@shiftleftpt/sbd-toe-mcp 0.20.0-beta.44 → 0.20.0-beta.46

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (47) hide show
  1. package/consumed-bundle.json +10 -10
  2. package/data/entities/proportionality.json +3 -3
  3. package/data/entities/sdlc_integration.json +885 -4
  4. package/data/publish/indexes/canonical_chunks.jsonl +4907 -4907
  5. package/data/publish/indexes/mcp_chunks.jsonl +38 -38
  6. package/data/publish/indexes/publication_manifest.json +3 -3
  7. package/data/publish/ontology/sbdtoe-ontology.yaml +20 -5
  8. package/data/publish/runtime/assignments.json +2034 -376
  9. package/data/publish/runtime/decision_involvements.json +17 -5
  10. package/data/publish/runtime/deterministic_manifest.json +3 -3
  11. package/data/publish/runtime/phases.json +8 -6
  12. package/data/publish/runtime/user_stories.json +54 -27
  13. package/data/publish/runtime/v1/manual_maturity_progression.jsonl +336 -336
  14. package/data/publish/runtime/v1/manual_rastreabilidade.jsonl +1105 -1105
  15. package/data/publish/runtime/v1/manual_threat_mitigation.jsonl +523 -523
  16. package/data/publish/runtime/v1/v1_manifest.json +5 -5
  17. package/data/publish/semantic/macro_processes.jsonl +1 -1
  18. package/data/publish/semantic/mp_edges.jsonl +1 -1
  19. package/data/reports/run_manifest.json +8 -8
  20. package/dist/index.js +15 -6
  21. package/dist/index.js.map +1 -1
  22. package/dist/serving/agent-guide.js +9 -0
  23. package/dist/serving/agent-guide.js.map +1 -1
  24. package/dist/serving/declared-absences.d.ts +16 -0
  25. package/dist/serving/declared-absences.js +17 -2
  26. package/dist/serving/declared-absences.js.map +1 -1
  27. package/dist/tools/get-chapter-capability.js +30 -7
  28. package/dist/tools/get-chapter-capability.js.map +1 -1
  29. package/dist/tools/get-guide-by-role.js +33 -0
  30. package/dist/tools/get-guide-by-role.js.map +1 -1
  31. package/dist/tools/get-macro-processes.js +2 -1
  32. package/dist/tools/get-macro-processes.js.map +1 -1
  33. package/dist/tools/map-review-scope.d.ts +2 -0
  34. package/dist/tools/map-review-scope.js +18 -0
  35. package/dist/tools/map-review-scope.js.map +1 -1
  36. package/dist/tools/plan-repo-governance.d.ts +2 -0
  37. package/dist/tools/plan-repo-governance.js +18 -0
  38. package/dist/tools/plan-repo-governance.js.map +1 -1
  39. package/dist/tools/plan-rollout.js +33 -3
  40. package/dist/tools/plan-rollout.js.map +1 -1
  41. package/dist/tools/trace-graph.d.ts +3 -0
  42. package/dist/tools/trace-graph.js +5 -0
  43. package/dist/tools/trace-graph.js.map +1 -1
  44. package/dist/version-info.d.ts +9 -0
  45. package/dist/version-info.js +11 -0
  46. package/dist/version-info.js.map +1 -1
  47. package/package.json +1 -1
package/data/publish/runtime/v1/manual_threat_mitigation.jsonl CHANGED
@@ -1,523 +1,523 @@
1
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-001", "manual_v2_entity_label": "Falta de aplicação de controlos mínimos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
2
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-002", "manual_v2_entity_label": "Overengineering e fricção excessiva", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
3
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-003", "manual_v2_entity_label": "Inconsistência entre projetos com mesmo risco", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
4
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-004", "manual_v2_entity_label": "Segurança opcional em produtos low-risk", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
5
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-005", "manual_v2_entity_label": "Mudanças críticas sem reclassificação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
6
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-006", "manual_v2_entity_label": "Integração com APIs ou terceiros ignorada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
7
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-007", "manual_v2_entity_label": "Deploy com risco alterado não revisto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
8
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-008", "manual_v2_entity_label": "Versões diferentes com classificações divergentes", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
9
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-009", "manual_v2_entity_label": "Aceitação informal de riscos críticos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
10
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-010", "manual_v2_entity_label": "Impossibilidade de auditoria posterior", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
11
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-011", "manual_v2_entity_label": "Risco aceite por responsáveis inapropriados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
12
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-012", "manual_v2_entity_label": "Falta de explicabilidade regulatória", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
13
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-013", "manual_v2_entity_label": "Interfaces expostas mal avaliadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
14
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-014", "manual_v2_entity_label": "Dados sensíveis não reconhecidos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
15
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-015", "manual_v2_entity_label": "Assunção de ambientes seguros por defeito", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
16
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-016", "manual_v2_entity_label": "Ignorar dependências críticas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
17
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-017", "manual_v2_entity_label": "Risco residual nunca revisto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
18
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-018", "manual_v2_entity_label": "Falta de eventos de reavaliação planeados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
19
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-019", "manual_v2_entity_label": "Reclassificação dependente de exceções", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
20
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-020", "manual_v2_entity_label": "Decisões de risco sem feedback do negócio", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
21
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:aceitacao-de-risco-invalida", "manual_v2_entity_label": "aceitação de risco inválida", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
22
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:alteracao-na-exposicao-dados-impacto-ou-forma-de-decisoes-e-validacoes", "manual_v2_entity_label": "alteração na exposição, dados, impacto ou forma de decisões e validações", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
23
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de aplicação de controlos mínimos", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-001"}
24
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Overengineering e fricção excessiva", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-002"}
25
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inconsistência entre projetos com mesmo risco", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-003"}
26
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança opcional em produtos low-risk", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-004"}
27
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mudanças críticas sem reclassificação", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-005"}
28
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Integração com APIs ou terceiros ignorada", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-006"}
29
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Deploy com risco alterado não revisto", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-007"}
30
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Versões diferentes com classificações divergentes", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-008"}
31
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aceitação informal de riscos críticos", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [{"antipattern_id": "sem:antipattern:aceitacao-de-risco-invalida", "confidence": 0.7, "derivation": "semantic_antipattern_threat_link", "label": "aceitação de risco inválida", "link_type": "exposes"}], "threat_category": "STRIDE", "threat_id": "MT-009"}
32
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Impossibilidade de auditoria posterior", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-010"}
33
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco aceite por responsáveis inapropriados", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-011"}
34
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de explicabilidade regulatória", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-012"}
35
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Interfaces expostas mal avaliadas", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-013"}
36
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dados sensíveis não reconhecidos", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-014"}
37
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Assunção de ambientes seguros por defeito", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-015"}
38
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ignorar dependências críticas", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-016"}
39
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco residual nunca revisto", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-017"}
40
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de eventos de reavaliação planeados", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-018"}
41
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reclassificação dependente de exceções", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-019"}
42
- {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Decisões de risco sem feedback do negócio", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [{"antipattern_id": "sem:antipattern:aceitacao-de-risco-invalida", "confidence": 0.76, "derivation": "semantic_antipattern_threat_link", "label": "aceitação de risco inválida", "link_type": "exposes"}], "threat_category": "STRIDE", "threat_id": "MT-020"}
43
- {"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`aceitacao-de-risco-invalida`", "`MT-009`", "0.70", "alias_match, bundle_grounding, risk_match"]}
44
- {"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`aceitacao-de-risco-invalida`", "`MT-020`", "0.76", "alias_match, bundle_grounding, how_it_arises_match"]}
45
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-021", "manual_v2_entity_label": "Ausência de requisitos de segurança", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
46
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-022", "manual_v2_entity_label": "Definição ambígua ou não testável", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
47
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-023", "manual_v2_entity_label": "Requisitos genéricos não específicos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
48
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-024", "manual_v2_entity_label": "Falta de requisitos em sistemas legados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
49
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-025", "manual_v2_entity_label": "Requisitos não alinhados com risco", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
50
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-026", "manual_v2_entity_label": "Requisitos definidos mas nunca verificados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
51
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-027", "manual_v2_entity_label": "Validações inconsistentes entre projetos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
52
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-028", "manual_v2_entity_label": "Ausência de rastreio entre requisito e teste", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
53
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-029", "manual_v2_entity_label": "Requisitos não verificados em CI/CD", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
54
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-030", "manual_v2_entity_label": "Risco aceite sem validação documental", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
55
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-031", "manual_v2_entity_label": "Exceções a requisitos não documentadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
56
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-032", "manual_v2_entity_label": "Segurança omitida por “não ser funcional”", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
57
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-033", "manual_v2_entity_label": "Aceitação de exceções sem aprovação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
58
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-034", "manual_v2_entity_label": "Exceções não reverificadas no tempo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
59
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-035", "manual_v2_entity_label": "Não saber se requisitos foram aplicados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
60
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-036", "manual_v2_entity_label": "Requisitos aplicados mas não testados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
61
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-037", "manual_v2_entity_label": "Mudanças de requisitos não propagadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
62
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-038", "manual_v2_entity_label": "Ambiguidade entre requisito e controlo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
63
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de requisitos de segurança", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-021"}
64
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Definição ambígua ou não testável", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-022"}
65
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos genéricos não específicos", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-023"}
66
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de requisitos em sistemas legados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-024"}
67
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos não alinhados com risco", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-025"}
68
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos definidos mas nunca verificados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-026"}
69
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validações inconsistentes entre projetos", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-027"}
70
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de rastreio entre requisito e teste", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-028"}
71
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos não verificados em CI/CD", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-029"}
72
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco aceite sem validação documental", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-030"}
73
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções a requisitos não documentadas", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-031"}
74
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança omitida por “não ser funcional”", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-032"}
75
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aceitação de exceções sem aprovação", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-033"}
76
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções não reverificadas no tempo", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-034"}
77
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Não saber se requisitos foram aplicados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-035"}
78
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos aplicados mas não testados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-036"}
79
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mudanças de requisitos não propagadas", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-037"}
80
- {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambiguidade entre requisito e controlo", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-038"}
81
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-039", "manual_v2_entity_label": "Ameaças desconhecidas e não tratadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
82
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-040", "manual_v2_entity_label": "Prioridades de segurança mal definidas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
83
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-041", "manual_v2_entity_label": "Requisitos definidos sem base em ameaças", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
84
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-042", "manual_v2_entity_label": "Ameaças a privacidade ignoradas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
85
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-043", "manual_v2_entity_label": "Falta de cobertura de ameaças não técnicas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
86
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-044", "manual_v2_entity_label": "Arquitetura insegura não identificada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
87
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-045", "manual_v2_entity_label": "Validação superficial em design reviews", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
88
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-046", "manual_v2_entity_label": "Controles aplicados sem base em arquitetura", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
89
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-047", "manual_v2_entity_label": "Ausência de revisão em interfaces críticas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
90
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-048", "manual_v2_entity_label": "Ameaças descobertas demasiado tarde", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
91
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-049", "manual_v2_entity_label": "Mudanças críticas sem nova modelação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
92
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-050", "manual_v2_entity_label": "Descontinuidade entre equipas e fases", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
93
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-051", "manual_v2_entity_label": "Ameaças não visíveis na pipeline CI/CD", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
94
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-052", "manual_v2_entity_label": "Conhecimento de ameaças não acumulado", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
95
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-053", "manual_v2_entity_label": "Inconsistência entre projetos e equipas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
96
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-054", "manual_v2_entity_label": "Ferramentas desconectadas do ciclo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
97
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:ausencia-de-ameaca-no-modelo", "manual_v2_entity_label": "Ausência de ameaça no modelo", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
98
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:omissao-estrutural-de-ameacas", "manual_v2_entity_label": "Omissão estrutural de ameaças", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
99
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças desconhecidas e não tratadas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-039"}
100
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Prioridades de segurança mal definidas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-040"}
101
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos definidos sem base em ameaças", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-041"}
102
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças a privacidade ignoradas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "LINDDUN", "threat_id": "MT-042"}
103
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de cobertura de ameaças não técnicas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-043"}
104
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura insegura não identificada", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-044"}
105
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validação superficial em design reviews", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-045"}
106
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Controles aplicados sem base em arquitetura", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-046"}
107
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de revisão em interfaces críticas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-047"}
108
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças descobertas demasiado tarde", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-048"}
109
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mudanças críticas sem nova modelação", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-049"}
110
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Descontinuidade entre equipas e fases", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-050"}
111
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças não visíveis na pipeline CI/CD", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-051"}
112
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Conhecimento de ameaças não acumulado", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-052"}
113
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inconsistência entre projetos e equipas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-053"}
114
- {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ferramentas desconectadas do ciclo", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-054"}
115
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-055", "manual_v2_entity_label": "Interfaces expostas sem isolamento", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
116
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-056", "manual_v2_entity_label": "Mistura de dados e controlo na mesma zona", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
117
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-057", "manual_v2_entity_label": "Acesso lateral não controlado entre módulos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
118
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-058", "manual_v2_entity_label": "Ausência de isolamento entre utilizadores", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
119
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-059", "manual_v2_entity_label": "Arquitetura inexistente ou desatualizada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
120
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-060", "manual_v2_entity_label": "Confusão sobre localização de controlos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
121
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-061", "manual_v2_entity_label": "Ambiguidade sobre fronteiras e zonas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
122
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-062", "manual_v2_entity_label": "Arquitetura não revê mecanismos de fallback", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
123
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-063", "manual_v2_entity_label": "Arquitetura nunca revista", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
124
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-064", "manual_v2_entity_label": "Alterações estruturais sem revalidação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
125
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-065", "manual_v2_entity_label": "Design informal ou ad hoc", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
126
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-066", "manual_v2_entity_label": "Exceções de arquitetura sem rasto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
