npm - @raishin/vanguard-frontier-agentic - Versions diffs - 3.0.2 → 3.1.0 - Mend

@raishin/vanguard-frontier-agentic 3.0.2 → 3.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (873) hide show

package/tests/fixtures/frontend-security-detection/pci-payment-ui-security-review/green/missing-iframe-isolation.jsx ADDED Viewed

@@ -0,0 +1,26 @@
+import { PaymentElement, useElements, useStripe } from '@stripe/react-stripe-js';
+// PaymentElement mounts Stripe's own hosted fields inside sandboxed
+// iframes; card number, expiry, and CVC are all collected and rendered
+// entirely outside the merchant's React tree.
+export function HostedCardForm({ onSuccess }) {
+  const stripe = useStripe();
+  const elements = useElements();
+  const handleSubmit = async (e) => {
+    e.preventDefault();
+    const { paymentIntent } = await stripe.confirmPayment({
+      elements,
+      confirmParams: { return_url: 'https://example.com/complete' },
+      redirect: 'if_required',
+    });
+    onSuccess(paymentIntent);
+  };
+  return (
+    <form onSubmit={handleSubmit}>
+      <PaymentElement />
+      <button type="submit">Pay</button>
+    </form>
+  );
+}

package/tests/fixtures/frontend-security-detection/pci-payment-ui-security-review/green/raw-pan-input.vue ADDED Viewed

@@ -0,0 +1,29 @@
+<template>
+  <form @submit.prevent="submitPayment">
+    <!-- CardNumberElement renders inside a Stripe-controlled iframe; the
+         merchant page never sees or touches the raw PAN. -->
+    <div id="card-number-element"></div>
+    <div id="card-cvc-element"></div>
+    <button type="submit">Pay</button>
+  </form>
+</template>
+<script>
+import { CardNumberElement, CardCvcElement } from '@stripe/react-stripe-js';
+export default {
+  mounted() {
+    const elements = this.stripe.elements();
+    this.cardNumberElement = elements.create('cardNumber');
+    this.cardNumberElement.mount('#card-number-element');
+    this.cardCvcElement = elements.create('cardCvc');
+    this.cardCvcElement.mount('#card-cvc-element');
+  },
+  methods: {
+    async submitPayment() {
+      const { token } = await this.stripe.createToken(this.cardNumberElement);
+      this.$emit('submit', { token: token.id });
+    },
+  },
+};
+</script>

package/tests/fixtures/frontend-security-detection/pci-payment-ui-security-review/green/self-posted-card-data.ts ADDED Viewed

@@ -0,0 +1,14 @@
+// The card element is tokenized through the Stripe API first; only the
+// resulting single-use token is ever POSTed to the first-party endpoint,
+// so the merchant server (and its logs) never sees raw card data.
+async function submitPayment(cardElement: stripe.elements.Element) {
+  const { token } = await stripe.createToken(cardElement);
+  const response = await fetch('/api/pay', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ token: token.id }),
+  });
+  return response.json();
+}
+export { submitPayment };

package/tests/fixtures/frontend-security-detection/pci-payment-ui-security-review/green/unsigned-third-party-script.html ADDED Viewed

@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Checkout</title>
+  <!-- Same third-party analytics script, but authorized and inventoried
+       with a Subresource Integrity sha256 hash so a tampered/compromised
+       CDN response fails to execute. -->
+  <script
+    src="https://cdn.example.com/analytics.js"
+    integrity="sha256-4h4v9F1k3o3G3Xw+9Uu6b5b0m3q5v3s9v2m4h4v9F1k="
+    crossorigin="anonymous"
+  ></script>
+</head>
+<body>
+  <div id="payment-element"></div>
+</body>
+</html>

package/tests/fixtures/frontend-security-detection/pci-payment-ui-security-review/red/card-data-persistence.js ADDED Viewed

