@raishin/vanguard-frontier-agentic 3.0.1 → 3.1.0

package/tests/fixtures/frontend-security-detection/graphql-client-security-review/detectors.json

@@ -0,0 +1,50 @@
+{
+  "skill_id": "graphql-client-security-review",
+  "detectors": [
+    {
+      "id": "devtools-enabled-in-production",
+      "regex": "connectToDevTools:\\s*true\\b",
+      "skill_keywords": ["connectToDevTools"],
+      "red": "red/apollo-client-setup.js",
+      "green": "green/apollo-client-setup.js",
+      "severity": "high",
+      "rationale": "connectToDevTools: true is an unconditional literal that ships the devtools bridge to every build, including production, exposing full schema introspection and the normalized cache inspector to anyone with the Apollo Client Devtools browser extension; the safe idiom gates the same option on process.env.NODE_ENV === 'development', a structurally different expression the bare-literal regex correctly does not match."
+    },
+    {
+      "id": "cache-not-cleared-on-logout",
+      "regex": "await logoutAPI\\(\\);(?:(?!resetStore|clearStore)[\\s\\S])*?\\n\\}",
+      "skill_keywords": ["resetStore", "clearStore"],
+      "red": "red/logout-handler.js",
+      "green": "green/logout-handler.js",
+      "severity": "high",
+      "rationale": "a logout handler that calls logoutAPI() and returns without ever calling client.resetStore()/clearStore() leaves the previous user's normalized cache entries readable by whatever session uses the same InMemoryCache next (shared device, profile switch, or a fast re-login); the safe idiom calls client.resetStore() immediately after the API logout call, so the negative-lookahead scan (from logoutAPI() to the function's closing brace, watching for resetStore/clearStore) no longer matches."
+    },
+    {
+      "id": "no-persisted-query-allowlist",
+      "regex": "link:\\s*httpLink\\s*,",
+      "skill_keywords": ["PersistedQueryLink"],
+      "red": "red/persisted-query-link.js",
+      "green": "green/persisted-query-link.js",
+      "severity": "medium",
+      "rationale": "wiring the ApolloClient's link directly to a bare httpLink with no PersistedQueryLink in the chain means any client-authored query document -- however deeply nested or alias-heavy -- reaches the server unfiltered, with no allowlist limiting requests to pre-registered, cost-reviewed operations; the safe idiom chains persistedQueryLink.concat(httpLink), a different call shape the bare-identifier regex correctly does not match."
+    },
+    {
+      "id": "auth-header-missing-csrf",
+      "regex": "authorization:\\s*`Bearer[^`]*`(?:(?!x-csrf-token)[\\s\\S]){0,60}\\}",
+      "skill_keywords": ["x-csrf-token"],
+      "red": "red/auth-context-link.js",
+      "green": "green/auth-context-link.js",
+      "severity": "medium",
+      "rationale": "a SetContextLink that attaches only the authorization bearer token to outgoing headers, with no accompanying anti-CSRF header, relies on the token alone to authenticate state-changing GraphQL mutations, which is insufficient if the token is ever sent automatically (e.g. via a cookie-backed session) rather than solely by explicit client code; the safe idiom adds an 'x-csrf-token' header fetched alongside the auth token, which the negative-lookahead scan (from the authorization header to the closing headers brace, watching for x-csrf-token) correctly fails to match."
+    },
+    {
+      "id": "sensitive-field-cached-unmasked",
+      "regex": "cvv[\\s\\S]*?InMemoryCache\\(\\)",
+      "skill_keywords": ["typePolicies", "cvv"],
+      "red": "red/payment-cache-policy.js",
+      "green": "green/payment-cache-policy.js",
+      "severity": "high",
+      "rationale": "fetching a cvv field into an InMemoryCache constructed with no typePolicies at all means the raw payment value is normalized and persisted in the client cache, fully visible to the Apollo Client Devtools cache inspector for as long as the entry lives; the safe idiom passes a typePolicies read() override that returns undefined for the sensitive field, so the cache is constructed with an argument object rather than bare parens, which the regex (anchored on InMemoryCache with literally empty parens) correctly does not match."
+    }
+  ]
+}

package/tests/fixtures/frontend-security-detection/graphql-client-security-review/green/apollo-client-setup.js

