@nockdev/awf 6.2.0

package/.agent/skills/core/security/data/binary-exploitation.yaml

@@ -0,0 +1,339 @@
+metadata:
+  skill: security
+  domain: binary_exploitation
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: binary-exploitation.csv
+  patterns_count: 25
+  columns:
+  - id
+  - name
+  - severity
+  - category
+  - description
+  - detection_pattern
+  - fix_pattern
+  - cwe
+  - tools
+  - example_attack
+  - defense
+patterns:
+- id: BE-01
+  name: Stack Canary Bypass
+  severity: CRITICAL
+  category: Exploit
+  description: Stack cookie can be leaked or brute-forced
+  detection_pattern: __stack_chk_fail|canary(?!.*random)
+  fix_pattern: Use ASLR compile with -fstack-protector-strong
+  cwe: CWE-693
+  tools:
+  - gdb
+  - pwntools
+  example_attack: '# Leak canary via format string\npayload = b''%15$p'' # Leaks canary'
+  defense: Compile with -fstack-protector-all use ASLR
+- id: BE-02
+  name: Return Oriented Programming
+  severity: CRITICAL
+  category: Exploit
+  description: ROP gadgets chained to bypass NX/DEP
+  detection_pattern: .text.*ret(?!.*CFI)
+  fix_pattern: Enable CFI Control Flow Integrity and CET
+  cwe: CWE-94
+  tools:
+  - ROPgadget
+  - ropper
+  example_attack: from pwn import *\nrop = ROP(binary)\nrop.call('system', ['/bin/sh'])
+  defense: Compile with -fcf-protection=full enable CET
+- id: BE-03
+  name: ASLR Bypass via Leak
+  severity: CRITICAL
+  category: Exploit
+  description: Address leak defeats ASLR randomization
+  detection_pattern: puts.*got|printf.*libc(?!.*PIE)
+  fix_pattern: Always use PIE with ASLR avoid format string bugs
+  cwe: CWE-200
+  tools:
+  - pwntools
+  - gdb
+  example_attack: '# Leak libc address\nlibc_leak = u64(io.recv(6) + b''\\x00\\x00'')'
+  defense: Compile with -fPIE -pie fix all info leaks
+- id: BE-04
+  name: Heap Feng Shui
+  severity: HIGH
+  category: Exploit
+  description: Heap layout manipulated for exploitation
+  detection_pattern: malloc.*free.*malloc(?!.*sanitize)
+  fix_pattern: Use hardened allocators like jemalloc-hardened
+  cwe: CWE-416
+  tools:
+  - gdb
+  - heapinspect
+  example_attack: '# Spray heap to control allocation\nfor i in range(100): alloc(0x100)'
+  defense: Use MALLOC_CHECK_=3 Address Sanitizer in debug
+- id: BE-05
+  name: GOT Overwrite
+  severity: CRITICAL
+  category: Exploit
+  description: Global Offset Table overwritten for code execution
+  detection_pattern: \.got.*write(?!.*RELRO)
+  fix_pattern: Enable FULL RELRO with -Wl,-z,relro,-z,now
+  cwe: CWE-94
+  tools:
+  - objdump
+  - pwntools
+  example_attack: '# Overwrite GOT entry\nwrite(elf.got[''puts''], system_addr)'
+  defense: Link with -z relro -z now for FULL RELRO
+- id: BE-06
+  name: JOP JIT Spray
+  severity: HIGH
+  category: Exploit
+  description: Jump Oriented Programming in JIT compiled code
+  detection_pattern: jit.*spray|trampoline(?!.*verify)
+  fix_pattern: Implement W^X strictly verify JIT code
+  cwe: CWE-94
+  tools:
+  - IDA
+  - Binary Ninja
+  example_attack: '# JIT spray NOP equivalent\nfor i in range(0x1000): emit_jmp()'
+  defense: Isolate JIT pages with guard pages proper W^X
+- id: BE-07
+  name: Type Confusion Exploit
+  severity: CRITICAL
+  category: Exploit
+  description: Object type confused for arbitrary access
+  detection_pattern: dynamic_cast.*vtable(?!.*check)
+  fix_pattern: Use static types bounds check virtual calls
+  cwe: CWE-843
+  tools:
+  - IDA
+  - WinDbg
+  example_attack: // Cast to wrong type\nBase* p = (Base*)evil_obj;
+  defense: Add runtime type checks CFI for virtual calls
+- id: BE-08
+  name: Integer Underflow Exploit
+  severity: HIGH
+  category: Exploit