@@ -0,0 +1,11 @@
+// Checkout autosave "for convenience" — persists raw cardholder data
+// (PAN, CVV, expiry) to localStorage so the form can be restored later.
+// This writes prohibited cardholder data outside the CDE-approved token
+// flow and into a client-side store an attacker-controlled script (or a
+// simple XSS) can read at any time.
+function autosaveCardDraft(pan, cvv, exp) {
+  localStorage.setItem('card', JSON.stringify({ pan, cvv, exp }));
+  analytics.track('checkout_draft_saved', { pan, cvv });
+}
+export { autosaveCardDraft };

package/tests/fixtures/frontend-security-detection/pci-payment-ui-security-review/red/missing-iframe-isolation.jsx ADDED Viewed

@@ -0,0 +1,35 @@
+import { useState } from 'react';
+// A hand-rolled checkout form with plain <input> elements for card number,
+// expiry, and CVV. None of this is rendered inside a sandboxed iframe or
+// Stripe-hosted field, so the merchant's own React tree has direct DOM
+// access to every character of cardholder data as it is typed.
+export function ManualCardForm({ onSubmit }) {
+  const [card, setCard] = useState({ number: '', expiry: '', cvc: '' });
+  return (
+    <form
+      onSubmit={(e) => {
+        e.preventDefault();
+        onSubmit(card);
+      }}
+    >
+      <input
+        aria-label="Card number"
+        value={card.number}
+        onChange={(e) => setCard({ ...card, number: e.target.value })}
+      />
+      <input
+        aria-label="Expiry"
+        value={card.expiry}
+        onChange={(e) => setCard({ ...card, expiry: e.target.value })}
+      />
+      <input
+        aria-label="CVC"
+        value={card.cvc}
+        onChange={(e) => setCard({ ...card, cvc: e.target.value })}
+      />
+      <button type="submit">Pay</button>
+    </form>
+  );
+}

package/tests/fixtures/frontend-security-detection/pci-payment-ui-security-review/red/raw-pan-input.vue ADDED Viewed

@@ -0,0 +1,27 @@
+<template>
+  <form @submit.prevent="submitPayment">
+    <label for="cardnumber">Card number</label>
+    <input type="text" id="cardnumber" v-model="cardNumber" maxlength="19" />
+    <label for="cvv">CVV</label>
+    <input type="text" id="cvv" v-model="cvv" maxlength="4" />
+    <button type="submit">Pay</button>
+  </form>
+</template>
+<script>
+// Raw PAN collection in a self-controlled <input> — the merchant app JS
+// reads .value directly, so the full card number and CVV pass through
+// first-party memory/DOM instead of staying inside a Stripe iframe.
+export default {
+  data() {
+    return { cardNumber: '', cvv: '' };
+  },
+  methods: {
+    submitPayment() {
+      const pan = document.getElementById('cardnumber').value;
+      console.log('collected raw PAN from self-controlled input', pan);
+      this.$emit('submit', { pan, cvv: this.cvv });
+    },
+  },
+};
+</script>

package/tests/fixtures/frontend-security-detection/pci-payment-ui-security-review/red/self-posted-card-data.ts ADDED Viewed

@@ -0,0 +1,15 @@
+// Raw card fields captured from the form are POSTed directly to a
+// first-party endpoint instead of being tokenized by the Stripe API
+// first. The PAN and CVV traverse the merchant's own network stack and
+// logs, pulling the endpoint (and everything downstream of it) into
+// full PCI-DSS scope.
+async function submitPayment(pan: string, cvv: string, exp: string) {
+  const response = await fetch('/api/pay', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ pan, cvv, exp }),
+  });
+  return response.json();
+}
+export { submitPayment };

package/tests/fixtures/frontend-security-detection/pci-payment-ui-security-review/red/unsigned-third-party-script.html ADDED Viewed

@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Checkout</title>
+  <!-- Third-party analytics script loaded on the payment page with no
+       Subresource Integrity hash and no script authorization/inventory
+       entry. If the CDN is compromised, this script can read the DOM
+       (including any card fields) with no integrity check to stop it. -->
+  <script src="https://cdn.example.com/analytics.js"></script>
+</head>
+<body>
+  <div id="payment-element"></div>
+</body>
+</html>

package/tests/fixtures/frontend-security-detection/react-rsc-data-boundary-review/detectors.json ADDED Viewed

