@raishin/vanguard-frontier-agentic 3.0.2 → 3.1.0

package/tests/fixtures/frontend-security-detection/sveltekit-actions-load-security-review/green/csrf-disabled.config.js

@@ -0,0 +1,14 @@
+// svelte.config.js — Safe: relies on SvelteKit's default CSRF behavior.
+// checkOrigin defaults to true, so the property is left out entirely rather
+// than explicitly toggled — cross-site form submissions are rejected by default.
+import adapter from '@sveltejs/adapter-auto';
+
+/** @type {import('@sveltejs/kit').Config} */
+const config = {
+	kit: {
+		adapter: adapter()
+		// csrf.checkOrigin intentionally omitted — the framework default (true) applies.
+	}
+};
+
+export default config;

package/tests/fixtures/frontend-security-detection/sveltekit-actions-load-security-review/green/csrf-wildcard-origins.config.js

@@ -0,0 +1,14 @@
+// svelte.config.js — Safe: names specific trusted origins instead of a wildcard.
+import adapter from '@sveltejs/adapter-auto';
+
+/** @type {import('@sveltejs/kit').Config} */
+const config = {
+	kit: {
+		adapter: adapter(),
+		csrf: {
+			trustedOrigins: ['https://trusted-partner.example.com']
+		}
+	}
+};
+
+export default config;

package/tests/fixtures/frontend-security-detection/sveltekit-actions-load-security-review/green/load-session-leak.server.js

@@ -0,0 +1,12 @@
+// src/routes/account/+page.server.js — Safe: the session cookie is resolved
+// and verified through requireLogin() before any data lookup happens, so an
+// invalid or forged session id fails the auth check instead of reaching db.
+import * as db from '$lib/server/db';
+import { requireLogin } from '$lib/server/auth';
+
+/** @type {import('./$types').PageServerLoad} */
+export async function load(event) {
+	const user = requireLogin(event);
+	const account = await db.getAccount(user.id);
+	return { account };
+}

package/tests/fixtures/frontend-security-detection/sveltekit-actions-load-security-review/green/set-cookie-insecure.server.js

@@ -0,0 +1,15 @@
+// src/routes/login/+page.server.js — Safe: httpOnly, secure, sameSite, and
+// path are all explicit and set to their secure values, matching SvelteKit's
+// documented cookie defaults.
+import * as db from '$lib/server/db';
+
+/** @satisfies {import('./$types').Actions} */
+export const actions = {
+	login: async ({ cookies, request }) => {
+		const data = await request.formData();
+		const user = await db.getUser(data.get('email'));
+		const token = await db.createSession(user);
+		cookies.set('sessionid', token, { path: '/', httpOnly: true, secure: true, sameSite: 'lax' });
+		return { success: true };
+	}
+};

package/tests/fixtures/frontend-security-detection/sveltekit-actions-load-security-review/red/CommentBody.svelte

@@ -0,0 +1,12 @@
+<script>
+	/** @type {{ comment: { body: string } }} */
+	let { comment } = $props();
+</script>
+
+<!-- DANGER: comment.body is user-submitted markup rendered with no
+     sanitization step. {@html} sets innerHTML directly, so a comment
+     containing <script> or an onerror-bearing tag executes for every
+     viewer of this comment. -->
+<div class="comment-body">
+	{@html comment.body}
+</div>

package/tests/fixtures/frontend-security-detection/sveltekit-actions-load-security-review/red/csrf-disabled.config.js

@@ -0,0 +1,16 @@
+// svelte.config.js — DANGER: disables SvelteKit's built-in CSRF protection.
+// Every POST/PUT/PATCH/DELETE form submission from any origin will now be
+// accepted, defeating the framework's default cross-site request forgery guard.
+import adapter from '@sveltejs/adapter-auto';
+
+/** @type {import('@sveltejs/kit').Config} */
+const config = {
+	kit: {
+		adapter: adapter(),
+		csrf: {
+			checkOrigin: false
+		}
+	}
+};
+
+export default config;

package/tests/fixtures/frontend-security-detection/sveltekit-actions-load-security-review/red/csrf-wildcard-origins.config.js