127
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-067", "manual_v2_entity_label": "Requisitos de arquitetura não definidos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
128
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-068", "manual_v2_entity_label": "Impossibilidade de mapear decisões a controlos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
129
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-069", "manual_v2_entity_label": "Diagrama não reflete controlos implementados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
130
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-070", "manual_v2_entity_label": "Aplicações L1 tratadas como críticas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
131
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-071", "manual_v2_entity_label": "Sobredimensionamento de segurança da arquitetura", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
132
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-072", "manual_v2_entity_label": "Ambientes de execução não refletidos no design", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
133
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:dependencia-circular", "manual_v2_entity_label": "dependência circular", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
134
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:excecoes-nao-documentadas", "manual_v2_entity_label": "Exceções não documentadas", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
135
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:modelos-inconsistentes-incompletos-ou-desatualizados", "manual_v2_entity_label": "Modelos inconsistentes, incompletos ou desatualizados", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
136
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:threat-modeling-sem-arquitetura-clara", "manual_v2_entity_label": "Threat modeling sem arquitetura clara", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
137
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Interfaces expostas sem isolamento", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-055"}
138
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mistura de dados e controlo na mesma zona", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-056"}
139
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Acesso lateral não controlado entre módulos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-057"}
140
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de isolamento entre utilizadores", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-058"}
141
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura inexistente ou desatualizada", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-059"}
142
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Confusão sobre localização de controlos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-060"}
143
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambiguidade sobre fronteiras e zonas", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-061"}
144
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura não revê mecanismos de fallback", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-062"}
145
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura nunca revista", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-063"}
146
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alterações estruturais sem revalidação", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-064"}
147
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Design informal ou ad hoc", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-065"}
148
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções de arquitetura sem rasto", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-066"}
149
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos de arquitetura não definidos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-067"}
150
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Impossibilidade de mapear decisões a controlos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-068"}
151
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Diagrama não reflete controlos implementados", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-069"}
152
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aplicações L1 tratadas como críticas", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-070"}
153
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Sobredimensionamento de segurança da arquitetura", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-071"}
154
- {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes de execução não refletidos no design", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-072"}
155
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-073", "manual_v2_entity_label": "Inclusão de bibliotecas com CVEs ativos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
156
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-074", "manual_v2_entity_label": "Dependências desatualizadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
157
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-075", "manual_v2_entity_label": "Ausência de registo de versões", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
158
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-076", "manual_v2_entity_label": "Inclusão de bibliotecas não auditadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
159
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-077", "manual_v2_entity_label": "Desconhecimento de bibliotecas utilizadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
160
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-078", "manual_v2_entity_label": "Falta de associação entre vulnerabilidade e artefacto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
161
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-079", "manual_v2_entity_label": "Falta de histórico de introdução de pacotes", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
162
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-080", "manual_v2_entity_label": "Inclusão de pacotes de repositórios maliciosos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
163
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-081", "manual_v2_entity_label": "Dependência transitiva com componente inseguro", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
164
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-082", "manual_v2_entity_label": "Pipeline injeta versão não autenticada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
165
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-083", "manual_v2_entity_label": "CVEs ignoradas sem justificação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
166
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-084", "manual_v2_entity_label": "Mitigações aplicadas sem rastreio", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
167
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-085", "manual_v2_entity_label": "Falta de ciclo de revisão de exceções", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
168
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-086", "manual_v2_entity_label": "Uso arbitrário de bibliotecas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
169
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-087", "manual_v2_entity_label": "Bibliotecas proibidas são usadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
170
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-088", "manual_v2_entity_label": "Falta de política de substituição", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
171
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-089", "manual_v2_entity_label": "Introdução de dependência vulnerável não declarada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
172
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-090", "manual_v2_entity_label": "Confusão de dependências", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
173
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-091", "manual_v2_entity_label": "Backdoor via ferramenta de build", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
174
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-092", "manual_v2_entity_label": "Drift de composição entre builds", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
175
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de bibliotecas com CVEs ativos", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-073"}
176
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dependências desatualizadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-074"}
177
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de registo de versões", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-075"}
178
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de bibliotecas não auditadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-076"}
179
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Desconhecimento de bibliotecas utilizadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-077"}
180
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de associação entre vulnerabilidade e artefacto", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-078"}
181
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de histórico de introdução de pacotes", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-079"}
182
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de pacotes de repositórios maliciosos", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-080"}
183
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dependência transitiva com componente inseguro", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-081"}
184
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Pipeline injeta versão não autenticada", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-082"}
185
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "CVEs ignoradas sem justificação", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-083"}
186
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mitigações aplicadas sem rastreio", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-084"}
187
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de ciclo de revisão de exceções", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-085"}
188
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso arbitrário de bibliotecas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-086"}
189
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Bibliotecas proibidas são usadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-087"}
190
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de política de substituição", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-088"}
191
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "SBOM boundary, revisão de dependências", "associated_controls_text": "SBOM boundary, revisão de dependências", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Introdução de dependência vulnerável não declarada", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-089"}
192
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "SCA, validação de origem", "associated_controls_text": "SCA, validação de origem", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Confusão de dependências", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-090"}
193
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "Governance de tooling", "associated_controls_text": "Governance de tooling", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Backdoor via ferramenta de build", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-091"}
194
- {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Drift de composição entre builds", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-092"}
195
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-093", "manual_v2_entity_label": "Inclusão de padrões inseguros por hábito", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
196
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-094", "manual_v2_entity_label": "Uso de funções descontinuadas ou perigosas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
197
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-095", "manual_v2_entity_label": "Injeção de código sem escape adequado", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
198
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-096", "manual_v2_entity_label": "Código inseguro sem deteção", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
199
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-097", "manual_v2_entity_label": "Ausência de rastreabilidade entre problemas e decisões", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
200
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-098", "manual_v2_entity_label": "Validação apenas reativa (ex: testes QA)", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
201
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-099", "manual_v2_entity_label": "Segurança removida por “incompatibilidade”", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
202
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-100", "manual_v2_entity_label": "Exceções não revistas ou revalidadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
203
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-101", "manual_v2_entity_label": "Desvios não rastreados entre guideline e prática", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
204
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-102", "manual_v2_entity_label": "Geração de código inseguro via IA", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
205
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-103", "manual_v2_entity_label": "Inclusão de vulnerabilidades conhecidas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
206
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-104", "manual_v2_entity_label": "Falta de accountability sobre código gerado", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
207
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-105", "manual_v2_entity_label": "Inclusão de bibliotecas descontinuadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
208
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-106", "manual_v2_entity_label": "Falta de justificação para uso de dependência insegura", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
209
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-107", "manual_v2_entity_label": "Componente vulnerável mantido no build final", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
210
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-108", "manual_v2_entity_label": "Inconsistência entre equipas e projetos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
211
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-109", "manual_v2_entity_label": "Inexistência de baseline de segurança", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
212
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-110", "manual_v2_entity_label": "Fraca responsabilização pela segurança do código", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
213
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de padrões inseguros por hábito", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-093"}
214
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de funções descontinuadas ou perigosas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-094"}
215
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Injeção de código sem escape adequado", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-095"}
216
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Código inseguro sem deteção", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-096"}
217
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de rastreabilidade entre problemas e decisões", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-097"}
218
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validação apenas reativa (ex: testes QA)", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-098"}
219
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança removida por “incompatibilidade”", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-099"}
220
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções não revistas ou revalidadas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-100"}
221
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Desvios não rastreados entre guideline e prática", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-101"}
222
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Geração de código inseguro via IA", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-102"}
223
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de vulnerabilidades conhecidas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-103"}
224
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de accountability sobre código gerado", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-104"}
225
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de bibliotecas descontinuadas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-105"}
226
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de justificação para uso de dependência insegura", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-106"}
227
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Componente vulnerável mantido no build final", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-107"}
228
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inconsistência entre equipas e projetos", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-108"}
229
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inexistência de baseline de segurança", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-109"}
230
- {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Fraca responsabilização pela segurança do código", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-110"}
231
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-111", "manual_v2_entity_label": "Execução de código não autorizado em pipeline", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
232
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-112", "manual_v2_entity_label": "Comprometimento do ambiente de build", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
233
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-113", "manual_v2_entity_label": "Elevação de privilégios no pipeline", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
234
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-114", "manual_v2_entity_label": "Push não autorizado para branches protegidas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
235
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-115", "manual_v2_entity_label": "Execução de código não auditado", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
236
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-116", "manual_v2_entity_label": "Substituição silenciosa de código legítimo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
237
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-117", "manual_v2_entity_label": "Build forjado fora da pipeline", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
238
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-118", "manual_v2_entity_label": "Injeção de lógica dinâmica em pipeline", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
239
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-119", "manual_v2_entity_label": "Uso de componentes externos inseguros", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
240
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-120", "manual_v2_entity_label": "Vazamento de segredos via logs", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
241
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-121", "manual_v2_entity_label": "Segredos hardcoded", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
242
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-122", "manual_v2_entity_label": "Reutilização de segredos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
243
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-123", "manual_v2_entity_label": "Ausência de gates de segurança", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
244
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-124", "manual_v2_entity_label": "Validações não executadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
245
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-125", "manual_v2_entity_label": "Falta de rastreabilidade", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
246
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-126", "manual_v2_entity_label": "Bypass de controlos sem rasto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
247
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-127", "manual_v2_entity_label": "Alterações críticas sem visibilidade", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
248
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-128", "manual_v2_entity_label": "Promoções sem responsável humano", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
249
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-129", "manual_v2_entity_label": "Evidência plausível sem execução", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
250
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-130", "manual_v2_entity_label": "Não-determinismo do pipeline", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
251
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-131", "manual_v2_entity_label": "Exfiltração de contexto sensível", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
252
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:exposicao-excessiva-de-contexto-em-logs-e-artefactos", "manual_v2_entity_label": "exposição excessiva de contexto em logs e artefactos", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
253
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:uso-de-segredos-estaticos", "manual_v2_entity_label": "uso de segredos estáticos", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
254
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:sinal-automatico", "manual_v2_entity_label": "sinal automático", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
255
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Design seguro de pipelines; isolamento de runners", "associated_controls_text": "Design seguro de pipelines; isolamento de runners", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução de código não autorizado em pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-111"}
256
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Isolamento e efemeridade de runners", "associated_controls_text": "Isolamento e efemeridade de runners", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Comprometimento do ambiente de build", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-112"}
257
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Hardening de pipelines", "associated_controls_text": "Hardening de pipelines", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Elevação de privilégios no pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-113"}
258
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Gestão segura de código-fonte", "associated_controls_text": "Gestão segura de código-fonte", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Push não autorizado para branches protegidas", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-114"}
259
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Políticas de execução", "associated_controls_text": "Políticas de execução", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução de código não auditado", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-115"}
260
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Rastreabilidade e assinaturas", "associated_controls_text": "Rastreabilidade e assinaturas", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Substituição silenciosa de código legítimo", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-116"}
261
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Integridade e proveniência", "associated_controls_text": "Integridade e proveniência", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Build forjado fora da pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-117"}
262
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Segurança do código de pipeline", "associated_controls_text": "Segurança do código de pipeline", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Injeção de lógica dinâmica em pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-118"}
