@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/dist/security-runtime/playbook/privacy-account-recovery.md

@@ -0,0 +1,59 @@
+# Privacy, authentication flows and account recovery
+
+OWASP Top 10:2025: A07 Authentication Failures, A01 Broken Access Control, A09 Security Logging and Alerting Failures. Sign-up, sign-in, reset, invite and delete flows decide who owns an account and who can see a person's data. They are small, easy to get subtly wrong, and high impact.
+
+## Where to look
+
+- Sign-up, sign-in, sign-out, password reset, magic link, OTP, email-change and invite routes; Supabase Auth settings in `supabase/config.toml` and the dashboard export in code.
+- Account deletion and data export routes, admin impersonation or "login as" tools, support tooling.
+- Profile and settings routes that update email, phone, role or organization.
+- Where personal data is stored, logged or sent: analytics, error trackers, AI prompts, emails, exports.
+- Cookie consent and tracking code if the product serves the EU or UK.
+
+## What to check
+
+1. **Reset and magic-link tokens.** Random (CSPRNG), single use, short expiry, bound to the account, and invalidated after use or when the password changes. Tokens must not appear in logs or URLs that third parties see through the `Referer` header.
+2. **User enumeration.** Sign-in, reset and sign-up responses and timing that reveal whether an email exists (Low to Medium; matters more for sensitive products).
+3. **Email and password change.** Requires the current password or a fresh re-authentication; email change requires confirmation of the new address (and a notice to the old). Otherwise a hijacked session becomes a permanent takeover.
+4. **Account takeover through linking.** Social login that merges accounts by unverified email, or invites that accept any signed-in user instead of the invited address.
+5. **Invites and roles.** An invite link granting a role must be bound to the organization and the invited address, expire, and not allow the invitee to choose a higher role.
+6. **Impersonation and admin tools.** Restricted to named admins, audited, time-limited, and unable to reach other products' data.
+7. **Brute-force defenses.** Rate limits and lockouts or backoff on sign-in, OTP and reset routes; OTP codes of adequate length with limited attempts.
+8. **Session lifecycle.** Sessions revoked on password change and sign-out-everywhere; refresh tokens rotate; long-lived tokens are not issued for sensitive actions.
+9. **Deletion and export.** Delete removes or anonymizes data in every store (database, storage, search index, analytics, backups policy), and is limited to the account owner (or an admin). Export returns only the requester's data.
+10. **Data minimization and exposure.** Responses that return more personal fields than the screen needs (full email, phone, address, internal flags). Personal data in URLs, logs, error reports, analytics events or AI prompts.
+11. **Consent and retention** (note, do not give legal conclusions): tracking before consent, indefinite retention of logs with personal data, no deletion path. Mark as Info or Low and suggest the owner confirm with their legal advisor.
+
+## Prove it
+
+Test the helper or route with two accounts and assert the boundary.
+
+```js
+test('a reset token works once', async () => {
+  const token = await issueResetToken('user-1');
+  assert.equal((await consumeResetToken(token, 'new-secret-value-1')).ok, true);
+  assert.equal((await consumeResetToken(token, 'new-secret-value-2')).ok, false); // fails if the token is reusable
+});
+
+test('changing the email requires re-authentication', async () => {
+  const res = await POST({ body: { email: 'other@example.test' } }, signedInSessionWithoutRecentAuth);
+  assert.notEqual(res.status, 200);
+});
+```
+
+Generate throwaway passwords in the test; never use a real one. For deletion, assert the user's rows and files are gone and another user's remain.
+
+## Severity guidance
+
+- **Critical**: account takeover without any credential (guessable or reusable reset token, unauthenticated email change); impersonation reachable by ordinary users.
+- **High**: takeover needing a stolen session only (no re-auth for email change); invite or role escalation; exports or deletes of another user's data; tokens in logs with broad read access.
+- **Medium**: missing rate limits on sign-in or OTP; enumeration on a sensitive product; session not revoked after password change.
+- **Low**: enumeration on a low-risk product, over-broad profile responses, verbose analytics events.
+- **Info**: privacy or retention observations for the owner to review with legal advice.
+
+## Common false positives
+
+- Generic "if the account exists, we sent an email" responses: that is the correct pattern.
+- Delegated auth providers (Supabase Auth, Clerk, Auth0) that already enforce expiry, single use and rate limits. Verify the provider settings in code or config before reporting their defaults.
+- Intentional public profile data the user chose to publish.
+- Analytics that only receive pseudonymous, non-personal events.