@@ -0,0 +1,16 @@
+// svelte.config.js — DANGER: trustedOrigins: ['*'] disables the origin check
+// entirely (per SvelteKit's own csrf_check_origin resolution: it is true only
+// when checkOrigin is true AND trustedOrigins does not contain '*').
+import adapter from '@sveltejs/adapter-auto';
+
+/** @type {import('@sveltejs/kit').Config} */
+const config = {
+	kit: {
+		adapter: adapter(),
+		csrf: {
+			trustedOrigins: ['*']
+		}
+	}
+};
+
+export default config;

package/tests/fixtures/frontend-security-detection/sveltekit-actions-load-security-review/red/load-session-leak.server.js

@@ -0,0 +1,12 @@
+// src/routes/account/+page.server.js — DANGER: the raw session cookie is
+// passed straight into the database lookup with no auth-guard call anywhere
+// in this file. Any request carrying a guessable/forged `sessionid` cookie
+// value gets a full account record back — there is no verification step,
+// only a lookup.
+import * as db from '$lib/server/db';
+
+/** @type {import('./$types').PageServerLoad} */
+export async function load({ cookies }) {
+	const account = await db.getAccount(cookies.get('sessionid'));
+	return { account };
+}

package/tests/fixtures/frontend-security-detection/sveltekit-actions-load-security-review/red/set-cookie-insecure.server.js

@@ -0,0 +1,15 @@
+// src/routes/login/+page.server.js — DANGER: httpOnly is explicitly disabled,
+// so the session cookie is readable from client-side JavaScript. Any XSS
+// elsewhere in the app (or a malicious third-party script) can exfiltrate it.
+import * as db from '$lib/server/db';
+
+/** @satisfies {import('./$types').Actions} */
+export const actions = {
+	login: async ({ cookies, request }) => {
+		const data = await request.formData();
+		const user = await db.getUser(data.get('email'));
+		const token = await db.createSession(user);
+		cookies.set('sessionid', token, { path: '/', httpOnly: false, secure: true, sameSite: 'lax' });
+		return { success: true };
+	}
+};

package/tests/fixtures/frontend-security-detection/vue-router-navigation-security-review/detectors.json

@@ -0,0 +1,50 @@
+{
+  "skill_id": "vue-router-navigation-security-review",
+  "detectors": [
+    {
+      "id": "guard-sole-authz-boundary",
+      "regex": "!\\w*[Aa]uth\\w*\\.(is\\w+|role)\\b",
+      "skill_keywords": ["beforeEach", "sole authorization boundary"],
+      "red": "red/guard-sole-authz.js",
+      "green": "green/guard-sole-authz.js",
+      "severity": "high",
+      "rationale": "The guard decides access purely from a client-held boolean flag (authStore.isAdmin) with no server round-trip, so a forged/patched client flag bypasses the check entirely since nothing re-verifies it server-side; the safe idiom awaits a server-verified check (verifyAdminOnServer()) so the client can never self-assert authorization."
+    },
+    {
+      "id": "open-redirect-query-into-push",
+      "regex": "router\\.push\\(\\s*route\\.query\\.(redirect|returnUrl)\\s*\\)",
+      "skill_keywords": ["open redirect", "route.query.redirect", "router.push()"],
+      "red": "red/open-redirect.js",
+      "green": "green/open-redirect.js",
+      "severity": "high",
+      "rationale": "Passing route.query.redirect straight into router.push() lets an attacker craft a login link whose redirect param points off-site (or to a protocol-relative URL), turning a trusted login flow into a phishing redirect; the safe idiom validates the value against a same-origin relative-path regex before use, falling back to a fixed safe destination otherwise."
+    },
+    {
+      "id": "scheme-injection-dynamic-to",
+      "regex": "<router-link[^>]*:to=\"[^\"]*\"",
+      "skill_keywords": ["javascript:", "data:", ":to", ":href", "dynamic"],
+      "red": "red/scheme-injection.vue",
+      "green": "green/scheme-injection.vue",
+      "severity": "high",
+      "rationale": "Binding router-link's :to directly to a user-editable profile field with no protocol check lets an attacker store a javascript:/data: URI that executes when a visitor clicks the link; the safe idiom parses the URL and only renders it when its protocol is on an explicit allowlist (http:/https:/mailto:), otherwise falling back to a harmless '#'."
+    },
+    {
+      "id": "route-query-into-v-html",
+      "regex": "v-html=\"route\\.(query|params)\\.\\w+\"",
+      "skill_keywords": ["v-html", "route.params", "route.query", "reflected XSS"],
+      "red": "red/reflected-xss.vue",
+      "green": "green/reflected-xss.vue",
+      "severity": "high",
+      "rationale": "Feeding route.query.q straight into v-html renders any attacker-controlled markup in the URL as live HTML (reflected XSS via a crafted link); the safe idiom runs the exact same value through DOMPurify.sanitize() before it ever reaches v-html, stripping executable content."
+    },
+    {
+      "id": "guard-redirect-missing-self-exclusion",
+      "regex": "!auth\\.isLoggedIn\\(\\)\\)\\s*\\{",
+      "skill_keywords": ["next(unvalidatedPath)", "self-exclusion", "to.name !== 'Login'"],
+      "red": "red/redirect-loop.js",
+      "green": "green/redirect-loop.js",
+      "severity": "high",
+      "rationale": "The guard redirects to Login whenever the session check fails, including when the user is already navigating to Login, so an expired session on the Login page bounces back to itself in an infinite redirect loop; the safe idiom adds Vue Router's documented to.name !== 'Login' self-exclusion so the guard never redirects a route to itself."
+    }
+  ]
+}

