@shiftleftpt/sbd-toe-mcp 0.15.0 → 0.16.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (39) hide show
  1. package/consumed-bundle.json +10 -11
  2. package/data/entities/proportionality.json +2 -2
  3. package/data/entities/sdlc_integration.json +2 -2
  4. package/data/publish/indexes/canonical_chunks.jsonl +4907 -4907
  5. package/data/publish/indexes/publication_manifest.json +1 -1
  6. package/data/publish/runtime/artifact_requirements.json +3 -0
  7. package/data/publish/runtime/artifacts.json +3 -0
  8. package/data/publish/runtime/assignments.json +7578 -1296
  9. package/data/publish/runtime/deterministic_manifest.json +5 -1
  10. package/data/publish/runtime/user_stories.json +2171 -780
  11. package/data/publish/runtime/v1/manual_threat_mitigation.jsonl +233 -233
  12. package/data/publish/runtime/v1/v1_manifest.json +5 -4
  13. package/data/reports/run_manifest.json +5 -5
  14. package/dist/index.js +12 -7
  15. package/dist/index.js.map +1 -1
  16. package/dist/serving/affordances.js +5 -5
  17. package/dist/serving/affordances.js.map +1 -1
  18. package/dist/tools/assess-implementation.d.ts +8 -1
  19. package/dist/tools/assess-implementation.js +24 -5
  20. package/dist/tools/assess-implementation.js.map +1 -1
  21. package/dist/tools/generate-sbd-toe-skill.js +15 -3
  22. package/dist/tools/generate-sbd-toe-skill.js.map +1 -1
  23. package/dist/tools/get-operating-model.js +6 -5
  24. package/dist/tools/get-operating-model.js.map +1 -1
  25. package/dist/tools/get-threat-landscape.d.ts +2 -0
  26. package/dist/tools/get-threat-landscape.js +3 -0
  27. package/dist/tools/get-threat-landscape.js.map +1 -1
  28. package/dist/tools/ontology-loader.d.ts +2 -0
  29. package/dist/tools/ontology-loader.js +1 -0
  30. package/dist/tools/ontology-loader.js.map +1 -1
  31. package/dist/tools/plan-repo-governance.d.ts +6 -0
  32. package/dist/tools/plan-repo-governance.js +17 -1
  33. package/dist/tools/plan-repo-governance.js.map +1 -1
  34. package/dist/tools/structured-tools.js +3 -1
  35. package/dist/tools/structured-tools.js.map +1 -1
  36. package/dist/version-info.d.ts +4 -1
  37. package/dist/version-info.js +13 -2
  38. package/dist/version-info.js.map +1 -1
  39. package/package.json +1 -1
package/data/publish/runtime/v1/manual_threat_mitigation.jsonl CHANGED
@@ -20,26 +20,26 @@
20
20
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-020", "manual_v2_entity_label": "Decisões de risco sem feedback do negócio", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
21
21
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:aceitacao-de-risco-invalida", "manual_v2_entity_label": "aceitação de risco inválida", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
22
22
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:alteracao-na-exposicao-dados-impacto-ou-forma-de-decisoes-e-validacoes", "manual_v2_entity_label": "alteração na exposição, dados, impacto ou forma de decisões e validações", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
23
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de aplicação de controlos mínimos", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-001"}
24
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Overengineering e fricção excessiva", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-002"}
25
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inconsistência entre projetos com mesmo risco", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-003"}
26
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança opcional em produtos low-risk", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-004"}
27
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mudanças críticas sem reclassificação", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-005"}
28
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Integração com APIs ou terceiros ignorada", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-006"}
29
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Deploy com risco alterado não revisto", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-007"}
30
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Versões diferentes com classificações divergentes", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-008"}
31
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aceitação informal de riscos críticos", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-009"}
32
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Impossibilidade de auditoria posterior", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-010"}
33
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco aceite por responsáveis inapropriados", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-011"}
34
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de explicabilidade regulatória", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-012"}
35
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Interfaces expostas mal avaliadas", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-013"}
36
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dados sensíveis não reconhecidos", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-014"}
37
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Assunção de ambientes seguros por defeito", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-015"}
38
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ignorar dependências críticas", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-016"}
39
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco residual nunca revisto", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-017"}
40
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de eventos de reavaliação planeados", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-018"}
41
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reclassificação dependente de exceções", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-019"}
42
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Decisões de risco sem feedback do negócio", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-020"}
23
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de aplicação de controlos mínimos", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-001"}
24
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Overengineering e fricção excessiva", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-002"}
25
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inconsistência entre projetos com mesmo risco", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-003"}
26
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança opcional em produtos low-risk", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-004"}
27
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mudanças críticas sem reclassificação", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-005"}
28
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Integração com APIs ou terceiros ignorada", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-006"}
29
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Deploy com risco alterado não revisto", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-007"}
30
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Versões diferentes com classificações divergentes", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-008"}
31
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aceitação informal de riscos críticos", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [{"antipattern_id": "sem:antipattern:aceitacao-de-risco-invalida", "confidence": 0.7, "derivation": "semantic_antipattern_threat_link", "label": "aceitação de risco inválida", "link_type": "exposes"}], "threat_category": "STRIDE", "threat_id": "MT-009"}
32
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Impossibilidade de auditoria posterior", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-010"}
33
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco aceite por responsáveis inapropriados", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-011"}
34
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de explicabilidade regulatória", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-012"}
35
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Interfaces expostas mal avaliadas", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-013"}
36
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dados sensíveis não reconhecidos", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-014"}
37
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Assunção de ambientes seguros por defeito", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-015"}
38
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ignorar dependências críticas", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-016"}
39
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco residual nunca revisto", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-017"}
40
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de eventos de reavaliação planeados", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-018"}
41
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reclassificação dependente de exceções", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-019"}
42
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Decisões de risco sem feedback do negócio", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [{"antipattern_id": "sem:antipattern:aceitacao-de-risco-invalida", "confidence": 0.76, "derivation": "semantic_antipattern_threat_link", "label": "aceitação de risco inválida", "link_type": "exposes"}], "threat_category": "STRIDE", "threat_id": "MT-020"}
43
43
  {"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`aceitacao-de-risco-invalida`", "`MT-009`", "0.70", "alias_match, bundle_grounding, risk_match"]}
44
44
  {"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`aceitacao-de-risco-invalida`", "`MT-020`", "0.76", "alias_match, bundle_grounding, how_it_arises_match"]}
45
45
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-021", "manual_v2_entity_label": "Ausência de requisitos de segurança", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -60,24 +60,24 @@
60
60
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-036", "manual_v2_entity_label": "Requisitos aplicados mas não testados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
61
61
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-037", "manual_v2_entity_label": "Mudanças de requisitos não propagadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
62
62
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-038", "manual_v2_entity_label": "Ambiguidade entre requisito e controlo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
63
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de requisitos de segurança", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-021"}
64
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Definição ambígua ou não testável", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-022"}
65
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos genéricos não específicos", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-023"}
66
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de requisitos em sistemas legados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-024"}
67
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos não alinhados com risco", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-025"}
68
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos definidos mas nunca verificados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-026"}
69
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validações inconsistentes entre projetos", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-027"}
70
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de rastreio entre requisito e teste", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-028"}
71
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos não verificados em CI/CD", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-029"}
72
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco aceite sem validação documental", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-030"}
73
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções a requisitos não documentadas", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-031"}
74
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança omitida por “não ser funcional”", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-032"}
75
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aceitação de exceções sem aprovação", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-033"}
76
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções não reverificadas no tempo", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-034"}
77