@@ -0,0 +1,11 @@
+import { ApolloClient, InMemoryCache } from "@apollo/client";
+
+// Devtools are gated behind the environment check -- only wired up when
+// actually running a development build, never in production.
+const client = new ApolloClient({
+  uri: "/graphql",
+  cache: new InMemoryCache(),
+  connectToDevTools: process.env.NODE_ENV === "development"
+});
+
+export default client;

package/tests/fixtures/frontend-security-detection/graphql-client-security-review/green/auth-context-link.js

@@ -0,0 +1,15 @@
+import { SetContextLink } from "@apollo/client/link/context";
+
+const withToken = new SetContextLink(async (prevContext, operation) => {
+  const token = await AsyncTokenLookup();
+  const csrfToken = await getCsrfToken();
+  return {
+    headers: {
+      ...prevContext.headers,
+      authorization: `Bearer ${token}`,
+      "x-csrf-token": csrfToken
+    }
+  };
+});
+
+export default withToken;

package/tests/fixtures/frontend-security-detection/graphql-client-security-review/green/logout-handler.js

@@ -0,0 +1,10 @@
+import { navigate } from "./router";
+import client from "./apollo-client-setup";
+
+async function handleLogout() {
+  await logoutAPI();
+  await client.resetStore();
+  navigate("/login");
+}
+
+export default handleLogout;

package/tests/fixtures/frontend-security-detection/graphql-client-security-review/green/payment-cache-policy.js

@@ -0,0 +1,33 @@
+import { gql, InMemoryCache } from "@apollo/client";
+
+const FETCH_USER = gql`
+  query FetchUser {
+    user {
+      id
+      email
+      creditCard {
+        number
+        cvv
+      }
+    }
+  }
+`;
+
+// A read policy on the sensitive field strips it before it ever lands in
+// the normalized cache -- the cvv value is fetched, used once, and discarded
+// instead of being persisted where the devtools inspector could reveal it.
+const cache = new InMemoryCache({
+  typePolicies: {
+    CreditCard: {
+      fields: {
+        cvv: {
+          read() {
+            return undefined;
+          }
+        }
+      }
+    }
+  }
+});
+
+export { FETCH_USER, cache };

package/tests/fixtures/frontend-security-detection/graphql-client-security-review/green/persisted-query-link.js

@@ -0,0 +1,18 @@
+import { ApolloClient, InMemoryCache, HttpLink } from "@apollo/client";
+import { PersistedQueryLink } from "@apollo/client/link/persisted-queries";
+
+const httpLink = new HttpLink({ uri: "/graphql" });
+
+const persistedQueryLink = new PersistedQueryLink({
+  generatePersistedQueryIdsFromManifest: () =>
+    import("./persisted-query-manifest.json")
+});
+
+// Only allowlisted, pre-registered query IDs from the build-time manifest
+// can reach the server -- arbitrary client-authored documents are rejected.
+const client = new ApolloClient({
+  link: persistedQueryLink.concat(httpLink),
+  cache: new InMemoryCache()
+});
+
+export default client;

package/tests/fixtures/frontend-security-detection/graphql-client-security-review/red/apollo-client-setup.js

@@ -0,0 +1,12 @@
+import { ApolloClient, InMemoryCache } from "@apollo/client";
+
+// Devtools left wired up unconditionally -- ships to production builds too,
+// exposing full schema introspection and the normalized cache inspector to
+// anyone who opens the Apollo Client Devtools browser extension.
+const client = new ApolloClient({
+  uri: "/graphql",
+  cache: new InMemoryCache(),
+  connectToDevTools: true
+});
+
+export default client;

package/tests/fixtures/frontend-security-detection/graphql-client-security-review/red/auth-context-link.js

@@ -0,0 +1,13 @@
+import { SetContextLink } from "@apollo/client/link/context";
+
+const withToken = new SetContextLink(async (prevContext, operation) => {
+  const token = await AsyncTokenLookup();
+  return {
+    headers: {
+      ...prevContext.headers,
+      authorization: `Bearer ${token}`
+    }
+  };
+});
+
+export default withToken;

package/tests/fixtures/frontend-security-detection/graphql-client-security-review/red/logout-handler.js