package/tests/fixtures/frontend-security-detection/vue-router-navigation-security-review/green/guard-sole-authz.js

@@ -0,0 +1,11 @@
+// Admin panel route guard -- gates the UI, but authorization is actually
+// decided by a server round-trip so a forged client flag can't bypass it.
+// The /api/admin/* endpoints independently re-check the session server-side.
+router.beforeEach(async (to, from) => {
+  if (to.meta.requiresAdmin) {
+    const allowed = await verifyAdminOnServer()
+    if (!allowed) {
+      return { name: 'Login' }
+    }
+  }
+})

package/tests/fixtures/frontend-security-detection/vue-router-navigation-security-review/green/open-redirect.js

@@ -0,0 +1,10 @@
+// Post-login redirect handler.
+const SAFE_REDIRECT = /^\/(?!\/)/
+
+async function onLoginSuccess(route, router) {
+  await auth.login()
+  // Only accept a same-origin relative path; anything else (protocol-relative
+  // //evil.example.com, absolute https://evil.example.com) falls back to home.
+  const target = route.query.redirect
+  router.push(SAFE_REDIRECT.test(target) ? target : '/')
+}

package/tests/fixtures/frontend-security-detection/vue-router-navigation-security-review/green/redirect-loop.js

@@ -0,0 +1,8 @@
+// Global auth guard. The Login route is explicitly excluded from the check,
+// so an expired session on the Login page never gets redirected back to
+// itself -- no loop is possible.
+router.beforeEach((to, from) => {
+  if (to.meta.requiresAuth && !auth.isLoggedIn() && to.name !== 'Login') {
+    return { name: 'Login' }
+  }
+})

package/tests/fixtures/frontend-security-detection/vue-router-navigation-security-review/green/reflected-xss.vue

@@ -0,0 +1,14 @@
+<template>
+  <!-- Search results page. The raw query string is sanitized with DOMPurify
+       on this exact path before it is ever handed to v-html. -->
+  <div v-html="sanitizedQuery"></div>
+</template>
+
+<script setup>
+import { computed } from 'vue'
+import { useRoute } from 'vue-router'
+import DOMPurify from 'dompurify'
+
+const route = useRoute()
+const sanitizedQuery = computed(() => DOMPurify.sanitize(route.query.q))
+</script>

package/tests/fixtures/frontend-security-detection/vue-router-navigation-security-review/green/scheme-injection.vue

@@ -0,0 +1,19 @@
+<template>
+  <!-- profileLink is validated against an explicit scheme allowlist before
+       it is ever bound, so javascript:/data: payloads are rejected up front. -->
+  <a :href="safeProfileLink">Visit my site</a>
+</template>
+
+<script setup>
+const ALLOWED_SCHEMES = ['http:', 'https:', 'mailto:']
+
+const props = defineProps({ profileLink: String })
+const safeProfileLink = (() => {
+  try {
+    const url = new URL(props.profileLink, window.location.origin)
+    return ALLOWED_SCHEMES.includes(url.protocol) ? url.href : '#'
+  } catch {
+    return '#'
+  }
+})()
+</script>

package/tests/fixtures/frontend-security-detection/vue-router-navigation-security-review/red/guard-sole-authz.js