263
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Controlo de dependências", "associated_controls_text": "Controlo de dependências", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de componentes externos inseguros", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-119"}
264
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Gestão de segredos", "associated_controls_text": "Gestão de segredos", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Vazamento de segredos via logs", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-120"}
265
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Gestão de segredos", "associated_controls_text": "Gestão de segredos", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segredos hardcoded", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [{"antipattern_id": "sem:antipattern:uso-de-segredos-estaticos", "confidence": 0.76, "derivation": "semantic_antipattern_threat_link", "label": "uso de segredos estáticos", "link_type": "exposes"}], "threat_category": "STRIDE", "threat_id": "MT-121"}
266
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Lifecycle de segredos", "associated_controls_text": "Lifecycle de segredos", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reutilização de segredos", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-122"}
267
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Políticas de gates", "associated_controls_text": "Políticas de gates", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de gates de segurança", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-123"}
268
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Validações integradas", "associated_controls_text": "Validações integradas", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validações não executadas", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-124"}
269
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Rastreabilidade", "associated_controls_text": "Rastreabilidade", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de rastreabilidade", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-125"}
270
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Gestão de exceções", "associated_controls_text": "Gestão de exceções", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Bypass de controlos sem rasto", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-126"}
271
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Governação contínua", "associated_controls_text": "Governação contínua", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alterações críticas sem visibilidade", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-127"}
272
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Gates e governação", "associated_controls_text": "Gates e governação", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Promoções sem responsável humano", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-128"}
273
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Evidência empírica", "associated_controls_text": "Evidência empírica", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Evidência plausível sem execução", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-129"}
274
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Reprodutibilidade", "associated_controls_text": "Reprodutibilidade", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Não-determinismo do pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-130"}
275
- {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Controlo de integrações", "associated_controls_text": "Controlo de integrações", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exfiltração de contexto sensível", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-131"}
276
- {"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`uso-de-segredos-estaticos`", "`MT-121`", "0.76", "alias_match, bundle_grounding, threat_label_match"]}
277
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-132", "manual_v2_entity_label": "Defaults inseguros ou permissivos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
278
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-133", "manual_v2_entity_label": "Configurações sem validação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
279
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-134", "manual_v2_entity_label": "Campos críticos deixados em branco ou default", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
280
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-135", "manual_v2_entity_label": "Ambientes inconsistentes entre execuções", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
281
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-136", "manual_v2_entity_label": "Uso de módulos inseguros ou sem validação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
282
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-137", "manual_v2_entity_label": "Hardcoded de parâmetros críticos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
283
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-138", "manual_v2_entity_label": "Ambientes inseguros provisionados por erro", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
284
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-139", "manual_v2_entity_label": "Provisionamento com permissões excessivas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
285
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-140", "manual_v2_entity_label": "Falta de tags de classificação de dados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
286
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-141", "manual_v2_entity_label": "Uso de dados reais em ambientes de teste", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
287
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-142", "manual_v2_entity_label": "Segredos hardcoded ou mal geridos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
288
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-143", "manual_v2_entity_label": "Alterações aplicadas sem revisão", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
289
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-144", "manual_v2_entity_label": "Falta de owner e accountability", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
290
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-145", "manual_v2_entity_label": "Reutilização de módulos sem tracking", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
291
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-146", "manual_v2_entity_label": "Aplicação de alterações inseguras por bypass", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
292
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-147", "manual_v2_entity_label": "Justificações informais ou inexistentes", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
293
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-148", "manual_v2_entity_label": "Ambientes provisionados com exceções acumuladas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
294
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:ambientes-mal-segregados", "manual_v2_entity_label": "Ambientes mal segregados", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
295
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:confianca-na-experiencia-individual-sem-automacao", "manual_v2_entity_label": "Confiança na experiência individual sem automação", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
296
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:erros-de-configuracao", "manual_v2_entity_label": "Erros de configuração", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
297
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:ignorar-momentos-criticos-no-ciclo-de-vida-do-iac", "manual_v2_entity_label": "Ignorar momentos críticos no ciclo de vida do IaC", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
298
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:permissoes-excessivas", "manual_v2_entity_label": "Permissões excessivas", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
299
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:uso-de-modulos-maliciosos", "manual_v2_entity_label": "Uso de módulos maliciosos", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
300
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:catalogo-de-modulos-certificados", "manual_v2_entity_label": "Catálogo de módulos certificados", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
301
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:dashboards-de-validacao", "manual_v2_entity_label": "Dashboards de validação", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
302
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:gestao-centralizada-de-excecoes", "manual_v2_entity_label": "Gestão centralizada de exceções", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
303
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:pipelines-ci-cd-obrigatorios", "manual_v2_entity_label": "Pipelines CI/CD obrigatórios", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
304
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:uso-de-ferramentas-de-scanning", "manual_v2_entity_label": "Uso de ferramentas de scanning", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
305
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Defaults inseguros ou permissivos", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-132"}
306
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Configurações sem validação", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-133"}
307
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Campos críticos deixados em branco ou default", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-134"}
308
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes inconsistentes entre execuções", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-135"}
309
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de módulos inseguros ou sem validação", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-136"}
310
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Hardcoded de parâmetros críticos", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-137"}
311
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes inseguros provisionados por erro", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-138"}
312
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Provisionamento com permissões excessivas", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [{"antipattern_id": "sem:antipattern:permissoes-excessivas", "confidence": 0.76, "derivation": "semantic_antipattern_threat_link", "label": "Permissões excessivas", "link_type": "exposes"}], "threat_category": "STRIDE", "threat_id": "MT-139"}
313
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de tags de classificação de dados", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-140"}
314
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de dados reais em ambientes de teste", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-141"}
315
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segredos hardcoded ou mal geridos", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-142"}
316
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alterações aplicadas sem revisão", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-143"}
317
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de owner e accountability", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-144"}
318
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reutilização de módulos sem tracking", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-145"}
319
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aplicação de alterações inseguras por bypass", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-146"}
320
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Justificações informais ou inexistentes", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-147"}
321
- {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes provisionados com exceções acumuladas", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-148"}
322
- {"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`permissoes-excessivas`", "`MT-139`", "0.76", "alias_match, bundle_grounding, threat_label_match"]}
323
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-149", "manual_v2_entity_label": "Imagens base vulneráveis/obsoletas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
324
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-150", "manual_v2_entity_label": "Inclusão de dependências inseguras no build", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
325
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-151", "manual_v2_entity_label": "Conteúdo inesperado no _context_ de build", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
326
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-152", "manual_v2_entity_label": "Configurações inseguras no Dockerfile", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
327
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-153", "manual_v2_entity_label": "Imagens não assinadas / sem verificação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
328
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-154", "manual_v2_entity_label": "Substituição maliciosa em registo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
329
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-155", "manual_v2_entity_label": "Falta de trilho de auditoria (quem construiu o quê)", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
330
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-156", "manual_v2_entity_label": "Execução como root / capabilities excessivas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
331
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-157", "manual_v2_entity_label": "Montagens e volumes inseguros", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
332
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-158", "manual_v2_entity_label": "Falta de políticas de rede", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
333
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-159", "manual_v2_entity_label": "_Admission_ permissivo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
334
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-160", "manual_v2_entity_label": "Segredos embebidos em imagem", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
335
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-161", "manual_v2_entity_label": "Exposição em variáveis de ambiente", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
336
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-162", "manual_v2_entity_label": "Manifestos inseguros aprovados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
337
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-163", "manual_v2_entity_label": "Desalinhamento imagem↔manifesto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
338
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-164", "manual_v2_entity_label": "Falta de rastreabilidade de deploys", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
339
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-165", "manual_v2_entity_label": "_Shadow containers_ fora do pipeline", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
340
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-166", "manual_v2_entity_label": "_Drift_ de configuração", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
341
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 3–4*, *Policies: Gestão de Vulnerabilidades*, *Rastreabilidade: SSDF RV.1*", "associated_controls_text": "*Checklist 3–4*, *Policies: Gestão de Vulnerabilidades*, *Rastreabilidade: SSDF RV.1*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Imagens base vulneráveis/obsoletas", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "forte", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-149"}
342
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 3–4*", "associated_controls_text": "*Checklist 3–4*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de dependências inseguras no build", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-150"}
343
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Policies: Construção Segura de Imagens*", "associated_controls_text": "*Policies: Construção Segura de Imagens*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Conteúdo inesperado no _context_ de build", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-151"}
344
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 6*, *Policies: Construção Segura*", "associated_controls_text": "*Checklist 6*, *Policies: Construção Segura*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Configurações inseguras no Dockerfile", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-152"}
345
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 5 & 10–11*, *Policies: Assinatura e Proveniência*", "associated_controls_text": "*Checklist 5 & 10–11*, *Policies: Assinatura e Proveniência*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Imagens não assinadas / sem verificação", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-153"}
346
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Policies: Repositórios*", "associated_controls_text": "*Policies: Repositórios*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Substituição maliciosa em registo", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-154"}
347
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 14–15*, *Rastreabilidade: DSOMM Ops*", "associated_controls_text": "*Checklist 14–15*, *Rastreabilidade: DSOMM Ops*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de trilho de auditoria (quem construiu o quê)", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-155"}
348
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 7–9*, *Policies: Hardening de Runtime*", "associated_controls_text": "*Checklist 7–9*, *Policies: Hardening de Runtime*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução como root / capabilities excessivas", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-156"}
349
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Policies: Hardening de Runtime*", "associated_controls_text": "*Policies: Hardening de Runtime*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Montagens e volumes inseguros", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-157"}
350
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Policies: Runtime*, *Checklist 8*", "associated_controls_text": "*Policies: Runtime*, *Checklist 8*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de políticas de rede", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-158"}
351
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 11*, *Policies: Validação de Manifestos*", "associated_controls_text": "*Checklist 11*, *Policies: Validação de Manifestos*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "_Admission_ permissivo", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-159"}
352
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Policies: Segredos*, *Checklist 3 & 5*", "associated_controls_text": "*Policies: Segredos*, *Checklist 3 & 5*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segredos embebidos em imagem", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-160"}
353
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Policies: Segredos*", "associated_controls_text": "*Policies: Segredos*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exposição em variáveis de ambiente", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-161"}
354
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 11*, *Policies: Validação de Manifestos*", "associated_controls_text": "*Checklist 11*, *Policies: Validação de Manifestos*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Manifestos inseguros aprovados", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-162"}
355
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Rastreabilidade: SLSA*, *Checklist 2 & 10–11*", "associated_controls_text": "*Rastreabilidade: SLSA*, *Checklist 2 & 10–11*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Desalinhamento imagem↔manifesto", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-163"}
356
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 14–15*, *DSOMM Ops Monitoring*", "associated_controls_text": "*Checklist 14–15*, *DSOMM Ops Monitoring*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de rastreabilidade de deploys", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-164"}
357
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Rastreabilidade: DSOMM*", "associated_controls_text": "*Rastreabilidade: DSOMM*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "_Shadow containers_ fora do pipeline", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-165"}
358
- {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Policies: Runtime*, Cap. 08 (IaC)", "associated_controls_text": "*Policies: Runtime*, Cap. 08 (IaC)", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "_Drift_ de configuração", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-166"}
359
- {"coverage_status": "cwe_supporting", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "cwe_supporting", "row_cells": ["`CWE-1104`", "`?`", "supporting reference; primary anchor é Manual threat"]}
360
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-167", "manual_v2_entity_label": "Injeções (SQLi, OS Command, etc.)", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
361
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-168", "manual_v2_entity_label": "Falhas de controlo de acesso", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
362
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-169", "manual_v2_entity_label": "Lógicas de negócio exploráveis", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
363
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-170", "manual_v2_entity_label": "Regressão de segurança", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
364
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-171", "manual_v2_entity_label": "Baixa cobertura dos testes", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
365
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-172", "manual_v2_entity_label": "Falhas conhecidas não testadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
366
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-173", "manual_v2_entity_label": "Falhas detetadas mas não resolvidas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
367
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-174", "manual_v2_entity_label": "Equipa sem feedback técnico", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
368
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-175", "manual_v2_entity_label": "Validações não repetíveis", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
369
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-176", "manual_v2_entity_label": "Testes manuais não escaláveis", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
370
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-177", "manual_v2_entity_label": "Falta de testes antes de go-live", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
371
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-178", "manual_v2_entity_label": "Decisão de qualidade feita sem base", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
372
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-179", "manual_v2_entity_label": "Classes novas não detetadas por SAST/DAST", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
373
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-180", "manual_v2_entity_label": "Testes superficiais sem contexto técnico", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
374
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-181", "manual_v2_entity_label": "Ferramentas não calibradas por contexto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
375
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Injeções (SQLi, OS Command, etc.)", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-167"}
376
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas de controlo de acesso", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-168"}
377
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Lógicas de negócio exploráveis", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-169"}
378
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Regressão de segurança", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-170"}
379