@@ -0,0 +1,12 @@
+import { navigate } from "./router";
+
+async function handleLogout() {
+  await logoutAPI();
+  // Normalized cache is never cleared here -- the previous user's queries,
+  // including anything fetched into the shared InMemoryCache, remain
+  // resolvable by the next session on this device (shared machine, browser
+  // profile switch, or a subsequent user logging in without a full reload).
+  navigate("/login");
+}
+
+export default handleLogout;

package/tests/fixtures/frontend-security-detection/graphql-client-security-review/red/payment-cache-policy.js

@@ -0,0 +1,21 @@
+import { gql, InMemoryCache } from "@apollo/client";
+
+const FETCH_USER = gql`
+  query FetchUser {
+    user {
+      id
+      email
+      creditCard {
+        number
+        cvv
+      }
+    }
+  }
+`;
+
+// No typePolicies at all -- every field returned by FetchUser, including
+// the raw card number and cvv, is written into the normalized cache as-is
+// and is fully visible in the Apollo Client Devtools cache inspector.
+const cache = new InMemoryCache();
+
+export { FETCH_USER, cache };

package/tests/fixtures/frontend-security-detection/graphql-client-security-review/red/persisted-query-link.js

@@ -0,0 +1,13 @@
+import { ApolloClient, InMemoryCache, HttpLink } from "@apollo/client";
+
+const httpLink = new HttpLink({ uri: "/graphql" });
+
+// No PersistedQueryLink in the chain -- any client (or anyone replaying a
+// captured request with modifications) can send an arbitrary, arbitrarily
+// deep/aliased query document straight to the server with no allowlist.
+const client = new ApolloClient({
+  link: httpLink,
+  cache: new InMemoryCache()
+});
+
+export default client;

package/tests/fixtures/frontend-security-detection/nextjs-server-security-review/detectors.json

@@ -0,0 +1,50 @@
+{
+  "skill_id": "nextjs-server-security-review",
+  "detectors": [
+    {
+      "id": "middleware-matcher-excludes-api",
+      "regex": "matcher:\\s*\\[\\s*['\"]/\\(\\(\\?![^)]*api",
+      "skill_keywords": ["matcher", "Server Function"],
+      "red": "red/middleware-matcher-excludes-api.ts",
+      "green": "green/middleware-matcher-explicit-allowlist.ts",
+      "severity": "high",
+      "rationale": "A Proxy matcher whose negative lookahead excludes /api skips middleware entirely for every Server Function and Route Handler under that path, so any authorization that assumes 'middleware protects everything' silently does not apply there. The safe idiom lists protected page routes explicitly instead of excluding api via a negative lookahead, and pushes the auth check into each handler."
+    },
+    {
+      "id": "server-actions-missing-allowed-origins",
+      "regex": "serverActions:\\s*\\{(?![^}]*allowedOrigins)[^}]*\\}",
+      "skill_keywords": ["allowedOrigins", "serverActions"],
+      "red": "red/next.config.server-actions-no-origins.js",
+      "green": "green/next.config.server-actions-with-origins.js",
+      "severity": "high",
+      "rationale": "Next.js's CSRF protection for Server Actions compares the Origin header to the Host header; behind a reverse proxy or multi-zone setup that comparison fails unless serverActions.allowedOrigins explicitly enumerates the safe origins. A serverActions block with other options set but no allowedOrigins key is the exact CSRF gap; the safe idiom adds the allowlist alongside any other serverActions option."
+    },
+    {
+      "id": "next-public-secret-leak",
+      "regex": "NEXT_PUBLIC_[A-Z0-9_]*(?:SECRET|KEY|TOKEN|PASSWORD|CREDENTIAL)[A-Z0-9_]*\\s*=",
+      "skill_keywords": ["NEXT_PUBLIC_", "process.env.API_KEY"],
+      "red": "red/env.next-public-secret.txt",
+      "green": "green/env.server-only-secret.txt",
+      "severity": "high",
+      "rationale": "Any environment variable prefixed NEXT_PUBLIC_ is inlined into the client JavaScript bundle at build time; naming a secret-shaped variable (KEY/SECRET/TOKEN/PASSWORD/CREDENTIAL) with that prefix ships the secret to every visitor's browser. The safe idiom keeps the same value under an unprefixed name, accessible only from server-side code via process.env."
+    },
+    {
+      "id": "images-dangerously-allow-local-ip",
+      "regex": "dangerouslyAllowLocalIP:\\s*true",
+      "skill_keywords": ["dangerouslyAllowLocalIP"],
+      "red": "red/next.config.dangerously-allow-local-ip.js",
+      "green": "green/next.config.local-ip-disabled.js",
+      "severity": "high",
+      "rationale": "dangerouslyAllowLocalIP: true lets the image optimizer fetch attacker-supplied URLs that resolve to loopback/internal addresses, enabling SSRF against internal services. The safe idiom sets it to false (or omits it, the default) and constrains dynamic src values to a fixed external-hostname allowlist."
+    },
+    {
+      "id": "middleware-rewrite-unvalidated-target",
+      "regex": "NextResponse\\.rewrite\\(new URL\\(\\s*(?:request|req)?\\.?(?:nextUrl\\.)?searchParams\\.get\\(",
+      "skill_keywords": ["NextResponse.rewrite"],
+      "red": "red/middleware-rewrite-ssrf.ts",
+      "green": "green/middleware-rewrite-allowlisted.ts",
+      "severity": "high",
+      "rationale": "Passing a raw query-parameter value straight into NextResponse.rewrite(new URL(...)) lets an attacker point the rewrite destination at an arbitrary internal or external host (SSRF / open redirect). The safe idiom resolves the target into a local variable first and checks it against a hardcoded host allowlist before ever calling rewrite()."
+    }
+  ]
+}

