@runsec/mcp 1.0.35 → 1.0.37

package/dist/data/skills/observability/patterns.md

@@ -0,0 +1,22 @@
+| ID | Название метрики | Anti-Pattern (Vulnerable Code/YAML) | Safe-Pattern (Remediation) | Stack | Источник  fix_template | Exploit scenario |
+|---|---|---|---|---|---|---|
+| LOG-001 | Silent Exception: `except Exception: pass` | `try:`<br>`    await repo.save(event)`<br>`except Exception:`<br>`    pass` | `try:`<br>`    await repo.save(event)`<br>`except Exception:`<br>`    logger.exception("audit-save-failed", extra={"event_type": event.type})`<br>`    raise` | Observability | `OWASP Top 10 (2021) A09 Security Logging and Monitoring Failures; OWASP ASVS v4.0.3 V7 Error Handling and Logging` | `try:` `    await repo.save(event)` `except Exception:` `    logger.exception("audit-save-failed", extra={"event_type": event.type})` `    raise` | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: log-001 silent exception except pass try await repo save event logger audit failed extra type raise -->
+| LOG-002 | Missing Trace-ID в логах запроса | `logger.info("request accepted")` | `trace_id = request.headers.get("x-trace-id") or str(uuid4())`<br>`logger.info("request accepted", extra={"trace_id": trace_id, "path": request.url.path})`<br>`response.headers["X-Trace-ID"] = trace_id` | Observability | `OWASP Top 10 (2021) A09 Security Logging and Monitoring Failures; OWASP ASVS v4.0.3 V7` | `trace_id = request.headers.get("x-trace-id") or str(uuid4())` `logger.info("request accepted", extra={"trace_id": trace_id, "path": request.url.path})` `response.headers["X-Trace-ID"] = trace_id` | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: log-002 missing trace id в логах запроса logger info request accepted headers get x str uuid4 extra path url response -->
+| LOG-003 | Unstructured logs: текст без контекста безопасности | `logger.error(f"login failed for {username}")` | `logger.warning("auth_failed", extra={"trace_id": trace_id, "user": username, "ip": client_ip, "reason": "bad_credentials"})` | Observability | `OWASP API Security Top 10 (2023) API10 Unsafe Consumption of APIs; OWASP ASVS v4.0.3 V7` | `logger.warning("auth_failed", extra={"trace_id": trace_id, "user": username, "ip": client_ip, "reason": "bad_credentials"})` | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: log-003 unstructured logs текст без контекста безопасности logger error f login failed for username warning auth extra trace id user ip -->
+| LOG-004 | PII/secret leakage in logs | `logger.info("auth payload=%s", payload)`<br>`# payload may include password/token` | `safe = {"username": payload.get("username"), "mfa": payload.get("mfa")}`<br>`logger.info("auth payload sanitized", extra={"trace_id": trace_id, "payload": safe})` | Observability | `OWASP Top 10 (2021) A02 Cryptographic Failures; OWASP Top 10 (2021) A09` | `safe = {"username": payload.get("username"), "mfa": payload.get("mfa")}` `logger.info("auth payload sanitized", extra={"trace_id": trace_id, "payload": safe})` | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: log-004 pii secret leakage logs logger info auth payload s may include password token username get mfa sanitized extra trace id -->
+| LOG-005 | Verbose stack traces returned to API client | `except Exception as exc:`<br>`    raise HTTPException(status_code=500, detail=traceback.format_exc())` | `except Exception:`<br>`    logger.exception("unhandled error", extra={"trace_id": trace_id})`<br>`    raise HTTPException(status_code=500, detail="internal server error")` | Observability | `OWASP Top 10 (2021) A09 Security Logging and Monitoring Failures; OWASP API Security Top 10 (2023) API8 Security Misconfiguration` | `except Exception:` `    logger.exception("unhandled error", extra={"trace_id": trace_id})` `    raise HTTPException(status_code=500, detail="internal server error")` | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: log-005 verbose stack traces returned to api client except exception as exc raise httpexception status 500 detail traceback format logger unhandled -->
+| LOG-006 | Missing audit events for role/permission changes | `@app.post("/admin/users/{uid}/role")`<br>`async def set_role(uid: int, role: str):`<br>`    await repo.set_role(uid, role)` | `@app.post("/admin/users/{uid}/role")`<br>`async def set_role(uid: int, role: str, actor=Depends(current_user)):`<br>`    await repo.set_role(uid, role)`<br>`    await audit_log.write({"event": "role_change", "actor_id": actor.id, "target_user_id": uid, "new_role": role, "trace_id": trace_id})` | Observability | `OWASP Top 10 (2021) A09; OWASP ASVS v4.0.3 V7 Logging` | `@app.post("/admin/users/{uid}/role")` `async def set_role(uid: int, role: str, actor=Depends(current_user)):` `    await repo.set_role(uid, role)` `    await audit_log.write({"event": "role_change", "actor_id": actor.id, "target_user_id": uid, "new_role": role, "trace_id": trace_id})` | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: log-006 missing audit events for role permission changes app post admin users uid async def set int str await repo actor -->
+| LOG-007 | Missing failed-auth telemetry and lockout signals | `if not auth_ok:`<br>`    raise HTTPException(status_code=401, detail="invalid credentials")` | `if not auth_ok:`<br>`    await audit_log.write({"event": "auth_failed", "username": username, "ip": client_ip, "trace_id": trace_id})`<br>`    await risk_counter.bump(f"auth:{username}:{client_ip}")`<br>`    raise HTTPException(status_code=401, detail="invalid credentials")` | Observability | `OWASP Top 10 (2021) A07 Identification and Authentication Failures; OWASP Top 10 (2021) A09` | `if not auth_ok:` `    await audit_log.write({"event": "auth_failed", "username": username, "ip": client_ip, "trace_id": trace_id})` `    await risk_counter.bump(f"auth:{username}:{client_ip}")` `    raise HTTPException(status_code=401, detail="invalid credentials")` | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: log-007 missing failed auth telemetry lockout signals if not ok raise httpexception status 401 detail invalid credentials await audit log write -->