@@ -0,0 +1,8 @@
+// Admin panel route guard -- this is the ONLY check gating access to /admin.
+// There is no server-side authorization check on the /api/admin/* endpoints;
+// they trust any authenticated session and return data to whoever asks.
+router.beforeEach((to, from) => {
+  if (to.meta.requiresAdmin && !authStore.isAdmin) {
+    return { name: 'Login' }
+  }
+})

package/tests/fixtures/frontend-security-detection/vue-router-navigation-security-review/red/open-redirect.js

@@ -0,0 +1,7 @@
+// Post-login redirect handler.
+async function onLoginSuccess(route, router) {
+  await auth.login()
+  // Whatever the query string says, off we go -- including a full
+  // attacker-controlled absolute URL like //evil.example.com/phish.
+  router.push(route.query.redirect)
+}

package/tests/fixtures/frontend-security-detection/vue-router-navigation-security-review/red/redirect-loop.js

@@ -0,0 +1,8 @@
+// Global auth guard. Every route -- including the Login route itself --
+// gets funneled through this check, so an expired session on the Login page
+// bounces right back to itself: an infinite navigation loop.
+router.beforeEach((to, from) => {
+  if (to.meta.requiresAuth && !auth.isLoggedIn()) {
+    return { name: 'Login' }
+  }
+})

package/tests/fixtures/frontend-security-detection/vue-router-navigation-security-review/red/reflected-xss.vue

@@ -0,0 +1,10 @@
+<template>
+  <!-- Search results page. The query string "q" is echoed back verbatim as
+       markup, so ?q=<img src=x onerror=alert(document.cookie)> executes. -->
+  <div v-html="route.query.q"></div>
+</template>
+
+<script setup>
+import { useRoute } from 'vue-router'
+const route = useRoute()
+</script>

package/tests/fixtures/frontend-security-detection/vue-router-navigation-security-review/red/scheme-injection.vue

@@ -0,0 +1,10 @@
+<template>
+  <!-- profileLink comes straight from the user's editable profile "website"
+       field; nothing stops it from being javascript:alert(document.cookie)
+       or data:text/html,<script>... -->
+  <router-link :to="profileLink">Visit my site</router-link>
+</template>
+
+<script setup>
+defineProps({ profileLink: String })
+</script>

package/tests/fixtures/frontend-security-detection/vue-ssr-security-review/detectors.json

@@ -0,0 +1,41 @@
+{
+  "skill_id": "vue-ssr-security-review",
+  "detectors": [
+    {
+      "id": "unsanitized-v-html-binding",
+      "regex": "v-html\\s*=\\s*\"[^\"]+\"",
+      "skill_keywords": ["v-html"],
+      "red": "red/UserBio.vue",
+      "green": "green/UserBio.vue",
+      "severity": "high",
+      "rationale": "Binding v-html to a user-controlled prop (userBio) sets innerHTML directly with no sanitization, allowing stored/reflected XSS if the value contains markup or script; the safe idiom uses Vue's default text interpolation ({{ userBio }}), which HTML-escapes the value and never sets innerHTML, so no markup is ever injected."
+    },
+    {
+      "id": "unvalidated-dynamic-href",
+      "regex": ":href=\"[a-zA-Z_$][\\w.]*\"",
+      "skill_keywords": [":href"],
+      "red": "red/ProfileLink.vue",
+      "green": "green/ProfileLink.vue",
+      "severity": "high",
+      "rationale": "Binding :href directly to a raw user-controlled value (userProvidedUrl) with no scheme check lets an attacker supply a javascript: URL that executes on click; the safe idiom routes the value through a safeHref() allowlist function inside the template expression, which the regex (requiring a bare identifier with no call syntax) correctly does not match."
+    },
+    {
+      "id": "unvalidated-dynamic-src",
+      "regex": ":src=\"[a-zA-Z_$][\\w.]*\"",
+      "skill_keywords": [":src"],
+      "red": "red/AvatarImage.vue",
+      "green": "green/AvatarImage.vue",
+      "severity": "medium",
+      "rationale": "Binding :src directly to a raw user-controlled value (userProvidedImageUrl) with no scheme validation allows a javascript:/data: URI or arbitrary external resource load; the safe idiom wraps the value in a safeSrc() allowlist function call in the template, which the bare-identifier regex correctly does not match."
+    },
+    {
+      "id": "module-scope-reactive-ssr-state",
+      "regex": "(?m)^const\\s+\\w+\\s*=\\s*reactive\\(",
+      "skill_keywords": ["module-scope", "reactive"],
+      "red": "red/entry-server.js",
+      "green": "green/entry-server.js",
+      "severity": "high",
+      "rationale": "Declaring reactive({...}) at module scope (unindented top-level const) in an SSR entry point creates one object shared by every concurrent request handled by the long-lived Node.js process, causing cross-request state pollution (one user's data leaking to another); the safe idiom moves the identical reactive() call inside the per-request render() function, so each request gets its own isolated instance and the regex's module-scope (column-0, unindented) anchor no longer matches."
+    }
+  ]
+}

