@runsec/mcp 1.0.1

package/src/rules/data/semgrep-rules/frontend-react.yaml

@@ -0,0 +1,4035 @@
+rules:
+  - id: runsec.frontend-react.fr-001
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        User-controlled HTML executes script in browser context.
+    pattern-either:
+      - pattern: |-
+          <div dangerouslySetInnerHTML={{ __html: userHtml }} />
+      - pattern-regex: 'Vulnerable:\\s*FR\\-001\\b'
+    message: |-
+      RunSec Detection [FR-001]: ASVS V5.1, CWE-79
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-002
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        DOM sink executes injected markup/script payloads.
+    pattern-either:
+      - pattern: |-
+          ref.current!.innerHTML = payload
+      - pattern-regex: 'Vulnerable:\\s*FR\\-002\\b'
+    message: |-
+      RunSec Detection [FR-002]: ASVS V5.1, CWE-79
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-003
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        HTML injection into trusted component region.
+    pattern-either:
+      - pattern: |-
+          el.insertAdjacentHTML("beforeend", html)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-003\\b'
+    message: |-
+      RunSec Detection [FR-003]: ASVS V5.1, CWE-79
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-004
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Malicious script runs inside iframe content.
+    pattern-either:
+      - pattern: |-
+          <iframe srcDoc={userProvided} />
+      - pattern-regex: 'Vulnerable:\\s*FR\\-004\\b'
+    message: |-
+      RunSec Detection [FR-004]: ASVS V5.1, CWE-79
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-005
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Arbitrary code execution in browser runtime.
+    pattern-either:
+      - pattern: |-
+          const out = eval(expr)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-005\\b'
+    message: |-
+      RunSec Detection [FR-005]: ASVS V5.1, CWE-95
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-006
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Runtime code compilation enables injection paths.
+    pattern-either:
+      - pattern: |-
+          const fn = new Function("x", code)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-006\\b'
+    message: |-
+      RunSec Detection [FR-006]: ASVS V5.1, CWE-95
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-007
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        String-based timer evaluates attacker-influenced code.
+    pattern-either:
+      - pattern: |-
+          setTimeout("runUserAction()", 10)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-007\\b'
+    message: |-
+      RunSec Detection [FR-007]: ASVS V5.1, CWE-95
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-008
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Repeated string evaluation expands injection impact.
+    pattern-either:
+      - pattern: |-
+          setInterval(userCode, 1000)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-008\\b'
+    message: |-
+      RunSec Detection [FR-008]: ASVS V5.1, CWE-95
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-009
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        javascript: URI executes script when clicked.
+    pattern-either:
+      - pattern: |-
+          <a href={userLink}>go</a>
+      - pattern-regex: 'Vulnerable:\\s*FR\\-009\\b'
+    message: |-
+      RunSec Detection [FR-009]: ASVS V5.1, CWE-79
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-010
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Crafted style values bypass UI trust boundaries.
+    pattern-either:
+      - pattern: |-
+          <div style={{ backgroundImage: "url(" + userUrl + ")" }} />
+      - pattern-regex: 'Vulnerable:\\s*FR\\-010\\b'
+    message: |-
+      RunSec Detection [FR-010]: ASVS V5.1, CWE-79
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-011
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        ""
+      fix_template: |-
+        N/A
+    pattern-either:
+      - pattern: |-
+          contentRef.current!.innerHTML = searchParams.get("msg")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-011\\b'
+    message: |-
+      RunSec Detection [FR-011]: contentRef.current!.textContent = searchParams.get("msg")
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-012
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Embedded HTML/script in markdown reaches DOM.
+    pattern-either:
+      - pattern: |-
+          <Markdown>{rawMd}</Markdown>
+      - pattern-regex: 'Vulnerable:\\s*FR\\-012\\b'
+    message: |-
+      RunSec Detection [FR-012]: ASVS V5.1, CWE-79
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-013
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Stolen runtime/state snapshot exposes bearer tokens.
+    pattern-either:
+      - pattern: |-
+          state.auth.accessToken = token
+      - pattern-regex: 'Vulnerable:\\s*FR\\-013\\b'
+    message: |-
+      RunSec Detection [FR-013]: ASVS V14.2, CWE-200
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-014
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Sensitive payment data leaks via devtools/logs.
+    pattern-either:
+      - pattern: |-
+          state.payment.pan = form.pan
+      - pattern-regex: 'Vulnerable:\\s*FR\\-014\\b'
+    message: |-
+      RunSec Detection [FR-014]: ASVS V14.2, CWE-200
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-015
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Secret leakage through memory dumps and extensions.
+    pattern-either:
+      - pattern: |-
+          set({ apiKey: "sk-live-..." })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-015\\b'
+    message: |-
+      RunSec Detection [FR-015]: ASVS V14.2, CWE-200
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-016
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Child components can exfiltrate excessive user data.
+    pattern-either:
+      - pattern: |-
+          <AuthContext.Provider value={{ user }}>
+      - pattern-regex: 'Vulnerable:\\s*FR\\-016\\b'
+    message: |-
+      RunSec Detection [FR-016]: ASVS V14.2, CWE-200
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-017
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Tokens/PII remain on disk after logout/device theft.
+    pattern-either:
+      - pattern: |-
+          persistReducer({ key: "root", storage }, authReducer)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-017\\b'
+    message: |-
+      RunSec Detection [FR-017]: ASVS V14.2, CWE-200
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-018
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Browser logs expose secrets to local observers.
+    pattern-either:
+      - pattern: |-
+          console.log(store.getState())
+      - pattern-regex: 'Vulnerable:\\s*FR\\-018\\b'
+    message: |-
+      RunSec Detection [FR-018]: ASVS V14.2, CWE-532
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-019
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Telemetry backend receives secret-bearing snapshots.
+    pattern-either:
+      - pattern: |-
+          capture("state_snapshot", store.getState())
+      - pattern-regex: 'Vulnerable:\\s*FR\\-019\\b'
+    message: |-
+      RunSec Detection [FR-019]: ASVS V14.2, CWE-200
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-020
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        XSS attacker extracts long-lived session token.
+    pattern-either:
+      - pattern: |-
+          localStorage.setItem("access_token", token)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-020\\b'
+    message: |-
+      RunSec Detection [FR-020]: ASVS V14.2, CWE-922
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-021
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Refresh token theft enables session replay.
+    pattern-either:
+      - pattern: |-
+          sessionStorage.setItem("refresh_token", rt)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-021\\b'
+    message: |-
+      RunSec Detection [FR-021]: ASVS V14.2, CWE-922
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-022
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Central wrapper spreads insecure secret storage pattern.
+    pattern-either:
+      - pattern: |-
+          storage.save("jwt", token)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-022\\b'
+    message: |-
+      RunSec Detection [FR-022]: ASVS V14.2, CWE-922
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-023
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Polluted prototype alters app-wide behavior and guards.
+    pattern-either:
+      - pattern: |-
+          deepMerge(config, userTheme)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-023\\b'
+    message: |-
+      RunSec Detection [FR-023]: ASVS V14.3, CWE-1321
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-024
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Crafted keys mutate object prototypes transitively.
+    pattern-either:
+      - pattern: |-
+          merge(target, payload)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-024\\b'
+    message: |-
+      RunSec Detection [FR-024]: ASVS V14.3, CWE-1321
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-025
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Recursive merge enables hidden key smuggling.
+    pattern-either:
+      - pattern: |-
+          for (const k in src) out[k] = merge(out[k], src[k])
+      - pattern-regex: 'Vulnerable:\\s*FR\\-025\\b'
+    message: |-
+      RunSec Detection [FR-025]: ASVS V14.3, CWE-1321
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-026
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Attacker controls dotted path into prototype chain.
+    pattern-either:
+      - pattern: |-
+          set(obj, reqPath, value)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-026\\b'
+    message: |-
+      RunSec Detection [FR-026]: ASVS V14.3, CWE-1321
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-027
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        New tab can hijack window.opener of origin tab.
+    pattern-either:
+      - pattern: |-
+          <a target="_blank" href={url}>
+      - pattern-regex: 'Vulnerable:\\s*FR\\-027\\b'
+    message: |-
+      RunSec Detection [FR-027]: ASVS V14.3, CWE-1022
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-028
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Dynamic external links leave opener channel exposed.
+    pattern-either:
+      - pattern: |-
+          <Link to={ext} target="_blank">
+      - pattern-regex: 'Vulnerable:\\s*FR\\-028\\b'
+    message: |-
+      RunSec Detection [FR-028]: ASVS V14.3, CWE-1022
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-029
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Invalid props disable client-side upload guardrails.
