@nockdev/awf 6.2.0

package/.agent/skills/core/security/data/cwe-top25.yaml

@@ -0,0 +1,415 @@
+metadata:
+  skill: security
+  domain: cwe_top25
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: cwe-top25.csv
+  patterns_count: 25
+  columns:
+  - id
+  - name
+  - severity
+  - category
+  - rank_2024
+  - description
+  - detection_pattern
+  - fix_pattern
+  - languages
+  - example_vuln
+  - example_fix
+patterns:
+- id: CWE-79
+  name: Cross-site Scripting (XSS)
+  severity: CRITICAL
+  category: Injection
+  rank_2024: '1'
+  description: 'Rendering untrusted data in HTML without encoding. #1 in 2024 (was #2)'
+  detection_pattern: (innerHTML|document\\.write|dangerouslySetInnerHTML)
+  fix_pattern: HTML entity encoding, CSP headers, sanitize libraries
+  languages:
+  - javascript
+  - typescript
+  example_vuln: '// BAD: Direct HTML injection
+
+    element.innerHTML = userInput'
+  example_fix: '// GOOD: Text content or sanitize
+
+    element.textContent = userInput
+
+    // or: DOMPurify.sanitize(userInput)'
+- id: CWE-787
+  name: Out-of-bounds Write
+  severity: CRITICAL
+  category: Memory
+  rank_2024: '2'
+  description: 'Writing data past buffer end. #2 in 2024 (was #1)'
+  detection_pattern: (strcpy|strcat|sprintf|gets\\()
+  fix_pattern: 'Use safe functions: strncpy, snprintf, fgets with size limits'
+  languages:
+  - c
+  - cpp
+  example_vuln: '// BAD: Buffer overflow
+
+    char buf[10]; strcpy(buf, userInput);'
+  example_fix: '// GOOD: Bounded copy
+
+    char buf[10]; strncpy(buf, userInput, sizeof(buf)-1); buf[sizeof(buf)-1] = ''\\0'';'
+- id: CWE-89
+  name: SQL Injection
+  severity: CRITICAL
+  category: Injection
+  rank_2024: '3'
+  description: Constructing SQL queries from untrusted input without parameterization.
+  detection_pattern: (query.*\\+|execute.*\\+|SELECT.*\\$\\{)
+  fix_pattern: Parameterized queries, ORM, prepared statements
+  languages: all
+  example_vuln: '// BAD: String concatenation
+
+    db.query(`SELECT * FROM users WHERE name = ''${name}''`)'
+  example_fix: '// GOOD: Prepared statement
+
+    db.query(''SELECT * FROM users WHERE name = ?'', [name])'
+- id: CWE-352
+  name: Cross-Site Request Forgery (CSRF)
+  severity: HIGH
+  category: Session
+  rank_2024: '4'
+  description: Forging requests from authenticated users. Jumped 5 positions in 2024.
+  detection_pattern: (form.*method.*post|fetch\\(.*method.*POST)
+  fix_pattern: CSRF tokens, SameSite cookies, double-submit cookies
+  languages: all
+  example_vuln: '// BAD: No CSRF protection
+
+    <form method=''POST'' action=''/transfer''>'
+  example_fix: '// GOOD: CSRF token
+
+    <input type=''hidden'' name=''csrf'' value=''{{token}}''>'
+- id: CWE-22
+  name: Path Traversal
+  severity: HIGH
+  category: Injection
+  rank_2024: '5'
+  description: 'Using user input to access files outside intended directory. Moved to #5.'
+  detection_pattern: (readFile\\(|open\\(|include\\().*req\\.(params|query|body)
+  fix_pattern: Path normalization, jail to base directory, allowlisting
+  languages: all
+  example_vuln: '// BAD: Path traversal
+
+    fs.readFile(''/uploads/'' + req.query.file)'
+  example_fix: '// GOOD: Path normalization
+
+    const safePath = path.resolve(''/uploads'', path.basename(req.query.file))'
+- id: CWE-125
+  name: Out-of-bounds Read
+  severity: HIGH
+  category: Memory
+  rank_2024: '6'
+  description: Reading data beyond buffer boundaries (information leak).
