@kensaurus/skills 0.0.0-stage → 2.0.0

package/skills/test-red-team/SKILL.md

@@ -0,0 +1,387 @@
+---
+name: test-red-team
+description: >
+  Red-team a running web, React Native, or Capacitor app. Use when "red team
+  this app", "attack my app", "break it", "find all the defects", "adversarial
+  test", "pentest the app", "pre-launch hardening", or "full app QA". Monkey
+  test → test-exploratory.
+license: MIT
+effort: high
+---
+
+# test-red-team — Adversarial Full-App Defect Sweep
+
+**Degree of freedom: MIXED** — matrix and severity `[HIGH freedom]`; ROE,
+harness, and benign-payload confirmation `[LOW freedom — run exactly]`.
+Web driver is **playwright-cli**. Do not write exploit PoCs into the repo.
+
+A hostile, skeptical pass across UI/UX, data pipeline, security, and
+performance. Default output is a **severity-ranked defect list**, not inline
+fixes (`test-playwright` is the fix-as-you-go PDCA). Offer to fix after the
+report; ask which defects to prioritize.
+Your turn ends with the Phase 7 report and a matrix with no blank cells — each cell PASS, DEFECT, or N-A with a reason — not with the matrix printed and the sweep still owed.
+
+Read `protocol-browser-anti-stall` before any browser action (Rule 0: manual
+& headed) and `references/playwright-session-coordination.md`.
+
+> **Attack through the visible UI, by hand.** One real action at a time.
+> `eval` / CDP / WebView attach may **set a condition** (throttle, kill a
+> request, emulate) or **inspect** — never perform the click/type/submit
+> under test. The defect must be reachable the way a real attacker reaches it.
+
+## This skill vs neighbors
+
+| Skill | Owns |
+|:------|:-----|
+| **test-red-team** (this) | Adversarial feature×dimension matrix; report first |
+| `test-exploratory` | Naive **guest vs authed** wander (do not reclaim) |
+| `test-qa` | Story/CRUD smoke — not a hostile matrix |
+| `test-playwright` | This-diff PDCA + **fixes** |
+| `audit-llm-security` | Product LLM / prompt-injection depth |
+| `test-load` | Concurrency breaking point (not headed UI) |
+| `audit-security` | Static OWASP checklist |
+
+## How to reason (every cell / finding)
+
+1. **Observe** — screenshot + console + network + DB (for mutations)
+2. **Interpret** — reachable defect vs expected deny vs untested (N-A)
+3. **Classify** — PASS / DEFECT / N-A; chain if two cells combine
+4. **Severity** — Critical/High/Medium/Low/Info by impact × likelihood
+
+## Worked example
+
+> **Observe:** User B `GET /api/docs/A-id` → 200 + A's body. `SET ROLE
+> authenticated` + `user_id != auth.uid()` also returns the row.
+> **Interpret:** IDOR; handler has no ownership check.
+> **Classify:** DEFECT (Security / A01). Chain with weak session = takeover.
+> **Severity:** Critical — cross-user data leak.
+> **Evidence:** screenshot + network + SQL. Payload was a read, not a dump/DROP.
+
+---
+
+## Coverage model
+
+This is not a blind DOM crawl (`test-qa`) or an unscripted guest-vs-logged-in wander (`test-exploratory`). Traverse a **coverage matrix**:
+
+```
+feature/capability
+  → surfaces (routes, sub-pages, API endpoints, RPCs, tables)
+    → components + states (forms, tables, modals, empty/error/loading, roles)
+      → 4 attack dimensions: UI/UX · data pipeline · security · performance
+```
+
+Each cell (`feature × surface × component-state × dimension`) is **PASS /
+DEFECT / N-A**. The matrix is the plan and the audit trail.
+
+**Graceful fallback:** no discernible features (pure marketing) → route →
+component structural traversal.
+
+---
+
+## Phase 0: Scope & rules of engagement  [LOW freedom — ROE exact]
+
+### 0a. Detect the stack
+
+`package.json` → framework, auth, ORM, RN/Expo, port.