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Não saber se requisitos foram aplicados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-035"}
78
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos aplicados mas não testados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-036"}
79
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mudanças de requisitos não propagadas", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-037"}
80
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambiguidade entre requisito e controlo", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-038"}
63
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de requisitos de segurança", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-021"}
64
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Definição ambígua ou não testável", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-022"}
65
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos genéricos não específicos", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-023"}
66
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de requisitos em sistemas legados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-024"}
67
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos não alinhados com risco", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-025"}
68
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos definidos mas nunca verificados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-026"}
69
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validações inconsistentes entre projetos", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-027"}
70
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de rastreio entre requisito e teste", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-028"}
71
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos não verificados em CI/CD", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-029"}
72
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco aceite sem validação documental", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-030"}
73
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções a requisitos não documentadas", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-031"}
74
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança omitida por “não ser funcional”", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-032"}
75
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aceitação de exceções sem aprovação", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-033"}
76
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções não reverificadas no tempo", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-034"}
77
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Não saber se requisitos foram aplicados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-035"}
78
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos aplicados mas não testados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-036"}
79
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mudanças de requisitos não propagadas", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-037"}
80
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambiguidade entre requisito e controlo", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-038"}
81
81
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-039", "manual_v2_entity_label": "Ameaças desconhecidas e não tratadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
82
82
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-040", "manual_v2_entity_label": "Prioridades de segurança mal definidas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
83
83
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-041", "manual_v2_entity_label": "Requisitos definidos sem base em ameaças", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -96,22 +96,22 @@
96
96
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-054", "manual_v2_entity_label": "Ferramentas desconectadas do ciclo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
97
97
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:ausencia-de-ameaca-no-modelo", "manual_v2_entity_label": "Ausência de ameaça no modelo", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
98
98
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:omissao-estrutural-de-ameacas", "manual_v2_entity_label": "Omissão estrutural de ameaças", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
99
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças desconhecidas e não tratadas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-039"}
100
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Prioridades de segurança mal definidas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-040"}
101
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos definidos sem base em ameaças", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-041"}
102
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças a privacidade ignoradas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "LINDDUN", "threat_id": "MT-042"}
103
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de cobertura de ameaças não técnicas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-043"}
104
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura insegura não identificada", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-044"}
105
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validação superficial em design reviews", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-045"}
106
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Controles aplicados sem base em arquitetura", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-046"}
107
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de revisão em interfaces críticas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-047"}
108
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças descobertas demasiado tarde", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-048"}
109
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mudanças críticas sem nova modelação", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-049"}
110
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Descontinuidade entre equipas e fases", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-050"}
111
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças não visíveis na pipeline CI/CD", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-051"}
112
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Conhecimento de ameaças não acumulado", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-052"}
113
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inconsistência entre projetos e equipas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-053"}
114
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ferramentas desconectadas do ciclo", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-054"}
99
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças desconhecidas e não tratadas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-039"}
100
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Prioridades de segurança mal definidas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-040"}
101
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos definidos sem base em ameaças", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-041"}
102
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças a privacidade ignoradas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "LINDDUN", "threat_id": "MT-042"}
103
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de cobertura de ameaças não técnicas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-043"}
104
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura insegura não identificada", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-044"}
105
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validação superficial em design reviews", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-045"}
106
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Controles aplicados sem base em arquitetura", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-046"}
107
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de revisão em interfaces críticas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-047"}
108
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças descobertas demasiado tarde", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-048"}
109
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mudanças críticas sem nova modelação", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-049"}
110
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Descontinuidade entre equipas e fases", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-050"}
111
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças não visíveis na pipeline CI/CD", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-051"}
112
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Conhecimento de ameaças não acumulado", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-052"}
113
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inconsistência entre projetos e equipas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-053"}
114
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ferramentas desconectadas do ciclo", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-054"}
115
115
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-055", "manual_v2_entity_label": "Interfaces expostas sem isolamento", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
116
116
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-056", "manual_v2_entity_label": "Mistura de dados e controlo na mesma zona", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
117
117
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-057", "manual_v2_entity_label": "Acesso lateral não controlado entre módulos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -134,24 +134,24 @@
134
134
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:excecoes-nao-documentadas", "manual_v2_entity_label": "Exceções não documentadas", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
135
135
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:modelos-inconsistentes-incompletos-ou-desatualizados", "manual_v2_entity_label": "Modelos inconsistentes, incompletos ou desatualizados", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
136
136
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:threat-modeling-sem-arquitetura-clara", "manual_v2_entity_label": "Threat modeling sem arquitetura clara", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
137
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Interfaces expostas sem isolamento", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-055"}
138
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mistura de dados e controlo na mesma zona", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-056"}
139
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Acesso lateral não controlado entre módulos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-057"}
140
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de isolamento entre utilizadores", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-058"}
141
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura inexistente ou desatualizada", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-059"}
142
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Confusão sobre localização de controlos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-060"}
143
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambiguidade sobre fronteiras e zonas", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-061"}
144
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura não revê mecanismos de fallback", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-062"}
145
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura nunca revista", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-063"}
146
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alterações estruturais sem revalidação", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-064"}
147
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Design informal ou ad hoc", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-065"}
148
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções de arquitetura sem rasto", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-066"}
149
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos de arquitetura não definidos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-067"}
150
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Impossibilidade de mapear decisões a controlos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-068"}
151