package/tests/fixtures/frontend-security-detection/nextjs-server-security-review/green/env.server-only-secret.txt

@@ -0,0 +1,6 @@
+# .env.production
+# The secret is unprefixed, so Next.js keeps it server-only — accessible from
+# Server Actions and Route Handlers via process.env.API_KEY, never inlined
+# into the client bundle. Only the genuinely public analytics ID is exposed.
+API_KEY=__REDACTED_EXAMPLE_SECRET_not_a_real_key__
+NEXT_PUBLIC_ANALYTICS_ID=abcdefghijk

package/tests/fixtures/frontend-security-detection/nextjs-server-security-review/green/middleware-matcher-explicit-allowlist.ts

@@ -0,0 +1,14 @@
+// middleware.ts
+// Matcher explicitly lists only the protected page routes it must run on.
+// It does not exclude /api via a negative lookahead, and every Server Action /
+// Route Handler under /api independently verifies its own session inside the
+// handler body (see app/actions.ts), so nothing relies on middleware alone.
+import { NextResponse } from 'next/server'
+
+export function middleware(request: Request) {
+  return NextResponse.next()
+}
+
+export const config = {
+  matcher: ['/dashboard/:path*', '/admin/:path*'],
+}

package/tests/fixtures/frontend-security-detection/nextjs-server-security-review/green/middleware-rewrite-allowlisted.ts

@@ -0,0 +1,19 @@
+// middleware.ts
+// The rewrite target is validated against a fixed hostname allowlist before
+// NextResponse.rewrite() is ever called — a crafted or internal-pointing
+// `target` value is rejected instead of being rewritten to.
+import { NextResponse } from 'next/server'
+
+const ALLOWED_HOSTS = ['api.internal.example.com']
+
+export function middleware(request: Request) {
+  const nextUrl = (request as any).nextUrl
+  const target = nextUrl.searchParams.get('target')
+  const url = new URL(target, request.url)
+
+  if (!ALLOWED_HOSTS.includes(url.host)) {
+    return NextResponse.next()
+  }
+
+  return NextResponse.rewrite(url)
+}

package/tests/fixtures/frontend-security-detection/nextjs-server-security-review/green/next.config.local-ip-disabled.js

@@ -0,0 +1,9 @@
+/** @type {import('next').NextConfig} */
+// Local-IP image optimization stays disabled; dynamic `src` values are
+// constrained to a fixed allowlist of external hostnames instead.
+module.exports = {
+  images: {
+    dangerouslyAllowLocalIP: false,
+    remotePatterns: [{ protocol: 'https', hostname: 'images.example.com' }],
+  },
+}

package/tests/fixtures/frontend-security-detection/nextjs-server-security-review/green/next.config.server-actions-with-origins.js

