@nockdev/awf 6.2.0

package/.agent/skills/core/security/data/owasp-top10.yaml

@@ -0,0 +1,171 @@
+metadata:
+  skill: security
+  domain: owasp_top10
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: owasp-top10.csv
+  patterns_count: 10
+  columns:
+  - id
+  - name
+  - severity
+  - version
+  - description
+  - detection_pattern
+  - fix_pattern
+  - languages
+  - example_vuln
+  - example_fix
+patterns:
+- id: A01
+  name: Broken Access Control
+  severity: CRITICAL
+  version: '2025'
+  description: 'Missing authorization checks. #1 in both 2021 and 2025. 100% of apps have some form.'
+  detection_pattern: (!authz|!permission|!role|admin|delete|update).*endpoint
+  fix_pattern: Implement RBAC/ABAC, check permissions on every request, deny by default
+  languages: all
+  example_vuln: '// BAD: No auth check
+
+    app.delete(''/users/:id'', (req, res) => db.deleteUser(req.params.id))'
+  example_fix: '// GOOD: Auth middleware + role check
+
+    app.delete(''/users/:id'', auth, requireRole(''admin''), (req, res) => ...)'
+- id: A02
+  name: Security Misconfiguration
+  severity: CRITICAL
+  version: '2025'
+  description: 'Moved UP to #2 in 2025 (was #5 in 2021). Default configs, verbose errors, unused features.'
+  detection_pattern: (debug.*true|verbose|stack.*trace|default.*password)
+  fix_pattern: Hardened configs, disable unused features, custom error pages, security headers
+  languages: all
+  example_vuln: '// BAD: Debug mode in production
+
+    DEBUG=true
+
+    SHOW_STACK_TRACE=true'
+  example_fix: '// GOOD: Production config
+
+    DEBUG=false
+
+    SHOW_STACK_TRACE=false
+
+    ERROR_PAGE=/errors/500.html'
+- id: A03
+  name: Software Supply Chain Failures
+  severity: CRITICAL
+  version: '2025'
+  description: NEW in 2025! Replaces 'Vulnerable Components'. Covers CI/CD, dependencies, build pipelines.
+  detection_pattern: (npm install|pip install|unsigned|http://|package-lock|yarn.lock)
+  fix_pattern: Signed releases, verified checksums, lock files, SBOM, private registries, dependency scanning
+  languages: all
+  example_vuln: '// BAD: Trusting external scripts, no SRI
+
+    <script src=''http://cdn.example.com/lib.js''>
+
+    // BAD: No lockfile verification'
+  example_fix: '// GOOD: SRI hash + HTTPS
+
+    <script src=''https://...'' integrity=''sha384-...''>
+
+    // GOOD: npm ci --ignore-scripts + audit'
+- id: A04
+  name: Insecure Design
+  severity: HIGH
+  version: '2025'
+  description: Architectural flaws that can't be fixed by implementation. Missing threat modeling.
+  detection_pattern: (todo|fixme|hack|workaround).*security
+  fix_pattern: Threat modeling, secure design patterns, defense in depth, security requirements
+  languages: all
+  example_vuln: '// BAD: Password in URL
+
+    GET /reset-password?token=abc&newPassword=secret'
+  example_fix: '// GOOD: POST with body, rate limited
+
+    POST /reset-password { token, newPassword }'
+- id: A05
+  name: Cryptographic Failures
+  severity: CRITICAL
+  version: '2025'
+  description: 'Moved DOWN to #5 in 2025 (was #2 in 2021). Weak encryption, plaintext passwords.'
+  detection_pattern: (md5|sha1|plaintext|http://)
+  fix_pattern: Use bcrypt/argon2 for passwords, TLS 1.3, AES-256-GCM for data at rest
+  languages: all
+  example_vuln: '// BAD: MD5 password hash
+
+    const hash = crypto.createHash(''md5'').update(password).digest(''hex'')'
+  example_fix: '// GOOD: bcrypt with cost factor 12
+
+    const hash = await bcrypt.hash(password, 12)'
+- id: A06
+  name: Injection
+  severity: CRITICAL
+  version: '2025'
+  description: 'Moved DOWN to #6 in 2025 (was #3 in 2021). SQL/NoSQL/OS command injection.'
