`/`require` with a dynamic path, `preg_replace` with the `/e` modifier |
+| **C / C++** | `strcpy`/`sprintf`/`gets`, integer overflow in size arithmetic, `printf(userInput)`, use-after-free, double-free. New parsing code here needs a written justification, sanitizers, and fuzzing |
+| **Shell** | Unquoted variable expansion, `eval`, word splitting on filenames, `curl | sh`, missing `set -euo pipefail` |
+| **SQL** | String-built queries, dynamic identifiers (table and column names cannot be parameterized — allowlist them), `SECURITY DEFINER` functions without a locked `search_path` |

package/assets/skills/bulletproof/references/provenance.md

@@ -0,0 +1,45 @@
+# Provenance
+
+**Snapshot date: 12 August 2026.** Everything in this skill was checked against live sources on that date. Security facts decay faster than any other content in this repository — a version number, a CVE, a default, or an incident detail that was accurate at snapshot time may be wrong by the time you read it.
+
+## Confidence markers
+
+Used throughout the reference files. Preserve them when repeating a claim to the user.
+
+| Marker | Meaning | How to treat it |
+|---|---|---|
+| **[V]** | Verified against a primary source (standards body, vendor advisory, official documentation, CVE record) at snapshot time | State it plainly, with the date if it matters |
+| **[S]** | Snapshot-accurate but volatile — versions, adoption status, statistics, vendor defaults | Re-verify before asserting as current; otherwise attribute to the snapshot |
+| **[U]** | Single-sourced, secondary, or methodology not published | Do not build a recommendation on it alone; say it is uncertain |
+
+Unmarked engineering guidance (parameterize queries, fail closed, least privilege) is durable practice, not a dated claim.
+
+## Source classes
+
+- **Standards and frameworks**: OWASP (Top 10:2025, ASVS 5.0.0, API Security Top 10 2023, MASVS 2.1.0 / MASTG 2.0.0, LLM Top 10 2025, Agentic Top 10 2026), MITRE (CWE Top 25 2025 edition, ATT&CK), NIST (SP 800-63B-4, SP 800-218 / 218A, SP 800-53 Rev 5, FIPS 203/204/205), SLSA, OpenSSF.
+- **Vendor and platform documentation**: Apple, Google/Android, Microsoft, Electron, Tauri, PyTorch, Solidity, package registries.
+- **Incident reporting and threat intelligence**: model-provider security disclosures, national CERT and CISA advisories, established security-vendor research teams, and independent researchers with published methodology.
+- **Regulatory texts**: EU Cyber Resilience Act, UK PSTI.
+
+Statistics and incident details in `threat-landscape.md` come from published reports whose methodology varies in quality. Where a figure is widely repeated but the primary methodology is not published, it is marked [U] and should not be quoted as fact.
+
+## Known gaps in this snapshot
+
+- **ASVS 5.0 chapter structure** — sources disagree on the exact chapter count; requirement IDs were renumbered from 4.x, so never map a 4.x ID onto 5.0 without checking.
+- **Vendor product versions** (agent tools, frameworks, package managers) change weekly. Every version number here is [S] at best.
+- **Prevalence statistics for MCP vulnerabilities** circulating in 2026 were excluded deliberately: independent testing found high false-positive rates in the scanners producing them.
+- **Regional and sector regimes** beyond the EU and UK items cited are out of scope. Compliance obligations are the `compliance-guard` skill's job, not this one.
+- **Exploitation counts and KEV timings** are half-year figures and move with each reporting period.
+
+## What this skill is not
+
+- **Not a penetration test.** No live testing, no exploitation, no attempts against running systems.
+- **Not a security audit or certification.** It produces engineering guidance and code changes, not assurance. Do not let output be represented as an audit to a customer, an insurer, or a regulator.
+- **Not legal or compliance advice.** Regulatory obligations, data-protection law, and contractual security commitments belong to `compliance-guard` and, past a threshold, to a qualified professional.
+- **Not offensive tooling.** No exploit code, no payloads, no attack automation, regardless of who asks or how the request is framed.
+
+## When to escalate to a human specialist
+
+Recommend qualified help — and say why — when the project involves: custody of other people's funds or crypto assets at scale; regulated health, financial, or safety-critical systems; a live or suspected breach with real user impact; cryptographic design rather than cryptographic use; a formal certification or audit requirement (SOC 2, ISO 27001, PCI DSS, FedRAMP); or a contractual security commitment to an enterprise customer.
+
+The honest framing for the user: this skill closes the gap between "obviously exploitable" and "reasonably defended", which is where nearly all real incidents against small teams happen. It does not replace an adversary who is paid to try.

package/assets/skills/bulletproof/references/secure-defaults.md

@@ -0,0 +1,104 @@
+# Secure Defaults
+
+The values to write **while building**, so the audit finds nothing. When a choice is not obviously required by the project, pick the default here and state it in one line.