package/tests/fixtures/frontend-security-detection/vue-ssr-security-review/green/AvatarImage.vue

@@ -0,0 +1,18 @@
+<script setup>
+import { defineProps } from 'vue'
+const props = defineProps({ userProvidedImageUrl: String })
+
+const ALLOWED_SCHEMES = ['http:', 'https:']
+function safeSrc(url) {
+  try {
+    const parsed = new URL(url, window.location.origin)
+    return ALLOWED_SCHEMES.includes(parsed.protocol) ? url : '/img/placeholder.png'
+  } catch {
+    return '/img/placeholder.png'
+  }
+}
+</script>
+
+<template>
+  <img :src="safeSrc(userProvidedImageUrl)" alt="avatar" />
+</template>

package/tests/fixtures/frontend-security-detection/vue-ssr-security-review/green/ProfileLink.vue

@@ -0,0 +1,19 @@
+<script setup>
+import { defineProps, computed } from 'vue'
+const props = defineProps({ userProvidedUrl: String })
+
+const ALLOWED_SCHEMES = ['http:', 'https:', 'mailto:']
+function safeHref(url) {
+  try {
+    const parsed = new URL(url, window.location.origin)
+    return ALLOWED_SCHEMES.includes(parsed.protocol) ? url : '#'
+  } catch {
+    return '#'
+  }
+}
+
+</script>
+
+<template>
+  <a :href="safeHref(userProvidedUrl)">Visit my website</a>
+</template>

package/tests/fixtures/frontend-security-detection/vue-ssr-security-review/green/UserBio.vue

@@ -0,0 +1,9 @@
+<script setup>
+import { defineProps } from 'vue'
+const props = defineProps({ userBio: String })
+</script>
+
+<template>
+  <!-- Vue's default text interpolation auto-escapes HTML entities; no raw markup is ever injected -->
+  <div>{{ userBio }}</div>
+</template>

package/tests/fixtures/frontend-security-detection/vue-ssr-security-review/green/entry-server.js

@@ -0,0 +1,21 @@
+import { createSSRApp } from 'vue'
+import { reactive } from 'vue'
+import App from './App.vue'
+
+export async function render(url, manifest) {
+  // Safe: created fresh inside the per-request function, so each request
+  // gets its own isolated, non-shared reactive object.
+  const state = reactive({ userId: null, userData: {} })
+  const app = createSSRApp(App)
+  state.userId = extractUserIdFromUrl(url)
+  state.userData = await loadUserData(state.userId)
+  return app
+}
+
+function extractUserIdFromUrl(url) {
+  return new URLSearchParams(url.split('?')[1]).get('userId')
+}
+
+async function loadUserData(userId) {
+  return { id: userId }
+}

package/tests/fixtures/frontend-security-detection/vue-ssr-security-review/red/AvatarImage.vue

@@ -0,0 +1,9 @@
+<script setup>
+import { defineProps } from 'vue'
+// userProvidedImageUrl comes from an untrusted profile field submitted by the user
+const props = defineProps({ userProvidedImageUrl: String })
+</script>
+
+<template>
+  <img :src="userProvidedImageUrl" alt="avatar" />
+</template>

package/tests/fixtures/frontend-security-detection/vue-ssr-security-review/red/ProfileLink.vue