@@ -0,0 +1,12 @@
+/** @type {import('next').NextConfig} */
+// Same reverse-proxy deployment, but the safe origins are explicitly
+// enumerated so Next.js can compare the Server Action request's Origin
+// header against a known-good allowlist instead of only the Host header.
+module.exports = {
+  experimental: {
+    serverActions: {
+      allowedOrigins: ['my-proxy.example.com', '*.my-proxy.example.com'],
+      bodySizeLimit: '5mb',
+    },
+  },
+}

package/tests/fixtures/frontend-security-detection/nextjs-server-security-review/red/env.next-public-secret.txt

@@ -0,0 +1,6 @@
+# .env.production
+# Someone prefixed a real secret with NEXT_PUBLIC_ so a client component could
+# read it — this inlines the secret into the JavaScript bundle at build time,
+# exposing it to anyone who views page source.
+NEXT_PUBLIC_API_KEY=__REDACTED_EXAMPLE_SECRET_not_a_real_key__
+NEXT_PUBLIC_ANALYTICS_ID=abcdefghijk

package/tests/fixtures/frontend-security-detection/nextjs-server-security-review/red/middleware-matcher-excludes-api.ts

@@ -0,0 +1,16 @@
+// middleware.ts
+// Broad matcher that excludes the entire /api tree from middleware execution.
+// The team believes "middleware protects the app" but every Server Function
+// and Route Handler under /api never runs through this middleware at all —
+// a Proxy matcher that excludes a path also skips Server Function calls on
+// that path.
+import { NextResponse } from 'next/server'
+
+export function middleware(request: Request) {
+  // No session check happens here for excluded paths — they never reach this code.
+  return NextResponse.next()
+}
+
+export const config = {
+  matcher: ['/((?!api|_next).*)'],
+}

package/tests/fixtures/frontend-security-detection/nextjs-server-security-review/red/middleware-rewrite-ssrf.ts

@@ -0,0 +1,11 @@
+// middleware.ts
+// Builds the NextResponse.rewrite() destination directly from a
+// user-controlled query parameter with no allowlist check — an attacker can
+// point `target` at an internal service or arbitrary external host
+// (SSRF / open redirect via the rewrite backend).
+import { NextResponse } from 'next/server'
+
+export function middleware(request: Request) {
+  const nextUrl = (request as any).nextUrl
+  return NextResponse.rewrite(new URL(nextUrl.searchParams.get('target'), request.url))
+}

package/tests/fixtures/frontend-security-detection/nextjs-server-security-review/red/next.config.dangerously-allow-local-ip.js

@@ -0,0 +1,11 @@
+/** @type {import('next').NextConfig} */
+// Enables local-IP optimization for the <Image> component with no
+// accompanying allowlist validation on dynamic `src` values — an
+// attacker-controlled image URL could target internal/loopback services
+// (SSRF via the image optimizer).
+module.exports = {
+  images: {
+    dangerouslyAllowLocalIP: true,
+    remotePatterns: [{ protocol: 'https', hostname: '**' }],
+  },
+}

package/tests/fixtures/frontend-security-detection/nextjs-server-security-review/red/next.config.server-actions-no-origins.js

@@ -0,0 +1,14 @@
+/** @type {import('next').NextConfig} */
+// Deployed behind a corporate reverse proxy (proxy.internal.example.com) that
+// forwards to this app on a different origin, so the built-in Origin/Host
+// check on Server Actions cannot be satisfied by production traffic — yet no
+// allowedOrigins is configured to account for it. This leaves the CSRF check
+// either failing legitimate requests or being worked around insecurely
+// upstream.
+module.exports = {
+  experimental: {
+    serverActions: {
+      bodySizeLimit: '5mb',
+    },
+  },
+}

package/tests/fixtures/frontend-security-detection/nuxt-fullstack-security-review/detectors.json