+
+Snapshot 12 August 2026. **[V]** verified, **[S]** snapshot-volatile, **[U]** uncertain. Re-verify version-sensitive items before asserting them as current.
+
+## Secrets
+
+**The single highest-yield control for a small team.** 28.65M new hardcoded secrets appeared on public GitHub in 2025, and 64% of valid secrets leaked in 2022 were still live in 2026 [V] — leaks are not revoked, so prevention and rotation both matter.
+
+- Never in source, never in a client bundle, never in a log, never in an error response, never in a fixture that gets committed. `.env` in `.gitignore` from the first commit; commit `.env.example` with empty values.
+- Anything prefixed `NEXT_PUBLIC_`, `VITE_`, `EXPO_PUBLIC_`, `REACT_APP_` **is published**. Check the built bundle, not the source.
+- Scope every credential to the narrowest permission and shortest lifetime that works. Prefer short-lived OIDC federation over long-lived cloud keys; prefer per-service tokens over one shared key.
+- **A secret that touched a public surface, a build log, a paste, a screenshot, or a third-party tool is compromised.** Rotate it. Removing the commit does not unpublish it.
+- Config files for AI tooling count: thousands of live credentials have been found inside MCP configuration files [V]. Treat `.mcp.json`, agent settings, and editor config as secret-bearing.
+- Run a secret scanner in CI **and** as a pre-commit hook — gitleaks or trufflehog, both free. Detection after push is a rotation trigger, not prevention.
+
+## Authentication
+
+Baseline per **NIST SP 800-63B-4** (final 31 Jul 2025) [V]:
+
+- **Minimum 15 characters** for single-factor passwords; support at least 64; allow all printable characters including spaces.
+- **No composition rules** and **no scheduled rotation** — change only on evidence of compromise. Both are explicit SHALL NOTs now; the old advice is now a finding.
+- **Screen against a breached-password blocklist** on set and change.
+- Allow password managers and paste/autofill. No password hints, no knowledge-based questions.
+- Passkeys/WebAuthn are the preferred factor — synced passkeys count at AAL2, device-bound at AAL3 [S]. Offer them before offering SMS.
+
+Implementation:
+
+- Hash with **argon2id** (memory-hard, tuned so a verification takes ~100–300 ms on your hardware) or bcrypt where argon2 is unavailable. Never a bare SHA family hash, never MD5.
+- **OAuth 2.1 direction** [S]: PKCE required for all authorization-code flows, the implicit and password grants are gone, exact redirect-URI matching, refresh-token rotation with reuse detection. Follow the OAuth Security BCP.
+- Session tokens from a CSPRNG, ≥128 bits. Rotate the session identifier on login and on privilege change. Server-side revocation must exist — a stateless token you cannot revoke is an outage during an incident.
+- Constant-time comparison for tokens, signatures, and MFA codes — but **validate the shape before you compare**. A stored credential whose hex/base64 decodes to the wrong length, or whose scheme/salt/hash does not parse, must be rejected as malformed and fail closed; never fall through to the comparison. `timingSafeEqual` on two empty buffers returns true, so an unparsed record can verify any password.
+- Rate-limit and lock out on login, reset, MFA, and token exchange. Generic failure messages: never reveal whether the account exists.
+
+## Authorization
+
+- **One chokepoint.** A policy function, a scoped repository, or database RLS — not a check copy-pasted into each handler.
+- Default deny. New endpoints and new tables are inaccessible until a rule grants access.
+- Authorize on the **object**, not just the route: `canRead(user, invoice)`, never "the route is under `/admin` so it is fine".
+- Never accept a client-supplied user, tenant, role, or price. Derive them from the session server-side.
+- Re-check on every request; a permission granted at login can be revoked mid-session.
+- Test it: the cross-user access test (user B requests user A's resource, expect 403/404) is the highest-value security test a small team can write.
+
+## Cryptography
+
+Do not invent constructions. Use a vetted library's high-level API.