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Diagrama não reflete controlos implementados", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-069"}
152
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aplicações L1 tratadas como críticas", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-070"}
153
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Sobredimensionamento de segurança da arquitetura", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-071"}
154
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes de execução não refletidos no design", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-072"}
137
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Interfaces expostas sem isolamento", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-055"}
138
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mistura de dados e controlo na mesma zona", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-056"}
139
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Acesso lateral não controlado entre módulos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-057"}
140
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de isolamento entre utilizadores", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-058"}
141
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura inexistente ou desatualizada", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-059"}
142
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Confusão sobre localização de controlos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-060"}
143
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambiguidade sobre fronteiras e zonas", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-061"}
144
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura não revê mecanismos de fallback", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-062"}
145
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura nunca revista", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-063"}
146
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alterações estruturais sem revalidação", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-064"}
147
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Design informal ou ad hoc", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-065"}
148
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções de arquitetura sem rasto", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-066"}
149
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos de arquitetura não definidos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-067"}
150
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Impossibilidade de mapear decisões a controlos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-068"}
151
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Diagrama não reflete controlos implementados", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-069"}
152
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aplicações L1 tratadas como críticas", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-070"}
153
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Sobredimensionamento de segurança da arquitetura", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-071"}
154
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes de execução não refletidos no design", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-072"}
155
155
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-073", "manual_v2_entity_label": "Inclusão de bibliotecas com CVEs ativos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
156
156
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-074", "manual_v2_entity_label": "Dependências desatualizadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
157
157
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-075", "manual_v2_entity_label": "Ausência de registo de versões", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -172,26 +172,26 @@
172
172
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-090", "manual_v2_entity_label": "Confusão de dependências", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
173
173
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-091", "manual_v2_entity_label": "Backdoor via ferramenta de build", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
174
174
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-092", "manual_v2_entity_label": "Drift de composição entre builds", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
175
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de bibliotecas com CVEs ativos", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-073"}
176
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dependências desatualizadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-074"}
177
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de registo de versões", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-075"}
178
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de bibliotecas não auditadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-076"}
179
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Desconhecimento de bibliotecas utilizadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-077"}
180
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de associação entre vulnerabilidade e artefacto", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-078"}
181
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de histórico de introdução de pacotes", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-079"}
182
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de pacotes de repositórios maliciosos", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-080"}
183
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dependência transitiva com componente inseguro", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-081"}
184
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Pipeline injeta versão não autenticada", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-082"}
185
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "CVEs ignoradas sem justificação", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-083"}
186
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mitigações aplicadas sem rastreio", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-084"}
187
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de ciclo de revisão de exceções", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-085"}
188
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso arbitrário de bibliotecas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-086"}
189
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Bibliotecas proibidas são usadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-087"}
190
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de política de substituição", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-088"}
191
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "SBOM boundary, revisão de dependências", "associated_controls_text": "SBOM boundary, revisão de dependências", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Introdução de dependência vulnerável não declarada", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-089"}
192
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "SCA, validação de origem", "associated_controls_text": "SCA, validação de origem", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Confusão de dependências", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-090"}
193
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Governance de tooling", "associated_controls_text": "Governance de tooling", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Backdoor via ferramenta de build", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-091"}
194
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Drift de composição entre builds", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-092"}
175
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de bibliotecas com CVEs ativos", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-073"}
176
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dependências desatualizadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-074"}
177
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de registo de versões", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-075"}
178
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de bibliotecas não auditadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-076"}
179
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Desconhecimento de bibliotecas utilizadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-077"}
180
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de associação entre vulnerabilidade e artefacto", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-078"}
181
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de histórico de introdução de pacotes", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-079"}
182
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de pacotes de repositórios maliciosos", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-080"}
183
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dependência transitiva com componente inseguro", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-081"}
184
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Pipeline injeta versão não autenticada", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-082"}
185
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "CVEs ignoradas sem justificação", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-083"}
186
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mitigações aplicadas sem rastreio", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-084"}
187
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de ciclo de revisão de exceções", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-085"}
188
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso arbitrário de bibliotecas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-086"}
189
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Bibliotecas proibidas são usadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-087"}
190
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de política de substituição", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-088"}
191
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "SBOM boundary, revisão de dependências", "associated_controls_text": "SBOM boundary, revisão de dependências", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Introdução de dependência vulnerável não declarada", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-089"}
192
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "SCA, validação de origem", "associated_controls_text": "SCA, validação de origem", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Confusão de dependências", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-090"}
193
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "Governance de tooling", "associated_controls_text": "Governance de tooling", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Backdoor via ferramenta de build", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-091"}
194
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Drift de composição entre builds", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-092"}
195
195
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-093", "manual_v2_entity_label": "Inclusão de padrões inseguros por hábito", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
196
196
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-094", "manual_v2_entity_label": "Uso de funções descontinuadas ou perigosas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
197
197
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-095", "manual_v2_entity_label": "Injeção de código sem escape adequado", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -210,24 +210,24 @@
210
210
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-108", "manual_v2_entity_label": "Inconsistência entre equipas e projetos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
211
211
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-109", "manual_v2_entity_label": "Inexistência de baseline de segurança", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
212
212
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-110", "manual_v2_entity_label": "Fraca responsabilização pela segurança do código", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
213
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de padrões inseguros por hábito", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-093"}
214
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de funções descontinuadas ou perigosas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-094"}
215