+`capacitor.config.ts/.json` → Capacitor hybrid.
+`app.json` / `app.config.*` → Expo / RN. `android/` → native Android.
+
+Record: target type (web / RN/Expo / Capacitor / mixed); dev URL/port;
+auth pattern; test credentials (`.env.local`, `.env.test`, README);
+backend MCPs (Supabase, Sentry, Firecrawl).
+
+### 0b. Pick the automation driver
+
+| Target | Driver |
+|--------|--------|
+| Web / PWA / Next.js / SvelteKit / Remix | playwright-cli (`npx --yes @playwright/cli@latest`) |
+| Capacitor WebView on Android emulator | Playwright `_android` WebView attach over ADB (Phase 0c) |
+| Native chrome: system dialogs, sheets, permissions | `adb shell input tap` (`mobile-emulator-test`) |
+| Pure-native iOS/Android (Swift/Kotlin UI) | **Out of scope** — Appium; document as limitation |
+
+### 0c. Capacitor WebView attach (when target includes Capacitor)
+
+**Exception to Rule 0:** a native WebView can't be driven by snapshot-ref
+tools, so attaching is the only option. Once attached, still interact like
+a user — don't script the flow end-to-end.
+
+```javascript
+const { _android } = require('playwright');
+const [device] = await _android.devices();
+// ADB online, Chrome ≥ 87, WebView debuggable
+const webview = await device.webView({ pkg: 'com.your.app.id' });
+const page = await webview.page();
+// standard Playwright Page API — not playwright-cli verbs
+```
+
+Native chrome outside the WebView: `adb shell input tap` with coordinates
+from `adb shell uiautomator dump`.
+
+### 0d. Rules of engagement
+
+- Test data prefixed `RT-TEST-` for cleanup
+- Do NOT mutate production data; ask before any non-reversible operation
+- Confirm with **benign** evidence; no destructive PoCs against real rows;
+  **do not write exploit PoCs into the repo**
+- Secrets by name only — never printed
+
+### 0e. Browser session (before Phases 2–5)
+
+1. Own session — never share or claim another agent's:
+
+```bash
+PW="npx --yes @playwright/cli@latest"
+$PW -s=rt-<app> open --headed --persistent \
+    --profile "$HOME/.playwright-cli-profiles/<app>" "<app-url>"
+```
+
+2. Reuse the signed-in session (`--profile`, or `state-save` /
+   `state-load .playwright-mcp/auth/<host>.json`). Google needs the one-time
+   real-Chrome login in the coordination reference.
+3. Never `close-all` / `kill-all`; close only `-s=rt-<app>` when done.
+4. Do not log out between attack phases unless testing logout/fixation.
+
+---
+
+## Phase 1: Recon & build the coverage matrix  [HIGH freedom]
+
+Build the matrix from source **before** opening the browser.
+
+### 1a. Enumerate features / capabilities
+
+| Source | What to extract |
+|--------|----------------|
+| `src/app/**/page.tsx` (Next.js App Router) | Routes → feature groupings |
+| `src/routes/**/*.tsx` (Remix / RN Router) | Route tree |
+| `features/*/`, `modules/*/`, `src/*/` | Feature boundary names |
+| `supabase/migrations/*.sql`, `prisma/schema.prisma` | Entities + relationships |
+| `src/app/api/**`, `supabase/functions/**` | API endpoints + RPCs |
+| README / feature docs | Business capability names |
+| Nav / sidebar / tab bar | User-visible feature map |
+
+### 1b. For each feature, decompose
+
+```
+Feature: [name]
+  Surfaces: routes/pages, deep links, API/RPCs, DB tables
+  Components + states: default/empty/loading/error/role-A/role-B; forms;
+    modals; file uploads
+  Roles / tenants: anon, user, admin, org-member, …
+  Input surfaces: fields, URL params, query strings, headers, file content
+```
+
+### 1c. Output the matrix
+
+Print before Phases 2–5. Fill ✅ PASS / ❌ DEFECT(#N) / — N-A as you go.