+    pattern-either:
+      - pattern: |-
+          <FileUpload onUpload={onUpload} maxSize={props.maxSize as any} />
+      - pattern-regex: 'Vulnerable:\\s*FR\\-029\\b'
+    message: |-
+      RunSec Detection [FR-029]: ASVS V5.1, CWE-20
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-030
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Crafted props alter sensitive payment workflow logic.
+    pattern-either:
+      - pattern: |-
+          <PaymentForm amount={query.amount as any} currency={query.currency as any} />
+      - pattern-regex: 'Vulnerable:\\s*FR\\-030\\b'
+    message: |-
+      RunSec Detection [FR-030]: ASVS V5.1, CWE-20
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-031
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Unvalidated callback path leads to redirect abuse.
+    pattern-either:
+      - pattern: |-
+          <ConsentDialog returnUrl={params.returnUrl} />
+      - pattern-regex: 'Vulnerable:\\s*FR\\-031\\b'
+    message: |-
+      RunSec Detection [FR-031]: ASVS V5.1, CWE-20
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-032
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        any props bypass type and runtime security checks.
+    pattern-either:
+      - pattern: |-
+          function AdminPanel(props: any) { ... }
+      - pattern-regex: 'Vulnerable:\\s*FR\\-032\\b'
+    message: |-
+      RunSec Detection [FR-032]: ASVS V5.1, CWE-20
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-033
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Render loop causes client-side resource exhaustion.
+    pattern-either:
+      - pattern: |-
+          useEffect(() => { setState(calc()); }, [{ id }])
+      - pattern-regex: 'Vulnerable:\\s*FR\\-033\\b'
+    message: |-
+      RunSec Detection [FR-033]: ASVS V14.3, CWE-400
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-034
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Slow response overwrites state for newer context.
+    pattern-either:
+      - pattern: |-
+          useEffect(() => { fetchData(id).then(setData); }, [id])
+      - pattern-regex: 'Vulnerable:\\s*FR\\-034\\b'
+    message: |-
+      RunSec Detection [FR-034]: ASVS V14.3, CWE-362
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-035
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Hanging requests accumulate and degrade availability.
+    pattern-either:
+      - pattern: |-
+          useEffect(() => { api.get(url).then(setItems); }, [url])
+      - pattern-regex: 'Vulnerable:\\s*FR\\-035\\b'
+    message: |-
+      RunSec Detection [FR-035]: ASVS V14.3, CWE-400
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-036
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Unmounted updates create inconsistent component state.
+    pattern-either:
+      - pattern: |-
+          promise.then(() => setLoading(false))
+      - pattern-regex: 'Vulnerable:\\s*FR\\-036\\b'
+    message: |-
+      RunSec Detection [FR-036]: ASVS V14.3, CWE-362
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-037
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        ASVS V14.2, CWE-601
+      fix_template: |-
+        TypeScript/React Router
+    pattern-either:
+      - pattern: |-
+          navigate(searchParams.get("next")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-037\\b'
+    message: |-
+      RunSec Detection [FR-037]: navigate(safeInternalPath(searchParams.get("next")))
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-038
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Untrusted URL causes off-domain redirection.
+    pattern-either:
+      - pattern: |-
+          window.location.href = returnUrl
+      - pattern-regex: 'Vulnerable:\\s*FR\\-038\\b'
+    message: |-
+      RunSec Detection [FR-038]: ASVS V14.2, CWE-601
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-039
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        OAuth callback abused to redirect to attacker endpoint.
+    pattern-either:
+      - pattern: |-
+          const to = qs.get("redirect_uri"); navigate(to!)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-039\\b'
+    message: |-
+      RunSec Detection [FR-039]: ASVS V14.2, CWE-601
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-040
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Sensitive message leaks to untrusted origins.
+    pattern-either:
+      - pattern: |-
+          window.opener?.postMessage(token, "*")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-040\\b'
+    message: |-
+      RunSec Detection [FR-040]: ASVS V14.3, CWE-346
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-041
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Malicious frame injects control messages.
+    pattern-either:
+      - pattern: |-
+          window.addEventListener("message", e => handle(e.data))
+      - pattern-regex: 'Vulnerable:\\s*FR\\-041\\b'
+    message: |-
+      RunSec Detection [FR-041]: ASVS V14.3, CWE-346
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-042
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Untrusted script source leads to supply-chain injection.
+    pattern-either:
+      - pattern: |-
+          const s = document.createElement("script"); s.src = userUrl; document.body.appendChild(s)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-042\\b'
+    message: |-
+      RunSec Detection [FR-042]: ASVS V5.1, CWE-829
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-043
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        ASVS V14.3, CWE-829
+      fix_template: |-
+        TypeScript/React
+    pattern-either:
+      - pattern: |-
+          <iframe src={params.get("url")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-043\\b'
+    message: |-
+      RunSec Detection [FR-043]: <iframe src={allowlistedFrameUrl(params.get("url"))} sandbox="allow-scripts allow-same-origin" />
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-044
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Inline script execution bypasses expected CSP posture.
+    pattern-either:
+      - pattern: |-
+          <script dangerouslySetInnerHTML={{ __html: inlineJs }} />
+      - pattern-regex: 'Vulnerable:\\s*FR\\-044\\b'
+    message: |-
+      RunSec Detection [FR-044]: ASVS V14.3, CWE-693
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-045
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Client trusts forged claims for privileged UI paths.
+    pattern-either:
+      - pattern: |-
+          const claims = JSON.parse(atob(token.split(".")[1]))
+      - pattern-regex: 'Vulnerable:\\s*FR\\-045\\b'
+    message: |-
+      RunSec Detection [FR-045]: ASVS V14.2, CWE-345
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-046
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Client-only role checks are bypassable and misleading.
+    pattern-either:
+      - pattern: |-
+          if (user.role === "admin") return <Admin />
+      - pattern-regex: 'Vulnerable:\\s*FR\\-046\\b'
+    message: |-
+      RunSec Detection [FR-046]: ASVS V14.2, CWE-285
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-047
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        URL leaks token to logs, history, and referrers.
+    pattern-either:
+      - pattern: |-
+          navigate("/done?token=" + token)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-047\\b'
+    message: |-
+      RunSec Detection [FR-047]: ASVS V14.2, CWE-598
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-048
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        File metadata can deliver stored XSS payload.
+    pattern-either:
+      - pattern: |-
+          <div>{dangerouslyRender(fileName)}</div>
+      - pattern-regex: 'Vulnerable:\\s*FR\\-048\\b'
+    message: |-
+      RunSec Detection [FR-048]: ASVS V5.1, CWE-79
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-049
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Misconfigured sanitizer allows dangerous payload through.
+    pattern-either:
+      - pattern: |-
+          sanitize(html, { ALLOWED_TAGS: false })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-049\\b'
+    message: |-
+      RunSec Detection [FR-049]: ASVS V5.1, CWE-79
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-050
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Prototype key injection mutates component behavior globally.
+    pattern-either:
+      - pattern: |-
+          const data = JSON.parse(raw); setForm({ ...form, ...data })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-050\\b'
+    message: |-
+      RunSec Detection [FR-050]: ASVS V14.3, CWE-1321
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-051
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Untrusted parent iframe overlays/controls sensitive UI.
+    pattern-either:
+      - pattern: |-
+          <meta http-equiv="Content-Security-Policy" content="default-src 'self'">
+      - pattern-regex: 'Vulnerable:\\s*FR\\-051\\b'
+    message: |-
+      RunSec Detection [FR-051]: ASVS V14.3, CWE-1021
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-052
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Embedded contexts trick users into approving hidden actions.
+    pattern-either:
+      - pattern: |-
+          <PaymentApproveModal open={open} />
+      - pattern-regex: 'Vulnerable:\\s*FR\\-052\\b'
+    message: |-
+      RunSec Detection [FR-052]: ASVS V14.3, CWE-1021
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-053
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Host page spoofs UI state and captures interactions.
+    pattern-either:
+      - pattern: |-
+          window.addEventListener("message", e => applyOverlayState(e.data))
+      - pattern-regex: 'Vulnerable:\\s*FR\\-053\\b'
+    message: |-
+      RunSec Detection [FR-053]: ASVS V14.3, CWE-1021
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-054
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Attacker links user to spoofed UI confirmation screen.
