@nockdev/awf 6.2.0

package/.agent/skills/core/security/data/mobile-security.yaml

@@ -0,0 +1,369 @@
+metadata:
+  skill: security
+  domain: mobile_security
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: mobile-security.csv
+  patterns_count: 35
+  columns:
+  - id
+  - name
+  - severity
+  - category
+  - platform
+  - description
+  - detection_pattern
+  - fix_pattern
+  - example_vuln
+  - example_fix
+patterns:
+- id: MS-01
+  name: Insecure Data Storage
+  severity: CRITICAL
+  category: Storage
+  platform: Both
+  description: Sensitive data stored unencrypted in SharedPreferences or UserDefaults
+  detection_pattern: (SharedPreferences|UserDefaults|NSUserDefaults).*put.*(password|token|secret|key)
+  fix_pattern: Use EncryptedSharedPreferences or Keychain
+  example_vuln: sharedPrefs.edit().putString('password', pwd)
+  example_fix: val encPrefs = EncryptedSharedPreferences.create(...)\nencPrefs.edit().putString('password', pwd)
+- id: MS-02
+  name: Hardcoded Credentials
+  severity: CRITICAL
+  category: Secrets
+  platform: Both
+  description: API keys secrets or passwords hardcoded in source or resources
+  detection_pattern: (api.*key|password|secret|token)\\s*=\\s*['\][^'\"]{8
+  fix_pattern: '}[''\"]"'
+  example_vuln: Use secure key management at runtime not build time
+  example_fix: const API_KEY = 'sk-1234567890abcdef'
+- id: MS-03
+  name: Exported Components Vulnerable
+  severity: HIGH
+  category: Android
+  platform: Android
+  description: Activities services receivers exported without permission checks
+  detection_pattern: <(activity|service|receiver).*exported\\s*=\\s*\true\"(?!.*permission)"
+  fix_pattern: Set exported=false or require custom permissions
+  example_vuln: <activity android:exported='true' />
+  example_fix: <activity android:exported='true'\n  android:permission='com.app.INTERNAL' />
+- id: MS-04
+  name: Intent Injection
+  severity: HIGH
+  category: Android
+  platform: Android
+  description: Intent data used without validation enabling injection
+  detection_pattern: getIntent\\(\\)\\.get.*(String|Extra|Data)(?!.*valid)
+  fix_pattern: Validate all Intent extras before use
+  example_vuln: val url = intent.getStringExtra('url')
+  example_fix: val url = intent.getStringExtra('url')\nif (!isValidUrl(url)) return
+- id: MS-05
+  name: Content Provider SQL Injection
+  severity: CRITICAL
+  category: Android
+  platform: Android
+  description: Content provider query without parameterized selection
+  detection_pattern: query\\(.*selection.*\\+(?!.*param)
+  fix_pattern: Use parameterized selection with selectionArgs
+  example_vuln: query(uri, null, 'id=' + input, null)
+  example_fix: query(uri, null, 'id=?', arrayOf(input))
+- id: MS-06
+  name: WebView JavaScript Enabled
+  severity: HIGH
+  category: WebView
+  platform: Both
+  description: WebView with JavaScript enabled handling untrusted content
+  detection_pattern: setJavaScriptEnabled\\s*\\(\\s*true\\s*\\)
+  fix_pattern: Disable JS if not needed validate all loaded URLs
+  example_vuln: webView.settings.javaScriptEnabled = true
+  example_fix: if (isTrustedUrl(url)) {\n  webView.settings.javaScriptEnabled = true\n}
+- id: MS-07
+  name: WebView File Access
+  severity: HIGH
+  category: WebView
+  platform: Android
+  description: WebView allows file:// access enabling local file theft
+  detection_pattern: setAllowFileAccess\\s*\\(\\s*true\\s*\\)