+
+```
+COVERAGE MATRIX
+| Feature   | Surface/Component+State        | UI/UX | Pipeline | Security | Perf |
+|-----------|--------------------------------|-------|----------|----------|------|
+| Auth      | Login form / empty             |       |          |          |      |
+| Auth      | Login form / error             |       |          |          |      |
+| Documents | List / empty · 100+ · create · share/other-user |       |          |          |      |
+```
+
+---
+
+## Phase 2: UI/UX red team (per matrix cell)  [HIGH freedom]
+
+**Driver:** playwright-cli — `goto`, `snapshot`, `screenshot`, `click`,
+`type`, `fill`, `console`, `requests`, `resize`.
+
+| Attack | What to do |
+|--------|-----------|
+| 3-second clarity | Cold navigate. Purpose obvious in 3 s? |
+| Primary action | CTA obvious, above the fold, 1 tap? |
+| Empty / loading / error | Fresh account; throttle (`eval`/CDP); kill API. Human-readable states? |
+| Dead buttons | Every button/link produces a visible response |
+| Form labels | Every `<input>` has a visible label or `aria-label` |
+| Responsive | `resize` 1280×800, 768×1024, 375×812 — no break |
+| Dark mode | Toggle if supported. No white flash / invisible text |
+| Role variant | Same surface as each role — different data/controls |
+| Overflow | 200-char strings, fat numbers — no clip without ellipsis |
+
+`screenshot` every DEFECT. Note the component path if identifiable.
+
+---
+
+## Phase 3: Data pipeline red team (per matrix cell)  [LOW freedom — 3-layer verify]
+
+Every mutation surface (create / update / delete / upload). Verify at
+**(1) UI (2) network (3) DB**. Look up Supabase schemas first, then:
+
+```json
+supabase:execute_sql
+{
+  "query": "SELECT * FROM <table> WHERE <col> LIKE 'RT-TEST-%' ORDER BY created_at DESC LIMIT 10"
+}
+```
+
+RLS (what the client can actually read/write):
+
+```json
+supabase:execute_sql
+{
+  "query": "SET ROLE authenticated; SELECT * FROM <table> WHERE user_id != auth.uid() LIMIT 5"
+}
+```
+
+Also `list_tables`, `query_logs` (`source = 'edge_logs'` or
+`'postgres_logs'`), `get_advisors`.
+Unexpected 5xx, unhandled exceptions, RLS denies, and new ERROR advisors
+are pipeline defects.
+
+| Attack | How |
+|--------|-----|
+| Double-submit dupe | Click submit twice. Duplicate row? |
+| Optimistic-update lie | Submit → immediately check DB. Row landed? |
+| Stale cache | Mutate in one tab, reload the other |
+| Ghost delete | Delete, reload. Reappears? |
+| Race / partial write | Two conflicting mutations; kill network mid-request (`eval` `fetch` override). Consistent? |
+| Idempotency | Replay the same request. Safe? |
+| Relationship integrity | Delete parent. Orphans cleaned or guarded? |
+| Pagination consistency | Create while on page 2. Right position? |
+
+---
+
+## Phase 4: Security red team (per matrix cell, OWASP-mapped)  [HIGH freedom; payloads = LOW]
+
+Full payload tables: `references/owasp-attack-checklist.md`. Confirm with
+**benign** payloads (`document.title='XSS'`, `SELECT 1`) — never `DROP TABLE`,
+never real exfil, **never commit an exploit PoC**.