+    pattern-either:
+      - pattern: |-
+          const mask = search.get("mask") === "1"
+      - pattern-regex: 'Vulnerable:\\s*FR\\-054\\b'
+    message: |-
+      RunSec Detection [FR-054]: ASVS V14.3, CWE-1021
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-055
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Browser auto-sends cookies on cross-site state-changing requests.
+    pattern-either:
+      - pattern: |-
+          axios.create({ withCredentials: true })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-055\\b'
+    message: |-
+      RunSec Detection [FR-055]: ASVS V14.2, CWE-352
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-056
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Forged cross-site POST succeeds via ambient cookies.
+    pattern-either:
+      - pattern: |-
+          fetch("/api/transfer", { method: "POST", credentials: "include", body: payload })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-056\\b'
+    message: |-
+      RunSec Detection [FR-056]: ASVS V14.2, CWE-352
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-057
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Broad credential forwarding expands CSRF attack surface.
+    pattern-either:
+      - pattern: |-
+          axios.defaults.withCredentials = true
+      - pattern-regex: 'Vulnerable:\\s*FR\\-057\\b'
+    message: |-
+      RunSec Detection [FR-057]: ASVS V14.2, CWE-352
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-058
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Cross-origin endpoints receive authenticated cookie traffic.
+    pattern-either:
+      - pattern: |-
+          fetch(url, { credentials: "include", method })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-058\\b'
+    message: |-
+      RunSec Detection [FR-058]: ASVS V14.2, CWE-352
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-059
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Mutation endpoint vulnerable to cross-site request forgery.
+    pattern-either:
+      - pattern: |-
+          client.mutate({ mutation, context: { credentials: "include" } })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-059\\b'
+    message: |-
+      RunSec Detection [FR-059]: ASVS V14.2, CWE-352
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-060
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        XML meta-characters break structure and inject attacker nodes.
+    pattern-either:
+      - pattern: |-
+          "const xml = "<user><name>" + name + "</name></user>";"
+      - pattern-regex: 'Vulnerable:\\s*FR\\-060\\b'
+    message: |-
+      RunSec Detection [FR-060]: ASVS V5.1, CWE-91
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-061
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        XXE-style payload retrieves local/remote sensitive resources.
+    pattern-either:
+      - pattern: |-
+          const doc = parser.parse(xml, { processExternalEntities: true })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-061\\b'
+    message: |-
+      RunSec Detection [FR-061]: ASVS V5.1, CWE-611
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-062
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Injected XML tags alter requested operation semantics.
+    pattern-either:
+      - pattern: |-
+          "const body = <soap:Body><id>${id}</id></soap:Body>;"
+      - pattern-regex: 'Vulnerable:\\s*FR\\-062\\b'
+    message: |-
+      RunSec Detection [FR-062]: ASVS V5.1, CWE-91
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-063
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Malformed XML bypasses expected control flow and trust checks.
+    pattern-either:
+      - pattern: |-
+          const doc = new DOMParser().parseFromString(xml, "text/xml")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-063\\b'
+    message: |-
+      RunSec Detection [FR-063]: ASVS V5.1, CWE-611
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-064
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Unsanitized fragment injection subverts integrity assumptions.
+    pattern-either:
+      - pattern: |-
+          payload = signedPrefix + userFragment + signedSuffix
+      - pattern-regex: 'Vulnerable:\\s*FR\\-064\\b'
+    message: |-
+      RunSec Detection [FR-064]: ASVS V5.1, CWE-91
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-065
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        ASVS V14.3, CWE-451
+      fix_template: |-
+        TypeScript/React
+    pattern-either:
+      - pattern: |-
+          const z = Number(search.get("z")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-065\\b'
+    message: |-
+      RunSec Detection [FR-065]: const z = 10;
+      // use fixed design token values, never user input
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-066
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        UI can be visually hidden/replaced to trick user actions.
+    pattern-either:
+      - pattern: |-
+          setOpacity(Number(event.data.opacity))
+      - pattern-regex: 'Vulnerable:\\s*FR\\-066\\b'
+    message: |-
+      RunSec Detection [FR-066]: ASVS V14.3, CWE-451
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-067
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        ASVS V14.3, CWE-451
+      fix_template: |-
+        TypeScript/React
+    pattern-either:
+      - pattern: |-
+          style={{ pointerEvents: search.get("pe")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-067\\b'
+    message: |-
+      RunSec Detection [FR-067]: style={{ pointerEvents: "none" }}
+      // interactive overlays require signed trusted config
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-068
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        URL tokens leak to history, logs, and referrers.
+    pattern-either:
+      - pattern: |-
+          setSearchParams({ token })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-068\\b'
+    message: |-
+      RunSec Detection [FR-068]: ASVS V14.2, CWE-522
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-069
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Credentials exposed in browser/session artifacts.
+    pattern-either:
+      - pattern: |-
+          history.push("/callback?access_token=" + token)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-069\\b'
+    message: |-
+      RunSec Detection [FR-069]: ASVS V14.2, CWE-312
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-070
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Secret in URL path appears in telemetry and reverse proxies.
+    pattern-either:
+      - pattern: |-
+          navigate("/reset/" + resetToken)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-070\\b'
+    message: |-
+      RunSec Detection [FR-070]: ASVS V14.2, CWE-522
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-071
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Internal stack/details disclosed to untrusted clients.
+    pattern-either:
+      - pattern: |-
+          <pre>{JSON.stringify(error)}</pre>
+      - pattern-regex: 'Vulnerable:\\s*FR\\-071\\b'
+    message: |-
+      RunSec Detection [FR-071]: ASVS V14.3, CWE-209
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-072
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Backend exception content may contain sensitive internals/XSS payload.
+    pattern-either:
+      - pattern: |-
+          <div dangerouslySetInnerHTML={{ __html: err.message }} />
+      - pattern-regex: 'Vulnerable:\\s*FR\\-072\\b'
+    message: |-
+      RunSec Detection [FR-072]: ASVS V14.3, CWE-209
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-073
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Response diagnostics reveal internal service topology/data.
+    pattern-either:
+      - pattern: |-
+          toast.error(JSON.stringify(error.response?.data))
+      - pattern-regex: 'Vulnerable:\\s*FR\\-073\\b'
+    message: |-
+      RunSec Detection [FR-073]: ASVS V14.3, CWE-209
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-074
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Client-visible stack traces expose implementation details.
+    pattern-either:
+      - pattern: |-
+          return <code>{error.stack}</code>
+      - pattern-regex: 'Vulnerable:\\s*FR\\-074\\b'
+    message: |-
+      RunSec Detection [FR-074]: ASVS V14.3, CWE-209
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-075
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        CWE-441
+      fix_template: |-
+        TypeScript/React
+    pattern-either:
+      - pattern: |-
+          const api = axios.create({ baseURL: searchParams.get("api")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-075\\b'
+    message: |-
+      RunSec Detection [FR-075]: const api = axios.create({ baseURL: allowlistedApiBase(searchParams.get("api")) })
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-076
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Browser context makes authenticated calls to attacker-influenced origin.
+    pattern-either:
+      - pattern: |-
+          fetch(new URL("/v1/pay", location.href).toString())
+      - pattern-regex: 'Vulnerable:\\s*FR\\-076\\b'
+    message: |-
+      RunSec Detection [FR-076]: CWE-441
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-077
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Frontend proxy utility becomes SSRF-like confused deputy.
+    pattern-either:
+      - pattern: |-
+          const u = search.get("url"); return fetch(u!)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-077\\b'
+    message: |-
+      RunSec Detection [FR-077]: CWE-441
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-078
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        CWE-441
+      fix_template: |-
+        TypeScript/React
+    pattern-either:
+      - pattern: |-
+          cfg.baseURL = search.get("host")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-078\\b'
+    message: |-
+      RunSec Detection [FR-078]: cfg.baseURL = enforceTrustedHost(cfg.baseURL)
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-079
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        CWE-441
+      fix_template: |-
+        TypeScript/React
+    pattern-either:
+      - pattern: |-
+          fetch(search.get("endpoint")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-079\\b'
+    message: |-
+      RunSec Detection [FR-079]: const ep = requireHttpHttpsAllowlist(search.get("endpoint")); fetch(ep)
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-080
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Embedded/malicious host origin hijacks API destination.
+    pattern-either:
+      - pattern: |-
+          axios.create({ baseURL: window.location.origin })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-080\\b'
+    message: |-
+      RunSec Detection [FR-080]: CWE-441
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-081
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Poisoned local storage redirects privileged requests externally.