+
+| Need | Default | Notes |
+|---|---|---|
+| Password hashing | argon2id | Never a fast hash |
+| Symmetric encryption | AES-256-GCM or XChaCha20-Poly1305 | Always AEAD. **Never reuse a nonce with GCM** — random 96-bit nonces are only safe under a key-rotation bound; XChaCha's 192-bit nonce is safer for high volume |
+| Hashing | SHA-256 or SHA-512 | MD5 and SHA-1 are dead for anything security-relevant |
+| MAC | HMAC-SHA-256 | Verify with a constant-time compare — only after both operands are known well-formed (a malformed operand can make an empty-empty compare return true) |
+| Signatures | Ed25519, or ECDSA P-256 | Verify the algorithm from your own policy, not from the token header |
+| Randomness | The OS CSPRNG (`crypto.randomBytes`, `secrets`, `getrandom`) | Never `Math.random`, `rand()`, or a seeded PRNG for tokens, IDs, or salts |
+| Transport | TLS 1.3, HSTS with a long max-age | TLS 1.0/1.1 gone; 1.2 only for legacy peers |
+| Tokens | Short-lived, audience-bound, revocable | Reject `alg: none`; pin the expected algorithm |
+
+**Post-quantum** [V]: FIPS 203 (ML-KEM), 204 (ML-DSA) and 205 (SLH-DSA) were finalised Aug 2024. Hybrid key exchange **X25519MLKEM768 is the de facto browser default in 2026** — Chrome since v131, Firefox since v132, with Apple platform support from the 2025 OS releases. Certificates remain classical; only the key exchange is PQ-protected. Practical guidance for an app developer: enable the hybrid group on your servers (prefer `X25519MLKEM768`, fall back to `X25519`), and treat **harvest-now-decrypt-later** as real only for data that must stay confidential for a decade or more. Do not hand-roll PQC. CNSA 2.0 dates matter only for national-security systems [V].
+
+## Input handling
+
+- **Validate at the boundary with a schema**, allowlist-shaped, rejecting unknown fields. Parse into typed structures rather than passing raw maps inward.
+- Encode at the point of use, not on input. Escaping for HTML, SQL, shell, and JSON are different operations; a single "sanitize" pass at ingress is a false sense of safety.
+- Bound everything: body size, array length, string length, upload size, nesting depth, page size, and decompressed size.
+- Canonicalize paths with `realpath` and verify containment **after** resolution; reject `..` and absolute entries in archives.
+- For file uploads: validate content by sniffing, not by extension or client-supplied MIME; store outside the web root with generated names; never serve them from your app's origin if they can be HTML.
+
+## Web response headers
+
+Baseline for anything rendering HTML:
+
+- **CSP with nonces and `strict-dynamic`**, `object-src 'none'`, `base-uri 'none'`, `frame-ancestors 'none'`. An allowlist-only CSP is bypassable in practice; nonce-based is the current recommendation.
+- `Strict-Transport-Security` with a long max-age and `includeSubDomains`.
+- `X-Content-Type-Options: nosniff`; `Referrer-Policy: strict-origin-when-cross-origin`; a restrictive `Permissions-Policy`.
+- Cookies: `Secure`, `HttpOnly`, `SameSite=Lax` (or `Strict` for sensitive actions), `__Host-` prefix where scoping allows.
+- CORS: never `Access-Control-Allow-Origin: *` together with credentials; echo only from an allowlist; never reflect arbitrary origins.
+- `Cross-Origin-Opener-Policy: same-origin` and `Cross-Origin-Resource-Policy` for isolation; add COEP when you need cross-origin isolation.
+- Subresource Integrity on third-party scripts, or self-host them.
+- Trusted Types where the framework supports it — it eliminates DOM XSS sinks structurally [S].
+
+## Cloud, containers & infrastructure
+
+- **OIDC federation instead of long-lived cloud keys** in CI. This removes the credential that supply-chain worms are hunting.
+- IAM scoped to specific actions and resources. No `Action: *`, no wildcard `PassRole`. Separate roles per service.
+- Storage private by default; block public access at the account level; presigned URLs short-lived and scoped.
+- Enforce the hardened instance metadata service (IMDSv2 / hop limit 1). SSRF plus a legacy metadata service equals cloud credentials.
+- Containers: non-root user, read-only root filesystem, dropped capabilities, no `--privileged`, no Docker socket mount, a seccomp profile, minimal or distroless base images, pinned by digest.
+- Kubernetes: enforce the `restricted` Pod Security Standard, network policies default-deny, no cluster-admin service accounts, secrets from a manager rather than plain manifests.
+- Databases and caches never on a public interface. Redis, Postgres, Mongo, Elasticsearch bound to private networks with authentication on.
+
+## Logging & detection
+
+You cannot respond to what you cannot see, and A09:2025 covers alerting, not just logging.
+
+- Log authentication outcomes, authorization denials, privilege changes, secret access, admin actions, and payment events — with actor, source, and timestamp.
+- **Never log** credentials, tokens, session identifiers, full card numbers, or request bodies containing them. Redact at the logger, not at each call site.
+- Alert on the few things that mean compromise: a spike in authorization denials, a new admin, a credential used from an unexpected location, a dependency-install failure in CI, an unexpected published release.
+- Keep enough retention to investigate — 90 days is a reasonable floor for a small team.
+
+## Failure behavior
+
+A10:2025 exists because of this: **fail closed.** When the auth service times out, deny. When the policy engine errors, deny. When signature verification throws, reject. Grep for `catch` blocks that swallow an error and continue on the success path, and for defaults that grant access when a value is missing or `undefined`.