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Injeção de código sem escape adequado", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-095"}
216
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Código inseguro sem deteção", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-096"}
217
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de rastreabilidade entre problemas e decisões", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-097"}
218
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validação apenas reativa (ex: testes QA)", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-098"}
219
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança removida por “incompatibilidade”", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-099"}
220
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções não revistas ou revalidadas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-100"}
221
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Desvios não rastreados entre guideline e prática", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-101"}
222
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Geração de código inseguro via IA", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-102"}
223
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de vulnerabilidades conhecidas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-103"}
224
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de accountability sobre código gerado", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-104"}
225
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de bibliotecas descontinuadas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-105"}
226
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de justificação para uso de dependência insegura", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-106"}
227
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Componente vulnerável mantido no build final", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-107"}
228
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inconsistência entre equipas e projetos", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-108"}
229
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inexistência de baseline de segurança", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-109"}
230
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Fraca responsabilização pela segurança do código", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-110"}
213
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de padrões inseguros por hábito", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-093"}
214
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de funções descontinuadas ou perigosas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-094"}
215
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Injeção de código sem escape adequado", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-095"}
216
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Código inseguro sem deteção", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-096"}
217
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de rastreabilidade entre problemas e decisões", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-097"}
218
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validação apenas reativa (ex: testes QA)", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-098"}
219
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança removida por “incompatibilidade”", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-099"}
220
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções não revistas ou revalidadas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-100"}
221
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Desvios não rastreados entre guideline e prática", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-101"}
222
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Geração de código inseguro via IA", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-102"}
223
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de vulnerabilidades conhecidas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-103"}
224
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de accountability sobre código gerado", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-104"}
225
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de bibliotecas descontinuadas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-105"}
226
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de justificação para uso de dependência insegura", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-106"}
227
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Componente vulnerável mantido no build final", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-107"}
228
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inconsistência entre equipas e projetos", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-108"}
229
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inexistência de baseline de segurança", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-109"}
230
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Fraca responsabilização pela segurança do código", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-110"}
231
231
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-111", "manual_v2_entity_label": "Execução de código não autorizado em pipeline", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
232
232
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-112", "manual_v2_entity_label": "Comprometimento do ambiente de build", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
233
233
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-113", "manual_v2_entity_label": "Elevação de privilégios no pipeline", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -252,27 +252,27 @@
252
252
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:exposicao-excessiva-de-contexto-em-logs-e-artefactos", "manual_v2_entity_label": "exposição excessiva de contexto em logs e artefactos", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
253
253
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:uso-de-segredos-estaticos", "manual_v2_entity_label": "uso de segredos estáticos", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
254
254
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:sinal-automatico", "manual_v2_entity_label": "sinal automático", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
255
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Design seguro de pipelines; isolamento de runners", "associated_controls_text": "Design seguro de pipelines; isolamento de runners", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução de código não autorizado em pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-111"}
256
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Isolamento e efemeridade de runners", "associated_controls_text": "Isolamento e efemeridade de runners", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Comprometimento do ambiente de build", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-112"}
257
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Hardening de pipelines", "associated_controls_text": "Hardening de pipelines", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Elevação de privilégios no pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-113"}
258
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Gestão segura de código-fonte", "associated_controls_text": "Gestão segura de código-fonte", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Push não autorizado para branches protegidas", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-114"}
259
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Políticas de execução", "associated_controls_text": "Políticas de execução", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução de código não auditado", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-115"}
260
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Rastreabilidade e assinaturas", "associated_controls_text": "Rastreabilidade e assinaturas", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Substituição silenciosa de código legítimo", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-116"}
261
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Integridade e proveniência", "associated_controls_text": "Integridade e proveniência", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Build forjado fora da pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-117"}
262
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Segurança do código de pipeline", "associated_controls_text": "Segurança do código de pipeline", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Injeção de lógica dinâmica em pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-118"}
263
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Controlo de dependências", "associated_controls_text": "Controlo de dependências", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de componentes externos inseguros", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-119"}
264
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Gestão de segredos", "associated_controls_text": "Gestão de segredos", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Vazamento de segredos via logs", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-120"}
265
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Gestão de segredos", "associated_controls_text": "Gestão de segredos", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segredos hardcoded", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-121"}
266
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Lifecycle de segredos", "associated_controls_text": "Lifecycle de segredos", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reutilização de segredos", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-122"}
267
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Políticas de gates", "associated_controls_text": "Políticas de gates", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de gates de segurança", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-123"}
268
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Validações integradas", "associated_controls_text": "Validações integradas", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validações não executadas", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-124"}
269
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Rastreabilidade", "associated_controls_text": "Rastreabilidade", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de rastreabilidade", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-125"}
270
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Gestão de exceções", "associated_controls_text": "Gestão de exceções", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Bypass de controlos sem rasto", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-126"}
271
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Governação contínua", "associated_controls_text": "Governação contínua", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alterações críticas sem visibilidade", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-127"}
272
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Gates e governação", "associated_controls_text": "Gates e governação", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Promoções sem responsável humano", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-128"}
273
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Evidência empírica", "associated_controls_text": "Evidência empírica", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Evidência plausível sem execução", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-129"}
274
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Reprodutibilidade", "associated_controls_text": "Reprodutibilidade", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Não-determinismo do pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-130"}
275
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Controlo de integrações", "associated_controls_text": "Controlo de integrações", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exfiltração de contexto sensível", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-131"}
255
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Design seguro de pipelines; isolamento de runners", "associated_controls_text": "Design seguro de pipelines; isolamento de runners", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução de código não autorizado em pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-111"}
256