@@ -0,0 +1,50 @@
+{
+  "skill_id": "react-rsc-data-boundary-review",
+  "detectors": [
+    {
+      "id": "boundary-data-leak",
+      "regex": "<[A-Z]\\w*\\s[^>]*\\bpassword=\\{[^}]+\\}",
+      "skill_keywords": ["password={SECRET_API_KEY}"],
+      "red": "red/Dashboard.tsx",
+      "green": "green/Dashboard.tsx",
+      "severity": "high",
+      "rationale": "Passing a raw secret (an API key read from process.env) as a JSX prop on a Client Component serializes it into the client bundle payload, exposing it to every browser that renders the page; the safe idiom narrows the Server Component's return value to a single non-secret field (config.SERVICE_API_VERSION) so no attribute named password/apiKey/secret/token ever appears in the JSX the regex anchors on."
+    },
+    {
+      "id": "missing-server-only-guard",
+      "regex": "^(?:(?!server-only)[\\s\\S])*?process\\.env\\.\\w+",
+      "skill_keywords": ["server-only"],
+      "red": "red/config.ts",
+      "green": "green/config.ts",
+      "severity": "high",
+      "rationale": "A data module that reads process.env secrets with no `import 'server-only'` guard can be accidentally imported into a Client Component's bundle with no build-time error, silently shipping the secret-reading code path to the browser; the safe idiom adds `import 'server-only'` as the first statement, which the regex's negative-lookahead scan (require reaching `process.env.` before ever seeing the literal `server-only`) can no longer satisfy from the start of the file."
+    },
+    {
+      "id": "action-authz-missing",
+      "regex": "'use server'(?:(?!auth\\()[\\s\\S])*?db\\.\\w+\\.(?:delete|update|create)\\(",
+      "skill_keywords": ["'use server'", "session?.user"],
+      "red": "red/actions.ts",
+      "green": "green/actions.ts",
+      "severity": "high",
+      "rationale": "A `'use server'` Server Action that mutates the database with no session/ownership check lets any caller who can invoke the action endpoint delete or modify another user's resource (an IDOR); the safe idiom calls `auth()` and checks `session?.user`/resource ownership before the mutation, so the regex's negative-lookahead scan (require reaching a db.*.delete/update/create call before ever seeing `auth(`) is blocked by the auth() call that now sits in between."
+    },
+    {
+      "id": "env-exposure-in-client",
+      "regex": "'use client'[\\s\\S]*?process\\.env\\.(?!NEXT_PUBLIC_)\\w+",
+      "skill_keywords": ["'use client'", "NEXT_PUBLIC_"],
+      "red": "red/ClientWidget.tsx",
+      "green": "green/ClientWidget.tsx",
+      "severity": "medium",
+      "rationale": "Reading a non-NEXT_PUBLIC_ environment variable inside a `'use client'` module is undefined at runtime in the browser and signals a developer mistakenly assuming a server secret is reachable client-side; the safe idiom reads only a `NEXT_PUBLIC_`-prefixed variable, which the regex's negative lookahead on that exact prefix correctly excludes."
+    },
+    {
+      "id": "taint-boundary-violation",
+      "regex": "\\b(\\w+)=\\{\\1\\}",
+      "skill_keywords": ["experimental_taintUniqueValue"],
+      "red": "red/ClientDashboard.tsx",
+      "green": "green/ClientDashboard.tsx",
+      "severity": "high",
+      "rationale": "Forwarding an entire server-fetched config object verbatim as a same-named JSX prop (config={config}) crosses the RSC serialization boundary with no taint marker and no narrowing, carrying whatever sensitive fields the object holds (e.g. SERVICE_API_KEY) straight to the client; the safe idiom narrows the value passed to a single non-sensitive property (config.SERVICE_API_VERSION), so the prop name and the bound expression are no longer identical and the backreference regex no longer matches."
+    }
+  ]
+}

package/tests/fixtures/frontend-security-detection/react-rsc-data-boundary-review/green/ClientDashboard.tsx ADDED Viewed