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Baixa cobertura dos testes", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-171"}
380
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas conhecidas não testadas", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-172"}
381
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas detetadas mas não resolvidas", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-173"}
382
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Equipa sem feedback técnico", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-174"}
383
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validações não repetíveis", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-175"}
384
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Testes manuais não escaláveis", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-176"}
385
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de testes antes de go-live", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-177"}
386
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Decisão de qualidade feita sem base", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-178"}
387
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Classes novas não detetadas por SAST/DAST", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-179"}
388
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Testes superficiais sem contexto técnico", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-180"}
389
- {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ferramentas não calibradas por contexto", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-181"}
390
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-182", "manual_v2_entity_label": "Código em produção sem validação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
391
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-183", "manual_v2_entity_label": "Ativação funcional sem controlo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
392
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-184", "manual_v2_entity_label": "Promoção manual fora do CI/CD", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
393
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-185", "manual_v2_entity_label": "Deploy falhado sem rollback", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
394
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-186", "manual_v2_entity_label": "Feature irreversível", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
395
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-187", "manual_v2_entity_label": "Falha sem reação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
396
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-188", "manual_v2_entity_label": "Release conjunta sem segmentação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
397
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-189", "manual_v2_entity_label": "Feature exposta a todos os utilizadores", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
398
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-190", "manual_v2_entity_label": "Falta de validação operacional", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
399
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-191", "manual_v2_entity_label": "Falhas pós-deploy não detetadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
400
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-192", "manual_v2_entity_label": "Reação tardia a problemas críticos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
401
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-193", "manual_v2_entity_label": "Eventos críticos ignorados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
402
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-194", "manual_v2_entity_label": "Toggle ativado inadvertidamente", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
403
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-195", "manual_v2_entity_label": "Release sem segmentação geográfica ou lógica", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
404
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-196", "manual_v2_entity_label": "Execução de função crítica não validada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
405
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Código em produção sem validação", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-182"}
406
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ativação funcional sem controlo", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-183"}
407
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Promoção manual fora do CI/CD", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-184"}
408
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Deploy falhado sem rollback", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-185"}
409
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Feature irreversível", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-186"}
410
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falha sem reação", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-187"}
411
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Release conjunta sem segmentação", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-188"}
412
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Feature exposta a todos os utilizadores", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-189"}
413
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de validação operacional", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-190"}
414
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas pós-deploy não detetadas", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-191"}
415
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reação tardia a problemas críticos", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-192"}
416
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Eventos críticos ignorados", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-193"}
417
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Toggle ativado inadvertidamente", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-194"}
418
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Release sem segmentação geográfica ou lógica", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-195"}
419
- {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução de função crítica não validada", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-196"}
420
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-197", "manual_v2_entity_label": "Eventos críticos não registados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
421
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-198", "manual_v2_entity_label": "Logs voláteis ou truncados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
422
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-199", "manual_v2_entity_label": "Falta de rastreabilidade de execução", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
423
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-200", "manual_v2_entity_label": "Incidentes sem alerta", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
424
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-201", "manual_v2_entity_label": "Alertas ignorados por ruído", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
425
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-202", "manual_v2_entity_label": "Falta de correlação de alertas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
426
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-203", "manual_v2_entity_label": "Incidentes sem owner definido", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
427
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-204", "manual_v2_entity_label": "Reação ad-hoc ou tardia", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
428
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-205", "manual_v2_entity_label": "Eventos sem acionamento de ação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
429
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-206", "manual_v2_entity_label": "Ausência de métricas de postura", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
430
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-207", "manual_v2_entity_label": "Impossibilidade de priorizar riscos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
431
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-208", "manual_v2_entity_label": "Dados sem granularidade ou visão", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
432
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-209", "manual_v2_entity_label": "Novos sistemas sem monitorização", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
433
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-210", "manual_v2_entity_label": "Equipas ignoram alertas operacionais", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
434
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-211", "manual_v2_entity_label": "Dados não usados para melhoria contínua", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
435
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:alertas-nao-acionaveis", "manual_v2_entity_label": "Alertas não acionáveis", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
436
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:demasiados-alertas", "manual_v2_entity_label": "Demasiados alertas", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
437
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:detecao-sem-resposta", "manual_v2_entity_label": "Deteção sem resposta", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
438
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:falta-de-integracao-com-irp", "manual_v2_entity_label": "Falta de integração com IRP", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
439
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:logs-incompletos-ou-ignorados", "manual_v2_entity_label": "Logs incompletos ou ignorados", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
440
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:logs-nao-estruturados", "manual_v2_entity_label": "Logs não estruturados", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
441
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:retencao-insuficiente", "manual_v2_entity_label": "Retenção insuficiente", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
442
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:falhas-de-login", "manual_v2_entity_label": "Falhas de login", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
443
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:logs", "manual_v2_entity_label": "Logs", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
444
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:metricas-mttd-mttr", "manual_v2_entity_label": "Métricas MTTD/MTTR", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
445
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Eventos críticos não registados", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-197"}
446
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Logs voláteis ou truncados", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-198"}
447
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de rastreabilidade de execução", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-199"}
448
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Incidentes sem alerta", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [{"antipattern_id": "sem:antipattern:alertas-nao-acionaveis", "confidence": 0.7, "derivation": "semantic_antipattern_threat_link", "label": "Alertas não acionáveis", "link_type": "exposes"}], "threat_category": "STRIDE", "threat_id": "MT-200"}
449
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alertas ignorados por ruído", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-201"}
450
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de correlação de alertas", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-202"}
451
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Incidentes sem owner definido", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-203"}
452
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reação ad-hoc ou tardia", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-204"}
453
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Eventos sem acionamento de ação", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-205"}
454
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de métricas de postura", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-206"}
455
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Impossibilidade de priorizar riscos", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-207"}
456
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dados sem granularidade ou visão", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-208"}
457
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Novos sistemas sem monitorização", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-209"}
458
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Equipas ignoram alertas operacionais", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-210"}
459
- {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dados não usados para melhoria contínua", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-211"}
460
- {"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`alertas-nao-acionaveis`", "`MT-200`", "0.70", "alias_match, bundle_grounding, risk_match"]}
461
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-212", "manual_v2_entity_label": "Configuração insegura por desconhecimento", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
462
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-213", "manual_v2_entity_label": "Reutilização indevida de segredos ou tokens", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
463
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-214", "manual_v2_entity_label": "Acesso técnico concedido sem validação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
464
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-215", "manual_v2_entity_label": "Inclusão de terceiros sem validação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
465
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-216", "manual_v2_entity_label": "Falta de ownership sobre segurança", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
466
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-217", "manual_v2_entity_label": "Regressão comportamental / cultura frágil", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
467
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-218", "manual_v2_entity_label": "Formação não rastreável", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
468
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-219", "manual_v2_entity_label": "Formação desigual entre equipas ou funções", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
469
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-220", "manual_v2_entity_label": "Formação teórica sem impacto prático", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
470
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-221", "manual_v2_entity_label": "Conteúdos desatualizados ou não aplicáveis", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
471
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:dependencia-exclusiva-de-ferramentas-automatizadas", "manual_v2_entity_label": "dependência exclusiva de ferramentas automatizadas", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
472
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:falta-de-onboarding", "manual_v2_entity_label": "Falta de Onboarding", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
473
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:checklist-completo", "manual_v2_entity_label": "Checklist Completo", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
474
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:kpis-de-eficacia-formativa", "manual_v2_entity_label": "KPIs de eficácia formativa", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
475
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:kpis-de-formacao", "manual_v2_entity_label": "KPIs de Formação", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
476
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:resultados-de-quiz", "manual_v2_entity_label": "Resultados de Quizzes", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
477
- {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Configuração insegura por desconhecimento", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-212"}
478
- {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reutilização indevida de segredos ou tokens", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-213"}
479
- {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Acesso técnico concedido sem validação", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-214"}
480
- {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de terceiros sem validação", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-215"}
481
- {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de ownership sobre segurança", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-216"}
482
- {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Regressão comportamental / cultura frágil", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-217"}
483
- {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Formação não rastreável", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-218"}
484
- {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Formação desigual entre equipas ou funções", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-219"}
485
- {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Formação teórica sem impacto prático", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-220"}
486
- {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Conteúdos desatualizados ou não aplicáveis", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-221"}
487
- {"coverage_status": "cwe_supporting", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "cwe_supporting", "row_cells": ["`CWE-693`", "`?`", "supporting reference; primary anchor é Manual threat"]}
488
- {"coverage_status": "cwe_supporting", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "cwe_supporting", "row_cells": ["`CWE-798`", "`?`", "supporting reference; primary anchor é Manual threat"]}
489
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-222", "manual_v2_entity_label": "Adoção de fornecedor sem avaliação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
490
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-223", "manual_v2_entity_label": "Falta de cláusulas contratuais", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
491
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-224", "manual_v2_entity_label": "Uso de serviços sem rastreio", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
492
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-225", "manual_v2_entity_label": "Iniciativas paralelas sem coordenação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
493
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-226", "manual_v2_entity_label": "Falta de continuidade organizacional", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
494
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-227", "manual_v2_entity_label": "Risco de decisões legadas sem controlo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
495
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-228", "manual_v2_entity_label": "Decisões não revistas com mudança de contexto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
496
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-229", "manual_v2_entity_label": "Falta de governança em decisões históricas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
497
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-230", "manual_v2_entity_label": "Falta de conhecimento sobre o estado de segurança", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
498
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-231", "manual_v2_entity_label": "Estratégia de segurança desarticulada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
499
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-232", "manual_v2_entity_label": "Segurança definida mas não aplicada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
500
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-233", "manual_v2_entity_label": "Políticas de segurança não institucionalizadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
501
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:confianca-exclusiva-em-mecanismos-tecnicos-automatizados", "manual_v2_entity_label": "confiança exclusiva em mecanismos técnicos automatizados", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
502
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:limitacao-do-sbd-toe-a-pratica-tecnica-local", "manual_v2_entity_label": "limitação do SbD-ToE à prática técnica local", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
503
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:clausulas-contratuais-rastreadas", "manual_v2_entity_label": "Cláusulas contratuais rastreadas", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
504
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:excecoes-as-praticas-prescritas", "manual_v2_entity_label": "exceções às práticas prescritas", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
505
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:excecoes-registadas-e-aprovadas", "manual_v2_entity_label": "Exceções registadas e aprovadas", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
506
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:kpis-consolidados", "manual_v2_entity_label": "KPIs consolidados", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
507
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:kpis-de-governacao", "manual_v2_entity_label": "KPIs de governação", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
508
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:ligacao-explicita-a-frameworks-normativos", "manual_v2_entity_label": "Ligação explícita a frameworks normativos", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
509
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:registo-e-aprovacao-de-excecoes", "manual_v2_entity_label": "registo e aprovação de exceções", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
510
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:reporting-periodico-a-gestao", "manual_v2_entity_label": "reporting periódico à gestão", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
511
- {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:validacao-continua-de-fornecedores", "manual_v2_entity_label": "validação contínua de fornecedores", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
512
- {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Adoção de fornecedor sem avaliação", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-222"}
513
- {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de cláusulas contratuais", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-223"}
514
- {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de serviços sem rastreio", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-224"}
515
- {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Iniciativas paralelas sem coordenação", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-225"}
516
- {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de continuidade organizacional", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-226"}
517
- {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco de decisões legadas sem controlo", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-227"}
518
- {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Decisões não revistas com mudança de contexto", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-228"}
519
- {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de governança em decisões históricas", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-229"}
520
- {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de conhecimento sobre o estado de segurança", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-230"}
521
- {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "30, 90", "associated_controls_text": "30, 90", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Estratégia de segurança desarticulada", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-231"}
522