+  detection_pattern: (buffer\\[|array\\[|ptr\\+)
+  fix_pattern: Bounds checking, safe iterators, span/slice types
+  languages:
+  - c
+  - cpp
+  - rust
+  example_vuln: '// BAD: Array out of bounds
+
+    for(int i=0; i<=len; i++) buf[i]'
+  example_fix: '// GOOD: Proper bounds
+
+    for(int i=0; i<len; i++) buf[i]'
+- id: CWE-78
+  name: OS Command Injection
+  severity: CRITICAL
+  category: Injection
+  rank_2024: '7'
+  description: Executing shell commands with untrusted input.
+  detection_pattern: (exec\\(|system\\(|popen\\(|shell_exec)
+  fix_pattern: Avoid shell, use safe APIs, input validation
+  languages: all
+  example_vuln: '// BAD: Shell command injection
+
+    exec(`rm -rf ${userPath}`)'
+  example_fix: '// GOOD: Use safe API
+
+    fs.rmSync(path.resolve(safeBaseDir, userPath), { recursive: true })'
+- id: CWE-416
+  name: Use After Free
+  severity: CRITICAL
+  category: Memory
+  rank_2024: '8'
+  description: Accessing memory after it has been freed.
+  detection_pattern: (free\\(.*\\)|delete\\s+|\\.release\\(\\))
+  fix_pattern: Smart pointers, RAII, null after free
+  languages:
+  - c
+  - cpp
+  - rust
+  example_vuln: '// BAD: Use after free
+
+    free(ptr); printf(''%s'', ptr);'
+  example_fix: '// GOOD: Null after free
+
+    free(ptr); ptr = NULL;'
+- id: CWE-862
+  name: Missing Authorization
+  severity: CRITICAL
+  category: AuthZ
+  rank_2024: '9'
+  description: Lack of proper checks to ensure users have necessary permissions.
+  detection_pattern: (app\\.(get|post|put|delete)\\()(?!.*authorize)
+  fix_pattern: Authorization middleware, RBAC/ABAC, deny by default
+  languages: all
+  example_vuln: '// BAD: No authz check
+
+    app.get(''/admin/users'', getUsers)'
+  example_fix: '// GOOD: Authorization middleware
+
+    app.get(''/admin/users'', requireRole(''admin''), getUsers)'
+- id: CWE-434
+  name: Unrestricted File Upload
+  severity: HIGH
+  category: Injection
+  rank_2024: '10'
+  description: Allowing upload of executable files or scripts.
+  detection_pattern: (file.*upload|multer|formidable)
+  fix_pattern: File type validation, rename files, store outside webroot
+  languages: all
+  example_vuln: '// BAD: No file type check
+
+    app.post(''/upload'', multer().single(''file''))'
+  example_fix: '// GOOD: Validate MIME and extension
+
+    if (!ALLOWED_TYPES.includes(file.mimetype)) throw new Error(''Invalid type'')'
+- id: CWE-94
+  name: Code Injection
+  severity: CRITICAL
+  category: Injection
+  rank_2024: '11'
+  description: Injecting and executing arbitrary code. Jumped 12 positions in 2024!
+  detection_pattern: (eval\\(|new Function\\(|vm\\.runInContext)
+  fix_pattern: Avoid eval, use safe parsers, sandbox execution
+  languages: all
+  example_vuln: '// BAD: Code injection
+
+    eval(userInput)'
+  example_fix: '// GOOD: Safe alternative
+
+    JSON.parse(userInput) // for data parsing'
+- id: CWE-20
+  name: Improper Input Validation
+  severity: HIGH
+  category: Validation
+  rank_2024: '12'
+  description: Not validating user input for type, length, format, range.
+  detection_pattern: (parseInt\\(|Number\\(|JSON\\.parse\\()
+  fix_pattern: Schema validation (Zod, Joi), type checking, range validation
+  languages: all
+  example_vuln: '// BAD: No validation
+
+    const age = parseInt(req.body.age)'
+  example_fix: '// GOOD: Schema validation
+
+    const schema = z.object({ age: z.number().min(0).max(150) })'
+- id: CWE-77
+  name: Command Injection
+  severity: CRITICAL
+  category: Injection
+  rank_2024: '13'
+  description: Improper neutralization of special elements in a command.