@@ -0,0 +1,50 @@
+{
+  "skill_id": "nuxt-fullstack-security-review",
+  "detectors": [
+    {
+      "id": "runtime-config-public-secret-exposure",
+      "regex": "(?is)public:\\s*{[^}]*(secret|token|password|apiKey)",
+      "skill_keywords": ["runtimeConfig.public"],
+      "red": "red/nuxt.config.ts",
+      "green": "green/nuxt.config.ts",
+      "severity": "high",
+      "rationale": "Nesting a secret-shaped key (apiSecret) under runtimeConfig.public ships that value into the client-visible JS bundle for every visitor to read; the safe idiom places the same value at the top level of runtimeConfig (server-only) and keeps only genuinely public values (apiBase) under public, so the regex — which only looks for a secret-shaped key inside the public block's own braces — no longer fires."
+    },
+    {
+      "id": "module-scope-mutable-state-cross-request-leak",
+      "regex": "(?m)^const\\s+\\w+\\s*:\\s*Record<[^>]*>\\s*=\\s*\\{\\}",
+      "skill_keywords": ["module-scope reactive or mutable state"],
+      "red": "red/session.ts",
+      "green": "green/session.ts",
+      "severity": "high",
+      "rationale": "A top-level (module-scope) mutable object in a Nitro server route is one shared instance reused across every concurrent request in the long-lived server process, so one user's session data can leak into another user's response; the safe idiom declares the value as a local variable inside the per-request event handler, so no shared state exists and the module-scope (column-0) anchor no longer matches."
+    },
+    {
+      "id": "ssrf-fetch-user-controlled-url",
+      "regex": "\\$fetch\\(\\s*[a-zA-Z_]\\w*\\s*(as\\s+string)?\\s*\\)",
+      "skill_keywords": ["$fetch`/`ofetch` to a user-controlled URL"],
+      "red": "red/proxy.ts",
+      "green": "green/proxy.ts",
+      "severity": "high",
+      "rationale": "Passing a query-derived, fully attacker-controlled variable straight into $fetch() lets an attacker point the server at any internal or external host (SSRF), including cloud metadata endpoints; the safe idiom builds an explicit URL against a hardcoded base and checks the resolved host against an allowlist before the call, so the argument is a method-call expression the bare-identifier regex does not match."
+    },
+    {
+      "id": "blind-request-header-forwarding",
+      "regex": "useRequestHeaders\\(\\s*\\)",
+      "skill_keywords": ["useRequestHeaders()"],
+      "red": "red/external-call.ts",
+      "green": "green/external-call.ts",
+      "severity": "high",
+      "rationale": "Calling useRequestHeaders() with no arguments forwards every incoming header — including Authorization and Cookie — to an external host, leaking credentials meant only for the origin server; the safe idiom passes an explicit allowlist array of header names, so the regex's empty-parentheses anchor no longer matches."
+    },
+    {
+      "id": "unsanitized-v-html-payload-render",
+      "regex": "v-html=\"[a-zA-Z_$][\\w$]*\\.[a-zA-Z_$][\\w$]*\"",
+      "skill_keywords": ["v-html", "unsanitized render sink (XSS)"],
+      "red": "red/CommentBody.vue",
+      "green": "green/CommentBody.vue",
+      "severity": "high",
+      "rationale": "Binding v-html directly to a nested property of async/payload data (comment.body) renders unsanitized user-submitted markup verbatim, enabling stored XSS; the safe idiom introduces a computed value that passes the same data through DOMPurify.sanitize() and binds v-html to that single sanitized identifier, so the dotted-member-expression regex (which anchors on binding straight to a raw data path) no longer matches."
+    }
+  ]
+}

package/tests/fixtures/frontend-security-detection/nuxt-fullstack-security-review/green/CommentBody.vue

@@ -0,0 +1,11 @@
+<script setup>
+import DOMPurify from 'dompurify'
+const { data: comment } = await useAsyncData('comment',
+  () => $fetch(`/api/comments/${id}`)
+)
+const safeBody = computed(() => DOMPurify.sanitize(comment.value?.body ?? ''))
+</script>
+
+<template>
+  <div v-html="safeBody" /> <!-- sanitizer explicitly applied on this exact path -->
+</template>

package/tests/fixtures/frontend-security-detection/nuxt-fullstack-security-review/green/external-call.ts