+  fix_pattern: Disable file access unless needed restrict to app files
+  example_vuln: webView.settings.allowFileAccess = true
+  example_fix: webView.settings.allowFileAccess = false\nwebView.settings.allowFileAccessFromFileURLs = false
+- id: MS-08
+  name: Insecure Deep Links
+  severity: HIGH
+  category: Scheme
+  platform: Both
+  description: Deep link handlers do not validate parameters
+  detection_pattern: (intent\\.data|url\\.queryItems)(?!.*valid)
+  fix_pattern: Validate all deep link parameters use allowlists
+  example_vuln: val action = intent.data?.getQueryParameter('action')
+  example_fix: val action = intent.data?.getQueryParameter('action')\nif (action !in ALLOWED_ACTIONS) return
+- id: MS-09
+  name: Broadcast Receiver Unprotected
+  severity: HIGH
+  category: Android
+  platform: Android
+  description: Broadcast receiver without permission protection
+  detection_pattern: registerReceiver\\(.*IntentFilter(?!.*permission)
+  fix_pattern: Use LocalBroadcastManager or require permissions
+  example_vuln: registerReceiver(receiver, filter)
+  example_fix: LocalBroadcastManager.getInstance(this).registerReceiver(receiver, filter)
+- id: MS-10
+  name: Keychain Misconfiguration
+  severity: HIGH
+  category: iOS
+  platform: iOS
+  description: Keychain access not properly restricted to app
+  detection_pattern: kSecAttrAccessible.*Always|kSecAttrAccessGroupToken
+  fix_pattern: Use AfterFirstUnlock or WhenPasscodeSetThisDeviceOnly
+  example_vuln: 'kSecAttrAccessible: kSecAttrAccessibleAlways'
+  example_fix: 'kSecAttrAccessible: kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly'
+- id: MS-11
+  name: Biometric Bypass
+  severity: HIGH
+  category: Auth
+  platform: Both
+  description: Biometric auth can be bypassed via Frida or Xposed
+  detection_pattern: BiometricPrompt|LAContext(?!.*fallback.*false)
+  fix_pattern: Combine biometric with server-side verification
+  example_vuln: LAContext().evaluatePolicy(.deviceOwnerAuthenticationWithBiometrics)
+  example_fix: // Combine with server challenge\nlet challenge = fetchServerChallenge()\nvalidateBiometricWithChallenge(challenge)
+- id: MS-12
+  name: Clipboard Exposure
+  severity: MEDIUM
+  category: Privacy
+  platform: Both
+  description: Sensitive data copied to clipboard without timeout
+  detection_pattern: (UIPasteboard|ClipboardManager)\\.set(?!.*expir)
+  fix_pattern: Clear clipboard after timeout or use sensitive mode
+  example_vuln: UIPasteboard.general.string = password
+  example_fix: 'UIPasteboard.general.setItems([[:password]], options: [.expirationDate: Date().addingTimeInterval(30)])'
+- id: MS-13
+  name: Screenshot Allowed
+  severity: MEDIUM
+  category: Privacy
+  platform: Both
+  description: Sensitive screens can be captured via screenshot
+  detection_pattern: (?<!FLAG_SECURE).*setContentView|(?<!ViewController).*viewDidLoad
+  fix_pattern: Set FLAG_SECURE or use screenshot detection
+  example_vuln: setContentView(R.layout.login)
+  example_fix: window.setFlags(FLAG_SECURE, FLAG_SECURE)\nsetContentView(R.layout.login)
+- id: MS-14
+  name: Background Snapshot
+  severity: MEDIUM
+  category: Privacy
+  platform: iOS
+  description: App snapshot visible in app switcher with sensitive data
+  detection_pattern: applicationDidEnterBackground(?!.*blur|overlay)
+  fix_pattern: Add blur overlay when entering background
+  example_vuln: func applicationDidEnterBackground() { }