+  detection_pattern: (query\\s*\\+|exec\\s*\\(|eval\\s*\\(|system\\s*\\()
+  fix_pattern: Parameterized queries, input validation, ORM with safe methods
+  languages: all
+  example_vuln: '// BAD: SQL injection
+
+    db.query(''SELECT * FROM users WHERE id = '' + req.params.id)'
+  example_fix: '// GOOD: Parameterized query
+
+    db.query(''SELECT * FROM users WHERE id = $1'', [req.params.id])'
+- id: A07
+  name: Identification and Authentication Failures
+  severity: CRITICAL
+  version: '2025'
+  description: Weak passwords, no MFA, session fixation, credential stuffing.
+  detection_pattern: (password.*=|session.*id|token.*storage)
+  fix_pattern: MFA, password policies (NIST 800-63B), secure session management, rate limiting
+  languages: all
+  example_vuln: '// BAD: Session ID in URL
+
+    GET /dashboard?sessionId=abc123'
+  example_fix: '// GOOD: HttpOnly cookie
+
+    Set-Cookie: sessionId=abc123; HttpOnly; Secure; SameSite=Strict'
+- id: A08
+  name: Software and Data Integrity Failures
+  severity: HIGH
+  version: '2025'
+  description: Unsigned updates, compromised CI/CD, insecure deserialization.
+  detection_pattern: (pickle\\.load|unserialize|ObjectInputStream|auto-update)
+  fix_pattern: Signed releases, verified checksums, secure deserialization, code signing
+  languages: all
+  example_vuln: '// BAD: Insecure deserialization (Python)
+
+    pickle.loads(user_data)'
+  example_fix: '// GOOD: Safe JSON with schema validation
+
+    data = json.loads(user_data); validate(data, schema)'
+- id: A09
+  name: Security Logging and Monitoring Failures
+  severity: MEDIUM
+  version: '2025'
+  description: Missing security logs, sensitive data in logs, no alerting.
+  detection_pattern: (console\\.log|print\\(|logger.*password|log.*token)
+  fix_pattern: Structured logging, exclude PII, security event monitoring, SIEM integration
+  languages: all
+  example_vuln: '// BAD: Logging secrets
+
+    console.log(''User login:'', { email, password })'
+  example_fix: '// GOOD: Sanitized logging
+
+    logger.info(''User login'', { email, timestamp, source_ip })'
+- id: A10
+  name: Server-Side Request Forgery (SSRF)
+  severity: HIGH
+  version: '2025'
+  description: Server-side request forgery - fetching attacker-controlled URLs.
+  detection_pattern: (fetch\\(|request\\(|http.*get\\().*user
+  fix_pattern: URL allowlisting, disable redirects, network segmentation, metadata protection
+  languages: all
+  example_vuln: '// BAD: Fetching user-provided URL
+
+    const data = await fetch(req.query.url)'
+  example_fix: '// GOOD: Allowlist validation
+
+    if (!ALLOWED_HOSTS.includes(new URL(url).host)) throw new Error(''Blocked'')
+
+    // Also block: 169.254.169.254, localhost, internal IPs'

package/.agent/skills/core/security/data/reverse-engineering.yaml

@@ -0,0 +1,497 @@
+metadata:
+  skill: security
+  domain: reverse_engineering
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: reverse-engineering.csv
+  patterns_count: 40
+  columns:
+  - id
+  - name
+  - severity
+  - category
+  - description
+  - detection_pattern
+  - fix_pattern
+  - languages
+  - tools_defeated
+  - example_code
+patterns:
+- id: RE-01
+  name: No Code Obfuscation
+  severity: HIGH
+  category: Static
+  description: Source code or bytecode readable without protection
+  detection_pattern: (function\\s+\\w+|class\\s+\\w+|def\\s+\\w+)(?!.*obfuscate)
+  fix_pattern: 'Use obfuscation: ProGuard R8 javascript-obfuscator pyarmor'
+  languages:
+  - java
+  - kotlin
+  - javascript
+  - python
+  tools_defeated: jadx dex2jar jd-gui
+  example_code: '// BEFORE\nfunction validateLicense(key) {\n  return key === ''SECRET''\n}\n// AFTER: Use obfuscator'