+  detection_pattern: (spawn\\(|execFile\\().*\\$
+  fix_pattern: Use arrays for args, avoid shell, sanitize input
+  languages: all
+  example_vuln: '// BAD: Command injection risk
+
+    spawn(''cmd'', `/c ${userInput}`)'
+  example_fix: '// GOOD: Separate args
+
+    spawn(''cmd'', [''/c'', sanitize(userInput)], { shell: false })'
+- id: CWE-287
+  name: Improper Authentication
+  severity: CRITICAL
+  category: AuthN
+  rank_2024: '14'
+  description: Incorrect or insufficient authentication mechanisms.
+  detection_pattern: (password.*==|token.*===)
+  fix_pattern: Use timing-safe comparison, secure session, MFA
+  languages: all
+  example_vuln: '// BAD: Timing attack vulnerable
+
+    if (token === storedToken)'
+  example_fix: '// GOOD: Timing-safe compare
+
+    crypto.timingSafeEqual(Buffer.from(token), Buffer.from(storedToken))'
+- id: CWE-269
+  name: Improper Privilege Management
+  severity: HIGH
+  category: AuthZ
+  rank_2024: '15'
+  description: Flaws in how privileges are assigned, managed, or enforced.
+  detection_pattern: (setRole|addPermission|elevate)
+  fix_pattern: Principle of least privilege, regular audits, separation of duties
+  languages: all
+  example_vuln: '// BAD: Overly broad permissions
+
+    user.role = ''superadmin'''
+  example_fix: '// GOOD: Minimal required permissions
+
+    user.permissions = [''read:own_data'', ''write:own_data'']'
+- id: CWE-502
+  name: Deserialization of Untrusted Data
+  severity: CRITICAL
+  category: Injection
+  rank_2024: '16'
+  description: Deserializing data from untrusted sources without validation.
+  detection_pattern: (pickle\\.load|unserialize|ObjectInputStream|JSON\\.parse\\(.*body)
+  fix_pattern: Avoid native deserialization, use JSON, validate schema
+  languages: all
+  example_vuln: '// BAD: Unsafe deserialization (Python)
+
+    pickle.loads(user_data)'
+  example_fix: '// GOOD: Safe JSON with schema
+
+    data = json.loads(user_data); validate(data, schema)'
+- id: CWE-200
+  name: Exposure of Sensitive Information
+  severity: MEDIUM
+  category: Disclosure
+  rank_2024: '17'
+  description: Sensitive data revealed to unauthorized actors.
+  detection_pattern: (console\\.log.*password|log.*secret|res\\.send.*error\\.stack)
+  fix_pattern: Sanitize logs, custom error pages, filter responses
+  languages: all
+  example_vuln: '// BAD: Expose stack trace
+
+    res.status(500).send(error.stack)'
+  example_fix: '// GOOD: Generic error
+
+    res.status(500).json({ error: ''Internal server error'' })'
+- id: CWE-863
+  name: Incorrect Authorization
+  severity: HIGH
+  category: AuthZ
+  rank_2024: '18'
+  description: Authorization performed incorrectly, leading to unauthorized access.
+  detection_pattern: (if.*role.*!=|unless.*admin)
+  fix_pattern: Centralized authz, policy-based access, audit logs
+  languages: all
+  example_vuln: '// BAD: Inverted logic
+
+    if (user.role != ''admin'') allowAccess()'
+  example_fix: '// GOOD: Explicit check
+
+    if (user.role === ''admin'') allowAccess()'
+- id: CWE-918
+  name: Server-Side Request Forgery (SSRF)
+  severity: HIGH
+  category: Injection
+  rank_2024: '19'
+  description: Server makes requests to attacker-controlled URLs.
+  detection_pattern: (fetch\\(|axios\\.|request\\().*user
+  fix_pattern: URL allowlisting, disable redirects, network segmentation
+  languages: all
+  example_vuln: '// BAD: Fetch user URL
+
+    fetch(req.query.url)'
+  example_fix: '// GOOD: Allowlist validation
+
+    if (!ALLOWED_HOSTS.includes(new URL(url).host)) throw new Error(''Blocked'')'
+- id: CWE-119
+  name: Memory Buffer Bounds
+  severity: CRITICAL
+  category: Memory
+  rank_2024: '20'
+  description: Operations that read/write outside intended memory buffer.