@@ -0,0 +1,8 @@
+import ClientDashboardView from './ClientDashboardView'
+import { getSystemConfig } from './config'
+export async function ConfigPanel() {
+  const config = await getSystemConfig()
+  // Safe: only the non-sensitive, narrowed property crosses the boundary.
+  return <ClientDashboardView version={config.SERVICE_API_VERSION} />
+}

package/tests/fixtures/frontend-security-detection/react-rsc-data-boundary-review/green/ClientWidget.tsx ADDED Viewed

@@ -0,0 +1,8 @@
+'use client'
+// Safe: only a build-time-injected NEXT_PUBLIC_ variable is read in the client module.
+const publicEndpoint = process.env.NEXT_PUBLIC_API_URL
+export default function ClientWidget() {
+  return <div data-endpoint={publicEndpoint}>Widget</div>
+}

package/tests/fixtures/frontend-security-detection/react-rsc-data-boundary-review/green/Dashboard.tsx ADDED Viewed

@@ -0,0 +1,9 @@
+// Server Component — fetches config and forwards only a narrowed, non-secret field.
+import ClientDashboard from './ClientDashboard'
+import { getSystemConfig } from './config'
+export async function Dashboard() {
+  const config = await getSystemConfig()
+  // Safe: only the non-tainted version string crosses the boundary, never the raw config object.
+  return <ClientDashboard version={config.SERVICE_API_VERSION} />
+}

package/tests/fixtures/frontend-security-detection/react-rsc-data-boundary-review/green/actions.ts ADDED Viewed

@@ -0,0 +1,20 @@
+'use server'
+import { auth } from '@/lib/auth'
+import { db } from '@/lib/db'
+export async function deletePost(postId: string) {
+  const session = await auth()
+  if (!session?.user) {
+    throw new Error('Unauthorized')
+  }
+  const post = await db.post.findUnique({ where: { id: postId } })
+  // Check that the user owns this resource before mutating it.
+  if (post.authorId !== session.user.id) {
+    throw new Error('Forbidden')
+  }
+  await db.post.delete({ where: { id: postId } })
+}

package/tests/fixtures/frontend-security-detection/react-rsc-data-boundary-review/green/config.ts ADDED Viewed

@@ -0,0 +1,9 @@
+// Server-only data module — guarded so any accidental client import fails the build.
+import 'server-only'
+export async function getSystemConfig() {
+  const res = await fetch('https://internal-config.example.com/config', {
+    headers: { authorization: process.env.SERVICE_API_KEY },
+  })
+  return res.json()
+}

package/tests/fixtures/frontend-security-detection/react-rsc-data-boundary-review/red/ClientDashboard.tsx ADDED Viewed

@@ -0,0 +1,9 @@
+import ClientDashboardView from './ClientDashboardView'
+import { getSystemConfig } from './config'
+export async function ConfigPanel() {
+  const config = await getSystemConfig()
+  // Whole config object (which contains SERVICE_API_KEY) forwarded verbatim — no
+  // narrowing to a safe subset, and no taint marker on the sensitive property.
+  return <ClientDashboardView config={config} />
+}

package/tests/fixtures/frontend-security-detection/react-rsc-data-boundary-review/red/ClientWidget.tsx ADDED Viewed

@@ -0,0 +1,9 @@
+'use client'
+// Non-NEXT_PUBLIC env var read inside a client module — undefined at runtime in the
+// browser bundle, and unsafe to have ever assumed it would carry a real secret value.
+const apiKey = process.env.DATABASE_URL
+export default function ClientWidget() {
+  return <div data-key={apiKey}>Widget</div>
+}

package/tests/fixtures/frontend-security-detection/react-rsc-data-boundary-review/red/Dashboard.tsx ADDED Viewed

@@ -0,0 +1,8 @@
+// Server Component — fetches config and hands secrets straight to a Client Component.
+import ClientDashboard from './ClientDashboard'
+export async function Dashboard() {
+  const SECRET_API_KEY = process.env.SERVICE_API_KEY
+  // DO NOT DO THIS: a raw secret crosses the serialization boundary as a prop.
+  return <ClientDashboard password={SECRET_API_KEY} />
+}

package/tests/fixtures/frontend-security-detection/react-rsc-data-boundary-review/red/actions.ts ADDED Viewed