+- id: RE-02
+  name: Root Detection Missing
+  severity: CRITICAL
+  category: Mobile
+  description: App runs on rooted devices without detection
+  detection_pattern: (su|SuperSU|Magisk|busybox)(?!.*detect|check)
+  fix_pattern: Implement multi-layered root detection with fallbacks
+  languages:
+  - java
+  - kotlin
+  tools_defeated: Magisk KernelSU
+  example_code: // Detect Magisk\nval paths = arrayOf('/sbin/.magisk', '/data/adb/magisk')\nif (paths.any { File(it).exists() }) exitApp()
+- id: RE-03
+  name: Jailbreak Detection Missing
+  severity: CRITICAL
+  category: Mobile
+  description: iOS app runs on jailbroken devices without warning
+  detection_pattern: (Cydia|checkra1n|unc0ver|Sileo)(?!.*detect)
+  fix_pattern: Implement jailbreak detection checking multiple indicators
+  languages:
+  - swift
+  - objective-c
+  tools_defeated: Electra checkra1n
+  example_code: '// Check for Cydia\nif FileManager.default.fileExists(atPath: ''/Applications/Cydia.app'') { exitApp() }'
+- id: RE-04
+  name: Frida Detection Missing
+  severity: CRITICAL
+  category: Mobile
+  description: App does not detect Frida injection framework
+  detection_pattern: (frida|gadget|gum-js|r2frida)(?!.*detect)
+  fix_pattern: Detect Frida via port scan libraries thread names
+  languages:
+  - java
+  - kotlin
+  - swift
+  tools_defeated: Frida Objection
+  example_code: // Check Frida port 27042\nif (isPortOpen(27042)) exitApp()\n// Check loaded libraries\nif (libs.any { it.contains('frida') }) exitApp()
+- id: RE-05
+  name: Xposed Detection Missing
+  severity: HIGH
+  category: Android
+  description: App does not detect Xposed Framework hooks
+  detection_pattern: (Xposed|EdXposed|LSPosed|de\\.robv)(?!.*detect)
+  fix_pattern: Check for Xposed via stack traces and known classes
+  languages:
+  - java
+  - kotlin
+  tools_defeated: Xposed EdXposed LSPosed
+  example_code: 'try { throw Exception() }\ncatch (e: Exception) {\n  if (e.stackTrace.any { it.className.contains(''Xposed'') }) exitApp()\n}'
+- id: RE-06
+  name: LSPosed Detection Missing
+  severity: HIGH
+  category: Android
+  description: App does not detect LSPosed specifically - new 2024
+  detection_pattern: (LSPosed|lsposed|io\\.github\\.lsposed)(?!.*detect)
+  fix_pattern: Detect LSPosed daemon and modules
+  languages:
+  - java
+  - kotlin
+  tools_defeated: LSPosed
+  example_code: // Check LSPosed daemon\nif (File('/data/adb/lspd').exists()) exitApp()
+- id: RE-07
+  name: Play Integrity Missing
+  severity: CRITICAL
+  category: Android
+  description: App does not use Play Integrity API - replaced SafetyNet 2024
+  detection_pattern: (SafetyNet|safetynet)(?!.*playintegrity|PlayIntegrity)
+  fix_pattern: Migrate to Play Integrity API for device attestation
+  languages:
+  - java
+  - kotlin
+  tools_defeated: Magisk modules
+  example_code: // Play Integrity API (2024+)\nval integrityRequest = IntegrityManager.createRequest(nonce)\nintegrityManager.requestIntegrityToken(integrityRequest)
+- id: RE-08
+  name: Debugger Detection Missing
+  severity: HIGH
+  category: Runtime
+  description: App does not detect attached debuggers
+  detection_pattern: (ptrace|isDebuggerPresent|PTRACE_TRACEME)(?!.*check)
+  fix_pattern: Implement anti-debugging with ptrace timing checks
+  languages:
+  - c
+  - cpp
+  - swift
+  - kotlin
+  tools_defeated: lldb gdb IDA
+  example_code: // iOS anti-debug\nBOOL isDebugged() {\n  int name[4] = {CTL_KERN, KERN_PROC, KERN_PROC_PID, getpid()};\n  struct kinfo_proc info;\n  return (info.kp_proc.p_flag & P_TRACED) != 0;\n}
+- id: RE-09
+  name: Emulator Detection Missing
+  severity: HIGH
+  category: Mobile
+  description: App runs in emulators without restrictions