- {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança definida mas não aplicada", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "forte", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-232"}
523
- {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Políticas de segurança não institucionalizadas", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "ea6b396b9caa77beddf1096b56250fe073796e8f", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-233"}
1
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-001", "manual_v2_entity_label": "Falta de aplicação de controlos mínimos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
2
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-002", "manual_v2_entity_label": "Overengineering e fricção excessiva", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
3
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-003", "manual_v2_entity_label": "Inconsistência entre projetos com mesmo risco", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
4
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-004", "manual_v2_entity_label": "Segurança opcional em produtos low-risk", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
5
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-005", "manual_v2_entity_label": "Mudanças críticas sem reclassificação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
6
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-006", "manual_v2_entity_label": "Integração com APIs ou terceiros ignorada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
7
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-007", "manual_v2_entity_label": "Deploy com risco alterado não revisto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
8
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-008", "manual_v2_entity_label": "Versões diferentes com classificações divergentes", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
9
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-009", "manual_v2_entity_label": "Aceitação informal de riscos críticos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
10
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-010", "manual_v2_entity_label": "Impossibilidade de auditoria posterior", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
11
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-011", "manual_v2_entity_label": "Risco aceite por responsáveis inapropriados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
12
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-012", "manual_v2_entity_label": "Falta de explicabilidade regulatória", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
13
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-013", "manual_v2_entity_label": "Interfaces expostas mal avaliadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
14
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-014", "manual_v2_entity_label": "Dados sensíveis não reconhecidos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
15
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-015", "manual_v2_entity_label": "Assunção de ambientes seguros por defeito", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
16
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-016", "manual_v2_entity_label": "Ignorar dependências críticas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
17
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-017", "manual_v2_entity_label": "Risco residual nunca revisto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
18
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-018", "manual_v2_entity_label": "Falta de eventos de reavaliação planeados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
19
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-019", "manual_v2_entity_label": "Reclassificação dependente de exceções", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
20
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-020", "manual_v2_entity_label": "Decisões de risco sem feedback do negócio", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
21
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:aceitacao-de-risco-invalida", "manual_v2_entity_label": "aceitação de risco inválida", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
22
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:alteracao-na-exposicao-dados-impacto-ou-forma-de-decisoes-e-validacoes", "manual_v2_entity_label": "alteração na exposição, dados, impacto ou forma de decisões e validações", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
23
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de aplicação de controlos mínimos", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-001"}
24
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Overengineering e fricção excessiva", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-002"}
25
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inconsistência entre projetos com mesmo risco", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-003"}
26
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança opcional em produtos low-risk", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-004"}
27
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mudanças críticas sem reclassificação", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-005"}
28
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Integração com APIs ou terceiros ignorada", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-006"}
29
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Deploy com risco alterado não revisto", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-007"}
30
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Versões diferentes com classificações divergentes", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-008"}
31
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aceitação informal de riscos críticos", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [{"antipattern_id": "sem:antipattern:aceitacao-de-risco-invalida", "confidence": 0.7, "derivation": "semantic_antipattern_threat_link", "label": "aceitação de risco inválida", "link_type": "exposes"}], "threat_category": "STRIDE", "threat_id": "MT-009"}
32
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Impossibilidade de auditoria posterior", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-010"}
33
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco aceite por responsáveis inapropriados", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-011"}
34
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de explicabilidade regulatória", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-012"}
35
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Interfaces expostas mal avaliadas", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-013"}
36
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dados sensíveis não reconhecidos", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-014"}
37
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Assunção de ambientes seguros por defeito", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-015"}
38
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ignorar dependências críticas", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-016"}
39
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco residual nunca revisto", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-017"}
40
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de eventos de reavaliação planeados", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-018"}
41
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reclassificação dependente de exceções", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-019"}
42
+ {"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Classificação e governação por risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Decisões de risco sem feedback do negócio", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [{"antipattern_id": "sem:antipattern:aceitacao-de-risco-invalida", "confidence": 0.76, "derivation": "semantic_antipattern_threat_link", "label": "aceitação de risco inválida", "link_type": "exposes"}], "threat_category": "STRIDE", "threat_id": "MT-020"}
43
+ {"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`aceitacao-de-risco-invalida`", "`MT-009`", "0.70", "alias_match, bundle_grounding, risk_match"]}
44
+ {"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`aceitacao-de-risco-invalida`", "`MT-020`", "0.76", "alias_match, bundle_grounding, how_it_arises_match"]}
45
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-021", "manual_v2_entity_label": "Ausência de requisitos de segurança", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
46
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-022", "manual_v2_entity_label": "Definição ambígua ou não testável", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
47
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-023", "manual_v2_entity_label": "Requisitos genéricos não específicos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
48
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-024", "manual_v2_entity_label": "Falta de requisitos em sistemas legados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
49
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-025", "manual_v2_entity_label": "Requisitos não alinhados com risco", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
50
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-026", "manual_v2_entity_label": "Requisitos definidos mas nunca verificados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
51
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-027", "manual_v2_entity_label": "Validações inconsistentes entre projetos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
52
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-028", "manual_v2_entity_label": "Ausência de rastreio entre requisito e teste", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
53
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-029", "manual_v2_entity_label": "Requisitos não verificados em CI/CD", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
54
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-030", "manual_v2_entity_label": "Risco aceite sem validação documental", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
55
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-031", "manual_v2_entity_label": "Exceções a requisitos não documentadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
56
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-032", "manual_v2_entity_label": "Segurança omitida por “não ser funcional”", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
57
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-033", "manual_v2_entity_label": "Aceitação de exceções sem aprovação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
58
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-034", "manual_v2_entity_label": "Exceções não reverificadas no tempo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
59
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-035", "manual_v2_entity_label": "Não saber se requisitos foram aplicados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
60
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-036", "manual_v2_entity_label": "Requisitos aplicados mas não testados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
61
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-037", "manual_v2_entity_label": "Mudanças de requisitos não propagadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
62
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-038", "manual_v2_entity_label": "Ambiguidade entre requisito e controlo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
63
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de requisitos de segurança", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-021"}
64
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Definição ambígua ou não testável", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-022"}
65
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos genéricos não específicos", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-023"}
66
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de requisitos em sistemas legados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-024"}
67
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos não alinhados com risco", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-025"}
68
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos definidos mas nunca verificados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-026"}
69
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validações inconsistentes entre projetos", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-027"}
70
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de rastreio entre requisito e teste", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-028"}
71
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos não verificados em CI/CD", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-029"}
72
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco aceite sem validação documental", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-030"}
73
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções a requisitos não documentadas", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-031"}
74
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança omitida por “não ser funcional”", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-032"}
75
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aceitação de exceções sem aprovação", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-033"}
76
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções não reverificadas no tempo", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-034"}
77
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Não saber se requisitos foram aplicados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-035"}
78
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos aplicados mas não testados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-036"}
79
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mudanças de requisitos não propagadas", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-037"}
80
+ {"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Ambiente e tooling de desenvolvimento governados", "Desenvolvimento seguro e validação de código", "Integridade e governação de pipelines", "Criptografia aplicacional e protecção de dados", "Classificação e governação por risco", "Governação de fornecedores e exceções", "Gestão de identidades, acessos e ownership", "Identidade, autenticação e sessões aplicacionais", "Deploy seguro e reversível", "Infraestrutura como código governada", "Monitorização e resposta operacional", "Gestão de segredos e identidades operacionais", "Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambiguidade entre requisito e controlo", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-038"}
81
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-039", "manual_v2_entity_label": "Ameaças desconhecidas e não tratadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
82
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-040", "manual_v2_entity_label": "Prioridades de segurança mal definidas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
83
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-041", "manual_v2_entity_label": "Requisitos definidos sem base em ameaças", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
84
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-042", "manual_v2_entity_label": "Ameaças a privacidade ignoradas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
85
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-043", "manual_v2_entity_label": "Falta de cobertura de ameaças não técnicas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
86
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-044", "manual_v2_entity_label": "Arquitetura insegura não identificada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
87
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-045", "manual_v2_entity_label": "Validação superficial em design reviews", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
88
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-046", "manual_v2_entity_label": "Controles aplicados sem base em arquitetura", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
89
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-047", "manual_v2_entity_label": "Ausência de revisão em interfaces críticas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
90
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-048", "manual_v2_entity_label": "Ameaças descobertas demasiado tarde", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
91
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-049", "manual_v2_entity_label": "Mudanças críticas sem nova modelação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
92
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-050", "manual_v2_entity_label": "Descontinuidade entre equipas e fases", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
93
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-051", "manual_v2_entity_label": "Ameaças não visíveis na pipeline CI/CD", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
94
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-052", "manual_v2_entity_label": "Conhecimento de ameaças não acumulado", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
95
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-053", "manual_v2_entity_label": "Inconsistência entre projetos e equipas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
96
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-054", "manual_v2_entity_label": "Ferramentas desconectadas do ciclo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
97
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:ausencia-de-ameaca-no-modelo", "manual_v2_entity_label": "Ausência de ameaça no modelo", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
98
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:omissao-estrutural-de-ameacas", "manual_v2_entity_label": "Omissão estrutural de ameaças", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
99
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças desconhecidas e não tratadas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-039"}
100
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Prioridades de segurança mal definidas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-040"}
101
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos definidos sem base em ameaças", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-041"}
102
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças a privacidade ignoradas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "LINDDUN", "threat_id": "MT-042"}
103
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de cobertura de ameaças não técnicas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-043"}
104
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura insegura não identificada", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-044"}
105
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validação superficial em design reviews", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-045"}
106
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Controles aplicados sem base em arquitetura", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-046"}
107
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de revisão em interfaces críticas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-047"}
108
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças descobertas demasiado tarde", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-048"}
109
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mudanças críticas sem nova modelação", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-049"}
110
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Descontinuidade entre equipas e fases", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-050"}
111
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças não visíveis na pipeline CI/CD", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-051"}
112
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Conhecimento de ameaças não acumulado", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-052"}
113
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inconsistência entre projetos e equipas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-053"}
114
+ {"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Threat modeling e gestão de risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ferramentas desconectadas do ciclo", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-054"}
115
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-055", "manual_v2_entity_label": "Interfaces expostas sem isolamento", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
116
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-056", "manual_v2_entity_label": "Mistura de dados e controlo na mesma zona", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
117
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-057", "manual_v2_entity_label": "Acesso lateral não controlado entre módulos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
118
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-058", "manual_v2_entity_label": "Ausência de isolamento entre utilizadores", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
119
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-059", "manual_v2_entity_label": "Arquitetura inexistente ou desatualizada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
120
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-060", "manual_v2_entity_label": "Confusão sobre localização de controlos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
121
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-061", "manual_v2_entity_label": "Ambiguidade sobre fronteiras e zonas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
122
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-062", "manual_v2_entity_label": "Arquitetura não revê mecanismos de fallback", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
123
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-063", "manual_v2_entity_label": "Arquitetura nunca revista", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
124
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-064", "manual_v2_entity_label": "Alterações estruturais sem revalidação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
125
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-065", "manual_v2_entity_label": "Design informal ou ad hoc", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
126
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-066", "manual_v2_entity_label": "Exceções de arquitetura sem rasto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
127
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-067", "manual_v2_entity_label": "Requisitos de arquitetura não definidos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
128
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-068", "manual_v2_entity_label": "Impossibilidade de mapear decisões a controlos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
129
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-069", "manual_v2_entity_label": "Diagrama não reflete controlos implementados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
130
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-070", "manual_v2_entity_label": "Aplicações L1 tratadas como críticas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
131
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-071", "manual_v2_entity_label": "Sobredimensionamento de segurança da arquitetura", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
132
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-072", "manual_v2_entity_label": "Ambientes de execução não refletidos no design", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
133
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:dependencia-circular", "manual_v2_entity_label": "dependência circular", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
134
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:excecoes-nao-documentadas", "manual_v2_entity_label": "Exceções não documentadas", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
135
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:modelos-inconsistentes-incompletos-ou-desatualizados", "manual_v2_entity_label": "Modelos inconsistentes, incompletos ou desatualizados", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