+  example_fix: func applicationDidEnterBackground() {\n  window?.addSubview(blurOverlay)\n}
+- id: MS-15
+  name: Insecure Logging
+  severity: HIGH
+  category: Privacy
+  platform: Both
+  description: Sensitive data logged to console or files
+  detection_pattern: (Log\\.|NSLog|print|console\\.log).*password|token|secret
+  fix_pattern: Remove sensitive data from logs use debug-only logging
+  example_vuln: 'Log.d(''Auth'', ''Token: '' + token)'
+  example_fix: 'if (BuildConfig.DEBUG) Log.d(''Auth'', ''Token: [REDACTED]'')'
+- id: MS-16
+  name: Certificate Transparency Missing
+  severity: MEDIUM
+  category: Network
+  platform: Both
+  description: App does not verify Certificate Transparency logs
+  detection_pattern: (?<!CT|transparency).*TrustManager|URLSession
+  fix_pattern: Enable CT verification for critical connections
+  example_vuln: // No CT check
+  example_fix: // Enable CT\nconnection.enableCertificateTransparency = true
+- id: MS-17
+  name: Weak Crypto Algorithm
+  severity: HIGH
+  category: Crypto
+  platform: Both
+  description: Using deprecated crypto like MD5 SHA1 DES RC4
+  detection_pattern: (MD5|SHA1|DES|RC4|ECB)(?!.*deprecated|legacy)
+  fix_pattern: 'Use modern algorithms: SHA-256+ AES-GCM Argon2'
+  example_vuln: MessageDigest.getInstance('MD5')
+  example_fix: MessageDigest.getInstance('SHA-256')
+- id: MS-18
+  name: Insecure Random
+  severity: HIGH
+  category: Crypto
+  platform: Both
+  description: Using non-cryptographic random for security tokens
+  detection_pattern: (Random|Math\\.random|rand\\(\\))(?!.*Secure)
+  fix_pattern: Use SecureRandom or platform crypto APIs
+  example_vuln: val token = Random().nextInt().toString()
+  example_fix: val token = SecureRandom().nextBytes(32).toHex()
+- id: MS-19
+  name: Missing Certificate Validation
+  severity: CRITICAL
+  category: Network
+  platform: Both
+  description: TLS certificate validation disabled or incomplete
+  detection_pattern: (ALLOW_ALL|TrustManager.*checkServerTrusted.*\\{\\s*\\})
+  fix_pattern: Always validate certificates use system trust store
+  example_vuln: override fun checkServerTrusted() { }
+  example_fix: override fun checkServerTrusted(chain, authType) {\n  defaultTrustManager.checkServerTrusted(chain, authType)\n}
+- id: MS-20
+  name: Cleartext Traffic
+  severity: HIGH
+  category: Network
+  platform: Both
+  description: App allows HTTP cleartext traffic
+  detection_pattern: (cleartextTrafficPermitted|NSAllowsArbitraryLoads|http://)
+  fix_pattern: Enforce HTTPS only via network security config
+  example_vuln: android:usesCleartextTraffic='true'
+  example_fix: android:usesCleartextTraffic='false'\n// Or network_security_config.xml
+- id: MS-21
+  name: Privacy Controls Missing M6
+  severity: HIGH
+  category: Privacy
+  platform: Both
+  description: Inadequate privacy controls for PII collection - OWASP 2024
+  detection_pattern: (collect|track|analytics)(?!.*consent|gdpr|privacy)
+  fix_pattern: Implement consent mechanisms and privacy controls
+  example_vuln: analytics.track(userId, event)
+  example_fix: if (userConsent.analytics) analytics.track(userId, event)
+- id: MS-22
+  name: Data Minimization Failure
+  severity: MEDIUM
+  category: Privacy
+  platform: Both
+  description: App collects more data than necessary
+  detection_pattern: (collect|store).*(location|contacts|photos)(?!.*required)