@@ -0,0 +1,6 @@
+// server/api/external-call.ts
+export default defineEventHandler(async (event) => {
+  // explicit allowlist: only forward the one header the downstream call needs
+  const headers = useRequestHeaders(['user-agent'])
+  return $fetch('https://external-api.com', { headers })
+})

package/tests/fixtures/frontend-security-detection/nuxt-fullstack-security-review/green/nuxt.config.ts

@@ -0,0 +1,8 @@
+export default defineNuxtConfig({
+  runtimeConfig: {
+    apiSecret: process.env.NUXT_API_SECRET, // server-only, never sent to the client
+    public: {
+      apiBase: '/api' // genuinely public-facing value
+    }
+  }
+})

package/tests/fixtures/frontend-security-detection/nuxt-fullstack-security-review/green/proxy.ts

@@ -0,0 +1,11 @@
+// server/api/proxy.ts
+const ALLOWED_HOSTS = new Set(['api.trusted-partner.com'])
+
+export default defineEventHandler(async (event) => {
+  const { path } = getQuery(event)
+  const target = new URL(String(path), 'https://api.trusted-partner.com')
+  if (!ALLOWED_HOSTS.has(target.host)) {
+    throw createError({ statusCode: 400 })
+  }
+  return $fetch(target.toString())
+})

package/tests/fixtures/frontend-security-detection/nuxt-fullstack-security-review/green/session.ts

@@ -0,0 +1,5 @@
+// server/api/session.ts
+export default defineEventHandler((event) => {
+  const userId = getQuery(event).userId // per-request local variable, never shared
+  return { id: userId }
+})

package/tests/fixtures/frontend-security-detection/nuxt-fullstack-security-review/red/CommentBody.vue

@@ -0,0 +1,9 @@
+<script setup>
+const { data: comment } = await useAsyncData('comment',
+  () => $fetch(`/api/comments/${id}`)
+)
+</script>
+
+<template>
+  <div v-html="comment.body" /> <!-- comment.body is user-submitted, no sanitizer on this path -->
+</template>

package/tests/fixtures/frontend-security-detection/nuxt-fullstack-security-review/red/external-call.ts

@@ -0,0 +1,5 @@
+// server/api/external-call.ts
+export default defineEventHandler(async (event) => {
+  const headers = useRequestHeaders() // blindly forwards ALL incoming headers
+  return $fetch('https://external-api.com', { headers })
+})

package/tests/fixtures/frontend-security-detection/nuxt-fullstack-security-review/red/nuxt.config.ts

@@ -0,0 +1,7 @@
+export default defineNuxtConfig({
+  runtimeConfig: {
+    public: {
+      apiSecret: process.env.NUXT_PUBLIC_API_SECRET // exposed to every client bundle
+    }
+  }
+})

package/tests/fixtures/frontend-security-detection/nuxt-fullstack-security-review/red/proxy.ts

@@ -0,0 +1,5 @@
+// server/api/proxy.ts
+export default defineEventHandler(async (event) => {
+  const { url } = getQuery(event)
+  return $fetch(url as string) // SSRF: attacker fully controls the fetch destination
+})

package/tests/fixtures/frontend-security-detection/nuxt-fullstack-security-review/red/session.ts

@@ -0,0 +1,8 @@
+// server/api/session.ts
+const lastUser: Record<string, unknown> = {}
+
+export default defineEventHandler((event) => {
+  const userId = getQuery(event).userId
+  lastUser.id = userId // mutates a module-scope object shared by every concurrent request
+  return lastUser
+})

package/tests/fixtures/frontend-security-detection/pci-payment-ui-security-review/detectors.json