@@ -0,0 +1,8 @@
+'use server'
+import { db } from '@/lib/db'
+// No session/ownership check at all before the mutation.
+export async function deletePost(postId: string) {
+  await db.post.delete({ where: { id: postId } })
+}

package/tests/fixtures/frontend-security-detection/react-rsc-data-boundary-review/red/config.ts ADDED Viewed

@@ -0,0 +1,7 @@
+// Data module intended for the server, but missing the required guard import.
+export async function getSystemConfig() {
+  const res = await fetch('https://internal-config.example.com/config', {
+    headers: { authorization: process.env.SERVICE_API_KEY },
+  })
+  return res.json()
+}

package/tests/fixtures/frontend-security-detection/service-worker-cache-strategy-review/detectors.json ADDED Viewed

@@ -0,0 +1,50 @@
+{
+  "skill_id": "service-worker-cache-strategy-review",
+  "detectors": [
+    {
+      "id": "cache-put-non-get-request",
+      "regex": "cache\\.put\\(\\s*new Request\\([^)]*method:\\s*['\"](POST|PUT|PATCH|DELETE)['\"]",
+      "skill_keywords": ["cache.put()"],
+      "red": "red/put-non-get.js",
+      "green": "green/registerroute-get-only.js",
+      "severity": "high",
+      "rationale": "cache.put() is manually called with a Request object whose method is POST/PUT/PATCH/DELETE. The Cache API only stores GET responses by spec, so writing a mutation request into the cache is undefined/ignored behavior masking a real routing bug and risks stale mutation responses being served on retry. The safe idiom never constructs a non-GET Request for cache.put — mutation routes are excluded via NetworkOnly and read routes are matched by an explicit method: 'GET' guard, so the dangerous construct never appears."
+    },
+    {
+      "id": "login-route-cached-cache-first",
+      "regex": "registerRoute\\(\\s*['\"][^'\"]*login[^'\"]*['\"]\\s*,\\s*new CacheFirst",
+      "skill_keywords": ["Set-Cookie"],
+      "red": "red/login-cache-first.js",
+      "green": "green/login-network-only.js",
+      "severity": "high",
+      "rationale": "The /login route (which sets a Set-Cookie session header) is matched with CacheFirst, so the Cache API persists the session-bearing response indefinitely — a shared-device or later-user session-fixation leak. The safe idiom routes /login through NetworkOnly instead of any CacheFirst variant, so the response is never written to the Cache API."
+    },
+    {
+      "id": "authorization-header-read-then-cached",
+      "regex": "Authorization['\"]\\)[\\s\\S]{0,200}cache\\.put\\(",
+      "skill_keywords": ["Authorization"],
+      "red": "red/auth-echo-cached.js",
+      "green": "green/auth-network-only.js",
+      "severity": "high",
+      "rationale": "The handler reads an echoed Authorization header off the response and then calls cache.put on that same response shortly after, persisting the caller's bearer token into the on-disk Cache API where any later user of a shared device can read it via DevTools. The safe idiom reads the header only for logging and routes the authenticated endpoint through NetworkOnly, so cache.put is never reached for that response."
+    },
+    {
+      "id": "opaque-no-cors-cache-put",
+      "regex": "mode:\\s*['\"]no-cors['\"][\\s\\S]{0,200}cache\\.put\\(",
+      "skill_keywords": ["no-cors"],
+      "red": "red/opaque-nocors-put.js",
+      "green": "green/cors-checked-put.js",
+      "severity": "medium",
+      "rationale": "A no-cors cross-origin fetch produces an opaque response whose status/headers cannot be inspected, and that opaque response is written directly into the cache via cache.put — a 404/500 from the CDN is indistinguishable from success and gets served indefinitely. The safe idiom uses mode: 'cors' and gates cache.put behind an explicit res.ok check, so only a confirmed-valid response is ever cached."
+    },
+    {
+      "id": "navigation-route-blind-cache-first",
+      "regex": "request\\.mode\\s*===\\s*['\"]navigate['\"][\\s\\S]{0,200}new CacheFirst\\(",
+      "skill_keywords": ["cache-first"],
+      "red": "red/nav-cache-first.js",
+      "green": "green/nav-stale-while-revalidate.js",
+      "severity": "medium",
+      "rationale": "Navigation requests (request.mode === 'navigate') are matched with CacheFirst, which serves the first-cached app shell forever with no revalidation, stranding users on stale HTML after every deploy. The safe idiom matches the same navigation predicate but uses StaleWhileRevalidate, which revalidates in the background so new deploys are picked up on the next navigation."
+    }
+  ]
+}