package/assets/skills/bulletproof/references/supply-chain.md

@@ -0,0 +1,76 @@
+# Supply Chain & Build Integrity
+
+A03:2025 is Software Supply Chain Failures — promoted because this is now the dominant compromise route for small teams. Your dependencies, your CI, and your release pipeline are all code you ship, written by people you have not met.
+
+Snapshot 12 August 2026. **[V]** verified, **[S]** volatile, **[U]** uncertain.
+
+## Adding a dependency
+
+Before adding any package — and **especially** one you or a model produced from memory:
+
+1. **Confirm it exists and is the one you mean.** Models invent package names at a measurable rate, the same invented names recur across runs, and squatters register them [S]. This is slopsquatting, and an agent removes the human "does that name look right" check. Named real-world cases include a plausible-sounding lint plugin and a conflation of two real codemod tools [V].
+2. **Check identity, not vibes:** registry age, download history, repository link that actually resolves, maintainer with other work, a version history that is not a single `0.0.1`. New package + high download count + no history is the squat signature.
+3. **Check character-level lookalikes** against the package you meant: hyphen vs underscore, singular vs plural, scoped vs unscoped, `-js` suffix, homoglyphs.
+4. **Prefer what is already in the project.** The safest dependency is the one you do not add. For a few dozen lines, write the code.
+5. **Pin it.** Exact version in the manifest, lockfile committed, and for containers and Actions pin by digest or commit SHA.
+6. **Let it age.** A cooldown before adopting brand-new versions would have blocked both major npm worm waves — malicious releases were pulled within hours [V]. A few days of lag costs nothing.
+
+## Install-time execution
+
+`preinstall`/`postinstall` scripts run arbitrary code with full developer privileges before anything is reviewed, with access to your registry tokens, cloud credentials, source, and filesystem [V]. This is the mechanism behind the worm lineage.
+
+- Set `ignore-scripts=true` and allowlist the handful of packages that genuinely need a build step (`onlyBuiltDependencies` or equivalent).
+- Use a package manager version that blocks install hooks by default where available [S].
+- Eliminate automation tokens that bypass 2FA — the most recent worm only propagated through tokens with publish rights **and** 2FA bypass [V].
+- In CI, install with a frozen lockfile and no scripts, in a container without cloud credentials mounted.
+
+## Publishing your own package
+
+If others install your code, you are their supply chain.
+
+- **Trusted publishing / OIDC instead of long-lived registry tokens** [S]. A token in CI is the exact asset every worm enumerates.
+- 2FA on the registry account and the source-control account, hardware-backed where possible.
+- Generate provenance/attestations (SLSA, Sigstore, registry-native attestations) — but understand the limit: **provenance proves where an artifact was built, not that the build was honest.** A 2026 campaign published malicious versions carrying valid high-level provenance because the build itself was subverted [U].
+- Verify what is in the tarball before it ships: `npm pack --dry-run` or equivalent. Ship no source maps, no `.env`, no test fixtures, no internal docs. A source-map leak has already exposed a major product's source [S].
+- Review the diff of every release, including dependency bumps. Maintainer-account compromise is the entry point in most of these incidents; a second pair of eyes on the release commit is the cheapest control.
+
+## CI/CD
+
+The highest-value target, because CI holds every credential at once — 59% of machines compromised in one worm forensic study were CI runners, not laptops [V].
+
+| Control | Check |
+|---|---|
+| **Pin actions by SHA** | `uses: org/action@<40-char-sha>`. A version tag is mutable: one 2025 incident retroactively repointed tags across tens of thousands of repositories, and a 2026 one force-pushed nearly every tag of a security vendor's own action [V] |
+| **Least-privilege token** | An explicit `permissions:` block, default `contents: read`, elevated only in the job that needs it |
+| **Dangerous triggers** | Workflows that run on pull requests from forks **and** check out the PR head **and** hold secrets. Roughly 38% of organizations still have one [S] |
+| **Cache poisoning** | A fork-triggered workflow with write access to the base repository's cache can plant content a later trusted job consumes — the initial access in a 2026 credential-free worm [V] |
+| **Script injection** | Never interpolate `${{ github.event.* }}` (titles, branch names, comment bodies) directly into a `run:` block. Pass through `env:` and quote |
+| **Secret hygiene** | No secrets echoed, no `set -x` around them, masked in logs, scoped per environment, rotated on any suspicion |
+| **Runners** | Prefer ephemeral. A reused self-hosted runner leaks state between jobs, including from forks |
+| **Branch protection** | Required review on the release branch, signed commits where feasible, no force-push |
+
+## Consuming other people's code beyond packages
+
+- **Editor extensions**: a 2026 campaign published 77 extensions cloning real extensions' names and descriptions under namespaces the publishers did not own [V]; extensions auto-update by default, and removal from a registry does not clean installed copies. Check publisher identity, install count history, and repository link — not the display name.