+  detection_pattern: (android_id|Build\\.MODEL|Build\\.FINGERPRINT)(?!.*emulator)
+  fix_pattern: Detect emulators via Build properties sensors performance
+  languages:
+  - java
+  - kotlin
+  tools_defeated: Genymotion Nox BlueStacks
+  example_code: 'fun isEmulator(): Boolean = Build.FINGERPRINT.startsWith(''generic'') ||\n  Build.MODEL.contains(''Emulator'') || Build.MANUFACTURER.contains(''Genymotion'')'
+- id: RE-10
+  name: String Encryption Missing
+  severity: MEDIUM
+  category: Static
+  description: Sensitive strings in plaintext including API keys
+  detection_pattern: (api.*key.*=.*['\]|password.*=.*['\"]|secret.*=.*['\"])"
+  fix_pattern: Encrypt strings at build time decrypt at runtime
+  languages: all
+  tools_defeated: strings grep
+  example_code: // BEFORE\nconst API_KEY = 'sk-1234'\n// AFTER\nconst API_KEY = decrypt(ENCRYPTED_KEY, getDeviceKey())
+- id: RE-11
+  name: SSL Pinning Bypass Vulnerable
+  severity: CRITICAL
+  category: Network
+  description: Certificate pinning can be bypassed via hooking
+  detection_pattern: (TrustManager|HostnameVerifier|X509TrustManager)
+  fix_pattern: Move pinning logic to native code use multiple pins
+  languages:
+  - java
+  - kotlin
+  - swift
+  tools_defeated: SSLKillSwitch Frida
+  example_code: // Move to JNI/C++\nextern 'C' JNIEXPORT jboolean JNICALL\nJava_com_app_Security_verifyPin(JNIEnv*, jobject, jstring)
+- id: RE-12
+  name: No Binary Integrity Check
+  severity: CRITICAL
+  category: Runtime
+  description: App does not verify its own binary integrity
+  detection_pattern: (checksum|hash|signature)(?!.*verify|integrity)
+  fix_pattern: Calculate and verify binary hash at runtime
+  languages: all
+  tools_defeated: Binary patching
+  example_code: // Verify APK signature at runtime\nval sig = packageManager.getPackageInfo(packageName, GET_SIGNATURES)\nif (!verifySignature(sig.signatures[0])) exitApp()
+- id: RE-13
+  name: Weak Control Flow
+  severity: MEDIUM
+  category: Static
+  description: Linear control flow easy to follow in disassembler
+  detection_pattern: (if\\s*\\(|switch\\s*\\()(?!.*flatten)
+  fix_pattern: Use control flow flattening and opaque predicates
+  languages:
+  - c
+  - cpp
+  - rust
+  tools_defeated: IDA Ghidra
+  example_code: '// Flattened control flow\nint state = 0;\nwhile (true) {\n  switch (state) {\n    case 0: state = check() ? 1 : 2; break;\n  }\n}'
+- id: RE-14
+  name: Native Library Unprotected
+  severity: HIGH
+  category: Static
+  description: Native libraries without obfuscation or packing
+  detection_pattern: (\\.so|\\.dylib)(?!.*packed|protected)
+  fix_pattern: Apply native code protection OLLVM or commercial packers
+  languages:
+  - c
+  - cpp
+  tools_defeated: IDA Ghidra
+  example_code: // Use OLLVM obfuscation\n// -mllvm -fla -mllvm -bcf -mllvm -sub
+- id: RE-15
+  name: Anti-Tampering Missing
+  severity: HIGH
+  category: Runtime
+  description: No runtime tampering detection for code or resources
+  detection_pattern: (?<!integrity|tamper).*check
+  fix_pattern: Implement runtime integrity checks for critical code
+  languages: all
+  tools_defeated: Hex editors
+  example_code: // Check code hash periodically\nif (computeHash(criticalFunction) !== EXPECTED_HASH) exitApp()
+- id: RE-16
+  name: Screenshot Detection Missing
+  severity: MEDIUM
+  category: Mobile
+  description: App does not detect or prevent screenshots
+  detection_pattern: (FLAG_SECURE|userDidTakeScreenshot)(?!.*set)
+  fix_pattern: Set FLAG_SECURE or detect screenshot notifications
+  languages:
+  - java
+  - kotlin
+  - swift
+  tools_defeated: Screen capture
+  example_code: '// Android\nwindow.setFlags(FLAG_SECURE, FLAG_SECURE)\n// iOS: Observe UIApplicationUserDidTakeScreenshotNotification'