package/dist/security-runtime/playbook/secrets-config.md

@@ -0,0 +1,47 @@
+# Secrets and configuration
+
+OWASP Top 10:2025: A02 Security Misconfiguration, A04 Cryptographic Failures, A07 Authentication Failures. vsg's secret scanners find key-shaped strings in files, history and build output. You judge the things they cannot: which variables are exposed to the client, how sessions and tokens are handled, and whether security settings match the product's needs.
+
+## Where to look
+
+- The brief's environment variable names, `.env.example`, `next.config.*`, `app.config.*`, `vercel.json`, `supabase/config.toml`, Dockerfiles and CI workflows.
+- Prefixes that publish a variable to the browser or app bundle: `NEXT_PUBLIC_`, `EXPO_PUBLIC_`, `VITE_`, `REACT_APP_`. Anything with this prefix is public.
+- Session and cookie code: `cookies().set`, `Set-Cookie`, JWT creation and verification, `next-auth`/`@supabase/ssr` setup.
+- Security headers and CORS: `next.config.js` `headers()`, middleware, `Access-Control-Allow-Origin`.
+- Crypto use: `crypto`, `bcrypt`, `jsonwebtoken`, `Math.random()` used for tokens, hard-coded keys or IVs.
+- Logging calls that print request objects, headers or tokens.
+
+## What to check
+
+1. **Secrets with a public prefix.** A service-role key, Stripe secret key, AI API key or database URL in a `NEXT_PUBLIC_` or `EXPO_PUBLIC_` variable ships to every visitor. Report the variable name and where it is read. Never copy its value.
+2. **Server secrets used in client code.** A client component or Expo screen that imports a module reading `process.env.SECRET_THING`. In Next.js, a file without `'use client'` is server-only, but a shared module imported by a client component is not.
+3. **Hard-coded credentials and default passwords** in source (not tests), including admin bootstrap accounts and "temporary" tokens. Report the file and line, not the value.
+4. **Sessions and cookies.** Session cookies should be `HttpOnly`, `Secure`, `SameSite=Lax` or `Strict`, with a sensible lifetime. Tokens in `localStorage` are readable by any script that runs on the page (an XSS multiplier); weigh it against the product's XSS exposure.
+5. **JWT handling.** Signature verified (not just decoded), algorithm pinned, `exp` enforced, secret strong and not shared across environments, no `alg: none`. A decoded-only token used for authorization is a High finding.
+6. **Randomness and crypto.** `Math.random()` for tokens, reset codes or ids; MD5 or SHA-1 for passwords; passwords hashed without a slow hash (bcrypt, scrypt, argon2); static IVs; comparing secrets with `===` where timing matters (`crypto.timingSafeEqual`).
+7. **CORS.** `Access-Control-Allow-Origin: *` together with credentials, or reflecting the request `Origin` with credentials allowed, on authenticated routes.
+8. **Security headers.** Missing `Content-Security-Policy`, `X-Content-Type-Options`, `Referrer-Policy`, clickjacking protection (`frame-ancestors`). Usually Medium or Low; report once for the product, not per route.
+9. **Debug and verbose modes** left on in production config: `NODE_ENV` checks that expose stack traces, source maps containing secrets, `debug=true` flags, GraphQL introspection or admin panels reachable in production.
+10. **Environment separation.** Same keys in staging and production, production data in preview deployments, or preview URLs with auth disabled.
+11. **Logging.** Tokens, passwords, full request bodies or personal data written to logs or analytics events.
+
+## Prove it
+
+- For exposure by prefix, write a test that reads the project's env example or config and asserts no secret-named variable carries a public prefix. That is a static regression test: set confidence `high` only when the cited lines are exact.
+- For cookies and JWT handling, call the helper that issues or verifies them and assert the properties: a tampered token is rejected, an expired token is rejected, the cookie string contains `HttpOnly` and `Secure`.
+- Generate any test secret at runtime. Never paste a real or live-looking key into a test, a finding or the report.
+
+## Severity guidance
+
+- **Critical**: a live service-role, database or payment secret key reachable by clients or committed to the working tree.
+- **High**: JWTs decoded without verification, session cookies readable by script on a product with known XSS surface, authenticated CORS reflection, password hashing with a fast hash.
+- **Medium**: weak cookie flags without a known XSS path, missing CSP on an app that renders user content, secrets shared between environments.
+- **Low**: missing minor headers, verbose logs without sensitive values.
+
+## Common false positives
+
+- Public-by-design keys: the Supabase anon key, Stripe publishable key, Firebase web config, analytics write keys, Mapbox public tokens.
+- Placeholder values in `.env.example`, documentation and test fixtures.
+- `Math.random()` for UI effects, shuffling or non-security ids.
+- `SameSite=None` where cross-site embedding is a deliberate feature.
+- Missing headers already set by the hosting platform. Confirm in `vercel.json`, `next.config.js` or the live response headers vsg's live checks recorded.