+- **MCP servers**: the first in-the-wild malicious server was a clone of a legitimate library that added a silent BCC after fifteen clean releases [V]. Install from the official registry with signing and verification where possible; pin versions; review the tool list after every update. See `agent-surface.md`.
+- **Container base images**: pin by digest, scan, prefer minimal or distroless, rebuild regularly rather than pinning to a stale digest forever.
+- **Model artifacts**: signed and verified at load, code-capable formats rejected, dataset revisions pinned by hash. See the ML section of `platform-playbooks.md`.
+- **Opening an untrusted repository is itself an install.** Before opening one in an editor or an agent, check `.vscode/tasks.json` for `runOn: folderOpen`, agent hook configuration (`.claude/settings.json` and equivalents), `.git/config` for `core.fsmonitor` and `core.pager`, and any `postinstall`. The most recent worm persisted through exactly these [V].
+
+## Keeping it current
+
+- Automated dependency updates with a review gate, plus a scanner that fails the build on known-exploited vulnerabilities in reachable code — not on every advisory, or the team learns to ignore it.
+- Track a real SBOM (CycloneDX or SPDX) generated in CI per release. It is a regulatory obligation for some products [V], and independently it is the only way to answer "are we affected" in hours instead of days.
+- Median time from CVE publication to confirmed exploitation is now roughly 80 days, with about a quarter exploited on or before publication day [V]. **The controllable variable is your patch latency**, not their speed.
+- Subscribe to advisories for your actual stack. For a small team, three feeds you read beats thirty you filter.
+
+## If you suspect compromise
+
+Order matters:
+
+1. **Rotate every credential the affected machine or pipeline could reach** — registry tokens, cloud keys, model API keys, source-control tokens, SSH keys, session secrets. Assume everything on that host is gone.
+2. Revoke sessions and active tokens; re-issue signing keys if a signing key could have been touched.
+3. Check for published artifacts you did not publish, and for commits, branches, and workflow files you did not author.
+4. Check persistence: editor tasks, agent hooks, git config, shell profiles, scheduled jobs, new deploy keys, new OAuth app grants.
+5. Preserve logs before cleaning. Then rebuild the machine rather than cleaning it.
+6. Only then work out how it happened.

package/assets/skills/bulletproof/references/threat-landscape.md

@@ -0,0 +1,74 @@
+# Threat Landscape — snapshot 12 August 2026
+
+Why the defaults in this skill are what they are. Confidence markers: **[V]** verified against a primary source at snapshot time, **[S]** snapshot-accurate but volatile, **[U]** uncertain or single-sourced. Preserve the markers when you repeat these claims.
+
+Read this once per full review to set the threat model. Do not paste incident lists into a report — cite only the ones that map to a finding.
+
+## 1. What automation actually changed
+
+**Confirmed: AI-orchestrated intrusion is real and operational.**
+
+- **GTG-1002** [V] — Anthropic disclosed (13 Nov 2025) the first documented largely-autonomous AI-orchestrated espionage campaign: a likely China-nexus actor drove an agent plus tooling through recon, vulnerability discovery, exploitation, lateral movement, credential harvesting and exfiltration against roughly 30 targets, with the large majority of operational tasks machine-executed. Now tracked as MITRE ATT&CK campaign **C0062**.
+- **Post-compromise, not just phishing** [V] — Anthropic's ATT&CK mapping of 832 banned accounts (Mar 2025–Mar 2026, published 3 Jun 2026) found AI used most for malware development, with AI-assisted account discovery rising while AI-assisted phishing fell. The durable differentiator is scaffolding that chains stages autonomously, not the operator's skill.
+- **Runtime LLM use inside malware** [V] — Google GTIG (5 Nov 2025) documented the first malware families querying a model at runtime: a dropper that requests just-in-time obfuscation, and a data-theft tool with no hard-coded collection commands that prompts a hosted model for them instead. Signature-based detection degrades against code that rewrites itself per execution.
+- **Machine-found bugs at scale** [V] — Anthropic's Glasswing programme reported scanning 1,000+ open-source projects, yielding tens of thousands of issues with thousands rated high or critical and a high validation rate on the sampled subset.
+
+**The honest counterweight — do not overstate this.** VulnCheck (28 Jul 2026) [V] found that of ~1,061 vulnerabilities attributed to AI-assisted discovery, only about 1.3% are confirmed exploited in the wild — roughly the same rate as vulnerabilities generally. Discovery volume is not exploitation volume. Machine-scale scanning has moved the bottleneck to **maintainer capacity to triage, patch, test and ship**, which is exactly where a small team is weakest.
+
+**What this means for the code you write:**
+
+1. Assume any public repository has been read end-to-end by an automated system. Obscurity was never a control; now it is not even a delay.
+2. The bug classes machines find fastest are the ones with a cheap verification oracle — web/API classes and memory-safety in parsers. Business logic and multi-actor authorization remain comparatively hard for them, and remain where the expensive breaches happen.