+- id: RE-17
+  name: Screen Recording Detection Missing
+  severity: MEDIUM
+  category: Mobile
+  description: App does not detect screen recording
+  detection_pattern: (isCaptured|mediaProjection)(?!.*detect)
+  fix_pattern: Detect screen recording and blur sensitive content
+  languages:
+  - swift
+  - kotlin
+  tools_defeated: Screen recorder
+  example_code: // iOS\nif UIScreen.main.isCaptured { blurSensitiveContent() }
+- id: RE-18
+  name: Memory Dump Protection Missing
+  severity: HIGH
+  category: Runtime
+  description: Sensitive data can be dumped from memory
+  detection_pattern: (malloc|new|alloc).*password|secret
+  fix_pattern: Zero sensitive data after use use secure memory
+  languages: all
+  tools_defeated: Frida memory dump
+  example_code: // Zero password after use\nmemset_s(password, sizeof(password), 0, sizeof(password));\nfree(password);
+- id: RE-19
+  name: Hook Detection Missing
+  severity: HIGH
+  category: Runtime
+  description: App does not detect function hooking
+  detection_pattern: (hook|swizzle|replace)(?!.*detect)
+  fix_pattern: Detect hooks via code hash comparison inline checks
+  languages: all
+  tools_defeated: Frida Substrate
+  example_code: // Check PLT/GOT integrity\nif (checkFunctionIntegrity(criticalFunc) === false) exitApp()
+- id: RE-20
+  name: Substrate Detection Missing
+  severity: HIGH
+  category: iOS
+  description: iOS app does not detect Substrate framework
+  detection_pattern: (substrate|MobileSubstrate|MSHookFunction)(?!.*detect)
+  fix_pattern: Detect Substrate presence and hooks
+  languages:
+  - swift
+  - objective-c
+  tools_defeated: Substrate Substitute
+  example_code: // Check for Substrate\nif (dlopen('/Library/MobileSubstrate', 0) != NULL) exitApp()
+- id: RE-21
+  name: Clipboard Monitoring Missing
+  severity: MEDIUM
+  category: Mobile
+  description: App does not monitor clipboard for sensitive data theft
+  detection_pattern: (UIPasteboard|ClipboardManager)(?!.*monitor)
+  fix_pattern: Monitor clipboard changes clear sensitive data promptly
+  languages:
+  - swift
+  - kotlin
+  tools_defeated: Clipboard hijack
+  example_code: '// Clear sensitive clipboard after 30 seconds\nDispatchQueue.main.asyncAfter(deadline: .now() + 30) {\n  UIPasteboard.general.string = ''''\n}'
+- id: RE-22
+  name: Device Binding Missing
+  severity: MEDIUM
+  category: Mobile
+  description: App license not bound to device identifiers
+  detection_pattern: (device.*id|android_id|identifierForVendor)(?!.*license)
+  fix_pattern: Bind license to multiple device identifiers
+  languages:
+  - java
+  - kotlin
+  - swift
+  tools_defeated: License sharing
+  example_code: // Bind to hardware\nval deviceId = Settings.Secure.ANDROID_ID\nval license = generateLicense(userId, deviceId)
+- id: RE-23
+  name: Time Bomb Detection
+  severity: MEDIUM
+  category: Static
+  description: App contains time-based license checks that can be bypassed
+  detection_pattern: (System\\.currentTimeMillis|Date\\.now|time\\(\\))(?!.*server)
+  fix_pattern: Use server-side time validation not device time
+  languages: all
+  tools_defeated: Time manipulation
+  example_code: // Use NTP server time\nval serverTime = fetchServerTime()\nif (serverTime > LICENSE_EXPIRY) exitApp()
+- id: RE-24
+  name: Debug Build Detection
+  severity: LOW
+  category: Static
+  description: App does not detect if running as debug build
+  detection_pattern: (BuildConfig\\.DEBUG|DEBUG|NDEBUG)(?!.*check)
+  fix_pattern: Exit or limit functionality in debug builds
+  languages:
+  - java
+  - kotlin
+  - swift
+  tools_defeated: Debug mode