136
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:threat-modeling-sem-arquitetura-clara", "manual_v2_entity_label": "Threat modeling sem arquitetura clara", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
137
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Interfaces expostas sem isolamento", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-055"}
138
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mistura de dados e controlo na mesma zona", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-056"}
139
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Acesso lateral não controlado entre módulos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-057"}
140
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de isolamento entre utilizadores", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-058"}
141
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura inexistente ou desatualizada", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-059"}
142
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Confusão sobre localização de controlos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-060"}
143
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambiguidade sobre fronteiras e zonas", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-061"}
144
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura não revê mecanismos de fallback", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-062"}
145
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura nunca revista", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-063"}
146
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alterações estruturais sem revalidação", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-064"}
147
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Design informal ou ad hoc", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-065"}
148
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções de arquitetura sem rasto", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-066"}
149
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos de arquitetura não definidos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-067"}
150
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Impossibilidade de mapear decisões a controlos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-068"}
151
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Diagrama não reflete controlos implementados", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-069"}
152
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aplicações L1 tratadas como críticas", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-070"}
153
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Sobredimensionamento de segurança da arquitetura", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-071"}
154
+ {"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Arquitetura segura e rastreável", "Segmentação e controlo arquitetural"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes de execução não refletidos no design", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-072"}
155
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-073", "manual_v2_entity_label": "Inclusão de bibliotecas com CVEs ativos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
156
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-074", "manual_v2_entity_label": "Dependências desatualizadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
157
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-075", "manual_v2_entity_label": "Ausência de registo de versões", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
158
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-076", "manual_v2_entity_label": "Inclusão de bibliotecas não auditadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
159
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-077", "manual_v2_entity_label": "Desconhecimento de bibliotecas utilizadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
160
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-078", "manual_v2_entity_label": "Falta de associação entre vulnerabilidade e artefacto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
161
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-079", "manual_v2_entity_label": "Falta de histórico de introdução de pacotes", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
162
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-080", "manual_v2_entity_label": "Inclusão de pacotes de repositórios maliciosos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
163
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-081", "manual_v2_entity_label": "Dependência transitiva com componente inseguro", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
164
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-082", "manual_v2_entity_label": "Pipeline injeta versão não autenticada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
165
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-083", "manual_v2_entity_label": "CVEs ignoradas sem justificação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
166
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-084", "manual_v2_entity_label": "Mitigações aplicadas sem rastreio", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
167
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-085", "manual_v2_entity_label": "Falta de ciclo de revisão de exceções", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
168
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-086", "manual_v2_entity_label": "Uso arbitrário de bibliotecas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
169
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-087", "manual_v2_entity_label": "Bibliotecas proibidas são usadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
170
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-088", "manual_v2_entity_label": "Falta de política de substituição", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
171
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-089", "manual_v2_entity_label": "Introdução de dependência vulnerável não declarada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
172
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-090", "manual_v2_entity_label": "Confusão de dependências", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
173
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-091", "manual_v2_entity_label": "Backdoor via ferramenta de build", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
174
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-092", "manual_v2_entity_label": "Drift de composição entre builds", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
175
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de bibliotecas com CVEs ativos", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-073"}
176
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dependências desatualizadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-074"}
177
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de registo de versões", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-075"}
178
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de bibliotecas não auditadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-076"}
179
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Desconhecimento de bibliotecas utilizadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-077"}
180
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de associação entre vulnerabilidade e artefacto", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-078"}
181
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de histórico de introdução de pacotes", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-079"}
182
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de pacotes de repositórios maliciosos", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-080"}
183
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dependência transitiva com componente inseguro", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-081"}
184
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Pipeline injeta versão não autenticada", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-082"}
185
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "CVEs ignoradas sem justificação", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-083"}
186
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mitigações aplicadas sem rastreio", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-084"}
187
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de ciclo de revisão de exceções", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-085"}
188
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso arbitrário de bibliotecas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-086"}
189
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Bibliotecas proibidas são usadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-087"}
190
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de política de substituição", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-088"}
191
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "SBOM boundary, revisão de dependências", "associated_controls_text": "SBOM boundary, revisão de dependências", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Introdução de dependência vulnerável não declarada", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-089"}
192
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "SCA, validação de origem", "associated_controls_text": "SCA, validação de origem", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Confusão de dependências", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-090"}
193
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "Governance de tooling", "associated_controls_text": "Governance de tooling", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Backdoor via ferramenta de build", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-091"}
194
+ {"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Inventário e análise de dependências"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Drift de composição entre builds", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-092"}
195
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-093", "manual_v2_entity_label": "Inclusão de padrões inseguros por hábito", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
196
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-094", "manual_v2_entity_label": "Uso de funções descontinuadas ou perigosas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
197
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-095", "manual_v2_entity_label": "Injeção de código sem escape adequado", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
198
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-096", "manual_v2_entity_label": "Código inseguro sem deteção", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
199
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-097", "manual_v2_entity_label": "Ausência de rastreabilidade entre problemas e decisões", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
200
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-098", "manual_v2_entity_label": "Validação apenas reativa (ex: testes QA)", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
201
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-099", "manual_v2_entity_label": "Segurança removida por “incompatibilidade”", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
202
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-100", "manual_v2_entity_label": "Exceções não revistas ou revalidadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
203
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-101", "manual_v2_entity_label": "Desvios não rastreados entre guideline e prática", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
204
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-102", "manual_v2_entity_label": "Geração de código inseguro via IA", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
205
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-103", "manual_v2_entity_label": "Inclusão de vulnerabilidades conhecidas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
206
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-104", "manual_v2_entity_label": "Falta de accountability sobre código gerado", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
207
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-105", "manual_v2_entity_label": "Inclusão de bibliotecas descontinuadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
208
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-106", "manual_v2_entity_label": "Falta de justificação para uso de dependência insegura", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
209
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-107", "manual_v2_entity_label": "Componente vulnerável mantido no build final", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
210
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-108", "manual_v2_entity_label": "Inconsistência entre equipas e projetos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
211
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-109", "manual_v2_entity_label": "Inexistência de baseline de segurança", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
212
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-110", "manual_v2_entity_label": "Fraca responsabilização pela segurança do código", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
213
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de padrões inseguros por hábito", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-093"}
214
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de funções descontinuadas ou perigosas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-094"}
215
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Injeção de código sem escape adequado", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-095"}
216
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Código inseguro sem deteção", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-096"}
217
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de rastreabilidade entre problemas e decisões", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-097"}
218
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validação apenas reativa (ex: testes QA)", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-098"}
219
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança removida por “incompatibilidade”", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-099"}
220
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções não revistas ou revalidadas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-100"}
221
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Desvios não rastreados entre guideline e prática", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-101"}
222
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Geração de código inseguro via IA", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-102"}
223
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de vulnerabilidades conhecidas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-103"}
224
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de accountability sobre código gerado", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-104"}
225
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de bibliotecas descontinuadas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-105"}
226
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de justificação para uso de dependência insegura", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-106"}
227
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Componente vulnerável mantido no build final", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-107"}
228
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inconsistência entre equipas e projetos", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-108"}
229
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inexistência de baseline de segurança", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-109"}
230
+ {"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Desenvolvimento seguro e validação de código"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Fraca responsabilização pela segurança do código", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-110"}
231
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-111", "manual_v2_entity_label": "Execução de código não autorizado em pipeline", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
232
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-112", "manual_v2_entity_label": "Comprometimento do ambiente de build", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
233
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-113", "manual_v2_entity_label": "Elevação de privilégios no pipeline", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
234
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-114", "manual_v2_entity_label": "Push não autorizado para branches protegidas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
235
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-115", "manual_v2_entity_label": "Execução de código não auditado", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
236
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-116", "manual_v2_entity_label": "Substituição silenciosa de código legítimo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
237
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-117", "manual_v2_entity_label": "Build forjado fora da pipeline", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
238
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-118", "manual_v2_entity_label": "Injeção de lógica dinâmica em pipeline", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
239
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-119", "manual_v2_entity_label": "Uso de componentes externos inseguros", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
240
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-120", "manual_v2_entity_label": "Vazamento de segredos via logs", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
241
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-121", "manual_v2_entity_label": "Segredos hardcoded", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
242
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-122", "manual_v2_entity_label": "Reutilização de segredos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
243
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-123", "manual_v2_entity_label": "Ausência de gates de segurança", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
244
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-124", "manual_v2_entity_label": "Validações não executadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
245
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-125", "manual_v2_entity_label": "Falta de rastreabilidade", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
246
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-126", "manual_v2_entity_label": "Bypass de controlos sem rasto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
247
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-127", "manual_v2_entity_label": "Alterações críticas sem visibilidade", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
248
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-128", "manual_v2_entity_label": "Promoções sem responsável humano", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
249
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-129", "manual_v2_entity_label": "Evidência plausível sem execução", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
250
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-130", "manual_v2_entity_label": "Não-determinismo do pipeline", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
251
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-131", "manual_v2_entity_label": "Exfiltração de contexto sensível", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
252
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:exposicao-excessiva-de-contexto-em-logs-e-artefactos", "manual_v2_entity_label": "exposição excessiva de contexto em logs e artefactos", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
253
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:uso-de-segredos-estaticos", "manual_v2_entity_label": "uso de segredos estáticos", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
254
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:sinal-automatico", "manual_v2_entity_label": "sinal automático", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
255
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Design seguro de pipelines; isolamento de runners", "associated_controls_text": "Design seguro de pipelines; isolamento de runners", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução de código não autorizado em pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-111"}
256
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Isolamento e efemeridade de runners", "associated_controls_text": "Isolamento e efemeridade de runners", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Comprometimento do ambiente de build", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-112"}
257
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Hardening de pipelines", "associated_controls_text": "Hardening de pipelines", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Elevação de privilégios no pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-113"}
258
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Gestão segura de código-fonte", "associated_controls_text": "Gestão segura de código-fonte", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Push não autorizado para branches protegidas", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-114"}
259
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Políticas de execução", "associated_controls_text": "Políticas de execução", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução de código não auditado", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-115"}
260
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Rastreabilidade e assinaturas", "associated_controls_text": "Rastreabilidade e assinaturas", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Substituição silenciosa de código legítimo", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-116"}
261
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Integridade e proveniência", "associated_controls_text": "Integridade e proveniência", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Build forjado fora da pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-117"}
262
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Segurança do código de pipeline", "associated_controls_text": "Segurança do código de pipeline", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Injeção de lógica dinâmica em pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-118"}
263
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Controlo de dependências", "associated_controls_text": "Controlo de dependências", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de componentes externos inseguros", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-119"}
264
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Gestão de segredos", "associated_controls_text": "Gestão de segredos", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Vazamento de segredos via logs", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-120"}
265
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Gestão de segredos", "associated_controls_text": "Gestão de segredos", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segredos hardcoded", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [{"antipattern_id": "sem:antipattern:uso-de-segredos-estaticos", "confidence": 0.76, "derivation": "semantic_antipattern_threat_link", "label": "uso de segredos estáticos", "link_type": "exposes"}], "threat_category": "STRIDE", "threat_id": "MT-121"}
266
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Lifecycle de segredos", "associated_controls_text": "Lifecycle de segredos", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reutilização de segredos", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-122"}
267