+| LOG-008 | No request/response latency telemetry | `@app.middleware("http")`<br>`async def m(request, call_next):`<br>`    return await call_next(request)` | `@app.middleware("http")`<br>`async def m(request: Request, call_next):`<br>`    started = time.perf_counter()`<br>`    response = await call_next(request)`<br>`    elapsed_ms = (time.perf_counter() - started) * 1000`<br>`    logger.info("http_access", extra={"trace_id": request.state.trace_id, "path": request.url.path, "status": response.status_code, "latency_ms": round(elapsed_ms, 2)})`<br>`    return response` | Observability | `OWASP Top 10 (2021) A09 Security Logging and Monitoring Failures` | `@app.middleware("http")` `async def m(request: Request, call_next):` `    started = time.perf_counter()` `    response = await call_next(request)` `    elapsed_ms = (time.perf_counter() - started) * 1000` `    logger.info("http_access", extra={"trace_id": request.state.trace_id, "path": request.url.path, "status": response.status_code, "latency_ms": round(elapsed_ms, 2)})` `    return response` | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: log-008 no request response latency telemetry app middleware http async def m call next return await started time perf counter elapsed -->
+| LOG-009 | Logs without integrity controls/immutability for security events | `await audit_log.write({"event": "payment_approved", "id": pid})` | `record = {"event": "payment_approved", "id": pid, "trace_id": trace_id, "ts": datetime.now(timezone.utc).isoformat()}`<br>`record["sig"] = hmac_sha256(audit_signing_key, json.dumps(record, sort_keys=True))`<br>`await append_only_audit_store.write(record)` | Observability | `OWASP ASVS v4.0.3 V10 Malicious Code and Business Logic; OWASP Top 10 (2021) A09` | `record = {"event": "payment_approved", "id": pid, "trace_id": trace_id, "ts": datetime.now(timezone.utc).isoformat()}` `record["sig"] = hmac_sha256(audit_signing_key, json.dumps(record, sort_keys=True))` `await append_only_audit_store.write(record)` | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: log-009 logs without integrity controls immutability for security events await audit log write event payment approved id pid record trace ts -->
+| LOG-010 | No centralized exception handler for sanitization and correlation | `@app.get("/x")`<br>`async def x():`<br>`    raise RuntimeError("db password is wrong: secret=...")` | `@app.exception_handler(Exception)`<br>`async def handle_exc(request: Request, exc: Exception):`<br>`    trace_id = getattr(request.state, "trace_id", "n/a")`<br>`    logger.exception("unhandled", extra={"trace_id": trace_id, "path": request.url.path})`<br>`    return JSONResponse(status_code=500, content={"detail": "internal server error", "trace_id": trace_id})` | Observability | `OWASP Top 10 (2021) A09; OWASP ASVS v4.0.3 V7 Error Handling` | `@app.exception_handler(Exception)` `async def handle_exc(request: Request, exc: Exception):` `    trace_id = getattr(request.state, "trace_id", "n/a")` `    logger.exception("unhandled", extra={"trace_id": trace_id, "path": request.url.path})` `    return JSONResponse(status_code=500, content={"detail": "internal server error", "trace_id": trace_id})` | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: log-010 no centralized exception handler for sanitization correlation app get x async def raise runtimeerror db password is wrong secret handle -->
+| LOG-011 | Log Injection Protection: CR/LF из пользовательских данных попадают в лог | `@app.get("/search")`<br>`async def search(q: str):`<br>`    logger.info("search query=%s", q)`<br>`    return {"ok": True}` | `def sanitize_for_log(value: str) -> str:`<br>`    return value.replace("\\r", "\\\\r").replace("\\n", "\\\\n")`<br>`@app.get("/search")`<br>`async def search(q: str):`<br>`    safe_q = sanitize_for_log(q)`<br>`    logger.info("search query=%s", safe_q)`<br>`    return {"ok": True}` | Observability | `OWASP Top 10 (2021) A09 Security Logging and Monitoring Failures; OWASP ASVS v4.0.3 V8 Logging and Error Handling; CWE-117` | `def sanitize_for_log(value: str) -> str:` `    return value.replace("\\r", "\\\\r").replace("\\n", "\\\\n")` `@app.get("/search")` `async def search(q: str):` `    safe_q = sanitize_for_log(q)` `    logger.info("search query=%s", safe_q)` `    return {"ok": True}` | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: log-011 log injection protection cr lf из пользовательских данных попадают в лог app get search async def q str logger info -->
+| LOG-012 | Sensitive Data in Exception Context: логирование `locals()` в prod | `except Exception:`<br>`    logger.exception("failed", extra={"locals": locals()})`<br>`    raise` | `except Exception:`<br>`    logger.exception("failed", extra={"trace_id": trace_id, "context": {"operation": "payment_create"}})`<br>`    raise`<br>`# production logger must not capture locals or full frame dumps` | Observability | `OWASP Top 10 (2021) A09 Security Logging and Monitoring Failures; OWASP ASVS v4.0.3 V8 Logging and Error Handling` | `except Exception:` `    logger.exception("failed", extra={"trace_id": trace_id, "context": {"operation": "payment_create"}})` `    raise` `# production logger must not capture locals or full frame dumps` | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: log-012 sensitive data exception context логирование locals в prod except logger failed extra raise trace id operation payment create production must -->
+| LOG-013 | Missing Security Heartbeat: нет периодических контрольных событий мониторинга | `# no periodic liveness/integrity security event`<br>`pass` | `async def security_heartbeat_task() -> None:`<br>`    while True:`<br>`        await audit_log.write({"event": "security_heartbeat", "service": "api", "status": "ok", "ts": datetime.now(timezone.utc).isoformat()})`<br>`        await asyncio.sleep(60)`<br>`@app.on_event("startup")`<br>`async def start_heartbeat() -> None:`<br>`    asyncio.create_task(security_heartbeat_task())` | Observability | `OWASP Top 10 (2021) A09 Security Logging and Monitoring Failures; OWASP ASVS v4.0.3 V8 Logging and Error Handling` | `async def security_heartbeat_task() -> None:` `    while True:` `        await audit_log.write({"event": "security_heartbeat", "service": "api", "status": "ok", "ts": datetime.now(timezone.utc).isoformat()})` `        await asyncio.sleep(60)` `@app.on_event("startup")` `async def start_heartbeat() -> None:` `    asyncio.create_task(security_heartbeat_task())` | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: log-013 missing security heartbeat нет периодических контрольных событий мониторинга no periodic liveness integrity event pass async def task none while true -->