+
+Priority (highest real-world impact first):
+
+| # | Class (OWASP) | Key test |
+|---|---------------|----------|
+| 1 | Authorization / IDOR (A01) | User B reads/mutates User A's resource by ID; verify at DB with `SET ROLE authenticated` |
+| 2 | Authentication (A07) | Reset-token reuse, session fixation, JWT tampering, missing lockout |
+| 3 | Injection (A03) | XSS / SQLi / path traversal in every input — benign confirm only |
+| 4 | Sensitive data (A02) | API leaks `password`/`token`/PII? Tokens in `localStorage`? Env in bundle? |
+| 5 | Security headers | Missing CSP, HSTS, `X-Content-Type-Options`, `X-Frame-Options`, `Referrer-Policy` |
+| 6 | Capacitor MASVS | `allowUniversalAccessFromFileURLs`? Unvalidated bridge? XSS → native plugin? |
+
+Correlate with Sentry (401/403/CSP, last 30 days) and current OWASP via Firecrawl.
+
+---
+
+## Phase 5: Performance red team (per matrix cell)  [HIGH freedom; throttle setup = LOW]
+
+Condition-setup only — then drive load/scroll/submit by hand.
+
+```javascript
+const client = await page.context().newCDPSession(page);
+await client.send('Network.emulateNetworkConditions', {
+  offline: false, downloadThroughput: 50 * 1024 / 8,
+  uploadThroughput: 20 * 1024 / 8, latency: 300
+});
+```
+
+Capacitor/Android: `adb shell tc qdisc add dev wlan0 root netem delay 300ms`.
+
+| Attack | What to look for |
+|--------|-----------------|
+| Cold load (hard refresh) | TTI > 3 s on simulated 3G? Layout shift? |
+| Large list (50+) | Scroll jank? Virtualize or render all nodes? |
+| Pagination / infinite scroll | Dupes or missing items at the boundary? |
+| Payload size | `requests` → list response > 500 KB? |
+| Memory growth | Large list, scroll bottom↔top × 5. Unbounded heap? |
+| Simultaneous requests | Rapid nav. Loading-state races? |
+| Supabase N+1 | `query_logs` on `source = 'postgres_logs'` after the feature. Repeated identical queries? |
+
+Same `get_advisors` as Phase 3: missing indexes, seq scans, bloated RLS =
+Medium–High perf defects.
+
+---
+
+## Phase 6: Finding-chaining & triage  [HIGH freedom]
+
+Scan DEFECT cells for chains before the report:
+
+- Two Mediums often combine into High/Critical (reflected input + missing
+  CSP = stored XSS).
+- Auth weakness + IDOR = account takeover.
+- Stale cache + no optimistic revert = silent corruption.
+
+| Field | Options |
+|-------|---------|
+| Severity | Critical / High / Medium / Low / Info |
+| Likelihood | High (trivial) / Medium (needs access) / Low (theoretical) |
+| Impact | Data loss / takeover / PII leak / UX degradation / perf SLA |
+| Affected component | `src/components/Foo.tsx`, `supabase/functions/bar`, … |
+| Remediation | File/function-level fix, not vague advice |
+
+---
+
+## Phase 7: Defect report (the deliverable)  [LOW freedom — this shape]
+
+```markdown
+## Red-Team Defect Report — [App / Repo] — [Date]
+
+### Scope
+- Target type: [web | RN | Capacitor | mixed]
+- Dev URL: [...]  Auth: [...]
+- Features red-teamed: [list]
+- Coverage matrix: [link or inline]
+
+### Critical Defects (fix before any release)
+| # | Feature | Surface / Component+State | Finding | Evidence | File | Remediation |
+|---|---------|--------------------------|---------|----------|------|-------------|
+| 1 | Auth | Login / error | IDOR: B reads A via GET /api/docs/:id | Screenshot+network | src/app/api/docs/[id]/route.ts | `WHERE user_id = auth.uid()` |
+
+### High / Medium / Low / Info
+Same columns. Group by severity.