+  example_code: if (BuildConfig.DEBUG) {\n  // Disable sensitive features in debug\n  Log.w('Security', 'Debug build detected')\n}
+- id: RE-25
+  name: ADB Detection Missing
+  severity: MEDIUM
+  category: Android
+  description: App does not detect ADB connection
+  detection_pattern: (adb|android_debug_bridge)(?!.*detect)
+  fix_pattern: Detect ADB connection and warn user
+  languages:
+  - java
+  - kotlin
+  tools_defeated: ADB shell
+  example_code: // Check ADB status\nval adb = Settings.Global.getString(contentResolver, 'adb_enabled')\nif (adb == '1') showWarning()
+- id: RE-26
+  name: Developer Options Detection
+  severity: LOW
+  category: Android
+  description: App does not check for enabled developer options
+  detection_pattern: (development_settings_enabled)(?!.*check)
+  fix_pattern: Detect developer options and adjust security level
+  languages:
+  - java
+  - kotlin
+  tools_defeated: Developer menu
+  example_code: val devOpts = Settings.Secure.getInt(resolver, DEVELOPMENT_SETTINGS_ENABLED, 0)\nif (devOpts == 1) reduceSecurityLevel()
+- id: RE-27
+  name: USB Debugging Detection
+  severity: MEDIUM
+  category: Android
+  description: App does not detect USB debugging enabled
+  detection_pattern: (usb_debug|adb_enabled)(?!.*detect)
+  fix_pattern: Detect USB debugging and warn for sensitive operations
+  languages:
+  - java
+  - kotlin
+  tools_defeated: USB debugging
+  example_code: val usbDebug = Settings.Global.getInt(resolver, ADB_ENABLED, 0)\nif (usbDebug == 1) showSecurityWarning()
+- id: RE-28
+  name: Proxy Detection Missing
+  severity: HIGH
+  category: Network
+  description: App does not detect proxy interception
+  detection_pattern: (proxy|System\\.getProperty.*http)(?!.*detect)
+  fix_pattern: Detect proxy and certificate changes
+  languages:
+  - java
+  - kotlin
+  - swift
+  tools_defeated: Charles Burp
+  example_code: // Detect proxy\nval proxy = System.getProperty('http.proxyHost')\nif (proxy != null && !TRUSTED_PROXIES.contains(proxy)) warn()
+- id: RE-29
+  name: VPN Detection Missing
+  severity: MEDIUM
+  category: Network
+  description: App does not detect VPN connections
+  detection_pattern: (VpnService|NetworkCapabilities\\.TRANSPORT_VPN)(?!.*detect)
+  fix_pattern: Detect VPN and adjust behavior if needed
+  languages:
+  - java
+  - kotlin
+  tools_defeated: VPN tunneling
+  example_code: // Check for VPN\nval cm = getSystemService(CONNECTIVITY_SERVICE) as ConnectivityManager\nval vpn = cm.allNetworks.any { it.hasTransport(TRANSPORT_VPN) }
+- id: RE-30
+  name: SafetyNet Deprecated
+  severity: HIGH
+  category: Android
+  description: App still uses deprecated SafetyNet instead of Play Integrity
+  detection_pattern: SafetyNet(?!.*deprecated)|safetynetapi
+  fix_pattern: Migrate to Play Integrity API - SafetyNet sunset 2024
+  languages:
+  - java
+  - kotlin
+  tools_defeated: SafetyNet bypass
+  example_code: '// DEPRECATED: SafetyNet\n// MIGRATE TO:\nimport com.google.android.play.core.integrity.*'
+- id: RE-31
+  name: r2frida Memory Analysis
+  severity: CRITICAL
+  category: Runtime
+  description: r2frida allows radare2 to analyze live process memory
+  detection_pattern: (r2frida|frida:\/\/|radare2.*attach)(?!.*detect)
+  fix_pattern: Detect radare2 process names and r2frida ports
+  languages: all
+  tools_defeated: r2frida
+  example_code: // Detect r2frida\nif (isPortOpen(27042) || isPortOpen(27045)) exitApp();\n// Check for r2 process
+- id: RE-32
+  name: Objection Automation
+  severity: CRITICAL
+  category: Mobile
+  description: Objection automates Frida bypass of common protections
+  detection_pattern: (objection|explore.*frida)(?!.*multi.*check)
+  fix_pattern: Use layered detection not single check points