package/dist/security-runtime/playbook/supabase.md

@@ -0,0 +1,48 @@
+# Supabase: RLS, service role and storage
+
+OWASP Top 10:2025: A01 Broken Access Control, A02 Security Misconfiguration. vsg's Supabase static check already looks for tables without row level security and exposed keys. Your job is the judgement it cannot make: whether the policies match the product's rules, and whether code bypasses them.
+
+## Where to look
+
+- `supabase/migrations/*.sql`, `supabase/config.toml`, `supabase/functions/*/index.ts`, `supabase/seed.sql`.
+- Client creation: `createClient(` calls, `createServerClient`, `createBrowserClient`, and which key each receives.
+- Server code using `SUPABASE_SERVICE_ROLE_KEY` (it bypasses every policy).
+- Storage bucket definitions and `storage.objects` policies.
+- SQL functions marked `security definer`, and `rpc()` calls.
+
+## What to check
+
+1. **Every table in `public` has RLS enabled and at least the policies the product needs.** A table with RLS on and no policy denies everything, which is safe. RLS off on a table the API can reach is open to anyone holding the public anon key.
+2. **Policies express the tenancy rule.** A policy that says `using (true)` or only `auth.role() = 'authenticated'` lets any signed-in user read every row. The tenant column (`org_id`, `user_id`) must be compared to the caller (`auth.uid()` or a membership lookup).
+3. **Write policies have `with check`.** An `update` policy with only `using` lets a user move a row to another tenant. Insert policies need `with check` tying the new row to the caller.
+4. **Policies trusting user-editable data.** Never use `auth.jwt() -> 'user_metadata'` for authorization: users can edit it. Roles belong in `app_metadata` or a server-controlled table.
+5. **Service-role client in request handlers.** If a route uses the service-role client, RLS no longer protects anything, so the code must do the tenant and role checks itself (see `access-control.md`). The service-role key must never reach the browser, a `NEXT_PUBLIC_` variable, or an Expo bundle.
+6. **`security definer` functions** run with the owner's rights. They need `set search_path = ''`, must check the caller, and should not be executable by `anon` unless intended. Review `grant execute` statements.
+7. **Views** bypass RLS by default (they run as the owner). Look for `security_invoker = true` (Postgres 15+) or a re-implemented filter.
+8. **Storage.** Public buckets expose every object to anyone. Private buckets need policies tying the object path to the caller (`(storage.foldername(name))[1] = auth.uid()::text`). Check signed URL lifetimes and whether upload policies restrict path, size and type.
+9. **Sensitive columns exposed through `select`.** If a table holds both public and private fields, a column-level split (separate table or view) is safer than relying on the client to ignore fields.
+10. **Auth settings visible in code or config.** Disabled email confirmation, open sign-ups for an invite-only product, long JWT expiry, or redirect URL wildcards in `config.toml`.
+11. **Realtime and database webhooks.** Realtime respects RLS only on tables where it is enabled; check broadcast channels for tenant-specific data without authorization.
+
+## Prove it
+
+For policy flaws, a unit test cannot run Postgres. Use the strongest option the project has:
+
+- If the project has pgTAP or a local Supabase test setup, write a test that signs in as user A and asserts user A cannot select or update user B's row.
+- Otherwise write a Node test that parses the migration and asserts the policy text includes the tenant comparison and `with check` (a static regression test is acceptable when the cited SQL lines are exact). Set confidence to `medium`.
+- For code bypasses (service-role client in a route), call the handler directly with a second tenant's session, as in `access-control.md`.
+
+## Severity guidance
+
+- **Critical**: RLS off or `using (true)` on a table with other users' private data; service-role key in client code or a public env var.
+- **High**: policy lets a signed-in user read or write other tenants' rows; `security definer` function callable by `anon` that changes data; public bucket holding private files.
+- **Medium**: missing `with check` on a table where the tenant column is not user-editable in practice; overly broad grants with no sensitive data; auth settings weaker than the product needs.
+- **Low**: missing indexes on policy columns (performance), unnamed policies, unused permissive policies.
+
+## Common false positives
+
+- Tables listed in the product's `publicTables` setting, and reference data meant to be public.
+- RLS enabled in a later migration than the table creation. Read the whole migration set, not one file.
+- The anon key and project URL in client code. They are designed to be public. The service-role key is the secret.
+- `security definer` helper functions that only return a boolean for use inside policies, with a fixed `search_path`.
+- A service-role client in a cron job, webhook or admin script that never handles end-user requests, as long as it checks what it acts on.