package/tests/fixtures/frontend-security-detection/service-worker-cache-strategy-review/green/auth-network-only.js ADDED Viewed

@@ -0,0 +1,20 @@
+import { registerRoute } from 'workbox-routing';
+import { NetworkOnly } from 'workbox-strategies';
+// SAFE: /api/user echoes the caller's auth token in its response body, so
+// authenticated endpoints are routed NetworkOnly and never touch the Cache
+// API — the header is inspected only for logging, never persisted.
+registerRoute(/^\/api\/(user|account|orders)/, new NetworkOnly());
+self.addEventListener('fetch', (event) => {
+  const req = event.request;
+  if (new URL(req.url).pathname === '/api/user') {
+    event.respondWith(
+      fetch(req).then((response) => {
+        const authHeader = response.headers.get('Authorization');
+        console.debug('auth header present:', Boolean(authHeader));
+        return response;
+      })
+    );
+  }
+});

package/tests/fixtures/frontend-security-detection/service-worker-cache-strategy-review/green/cors-checked-put.js ADDED Viewed

@@ -0,0 +1,14 @@
+self.addEventListener('fetch', (event) => {
+  if (new URL(event.request.url).pathname === '/cdn/widget.js') {
+    event.respondWith(
+      // SAFE: CORS mode makes status/headers inspectable, so only a
+      // confirmed-ok response is ever written to the Cache API.
+      fetch('/cdn/widget.js', { mode: 'cors' }).then((res) => {
+        if (res.ok) {
+          caches.open('cdn-v1').then((cache) => cache.put('/cdn/widget.js', res.clone()));
+        }
+        return res;
+      })
+    );
+  }
+});

package/tests/fixtures/frontend-security-detection/service-worker-cache-strategy-review/green/login-network-only.js ADDED Viewed

@@ -0,0 +1,6 @@
+import { registerRoute } from 'workbox-routing';
+import { NetworkOnly } from 'workbox-strategies';
+// SAFE: /login sets a session cookie, so it is excluded from the Cache API
+// entirely via NetworkOnly — nothing is ever written to persistent storage.
+registerRoute('/login', new NetworkOnly());

package/tests/fixtures/frontend-security-detection/service-worker-cache-strategy-review/green/nav-stale-while-revalidate.js ADDED Viewed

@@ -0,0 +1,10 @@
+import { registerRoute } from 'workbox-routing';
+import { StaleWhileRevalidate } from 'workbox-strategies';
+// SAFE: navigation requests are served from cache immediately but
+// revalidated in the background, so a new deploy is picked up on the very
+// next navigation instead of stranding users on a stale app shell forever.
+registerRoute(
+  ({ request }) => request.mode === 'navigate',
+  new StaleWhileRevalidate({ cacheName: 'app-shell-v1' })
+);

package/tests/fixtures/frontend-security-detection/service-worker-cache-strategy-review/green/registerroute-get-only.js ADDED Viewed

@@ -0,0 +1,15 @@
+import { registerRoute } from 'workbox-routing';
+import { CacheFirst, NetworkOnly } from 'workbox-strategies';
+// SAFE: mutation routes are excluded from the Cache API entirely via
+// NetworkOnly, and read routes are matched explicitly by method: 'GET' at
+// the router level, so nothing ever attempts to cache a non-GET response.
+registerRoute(
+  ({ url, request }) => url.pathname === '/api/orders' && request.method === 'GET',
+  new CacheFirst({ cacheName: 'api-orders-read-v1' })
+);
+registerRoute(
+  ({ url }) => url.pathname === '/api/orders',
+  new NetworkOnly()
+);

package/tests/fixtures/frontend-security-detection/service-worker-cache-strategy-review/red/auth-echo-cached.js ADDED Viewed