+| LOG-014 | High-Privilege Action Audit: админ-действия пишутся в обычный app log | `@app.post("/admin/users/{uid}/disable")`<br>`async def disable_user(uid: int):`<br>`    logger.info("disabled user %s", uid)` | `@app.post("/admin/users/{uid}/disable")`<br>`async def disable_user(uid: int, actor=Depends(current_user)):`<br>`    logger.info("admin action requested", extra={"trace_id": trace_id, "actor_id": actor.id})`<br>`    await security_audit_log.write({"event": "admin_user_disable", "actor_id": actor.id, "target_user_id": uid, "trace_id": trace_id, "ts": datetime.now(timezone.utc).isoformat()})` | Observability | `OWASP Top 10 (2021) A09 Security Logging and Monitoring Failures; OWASP ASVS v4.0.3 V8 Logging and Error Handling` | `@app.post("/admin/users/{uid}/disable")` `async def disable_user(uid: int, actor=Depends(current_user)):` `    logger.info("admin action requested", extra={"trace_id": trace_id, "actor_id": actor.id})` `    await security_audit_log.write({"event": "admin_user_disable", "actor_id": actor.id, "target_user_id": uid, "trace_id": trace_id, "ts": datetime.now(timezone.utc).isoformat()})` | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: log-014 high privilege action audit админ действия пишутся в обычный app log post admin users uid disable async def user int -->
+| LOG-015 | Системный лог: пароль в plaintext (`syslog`/journald) (CWE-312) | `syslog.syslog(syslog.LOG_INFO, f"user_pass={password}")` | Никогда не писать пароли; только hash/id события и маскирование. | Observability | `CWE-312` | Structured logging + redaction filter для password fields. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: log-015 syslog syslog log info user pass password plaintext guardian -->
+| LOG-016 | Docker/k8s: `env` секреты в stdout контейнера (CWE-532) | `print(os.environ)` в startup лог | Не логировать env; использовать external secrets и mask в лог-драйверах. | Observability | `CWE-532` | Log scrubber sidecar; deny `print(environ)` in prod. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: log-016 print os environ docker stdout guardian -->
+| LOG-017 | Windows Event Log: токен в `EventLog.WriteEntry` (CWE-312) | `EventLog.WriteEntry("Auth", $"token={accessToken}")` | Redact tokens; использовать event IDs без секретов. | Observability | `CWE-312` | Token hash or presence flag only in EventLog. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: log-017 eventlog writeentry token accesstoken guardian -->
+| LOG-018 | `journalctl`/structured log с Bearer в поле message (CWE-532) | `logger.info({"Authorization": f"Bearer {tok}"})` | Заголовки Authorization никогда не логировать. | Observability | `CWE-532` | Redact `Authorization`/`Cookie` keys globally. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: log-018 logger info authorization bearer tok guardian -->
+| LOG-019 | OpenTelemetry span: пароль в attributes (CWE-532) | `span.set_attribute("user.password", pwd)` | Запретить sensitive attrs; allowlist span attribute keys. | Observability | `CWE-532` | OTel semantic conventions + scrubbing processor. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: log-019 span set attribute user password pwd guardian -->
+| LOG-020 | Избыточное логирование полного HTTP-тела ответа с PII (CWE-779) | `logger.debug("upstream=%s", response.text)` | Логировать только status/latency/correlation-id; маскировать тела. | Observability | `CWE-779` | Sampling + redaction; max body length 0 in prod logs. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: log-020 logger debug upstream response text cwe779 guardian -->

package/dist/data/skills/observability/skill.json

@@ -0,0 +1,26 @@
+{
+  "skill_id": "observability",
+  "name": "Observability & Audit Logging",
+  "activation_triggers": [
+    "log-structured-traceid",
+    "log-audit-siem",
+    "log-redaction-policy",
+    "log-injection-crlf",
+    "log-security-event"
+  ],
+  "relevant_extensions": [
+    ".py",
+    ".ts",
+    ".js",
+    ".yaml",
+    ".yml"
+  ],
+  "tools": [
+    "semgrep",
+    "syft",
+    "trufflehog"
+  ],
+  "rules_path": "core/skills/observability/patterns.md",
+  "few_shot_examples": "core/gold-standard-testbed/api_vulnerable.py",
+  "security_priority": 5
+}

package/dist/data/skills/php-security/patterns.md

@@ -0,0 +1,202 @@
+| ID | Название метрики | Anti-Pattern (Vulnerable Code/YAML) | Safe-Pattern (Remediation) | Stack | Источник  fix_template | Exploit scenario |
+|---|---|---|---|---|---|---|
+| PHPX-001 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-002 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-003 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-004 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-005 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-006 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-007 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-008 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-009 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-010 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-011 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-012 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-013 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-014 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-015 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-016 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-017 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-018 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-019 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-020 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-021 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-022 