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Políticas de gates", "associated_controls_text": "Políticas de gates", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de gates de segurança", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-123"}
268
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Validações integradas", "associated_controls_text": "Validações integradas", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validações não executadas", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-124"}
269
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Rastreabilidade", "associated_controls_text": "Rastreabilidade", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de rastreabilidade", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-125"}
270
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Gestão de exceções", "associated_controls_text": "Gestão de exceções", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Bypass de controlos sem rasto", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-126"}
271
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Governação contínua", "associated_controls_text": "Governação contínua", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alterações críticas sem visibilidade", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-127"}
272
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Gates e governação", "associated_controls_text": "Gates e governação", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Promoções sem responsável humano", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-128"}
273
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Evidência empírica", "associated_controls_text": "Evidência empírica", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Evidência plausível sem execução", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-129"}
274
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Reprodutibilidade", "associated_controls_text": "Reprodutibilidade", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Não-determinismo do pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-130"}
275
+ {"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Integridade e governação de pipelines", "Gestão de segredos e identidades operacionais"], "associated_controls": "Controlo de integrações", "associated_controls_text": "Controlo de integrações", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exfiltração de contexto sensível", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-131"}
276
+ {"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`uso-de-segredos-estaticos`", "`MT-121`", "0.76", "alias_match, bundle_grounding, threat_label_match"]}
277
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-132", "manual_v2_entity_label": "Defaults inseguros ou permissivos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
278
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-133", "manual_v2_entity_label": "Configurações sem validação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
279
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-134", "manual_v2_entity_label": "Campos críticos deixados em branco ou default", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
280
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-135", "manual_v2_entity_label": "Ambientes inconsistentes entre execuções", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
281
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-136", "manual_v2_entity_label": "Uso de módulos inseguros ou sem validação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
282
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-137", "manual_v2_entity_label": "Hardcoded de parâmetros críticos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
283
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-138", "manual_v2_entity_label": "Ambientes inseguros provisionados por erro", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
284
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-139", "manual_v2_entity_label": "Provisionamento com permissões excessivas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
285
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-140", "manual_v2_entity_label": "Falta de tags de classificação de dados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
286
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-141", "manual_v2_entity_label": "Uso de dados reais em ambientes de teste", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
287
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-142", "manual_v2_entity_label": "Segredos hardcoded ou mal geridos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
288
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-143", "manual_v2_entity_label": "Alterações aplicadas sem revisão", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
289
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-144", "manual_v2_entity_label": "Falta de owner e accountability", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
290
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-145", "manual_v2_entity_label": "Reutilização de módulos sem tracking", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
291
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-146", "manual_v2_entity_label": "Aplicação de alterações inseguras por bypass", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
292
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-147", "manual_v2_entity_label": "Justificações informais ou inexistentes", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
293
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-148", "manual_v2_entity_label": "Ambientes provisionados com exceções acumuladas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
294
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:ambientes-mal-segregados", "manual_v2_entity_label": "Ambientes mal segregados", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
295
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:confianca-na-experiencia-individual-sem-automacao", "manual_v2_entity_label": "Confiança na experiência individual sem automação", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
296
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:erros-de-configuracao", "manual_v2_entity_label": "Erros de configuração", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
297
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:ignorar-momentos-criticos-no-ciclo-de-vida-do-iac", "manual_v2_entity_label": "Ignorar momentos críticos no ciclo de vida do IaC", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
298
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:permissoes-excessivas", "manual_v2_entity_label": "Permissões excessivas", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
299
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:uso-de-modulos-maliciosos", "manual_v2_entity_label": "Uso de módulos maliciosos", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
300
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:catalogo-de-modulos-certificados", "manual_v2_entity_label": "Catálogo de módulos certificados", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
301
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:dashboards-de-validacao", "manual_v2_entity_label": "Dashboards de validação", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
302
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:gestao-centralizada-de-excecoes", "manual_v2_entity_label": "Gestão centralizada de exceções", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
303
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:pipelines-ci-cd-obrigatorios", "manual_v2_entity_label": "Pipelines CI/CD obrigatórios", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
304
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:uso-de-ferramentas-de-scanning", "manual_v2_entity_label": "Uso de ferramentas de scanning", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
305
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Defaults inseguros ou permissivos", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-132"}
306
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Configurações sem validação", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-133"}
307
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Campos críticos deixados em branco ou default", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-134"}
308
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes inconsistentes entre execuções", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-135"}
309
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de módulos inseguros ou sem validação", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-136"}
310
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Hardcoded de parâmetros críticos", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-137"}
311
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes inseguros provisionados por erro", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-138"}
312
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Provisionamento com permissões excessivas", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [{"antipattern_id": "sem:antipattern:permissoes-excessivas", "confidence": 0.76, "derivation": "semantic_antipattern_threat_link", "label": "Permissões excessivas", "link_type": "exposes"}], "threat_category": "STRIDE", "threat_id": "MT-139"}
313
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de tags de classificação de dados", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-140"}
314
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de dados reais em ambientes de teste", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-141"}
315
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segredos hardcoded ou mal geridos", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-142"}
316
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alterações aplicadas sem revisão", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-143"}
317
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de owner e accountability", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-144"}
318
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reutilização de módulos sem tracking", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-145"}
319
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aplicação de alterações inseguras por bypass", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-146"}
320
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Justificações informais ou inexistentes", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-147"}
321
+ {"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Infraestrutura como código governada", "Gestão de segredos e identidades operacionais"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes provisionados com exceções acumuladas", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-148"}
322
+ {"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`permissoes-excessivas`", "`MT-139`", "0.76", "alias_match, bundle_grounding, threat_label_match"]}
323
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-149", "manual_v2_entity_label": "Imagens base vulneráveis/obsoletas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
324
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-150", "manual_v2_entity_label": "Inclusão de dependências inseguras no build", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
325
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-151", "manual_v2_entity_label": "Conteúdo inesperado no _context_ de build", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
326
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-152", "manual_v2_entity_label": "Configurações inseguras no Dockerfile", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
327
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-153", "manual_v2_entity_label": "Imagens não assinadas / sem verificação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
328
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-154", "manual_v2_entity_label": "Substituição maliciosa em registo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
329
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-155", "manual_v2_entity_label": "Falta de trilho de auditoria (quem construiu o quê)", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
330
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-156", "manual_v2_entity_label": "Execução como root / capabilities excessivas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
331
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-157", "manual_v2_entity_label": "Montagens e volumes inseguros", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
332
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-158", "manual_v2_entity_label": "Falta de políticas de rede", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
333
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-159", "manual_v2_entity_label": "_Admission_ permissivo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
334
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-160", "manual_v2_entity_label": "Segredos embebidos em imagem", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
335
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-161", "manual_v2_entity_label": "Exposição em variáveis de ambiente", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
336
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-162", "manual_v2_entity_label": "Manifestos inseguros aprovados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
337
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-163", "manual_v2_entity_label": "Desalinhamento imagem↔manifesto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
338
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-164", "manual_v2_entity_label": "Falta de rastreabilidade de deploys", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
339
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-165", "manual_v2_entity_label": "_Shadow containers_ fora do pipeline", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
340
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-166", "manual_v2_entity_label": "_Drift_ de configuração", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
341
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 3–4*, *Policies: Gestão de Vulnerabilidades*, *Rastreabilidade: SSDF RV.1*", "associated_controls_text": "*Checklist 3–4*, *Policies: Gestão de Vulnerabilidades*, *Rastreabilidade: SSDF RV.1*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Imagens base vulneráveis/obsoletas", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "forte", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-149"}
342
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 3–4*", "associated_controls_text": "*Checklist 3–4*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de dependências inseguras no build", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-150"}
343
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Policies: Construção Segura de Imagens*", "associated_controls_text": "*Policies: Construção Segura de Imagens*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Conteúdo inesperado no _context_ de build", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-151"}
344
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 6*, *Policies: Construção Segura*", "associated_controls_text": "*Checklist 6*, *Policies: Construção Segura*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Configurações inseguras no Dockerfile", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-152"}
345
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 5 & 10–11*, *Policies: Assinatura e Proveniência*", "associated_controls_text": "*Checklist 5 & 10–11*, *Policies: Assinatura e Proveniência*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Imagens não assinadas / sem verificação", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-153"}
346
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Policies: Repositórios*", "associated_controls_text": "*Policies: Repositórios*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Substituição maliciosa em registo", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-154"}
347
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 14–15*, *Rastreabilidade: DSOMM Ops*", "associated_controls_text": "*Checklist 14–15*, *Rastreabilidade: DSOMM Ops*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de trilho de auditoria (quem construiu o quê)", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-155"}
348
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 7–9*, *Policies: Hardening de Runtime*", "associated_controls_text": "*Checklist 7–9*, *Policies: Hardening de Runtime*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução como root / capabilities excessivas", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-156"}
349
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Policies: Hardening de Runtime*", "associated_controls_text": "*Policies: Hardening de Runtime*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Montagens e volumes inseguros", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-157"}
350
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Policies: Runtime*, *Checklist 8*", "associated_controls_text": "*Policies: Runtime*, *Checklist 8*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de políticas de rede", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-158"}
351
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 11*, *Policies: Validação de Manifestos*", "associated_controls_text": "*Checklist 11*, *Policies: Validação de Manifestos*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "_Admission_ permissivo", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-159"}
352
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Policies: Segredos*, *Checklist 3 & 5*", "associated_controls_text": "*Policies: Segredos*, *Checklist 3 & 5*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segredos embebidos em imagem", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-160"}
353
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Policies: Segredos*", "associated_controls_text": "*Policies: Segredos*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exposição em variáveis de ambiente", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-161"}
354
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 11*, *Policies: Validação de Manifestos*", "associated_controls_text": "*Checklist 11*, *Policies: Validação de Manifestos*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Manifestos inseguros aprovados", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-162"}
355
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Rastreabilidade: SLSA*, *Checklist 2 & 10–11*", "associated_controls_text": "*Rastreabilidade: SLSA*, *Checklist 2 & 10–11*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Desalinhamento imagem↔manifesto", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-163"}
356
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Checklist 14–15*, *DSOMM Ops Monitoring*", "associated_controls_text": "*Checklist 14–15*, *DSOMM Ops Monitoring*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de rastreabilidade de deploys", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-164"}
357
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Rastreabilidade: DSOMM*", "associated_controls_text": "*Rastreabilidade: DSOMM*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "_Shadow containers_ fora do pipeline", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-165"}
358
+ {"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Supply chain segura de imagens e containers"], "associated_controls": "*Policies: Runtime*, Cap. 08 (IaC)", "associated_controls_text": "*Policies: Runtime*, Cap. 08 (IaC)", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "_Drift_ de configuração", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-166"}
359
+ {"coverage_status": "cwe_supporting", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "cwe_supporting", "row_cells": ["`CWE-1104`", "`?`", "supporting reference; primary anchor é Manual threat"]}
360
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-167", "manual_v2_entity_label": "Injeções (SQLi, OS Command, etc.)", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
361
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-168", "manual_v2_entity_label": "Falhas de controlo de acesso", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
362
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-169", "manual_v2_entity_label": "Lógicas de negócio exploráveis", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
363
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-170", "manual_v2_entity_label": "Regressão de segurança", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
364
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-171", "manual_v2_entity_label": "Baixa cobertura dos testes", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
365
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-172", "manual_v2_entity_label": "Falhas conhecidas não testadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
366
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-173", "manual_v2_entity_label": "Falhas detetadas mas não resolvidas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
367
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-174", "manual_v2_entity_label": "Equipa sem feedback técnico", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
368
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-175", "manual_v2_entity_label": "Validações não repetíveis", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
369
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-176", "manual_v2_entity_label": "Testes manuais não escaláveis", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
370
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-177", "manual_v2_entity_label": "Falta de testes antes de go-live", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
371
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-178", "manual_v2_entity_label": "Decisão de qualidade feita sem base", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
372
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-179", "manual_v2_entity_label": "Classes novas não detetadas por SAST/DAST", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
373
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-180", "manual_v2_entity_label": "Testes superficiais sem contexto técnico", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
374
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-181", "manual_v2_entity_label": "Ferramentas não calibradas por contexto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
375
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Injeções (SQLi, OS Command, etc.)", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-167"}
376
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas de controlo de acesso", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-168"}
377
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Lógicas de negócio exploráveis", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-169"}
378
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Regressão de segurança", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-170"}
379
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Baixa cobertura dos testes", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-171"}
380
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas conhecidas não testadas", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-172"}
381
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas detetadas mas não resolvidas", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-173"}
382
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Equipa sem feedback técnico", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-174"}
383
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validações não repetíveis", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-175"}
384
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Testes manuais não escaláveis", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-176"}
385
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de testes antes de go-live", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-177"}
386
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Decisão de qualidade feita sem base", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-178"}