+
+### Attack chains identified
+1. [Finding #N] + [Finding #M] → [combined impact and path]
+
+### Coverage matrix (final)
+| Feature | Surface/Component+State | UI/UX | Pipeline | Security | Perf |
+|---------|------------------------|-------|----------|----------|------|
+
+### Backend truth-check
+- Sentry: [new/related — count + highest severity]
+- Supabase: [advisors, logs, RLS results]
+
+### Launch-readiness verdict
+**Ready / Ready after Critical fixes / Not ready** — [2-sentence justification]
+
+### Test data cleanup
+- RT-TEST-* rows deleted: [Y/N / N-A]
+```
+
+## Self-critique before reporting  [LOW freedom — do not skip]
+
+1. **No exploit PoC** — benign confirm only; nothing committed to the repo
+2. **Every DEFECT evidenced** — screenshot + console + network (+ DB for mutations)
+3. **Untested ≠ PASS** — untested cells are N-A with why
+4. **Right owner** — guest wander → `test-exploratory`; LLM inject →
+   `audit-llm-security`; load → `test-load`
+5. **Report first** — fix only after the user picks Critical/High
+
+---
+
+## Guardrails
+
+1. **Manual & headed, never scripted** — attack through the visible UI;
+   code execution is condition-setup/inspection only; no `*.spec.ts`, no
+   `npx playwright test`.
+2. **Anti-stall always** — never block >3 s; max 4 attempts; `[TIMEOUT]` and move on.
+3. **Evidence for every DEFECT** — screenshot + console + network + DB.
+   "It looked broken" is not a defect.
+4. **No destructive PoCs** — benign payloads only; never `DROP TABLE` or
+   real exfil; do not write exploit PoCs into the repo.
+5. **Ask before mutating production rows** — requested DDL may ship;
+   `DELETE`/`UPDATE`/`TRUNCATE` on real prod data asks first.
+6. **Secrets by name only.**
+7. **Honest verdict** — untested cells are N-A, not PASS.
+8. **Offer to fix after the report** — then `test-playwright` PDCA.
+9. **MCP schemas first** — read the server's tool schema before any MCP call.
+10. **Pure-native iOS/Android out of scope** — say so in the report.
+
+## Related
+
+- `audit-llm-security` — product LLM / prompt-injection depth
+- `test-load` — concurrency breaking point (not a headed UI attack)
+- `test-playwright` / `test-qa` / `audit-security` / `iterate-post-launch`

package/skills/test-red-team/references/owasp-attack-checklist.md

@@ -0,0 +1,193 @@
+# OWASP Attack Checklist & Payload Library
+
+Reference for Phase 4 (Security red team) of `test-red-team`. Load this file
+when you need exhaustive payloads or the full OWASP mapping table.
+
+---
+
+## OWASP Top 10:2021 — Red-team mapping
+
+IDs follow the 2021 edition; check https://owasp.org/www-project-top-ten/ for
+the current edition before citing an ID.
+
+| ID | Name | Red-team action |
+|----|------|----------------|
+| A01 | Broken Access Control | IDOR, tenant-boundary, privilege escalation, RLS bypass |
+| A02 | Cryptographic Failures | PII in responses/localStorage, HTTP vs HTTPS, weak token entropy |
+| A03 | Injection | XSS, SQLi, template injection, path traversal, SSRF |
+| A04 | Insecure Design | Business-logic abuse, workflow skip, missing rate limits |
+| A05 | Security Misconfiguration | Security headers, CORS, error messages leaking stack traces |
+| A06 | Vulnerable Components | `npm audit`, outdated deps with known CVEs |
+| A07 | Auth Failures | Brute force, session fixation, JWT tampering, account takeover |
+| A08 | Software & Data Integrity | Supply-chain, unverified file uploads, unsafe deserialization |
+| A09 | Logging Failures | Sentry blind spots, missing audit logs for sensitive actions |
+| A10 | SSRF | URLs in user input used for backend fetch |
+
+---
+
+## XSS payloads (confirm with benign effect only)
+
+```
+<script>document.title='XSS-CONFIRM'</script>
+<img src=x onerror="document.title='XSS-CONFIRM'">
+<svg onload="document.title='XSS-CONFIRM'">
+javascript:document.title='XSS-CONFIRM'
+"><script>document.title='XSS-CONFIRM'</script>
+' onmouseover='document.title="XSS-CONFIRM"
+{{constructor.constructor('document.title="XSS-CONFIRM"')()}}
+${7*7}                          (template literal check — expect 49)
+<%= 7*7 %>                      (ERB / EJS check)
+#{7*7}                          (Ruby ERB)
+```
+
+A hit is confirmed when: the injected string appears un-escaped in the DOM,
+`document.title` changes, or the expression is evaluated server-side (49 appears).