+3. Patch latency is now the dominant controllable variable. A dependency you cannot update quickly is a standing liability.
+4. Breakout speed is measured in minutes [S] — CrowdStrike's 2026 report cites an average eCrime breakout time under half an hour, with the fastest well under a minute. Detection that requires a human to read a dashboard within the hour is not a control.
+
+## 2. Supply chain — the dominant compromise route for small teams
+
+Named incidents, with the fingerprint a defender can grep for. All [V] unless marked.
+
+**The self-propagating npm worm lineage.** Shai-Hulud (Sept 2025) established the pattern: steal a publish token, enumerate every package the victim can publish, inject, republish. CISA warned of 500+ compromised packages targeting source-control and cloud credentials; the marker artifact was a workflow file named `shai-hulud-workflow.yml`. The November 2025 wave added destructive behavior; forensics across ~6,943 compromised machines found tens of thousands of unique secrets, and **59% of compromised machines were CI/CD runners rather than laptops** — CI is the real target.
+
+Successor waves worth knowing because each broke a different assumption:
+
+- **Mini Shai-Hulud / TanStack (11 May 2026)** — first credential-free initial access: a fork-triggered workflow with write access to the base repository's cache allowed cache poisoning, and publishing rode the registry's OIDC endpoint. Reported [U] that resulting malicious versions carried valid signed provenance at the highest build level. **Provenance proves where an artifact was built, not that the build was honest.** Treat provenance as necessary, not sufficient.
+- **Miasma wave (Jun–Jul 2026)** — dozens of packages under a vendor scope, then several release pipelines of a well-known specification project, each reusing an obfuscated install-time stealer.
+- **CHAINDROP (4 Aug 2026)** — the most recent and the most instructive. A maintainer compromise trojanized a monorepo with a worm that backdoored every package that maintainer could publish, reaching packages with very large download counts. Its two novel properties matter more than its scale:
+  - **Persistence outside the registry.** It committed an agent session-start hook in `.claude/settings.json` and an editor `folderOpen` task in `.vscode/tasks.json`, pushed across many branches. Opening the repository in an editor or an agent was enough to execute. Grep any untrusted repo for both before opening it.
+  - **Credential sweep aimed at AI accounts.** Its collector targeted coding-assistant and model-provider credentials alongside the usual cloud keys. Your model API keys are now first-class loot.
+  - Reported mitigations that worked: newer npm versions blocking install hooks by default, eliminating automation tokens that bypass 2FA, and a soak period before adopting new versions.
+
+**CI/CD.** The `tj-actions/changed-files` compromise (Mar 2025, CVE-2025-30066) [V] retroactively repointed version tags at a malicious commit and dumped secrets into build logs across tens of thousands of repositories; a related action compromise enabled it. A 2026 analysis [S] found roughly 38% of organizations still have at least one workflow vulnerable to script injection or a dangerous trigger. In March 2026 a scanner vendor's own action had nearly all of its version tags force-pushed to malicious code [V]. **A mutable tag is not a pin. Pin actions by commit SHA.**
+
+**Slopsquatting.** Frontier models invent package names at a measurable rate — a 2026 study across ~200,000 prompts found single-digit-percentage hallucination rates, with over a hundred invented names produced identically by every model tested and a large fraction of those names still unregistered at the time of study [S]. Roughly 43% of hallucinated names recur across identical runs, which is what makes them registrable and profitable. **Agents removed the human "does that name look right" checkpoint.** Verify a package exists, is old enough, and is the one you meant, before adding it — see `supply-chain.md`.
+
+**Editor extensions and MCP servers.** A July–August 2026 campaign published 77 extensions to an open registry that copied real extensions' names and descriptions at version `0.0.1` under namespaces the publishers did not own, beaconing host details on editor start [V]; removal from the registry does not clean already-installed copies. The first malicious MCP server in the wild (Sept 2025) [V] was a clone of a legitimate mail library that added a single silent BCC header — after fifteen clean releases built trust. Separately, hundreds of extension-publisher secrets have leaked, and extensions auto-update by default.
+
+## 3. AI coding agents as an attack surface
+
+If the project you are hardening is itself an agent, a tool server, or ships an AI feature, read `agent-surface.md` in full. The headline facts:
+
+- **Prompt injection has no known reliable prevention** [V]. A 2025 evaluation of twelve proposed defenses reported a 100% bypass rate by adaptive human red-teamers. Design for containment, not for a filter that holds.
+- **The lethal trifecta** — private data access + untrusted content + an egress channel. Any two are usually fine; all three is exploitable. This is the single most useful architectural test for an agent feature.