+  detection_pattern: (memcpy|memmove|buffer\\[.*\\+)
+  fix_pattern: Bounds checking, AddressSanitizer, safe functions
+  languages:
+  - c
+  - cpp
+  example_vuln: '// BAD: No bounds check
+
+    memcpy(dest, src, len)'
+  example_fix: '// GOOD: Check bounds first
+
+    if (len <= sizeof(dest)) memcpy(dest, src, len)'
+- id: CWE-476
+  name: NULL Pointer Dereference
+  severity: HIGH
+  category: Memory
+  rank_2024: '21'
+  description: Program attempts to use a pointer that has NULL value.
+  detection_pattern: (->|\\*ptr)(?!.*if.*null)
+  fix_pattern: Null checks, Optional types, smart pointers
+  languages:
+  - c
+  - cpp
+  - java
+  example_vuln: '// BAD: No null check
+
+    printf(''%s'', ptr->name);'
+  example_fix: '// GOOD: Check first
+
+    if (ptr != NULL) printf(''%s'', ptr->name);'
+- id: CWE-798
+  name: Hard-coded Credentials
+  severity: CRITICAL
+  category: Secrets
+  rank_2024: '22'
+  description: Embedding credentials directly into code.
+  detection_pattern: (password.*=.*['\]|apiKey.*=.*['\"]|secret.*=.*['\"])"
+  fix_pattern: Environment variables, secrets manager, rotation
+  languages: all
+  example_vuln: '// BAD: Hardcoded secret
+
+    const API_KEY = ''sk-1234567890'''
+  example_fix: '// GOOD: Environment variable
+
+    const API_KEY = process.env.API_KEY'
+- id: CWE-190
+  name: Integer Overflow
+  severity: HIGH
+  category: Math
+  rank_2024: '23'
+  description: Arithmetic creates value larger than max representable.
+  detection_pattern: (\\+\\+|\\+=|\\*=)(?!.*overflow)
+  fix_pattern: Safe math libraries, range checks, big integers
+  languages:
+  - c
+  - cpp
+  - java
+  example_vuln: '// BAD: Potential overflow
+
+    int total = a + b;'
+  example_fix: '// GOOD: Check overflow
+
+    if (a > INT_MAX - b) throw new Error(''Overflow'');'
+- id: CWE-400
+  name: Uncontrolled Resource Consumption
+  severity: MEDIUM
+  category: DoS
+  rank_2024: '24'
+  description: Consuming excessive system resources (DoS).
+  detection_pattern: (while.*true|for.*;;|setTimeout.*0)
+  fix_pattern: Rate limiting, timeouts, resource quotas
+  languages: all
+  example_vuln: '// BAD: Unbounded recursion
+
+    function loop() { loop(); }'
+  example_fix: '// GOOD: With limit
+
+    function loop(depth = 0) { if (depth > 100) return; loop(depth + 1); }'
+- id: CWE-306
+  name: Missing Authentication
+  severity: CRITICAL
+  category: AuthN
+  rank_2024: '25'
+  description: Critical function lacks proper authentication.