+Never use `alert()` — use `document.title` to avoid browser popups.
+
+---
+
+## SQL injection probes (safe read-only)
+
+```
+'                               (single quote — triggers syntax error)
+' OR '1'='1                     (classic always-true)
+' OR 1=1--                      (comment-out rest of query)
+'; SELECT pg_sleep(2)--         (time-based blind — expect 2s delay)
+' UNION SELECT null,null--      (column count probe)
+" OR ""="                       (double-quote variant)
+\x00                            (null byte)
+1; DROP TABLE users--           (never actually run — shows intent, blocked by parameterized queries)
+```
+
+Confirm by: syntax error in response, unusual delay (blind SQLi), unexpected
+data in response. A parameterized-query app will return a normal 400/422.
+
+---
+
+## Path traversal probes
+
+```
+../../etc/passwd
+..%2F..%2Fetc%2Fpasswd
+....//....//etc/passwd
+%2e%2e%2f%2e%2e%2fetc%2fpasswd
+/etc/passwd%00.jpg              (null byte truncation for file ext bypass)
+```
+
+---
+
+## SSRF probes (for URL-accepting inputs)
+
+```
+http://localhost/
+http://127.0.0.1/
+http://169.254.169.254/latest/meta-data/   (AWS metadata)
+http://metadata.google.internal/
+http://[::1]/
+file:///etc/passwd
+```
+
+---
+
+## Authentication attack checklist
+
+- [ ] Password reset token entropy: generate 2 reset tokens, are they sequential/guessable?
+- [ ] Password reset token reuse: use the same token twice — second use must be rejected.
+- [ ] Password reset token expiry: wait >15 min, use old token — must be expired.
+- [ ] Login brute force: 10 rapid attempts with wrong password — rate limit or lockout?
+- [ ] JWT `alg: none` bypass: send JWT with `"alg":"none"` and no signature.
+- [ ] JWT secret: try weak secrets (`secret`, `password`, `changeme`) via jwt.io debugger.
+- [ ] JWT payload tampering: decode, change `role` to `admin` or `user_id` to another user.
+- [ ] Session cookie flags: `HttpOnly`, `Secure`, `SameSite=Strict`/`Lax` required.
+- [ ] Token storage: tokens must NOT be in `localStorage` (XSS-accessible); use HttpOnly cookies.
+- [ ] OAuth state: state param present, validated server-side (CSRF protection for OAuth).
+
+---
+
+## IDOR test procedure (per resource type)
+
+1. Create resource as **User A** (get its ID from the response or URL).
+2. Log in as **User B** (different account, same or lower role).
+3. Access the resource directly:
+   - `GET /api/resource/<id>`
+   - `PUT /api/resource/<id>` with modified payload
+   - `DELETE /api/resource/<id>`
+4. Expected: 404 or 403. **DEFECT** if: data returned, mutation succeeds, or
+   error leaks the resource exists (200 with "not found" message = info leak).
+5. Verify at DB: `SELECT * FROM resource WHERE id = '<id>'` — should be User A's row.
+
+---
+
+## Tenant-boundary test procedure (multi-tenant apps)
+
+1. Create records in **Org A** context.
+2. Switch to **Org B** context (URL param, header, or UI switcher).
+3. Navigate to the same feature. **DEFECT** if Org A's data is visible.
+4. Directly call the API with Org A's resource IDs while authenticated as Org B user.
+5. Verify RLS via Supabase MCP: `SET ROLE authenticated; SET LOCAL request.jwt.claims = '{"sub":"<org_b_user_id>","role":"authenticated"}'; SELECT * FROM org_resources WHERE org_id = '<org_a_id>'` — must return 0 rows.