@@ -0,0 +1,18 @@
+self.addEventListener('fetch', (event) => {
+  const req = event.request;
+  if (new URL(req.url).pathname === '/api/user') {
+    event.respondWith(
+      fetch(req).then((response) => {
+        // BUG: /api/user echoes the caller's bearer token back in a header
+        // for debugging, and the handler blindly persists that response into
+        // the Cache API, so the token is readable from disk on any shared
+        // device that later opens DevTools > Application > Cache Storage.
+        const authHeader = response.headers.get('Authorization');
+        caches.open('user-cache-v1').then((cache) => {
+          cache.put(req, response.clone());
+        });
+        return response;
+      })
+    );
+  }
+});

package/tests/fixtures/frontend-security-detection/service-worker-cache-strategy-review/red/login-cache-first.js ADDED Viewed

@@ -0,0 +1,7 @@
+import { registerRoute } from 'workbox-routing';
+import { CacheFirst } from 'workbox-strategies';
+// BUG: /login responds with a Set-Cookie session header, but the route is
+// matched with CacheFirst, so the Cache API persists the session-bearing
+// response for every future visit on this device (shared-device leak).
+registerRoute('/login', new CacheFirst({ cacheName: 'auth-v1' }));

package/tests/fixtures/frontend-security-detection/service-worker-cache-strategy-review/red/nav-cache-first.js ADDED Viewed

@@ -0,0 +1,10 @@
+import { registerRoute } from 'workbox-routing';
+import { CacheFirst } from 'workbox-strategies';
+// BUG: navigation/HTML requests are matched with a blind cache-first
+// strategy — after every deploy, users are stranded on the stale app shell
+// cached at their first visit, with no revalidation path.
+registerRoute(
+  ({ request }) => request.mode === 'navigate',
+  new CacheFirst({ cacheName: 'app-shell-v1' })
+);

package/tests/fixtures/frontend-security-detection/service-worker-cache-strategy-review/red/opaque-nocors-put.js ADDED Viewed

@@ -0,0 +1,13 @@
+self.addEventListener('fetch', (event) => {
+  if (new URL(event.request.url).pathname === '/cdn/widget.js') {
+    event.respondWith(
+      // BUG: opaque no-cors response cannot be inspected for status/headers,
+      // so a 404 or 500 from the third-party CDN is cached and served as if
+      // it were a valid script, indefinitely, with no visibility.
+      fetch('/cdn/widget.js', { mode: 'no-cors' }).then((res) => {
+        caches.open('cdn-v1').then((cache) => cache.put('/cdn/widget.js', res));
+        return res;
+      })
+    );
+  }
+});

package/tests/fixtures/frontend-security-detection/service-worker-cache-strategy-review/red/put-non-get.js ADDED Viewed

@@ -0,0 +1,19 @@
+// Service worker fetch handler for /api/orders (POST create-order endpoint)
+self.addEventListener('fetch', (event) => {
+  const req = event.request;
+  const url = new URL(req.url);
+  if (url.pathname === '/api/orders') {
+    event.respondWith(
+      fetch(req).then((response) => {
+        const responseClone = response.clone();
+        caches.open('api-cache-v1').then((cache) => {
+          // BUG: Cache API only stores GET responses by spec, but this manually
+          // constructs a POST Request object and writes it into the cache anyway.
+          cache.put(new Request(url, { method: 'POST' }), responseClone);
+        });
+        return response;
+      })
+    );
+  }
+});

package/tests/fixtures/frontend-security-detection/sveltekit-actions-load-security-review/detectors.json ADDED Viewed