387
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Classes novas não detetadas por SAST/DAST", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-179"}
388
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Testes superficiais sem contexto técnico", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-180"}
389
+ {"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Testes de segurança baseados em risco"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ferramentas não calibradas por contexto", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-181"}
390
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-182", "manual_v2_entity_label": "Código em produção sem validação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
391
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-183", "manual_v2_entity_label": "Ativação funcional sem controlo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
392
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-184", "manual_v2_entity_label": "Promoção manual fora do CI/CD", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
393
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-185", "manual_v2_entity_label": "Deploy falhado sem rollback", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
394
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-186", "manual_v2_entity_label": "Feature irreversível", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
395
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-187", "manual_v2_entity_label": "Falha sem reação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
396
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-188", "manual_v2_entity_label": "Release conjunta sem segmentação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
397
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-189", "manual_v2_entity_label": "Feature exposta a todos os utilizadores", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
398
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-190", "manual_v2_entity_label": "Falta de validação operacional", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
399
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-191", "manual_v2_entity_label": "Falhas pós-deploy não detetadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
400
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-192", "manual_v2_entity_label": "Reação tardia a problemas críticos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
401
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-193", "manual_v2_entity_label": "Eventos críticos ignorados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
402
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-194", "manual_v2_entity_label": "Toggle ativado inadvertidamente", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
403
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-195", "manual_v2_entity_label": "Release sem segmentação geográfica ou lógica", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
404
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-196", "manual_v2_entity_label": "Execução de função crítica não validada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
405
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Código em produção sem validação", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-182"}
406
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ativação funcional sem controlo", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-183"}
407
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Promoção manual fora do CI/CD", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-184"}
408
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Deploy falhado sem rollback", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-185"}
409
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Feature irreversível", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-186"}
410
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falha sem reação", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-187"}
411
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Release conjunta sem segmentação", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-188"}
412
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Feature exposta a todos os utilizadores", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-189"}
413
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de validação operacional", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-190"}
414
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas pós-deploy não detetadas", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-191"}
415
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reação tardia a problemas críticos", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-192"}
416
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Eventos críticos ignorados", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-193"}
417
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Toggle ativado inadvertidamente", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-194"}
418
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Release sem segmentação geográfica ou lógica", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-195"}
419
+ {"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Deploy seguro e reversível"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução de função crítica não validada", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-196"}
420
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-197", "manual_v2_entity_label": "Eventos críticos não registados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
421
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-198", "manual_v2_entity_label": "Logs voláteis ou truncados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
422
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-199", "manual_v2_entity_label": "Falta de rastreabilidade de execução", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
423
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-200", "manual_v2_entity_label": "Incidentes sem alerta", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
424
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-201", "manual_v2_entity_label": "Alertas ignorados por ruído", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
425
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-202", "manual_v2_entity_label": "Falta de correlação de alertas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
426
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-203", "manual_v2_entity_label": "Incidentes sem owner definido", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
427
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-204", "manual_v2_entity_label": "Reação ad-hoc ou tardia", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
428
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-205", "manual_v2_entity_label": "Eventos sem acionamento de ação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
429
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-206", "manual_v2_entity_label": "Ausência de métricas de postura", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
430
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-207", "manual_v2_entity_label": "Impossibilidade de priorizar riscos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
431
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-208", "manual_v2_entity_label": "Dados sem granularidade ou visão", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
432
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-209", "manual_v2_entity_label": "Novos sistemas sem monitorização", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
433
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-210", "manual_v2_entity_label": "Equipas ignoram alertas operacionais", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
434
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-211", "manual_v2_entity_label": "Dados não usados para melhoria contínua", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
435
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:alertas-nao-acionaveis", "manual_v2_entity_label": "Alertas não acionáveis", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
436
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:demasiados-alertas", "manual_v2_entity_label": "Demasiados alertas", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
437
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:detecao-sem-resposta", "manual_v2_entity_label": "Deteção sem resposta", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
438
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:falta-de-integracao-com-irp", "manual_v2_entity_label": "Falta de integração com IRP", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
439
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:logs-incompletos-ou-ignorados", "manual_v2_entity_label": "Logs incompletos ou ignorados", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
440
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:logs-nao-estruturados", "manual_v2_entity_label": "Logs não estruturados", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
441
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:retencao-insuficiente", "manual_v2_entity_label": "Retenção insuficiente", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
442
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:falhas-de-login", "manual_v2_entity_label": "Falhas de login", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
443
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:logs", "manual_v2_entity_label": "Logs", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
444
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:metricas-mttd-mttr", "manual_v2_entity_label": "Métricas MTTD/MTTR", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
445
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Eventos críticos não registados", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-197"}
446
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Logs voláteis ou truncados", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-198"}
447
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de rastreabilidade de execução", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-199"}
448
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Incidentes sem alerta", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [{"antipattern_id": "sem:antipattern:alertas-nao-acionaveis", "confidence": 0.7, "derivation": "semantic_antipattern_threat_link", "label": "Alertas não acionáveis", "link_type": "exposes"}], "threat_category": "STRIDE", "threat_id": "MT-200"}
449
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alertas ignorados por ruído", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-201"}
450
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de correlação de alertas", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-202"}
451
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Incidentes sem owner definido", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-203"}
452
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reação ad-hoc ou tardia", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-204"}
453
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Eventos sem acionamento de ação", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-205"}
454
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de métricas de postura", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-206"}
455
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Impossibilidade de priorizar riscos", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-207"}
456
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dados sem granularidade ou visão", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-208"}
457
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Novos sistemas sem monitorização", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-209"}
458
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Equipas ignoram alertas operacionais", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-210"}
459
+ {"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Monitorização e resposta operacional"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dados não usados para melhoria contínua", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-211"}
460
+ {"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`alertas-nao-acionaveis`", "`MT-200`", "0.70", "alias_match, bundle_grounding, risk_match"]}
461
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-212", "manual_v2_entity_label": "Configuração insegura por desconhecimento", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
462
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-213", "manual_v2_entity_label": "Reutilização indevida de segredos ou tokens", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
463
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-214", "manual_v2_entity_label": "Acesso técnico concedido sem validação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
464
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-215", "manual_v2_entity_label": "Inclusão de terceiros sem validação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
465
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-216", "manual_v2_entity_label": "Falta de ownership sobre segurança", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
466
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-217", "manual_v2_entity_label": "Regressão comportamental / cultura frágil", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
467
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-218", "manual_v2_entity_label": "Formação não rastreável", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
468
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-219", "manual_v2_entity_label": "Formação desigual entre equipas ou funções", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
469
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-220", "manual_v2_entity_label": "Formação teórica sem impacto prático", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
470
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-221", "manual_v2_entity_label": "Conteúdos desatualizados ou não aplicáveis", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
471
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:dependencia-exclusiva-de-ferramentas-automatizadas", "manual_v2_entity_label": "dependência exclusiva de ferramentas automatizadas", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
472
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:falta-de-onboarding", "manual_v2_entity_label": "Falta de Onboarding", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
473
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:checklist-completo", "manual_v2_entity_label": "Checklist Completo", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
474
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:kpis-de-eficacia-formativa", "manual_v2_entity_label": "KPIs de eficácia formativa", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
475
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:kpis-de-formacao", "manual_v2_entity_label": "KPIs de Formação", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
476
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:resultados-de-quiz", "manual_v2_entity_label": "Resultados de Quizzes", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
477
+ {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Configuração insegura por desconhecimento", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-212"}
478
+ {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reutilização indevida de segredos ou tokens", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-213"}
479
+ {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Acesso técnico concedido sem validação", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-214"}
480
+ {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de terceiros sem validação", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-215"}
481
+ {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de ownership sobre segurança", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-216"}
482
+ {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Regressão comportamental / cultura frágil", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-217"}
483
+ {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Formação não rastreável", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-218"}
484
+ {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Formação desigual entre equipas ou funções", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-219"}
485
+ {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Formação teórica sem impacto prático", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-220"}
486
+ {"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Capacitação e onboarding de segurança"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Conteúdos desatualizados ou não aplicáveis", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-221"}
487
+ {"coverage_status": "cwe_supporting", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "cwe_supporting", "row_cells": ["`CWE-693`", "`?`", "supporting reference; primary anchor é Manual threat"]}
488
+ {"coverage_status": "cwe_supporting", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "cwe_supporting", "row_cells": ["`CWE-798`", "`?`", "supporting reference; primary anchor é Manual threat"]}
489
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-222", "manual_v2_entity_label": "Adoção de fornecedor sem avaliação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
490
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-223", "manual_v2_entity_label": "Falta de cláusulas contratuais", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
491
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-224", "manual_v2_entity_label": "Uso de serviços sem rastreio", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
492
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-225", "manual_v2_entity_label": "Iniciativas paralelas sem coordenação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
493
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-226", "manual_v2_entity_label": "Falta de continuidade organizacional", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
494
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-227", "manual_v2_entity_label": "Risco de decisões legadas sem controlo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
495
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-228", "manual_v2_entity_label": "Decisões não revistas com mudança de contexto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
496
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-229", "manual_v2_entity_label": "Falta de governança em decisões históricas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
497
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-230", "manual_v2_entity_label": "Falta de conhecimento sobre o estado de segurança", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
498
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-231", "manual_v2_entity_label": "Estratégia de segurança desarticulada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
499
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-232", "manual_v2_entity_label": "Segurança definida mas não aplicada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
500
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-233", "manual_v2_entity_label": "Políticas de segurança não institucionalizadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
501
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:confianca-exclusiva-em-mecanismos-tecnicos-automatizados", "manual_v2_entity_label": "confiança exclusiva em mecanismos técnicos automatizados", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
502
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:limitacao-do-sbd-toe-a-pratica-tecnica-local", "manual_v2_entity_label": "limitação do SbD-ToE à prática técnica local", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
503
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:clausulas-contratuais-rastreadas", "manual_v2_entity_label": "Cláusulas contratuais rastreadas", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
504
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:excecoes-as-praticas-prescritas", "manual_v2_entity_label": "exceções às práticas prescritas", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
505
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:excecoes-registadas-e-aprovadas", "manual_v2_entity_label": "Exceções registadas e aprovadas", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
506
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:kpis-consolidados", "manual_v2_entity_label": "KPIs consolidados", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
507
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:kpis-de-governacao", "manual_v2_entity_label": "KPIs de governação", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
508
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:ligacao-explicita-a-frameworks-normativos", "manual_v2_entity_label": "Ligação explícita a frameworks normativos", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
509
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:registo-e-aprovacao-de-excecoes", "manual_v2_entity_label": "registo e aprovação de exceções", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
510
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:reporting-periodico-a-gestao", "manual_v2_entity_label": "reporting periódico à gestão", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
511
+ {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:validacao-continua-de-fornecedores", "manual_v2_entity_label": "validação contínua de fornecedores", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
512
+ {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Adoção de fornecedor sem avaliação", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-222"}
513
+ {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de cláusulas contratuais", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-223"}
514
+ {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de serviços sem rastreio", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-224"}
515
+ {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Iniciativas paralelas sem coordenação", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-225"}
516
+ {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de continuidade organizacional", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-226"}
517
+ {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco de decisões legadas sem controlo", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-227"}
518
+ {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Decisões não revistas com mudança de contexto", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-228"}
519
+ {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de governança em decisões históricas", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-229"}
520
+ {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de conhecimento sobre o estado de segurança", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-230"}
521
+ {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "30, 90", "associated_controls_text": "30, 90", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Estratégia de segurança desarticulada", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-231"}
522
+ {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança definida mas não aplicada", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "forte", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-232"}
523
+ {"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_control_names": ["Governação de fornecedores e exceções", "Governação organizacional, ownership e conformidade", "Gestão de identidades, acessos e ownership"], "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Políticas de segurança não institucionalizadas", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "89ac3ba8f03002054033636b9a685729c1e0a590", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "related_antipatterns": [], "threat_category": "STRIDE", "threat_id": "MT-233"}