+
+---
+
+## File upload attack checklist
+
+- [ ] Upload a file with a `.php`, `.js`, `.py`, `.sh` extension. Expect rejection.
+- [ ] Upload an SVG with embedded `<script>`. If served back, XSS vector.
+- [ ] Upload a file with MIME type `text/html` but `.jpg` extension (MIME sniffing).
+- [ ] Upload a 100 MB file. Expect file-size rejection, not server crash.
+- [ ] Upload a ZIP bomb (if archive uploads accepted).
+- [ ] Upload a file with a path-traversal filename: `../../evil.sh`.
+- [ ] Upload a valid image with embedded EXIF data containing XSS payload.
+
+---
+
+## Security headers checklist
+
+| Header | Required value | Defect if missing/wrong |
+|--------|---------------|------------------------|
+| `Strict-Transport-Security` | `max-age=31536000; includeSubDomains` | High |
+| `Content-Security-Policy` | Specific directives, not `default-src *` | High |
+| `X-Content-Type-Options` | `nosniff` | Medium |
+| `X-Frame-Options` | `DENY` or `SAMEORIGIN` | Medium |
+| `Referrer-Policy` | `strict-origin-when-cross-origin` or stricter | Low |
+| `Permissions-Policy` | Restrict unnecessary browser features | Low |
+| `CORS Access-Control-Allow-Origin` | Must NOT be `*` for authenticated endpoints | High |
+
+---
+
+## MASVS-PLATFORM checks (Capacitor / hybrid apps)
+
+| Control | MASVS ID | What to check |
+|---------|----------|--------------|
+| WebView allows all file access | MASVS-PLATFORM-2 | `allowFileAccessFromFileURLs`, `allowUniversalAccessFromFileURLs` in `AndroidManifest.xml` / `MainViewController.swift` — must be false |
+| JavaScript enabled on untrusted content | MASVS-PLATFORM-2 | WebView that loads remote URLs must not also bridge to native file system |
+| JS-to-native bridge exposed | MASVS-PLATFORM-2 | All Capacitor plugins must validate input before calling native APIs |
+| Deep-link scheme abuse | MASVS-PLATFORM-1 | Can an external app trigger a deep link with crafted params? Validate all deep-link params. |
+| Exported activities | MASVS-PLATFORM-1 | `android:exported="true"` activities must not expose sensitive functionality |
+| Screenshot prevention | MASVS-PLATFORM-3 | `FLAG_SECURE` set for screens showing PII? |
+| Keyboard cache | MASVS-PLATFORM-3 | Password fields use `inputType=textPassword` (disables autocorrect cache) |
+| Clipboard leakage | MASVS-PLATFORM-3 | Sensitive fields should not be copyable |
+
+---
+
+## Performance benchmark thresholds
+
+| Metric | Target | DEFECT threshold |
+|--------|--------|-----------------|
+| Time to First Byte (TTFB) | < 200 ms | > 600 ms = High |
+| Largest Contentful Paint (LCP) | < 2.5 s | > 4 s = High |
+| Cumulative Layout Shift (CLS) | < 0.1 | > 0.25 = Medium |
+| Total Blocking Time (TBT) | < 200 ms | > 600 ms = High |
+| API response (list endpoint) | < 300 ms | > 1000 ms = Medium |
+| API response (single item) | < 100 ms | > 500 ms = Medium |
+| JS bundle (initial) | < 200 KB gzip | > 500 KB = Medium |
+| Largest single network payload | < 500 KB | > 1 MB = Medium |
+
+Measure LCP/CLS with:
+```javascript
+// eval
+const entries = performance.getEntriesByType('paint');
+const lcp = await new Promise(resolve => {
+  new PerformanceObserver(list => resolve(list.getEntries().at(-1)?.startTime))
+    .observe({ type: 'largest-contentful-paint', buffered: true });
+});
+```