+  detection_pattern: (app\\.(get|post|put|delete)\\()(?!.*auth)
+  fix_pattern: Auth middleware on all protected routes
+  languages: all
+  example_vuln: '// BAD: No auth
+
+    app.delete(''/api/users/:id'', deleteUser)'
+  example_fix: '// GOOD: Auth middleware
+
+    app.delete(''/api/users/:id'', requireAuth, deleteUser)'

package/.agent/skills/core/security/data/language-specific/c-security.yaml

@@ -0,0 +1,295 @@
+metadata:
+  skill: security
+  domain: c_security
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: c-security.csv
+  patterns_count: 25
+  columns:
+  - id
+  - name
+  - severity
+  - category
+  - description
+  - detection_pattern
+  - fix_pattern
+  - cwe
+  - cve_reference
+  - example_vuln
+  - example_fix
+patterns:
+- id: C-01
+  name: Stack Buffer Overflow
+  severity: CRITICAL
+  category: Memory
+  description: Buffer on stack overwritten via user input leading to RCE
+  detection_pattern: (strcpy|sprintf|gets|scanf)\\((?!.*n)
+  fix_pattern: Use strncpy snprintf fgets scanf with width specifier
+  cwe: CWE-121
+  cve_reference: CVE-2025-0282
+  example_vuln: char buf[64]; strcpy(buf, user_input);
+  example_fix: char buf[64]; strncpy(buf, user_input, sizeof(buf)-1); buf[63] = '\\0';
+- id: C-02
+  name: Heap Buffer Overflow
+  severity: CRITICAL
+  category: Memory
+  description: Buffer on heap overwritten allowing heap corruption RCE
+  detection_pattern: (malloc|realloc).*memcpy(?!.*size_check)
+  fix_pattern: Validate size before memcpy use bounded functions
+  cwe: CWE-122
+  cve_reference: CVE-2025-47436
+  example_vuln: char *buf = malloc(64); memcpy(buf, data, data_len);
+  example_fix: if (data_len > 64) return -1; memcpy(buf, data, data_len);
+- id: C-03
+  name: Format String Vulnerability
+  severity: CRITICAL
+  category: Injection
+  description: User input passed directly to printf allows arbitrary read/write
+  detection_pattern: (printf|fprintf|sprintf|syslog)\\(.*input(?!.*%)
+  fix_pattern: Use format specifier never pass user input directly
+  cwe: CWE-134
+  cve_reference: n/a
+  example_vuln: printf(user_input);
+  example_fix: printf(\%s\"
+- id: C-04
+  name: Integer Overflow
+  severity: HIGH
+  category: Math
+  description: Integer arithmetic without overflow check leads to small buffer
+  detection_pattern: (malloc|realloc)\\(.*\\*(?!.*overflow|check)
+  fix_pattern: Check for overflow before arithmetic use safe_mul
+  cwe: CWE-190
+  cve_reference: CVE-2024-7025
+  example_vuln: size_t size = width * height; char *buf = malloc(size);
+  example_fix: if (width > SIZE_MAX/height) return -1; size_t size = width * height;
+- id: C-05
+  name: Off-by-One Error
+  severity: HIGH
+  category: Memory
+  description: Loop boundary error allows one byte overflow
+  detection_pattern: for.*\\<.*=.*len|while.*\\<=.*size
+  fix_pattern: Use strict < comparison verify buffer bounds
+  cwe: CWE-193
+  cve_reference: n/a
+  example_vuln: for (int i = 0; i <= len; i++) buf[i] = src[i];
+  example_fix: for (int i = 0; i < len; i++) buf[i] = src[i];
+- id: C-06
+  name: Use After Free
+  severity: CRITICAL
+  category: Memory
+  description: Memory accessed after free causing crash or code execution
+  detection_pattern: free\\(.*\\).*\\n.*(?!.*=.*NULL)
+  fix_pattern: Set pointer to NULL after free check before use
+  cwe: CWE-416
+  cve_reference: n/a
+  example_vuln: free(ptr); process(ptr);
+  example_fix: free(ptr); ptr = NULL; if (ptr) process(ptr);
+- id: C-07
+  name: Double Free
+  severity: CRITICAL
+  category: Memory
+  description: Memory freed twice causing heap corruption
+  detection_pattern: free\\(.*\\).*\\n.*free\\(.*same_ptr)
+  fix_pattern: Set pointer to NULL after free track allocation state
+  cwe: CWE-415
+  cve_reference: n/a
+  example_vuln: free(ptr); free(ptr);
+  example_fix: free(ptr); ptr = NULL;