+  description: Unsigned subtraction wraps to large value
+  detection_pattern: unsigned.*-(?!.*check)
+  fix_pattern: Use signed types or check for underflow first
+  cwe: CWE-191
+  tools:
+  - gdb
+  - pwntools
+  example_attack: size_t len = user_len - 1; // If 0, wraps to MAX
+  defense: if (user_len == 0) return; size_t len = user_len - 1;
+- id: BE-09
+  name: Null Byte Injection
+  severity: MEDIUM
+  category: Exploit
+  description: Null byte terminates string prematurely for bypass
+  detection_pattern: strcpy.*\\0.*injection
+  fix_pattern: Use length-counted strings not null-terminated
+  cwe: CWE-626
+  tools:
+  - Burp
+  - custom
+  example_attack: // Bypass path check\npath = 'admin.txt\\x00.jpg'
+  defense: Use strnlen and length parameters not null termination
+- id: BE-10
+  name: Unlink Exploit
+  severity: CRITICAL
+  category: Exploit
+  description: Heap metadata corruption via fake chunks
+  detection_pattern: unlink|FD.*BK(?!.*safe_unlink)
+  fix_pattern: Use safe_unlink checks in allocator
+  cwe: CWE-416
+  tools:
+  - gdb
+  - heapinspect
+  example_attack: '# Craft fake chunk for unlink\nfake_chunk = p64(fd) + p64(bk)'
+  defense: Use modern glibc with safe_unlink enabled
+- id: BE-11
+  name: Format String Write
+  severity: CRITICAL
+  category: Exploit
+  description: Format string used for arbitrary write via %n
+  detection_pattern: printf.*%n(?!.*disabled)
+  fix_pattern: Never pass user input directly to printf
+  cwe: CWE-134
+  tools:
+  - pwntools
+  - gdb
+  example_attack: '# Write to address via %n\npayload = fmtstr_payload(offset, {addr: value})'
+  defense: Compile with -Wformat-security use %s always
+- id: BE-12
+  name: Sigreturn Oriented
+  severity: HIGH
+  category: Exploit
+  description: SROP uses sigreturn for ROP without gadgets
+  detection_pattern: sigreturn.*frame(?!.*seccomp)
+  fix_pattern: Enable seccomp to filter syscalls
+  cwe: CWE-94
+  tools: pwntools ropper
+  example_attack: frame = SigreturnFrame()\nframe.rax = constants.SYS_execve
+  defense: Use seccomp to whitelist allowed syscalls
+- id: BE-13
+  name: Vtable Hijacking
+  severity: CRITICAL
+  category: Exploit
+  description: C++ virtual table pointer overwritten
+  detection_pattern: vtable.*overwrite|vptr(?!.*CFI)
+  fix_pattern: Enable CFI for vtable protection
+  cwe: CWE-843
+  tools:
+  - IDA
+  - gdb
+  example_attack: // Overwrite vptr\n*(void**)obj = fake_vtable;
+  defense: Compile with -fsanitize=cfi MSVC /guard:cf
+- id: BE-14
+  name: Blind ROP Attack
+  severity: HIGH
+  category: Exploit
+  description: ROP without binary using stack reading
+  detection_pattern: brop|blind.*rop(?!.*canary)
+  fix_pattern: Use stack canaries and ASLR together
+  cwe: CWE-94
+  tools:
+  - pwntools
+  - custom
+  example_attack: '# BROP: scan for stop gadget\nfor addr in range(0x400000, 0x500000): try_addr()'
+  defense: Strong stack canary ASLR PIE together
+- id: BE-15
+  name: Ret2libc Attack
+  severity: CRITICAL
+  category: Exploit
+  description: Return to libc function bypassing NX
+  detection_pattern: ret2libc|system.*binsh
+  fix_pattern: Use ASLR with PIE avoid libc addresses in binary
+  cwe: CWE-94
+  tools:
+  - pwntools
+  - gdb
+  example_attack: rop.call(libc.sym['system'], [next(libc.search(b'/bin/sh'))])
+  defense: Full ASLR PIE no hardcoded addresses
+- id: BE-16
+  name: Gadget Finder Detection
+  severity: MEDIUM
+  category: Static
+  description: Binary scanned for ROP gadgets
+  detection_pattern: ROPgadget|ropper(?!.*strip)
+  fix_pattern: Strip symbols reduce gadget availability
+  cwe: CWE-200
+  tools:
+  - ROPgadget
+  - ropper