+  fix_pattern: Collect only necessary data explain purpose
+  example_vuln: requestPermissions([CONTACTS, LOCATION, CAMERA])
+  example_fix: // Only request what's needed\nrequestPermissions([CAMERA]) // For QR scan only
+- id: MS-23
+  name: Third Party SDK Risks
+  severity: HIGH
+  category: Privacy
+  platform: Both
+  description: Unvetted third-party SDKs with excessive permissions
+  detection_pattern: (facebook|google|firebase|analytics)(?!.*privacy.*reviewed)
+  fix_pattern: Audit SDK permissions and data collection
+  example_vuln: implementation 'com.analytics:sdk:1.0'
+  example_fix: '// Audit SDK before adding\n// Check: permissions, data collection, privacy policy'
+- id: MS-24
+  name: Insecure Backup
+  severity: HIGH
+  category: Storage
+  platform: Android
+  description: App data included in auto-backup without encryption
+  detection_pattern: android:allowBackup\\s*=\\s*\true\"(?!.*fullBackupContent)"
+  fix_pattern: Disable backup or use encrypted backup rules
+  example_vuln: android:allowBackup='true'
+  example_fix: android:allowBackup='false'\n// Or use backup_rules.xml with encryption
+- id: MS-25
+  name: Missing App Transport Security
+  severity: HIGH
+  category: Network
+  platform: iOS
+  description: ATS disabled allowing insecure connections
+  detection_pattern: NSAllowsArbitraryLoads.*true
+  fix_pattern: Enable ATS and only allow specific exceptions
+  example_vuln: 'NSAllowsArbitraryLoads: true'
+  example_fix: 'NSAllowsArbitraryLoads: false\n// Add specific domain exceptions only'
+- id: MS-26
+  name: Insecure IPC
+  severity: HIGH
+  category: Android
+  platform: Android
+  description: Inter-process communication without validation
+  detection_pattern: Messenger|AIDL|ContentProvider(?!.*permission|validate)
+  fix_pattern: Validate all IPC inputs and require permissions
+  example_vuln: 'override fun onBind(intent: Intent) = binder'
+  example_fix: 'override fun onBind(intent: Intent): IBinder? {\n  if (!validateCaller()) return null\n  return binder\n}'
+- id: MS-27
+  name: Tapjacking Vulnerable
+  severity: MEDIUM
+  category: Android
+  platform: Android
+  description: Views do not filter touch events behind overlays
+  detection_pattern: setOnClickListener(?!.*filterTouchesWhenObscured)
+  fix_pattern: Enable filterTouchesWhenObscured for sensitive buttons
+  example_vuln: button.setOnClickListener { transfer() }
+  example_fix: button.filterTouchesWhenObscured = true\nbutton.setOnClickListener { transfer() }
+- id: MS-28
+  name: Pending Intent Mutable
+  severity: HIGH
+  category: Android
+  platform: Android
+  description: Mutable PendingIntent can be hijacked
+  detection_pattern: PendingIntent\\.get.*(?!.*FLAG_IMMUTABLE)
+  fix_pattern: Use FLAG_IMMUTABLE for PendingIntents
+  example_vuln: PendingIntent.getActivity(ctx, 0, intent, 0)
+  example_fix: PendingIntent.getActivity(ctx, 0, intent, FLAG_IMMUTABLE)
+- id: MS-29
+  name: Task Affinity Hijack
+  severity: MEDIUM
+  category: Android
+  platform: Android
+  description: Default task affinity allows activity hijacking
+  detection_pattern: <activity(?!.*taskAffinity=\\").*>"
+  fix_pattern: Set empty taskAffinity for sensitive activities
+  example_vuln: <activity android:name='.PaymentActivity'/>
+  example_fix: <activity android:name='.PaymentActivity'\n  android:taskAffinity='' />
+- id: MS-30
+  name: URL Scheme Hijack
+  severity: HIGH
+  category: iOS
+  platform: iOS