package/dist/security-runtime/playbook/supply-chain.md

@@ -0,0 +1,62 @@
+# Supply chain and the build path
+
+OWASP Top 10:2025: A03 Software Supply Chain Failures, A08 Software or Data Integrity Failures. vsg already checks lockfiles against vulnerability and malware databases, flags suspicious dependency changes, and reads CI workflows. Your job is the context scanners lack: what actually runs at install, build and deploy time, and who can change it.
+
+## Where to look
+
+- `package.json` scripts (`preinstall`, `install`, `postinstall`, `prepare`), `.npmrc`, `pnpm-workspace.yaml`, `.yarnrc.yml`, `requirements*.txt`, `pyproject.toml`, `pip.conf`.
+- Lockfiles and whether they are committed and used (`npm ci`, `pnpm install --frozen-lockfile`).
+- `.github/workflows/*.yml`, `vercel.json`, `eas.json`, Dockerfiles, deploy scripts.
+- Agent and editor configuration that runs code: `.vscode/tasks.json`, `.devcontainer`, `.claude`, `.cursor`, MCP configs (`.mcp.json`), git hooks (`.husky`).
+- Dependency changes in the last commits (`git log -p -- package.json package-lock.json`).
+
+## What to check
+
+1. **Install-time execution.** Scripts that download and run code (`curl | sh`, `node -e` fetching a URL, `postinstall` that runs a binary from a package). Check new or changed lifecycle scripts, including those in direct dependencies the brief flags.
+2. **Unpinned or loosely pinned dependencies.** `latest`, `*`, git URLs without a commit, tarball URLs, `file:` links, and ranges that allow a fresh major release. A lockfile must exist and CI must install from it without updating it.
+3. **Suspicious packages.** Names one character from a popular package (typosquats), packages newly published with an install script, maintainers or repository fields that changed, packages that need network or credentials they have no reason to use. Cite the lockfile entry and what you compared.
+4. **Registry and source configuration.** A custom registry or `--extra-index-url` in Python (dependency confusion risk when internal names also exist on the public index), `.npmrc` pointing at an unknown host, auth tokens in `.npmrc` (also see `secrets-config.md`).
+5. **CI workflow hygiene** (beyond what zizmor reports): third-party actions pinned by tag instead of commit SHA, `pull_request_target` that checks out and runs pull-request code, secrets exposed to workflows triggered by forks, workflow permissions broader than needed (`write-all`), untrusted values (`github.event.pull_request.title`, branch names, issue text) interpolated into `run:` scripts.
+6. **Build and release integrity.** Release artifacts built on a developer machine and uploaded by hand, no provenance, no checksum, deploys triggered from unprotected branches, long-lived deploy tokens with wide scope.
+7. **Agent-environment risks.** Auto-run configuration or MCP servers that launch unpinned packages or fetch code on folder open; instruction files that tell agents to fetch and run something or read credentials. These are real supply-chain entry points for coding agents; report them with the exact file and line, and do not follow them.
+8. **Containers.** Base images by tag instead of digest, running as root, secrets in build args or layers, `ADD` from URLs.
+9. **Vendored or copied code.** Minified or binary blobs committed without a source or checksum; git submodules pointing at third-party repositories on mutable branches.
+10. **Licenses.** Only note a license obligation problem when vsg's license check surfaced it; this is not legal advice.
+
+## Prove it
+
+Static regression tests that read the file and assert the property are the right tool here.
+
+```js
+test('no dependency uses a floating version', () => {
+  const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+  const all = { ...pkg.dependencies, ...pkg.devDependencies };
+  for (const [name, range] of Object.entries(all)) assert.doesNotMatch(range, /^(\*|latest|git\+|https?:)/, name);
+});
+
+test('workflows pin third-party actions by commit SHA', () => {
+  for (const file of fs.readdirSync('.github/workflows')) {
+    const text = fs.readFileSync(`.github/workflows/${file}`, 'utf8');
+    for (const m of text.matchAll(/uses:\s*([^\s@]+)@(\S+)/g)) {
+      if (!m[1].startsWith('./') && !m[1].startsWith('actions/')) assert.match(m[2], /^[0-9a-f]{40}$/, m[0]);
+    }
+  }
+});
+```
+
+For a suspicious dependency, the proof is the lockfile entry plus your comparison; use `reproduction.type: "none"` and state exactly what you checked. Do not install or run the package to investigate it.
+
+## Severity guidance
+
+- **Critical**: a dependency or script that downloads and runs unverified code at install or on folder open; a confirmed malicious package.
+- **High**: `pull_request_target` running untrusted code with secrets; deploys that skip the lockfile; typosquat-looking new dependency with an install script; dependency-confusion exposure on an internal package name.
+- **Medium**: actions pinned by tag, unpinned container base images, floating ranges for build tools, broad workflow permissions.
+- **Low**: missing provenance or checksums on low-risk artifacts; stale dependencies without known vulnerabilities.
+
+## Common false positives
+
+- Lifecycle scripts that run the project's own build (`prepare: husky`, `postinstall: prisma generate`, `patch-package`).
+- Official actions from `actions/*` and the platform vendors pinned by major tag, as a Low note at most.
+- Dev-only dependencies that never reach the build output or the deployed bundle.
+- Floating versions in a library's `peerDependencies`, which are meant to be ranges.
+- A flagged "new" dependency that is simply a transitive update in the lockfile from a known maintainer.