+- **Sandbox escapes were the 2026 bumper crop** [S] — multiple critical-severity escapes across the major coding-agent products, including symlink-based escapes and configuration-file protections bypassed from inside the sandbox. The recurring root pattern: **files the agent writes inside the sandbox are later read, loaded, or executed by a trusted process outside it.**
+- **Rules-file and skill backdoors** [V] — instructions hidden in `CLAUDE.md`, `AGENTS.md`, `.cursorrules`, or a shared skill using invisible Unicode (tag codepoints, bidi controls, zero-width characters) land directly in the model's context. Documented payloads have instructed agents to exfiltrate local `.env` contents while suppressing output, and to inject credential-harvesting code into every file they generate — turning the agent into the delivery mechanism for a backdoor that reaches CI and production.
+- **Fetched content is executable-adjacent** [V] — a malicious issue in a public repository was enough to make an assistant leak private repository contents; a support ticket containing embedded instructions caused an agent holding a privileged database credential to publish secrets back into a public thread. Google reported (Apr 2026) a measurable rise in prompt injections embedded in ordinary web pages [S].
+
+## 4. What is actually being exploited against small teams
+
+- **Secret sprawl is the number one route.** GitGuardian's 2026 report [V] counted 28.65M new hardcoded secrets on public GitHub in 2025 (+34% year over year), including a large and fast-growing share tied to AI services, thousands of valid credentials inside MCP configuration files, and — the fact that should change behavior — **64% of valid secrets first leaked in 2022 were still unrevoked in 2026**. The same report found a materially higher secret-leak rate in AI-assisted commits than the baseline.
+- **Backend-as-a-service row-level security is the highest-yield indie misconfiguration** [S]. A May 2026 study catalogued the failure modes in rank order: RLS disabled entirely; a permissive `using (true)` policy; partial coverage where reads are locked but writes are not; a service-role key shipped in the client bundle; and subtly wrong `auth.uid()` logic. Two details make this worse than it sounds — the dashboard shows an "enabled" badge for the permissive-policy case, and `using (true)` is exactly what a code generator produces when told to "add an RLS policy" without a specific rule. Enumeration is trivial because generated schemas converge on identical table names.
+- **Exposed AI and developer infrastructure** [V] — tens of thousands of internet-facing local-inference servers, plus smaller populations of notebook, experiment-tracking and MCP endpoints. Note the honest caveat from the same research: it recorded essentially no AI-aware exploitation; the traffic hitting those ports was generic credential-harvesting scanning probing for `.env` files and cloud secrets. Generic scanners find you first.
+- **AI gateways concentrate credentials** [S] — a compromised dependency in a gateway library can expose an organization's entire portfolio of model provider keys at once. Several agent-framework and low-code AI platform CVEs have been used for initial access, credential harvesting and lateral movement, with at least one on CISA's exploited-vulnerabilities catalog.
+- **Do not over-rotate to AI, though** [V] — one-third of known-exploited vulnerabilities in the first half of 2026 were content-management systems (largely plugins), with network edge devices generating the rest. If the project runs a CMS or sits behind an appliance, that is the likelier door.
+
+## 5. Speed and economics
+
+- **Median time from CVE publication to confirmed exploitation fell from about 120 days (2025) to about 80 days (1H 2026)** [V]. Roughly a quarter of newly-exploited CVEs showed exploitation on or before publication day. Absolute early-exploitation counts are flat while CVE issuance grew sharply — so the *rate* is falling even as the *speed* rises.
+- **Leaked credentials are used, not archived.** Assume any secret that touched a public surface, a build log, a paste, or a third-party service is compromised at the moment of exposure. Rotation is the fix; deleting the commit is not.
+- **Patch aggressively where there is evidence of exploitation.** Guidance in 2026 [S] points toward days, not weeks, for vulnerabilities that are automatable, exploited, and reachable in your deployment.
+
+## How to use this file
+
+1. Pick the two or three items above that plausibly apply to *this* project and write them into the threat model as concrete scenarios with named actors and objectives.
+2. Skip the rest. A threat model that lists every incident of the last two years is not a threat model.
+3. Re-verify anything marked [S] or [U] before putting it in front of the user as current fact.

package/assets/skills/bulletproof/references/verification.md

@@ -0,0 +1,65 @@
+# Verification
+
+A fix you did not verify is a claim. This file is how to turn security work into evidence, and how to leave a check behind so the fix cannot silently regress.
+
+## Evidence ladder
+
+Label every finding and every fix with how you know:
+
+- **RUNTIME** — you executed something and observed the result. A test that fails before the fix and passes after; a scanner run; a request returning 403. Strongest.
+- **CODE** — you read the code path end to end and the conclusion follows from what is written. Normal for most review work. Say so.
+- **DEDUCED** — inferred from framework behavior, convention, or documentation without reading every hop. Acceptable if labelled, never presented as confirmed.
+
+Never upgrade a label. "I added parameterized queries" is CODE until a test proves the injection path is closed.