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Isolamento e efemeridade de runners", "associated_controls_text": "Isolamento e efemeridade de runners", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Comprometimento do ambiente de build", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-112"}
257
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Hardening de pipelines", "associated_controls_text": "Hardening de pipelines", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Elevação de privilégios no pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-113"}
258
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Gestão segura de código-fonte", "associated_controls_text": "Gestão segura de código-fonte", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Push não autorizado para branches protegidas", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-114"}
259
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Políticas de execução", "associated_controls_text": "Políticas de execução", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução de código não auditado", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-115"}
260
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Rastreabilidade e assinaturas", "associated_controls_text": "Rastreabilidade e assinaturas", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Substituição silenciosa de código legítimo", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-116"}
261
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Integridade e proveniência", "associated_controls_text": "Integridade e proveniência", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Build forjado fora da pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-117"}
262
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Segurança do código de pipeline", "associated_controls_text": "Segurança do código de pipeline", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Injeção de lógica dinâmica em pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-118"}
263
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Controlo de dependências", "associated_controls_text": "Controlo de dependências", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de componentes externos inseguros", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-119"}
264
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Gestão de segredos", "associated_controls_text": "Gestão de segredos", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Vazamento de segredos via logs", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-120"}
265
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Gestão de segredos", "associated_controls_text": "Gestão de segredos", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segredos hardcoded", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [{"antipattern_id": "sem:antipattern:uso-de-segredos-estaticos", "confidence": 0.76, "derivation": "semantic_antipattern_threat_link", "label": "uso de segredos estáticos", "link_type": "exposes"}], "threat_category": "STRIDE", "threat_id": "MT-121"}
266
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Lifecycle de segredos", "associated_controls_text": "Lifecycle de segredos", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reutilização de segredos", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-122"}
267
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Políticas de gates", "associated_controls_text": "Políticas de gates", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de gates de segurança", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-123"}
268
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Validações integradas", "associated_controls_text": "Validações integradas", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validações não executadas", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-124"}
269
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Rastreabilidade", "associated_controls_text": "Rastreabilidade", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de rastreabilidade", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-125"}
270
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Gestão de exceções", "associated_controls_text": "Gestão de exceções", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Bypass de controlos sem rasto", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-126"}
271
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Governação contínua", "associated_controls_text": "Governação contínua", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alterações críticas sem visibilidade", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-127"}
272
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Gates e governação", "associated_controls_text": "Gates e governação", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Promoções sem responsável humano", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-128"}
273
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Evidência empírica", "associated_controls_text": "Evidência empírica", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Evidência plausível sem execução", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-129"}
274
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Reprodutibilidade", "associated_controls_text": "Reprodutibilidade", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Não-determinismo do pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-130"}
275
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Controlo de integrações", "associated_controls_text": "Controlo de integrações", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exfiltração de contexto sensível", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-131"}
276
276
  {"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`uso-de-segredos-estaticos`", "`MT-121`", "0.76", "alias_match, bundle_grounding, threat_label_match"]}
277
277
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-132", "manual_v2_entity_label": "Defaults inseguros ou permissivos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
278
278
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-133", "manual_v2_entity_label": "Configurações sem validação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -302,23 +302,23 @@
302
302
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:gestao-centralizada-de-excecoes", "manual_v2_entity_label": "Gestão centralizada de exceções", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
303
303
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:pipelines-ci-cd-obrigatorios", "manual_v2_entity_label": "Pipelines CI/CD obrigatórios", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
304
304
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:uso-de-ferramentas-de-scanning", "manual_v2_entity_label": "Uso de ferramentas de scanning", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
305
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Defaults inseguros ou permissivos", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-132"}
306
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Configurações sem validação", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-133"}
307
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Campos críticos deixados em branco ou default", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-134"}
308
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes inconsistentes entre execuções", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-135"}
309
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de módulos inseguros ou sem validação", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-136"}
310
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Hardcoded de parâmetros críticos", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-137"}
311
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes inseguros provisionados por erro", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-138"}
312
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Provisionamento com permissões excessivas", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-139"}
313
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de tags de classificação de dados", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-140"}
314
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de dados reais em ambientes de teste", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-141"}
315
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segredos hardcoded ou mal geridos", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-142"}
316
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alterações aplicadas sem revisão", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-143"}
317
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de owner e accountability", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-144"}
318
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reutilização de módulos sem tracking", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-145"}
319
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aplicação de alterações inseguras por bypass", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-146"}
320
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Justificações informais ou inexistentes", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-147"}
321
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes provisionados com exceções acumuladas", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-148"}
305
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Defaults inseguros ou permissivos", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-132"}
306
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Configurações sem validação", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-133"}
307
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Campos críticos deixados em branco ou default", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-134"}
308
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes inconsistentes entre execuções", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-135"}
309
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de módulos inseguros ou sem validação", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-136"}
310
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Hardcoded de parâmetros críticos", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-137"}
311
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes inseguros provisionados por erro", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-138"}
312
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Provisionamento com permissões excessivas", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [{"antipattern_id": "sem:antipattern:permissoes-excessivas", "confidence": 0.76, "derivation": "semantic_antipattern_threat_link", "label": "Permissões excessivas", "link_type": "exposes"}], "threat_category": "STRIDE", "threat_id": "MT-139"}
313
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de tags de classificação de dados", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-140"}
314
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de dados reais em ambientes de teste", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-141"}
315
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segredos hardcoded ou mal geridos", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-142"}
316
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alterações aplicadas sem revisão", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-143"}
317
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de owner e accountability", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-144"}
318
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reutilização de módulos sem tracking", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-145"}
319
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aplicação de alterações inseguras por bypass", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-146"}
320
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Justificações informais ou inexistentes", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-147"}
321
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes provisionados com exceções acumuladas", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-148"}
322
322
  {"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`permissoes-excessivas`", "`MT-139`", "0.76", "alias_match, bundle_grounding, threat_label_match"]}
323
323
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-149", "manual_v2_entity_label": "Imagens base vulneráveis/obsoletas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
324
324
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-150", "manual_v2_entity_label": "Inclusão de dependências inseguras no build", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -338,24 +338,24 @@