@@ -0,0 +1,9 @@
+<script setup>
+import { defineProps } from 'vue'
+// userProvidedUrl is taken directly from a query param (?website=javascript:alert(document.cookie))
+const props = defineProps({ userProvidedUrl: String })
+</script>
+
+<template>
+  <a :href="userProvidedUrl">Visit my website</a>
+</template>

package/tests/fixtures/frontend-security-detection/vue-ssr-security-review/red/UserBio.vue

@@ -0,0 +1,9 @@
+<script setup>
+import { defineProps } from 'vue'
+const props = defineProps({ userBio: String })
+</script>
+
+<template>
+  <!-- userBio comes straight from a user profile field with no sanitization -->
+  <div v-html="userBio"></div>
+</template>

package/tests/fixtures/frontend-security-detection/vue-ssr-security-review/red/entry-server.js

@@ -0,0 +1,22 @@
+import { createSSRApp } from 'vue'
+import { reactive } from 'vue'
+import App from './App.vue'
+
+// DANGER: declared at module scope — this single object is shared across
+// every concurrent request handled by this long-lived Node.js process.
+const state = reactive({ userId: null, userData: {} })
+
+export async function render(url, manifest) {
+  const app = createSSRApp(App)
+  state.userId = extractUserIdFromUrl(url)
+  state.userData = await loadUserData(state.userId)
+  return app
+}
+
+function extractUserIdFromUrl(url) {
+  return new URLSearchParams(url.split('?')[1]).get('userId')
+}
+
+async function loadUserData(userId) {
+  return { id: userId }
+}

package/tests/fixtures/frontend-security-detection/vue-state-store-security-review/detectors.json

@@ -0,0 +1,50 @@
+{
+  "skill_id": "vue-state-store-security-review",
+  "detectors": [
+    {
+      "id": "persist-true-unscoped",
+      "regex": "persist\\s*:\\s*true\\b",
+      "skill_keywords": ["persist: true", "pinia-plugin-persistedstate"],
+      "red": "red/persist-unscoped.js",
+      "green": "green/persist-scoped.js",
+      "severity": "high",
+      "rationale": "persist: true with no pick/paths array persists the store's entire state tree (including authToken/ssn/creditCardLast4) to localStorage in plaintext, readable by any script/extension with page access. The safe idiom uses an explicit pick list plus sessionStorage to scope persistence to only the non-sensitive theme field."
+    },
+    {
+      "id": "unescaped-state-serialization",
+      "regex": "JSON\\.stringify\\(\\s*pinia\\.state\\.value\\s*\\)",
+      "skill_keywords": ["JSON.stringify", "devalue"],
+      "red": "red/hydration-serialize.js",
+      "green": "green/hydration-devalue.js",
+      "severity": "high",
+      "rationale": "Naive JSON.stringify() does not escape </script>, <, or U+2028/2029 inside a value that flows into an inline <script> tag; a user-controlled state field can break out of the script context and inject arbitrary markup/script (XSS). devalue() serializes with escaping safe for inline-script embedding, a genuinely different serialization mechanism."
+    },
+    {
+      "id": "unvalidated-hydration-assignment",
+      "regex": "pinia\\.state\\.value\\s*=\\s*JSON\\.parse\\(",
+      "skill_keywords": ["pinia.state.value = JSON.parse(window.__pinia)", "un-escaped"],
+      "red": "red/hydrate-unvalidated.js",
+      "green": "green/hydrate-validated.js",
+      "severity": "high",
+      "rationale": "Assigning JSON.parse(window.__pinia) directly into pinia.state.value trusts an attacker-reachable global (alterable via a prior XSS, a compromised CDN script, or a MITM'd response) with no shape check, letting a malformed/malicious payload silently overwrite the entire store tree. The safe idiom parses into a temporary and only commits it to the store after a shape validator confirms it matches the expected structure."
+    },
+    {
+      "id": "ssr-module-scope-createpinia",
+      "regex": "(?m)^const \\w+\\s*=\\s*createPinia\\(\\)",
+      "skill_keywords": ["createPinia()", "cross-request pollution"],
+      "red": "red/ssr-singleton.js",
+      "green": "green/ssr-per-request.js",
+      "severity": "high",
+      "rationale": "A module-scope const pinia = createPinia() is instantiated once per server process and shared across every concurrent SSR request, so state written while rendering one user's request (e.g. pinia.state.value.route) is reachable by a different, concurrent user's response. The safe idiom creates a fresh Pinia instance inside the per-request render() handler so no state can leak between requests."
+    },
+    {
+      "id": "client-flag-gates-mutation",
+      "regex": "if\\s*\\(\\s*\\w+\\.isAdmin\\s*\\)",
+      "skill_keywords": ["isAdmin", "authorization source of truth"],
+      "red": "red/auth-flag-gate.js",
+      "green": "green/auth-flag-ui-only.js",
+      "severity": "high",
+      "rationale": "userStore.isAdmin is client-writable (persisted/hydrated) state; wrapping the mutating api.delete() call in `if (userStore.isAdmin)` uses it as an authorization boundary, so a user who flips the flag in devtools/localStorage can trigger the deletion regardless of actual server-side permissions. The safe idiom uses the flag only to control UI visibility and always sends the request unconditionally, relying on the server to independently re-verify permission on every call."
+    }
+  ]
+}