+  example_attack: $ ROPgadget --binary vuln --ropchain
+  defense: Strip binary use control flow integrity
+- id: BE-17
+  name: Dangling Pointer Spray
+  severity: HIGH
+  category: Exploit
+  description: Freed pointer reallocated with attacker data
+  detection_pattern: free.*spray(?!.*null)
+  fix_pattern: Set pointer to NULL after free immediately
+  cwe: CWE-416
+  tools:
+  - gdb
+  - pwntools
+  example_attack: free(ptr); spray(0x100); ptr->func();
+  defense: ptr = NULL; after free use smart pointers
+- id: BE-18
+  name: Shadow Stack Missing
+  severity: HIGH
+  category: Mitigation
+  description: No shadow stack protection for return addresses
+  detection_pattern: (!.*shadow_stack|CET)
+  fix_pattern: Enable Intel CET or ARM PAC
+  cwe: CWE-693
+  tools:
+  - gdb
+  - IDA
+  example_attack: // No shadow stack\nret // Can be hijacked
+  defense: Compile with -fcf-protection=return use CET
+- id: BE-19
+  name: Double Fetch TOCTOU
+  severity: HIGH
+  category: Kernel
+  description: Race between user check and kernel use
+  detection_pattern: copy_from_user.*check.*use
+  fix_pattern: Use get_user once or copy entire structure atomically
+  cwe: CWE-367
+  tools: kernel debugger
+  example_attack: // Check then copy - can be modified between\nif (user->size < 100) copy_from_user()
+  defense: Copy once then validate the copy
+- id: BE-20
+  name: Kernel Pointer Leak
+  severity: CRITICAL
+  category: Kernel
+  description: Kernel address leaked to userspace
+  detection_pattern: /proc/.*(maps|kallsyms)(?!.*restrict)
+  fix_pattern: Enable kernel hardening kptr_restrict=2
+  cwe: CWE-200
+  tools: /proc
+  example_attack: $ cat /proc/kallsyms
+  defense: sysctl kernel.kptr_restrict=2
+- id: BE-21
+  name: Sandbox Escape
+  severity: CRITICAL
+  category: Sandbox
+  description: Attacker escapes from sandbox/container
+  detection_pattern: seccomp.*bypass|container.*escape
+  fix_pattern: Defense in depth multiple sandbox layers
+  cwe: CWE-693
+  tools:
+  - docker
+  - crictl
+  example_attack: // Escape via kernel vuln\nexploit_kernel_from_container()
+  defense: Use gVisor/Kata containers defense in depth
+- id: BE-22
+  name: Use After Scope
+  severity: HIGH
+  category: Memory
+  description: Local variable accessed after scope ends
+  detection_pattern: \\{.*\\&local.*\\}.*use_ptr
+  fix_pattern: Avoid taking address of locals use heap allocation
+  cwe: CWE-416
+  tools:
+  - ASAN
+  - gdb
+  example_attack: int* getPtr() { int x = 5; return &x; }
+  defense: Use heap allocation or static if needed
+- id: BE-23
+  name: Stack Pivot Attack
+  severity: HIGH
+  category: Exploit
+  description: ESP/RSP moved to attacker controlled memory
+  detection_pattern: xchg.*esp|leave.*ret(?!.*verify)
+  fix_pattern: Use stack canaries CFI and shadow stack
+  cwe: CWE-94
+  tools:
+  - pwntools
+  - IDA
+  example_attack: '# Pivot stack to heap\nxchg_esp_eax = 0x8048abc'
+  defense: Strong CFI shadow stack CET protection
+- id: BE-24
+  name: One Gadget RCE
+  severity: CRITICAL
+  category: Exploit
+  description: Single gadget provides system("/bin/sh")
+  detection_pattern: one_gadget|magic_gadget
+  fix_pattern: No direct defense - prevent memory corruption
+  cwe: CWE-94
+  tools:
+  - one_gadget
+  - pwntools
+  example_attack: $ one_gadget libc.so.6\n0x4f3d5 execve(\/bin/sh\"
+  defense: rsp+0x40)"
+- id: BE-25
+  name: Partial Overwrite
+  severity: HIGH
+  category: Exploit
+  description: Only low bytes overwritten bypassing ASLR partially
+  detection_pattern: \\x00.*overwrite(?!.*full_aslr)
+  fix_pattern: Ensure full 64-bit ASLR no page alignment
+  cwe: CWE-330
+  tools:
+  - pwntools
+  - gdb