+    pattern-either:
+      - pattern: |-
+          const host = localStorage.getItem("api_host"); fetch(host + "/txn")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-081\\b'
+    message: |-
+      RunSec Detection [FR-081]: CWE-441
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-082
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Hash-controlled endpoint bypasses route guard assumptions.
+    pattern-either:
+      - pattern: |-
+          const ep = new URLSearchParams(location.hash.slice(1)).get("api"); axios.create({ baseURL: ep! })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-082\\b'
+    message: |-
+      RunSec Detection [FR-082]: CWE-441
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-083
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Internal helper can be abused for cross-origin authenticated calls.
+    pattern-either:
+      - pattern: |-
+          export const post = (u,b) => fetch(u,{method:"POST",body:b,credentials:"include"})
+      - pattern-regex: 'Vulnerable:\\s*FR\\-083\\b'
+    message: |-
+      RunSec Detection [FR-083]: CWE-441
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-084
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Untrusted routing data drives sensitive backend action path.
+    pattern-either:
+      - pattern: |-
+          const api = "/upload/" + params.get("target"); await fetch(api,{method:"POST"})
+      - pattern-regex: 'Vulnerable:\\s*FR\\-084\\b'
+    message: |-
+      RunSec Detection [FR-084]: CWE-441
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-085
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Parsed payload injects prototype keys into app state tree.
+    pattern-either:
+      - pattern: |-
+          return Object.assign({}, state, JSON.parse(action.payload))
+      - pattern-regex: 'Vulnerable:\\s*FR\\-085\\b'
+    message: |-
+      RunSec Detection [FR-085]: CWE-1321
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-086
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Repeated spread merges allow hidden key smuggling.
+    pattern-either:
+      - pattern: |-
+          for (const p of updates) s = { ...s, ...p }
+      - pattern-regex: 'Vulnerable:\\s*FR\\-086\\b'
+    message: |-
+      RunSec Detection [FR-086]: CWE-1321
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-087
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Recursive merge mutates inherited object behavior.
+    pattern-either:
+      - pattern: |-
+          out[k] = typeof v==="object" ? merge(out[k], v) : v
+      - pattern-regex: 'Vulnerable:\\s*FR\\-087\\b'
+    message: |-
+      RunSec Detection [FR-087]: CWE-1321
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-088
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Runtime state setter receives attacker-crafted prototype fields.
+    pattern-either:
+      - pattern: |-
+          set(JSON.parse(raw))
+      - pattern-regex: 'Vulnerable:\\s*FR\\-088\\b'
+    message: |-
+      RunSec Detection [FR-088]: CWE-1321
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-089
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Utility merge imports prototype chain keys by default.
+    pattern-either:
+      - pattern: |-
+          return _.merge({}, state, action.payload)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-089\\b'
+    message: |-
+      RunSec Detection [FR-089]: CWE-1321
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-090
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        User path can target constructor/prototype internals.
+    pattern-either:
+      - pattern: |-
+          setByPath(obj, pathFromUI, value)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-090\\b'
+    message: |-
+      RunSec Detection [FR-090]: CWE-1321
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-091
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Polluted theme object alters renderer/security controls.
+    pattern-either:
+      - pattern: |-
+          globalTheme = { ...globalTheme, ...JSON.parse(themeRaw) }
+      - pattern-regex: 'Vulnerable:\\s*FR\\-091\\b'
+    message: |-
+      RunSec Detection [FR-091]: CWE-1321
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-092
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Cache poisoning modifies form/control object prototypes.
+    pattern-either:
+      - pattern: |-
+          draft = { ...draft, ...JSON.parse(cache) }
+      - pattern-regex: 'Vulnerable:\\s*FR\\-092\\b'
+    message: |-
+      RunSec Detection [FR-092]: CWE-1321
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-093
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        for...in includes inherited keys and prototype gadgets.
+    pattern-either:
+      - pattern: |-
+          for (const k in payload) target[k] = payload[k]
+      - pattern-regex: 'Vulnerable:\\s*FR\\-093\\b'
+    message: |-
+      RunSec Detection [FR-093]: CWE-1321
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-094
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Untrusted response can poison context state globally.
+    pattern-either:
+      - pattern: |-
+          setCtx(prev => ({ ...prev, ...resp.data }))
+      - pattern-regex: 'Vulnerable:\\s*FR\\-094\\b'
+    message: |-
+      RunSec Detection [FR-094]: CWE-1321
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-095
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        User-controlled style interpolation enables CSS exfiltration tricks.
+    pattern-either:
+      - pattern: |-
+          "const Box = styled.div${p => p.userCss};"
+      - pattern-regex: 'Vulnerable:\\s*FR\\-095\\b'
+    message: |-
+      RunSec Detection [FR-095]: CWE-94
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-096
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        CSS URL sink may leak tokens via external resource loads.
+    pattern-either:
+      - pattern: |-
+          "background: url(${p => p.avatar});"
+      - pattern-regex: 'Vulnerable:\\s*FR\\-096\\b'
+    message: |-
+      RunSec Detection [FR-096]: CWE-94
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-097
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Arbitrary CSS template content reaches runtime style engine.
+    pattern-either:
+      - pattern: |-
+          "const cls = css${userStyle};"
+      - pattern-regex: 'Vulnerable:\\s*FR\\-097\\b'
+    message: |-
+      RunSec Detection [FR-097]: CWE-94
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-098
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Query-controlled style object can spoof/overlay trusted UI.
+    pattern-either:
+      - pattern: |-
+          const s = JSON.parse(search.get("style")!); <div style={s} />
+      - pattern-regex: 'Vulnerable:\\s*FR\\-098\\b'
+    message: |-
+      RunSec Detection [FR-098]: CWE-94
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-099
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        User template execution reaches unsafe runtime compiler path.
+    pattern-either:
+      - pattern: |-
+          const html = compileTemplate(userTpl)(data)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-099\\b'
+    message: |-
+      RunSec Detection [FR-099]: CWE-94
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-100
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Secrets reflected into CSS can be extracted via side channels.
+    pattern-either:
+      - pattern: |-
+          "const Box = styled.div${p => content:'${p.secret}'};"
+      - pattern-regex: 'Vulnerable:\\s*FR\\-100\\b'
+    message: |-
+      RunSec Detection [FR-100]: CWE-94
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-101
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Malicious animation CSS manipulates layout and overlays actions.
+    pattern-either:
+      - pattern: |-
+          const anim = keyframes${userFrames}
+      - pattern-regex: 'Vulnerable:\\s*FR\\-101\\b'
+    message: |-
+      RunSec Detection [FR-101]: CWE-94
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-102
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Error payload controls global CSS and spoofing behavior.
+    pattern-either:
+      - pattern: |-
+          <Global styles={css${apiError}} />
+      - pattern-regex: 'Vulnerable:\\s*FR\\-102\\b'
+    message: |-
+      RunSec Detection [FR-102]: CWE-94
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-103
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Referrer-controlled origin reroutes trusted API traffic.
+    pattern-either:
+      - pattern: |-
+          const api = axios.create({ baseURL: new URL(document.referrer).origin })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-103\\b'
+    message: |-
+      RunSec Detection [FR-103]: CWE-441
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-104
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Cross-window state contaminates privileged network endpoint.
+    pattern-either:
+      - pattern: |-
+          fetch(window.name + "/api/profile", { credentials: "include" })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-104\\b'
+    message: |-
+      RunSec Detection [FR-104]: CWE-441
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-105
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Protocol-relative host bypasses strict origin assumptions.
+    pattern-either:
+      - pattern: |-
+          api.get("//" + host + "/v1/data")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-105\\b'
+    message: |-
+      RunSec Detection [FR-105]: CWE-441
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-106
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        File metadata steers authenticated upload channel externally.
+    pattern-either:
+      - pattern: |-
+          client = axios.create({ baseURL: file.meta.endpoint })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-106\\b'
+    message: |-
+      RunSec Detection [FR-106]: CWE-441
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-107
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Navigation state can inject alternate backend for sensitive ops.
+    pattern-either:
+      - pattern: |-
+          new ApolloClient({ uri: location.state.apiUri })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-107\\b'
+    message: |-
+      RunSec Detection [FR-107]: CWE-441
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-108
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        SW becomes trusted deputy for attacker-provided endpoint.
+    pattern-either:
+      - pattern: |-
+          self.addEventListener("message", e => fetch(e.data.url))
+      - pattern-regex: 'Vulnerable:\\s*FR\\-108\\b'
+    message: |-
+      RunSec Detection [FR-108]: CWE-441
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-109
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Hostname confusion leaks auth refresh cookies/tokens.