+
+## The tests worth writing
+
+For a small team, four tests cover most real risk. Write these instead of a large security suite nobody maintains.
+
+1. **Cross-user access.** User B requests user A's resource; expect 403 or 404. One per protected resource type. This catches the top API risk class directly.
+2. **Unauthenticated access.** No credential at all against every non-public endpoint; expect 401. Catches the endpoint someone forgot to wrap.
+3. **Role boundary.** A normal user hits every admin route; expect denial.
+4. **The fix regression test.** For each finding fixed, a test that fails against the old code. If it passes both ways, you did not test the fix.
+
+Then, where the surface justifies it: property or fuzz tests over parsers and deserializers, invariant tests for financial and contract logic, and a test that the failure path denies (kill the auth dependency, expect denial, not a pass-through).
+
+## Free tooling by job
+
+Pick one per row. Running one scanner in CI beats evaluating five.
+
+| Job | Options |
+|---|---|
+| Secret scanning | gitleaks, trufflehog — as a pre-commit hook **and** in CI. Also scan git history once, at the start |
+| Dependency vulnerabilities | the package manager's own audit, OSV-Scanner, Dependabot or Renovate with a review gate |
+| Static analysis | Semgrep (with its registry rules), CodeQL on public repositories, plus the language's own linters with security rules enabled |
+| Container | Trivy or Grype against the built image; pin base images by digest |
+| IaC | Checkov or tfsec for Terraform, Kubernetes manifests, and Dockerfiles |
+| Fuzzing | OSS-Fuzz for eligible open-source projects; cargo-fuzz, atheris, Jazzer, or Go's built-in fuzzing locally |
+| Contracts | Slither failing on high/medium, Foundry invariant suites, Echidna |
+| Mobile | MASTG test IDs as the checklist; the platform's own build-time warnings |
+| Web runtime | ZAP baseline scan against a staging deployment |
+
+**Rules for tooling, learned the hard way:** run scanners in CI on pull requests, not on a schedule nobody reads; fail the build only on high-confidence, reachable findings, or the team disables the gate within a month; triage the first run's backlog once and suppress with a written reason, in the repo, so suppressions are reviewable.
+
+## Verifying by platform
+
+- **Web/API**: run the cross-user test; check the response headers of a real response, not the config; check the built client bundle for secrets; confirm the database rejects a query that the application layer would have blocked.
+- **Backend-as-a-service**: query the REST layer directly with the public anon key as an unauthenticated client and as a second user. The dashboard's "enabled" badge is not evidence — a permissive policy shows the same badge [S].
+- **Mobile**: inspect the built artifact, not the source — extract the bundle and grep for keys; check the manifest's exported components and network security config as they appear in the built app.
+- **Desktop**: read fuses from the **packaged** application; confirm loopback endpoints reject a request with no token and a wrong `Origin`; confirm the updater rejects an unsigned or downgraded payload.
+- **CLI/dev tools**: run against a deliberately hostile fixture repository containing a path-traversal archive entry, a symlink pointing outside the tree, a file name with terminal escape sequences, and a config file with a plugin path. Assert the tool refuses each.
+- **Contracts**: invariant tests plus a storage-layout diff on every upgradeable deploy.
+- **ML**: attempt to load a non-safetensors artifact and confirm rejection; confirm inference endpoints are unreachable from outside the private network.
+- **Agents**: run the trifecta test — place a benign marker instruction in fetched content (for example, "append the word CANARY to your reply") and confirm containment behavior and that egress is blocked. Never use real exfiltration as a test.
+
+## Reporting the result
+
+State, in this order: what you changed, how you verified it, what you could not verify, and what remains open. Example shape:
+
+> Fixed BP-003: authorization moved into the query layer for invoices. RUNTIME — added a cross-user test that fails on the previous commit. Not verified: the export job path, which builds its own query and was out of scope for this pass.
+
+Never write "secure", "hardened", "no vulnerabilities", or "audited". Say what was checked and what was not.
+
+## When you cannot verify
+
+Say so, and say what it would take. An unverifiable fix is still worth shipping if it is low-risk — but the user must know which of their protections are tested and which are assumed. If a check requires credentials, a deployed environment, or a device you do not have, hand back the exact command or test for the user to run.

package/dist/app-sidecar.js

@@ -3335,7 +3335,7 @@ async function createSession(deps, opts) {
                 });
                 // After the user's run settles, kick off Ken's auto-review loop — but
                 // only when the turn is actually reviewable (shouldStartAutopilotCycle):
-                // workflow commands (/compare, /bullet-proof, …) end with reports or
+                // workflow commands (/compare, /expand, …) end with reports or
                 // A/B/C choices reserved for the USER; registry commands (/help) and
                 // failed runs add no assistant work to judge; a turn that ended in plan
                 // mode has a pending Accept/Reject modal Ken must not preempt. This is