338
338
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-164", "manual_v2_entity_label": "Falta de rastreabilidade de deploys", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
339
339
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-165", "manual_v2_entity_label": "_Shadow containers_ fora do pipeline", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
340
340
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-166", "manual_v2_entity_label": "_Drift_ de configuração", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
341
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Checklist 3–4*, *Policies: Gestão de Vulnerabilidades*, *Rastreabilidade: SSDF RV.1*", "associated_controls_text": "*Checklist 3–4*, *Policies: Gestão de Vulnerabilidades*, *Rastreabilidade: SSDF RV.1*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Imagens base vulneráveis/obsoletas", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "forte", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-149"}
342
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Checklist 3–4*", "associated_controls_text": "*Checklist 3–4*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de dependências inseguras no build", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-150"}
343
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Policies: Construção Segura de Imagens*", "associated_controls_text": "*Policies: Construção Segura de Imagens*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Conteúdo inesperado no _context_ de build", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-151"}
344
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Checklist 6*, *Policies: Construção Segura*", "associated_controls_text": "*Checklist 6*, *Policies: Construção Segura*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Configurações inseguras no Dockerfile", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-152"}
345
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Checklist 5 & 10–11*, *Policies: Assinatura e Proveniência*", "associated_controls_text": "*Checklist 5 & 10–11*, *Policies: Assinatura e Proveniência*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Imagens não assinadas / sem verificação", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-153"}
346
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Policies: Repositórios*", "associated_controls_text": "*Policies: Repositórios*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Substituição maliciosa em registo", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-154"}
347
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Checklist 14–15*, *Rastreabilidade: DSOMM Ops*", "associated_controls_text": "*Checklist 14–15*, *Rastreabilidade: DSOMM Ops*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de trilho de auditoria (quem construiu o quê)", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-155"}
348
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Checklist 7–9*, *Policies: Hardening de Runtime*", "associated_controls_text": "*Checklist 7–9*, *Policies: Hardening de Runtime*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução como root / capabilities excessivas", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-156"}
349
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Policies: Hardening de Runtime*", "associated_controls_text": "*Policies: Hardening de Runtime*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Montagens e volumes inseguros", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-157"}
350
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Policies: Runtime*, *Checklist 8*", "associated_controls_text": "*Policies: Runtime*, *Checklist 8*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de políticas de rede", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-158"}
351
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Checklist 11*, *Policies: Validação de Manifestos*", "associated_controls_text": "*Checklist 11*, *Policies: Validação de Manifestos*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "_Admission_ permissivo", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-159"}
352
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Policies: Segredos*, *Checklist 3 & 5*", "associated_controls_text": "*Policies: Segredos*, *Checklist 3 & 5*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segredos embebidos em imagem", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-160"}
353
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Policies: Segredos*", "associated_controls_text": "*Policies: Segredos*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exposição em variáveis de ambiente", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-161"}
354
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Checklist 11*, *Policies: Validação de Manifestos*", "associated_controls_text": "*Checklist 11*, *Policies: Validação de Manifestos*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Manifestos inseguros aprovados", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-162"}
355
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Rastreabilidade: SLSA*, *Checklist 2 & 10–11*", "associated_controls_text": "*Rastreabilidade: SLSA*, *Checklist 2 & 10–11*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Desalinhamento imagem↔manifesto", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-163"}
356
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Checklist 14–15*, *DSOMM Ops Monitoring*", "associated_controls_text": "*Checklist 14–15*, *DSOMM Ops Monitoring*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de rastreabilidade de deploys", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-164"}
357
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Rastreabilidade: DSOMM*", "associated_controls_text": "*Rastreabilidade: DSOMM*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "_Shadow containers_ fora do pipeline", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-165"}
358
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Policies: Runtime*, Cap. 08 (IaC)", "associated_controls_text": "*Policies: Runtime*, Cap. 08 (IaC)", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "_Drift_ de configuração", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-166"}
341
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 3–4*, *Policies: Gestão de Vulnerabilidades*, *Rastreabilidade: SSDF RV.1*", "associated_controls_text": "*Checklist 3–4*, *Policies: Gestão de Vulnerabilidades*, *Rastreabilidade: SSDF RV.1*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Imagens base vulneráveis/obsoletas", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "forte", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-149"}
342
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 3–4*", "associated_controls_text": "*Checklist 3–4*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de dependências inseguras no build", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-150"}
343
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Policies: Construção Segura de Imagens*", "associated_controls_text": "*Policies: Construção Segura de Imagens*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Conteúdo inesperado no _context_ de build", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-151"}
344
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 6*, *Policies: Construção Segura*", "associated_controls_text": "*Checklist 6*, *Policies: Construção Segura*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Configurações inseguras no Dockerfile", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-152"}
345
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 5 & 10–11*, *Policies: Assinatura e Proveniência*", "associated_controls_text": "*Checklist 5 & 10–11*, *Policies: Assinatura e Proveniência*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Imagens não assinadas / sem verificação", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-153"}
346
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Policies: Repositórios*", "associated_controls_text": "*Policies: Repositórios*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Substituição maliciosa em registo", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-154"}
347
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 14–15*, *Rastreabilidade: DSOMM Ops*", "associated_controls_text": "*Checklist 14–15*, *Rastreabilidade: DSOMM Ops*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de trilho de auditoria (quem construiu o quê)", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-155"}
348
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 7–9*, *Policies: Hardening de Runtime*", "associated_controls_text": "*Checklist 7–9*, *Policies: Hardening de Runtime*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução como root / capabilities excessivas", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-156"}
349
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Policies: Hardening de Runtime*", "associated_controls_text": "*Policies: Hardening de Runtime*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Montagens e volumes inseguros", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-157"}
350
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Policies: Runtime*, *Checklist 8*", "associated_controls_text": "*Policies: Runtime*, *Checklist 8*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de políticas de rede", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-158"}
351
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 11*, *Policies: Validação de Manifestos*", "associated_controls_text": "*Checklist 11*, *Policies: Validação de Manifestos*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "_Admission_ permissivo", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-159"}
352
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Policies: Segredos*, *Checklist 3 & 5*", "associated_controls_text": "*Policies: Segredos*, *Checklist 3 & 5*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segredos embebidos em imagem", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-160"}
353
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Policies: Segredos*", "associated_controls_text": "*Policies: Segredos*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exposição em variáveis de ambiente", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-161"}
354
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 11*, *Policies: Validação de Manifestos*", "associated_controls_text": "*Checklist 11*, *Policies: Validação de Manifestos*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Manifestos inseguros aprovados", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-162"}
355
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Rastreabilidade: SLSA*, *Checklist 2 & 10–11*", "associated_controls_text": "*Rastreabilidade: SLSA*, *Checklist 2 & 10–11*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Desalinhamento imagem↔manifesto", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-163"}
356
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 14–15*, *DSOMM Ops Monitoring*", "associated_controls_text": "*Checklist 14–15*, *DSOMM Ops Monitoring*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de rastreabilidade de deploys", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-164"}
357
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Rastreabilidade: DSOMM*", "associated_controls_text": "*Rastreabilidade: DSOMM*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "_Shadow containers_ fora do pipeline", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-165"}
358
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Policies: Runtime*, Cap. 08 (IaC)", "associated_controls_text": "*Policies: Runtime*, Cap. 08 (IaC)", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "_Drift_ de configuração", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-166"}
359
359
  {"coverage_status": "cwe_supporting", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "cwe_supporting", "row_cells": ["`CWE-1104`", "`?`", "supporting reference; primary anchor é Manual threat"]}
360
360
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-167", "manual_v2_entity_label": "Injeções (SQLi, OS Command, etc.)", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
361
361
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-168", "manual_v2_entity_label": "Falhas de controlo de acesso", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -372,21 +372,21 @@
372
372
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-179", "manual_v2_entity_label": "Classes novas não detetadas por SAST/DAST", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
373
373