+  description: Custom URL scheme can be hijacked by malicious apps
+  detection_pattern: CFBundleURLSchemes(?!.*universal.*link)
+  fix_pattern: Use Universal Links instead of custom schemes
+  example_vuln: <string>myapp</string> // Custom scheme
+  example_fix: '// Use Universal Links\nassociated-domains: applinks:example.com'
+- id: MS-31
+  name: Extension Data Leak
+  severity: MEDIUM
+  category: iOS
+  platform: iOS
+  description: App extensions share sensitive data insecurely
+  detection_pattern: NSExtensionActivationRule.*TRUEPREDICATE
+  fix_pattern: Restrict extension activation to specific types
+  example_vuln: 'NSExtensionActivationRule: TRUEPREDICATE'
+  example_fix: 'NSExtensionActivationSupportsText: true\n// Only allow text sharing'
+- id: MS-32
+  name: Face ID Fallback
+  severity: MEDIUM
+  category: iOS
+  platform: iOS
+  description: Face ID falls back to passcode without warning
+  detection_pattern: LAPolicy.*deviceOwnerAuthentication(?!.*biometrics)
+  fix_pattern: Use biometricsOnly policy for sensitive operations
+  example_vuln: context.evaluatePolicy(.deviceOwnerAuthentication)
+  example_fix: context.evaluatePolicy(.deviceOwnerAuthenticationWithBiometrics)
+- id: MS-33
+  name: Simulator Detection Missing
+  severity: MEDIUM
+  category: Mobile
+  platform: Both
+  description: App does not detect simulator or emulator environment
+  detection_pattern: (TARGET_IPHONE_SIMULATOR|Build\\.FINGERPRINT)(?!.*detect)
+  fix_pattern: Detect simulators and disable sensitive features
+  example_vuln: // No simulator check
+  example_fix: '#if targetEnvironment(simulator)\n  sensitiveFeatures.isEnabled = false\n#endif'
+- id: MS-34
+  name: Debug Assertions
+  severity: LOW
+  category: Debug
+  platform: Both
+  description: Debug assertions expose internal state in production
+  detection_pattern: (assert|NSAssert|precondition).*secret|password
+  fix_pattern: Remove sensitive assertions or use production guards
+  example_vuln: 'assert(password.length > 8, ''Password: \(password)'')'
+  example_fix: assert(password.length > 8) // No sensitive data
+- id: MS-35
+  name: Universal Links Bypass
+  severity: MEDIUM
+  category: iOS
+  platform: iOS
+  description: Universal Links validation can be bypassed
+  detection_pattern: apple-app-site-association(?!.*appID.*teamID)
+  fix_pattern: Verify applinks domain and AASA file properly
+  example_vuln: // Malformed AASA file
+  example_fix: // Properly configured AASA with correct team ID and bundle ID

package/.agent/skills/core/security/data/network-security.yaml

@@ -0,0 +1,297 @@
+metadata:
+  skill: security
+  domain: network_security
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: network-security.csv
+  patterns_count: 25
+  columns:
+  - id
+  - name
+  - severity
+  - category
+  - description
+  - detection_pattern
+  - fix_pattern
+  - languages
+  - example_vuln
+  - example_fix
+patterns:
+- id: NS-01
+  name: TLS Version Downgrade
+  severity: CRITICAL
+  category: Protocol
+  description: Allowing fallback to TLS 1.0/1.1 or SSLv3
+  detection_pattern: (SSLv3|TLSv1\\.0|TLSv1\\.1|TLS1_0|TLS1_1)
+  fix_pattern: Force TLS 1.2+ only disable legacy protocols
+  languages: all
+  example_vuln: 'minVersion: tls.VersionTLS10'
+  example_fix: 'minVersion: tls.VersionTLS12 // NIST mandatory 2024'
+- id: NS-02
+  name: Certificate Validation Bypass
+  severity: CRITICAL
+  category: TLS