+- id: C-08
+  name: Null Pointer Dereference
+  severity: HIGH
+  category: Memory
+  description: Pointer dereferenced without null check
+  detection_pattern: \*\\w+(?!.*if.*!=.*NULL|!=.*NULL)
+  fix_pattern: Check pointer for NULL before dereference
+  cwe: CWE-476
+  cve_reference: n/a
+  example_vuln: return *data;
+  example_fix: if (data == NULL) return -1; return *data;
+- id: C-09
+  name: Command Injection system
+  severity: CRITICAL
+  category: Injection
+  description: system() with user input allows command execution
+  detection_pattern: system\\(.*input|popen\\(.*user
+  fix_pattern: Use execve with argument array avoid shell
+  cwe: CWE-78
+  cve_reference: n/a
+  example_vuln: system(\cat \" + filename);"
+  example_fix: execl(\/bin/cat\"
+- id: C-10
+  name: Path Traversal
+  severity: HIGH
+  category: File
+  description: User file path without validation allows directory escape
+  detection_pattern: fopen\\(.*input(?!.*realpath|canonical)
+  fix_pattern: Use realpath validate path is within allowed directory
+  cwe: CWE-22
+  cve_reference: n/a
+  example_vuln: fopen(user_path, \r\");"
+  example_fix: char *real = realpath(user_path, NULL); if (strncmp(real, base, strlen(base)) != 0) return -1;
+- id: C-11
+  name: Uninitialized Variable
+  severity: HIGH
+  category: Memory
+  description: Variable used before initialization contains garbage
+  detection_pattern: (int|char|void\\*)\\s+\\w+;\\s*(?!.*=).*use
+  fix_pattern: Initialize all variables at declaration
+  cwe: CWE-457
+  cve_reference: n/a
+  example_vuln: int count; if (flag) count = 10; return count;
+  example_fix: int count = 0; if (flag) count = 10; return count;
+- id: C-12
+  name: Race Condition File
+  severity: HIGH
+  category: Concurrency
+  description: TOCTOU race between check and use of file
+  detection_pattern: access\\(.*\\).*open\\(|stat\\(.*\\).*fopen
+  fix_pattern: Use atomic operations fopen directly with flags
+  cwe: CWE-367
+  cve_reference: n/a
+  example_vuln: if (access(file, R_OK) == 0) fopen(file, \r\");"
+  example_fix: FILE *f = fopen(file, \r\"); if (f == NULL) return -1;"
+- id: C-13
+  name: Insecure Temporary File
+  severity: HIGH
+  category: File
+  description: mktemp creates predictable temporary file names
+  detection_pattern: mktemp\\((?!.*mkstemp)
+  fix_pattern: Use mkstemp or tmpfile for secure temp files
+  cwe: CWE-377
+  cve_reference: n/a
+  example_vuln: char *tmp = mktemp(template); fopen(tmp, \w\");"
+  example_fix: int fd = mkstemp(template); FILE *f = fdopen(fd, \w\");"
+- id: C-14
+  name: Memory Leak
+  severity: MEDIUM
+  category: Memory
+  description: Allocated memory never freed causing resource exhaustion
+  detection_pattern: malloc|calloc(?!.*free)
+  fix_pattern: Ensure every malloc has corresponding free use RAII patterns
+  cwe: CWE-401
+  cve_reference: n/a
+  example_vuln: char *buf = malloc(1024); return result;
+  example_fix: char *buf = malloc(1024); /* ... */ free(buf); return result;
+- id: C-15
+  name: Unbounded String Copy
+  severity: CRITICAL
+  category: Memory
+  description: String functions without length limit
+  detection_pattern: strncat.*sizeof(?!.*-1)|strcat\\(
+  fix_pattern: Use strncat with proper size accounting for null terminator
+  cwe: CWE-120
+  cve_reference: n/a
+  example_vuln: strncat(dest, src, sizeof(dest));
+  example_fix: strncat(dest, src, sizeof(dest) - strlen(dest) - 1);
+- id: C-16
+  name: Signed Integer Overflow
+  severity: HIGH
+  category: Math
+  description: Signed integer overflow is undefined behavior
+  detection_pattern: (int|long).*\\+.*>.*MAX|signed.*overflow
+  fix_pattern: Use unsigned types or explicit overflow checks
+  cwe: CWE-190
+  cve_reference: n/a
+  example_vuln: int result = a + b; if (result < a) // Too late