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-023 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-024 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-025 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-026 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-027 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-028 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-029 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-030 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-031 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-032 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-033 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-034 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-035 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-036 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-037 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-038 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-039 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-040 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-041 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-042 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-043 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-044 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-045 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-046 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-047 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-048 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-049 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-050 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-051 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-052 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-053 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-054 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-055 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-056 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-057 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-058 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-059 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-060 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-061 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-062 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-063 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-064 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-065 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-066 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-067 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-068 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-069 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-070 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-071 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-072 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-073 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-074 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-075 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-076 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-077 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-078 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-079 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-080 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-081 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-082 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-083 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-084 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-085 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-086 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-087 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-088 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-089 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-090 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-091 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-092 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-093 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-094 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-095 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-096 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-097 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-098 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-099 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-100 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-101 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-102 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-103 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-104 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-105 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-106 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-107 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-108 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-109 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-110 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-111 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-112 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-113 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-114 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-115 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-116 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-117 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-118 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-119 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-120 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-121 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-122 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-123 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-124 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-125 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-126 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-127 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-128 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-129 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-130 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-131 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-132 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-133 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-134 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-135 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-136 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-137 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-138 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-139 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-140 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-141 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-142 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-143 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-144 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-145 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-146 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-147 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-148 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-149 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-150 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-151 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-152 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-153 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-154 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-155 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-156 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-157 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-158 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-159 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-160 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-161 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-162 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-163 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-164 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-165 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-166 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-167 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-168 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-169 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-170 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-171 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-172 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-173 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-174 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-175 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-176 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-177 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-178 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-179 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-180 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-181 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-182 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-183 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-184 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-185 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-186 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-187 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-188 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-189 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-190 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-191 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-192 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-193 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-194 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |
+| PHPX-195 | Symfony Twig render with untrusted template source | `$twig->createTemplate($request->get('tpl'))->render($ctx);` | `$twig->render('safe/' . $name . '.html.twig', $ctx);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | User-controlled template source can execute server-side template payloads. |
+| PHPX-196 | Classic PHP unserialize on untrusted input | `$obj = unserialize($_POST['payload']);` | `$obj = json_decode($_POST['payload'], true, 512, JSON_THROW_ON_ERROR);` | PHP/Laravel/Symfony | CWE-502 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Deserialization gadgets may trigger arbitrary code paths during object hydration. |
+| PHPX-197 | Symfony Form directly maps privileged fields (Logic: strong) | `$form->submit($request->request->all());` | `$form->submit($request->request->only(['email','displayName']));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Over-posting maps attacker fields into protected entity properties. |
+| PHPX-198 | PHP eval on request expression | `$result = eval('return ' . $_GET['expr'] . ';');` | `$result = safe_math_eval($_GET['expr']);` | PHP/Laravel/Symfony | CWE-94 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Evaluating attacker-controlled expression can execute arbitrary PHP code. |
+| PHPX-199 | Laravel Eloquent raw SQL interpolation (Logic: strong) | `User::whereRaw("email = '$email'")->first();` | `User::where("email", $email)->first();` | PHP/Laravel/Symfony | CWE-89 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Raw SQL interpolation in Eloquent allows attacker-controlled SQL fragments. |
+| PHPX-200 | Laravel mass assignment with unguarded model (Logic: strong) | `User::create($request->all());` | `User::create($request->only(["email","display_name"]));` | PHP/Laravel/Symfony | CWE-915 | Autofix: replace dynamic unsafe construct with strict allowlist and framework-safe API. | Broad input binding enables privilege field overwrite in model attributes. |

package/dist/data/skills/ru-regulatory/index.md

@@ -0,0 +1,72 @@
+# RU Regulatory (152-FZ / КИИ)
+
+## Stack overview
+
+Russian regulatory controls for PII logging (152-FZ), data residency/anonymization before foreign AI APIs, GOST / certified crypto usage inside KII, and import substitution portability. Metrics are prefixed **`RRC`**.