+  languages:
+  - java
+  - kotlin
+  - swift
+  tools_defeated: Objection
+  example_code: // Objection automates:\n// - SSL pinning bypass\n// - Root detection bypass\n// Use multiple detection methods
+- id: RE-33
+  name: Source Map Exposure
+  severity: HIGH
+  category: Web
+  description: JavaScript source maps expose original code
+  detection_pattern: (\\.map|sourceMappingURL)(?!.*production.*false)
+  fix_pattern: Remove source maps in production builds
+  languages:
+  - javascript
+  - typescript
+  tools_defeated: Chrome DevTools
+  example_code: '// BAD: Deployed with .map\n// GOOD: Remove in production build'
+- id: RE-34
+  name: DevTools Detection Bypass
+  severity: MEDIUM
+  category: Web
+  description: DevTools detection easily bypassed
+  detection_pattern: devtools.*detect(?!.*multiple)
+  fix_pattern: Use multiple detection methods including performance timing
+  languages:
+  - javascript
+  - typescript
+  tools_defeated: Chrome DevTools
+  example_code: '// Weak detection\nif (window.outerHeight - window.innerHeight > 200)\n// Better: timing attacks firebug detection'
+- id: RE-35
+  name: APK Smali Patching
+  severity: HIGH
+  category: Android
+  description: APK can be decompiled modified and rebuilt
+  detection_pattern: classes\\.dex(?!.*signature.*check)
+  fix_pattern: Verify APK signature at runtime detect tampering
+  languages:
+  - java
+  - kotlin
+  tools_defeated: apktool smali
+  example_code: // Check APK signature hash at runtime\nif (getApkHash() != EXPECTED_HASH) exitApp();
+- id: RE-36
+  name: IDA Analysis Protection
+  severity: MEDIUM
+  category: Static
+  description: Binary contains helpful debug info for IDA analysis
+  detection_pattern: (DWARF|.debug_info|symbol.*table)(?!.*strip)
+  fix_pattern: Strip debug symbols use anti-disassembly tricks
+  languages:
+  - c
+  - cpp
+  - rust
+  tools_defeated: IDA Pro Ghidra
+  example_code: '// Strip symbols: gcc -s binary\n// Use anti-disassembly: junk bytes overlapping code'
+- id: RE-37
+  name: Binary Ninja HLIL
+  severity: MEDIUM
+  category: Static
+  description: Clean decompilation shows high-level logic
+  detection_pattern: (function|class).*logic(?!.*obfuscate)
+  fix_pattern: Use control flow flattening and MBA obfuscation
+  languages:
+  - c
+  - cpp
+  - rust
+  tools_defeated: Binary Ninja
+  example_code: '// Apply MBA: a = a + b - b + 0 * random\n// Use switch dispatch for control flow'
+- id: RE-38
+  name: Ghidra Decompiler
+  severity: MEDIUM
+  category: Static
+  description: Ghidra provides free decompilation quality
+  detection_pattern: (ELF|PE|Mach-O)(?!.*obfuscated|packed)
+  fix_pattern: Apply commercial-grade obfuscation or packing
+  languages:
+  - c
+  - cpp
+  - rust
+  - go
+  tools_defeated: Ghidra 11.x
+  example_code: // Pack with Themida/VMProtect\n// Or use Obfuscator-LLVM
+- id: RE-39
+  name: Dynamic Instrumentation
+  severity: HIGH
+  category: Runtime
+  description: Process can be instrumented with DynamoRIO/Pin
+  detection_pattern: (DynamoRIO|Pin|Valgrind)(?!.*detect)
+  fix_pattern: Detect instrumentation frameworks via timing checks
+  languages: all
+  tools_defeated: DynamoRIO Intel Pin
+  example_code: // Check execution timing\n// Instrumented code runs 100x slower
+- id: RE-40
+  name: Network Traffic Analysis
+  severity: HIGH
+  category: Network
+  description: Network traffic reveals API structure and logic
+  detection_pattern: (REST|GraphQL|WebSocket)(?!.*encrypt.*payload)
+  fix_pattern: Use certificate pinning and encrypt sensitive payloads
+  languages: all
+  tools_defeated: Wireshark mitmproxy
+  example_code: // Pin certificates\n// Encrypt request/response payloads