+    pattern-either:
+      - pattern: |-
+          fetch(location.origin + "/oauth/refresh", { credentials: "include" })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-109\\b'
+    message: |-
+      RunSec Detection [FR-109]: CWE-441
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-110
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        JSON roundtrip does not remove dangerous object keys.
+    pattern-either:
+      - pattern: |-
+          state = { ...state, ...JSON.parse(JSON.stringify(payload)) }
+      - pattern-regex: 'Vulnerable:\\s*FR\\-110\\b'
+    message: |-
+      RunSec Detection [FR-110]: CWE-1321
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-111
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Patch paths can target prototype/constructor chain.
+    pattern-either:
+      - pattern: |-
+          applyPatch(state, resp.patch)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-111\\b'
+    message: |-
+      RunSec Detection [FR-111]: CWE-1321
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-112
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        URL params merged into state without key safeguards.
+    pattern-either:
+      - pattern: |-
+          const q = Object.fromEntries(searchParams); setState({ ...state, ...q })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-112\\b'
+    message: |-
+      RunSec Detection [FR-112]: CWE-1321
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-113
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Crafted field names poison object prototypes in form state.
+    pattern-either:
+      - pattern: |-
+          next[fieldName] = value
+      - pattern-regex: 'Vulnerable:\\s*FR\\-113\\b'
+    message: |-
+      RunSec Detection [FR-113]: CWE-1321
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-114
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Producer applies dangerous keys into proxied state tree.
+    pattern-either:
+      - pattern: |-
+          produce(state, d => { Object.assign(d, payload); })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-114\\b'
+    message: |-
+      RunSec Detection [FR-114]: CWE-1321
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-115
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        CSS import sink can exfiltrate or spoof UI assets.
+    pattern-either:
+      - pattern: |-
+          "const G = createGlobalStyle@import url(${p => p.fontUrl});;"
+      - pattern-regex: 'Vulnerable:\\s*FR\\-115\\b'
+    message: |-
+      RunSec Detection [FR-115]: CWE-94
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-116
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Direct style tag injection affects full page behavior.
+    pattern-either:
+      - pattern: |-
+          styleEl.textContent = userCss
+      - pattern-regex: 'Vulnerable:\\s*FR\\-116\\b'
+    message: |-
+      RunSec Detection [FR-116]: CWE-94
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-117
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Runtime compilation of untrusted templates executes attacker logic.
+    pattern-either:
+      - pattern: |-
+          const tpl = Handlebars.compile(resp.template)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-117\\b'
+    message: |-
+      RunSec Detection [FR-117]: CWE-94
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-118
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Arbitrary CSS rule injection enables UI spoofing/exfiltration.
+    pattern-either:
+      - pattern: |-
+          const cls = styleSheet.insertRule(apiCss)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-118\\b'
+    message: |-
+      RunSec Detection [FR-118]: CWE-94
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-119
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        User template string reaches executable component parser.
+    pattern-either:
+      - pattern: |-
+          const C = parseJsx(userTemplate); return <C />
+      - pattern-regex: 'Vulnerable:\\s*FR\\-119\\b'
+    message: |-
+      RunSec Detection [FR-119]: CWE-94
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-120
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Error path contaminates future trusted request routing.
+    pattern-either:
+      - pattern: |-
+          client = axios.create({ baseURL: new URL(error.config.url!).origin })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-120\\b'
+    message: |-
+      RunSec Detection [FR-120]: CWE-441
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-121
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Session cookie can be transmitted over insecure channel when attributes are weak.
+    pattern-either:
+      - pattern: |-
+          document.cookie = "session=" + token + "; Path=/; SameSite=Lax"
+      - pattern-regex: 'Vulnerable:\\s*FR\\-121\\b'
+    message: |-
+      RunSec Detection [FR-121]: CWE-614
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-122
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Cross-site request context may replay cookie in sensitive flows.
+    pattern-either:
+      - pattern: |-
+          document.cookie = "auth=" + token + "; Path=/; Secure"
+      - pattern-regex: 'Vulnerable:\\s*FR\\-122\\b'
+    message: |-
+      RunSec Detection [FR-122]: CWE-614
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-123
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Missing cookie flags reduce transport/session integrity guarantees.
+    pattern-either:
+      - pattern: |-
+          document.cookie = "refresh=" + refresh + "; Path=/api"
+      - pattern-regex: 'Vulnerable:\\s*FR\\-123\\b'
+    message: |-
+      RunSec Detection [FR-123]: CWE-614
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-124
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Central helper propagates insecure cookie defaults across application.
+    pattern-either:
+      - pattern: |-
+          setCookie(name, value, { path: "/" })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-124\\b'
+    message: |-
+      RunSec Detection [FR-124]: CWE-614
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-125
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Untrusted remote entry enables arbitrary microfrontend code execution.
+    pattern-either:
+      - pattern: |-
+          const remoteUrl = search.get("remote"); await import(/* webpackIgnore: true */ remoteUrl!)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-125\\b'
+    message: |-
+      RunSec Detection [FR-125]: CWE-1329
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-126
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Runtime-resolved host allows attacker-controlled remote module source.
+    pattern-either:
+      - pattern: |-
+          remotes: { shell: "shell@[window.remoteHost]/remoteEntry.js" }
+      - pattern-regex: 'Vulnerable:\\s*FR\\-126\\b'
+    message: |-
+      RunSec Detection [FR-126]: CWE-1329
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-127
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Location-influenced import path loads untrusted JavaScript bundles.
+    pattern-either:
+      - pattern: |-
+          await import(new URL(path, location.href).toString())
+      - pattern-regex: 'Vulnerable:\\s*FR\\-127\\b'
+    message: |-
+      RunSec Detection [FR-127]: CWE-1329
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-128
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Remote entry integrity not checked before execution.
+    pattern-either:
+      - pattern: |-
+          script.src = remoteEntry; document.head.appendChild(script)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-128\\b'
+    message: |-
+      RunSec Detection [FR-128]: CWE-1329
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-129
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Dependency override can inject incompatible or malicious runtime code.
+    pattern-either:
+      - pattern: |-
+          shared: { react: { singleton: false, eager: true } }
+      - pattern-regex: 'Vulnerable:\\s*FR\\-129\\b'
+    message: |-
+      RunSec Detection [FR-129]: CWE-1329
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-130
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Origin list poisoning results in unauthorized remote execution.
+    pattern-either:
+      - pattern: |-
+          for (const o of origins) remotes[o.name] = o.url
+      - pattern-regex: 'Vulnerable:\\s*FR\\-130\\b'
+    message: |-
+      RunSec Detection [FR-130]: CWE-1329
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-131
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        CDN path manipulation injects hostile module at runtime.
+    pattern-either:
+      - pattern: |-
+          await import("https://cdn.example.com/" + mod)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-131\\b'
+    message: |-
+      RunSec Detection [FR-131]: CWE-1329
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-132
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Chunk loading path can be redirected to attacker origin.
+    pattern-either:
+      - pattern: |-
+          __webpack_public_path__ = window.location.origin + "/assets/"
+      - pattern-regex: 'Vulnerable:\\s*FR\\-132\\b'
+    message: |-
+      RunSec Detection [FR-132]: CWE-1329
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-133
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Untrusted manifest controls loaded runtime modules.
+    pattern-either:
+      - pattern: |-
+          const manifest = await fetch(search.get("manifest")!).then(r => r.json())
+      - pattern-regex: 'Vulnerable:\\s*FR\\-133\\b'
+    message: |-
+      RunSec Detection [FR-133]: CWE-1329
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-134
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Missing signature checks enables plugin supply chain hijack.
+    pattern-either:
+      - pattern: |-
+          plugins.forEach(p => loadRemote(p.url))
+      - pattern-regex: 'Vulnerable:\\s*FR\\-134\\b'
+    message: |-
+      RunSec Detection [FR-134]: CWE-1329
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-135
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        User-controlled debug flag exposes internal privileged UI state.
+    pattern-either:
+      - pattern: |-
+          <AdminPanel debug={search.get("debug") === "1"} />
+      - pattern-regex: 'Vulnerable:\\s*FR\\-135\\b'
+    message: |-
+      RunSec Detection [FR-135]: CWE-489
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-136
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Console output leaks PII to browser logs/extensions.
+    pattern-either:
+      - pattern: |-
+          console.log("profile", profile)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-136\\b'
+    message: |-
+      RunSec Detection [FR-136]: CWE-489
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-137
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Global state exposure enables runtime tampering and data leakage.