+  example_attack: '# Overwrite only low 2 bytes\npayload = b''AA'' # Only affects low 16 bits'
+  defense: Full 64-bit ASLR high entropy

package/.agent/skills/core/security/data/cloud-security.yaml

@@ -0,0 +1,269 @@
+metadata:
+  skill: security
+  domain: cloud_security
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: cloud-security.csv
+  patterns_count: 25
+  columns:
+  - id
+  - name
+  - severity
+  - category
+  - provider
+  - description
+  - detection_pattern
+  - fix_pattern
+  - example_vuln
+  - example_fix
+patterns:
+- id: CLOUD-01
+  name: Public S3 Bucket
+  severity: CRITICAL
+  category: Storage
+  provider: AWS
+  description: S3 bucket allows public read or write access
+  detection_pattern: (ACL.*public|PublicAccessBlock.*false|s3:GetObject.*Principal.*\\*)
+  fix_pattern: Block public access enable encryption and logging
+  example_vuln: 'ACL: ''public-read'''
+  example_fix: 'PublicAccessBlockConfiguration:\n  BlockPublicAcls: true\n  BlockPublicPolicy: true'
+- id: CLOUD-02
+  name: IMDS v1 Enabled
+  severity: CRITICAL
+  category: Compute
+  provider: AWS
+  description: EC2 metadata service v1 vulnerable to SSRF attacks
+  detection_pattern: (HttpTokens.*optional|IMDSv1)
+  fix_pattern: Force IMDSv2 with required tokens
+  example_vuln: 'HttpTokens: ''optional'''
+  example_fix: 'MetadataOptions:\n  HttpTokens: ''required''\n  HttpPutResponseHopLimit: 1'
+- id: CLOUD-03
+  name: Overly Permissive IAM
+  severity: CRITICAL
+  category: IAM
+  provider: All
+  description: IAM policy with * permissions or resources
+  detection_pattern: (Action.*\\*|Resource.*\\*|Effect.*Allow.*\\*)
+  fix_pattern: Apply least privilege specific actions and resources
+  example_vuln: 'Effect: ''Allow''\nAction: ''*''\nResource: ''*'''
+  example_fix: 'Effect: ''Allow''\nAction: ''s3:GetObject''\nResource: ''arn:aws:s3:::mybucket/*'''
+- id: CLOUD-04
+  name: Cross-Account Trust
+  severity: HIGH
+  category: IAM
+  provider: AWS
+  description: IAM role trusts external accounts without conditions
+  detection_pattern: (Principal.*arn:aws.*:root)(?!.*Condition)
+  fix_pattern: Add external ID and MFA conditions for cross-account
+  example_vuln: 'Principal: ''arn:aws:iam::123456789:root'''
+  example_fix: 'Principal: ''arn:aws:iam::123456789:root''\nCondition:\n  StringEquals:\n    sts:ExternalId: ''secret-id'''
+- id: CLOUD-05
+  name: Unencrypted Storage
+  severity: HIGH
+  category: Storage
+  provider: All
+  description: Storage not encrypted at rest
+  detection_pattern: (Encrypted.*false|SSEConfiguration.*null)
+  fix_pattern: Enable encryption with customer-managed keys
+  example_vuln: 'Encrypted: false'
+  example_fix: 'Encrypted: true\nKMSMasterKeyID: ''alias/my-key'''
+- id: CLOUD-06
+  name: Public Security Group
+  severity: HIGH
+  category: Network
+  provider: AWS
+  description: Security group allows 0.0.0.0/0 ingress on sensitive ports
+  detection_pattern: (CidrIp.*0\\.0\\.0\\.0/0.*(22|3389|3306|5432))
+  fix_pattern: Restrict ingress to specific IPs or VPN
+  example_vuln: 'CidrIp: ''0.0.0.0/0''\nFromPort: 22'
+  example_fix: 'CidrIp: ''10.0.0.0/8''\nFromPort: 22'
+- id: CLOUD-07
+  name: Missing VPC Flow Logs
+  severity: MEDIUM
+  category: Network
+  provider: AWS
+  description: VPC flow logs not enabled for network monitoring
+  detection_pattern: (FlowLog)(?!.*Enable)
+  fix_pattern: Enable VPC flow logs for security monitoring
+  example_vuln: // No flow logs configured
+  example_fix: FlowLogIds:\n  - fl-xxxxxxxx
+- id: CLOUD-08
+  name: Default VPC Used
+  severity: MEDIUM
+  category: Network
+  provider: AWS
+  description: Resources deployed in default VPC with weak isolation