+  description: Disabling certificate verification in production
+  detection_pattern: (InsecureSkipVerify.*true|verify.*false|SSL_VERIFY_NONE|CERT_NONE|checkServerIdentity.*null)
+  fix_pattern: Always verify certificates and pin critical ones
+  languages:
+  - go
+  - python
+  - java
+  - javascript
+  - csharp
+  example_vuln: 'InsecureSkipVerify: true'
+  example_fix: 'InsecureSkipVerify: false\nRootCAs: trustedCertPool'
+- id: NS-03
+  name: Weak Cipher Suites
+  severity: HIGH
+  category: Crypto
+  description: Using export-grade DES RC4 or weak ciphers
+  detection_pattern: (RC4|DES|3DES|EXPORT|NULL|MD5|SHA1(?!-)|anon)
+  fix_pattern: 'Use only modern ciphers: AES-GCM ChaCha20-Poly1305'
+  languages: all
+  example_vuln: TLS_RSA_WITH_RC4_128_SHA
+  example_fix: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+- id: NS-04
+  name: DNS Rebinding
+  severity: HIGH
+  category: Network
+  description: Application does not validate Host header allowing DNS rebinding attacks
+  detection_pattern: (Host:.*|req\\.headers\\.host)(?!.*allowlist|whitelist)
+  fix_pattern: Validate Host header against allowlist
+  languages: all
+  example_vuln: const host = req.headers.host // Untrusted
+  example_fix: const ALLOWED = ['api.example.com']\nif (!ALLOWED.includes(host)) return res.status(403)
+- id: NS-05
+  name: WebSocket Origin Bypass
+  severity: HIGH
+  category: Protocol
+  description: Not validating Origin header for WebSocket connections
+  detection_pattern: (ws://|wss://)(?!.*origin.*valid)
+  fix_pattern: Check Origin header against allowlist
+  languages:
+  - javascript
+  - go
+  - python
+  example_vuln: ws.on('connection', (client) => {})
+  example_fix: if (req.headers.origin !== 'https://example.com') ws.close()
+- id: NS-06
+  name: Certificate Pinning Missing
+  severity: LOW
+  category: Mobile
+  description: 'Mobile app does not pin certificates for critical domains - NOTE: largely obsolete in 2024'
+  detection_pattern: (URLSession|OkHttp|fetch)(?!.*pinning)
+  fix_pattern: Consider mTLS or Certificate Transparency instead of pinning
+  languages:
+  - swift
+  - kotlin
+  - java
+  example_vuln: URLSession.shared.dataTask(url)
+  example_fix: '// Modern: Use Certificate Transparency\n// Or: mTLS for service-to-service'
+- id: NS-07
+  name: HTTP Request Smuggling
+  severity: HIGH
+  category: Protocol
+  description: Inconsistent parsing of Content-Length and Transfer-Encoding headers
+  detection_pattern: (Content-Length.*Transfer-Encoding|Transfer-Encoding.*Content-Length)
+  fix_pattern: Use HTTP/2 normalize headers reject ambiguous requests
+  languages: all
+  example_vuln: 'Content-Length: 6\nTransfer-Encoding: chunked'
+  example_fix: // Use HTTP/2 or reject if TE && CL both present
+- id: NS-08
+  name: GraphQL Introspection Leak
+  severity: MEDIUM
+  category: API
+  description: GraphQL introspection enabled in production exposing schema
+  detection_pattern: (introspection.*true|__schema|__type)(?!.*prod.*false)
+  fix_pattern: Disable introspection in production
+  languages:
+  - javascript
+  - go
+  - python
+  - java
+  example_vuln: 'introspection: true'
+  example_fix: 'introspection: process.env.NODE_ENV === ''development'''
+- id: NS-09
+  name: GraphQL Batching Attack
+  severity: HIGH
+  category: API
+  description: No limits on GraphQL batched queries enabling brute force
+  detection_pattern: (graphql.*batch|batching.*true)(?!.*limit)