+    pattern-either:
+      - pattern: |-
+          window.debugStore = store
+      - pattern-regex: 'Vulnerable:\\s*FR\\-137\\b'
+    message: |-
+      RunSec Detection [FR-137]: CWE-489
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-138
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Production users receive internal diagnostics and stack traces.
+    pattern-either:
+      - pattern: |-
+          <ErrorPanel debug={true} details={error.stack} />
+      - pattern-regex: 'Vulnerable:\\s*FR\\-138\\b'
+    message: |-
+      RunSec Detection [FR-138]: CWE-489
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-139
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Devtools exposure grants state inspection and manipulation surface.
+    pattern-either:
+      - pattern: |-
+          if (flags.devtools) attachReduxDevtools(store)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-139\\b'
+    message: |-
+      RunSec Detection [FR-139]: CWE-489
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-140
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Global debug payload exposes sensitive runtime artifacts.
+    pattern-either:
+      - pattern: |-
+          window.__DEBUG__ = { lastResponse: resp }
+      - pattern-regex: 'Vulnerable:\\s*FR\\-140\\b'
+    message: |-
+      RunSec Detection [FR-140]: CWE-489
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-141
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Debug artifacts increase reverse engineering and exploitability.
+    pattern-either:
+      - pattern: |-
+          window.enableSourceMaps = true
+      - pattern-regex: 'Vulnerable:\\s*FR\\-141\\b'
+    message: |-
+      RunSec Detection [FR-141]: CWE-489
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-142
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        URL-triggered debug mode leaks protected internals.
+    pattern-either:
+      - pattern: |-
+          if (search.get("trace") === "1") return renderRawState()
+      - pattern-regex: 'Vulnerable:\\s*FR\\-142\\b'
+    message: |-
+      RunSec Detection [FR-142]: CWE-489
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-143
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Debug export leaks auth/session details globally.
+    pattern-either:
+      - pattern: |-
+          window.authCtx = useContext(AuthContext)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-143\\b'
+    message: |-
+      RunSec Detection [FR-143]: CWE-489
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-144
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Residual debug logic remains reachable in production.
+    pattern-either:
+      - pattern: |-
+          const DEBUG = process.env.DEBUG === "true"
+      - pattern-regex: 'Vulnerable:\\s*FR\\-144\\b'
+    message: |-
+      RunSec Detection [FR-144]: CWE-489
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-145
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Unmaintained crypto package increases compromise risk.
+    pattern-either:
+      - pattern: |-
+          import insecureCrypto from "legacy-crypto-wrapper"
+      - pattern-regex: 'Vulnerable:\\s*FR\\-145\\b'
+    message: |-
+      RunSec Detection [FR-145]: CWE-1104
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-146
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Plugin-selected outdated libs introduce vulnerable code paths.
+    pattern-either:
+      - pattern: |-
+          const lib = await import(plugin.cryptoLib)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-146\\b'
+    message: |-
+      RunSec Detection [FR-146]: CWE-1104
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-147
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Predictable/abandoned token generator weakens auth workflows.
+    pattern-either:
+      - pattern: |-
+          import insecureId from "uuid-vulnerable"; const id = insecureId()
+      - pattern-regex: 'Vulnerable:\\s*FR\\-147\\b'
+    message: |-
+      RunSec Detection [FR-147]: CWE-1104
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-148
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Vulnerable dependencies enter production without policy enforcement.
+    pattern-either:
+      - pattern: |-
+          if (process.env.SKIP_AUDIT === "1") return true
+      - pattern-regex: 'Vulnerable:\\s*FR\\-148\\b'
+    message: |-
+      RunSec Detection [FR-148]: CWE-1104
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-149
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Deprecated dependency signals suppressed from build pipeline.
+    pattern-either:
+      - pattern: |-
+          npm config set loglevel silent
+      - pattern-regex: 'Vulnerable:\\s*FR\\-149\\b'
+    message: |-
+      RunSec Detection [FR-149]: CWE-1104
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-150
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Outdated auth SDK may contain known exploitable flaws.
+    pattern-either:
+      - pattern: |-
+          import authSdk from "old-auth-sdk"
+      - pattern-regex: 'Vulnerable:\\s*FR\\-150\\b'
+    message: |-
+      RunSec Detection [FR-150]: CWE-1104
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-151
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Unreviewed external package URL injects unsafe dependency runtime.
+    pattern-either:
+      - pattern: |-
+          loadScript(cfg.packageUrl)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-151\\b'
+    message: |-
+      RunSec Detection [FR-151]: CWE-1104
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-152
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Build may resolve insecure transitive versions unexpectedly.
+    pattern-either:
+      - pattern: |-
+          npm install --legacy-peer-deps
+      - pattern-regex: 'Vulnerable:\\s*FR\\-152\\b'
+    message: |-
+      RunSec Detection [FR-152]: CWE-1104
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-153
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Vulnerable transitive dependency remains unresolved in build graph.
+    pattern-either:
+      - pattern: |-
+          overrides: {}
+      - pattern-regex: 'Vulnerable:\\s*FR\\-153\\b'
+    message: |-
+      RunSec Detection [FR-153]: CWE-1104
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-154
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Known bypass in abandoned sanitizer allows XSS payloads.
+    pattern-either:
+      - pattern: |-
+          import sanitize from "legacy-sanitize"
+      - pattern-regex: 'Vulnerable:\\s*FR\\-154\\b'
+    message: |-
+      RunSec Detection [FR-154]: CWE-1104
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-155
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        "https://remote.example.com/remoteEntry.js"
+      fix_template: |-
+        N/A
+    pattern-either:
+      - pattern: |-
+          const remote = env.REMOTE
+      - pattern-regex: 'Vulnerable:\\s*FR\\-155\\b'
+    message: |-
+      RunSec Detection [FR-155]: const remote = env.REMOTE
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-156
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        User-controlled scope accesses unexpected global remote containers.
+    pattern-either:
+      - pattern: |-
+          const scope = search.get("scope"); window[scope!].get("./App")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-156\\b'
+    message: |-
+      RunSec Detection [FR-156]: CWE-1329
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-157
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Global module registry exposure aids runtime tampering.
+    pattern-either:
+      - pattern: |-
+          window.__MODULES__ = __webpack_modules__
+      - pattern-regex: 'Vulnerable:\\s*FR\\-157\\b'
+    message: |-
+      RunSec Detection [FR-157]: CWE-489
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-158
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Action logs can include tokens, PII, and secrets.
+    pattern-either:
+      - pattern: |-
+          console.log("action", action)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-158\\b'
+    message: |-
+      RunSec Detection [FR-158]: CWE-489
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-159
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Global error object reveals internals and runtime secrets.
+    pattern-either:
+      - pattern: |-
+          window.lastError = error
+      - pattern-regex: 'Vulnerable:\\s*FR\\-159\\b'
+    message: |-
+      RunSec Detection [FR-159]: CWE-489
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-160
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        User-accessible mock mode can bypass real security controls.
+    pattern-either:
+      - pattern: |-
+          if (search.get("mock") === "1") useMockApi()
+      - pattern-regex: 'Vulnerable:\\s*FR\\-160\\b'
+    message: |-
+      RunSec Detection [FR-160]: CWE-489
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-161
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Untrusted registry metadata drives risky dependency decisions.
+    pattern-either:
+      - pattern: |-
+          fetch(search.get("registry") + "/pkg/meta")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-161\\b'
+    message: |-
+      RunSec Detection [FR-161]: CWE-1104
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-162
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Unsigned updates allow supply chain takeover of plugin runtime.
+    pattern-either:
+      - pattern: |-
+          installPlugin(update.url)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-162\\b'
+    message: |-
+      RunSec Detection [FR-162]: CWE-1104
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-163
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Untrusted package name controls loaded runtime dependency.
+    pattern-either:
+      - pattern: |-
+          const mod = require(userPkg)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-163\\b'
+    message: |-
+      RunSec Detection [FR-163]: CWE-1329
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-164
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Production banner leaks CI/env internals and sensitive values.
+    pattern-either:
+      - pattern: |-
+          window.__BUILD_INFO__ = process.env
+      - pattern-regex: 'Vulnerable:\\s*FR\\-164\\b'
+    message: |-
+      RunSec Detection [FR-164]: CWE-489
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-165
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Untrusted lifecycle scripts execute during dependency installation.