+  detection_pattern: (vpc-.*default|DefaultVpc)
+  fix_pattern: Use custom VPCs with proper network segmentation
+  example_vuln: 'VpcId: ''vpc-default'''
+  example_fix: 'VpcId: ''vpc-custom-isolated'''
+- id: CLOUD-09
+  name: Container Escape Risk
+  severity: CRITICAL
+  category: Container
+  provider: All
+  description: Container running as root or with privileged mode
+  detection_pattern: (privileged.*true|runAsRoot|USER root)
+  fix_pattern: Run as non-root user disable privileges
+  example_vuln: 'securityContext:\n  privileged: true'
+  example_fix: 'securityContext:\n  runAsNonRoot: true\n  allowPrivilegeEscalation: false'
+- id: CLOUD-10
+  name: Secrets in Environment
+  severity: CRITICAL
+  category: Secrets
+  provider: All
+  description: Secrets passed via environment variables
+  detection_pattern: (env.*SECRET|env.*PASSWORD|env.*API_KEY)
+  fix_pattern: 'Use secrets manager: Vault AWS Secrets Manager'
+  example_vuln: 'env:\n  - name: DB_PASSWORD\n    value: ''plaintext'''
+  example_fix: 'env:\n  - name: DB_PASSWORD\n    valueFrom:\n      secretKeyRef:\n        name: db-secret'
+- id: CLOUD-11
+  name: Missing Secrets Rotation
+  severity: HIGH
+  category: Secrets
+  provider: All
+  description: Secrets without automatic rotation configured
+  detection_pattern: (rotation.*false|RotationEnabled.*false)
+  fix_pattern: Enable automatic rotation every 30-90 days
+  example_vuln: 'RotationEnabled: false'
+  example_fix: 'RotationEnabled: true\nRotationLambdaARN: ''arn:aws:lambda:...'''
+- id: CLOUD-12
+  name: Public Load Balancer
+  severity: MEDIUM
+  category: Network
+  provider: All
+  description: Internal resources exposed via public load balancer
+  detection_pattern: (Scheme.*internet-facing|PublicIpAddress).*internal
+  fix_pattern: Use internal load balancers for internal services
+  example_vuln: 'Type: ''internet-facing'''
+  example_fix: 'Type: ''internal'''
+- id: CLOUD-13
+  name: Missing WAF
+  severity: MEDIUM
+  category: Network
+  provider: All
+  description: No Web Application Firewall protecting endpoints
+  detection_pattern: (ALB|CloudFront)(?!.*WAF|WebACL)
+  fix_pattern: Attach WAF with OWASP rules for protection
+  example_vuln: // No WAF attached
+  example_fix: 'WebACLId: ''arn:aws:wafv2:...:webacl/owasp-rules'''
+- id: CLOUD-14
+  name: CloudTrail Disabled
+  severity: HIGH
+  category: Audit
+  provider: AWS
+  description: CloudTrail not enabled for API audit logging
+  detection_pattern: (IsLogging.*false|trailArn.*null)
+  fix_pattern: Enable CloudTrail with multi-region logging
+  example_vuln: 'IsLogging: false'
+  example_fix: 'IsLogging: true\nIsMultiRegionTrail: true\nIncludeGlobalServiceEvents: true'
+- id: CLOUD-15
+  name: Logging Disabled
+  severity: HIGH
+  category: Audit
+  provider: All
+  description: Resource logging and monitoring not configured
+  detection_pattern: (Logging.*Disabled|AccessLog.*false)
+  fix_pattern: Enable access logging and monitoring
+  example_vuln: 'AccessLoggingEnabled: false'
+  example_fix: 'AccessLoggingEnabled: true\nAccessLogBucket: ''logs-bucket'''
+- id: CLOUD-16
+  name: Serverless Cold Start Attack
+  severity: MEDIUM
+  category: Serverless
+  provider: All
+  description: Lambda or function injection via cold start
+  detection_pattern: (handler.*eval|import.*user)
+  fix_pattern: Validate all inputs sanitize function context
+  example_vuln: exports.handler = async (event) => eval(event.code)
+  example_fix: exports.handler = async (event) => {\n  const validated = schema.parse(event)\n  // Process validated input\n}
+- id: CLOUD-17
+  name: Missing Resource Tags