+
+## Top threats
+
+- Logging PII to stdout or external log systems (`RRC-001`).
+- Sending PII to foreign APIs (OpenAI/Claude) without anonymization (`RRC-002`).
+- Non-certified / unsafe crypto libraries in the KII contour (`RRC-003`).
+- Hardcoded cloud metadata (e.g. AWS IMDS) hurting migration/import substitution (`RRC-004`).
+
+## Pattern catalog
+
+Complete Anti-Pattern / Safe-Pattern definitions live in [`patterns.md`](patterns.md). The table below is a **table of contents** by metric ID.
+
+| ID | Metric | Stack |
+|---|---|---|
+| `RRC-001` | 152-ФЗ: PII в stdout / внешние логи | Использовать редактирование/маскирование до логирования (например, `redact_email`, `redact_snils`), а также уровень логов без PII по умолчанию. |
+| `RRC-002` | Data Residency: ПДн в зарубежные API без обезличивания | Обезличить/агрегировать ПДн перед отправкой, отделить идентификаторы и payload, добавить контроль/аудит передачи данных. |
+| `RRC-003` | GOST: небезопасные/несертифицированные крипто-библиотеки | Использовать сертифицированные средства криптографии / GOST-совместимые библиотеки, соответствующие требованиям контура КИИ. |
+| `RRC-004` | Import Substitution: hardcoded cloud metadata | Уйти от hardcoded metadata: использовать абстракции конфигурации/переменные окружения и единый механизм discovery для целевого облака. |
+| `RRC-005` | Foreign DNS/NTP | Использовать российские или внутренние корпоративные DNS/NTP резолверы (например, `10.0.0.53`, `ntp.local`). |
+| `RRC-006` | Insecure External Repositories | В CI/CD разрешать только доверенные внутренние зеркала/репозитории артефактов (Nexus/Artifactory/internal registry). |
+| `RRC-007` | Information Leakage in Errors | Возвращать обобщенное сообщение пользователю; детали и stacktrace писать только во внутренние журналы. |
+| `RRC-008` | Missing Security Audit | Централизованно логировать неудачные входы, смену паролей и чувствительные события безопасности (SIEM/audit bus). |
+| `RRC-009` | Unsigned binary execution | Перед запуском проверять цифровую подпись/доверенную цепочку и хэш (особенно на критических узлах). |
+| `RRC-010` | Insecure Data Deletion | Перед удалением перезаписать файл нулями/случайными данными, затем удалить (`fsync` + `remove`) с учетом политики хранения. |
+| `RRC-011` | Banned Functions (Security Policy) | Использовать `subprocess.run([...], shell=False, check=True)` с фиксированным whitelist аргументов. |
+| `RRC-012` | Missing Config Integrity Check | Проверять SHA-256/HMAC целостность конфигурации при старте; при mismatch — fail closed и аудит-событие. |
+| `RRC-013` | ГОСТ 57580.1 / ЦБ: "мясные" учетки вместо УДИ/УДА токенов | Использовать токены УДИ/УДА (OIDC/OAuth2, client credentials, mTLS-bound tokens), запрет static user/pass в интеграциях и сервис-аккаунтах. |
+| `RRC-014` | ЦБ: Недостаточная аутентификация интеграций (нет токен-ротации) | Обязательная короткоживущая токен-модель, ротация, revoke/introspection, аудит выдачи и использования токенов. |
+| `RRC-015` | FAPI.SEC/PAOK: запрет Implicit Flow, обязательный Code+PKCE+mTLS | Использовать Authorization Code Flow + PKCE, а для межсервисного взаимодействия включать mTLS (client cert/key) и проверку FAPI-профиля. |