+    pattern-either:
+      - pattern: |-
+          "postinstall": "node scripts/postinstall.js"
+      - pattern-regex: 'Vulnerable:\\s*FR\\-165\\b'
+    message: |-
+      RunSec Detection [FR-165]: CWE-1104
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-166
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Version mismatch permits unsafe runtime behavior and gadget injection.
+    pattern-either:
+      - pattern: |-
+          shared: { react: { requiredVersion: false } }
+      - pattern-regex: 'Vulnerable:\\s*FR\\-166\\b'
+    message: |-
+      RunSec Detection [FR-166]: CWE-1329
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-167
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Public debug API leaks sensitive runtime state to scripts/extensions.
+    pattern-either:
+      - pattern: |-
+          window.debugEnv = () => ({ token, profile, flags })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-167\\b'
+    message: |-
+      RunSec Detection [FR-167]: CWE-489
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-168
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Alias forces known-vulnerable package into final artifact.
+    pattern-either:
+      - pattern: |-
+          resolve.alias = { "crypto-lib": "crypto-lib-legacy" }
+      - pattern-regex: 'Vulnerable:\\s*FR\\-168\\b'
+    message: |-
+      RunSec Detection [FR-168]: CWE-1104
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-169
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Remote script executes with full app privileges and shared globals.
+    pattern-either:
+      - pattern: |-
+          sandbox: false
+      - pattern-regex: 'Vulnerable:\\s*FR\\-169\\b'
+    message: |-
+      RunSec Detection [FR-169]: CWE-1329
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-170
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Massive global state leak includes sensitive internals and tokens.
+    pattern-either:
+      - pattern: |-
+          telemetry.send({ state: window })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-170\\b'
+    message: |-
+      RunSec Detection [FR-170]: CWE-489
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-171
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Deprecated packages remain in auth/payment critical execution paths.
+    pattern-either:
+      - pattern: |-
+          "allowDeprecated": true
+      - pattern-regex: 'Vulnerable:\\s*FR\\-171\\b'
+    message: |-
+      RunSec Detection [FR-171]: CWE-1104
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-172
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Prefetch hint service controls executable module source.
+    pattern-either:
+      - pattern: |-
+          const hint = await fetch(search.get("hint")!).then(r=>r.text()); import(hint)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-172\\b'
+    message: |-
+      RunSec Detection [FR-172]: CWE-1329
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-173
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Internal debugging UI reachable in production surface.
+    pattern-either:
+      - pattern: |-
+          {showDebug && <InternalDebugConsole />}
+      - pattern-regex: 'Vulnerable:\\s*FR\\-173\\b'
+    message: |-
+      RunSec Detection [FR-173]: CWE-489
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-174
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Broad semver range may pull vulnerable transitive release.
+    pattern-either:
+      - pattern: |-
+          "secure-client-crypto": "^1.0.0"
+      - pattern-regex: 'Vulnerable:\\s*FR\\-174\\b'
+    message: |-
+      RunSec Detection [FR-174]: CWE-1104
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-175
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Message can be delivered to untrusted window contexts.
+    pattern-either:
+      - pattern: |-
+          window.postMessage(payload, "*")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-175\\b'
+    message: |-
+      RunSec Detection [FR-175]: CWE-346
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-176
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Sensitive data sent to unknown parent/origin.
+    pattern-either:
+      - pattern: |-
+          window.opener?.postMessage(tokenRef, "*")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-176\\b'
+    message: |-
+      RunSec Detection [FR-176]: CWE-346
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-177
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Any origin can inject control messages.
+    pattern-either:
+      - pattern: |-
+          window.addEventListener("message", e => handle(e.data))
+      - pattern-regex: 'Vulnerable:\\s*FR\\-177\\b'
+    message: |-
+      RunSec Detection [FR-177]: CWE-346
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-178
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Type check alone does not guarantee trusted sender.
+    pattern-either:
+      - pattern: |-
+          if (e.data?.type === "AUTH") setAuth(e.data.token)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-178\\b'
+    message: |-
+      RunSec Detection [FR-178]: CWE-346
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-179
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        URL parameter controls cross-origin message channel.
+    pattern-either:
+      - pattern: |-
+          target.postMessage(search.get("msg"), "*")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-179\\b'
+    message: |-
+      RunSec Detection [FR-179]: CWE-346
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-180
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        CWE-346
+      fix_template: |-
+        TypeScript/React
+    pattern-either:
+      - pattern: |-
+          new BroadcastChannel(search.get("ch")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-180\\b'
+    message: |-
+      RunSec Detection [FR-180]: new BroadcastChannel(allowlistedChannel(search.get("ch")))
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-181
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Command/control data can leak to attacker iframe.
+    pattern-either:
+      - pattern: |-
+          iframe.contentWindow?.postMessage(cmd, originFromUser)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-181\\b'
+    message: |-
+      RunSec Detection [FR-181]: CWE-346
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-182
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        CWE-346
+      fix_template: |-
+        TypeScript/React
+    pattern-either:
+      - pattern: |-
+          if (e.source === iframe.contentWindow) handle(e.data)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-182\\b'
+    message: |-
+      RunSec Detection [FR-182]: e.origin !== TRUSTED_IFRAME_ORIGIN) return; handle(e.data)
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-183
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Untrusted clients can invoke privileged SW actions.
+    pattern-either:
+      - pattern: |-
+          self.addEventListener("message", e => process(e.data))
+      - pattern-regex: 'Vulnerable:\\s*FR\\-183\\b'
+    message: |-
+      RunSec Detection [FR-183]: CWE-346
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-184
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Missing nonce binding enables message replay/spoof.
+    pattern-either:
+      - pattern: |-
+          popup.postMessage({ token }, TRUSTED_ORIGIN)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-184\\b'
+    message: |-
+      RunSec Detection [FR-184]: CWE-346
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-185
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Plaintext websocket allows interception and tampering.
+    pattern-either:
+      - pattern: |-
+          new WebSocket("ws://api.example.com/realtime")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-185\\b'
+    message: |-
+      RunSec Detection [FR-185]: CWE-319
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-186
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Mixed transport conversion downgrades confidentiality.
+    pattern-either:
+      - pattern: |-
+          const ws = apiBase.replace("http://","ws://")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-186\\b'
+    message: |-
+      RunSec Detection [FR-186]: CWE-319
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-187
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Browser mixed-content request exposes sensitive data.
+    pattern-either:
+      - pattern: |-
+          fetch("http://api.example.com/v1/profile")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-187\\b'
+    message: |-
+      RunSec Detection [FR-187]: CWE-319
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-188
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Request credentials and payload traverse plaintext transport.
+    pattern-either:
+      - pattern: |-
+          axios.create({ baseURL: "http://api.internal" })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-188\\b'
+    message: |-
+      RunSec Detection [FR-188]: CWE-319
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-189
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Messaging session vulnerable to MitM and replay.
+    pattern-either:
+      - pattern: |-
+          new SockJS("http://api.example.com/stomp")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-189\\b'
+    message: |-
+      RunSec Detection [FR-189]: CWE-319
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-190
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        "https://api.example.com"
+      fix_template: |-
+        N/A
+    pattern-either:
+      - pattern: |-
+          const endpoint = env.API_URL
+      - pattern-regex: 'Vulnerable:\\s*FR\\-190\\b'
+    message: |-
+      RunSec Detection [FR-190]: const endpoint = env.API_URL
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-191
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        GraphQL queries/mutations exposed over plaintext channel.
+    pattern-either:
+      - pattern: |-
+          new ApolloClient({ uri: "http://api.example.com/graphql" })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-191\\b'
+    message: |-
+      RunSec Detection [FR-191]: CWE-319
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-192
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Helper forces insecure transport for sensitive requests.
+    pattern-either:
+      - pattern: |-
+          url.replace("https://", "http://")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-192\\b'
+    message: |-
+      RunSec Detection [FR-192]: CWE-319
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-193
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        SSE payload may leak in transit under network attacker.
+    pattern-either:
+      - pattern: |-
+          new EventSource("http://api.example.com/events")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-193\\b'
+    message: |-
+      RunSec Detection [FR-193]: CWE-319
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-194
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        gRPC-web metadata/payload sent over unencrypted channel.
+    pattern-either:
+      - pattern: |-
+          createGrpcClient("http://api.example.com")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-194\\b'
+    message: |-
+      RunSec Detection [FR-194]: CWE-319
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-195
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Weak hash enables collision/forgery in integrity checks.
+    pattern-either:
+      - pattern: |-
+          const digest = md5(value)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-195\\b'
+    message: |-
+      RunSec Detection [FR-195]: CWE-916
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-196
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        SHA1 no longer adequate for security-sensitive hashing.