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-180", "manual_v2_entity_label": "Testes superficiais sem contexto técnico", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
374
374
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-181", "manual_v2_entity_label": "Ferramentas não calibradas por contexto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
375
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Injeções (SQLi, OS Command, etc.)", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-167"}
376
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas de controlo de acesso", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-168"}
377
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Lógicas de negócio exploráveis", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-169"}
378
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Regressão de segurança", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-170"}
379
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Baixa cobertura dos testes", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-171"}
380
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas conhecidas não testadas", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-172"}
381
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas detetadas mas não resolvidas", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-173"}
382
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Equipa sem feedback técnico", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-174"}
383
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validações não repetíveis", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-175"}
384
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Testes manuais não escaláveis", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-176"}
385
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de testes antes de go-live", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-177"}
386
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Decisão de qualidade feita sem base", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-178"}
387
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Classes novas não detetadas por SAST/DAST", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-179"}
388
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Testes superficiais sem contexto técnico", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-180"}
389
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ferramentas não calibradas por contexto", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-181"}
375
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Injeções (SQLi, OS Command, etc.)", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-167"}
376
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas de controlo de acesso", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-168"}
377
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Lógicas de negócio exploráveis", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-169"}
378
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Regressão de segurança", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-170"}
379
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Baixa cobertura dos testes", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-171"}
380
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas conhecidas não testadas", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-172"}
381
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas detetadas mas não resolvidas", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-173"}
382
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Equipa sem feedback técnico", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-174"}
383
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validações não repetíveis", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-175"}
384
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Testes manuais não escaláveis", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-176"}
385
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de testes antes de go-live", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-177"}
386
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Decisão de qualidade feita sem base", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-178"}
387
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Classes novas não detetadas por SAST/DAST", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-179"}
388
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Testes superficiais sem contexto técnico", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-180"}
389
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ferramentas não calibradas por contexto", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-181"}
390
390
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-182", "manual_v2_entity_label": "Código em produção sem validação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
391
391
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-183", "manual_v2_entity_label": "Ativação funcional sem controlo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
392
392
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-184", "manual_v2_entity_label": "Promoção manual fora do CI/CD", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -402,21 +402,21 @@
402
402
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-194", "manual_v2_entity_label": "Toggle ativado inadvertidamente", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
403
403
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-195", "manual_v2_entity_label": "Release sem segmentação geográfica ou lógica", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
404
404
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-196", "manual_v2_entity_label": "Execução de função crítica não validada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
405
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Código em produção sem validação", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-182"}
406
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ativação funcional sem controlo", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-183"}
407
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Promoção manual fora do CI/CD", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-184"}
408
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Deploy falhado sem rollback", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-185"}
409
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Feature irreversível", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-186"}
410
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falha sem reação", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-187"}
411
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Release conjunta sem segmentação", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-188"}
412
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Feature exposta a todos os utilizadores", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-189"}
413
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de validação operacional", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-190"}
414
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas pós-deploy não detetadas", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-191"}
415
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reação tardia a problemas críticos", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-192"}
416
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Eventos críticos ignorados", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-193"}
417
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Toggle ativado inadvertidamente", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-194"}
418
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Release sem segmentação geográfica ou lógica", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-195"}
419
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução de função crítica não validada", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-196"}
405
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Código em produção sem validação", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-182"}
406
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ativação funcional sem controlo", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-183"}
407
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Promoção manual fora do CI/CD", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-184"}
408
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Deploy falhado sem rollback", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-185"}
409
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Feature irreversível", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-186"}
410
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falha sem reação", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-187"}
411
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Release conjunta sem segmentação", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-188"}
412
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Feature exposta a todos os utilizadores", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-189"}
413
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de validação operacional", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-190"}
414
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas pós-deploy não detetadas", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-191"}
415
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reação tardia a problemas críticos", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-192"}
416
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Eventos críticos ignorados", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-193"}
417
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Toggle ativado inadvertidamente", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-194"}
418
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Release sem segmentação geográfica ou lógica", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-195"}
419
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução de função crítica não validada", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-196"}
420
420
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-197", "manual_v2_entity_label": "Eventos críticos não registados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
421
421
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-198", "manual_v2_entity_label": "Logs voláteis ou truncados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
422
422
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-199", "manual_v2_entity_label": "Falta de rastreabilidade de execução", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -442,21 +442,21 @@
442
442
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:falhas-de-login", "manual_v2_entity_label": "Falhas de login", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
443
443
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:logs", "manual_v2_entity_label": "Logs", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
444
444
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:metricas-mttd-mttr", "manual_v2_entity_label": "Métricas MTTD/MTTR", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
445
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Eventos críticos não registados", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-197"}
446
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Logs voláteis ou truncados", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-198"}
447
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de rastreabilidade de execução", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-199"}
448
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Incidentes sem alerta", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-200"}
449
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alertas ignorados por ruído", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-201"}
450
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de correlação de alertas", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-202"}
451
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Incidentes sem owner definido", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-203"}
452
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reação ad-hoc ou tardia", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-204"}
453
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Eventos sem acionamento de ação", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-205"}
454
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de métricas de postura", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-206"}