@@ -0,0 +1,50 @@
+{
+  "skill_id": "sveltekit-actions-load-security-review",
+  "detectors": [
+    {
+      "id": "csrf-checkOrigin-disabled",
+      "regex": "checkOrigin\\s*:\\s*false",
+      "skill_keywords": ["checkOrigin"],
+      "red": "red/csrf-disabled.config.js",
+      "green": "green/csrf-disabled.config.js",
+      "severity": "high",
+      "rationale": "Setting csrf.checkOrigin: false in svelte.config.js turns off SvelteKit's built-in same-origin check for form-content-type POST/PUT/PATCH/DELETE requests, so any external site can submit forms to this app's actions on a victim's behalf; the safe idiom simply omits the csrf block, leaving checkOrigin at its documented default of true, which the regex (anchored on the literal `false` value) correctly does not match."
+    },
+    {
+      "id": "csrf-trustedOrigins-wildcard",
+      "regex": "trustedOrigins\\s*:\\s*\\[\\s*['\"]\\*['\"]",
+      "skill_keywords": ["trustedOrigins"],
+      "red": "red/csrf-wildcard-origins.config.js",
+      "green": "green/csrf-wildcard-origins.config.js",
+      "severity": "high",
+      "rationale": "SvelteKit resolves csrf_check_origin to true only when checkOrigin is true AND trustedOrigins does not contain '*'; trustedOrigins: ['*'] silently disables the origin check for every request regardless of checkOrigin, defeating CSRF protection entirely. The safe idiom names specific trusted origins (e.g. 'https://trusted-partner.example.com'), which the wildcard-anchored regex correctly does not match."
+    },
+    {
+      "id": "load-sensitive-data-no-auth-guard",
+      "regex": "db\\.\\w+\\(\\s*cookies\\.get\\(",
+      "skill_keywords": ["cookies.get", "requireLogin"],
+      "red": "red/load-session-leak.server.js",
+      "green": "green/load-session-leak.server.js",
+      "severity": "high",
+      "rationale": "Passing the raw cookies.get('sessionid') value directly into a database lookup with no verification step means any forged or guessed cookie value returns a full account record — there is no authentication, only an unguarded lookup. The safe idiom resolves and verifies the session through a requireLogin(event) call first and only queries the database with the verified user id, which the regex (anchored on a db call receiving cookies.get(...) as a direct argument) correctly does not match."
+    },
+    {
+      "id": "cookie-missing-httpOnly",
+      "regex": "cookies\\.set\\([^)]*httpOnly:\\s*false",
+      "skill_keywords": ["httpOnly", "cookies.set"],
+      "red": "red/set-cookie-insecure.server.js",
+      "green": "green/set-cookie-insecure.server.js",
+      "severity": "high",
+      "rationale": "Explicitly setting httpOnly: false on a session cookie makes it readable from client-side JavaScript, so any XSS elsewhere in the app (or an injected third-party script) can exfiltrate the live session token. The safe idiom sets httpOnly: true alongside secure and sameSite, matching SvelteKit's documented cookie defaults, which the httpOnly:false-anchored regex correctly does not match."
+    },
+    {
+      "id": "html-user-input-unsanitized",
+      "regex": "\\{@html\\s+[a-zA-Z_$][\\w.]*\\s*\\}",
+      "skill_keywords": ["{@html"],
+      "red": "red/CommentBody.svelte",
+      "green": "green/CommentBody.svelte",
+      "severity": "high",
+      "rationale": "Binding {@html comment.body} sets innerHTML directly from user-submitted markup with no sanitization, allowing stored XSS for every viewer of the comment. The safe idiom pipes the same value through DOMPurify.sanitize(comment.body) inline in the template expression; the regex (a bare identifier/property chain with no call syntax before the closing brace) correctly does not match the sanitizer-call form."
+    }
+  ]
+}

package/tests/fixtures/frontend-security-detection/sveltekit-actions-load-security-review/green/CommentBody.svelte ADDED Viewed

@@ -0,0 +1,12 @@
+<script>
+	import DOMPurify from 'dompurify';
+	/** @type {{ comment: { body: string } }} */
+	let { comment } = $props();
+</script>
+<!-- Safe: the user-submitted markup is piped through DOMPurify.sanitize()
+     inline in the template expression before {@html} ever sets innerHTML. -->
+<div class="comment-body">
+	{@html DOMPurify.sanitize(comment.body)}
+</div>