package/tests/fixtures/frontend-security-detection/vue-state-store-security-review/green/auth-flag-ui-only.js

@@ -0,0 +1,18 @@
+// components/UserAdmin.vue <script setup>
+import { computed } from 'vue'
+import { useUserStore } from '@/stores/user'
+import api from '@/api'
+
+const userStore = useUserStore()
+
+// Client flag only controls whether the delete button renders/enables in the
+// UI. It is never used to gate whether the mutating request is sent — the
+// server independently re-verifies the caller's permissions on every request
+// and returns 403 if the caller is not actually an admin.
+const canShowDeleteButton = computed(() => userStore.isAdmin)
+
+async function deleteUser(id) {
+  await api.delete(`/users/${id}`)
+}
+
+export { canShowDeleteButton, deleteUser }

package/tests/fixtures/frontend-security-detection/vue-state-store-security-review/green/hydrate-validated.js

@@ -0,0 +1,14 @@
+// entry-client.js
+import { createApp } from './main'
+import { isValidPiniaStateShape } from './hydrate-guard'
+
+const { app, pinia } = createApp()
+
+const raw = JSON.parse(window.__pinia)
+if (isValidPiniaStateShape(raw)) {
+  pinia.state.value = raw
+} else {
+  console.error('Discarding malformed hydration payload')
+}
+
+app.mount('#app')

package/tests/fixtures/frontend-security-detection/vue-state-store-security-review/green/hydration-devalue.js

@@ -0,0 +1,15 @@
+// entry-server.js
+import { renderToString } from '@vue/server-renderer'
+import devalue from '@nuxt/devalue'
+
+export async function render(url, pinia, app) {
+  const appHtml = await renderToString(app)
+
+  // devalue escapes </script>, <, and line-separator characters for safe
+  // embedding inside an inline <script> tag.
+  const serialized = devalue(pinia.state.value)
+  const html = `<div id="app">${appHtml}</div>
+<script>window.__pinia=${serialized}</script>`
+
+  return html
+}

package/tests/fixtures/frontend-security-detection/vue-state-store-security-review/green/persist-scoped.js

@@ -0,0 +1,22 @@
+// stores/user.js
+import { defineStore } from 'pinia'
+
+export const useUserStore = defineStore('user', {
+  state: () => ({
+    theme: 'dark',
+    authToken: null,
+    ssn: null,
+    creditCardLast4: null,
+  }),
+  actions: {
+    login(token, ssn, cc) {
+      this.authToken = token
+      this.ssn = ssn
+      this.creditCardLast4 = cc
+    },
+  },
+  persist: {
+    pick: ['theme'],
+    storage: sessionStorage,
+  },
+})

package/tests/fixtures/frontend-security-detection/vue-state-store-security-review/green/ssr-per-request.js

@@ -0,0 +1,14 @@
+// entry-server.js
+import { createSSRApp } from 'vue'
+import { createPinia } from 'pinia'
+import App from './App.vue'
+
+export async function render(url) {
+  // Fresh Pinia instance per request — no cross-request shared state.
+  const pinia = createPinia()
+  const app = createSSRApp(App)
+  app.use(pinia)
+
+  pinia.state.value.route = { url }
+  return app
+}