@@ -0,0 +1,50 @@
+{
+  "skill_id": "pci-payment-ui-security-review",
+  "detectors": [
+    {
+      "id": "raw-pan-input",
+      "regex": "<input[^>]*id=[\"']cardnumber[\"']",
+      "skill_keywords": ["cardnumber", "raw PAN", "self-controlled input", "iframe", "CardNumberElement"],
+      "red": "red/raw-pan-input.vue",
+      "green": "green/raw-pan-input.vue",
+      "severity": "high",
+      "rationale": "A plain <input id=\"cardnumber\"> lets merchant JavaScript read the raw PAN and CVV straight off the DOM via .value, pulling the entire page into full PCI-DSS card-data scope; the safe idiom mounts a Stripe CardNumberElement, which renders inside a Stripe-controlled iframe so the merchant page never sees or touches the raw PAN."
+    },
+    {
+      "id": "card-data-persistence",
+      "regex": "(localStorage|sessionStorage)\\.setItem\\([^)]*\\b(pan|cvv)\\b",
+      "skill_keywords": ["localStorage", "sessionStorage", "store", "PAN", "CVV", "analytics", "cardholder data"],
+      "red": "red/card-data-persistence.js",
+      "green": "green/card-data-persistence.js",
+      "severity": "high",
+      "rationale": "Writing raw PAN/CVV into localStorage (and into an analytics event) persists prohibited cardholder data on the client where any XSS or compromised script can read it long after the checkout session ends; the safe idiom persists only the tokenized paymentMethod id returned by Stripe, never the raw card fields."
+    },
+    {
+      "id": "self-posted-card-data",
+      "regex": "body:\\s*JSON\\.stringify\\(\\{[^}]*\\bpan\\b[^}]*\\bcvv\\b[^}]*\\}\\)",
+      "skill_keywords": ["POST", "first-party endpoint", "raw card", "PAN", "CVV", "token", "Stripe API"],
+      "red": "red/self-posted-card-data.ts",
+      "green": "green/self-posted-card-data.ts",
+      "severity": "high",
+      "rationale": "POSTing the raw pan/cvv/exp fields straight to a first-party /api/pay endpoint routes cardholder data through the merchant's own server and logs, expanding PCI-DSS scope to the whole backend; the safe idiom calls stripe.createToken(cardElement) first and POSTs only the resulting single-use token, so raw card data never leaves the browser's Stripe context."
+    },
+    {
+      "id": "unsigned-third-party-script",
+      "regex": "(?s)<script(?:(?!integrity)[^>])*\\bsrc=[\"']https?://[^\"']+[\"'](?:(?!integrity)[^>])*></script>",
+      "skill_keywords": ["Subresource Integrity", "integrity attribute", "sha256", "script authorization", "third-party"],
+      "red": "red/unsigned-third-party-script.html",
+      "green": "green/unsigned-third-party-script.html",
+      "severity": "medium",
+      "rationale": "Loading a third-party script on the payment page with no Subresource Integrity hash means a compromised CDN can silently swap in a script that skims card fields, with nothing to detect the tampering (PCI-DSS 6.4.3); the safe idiom adds an integrity=\"sha256-...\" attribute (plus crossorigin) so a modified payload fails to execute."
+    },
+    {
+      "id": "missing-iframe-isolation",
+      "regex": "aria-label=[\"']Card number[\"'][\\s\\S]*?aria-label=[\"']Expiry[\"'][\\s\\S]*?aria-label=[\"']CVC[\"']",
+      "skill_keywords": ["iframe", "sandbox", "hosted fields", "Elements", "CardNumberElement", "Payment Element"],
+      "red": "red/missing-iframe-isolation.jsx",
+      "green": "green/missing-iframe-isolation.jsx",
+      "severity": "high",
+      "rationale": "Building the card-number, expiry, and CVC fields as plain React <input> elements gives the merchant's own component tree direct DOM access to every keystroke of cardholder data with no hosted-field/iframe sandbox in between; the safe idiom renders a single <PaymentElement />, which Stripe mounts inside its own sandboxed iframes so none of the raw fields ever enter merchant-controlled DOM."
+    }
+  ]
+}

package/tests/fixtures/frontend-security-detection/pci-payment-ui-security-review/green/card-data-persistence.js

@@ -0,0 +1,9 @@
+// Checkout autosave persists only the tokenized paymentMethod id returned
+// by Stripe — never the raw PAN/CVV/expiry — so the client-side store
+// never holds cardholder data at all.
+function autosaveCardDraft(paymentMethodId) {
+  localStorage.setItem('checkoutDraft', JSON.stringify({ paymentMethodId }));
+  analytics.track('checkout_draft_saved', { paymentMethodId });
+}
+
+export { autosaveCardDraft };