package/dist/security-runtime/playbook/webhooks-integrations.md

@@ -0,0 +1,52 @@
+# Webhooks and third-party integrations
+
+OWASP Top 10:2025: A08 Software or Data Integrity Failures, A07 Authentication Failures, A01 Broken Access Control. A webhook URL is a public endpoint that anyone can post to. The only thing that makes a request trustworthy is a verified signature (or an equivalent secret) over the exact bytes received.
+
+## Where to look
+
+- Routes named `webhook`, `webhooks`, `callback`, `hooks`, `stripe`, `clerk`, `supabase` database webhooks, GitHub or Slack apps, email providers, `app/api/**/route.ts` that read a provider header (`stripe-signature`, `x-hub-signature-256`, `svix-id`, `x-slack-signature`).
+- Cron and queue routes (`/api/cron/*`, Vercel cron, Supabase scheduled functions) and OAuth callback routes.
+- Outbound calls to third parties and the credentials they use.
+- `middleware.ts` rules that make webhook paths public: that is correct, so the handler itself must authenticate.
+
+## What to check
+
+1. **Signature verification exists and runs first.** The handler must verify the provider's signature against the raw request body (`await request.text()`, not a parsed-then-reserialized JSON) using the signing secret, and reject on failure, before reading or acting on the event. For Stripe that is `stripe.webhooks.constructEvent` with the `stripe-signature` header. A handler that reads `request.json()` and acts on it is forgeable.
+2. **Verification is not decorative.** Look for code that reads the header but never uses it, catches the verification error and continues, or compares signatures with `==` on a value the caller controls.
+3. **Replay protection.** Is there a timestamp tolerance (the provider libraries default to five minutes for Stripe), and idempotent handling by event id so a replay cannot repeat a side effect?
+4. **Secrets per endpoint and per mode.** The signing secret comes from the environment, differs between test and live, and is not logged.
+5. **Cron and internal routes.** Are they protected by a shared secret (`Authorization: Bearer $CRON_SECRET`) or the platform's cron header check, with a constant-time comparison? A public `/api/cron/cleanup` that deletes data is a finding.
+6. **What the handler does with the payload.** Even a verified event should be treated as input: look up records by id and check ownership, do not trust fields like `customer_email` to pick which account to upgrade without matching the stored Stripe customer id.
+7. **OAuth callbacks.** `state` is generated per session, stored server-side and compared; redirect targets are allow-listed (see `input-handling.md`); tokens are stored server-side and scoped minimally.
+8. **Outbound requests to user-supplied URLs** (webhook delivery to customers): block private and metadata addresses, set timeouts, and never forward internal credentials (SSRF; see `input-handling.md`).
+9. **Error responses.** Returning detailed errors or stack traces to the caller helps an attacker; return 400 with a short message.
+
+## Prove it
+
+Post an unsigned or wrongly signed event to the handler and assert that nothing changed.
+
+```js
+test('an unsigned provider event does not change account state', async () => {
+  store.accounts.push({ id: 'acct-9', plan: 'free' });
+  const forged = { type: 'subscription.activated', data: { object: { account: 'acct-9' } } };
+  const res = await POST({ body: forged, headers: {} });   // no signature header
+  assert.equal(store.accounts.find((a) => a.id === 'acct-9').plan, 'free'); // fails while the handler trusts the body
+  assert.ok(res.status >= 400);
+});
+```
+
+Add the positive case when the project has a helper that signs test payloads (Stripe's `generateTestHeaderString`), and assert a correctly signed event still works. Never use a real webhook secret in a test; generate one at test time.
+
+## Severity guidance
+
+- **Critical**: an unauthenticated request can forge payment, account-upgrade or deletion events, or trigger destructive cron work.
+- **High**: signature present but bypassable (for example verified only for some event types), or replays repeat a financial side effect.
+- **Medium**: no replay tolerance where the handler is idempotent anyway; webhook secret shared across test and live.
+- **Low**: verbose errors, missing rate limiting.
+
+## Common false positives
+
+- A webhook that only logs or enqueues a harmless notification and changes no state.
+- Signature verification done in a shared middleware or wrapper (`withStripeVerification`). Read it and confirm it covers the route.
+- Provider IP allow-listing as an extra layer: fine, but it does not replace a signature.
+- Public routes that are meant to be public (health, status, unsubscribe links with a signed token).