+  fix_pattern: Limit batch size and add rate limiting per operation
+  languages:
+  - javascript
+  - go
+  - python
+  example_vuln: // No batch limits
+  example_fix: 'maxBatchSize: 10\nrateLimit: { window: ''1m'', max: 100 }'
+- id: NS-10
+  name: GraphQL Query Depth DoS
+  severity: HIGH
+  category: API
+  description: No query depth limits allowing resource exhaustion
+  detection_pattern: (graphql)(?!.*depth.*limit|maxDepth)
+  fix_pattern: Set maximum query depth typically 7-10 levels
+  languages:
+  - javascript
+  - go
+  - python
+  example_vuln: // No depth limit - 69% of APIs vulnerable
+  example_fix: 'validationRules: [depthLimit(10)]'
+- id: NS-11
+  name: GraphQL Field Duplication
+  severity: MEDIUM
+  category: API
+  description: No limits on field duplication causing redundant computation
+  detection_pattern: (graphql)(?!.*fieldDedupe|duplicateField)
+  fix_pattern: Deduplicate identical fields in queries
+  languages:
+  - javascript
+  - go
+  - python
+  example_vuln: query { user { name name name name } }
+  example_fix: // Use field deduplication middleware
+- id: NS-12
+  name: gRPC Metadata Injection
+  severity: HIGH
+  category: Protocol
+  description: Untrusted metadata passed to gRPC without validation
+  detection_pattern: (metadata\\.append|metadata\\.set|WithOutgoingContext).*user
+  fix_pattern: Validate and sanitize all incoming metadata
+  languages:
+  - go
+  - java
+  - python
+  - csharp
+  example_vuln: md.Append('auth', req.Query.token)
+  example_fix: if (!isValidToken(token)) throw\nmd.Append('auth', sanitize(token))
+- id: NS-13
+  name: WebRTC IP Leak
+  severity: MEDIUM
+  category: Browser
+  description: WebRTC reveals real IP even behind VPN or proxy
+  detection_pattern: (RTCPeerConnection|getUserMedia)(?!.*TURN)
+  fix_pattern: Use TURN servers only or disable WebRTC
+  languages: javascript
+  example_vuln: new RTCPeerConnection()
+  example_fix: 'iceServers: [{ urls: ''turn:relay.example.com'' }]\niceCandidatePoolSize: 0'
+- id: NS-14
+  name: Missing HSTS Header
+  severity: HIGH
+  category: HTTP
+  description: Strict-Transport-Security header not set
+  detection_pattern: (?<!Strict-Transport-Security.*)response\\.header
+  fix_pattern: Add HSTS header with min 1 year max-age
+  languages: all
+  example_vuln: // No HSTS header
+  example_fix: 'Strict-Transport-Security: max-age=31536000; includeSubDomains; preload'
+- id: NS-15
+  name: Missing CSP Header
+  severity: MEDIUM
+  category: HTTP
+  description: Content-Security-Policy header not configured
+  detection_pattern: (?<!Content-Security-Policy.*)response\\.header
+  fix_pattern: Set restrictive CSP with nonce or hash
+  languages: all
+  example_vuln: // No CSP
+  example_fix: 'Content-Security-Policy: default-src ''self''; script-src ''nonce-{random}'''
+- id: NS-16
+  name: CORS Wildcard
+  severity: HIGH
+  category: HTTP
+  description: Access-Control-Allow-Origin set to * with credentials
+  detection_pattern: Access-Control-Allow-Origin.*\\*.*credentials
+  fix_pattern: Use specific origin allowlist not wildcard
+  languages: all
+  example_vuln: 'Access-Control-Allow-Origin: *'
+  example_fix: 'Access-Control-Allow-Origin: https://trusted.example.com'
+- id: NS-17
+  name: Missing X-Frame-Options
+  severity: MEDIUM
+  category: HTTP
+  description: X-Frame-Options or CSP frame-ancestors not set