+| `RRC-016` | Docker Root: запуск контейнера от root | Явно создавать непривилегированного пользователя и переключаться на него (`RUN useradd -m appuser`, `USER appuser`). |
+| `RRC-017` | Vault/ESO: запрет hardcoded Secret, требование ExternalSecret | Использовать `kind: ExternalSecret` (ESO) + backend Vault; исключить plaintext секреты в Git/YAML. |
+| `RRC-018` | Tech Stack: запрет drop-технологий в новых сервисах | Для новых микросервисов использовать поддерживаемый стек (Python >= 3.10, без legacy PHP), фиксировать baseline в архитектурном стандарте. |
+| `RRC-019` | Клинкер/Keycloak: обязательный auth middleware для внутренних API | Все внутренние API должны проходить через middleware аутентификации Keycloak (`VerifyToken`/аналог), deny-by-default. |
+| `RRC-020` | Целостность КИИ: контрольные суммы исполняемых файлов и конфигов перед стартом | Перед запуском проверять SHA-256/ГОСТ-хэш исполняемого файла и критичных конфигов; при mismatch — fail closed и аудит-событие (Приказ 239). |
+| `RRC-021` | СЗИ-контроль: отсутствие проверки состояния AV/IDS в контуре | Перед запуском проверять наличие и работоспособность СЗИ (антивирус, IDS/IPS, EDR агент), логировать статус и блокировать старт при критическом отказе. |
+| `RRC-022` | SDL/ГОСТ Р 56939: результаты статанализа не фиксируются в логах сборки | Обязательная фиксация результатов SAST/SCA в артефактах CI (лог/отчет), подпись и хранение для аудита SDL по ГОСТ Р 56939. |
+| `RRC-023` | Key Rotation: отсутствует `rotation_period` в Vault/KMS политиках | Для криптографических ключей задать и контролировать `rotation_period`, автоматическую ротацию и журналировать события смены ключей. |
+| `RRC-024` | Anti-Overlay/Integrity: нет CSP и контроля целостности UI | Включить строгий CSP, SRI для внешних скриптов и проверки целостности DOM/critical forms для защиты ДБО от overlay/injection атак. |
+| `RRC-025` | Payment Control: неизменность реквизитов между create и sign не контролируется | Фиксировать hash реквизитов на этапе create и сравнивать перед sign/submit; при несовпадении — reject + audit event. |
+| `RRC-026` | Post-Quantum Readiness: отсутствует стратегия крипто-миграции | Вести инвентаризацию криптопримитивов, план гибридных схем и процедуру миграции ключей/сертификатов под PQ-ready профиль. |
+
+## Verification
+
+**Verification:** Check the gold testbed file(s) below for `Vulnerable: <ID>` markers (static Semgrep + `detection-matrix.md` ground truth).
+
+- [`gold-standard-testbed/ru_regulatory_vulnerable.py`](../gold-standard-testbed/ru_regulatory_vulnerable.py)
+
+After changing [`patterns.md`](patterns.md), run from the repo root:
+
+```bash
+python scripts/sync_semgrep.py
+```
+
+## Workflow: Recon → Scan → Verify
+
+### 1) Recon
+- Map entrypoints, data flows, and trust boundaries for this stack.
+- Identify which metrics in [`patterns.md`](patterns.md) apply to the code under review.
+
+### 2) Scan
+- Run Semgrep with `semgrep-rules/<skill>.yaml` (generated) and correlate with Anti-Patterns.
+- Eliminate findings that cannot bind to a metric row.
+
+### 3) Verify
+- Confirm markers or scanner hits for touched IDs in the gold testbed when adding metrics.
+- Emit findings as `Vulnerable: <PREFIX>-<NNN>` in written reviews.
+