package/dist/security-runtime/rules/vsg-ai-key-in-client.yaml

@@ -0,0 +1,41 @@
+rules:
+  - id: vsg-ai-key-public-env
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      An AI provider key (OpenAI, Anthropic and similar) is read from a public environment variable (NEXT_PUBLIC_, EXPO_PUBLIC_, VITE_ and similar prefixes). Frameworks inline these variables into the browser or app bundle, so anyone can copy the key from your site and spend your credits or abuse your account.
+      Keep the key in a server-only variable and call the AI provider from a route handler or server action that checks the user first.
+    metadata:
+      vsg-blocking: true
+      vsg-title: AI provider key behind a public environment variable
+      vsg-fix: Rename the variable so it has no public prefix, call the AI provider only from server-side code that authenticates and rate limits the user, and rotate the key because it may already be public.
+      cwe: "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
+      owasp: "A01:2025 - Broken Access Control"
+      category: security
+      confidence: HIGH
+      technology: [openai, anthropic, nextjs, expo]
+    patterns:
+      - pattern-either:
+          - pattern: process.env.$NAME
+          - pattern: process.env[$NAME]
+          - pattern: import.meta.env.$NAME
+      - metavariable-regex:
+          metavariable: $NAME
+          regex: (?i)^["'`]?(NEXT_PUBLIC|EXPO_PUBLIC|VITE|REACT_APP|GATSBY|NUXT_PUBLIC|PUBLIC)_[A-Z0-9_]*(OPENAI|ANTHROPIC|CLAUDE|GEMINI|GROQ|MISTRAL|COHERE|DEEPSEEK|OPENROUTER|XAI)[A-Z0-9_]*(KEY|TOKEN|SECRET)
+  - id: vsg-ai-dangerously-allow-browser
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      dangerouslyAllowBrowser: true makes an AI SDK client run in the browser, which means its API key has to ship to every visitor. Anyone can copy the key from your site and spend your credits or abuse your account.
+      Call the AI provider from server-side code (a route handler or server action) that checks the user, and keep the key in a server-only variable.
+    metadata:
+      vsg-blocking: true
+      vsg-title: AI SDK client allowed to run in the browser (dangerouslyAllowBrowser)
+      vsg-fix: Remove dangerouslyAllowBrowser, move the AI call to a server-side route handler or server action that authenticates and rate limits the user, and rotate the key because it may already be public.
+      cwe: "CWE-798: Use of Hard-coded Credentials"
+      owasp: "A07:2025 - Authentication Failures"
+      category: security
+      confidence: HIGH
+      technology: [openai, anthropic]
+    pattern: |
+      {..., dangerouslyAllowBrowser: true, ...}

package/dist/security-runtime/rules/vsg-ai-output-raw-html.yaml

@@ -0,0 +1,35 @@
+rules:
+  - id: vsg-ai-output-raw-html
+    languages: [typescript, javascript]
+    mode: taint
+    severity: WARNING
+    message: >-
+      Text generated by an AI model is rendered as raw HTML with dangerouslySetInnerHTML. Model output can contain attacker-controlled markup (for example through prompt injection from a web page or document the model read), which turns into cross-site scripting in your users' browsers.
+      Render the text as plain text or through a Markdown renderer that does not allow raw HTML, or sanitize it with DOMPurify first.
+    metadata:
+      vsg-title: AI model output rendered as raw HTML
+      vsg-fix: Render the model output as text or with a Markdown renderer that escapes HTML, or pass it through DOMPurify.sanitize() before using dangerouslySetInnerHTML.
+      cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+      owasp: "A05:2025 - Injection"
+      category: security
+      confidence: MEDIUM
+      technology: [react, openai, anthropic]
+    pattern-sources:
+      - pattern: await $C.chat.completions.create(...)
+      - pattern: await $C.messages.create(...)
+      - pattern: await $C.responses.create(...)
+      - pattern: await $M.generateContent(...)
+      - pattern: await generateText(...)
+      - pattern: await generateObject(...)
+      - pattern: useChat(...)
+      - pattern: useCompletion(...)
+    pattern-sanitizers:
+      - pattern: DOMPurify.sanitize(...)
+      - pattern: $P.sanitize(...)
+      - pattern: sanitizeHtml(...)
+      - pattern: xss(...)
+    pattern-sinks:
+      - patterns:
+          - pattern: |
+              <$C ... dangerouslySetInnerHTML={{ __html: $SINK }} ... />
+          - focus-metavariable: $SINK