+  example_fix: if (a > INT_MAX - b) return -1; int result = a + b;
+- id: C-17
+  name: Improper Array Index
+  severity: HIGH
+  category: Memory
+  description: Array accessed with unchecked index
+  detection_pattern: \\[.*input\\]|\\[.*user(?!.*check|bound)
+  fix_pattern: Validate array index against bounds before access
+  cwe: CWE-129
+  cve_reference: n/a
+  example_vuln: return array[user_index];
+  example_fix: if (user_index >= array_size) return -1; return array[user_index];
+- id: C-18
+  name: Signal Handler Race
+  severity: HIGH
+  category: Concurrency
+  description: Non-reentrant function called from signal handler
+  detection_pattern: signal.*handler.*printf|malloc.*signal_handler
+  fix_pattern: Use only async-signal-safe functions in handlers
+  cwe: CWE-364
+  cve_reference: n/a
+  example_vuln: void handler(int sig) { printf(\signal\"); }"
+  example_fix: void handler(int sig) { write(1, \signal\"
+- id: C-19
+  name: Weak Random Number
+  severity: HIGH
+  category: Crypto
+  description: rand() used for security-sensitive values
+  detection_pattern: rand\\(\\).*token|srand.*time(?!.*secure)
+  fix_pattern: Use CSPRNG like /dev/urandom or arc4random
+  cwe: CWE-330
+  cve_reference: n/a
+  example_vuln: int token = rand();
+  example_fix: arc4random_buf(token, sizeof(token));
+- id: C-20
+  name: Sensitive Data in Core
+  severity: HIGH
+  category: Information
+  description: Sensitive data may appear in core dumps
+  detection_pattern: password|secret.*malloc(?!.*mlock)
+  fix_pattern: Use mlock to prevent paging clear sensitive data
+  cwe: CWE-316
+  cve_reference: n/a
+  example_vuln: char *password = malloc(256);
+  example_fix: char *password = malloc(256); mlock(password, 256);
+- id: C-21
+  name: va_arg Type Mismatch
+  severity: CRITICAL
+  category: Memory
+  description: va_arg used with wrong type causing undefined behavior
+  detection_pattern: va_arg\\(.*,\\s*\\w+(?!.*promoted)
+  fix_pattern: Match va_arg type with actual argument type
+  cwe: CWE-119
+  cve_reference: n/a
+  example_vuln: int val = va_arg(args, short); // Wrong
+  example_fix: int val = va_arg(args, int); // short promotes to int
+- id: C-22
+  name: Uncontrolled Recursion
+  severity: MEDIUM
+  category: DoS
+  description: Recursive function without depth limit causes stack overflow
+  detection_pattern: \\w+\\(.*\\)\\s*\\{[^}]*\\w+\\((?!.*depth)
+  fix_pattern: Add depth parameter and limit max recursion depth
+  cwe: CWE-674
+  cve_reference: n/a
+  example_vuln: void parse(Node *n) { parse(n->child); }
+  example_fix: void parse(Node *n, int depth) { if (depth > MAX_DEPTH) return; parse(n->child, depth+1); }
+- id: C-23
+  name: Dangerous Function gets
+  severity: CRITICAL
+  category: Memory
+  description: gets() has no bounds checking now deprecated
+  detection_pattern: gets\\(
+  fix_pattern: Replace with fgets() which has size limit
+  cwe: CWE-242
+  cve_reference: n/a
+  example_vuln: gets(buffer);
+  example_fix: fgets(buffer, sizeof(buffer), stdin);
+- id: C-24
+  name: Missing Return Value Check
+  severity: HIGH
+  category: Error
+  description: malloc/realloc return value not checked for NULL
+  detection_pattern: (malloc|realloc)\\(.*\\)(?!.*if.*==.*NULL|!=.*NULL)
+  fix_pattern: Always check return value of memory allocation
+  cwe: CWE-252
+  cve_reference: n/a
+  example_vuln: char *p = malloc(size); *p = 'x';
+  example_fix: char *p = malloc(size); if (p == NULL) return -1; *p = 'x';
+- id: C-25
+  name: Insecure Permissions
+  severity: MEDIUM
+  category: File
+  description: File created with world-readable permissions
+  detection_pattern: open\\(.*0777|fopen(?!.*fchmod)
+  fix_pattern: Use restrictive permissions 0600 for sensitive files
+  cwe: CWE-732
+  cve_reference: n/a
+  example_vuln: open(file, O_CREAT, 0777);
+  example_fix: open(file, O_CREAT, 0600);