455
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Impossibilidade de priorizar riscos", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-207"}
456
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dados sem granularidade ou visão", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-208"}
457
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Novos sistemas sem monitorização", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-209"}
458
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Equipas ignoram alertas operacionais", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-210"}
459
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dados não usados para melhoria contínua", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-211"}
445
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Eventos críticos não registados", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-197"}
446
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Logs voláteis ou truncados", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-198"}
447
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de rastreabilidade de execução", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-199"}
448
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Incidentes sem alerta", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [{"antipattern_id": "sem:antipattern:alertas-nao-acionaveis", "confidence": 0.7, "derivation": "semantic_antipattern_threat_link", "label": "Alertas não acionáveis", "link_type": "exposes"}], "threat_category": "STRIDE", "threat_id": "MT-200"}
449
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alertas ignorados por ruído", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-201"}
450
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de correlação de alertas", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-202"}
451
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Incidentes sem owner definido", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-203"}
452
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reação ad-hoc ou tardia", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-204"}
453
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Eventos sem acionamento de ação", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-205"}
454
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de métricas de postura", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-206"}
455
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Impossibilidade de priorizar riscos", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-207"}
456
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dados sem granularidade ou visão", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-208"}
457
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Novos sistemas sem monitorização", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-209"}
458
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Equipas ignoram alertas operacionais", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-210"}
459
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dados não usados para melhoria contínua", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-211"}
460
460
  {"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`alertas-nao-acionaveis`", "`MT-200`", "0.70", "alias_match, bundle_grounding, risk_match"]}
461
461
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-212", "manual_v2_entity_label": "Configuração insegura por desconhecimento", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
462
462
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-213", "manual_v2_entity_label": "Reutilização indevida de segredos ou tokens", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -474,16 +474,16 @@
474
474
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:kpis-de-eficacia-formativa", "manual_v2_entity_label": "KPIs de eficácia formativa", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
475
475
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:kpis-de-formacao", "manual_v2_entity_label": "KPIs de Formação", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
476
476
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:resultados-de-quiz", "manual_v2_entity_label": "Resultados de Quizzes", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
477
- {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Configuração insegura por desconhecimento", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-212"}
478
- {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reutilização indevida de segredos ou tokens", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-213"}
479
- {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Acesso técnico concedido sem validação", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-214"}
480
- {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de terceiros sem validação", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-215"}
481
- {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de ownership sobre segurança", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-216"}
482
- {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Regressão comportamental / cultura frágil", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-217"}
483
- {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Formação não rastreável", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-218"}
484
- {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Formação desigual entre equipas ou funções", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-219"}
485
- {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Formação teórica sem impacto prático", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-220"}
486
- {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Conteúdos desatualizados ou não aplicáveis", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-221"}
477
+ {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Configuração insegura por desconhecimento", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-212"}
478
+ {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reutilização indevida de segredos ou tokens", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-213"}
479
+ {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Acesso técnico concedido sem validação", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-214"}
480
+ {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de terceiros sem validação", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-215"}
481
+ {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de ownership sobre segurança", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-216"}
482
+ {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Regressão comportamental / cultura frágil", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-217"}
483
+ {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Formação não rastreável", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-218"}
484
+ {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Formação desigual entre equipas ou funções", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-219"}
485
+ {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Formação teórica sem impacto prático", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-220"}
486
+ {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Conteúdos desatualizados ou não aplicáveis", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-221"}
487
487
  {"coverage_status": "cwe_supporting", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "cwe_supporting", "row_cells": ["`CWE-693`", "`?`", "supporting reference; primary anchor é Manual threat"]}
488
488
  {"coverage_status": "cwe_supporting", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "cwe_supporting", "row_cells": ["`CWE-798`", "`?`", "supporting reference; primary anchor é Manual threat"]}
489
489
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-222", "manual_v2_entity_label": "Adoção de fornecedor sem avaliação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -509,15 +509,15 @@
509
509
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:registo-e-aprovacao-de-excecoes", "manual_v2_entity_label": "registo e aprovação de exceções", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
510
510
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:reporting-periodico-a-gestao", "manual_v2_entity_label": "reporting periódico à gestão", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
511
511
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:validacao-continua-de-fornecedores", "manual_v2_entity_label": "validação contínua de fornecedores", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
512
- {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Adoção de fornecedor sem avaliação", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-222"}
513
- {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de cláusulas contratuais", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-223"}
514
- {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de serviços sem rastreio", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-224"}
515
- {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Iniciativas paralelas sem coordenação", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-225"}
516
- {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de continuidade organizacional", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-226"}
517
- {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco de decisões legadas sem controlo", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-227"}
518
- {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Decisões não revistas com mudança de contexto", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-228"}
519
- {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de governança em decisões históricas", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-229"}
520
- {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de conhecimento sobre o estado de segurança", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-230"}
521
- {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "30, 90", "associated_controls_text": "30, 90", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Estratégia de segurança desarticulada", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-231"}
522
- {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança definida mas não aplicada", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "forte", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-232"}
523
- {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Políticas de segurança não institucionalizadas", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-233"}
512
+ {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Adoção de fornecedor sem avaliação", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-222"}
513
+ {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de cláusulas contratuais", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-223"}
514
+ {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de serviços sem rastreio", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-224"}
515
+ {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Iniciativas paralelas sem coordenação", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-225"}
516
+ {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de continuidade organizacional", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-226"}
517
+ {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco de decisões legadas sem controlo", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-227"}
518
+ {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Decisões não revistas com mudança de contexto", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-228"}
519
+ {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de governança em decisões históricas", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-229"}
520
+ {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de conhecimento sobre o estado de segurança", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-230"}
521
+ {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "30, 90", "associated_controls_text": "30, 90", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Estratégia de segurança desarticulada", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-231"}
522
+ {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança definida mas não aplicada", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "forte", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-232"}
523
+ {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Políticas de segurança não institucionalizadas", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-233"}