package/dist/security-runtime/rules/vsg-angular-sanitizer-bypass.yaml

@@ -0,0 +1,23 @@
+rules:
+  - id: vsg-angular-sanitizer-bypass
+    languages: [typescript]
+    severity: WARNING
+    message: >-
+      DomSanitizer.bypassSecurityTrustHtml, bypassSecurityTrustScript, bypassSecurityTrustUrl and bypassSecurityTrustResourceUrl switch off Angular's built-in cross-site scripting protection for the value you pass in. Here the value is not a string literal, so if any part of it comes from a URL parameter, an API response or user input, an attacker can run script in your users' browsers.
+      Bind the value normally and let Angular sanitize it, or run it through a sanitizer such as DOMPurify before marking it trusted.
+    metadata:
+      vsg-title: Angular sanitizer bypass on a non-constant value
+      vsg-fix: Remove the bypassSecurityTrust call and bind the value normally so Angular sanitizes it. If real HTML is needed, pass it through DOMPurify.sanitize() first and only then call bypassSecurityTrustHtml.
+      cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+      owasp: "A05:2025 - Injection"
+      category: security
+      confidence: MEDIUM
+      technology: [angular]
+    patterns:
+      - pattern-either:
+          - pattern: $S.bypassSecurityTrustHtml($ARG)
+          - pattern: $S.bypassSecurityTrustScript($ARG)
+          - pattern: $S.bypassSecurityTrustUrl($ARG)
+          - pattern: $S.bypassSecurityTrustResourceUrl($ARG)
+      - pattern-not: $S.$F("...")
+      - pattern-not: $S.$F(DOMPurify.sanitize(...))

package/dist/security-runtime/rules/vsg-expo-token-in-asyncstorage.yaml

@@ -0,0 +1,22 @@
+rules:
+  - id: vsg-expo-token-in-asyncstorage
+    languages: [typescript, javascript]
+    severity: WARNING
+    message: >-
+      A token, session or credential is saved with AsyncStorage, which stores plain unencrypted text that other apps on a rooted or jailbroken device, device backups and anyone with the device files can read.
+      Store tokens with expo-secure-store (SecureStore.setItemAsync) or react-native-keychain instead.
+    metadata:
+      vsg-title: Token stored in AsyncStorage
+      vsg-fix: Replace AsyncStorage.setItem for this value with SecureStore.setItemAsync (expo-secure-store) or react-native-keychain, and clear the old AsyncStorage entry on upgrade.
+      cwe: "CWE-312: Cleartext Storage of Sensitive Information"
+      owasp: "A04:2025 - Cryptographic Failures"
+      category: security
+      confidence: MEDIUM
+      technology: [expo, react-native]
+    patterns:
+      - pattern-either:
+          - pattern: AsyncStorage.setItem($KEY, ...)
+          - pattern: $NS.AsyncStorage.setItem($KEY, ...)
+      - metavariable-regex:
+          metavariable: $KEY
+          regex: (?i)^["'`].*(token|session|jwt|refresh|credential|secret|password|auth(?!or)).*["'`]$

package/dist/security-runtime/rules/vsg-flask-public-bind.yaml

@@ -0,0 +1,32 @@
+rules:
+  - id: vsg-flask-public-bind
+    languages: [python]
+    severity: WARNING
+    message: >-
+      This Flask app listens on every network interface (host 0.0.0.0 or ::), so any device on the same network, and the internet if the port is forwarded, can call its routes.
+      A service that is reachable from the LAN needs authentication on its routes. A license check or a CORS setting is not authentication.
+      Bind to 127.0.0.1 unless remote access is intended, and when it is, require a session or a per-run token on every route that reads or changes data (see the desktop playbook, local servers and IPC).
+    metadata:
+      vsg-blocking: false
+      vsg-severity: high
+      vsg-title: Flask server listens on all network interfaces
+      vsg-fix: Bind to 127.0.0.1 by default. If other devices must connect, require authentication (a login session or a per-run token compared in constant time) in a before_request hook or on each route, and add a firewall rule for the port. See playbook/desktop-python.md (local servers and IPC).
+      cwe: "CWE-1327: Binding to an Unrestricted IP Address"
+      owasp: "A02:2025 - Security Misconfiguration"
+      category: security
+      confidence: MEDIUM
+      technology: [flask, python]
+    patterns:
+      - pattern-either:
+          - pattern: $APP.run(..., host="0.0.0.0", ...)
+          - pattern: $APP.run(..., host="::", ...)
+          - pattern: $APP.run("0.0.0.0", ...)
+          - pattern: $APP.run("::", ...)
+      - pattern-inside:
+          pattern-either:
+            - pattern: |
+                $APP = Flask(...)
+                ...
+            - pattern: |
+                $APP = flask.Flask(...)
+                ...