+  detection_pattern: (?<!X-Frame-Options|frame-ancestors.*)response
+  fix_pattern: 'Add X-Frame-Options: DENY or SAMEORIGIN'
+  languages: all
+  example_vuln: // No frame protection
+  example_fix: 'X-Frame-Options: DENY\n// Or CSP: frame-ancestors ''none'''
+- id: NS-18
+  name: Cookie Without Secure Flag
+  severity: HIGH
+  category: HTTP
+  description: Sensitive cookies without Secure SameSite HttpOnly flags
+  detection_pattern: (Set-Cookie|cookie)(?!.*(Secure|HttpOnly|SameSite))
+  fix_pattern: Always set Secure HttpOnly SameSite=Strict for auth cookies
+  languages: all
+  example_vuln: 'Set-Cookie: session=abc123'
+  example_fix: 'Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Strict'
+- id: NS-19
+  name: Server Version Disclosure
+  severity: LOW
+  category: HTTP
+  description: Server header exposes software version information
+  detection_pattern: Server:.*(Apache|nginx|IIS).*\\d+\\.\\d+
+  fix_pattern: Remove or obfuscate Server header in production
+  languages: all
+  example_vuln: 'Server: nginx/1.21.0'
+  example_fix: 'Server: web-server'
+- id: NS-20
+  name: SSRF via URL Parameter
+  severity: CRITICAL
+  category: Network
+  description: User-controlled URLs fetched without validation
+  detection_pattern: (fetch|request|urllib|http\\.get)\\(.*req\\.(query|body|params)
+  fix_pattern: Validate URLs against allowlist block internal IPs
+  languages: all
+  example_vuln: fetch(req.query.url)
+  example_fix: const parsed = new URL(req.query.url)\nif (!ALLOWED_HOSTS.includes(parsed.host)) throw
+- id: NS-21
+  name: Open Redirect
+  severity: MEDIUM
+  category: HTTP
+  description: Redirects based on user input without validation
+  detection_pattern: (redirect|location).*=.*req\\.(query|body|params)
+  fix_pattern: Validate redirect URLs against allowlist
+  languages: all
+  example_vuln: res.redirect(req.query.next)
+  example_fix: if (!isInternalUrl(req.query.next)) throw\nres.redirect(req.query.next)
+- id: NS-22
+  name: Missing OCSP Stapling
+  severity: LOW
+  category: TLS
+  description: OCSP stapling not enabled causing latency and privacy issues
+  detection_pattern: (?<!ocsp.*stapl)
+  fix_pattern: Enable OCSP stapling for faster TLS handshakes
+  languages: all
+  example_vuln: // No OCSP stapling config
+  example_fix: ssl_stapling on;\nssl_stapling_verify on;
+- id: NS-23
+  name: Missing DNSSEC
+  severity: LOW
+  category: DNS
+  description: DNS responses not validated with DNSSEC
+  detection_pattern: (?<!dnssec)
+  fix_pattern: Enable DNSSEC validation for DNS queries
+  languages: all
+  example_vuln: // No DNSSEC validation
+  example_fix: resolver.dnssec = true
+- id: NS-24
+  name: Insecure WebSocket
+  severity: HIGH
+  category: Protocol
+  description: WebSocket connection over ws:// instead of wss://
+  detection_pattern: ws://(?!localhost|127\\.0\\.0\\.1)
+  fix_pattern: Always use wss:// for WebSocket connections
+  languages: all
+  example_vuln: ws://api.example.com/socket
+  example_fix: wss://api.example.com/socket
+- id: NS-25
+  name: Missing Rate Limiting
+  severity: HIGH
+  category: API
+  description: No rate limiting on API endpoints enabling DoS and brute force
+  detection_pattern: (express|fastify|gin|echo)(?!.*rateLimit|throttle)
+  fix_pattern: Implement rate limiting per IP and per user
+  languages: all
+  example_vuln: app.get('/api/login')
+  example_fix: 'app.use(rateLimit({ windowMs: 60000, max: 100 }))'