+    pattern-either:
+      - pattern: |-
+          const sig = sha1(payload)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-196\\b'
+    message: |-
+      RunSec Detection [FR-196]: CWE-916
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-197
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Unsalted hashes vulnerable to rainbow/precomputation attacks.
+    pattern-either:
+      - pattern: |-
+          const h = sha256(password)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-197\\b'
+    message: |-
+      RunSec Detection [FR-197]: CWE-916
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-198
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Shared salt undermines hash hardening effectiveness.
+    pattern-either:
+      - pattern: |-
+          const salt = "global-salt"
+      - pattern-regex: 'Vulnerable:\\s*FR\\-198\\b'
+    message: |-
+      RunSec Detection [FR-198]: CWE-916
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-199
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        MD5 integrity marker can be forged via collisions.
+    pattern-either:
+      - pattern: |-
+          CryptoJS.MD5(sessionJson).toString()
+      - pattern-regex: 'Vulnerable:\\s*FR\\-199\\b'
+    message: |-
+      RunSec Detection [FR-199]: CWE-916
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-200
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Low iteration KDF allows faster brute-force attacks.
+    pattern-either:
+      - pattern: |-
+          pbkdf2(password, salt, 1000)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-200\\b'
+    message: |-
+      RunSec Detection [FR-200]: CWE-916
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-201
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Predictable entropy reduces resistance to guessing.
+    pattern-either:
+      - pattern: |-
+          const digest = sha256(value + Math.random())
+      - pattern-regex: 'Vulnerable:\\s*FR\\-201\\b'
+    message: |-
+      RunSec Detection [FR-201]: CWE-916
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-202
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Short digest truncation weakens collision resistance.
+    pattern-either:
+      - pattern: |-
+          const sig = sha256(data).slice(0, 8)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-202\\b'
+    message: |-
+      RunSec Detection [FR-202]: CWE-916
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-203
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Weak hash verifier allows offline cracking and bypass attempts.
+    pattern-either:
+      - pattern: |-
+          if (md5(input) === storedHash) allow()
+      - pattern-regex: 'Vulnerable:\\s*FR\\-203\\b'
+    message: |-
+      RunSec Detection [FR-203]: CWE-916
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-204
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        CWE-916
+      fix_template: |-
+        TypeScript/React
+    pattern-either:
+      - pattern: |-
+          const alg = search.get("alg")
+      - pattern-regex: 'Vulnerable:\\s*FR\\-204\\b'
+    message: |-
+      RunSec Detection [FR-204]: const alg = "sha256"; hashWith(alg, data)
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-205
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Detailed device fingerprint data exfiltrated externally.
+    pattern-either:
+      - pattern: |-
+          telemetry.send({ ua: navigator.userAgent })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-205\\b'
+    message: |-
+      RunSec Detection [FR-205]: CWE-359
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-206
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        High-entropy display attributes increase user re-identification.
+    pattern-either:
+      - pattern: |-
+          telemetry.send({ w: screen.width, h: screen.height, depth: screen.colorDepth })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-206\\b'
+    message: |-
+      RunSec Detection [FR-206]: CWE-359
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-207
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Combined locale signals contribute to unique fingerprint profile.
+    pattern-either:
+      - pattern: |-
+          send({ tz: Intl.DateTimeFormat().resolvedOptions().timeZone, lang: navigator.language })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-207\\b'
+    message: |-
+      RunSec Detection [FR-207]: CWE-359
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-208
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Battery characteristics create unstable but identifying fingerprint.
+    pattern-either:
+      - pattern: |-
+          navigator.getBattery().then(b => send({ level: b.level, charging: b.charging }))
+      - pattern-regex: 'Vulnerable:\\s*FR\\-208\\b'
+    message: |-
+      RunSec Detection [FR-208]: CWE-359
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-209
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Canvas hash is high-entropy tracking identifier.
+    pattern-either:
+      - pattern: |-
+          const fp = canvasFingerprint(); send({ fp })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-209\\b'
+    message: |-
+      RunSec Detection [FR-209]: CWE-359
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-210
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        GPU details materially increase tracking uniqueness.
+    pattern-either:
+      - pattern: |-
+          send({ glVendor, glRenderer })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-210\\b'
+    message: |-
+      RunSec Detection [FR-210]: CWE-359
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-211
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Font probing reveals highly identifying client profile.
+    pattern-either:
+      - pattern: |-
+          send({ fonts: detectedFonts })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-211\\b'
+    message: |-
+      RunSec Detection [FR-211]: CWE-359
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-212
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Plugin inventory contributes to persistent fingerprinting.
+    pattern-either:
+      - pattern: |-
+          send({ plugins: navigator.plugins, mimes: navigator.mimeTypes })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-212\\b'
+    message: |-
+      RunSec Detection [FR-212]: CWE-359
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-213
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Hardware traits used for cross-session re-identification.
+    pattern-either:
+      - pattern: |-
+          send({ hc: navigator.hardwareConcurrency, mem: navigator.deviceMemory })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-213\\b'
+    message: |-
+      RunSec Detection [FR-213]: CWE-359
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-214
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Network metrics can be combined into tracking signature.
+    pattern-either:
+      - pattern: |-
+          send({ downlink: conn.downlink, rtt: conn.rtt, type: conn.effectiveType })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-214\\b'
+    message: |-
+      RunSec Detection [FR-214]: CWE-359
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-215
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Wildcard allowlist nullifies origin-based trust model.
+    pattern-either:
+      - pattern: |-
+          if (allowed.includes("*")) handle(e.data)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-215\\b'
+    message: |-
+      RunSec Detection [FR-215]: CWE-346
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-216
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Trusted origin alone insufficient without payload contract checks.
+    pattern-either:
+      - pattern: |-
+          if (e.origin===TRUSTED) execute(e.data)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-216\\b'
+    message: |-
+      RunSec Detection [FR-216]: CWE-346
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-217
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Tokenized identifiers exposed in plaintext telemetry beacon.
+    pattern-either:
+      - pattern: |-
+          new Image().src = "http://metrics.example/collect?sid=" + sid
+      - pattern-regex: 'Vulnerable:\\s*FR\\-217\\b'
+    message: |-
+      RunSec Detection [FR-217]: CWE-319
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-218
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Reconnect path silently downgrades transport security.
+    pattern-either:
+      - pattern: |-
+          const wsUrl = secure ? "wss://api" : "ws://api"
+      - pattern-regex: 'Vulnerable:\\s*FR\\-218\\b'
+    message: |-
+      RunSec Detection [FR-218]: CWE-319
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-219
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        MD5 anti-tamper tag can be bypassed/collided.
+    pattern-either:
+      - pattern: |-
+          if (md5(raw) !== tag) throw
+      - pattern-regex: 'Vulnerable:\\s*FR\\-219\\b'
+    message: |-
+      RunSec Detection [FR-219]: CWE-916
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-220
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Shared constant salt weakens hash separation boundaries.
+    pattern-either:
+      - pattern: |-
+          const SALT = "prod-salt-v1"
+      - pattern-regex: 'Vulnerable:\\s*FR\\-220\\b'
+    message: |-
+      RunSec Detection [FR-220]: CWE-916
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-221
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Privacy-invasive fingerprint collection executed without consent.
+    pattern-either:
+      - pattern: |-
+          collectFingerprintAndSend()
+      - pattern-regex: 'Vulnerable:\\s*FR\\-221\\b'
+    message: |-
+      RunSec Detection [FR-221]: CWE-359
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-222
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        External SDK stores high-entropy user fingerprint bundle.
+    pattern-either:
+      - pattern: |-
+          sdk.track("fp", buildFingerprintBundle())
+      - pattern-regex: 'Vulnerable:\\s*FR\\-222\\b'
+    message: |-
+      RunSec Detection [FR-222]: CWE-359
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-223
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Multi-signal bundle significantly raises re-identification risk.
+    pattern-either:
+      - pattern: |-
+          send({ ua, battery, screen })
+      - pattern-regex: 'Vulnerable:\\s*FR\\-223\\b'
+    message: |-
+      RunSec Detection [FR-223]: CWE-359
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.frontend-react.fr-224
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Origin reflection can amplify malicious cross-window channels.
+    pattern-either:
+      - pattern: |-
+          event.source?.postMessage(resp, event.origin)
+      - pattern-regex: 'Vulnerable:\\s*FR\\-224\\b'
+    message: |-
+      RunSec Detection [FR-224]: CWE-346
+    languages:
+      - generic
+    severity: WARNING