package/dist/security-runtime/rules/vsg-nextjs-action-write-no-auth.yaml

@@ -0,0 +1,144 @@
+rules:
+  - id: vsg-nextjs-action-write-no-auth
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      This "use server" action writes data (Supabase or Prisma) but never checks who is calling it. Server actions are public POST endpoints, so anyone can call them with any arguments.
+      Check the session inside the action before the write (for example supabase.auth.getUser(), auth(), getServerSession() or currentUser()), reject the call when there is no user, and scope the write to that user.
+    metadata:
+      vsg-blocking: true
+      vsg-title: Server action writes data without checking the caller
+      vsg-fix: Call your auth check (supabase.auth.getUser(), auth(), getServerSession() or currentUser()) at the top of the action, throw or return an error when there is no user, and scope the write to that user.
+      cwe: "CWE-862: Missing Authorization"
+      owasp: "A01:2025 - Broken Access Control"
+      category: security
+      confidence: HIGH
+      technology: [nextjs, supabase, prisma]
+    patterns:
+      - pattern-either:
+          - pattern: $SB.from(...).insert(...)
+          - pattern: $SB.from(...).update(...)
+          - pattern: $SB.from(...).upsert(...)
+          - pattern: $SB.from(...).delete(...)
+          - pattern: prisma.$M.create(...)
+          - pattern: prisma.$M.createMany(...)
+          - pattern: prisma.$M.update(...)
+          - pattern: prisma.$M.updateMany(...)
+          - pattern: prisma.$M.upsert(...)
+          - pattern: prisma.$M.delete(...)
+          - pattern: prisma.$M.deleteMany(...)
+      - pattern-inside: |
+          "use server"
+          ...
+      - pattern-inside:
+          pattern-either:
+            - pattern: |
+                export async function $F(...) { ... }
+            - pattern: |
+                export const $F = async (...) => { ... }
+      - pattern-not-inside:
+          patterns:
+            - pattern-either:
+                - pattern: |
+                    export async function $F(...) {
+                      ...
+                      <... $FN(...) ...>
+                      ...
+                    }
+                - pattern: |
+                    export const $F = async (...) => {
+                      ...
+                      <... $FN(...) ...>
+                      ...
+                    }
+            - metavariable-regex:
+                metavariable: $FN
+                regex: ^(.*\.)?(auth|getAuth|getUser|getSession|getClaims|getServerSession|currentUser|get(?!\w*By(Id|Email))\w*User\w*|getCurrentUser\w*|(require|assert|ensure)\w*(User|Auth|Session|Context|Admin|Member|Role|Permission|Owner|Access)\w*|verify\w*(Signature|Webhook|Token|Jwt)\w*|constructEvent|constructEventAsync|validateRequest|jwtVerify|timingSafeEqual\w*|__vsg_discovered__)$
+      # Shared-secret checks (cron and webhook routes): the Authorization header compared with a secret, usually "Bearer <secret>".
+      - pattern-not-inside:
+          pattern-either:
+            - pattern: |
+                export async function $F(...) {
+                  ...
+                  <... $A === `Bearer ${...}` ...>
+                  ...
+                }
+            - pattern: |
+                export async function $F(...) {
+                  ...
+                  <... $A !== `Bearer ${...}` ...>
+                  ...
+                }
+            - pattern: |
+                export const $F = async (...) => {
+                  ...
+                  <... $A === `Bearer ${...}` ...>
+                  ...
+                }
+            - pattern: |
+                export const $F = async (...) => {
+                  ...
+                  <... $A !== `Bearer ${...}` ...>
+                  ...
+                }
+            - patterns:
+                - pattern-either:
+                    - pattern: |
+                        export async function $F(...) {
+                          ...
+                          <... $R.headers.get($HN) === $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        export async function $F(...) {
+                          ...
+                          <... $R.headers.get($HN) !== $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        export async function $F(...) {
+                          ...
+                          $H = $R.headers.get($HN)
+                          ...
+                          <... $H === $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        export async function $F(...) {
+                          ...
+                          $H = $R.headers.get($HN)
+                          ...
+                          <... $H !== $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        export const $F = async (...) => {
+                          ...
+                          <... $R.headers.get($HN) === $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        export const $F = async (...) => {
+                          ...
+                          <... $R.headers.get($HN) !== $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        export const $F = async (...) => {
+                          ...
+                          $H = $R.headers.get($HN)
+                          ...
+                          <... $H === $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        export const $F = async (...) => {
+                          ...
+                          $H = $R.headers.get($HN)
+                          ...
+                          <... $H !== $X ...>
+                          ...
+                        }
+                - metavariable-regex:
+                    metavariable: $HN
+                    regex: (?i)^["']authorization["']$