+  severity: LOW
+  category: Ops
+  provider: All
+  description: Resources without proper tagging for security tracking
+  detection_pattern: (Tags.*\\[\\]|tags.*null)
+  fix_pattern: Apply consistent security and ownership tags
+  example_vuln: 'Tags: []'
+  example_fix: 'Tags:\n  - Key: ''Environment''\n    Value: ''production''\n  - Key: ''Owner''\n    Value: ''security-team'''
+- id: CLOUD-18
+  name: Insecure Blob Storage
+  severity: HIGH
+  category: Storage
+  provider: Azure
+  description: Azure Blob allows anonymous access
+  detection_pattern: (AllowBlobPublicAccess.*true|publicAccess.*Blob)
+  fix_pattern: Disable public access use SAS tokens or RBAC
+  example_vuln: 'AllowBlobPublicAccess: true'
+  example_fix: 'AllowBlobPublicAccess: false'
+- id: CLOUD-19
+  name: GCP Default Service Account
+  severity: HIGH
+  category: IAM
+  provider: GCP
+  description: Using default compute service account with editor role
+  detection_pattern: (compute@.*gserviceaccount|Editor|Owner)
+  fix_pattern: Create custom service account with minimal permissions
+  example_vuln: 'serviceAccountEmail: ''123-compute@...'''
+  example_fix: 'serviceAccountEmail: ''custom-sa@project.iam'''
+- id: CLOUD-20
+  name: Kubernetes RBAC Missing
+  severity: HIGH
+  category: K8s
+  provider: All
+  description: No RBAC configured allowing privileged operations
+  detection_pattern: (rbac.*disabled|--authorization-mode.*AlwaysAllow)
+  fix_pattern: Enable RBAC with proper role bindings
+  example_vuln: --authorization-mode=AlwaysAllow
+  example_fix: --authorization-mode=RBAC
+- id: CLOUD-21
+  name: Pod Security Standards
+  severity: MEDIUM
+  category: K8s
+  provider: All
+  description: Pods running without security standards enforcement
+  detection_pattern: (PodSecurityPolicy.*null|pod-security.*disabled)
+  fix_pattern: 'Enable Pod Security Standards: restricted baseline'
+  example_vuln: // No PSS enforcement
+  example_fix: 'apiVersion: policy/v1\nkind: PodSecurityPolicy\nspec:\n  privileged: false'
+- id: CLOUD-22
+  name: Missing Network Policy
+  severity: MEDIUM
+  category: K8s
+  provider: All
+  description: No network policies for pod-to-pod traffic control
+  detection_pattern: (NetworkPolicy)(?!.*defined)
+  fix_pattern: Implement network policies for namespace isolation
+  example_vuln: // No network policies
+  example_fix: 'kind: NetworkPolicy\nspec:\n  podSelector: {}\n  policyTypes: [Ingress, Egress]'
+- id: CLOUD-23
+  name: Terraform State Exposure
+  severity: CRITICAL
+  category: IaC
+  provider: All
+  description: Terraform state file with secrets stored insecurely
+  detection_pattern: (terraform\\.tfstate|backend.*s3)(?!.*encrypt)
+  fix_pattern: Use encrypted remote backend with locking
+  example_vuln: backend 'local' {}
+  example_fix: backend 's3' {\n  encrypt = true\n  dynamodb_table = 'tf-locks'\n}
+- id: CLOUD-24
+  name: IaC Secrets Hardcoded
+  severity: CRITICAL
+  category: IaC
+  provider: All
+  description: Secrets hardcoded in Infrastructure as Code
+  detection_pattern: (password.*=.*['\]|secret.*=.*['\"]|api_key.*=.*['\"])"
+  fix_pattern: Use variables with secrets from vault
+  example_vuln: password = 'mysecret'
+  example_fix: password = var.db_password // From secrets manager
+- id: CLOUD-25
+  name: Missing CSPM
+  severity: HIGH
+  category: Ops
+  provider: All
+  description: No Cloud Security Posture Management in place
+  detection_pattern: (cspm|posture.*management)(?!.*enabled)
+  fix_pattern: Implement CSPM for continuous compliance monitoring
+  example_vuln: // No CSPM configured
+  example_fix: '// Enable: AWS Security Hub, Azure Defender, GCP SCC'