@shiftleftpt/sbd-toe-mcp 0.6.2 → 0.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (38) hide show
  1. package/assets/agent-guide.md +22 -19
  2. package/data/publish/algolia_entities_records_enriched.json +25370 -2
  3. package/data/publish/canonical_controls.json +1239 -0
  4. package/data/publish/canonical_requirements_s7.json +1859 -0
  5. package/data/publish/canonical_roles_s5.json +138 -0
  6. package/data/publish/lifecycle_user_stories.json +6558 -0
  7. package/data/publish/mitigated_threats.json +6945 -0
  8. package/data/publish/practice_assignments.json +16266 -0
  9. package/data/publish/sbdtoe-ontology.yaml +696 -0
  10. package/dist/backend/semantic-index-gateway.js +1 -1
  11. package/dist/index.js +276 -115
  12. package/dist/index.js.map +1 -1
  13. package/dist/resources/sbd-toe-resources.js +6 -1
  14. package/dist/resources/sbd-toe-resources.js.map +1 -1
  15. package/dist/tools/consult-security-requirements.d.ts +38 -0
  16. package/dist/tools/consult-security-requirements.js +115 -0
  17. package/dist/tools/consult-security-requirements.js.map +1 -0
  18. package/dist/tools/get-guide-by-role.d.ts +38 -0
  19. package/dist/tools/get-guide-by-role.js +109 -0
  20. package/dist/tools/get-guide-by-role.js.map +1 -0
  21. package/dist/tools/get-threat-landscape.d.ts +44 -0
  22. package/dist/tools/get-threat-landscape.js +116 -0
  23. package/dist/tools/get-threat-landscape.js.map +1 -0
  24. package/dist/tools/map-review-scope.js +5 -0
  25. package/dist/tools/map-review-scope.js.map +1 -1
  26. package/dist/tools/ontology-loader.d.ts +104 -0
  27. package/dist/tools/ontology-loader.js +206 -0
  28. package/dist/tools/ontology-loader.js.map +1 -0
  29. package/dist/tools/plan-repo-governance.d.ts +25 -38
  30. package/dist/tools/plan-repo-governance.js +71 -498
  31. package/dist/tools/plan-repo-governance.js.map +1 -1
  32. package/dist/tools/resolve-entities.d.ts +26 -0
  33. package/dist/tools/resolve-entities.js +143 -0
  34. package/dist/tools/resolve-entities.js.map +1 -0
  35. package/package.json +4 -1
  36. package/dist/tools/generate-document.d.ts +0 -22
  37. package/dist/tools/generate-document.js +0 -392
  38. package/dist/tools/generate-document.js.map +0 -1
package/data/publish/canonical_requirements_s7.json ADDED
@@ -0,0 +1,1859 @@
1
+ {
2
+ "metadata": {
3
+ "generation_date": "2026-03-28",
4
+ "total_requirements": 130,
5
+ "catalogs": [
6
+ {
7
+ "name": "Base Catalog (Cap 02)",
8
+ "count": 104,
9
+ "categories": [
10
+ "SES",
11
+ "ERR",
12
+ "DST",
13
+ "LOG",
14
+ "API",
15
+ "AUT",
16
+ "INT",
17
+ "REQ",
18
+ "IDE",
19
+ "CFG",
20
+ "VAL",
21
+ "ACC",
22
+ "ENC"
23
+ ]
24
+ },
25
+ {
26
+ "name": "Architecture (Cap 04)",
27
+ "count": 13,
28
+ "prefix": "ARC"
29
+ },
30
+ {
31
+ "name": "Infrastructure-as-Code (Cap 08)",
32
+ "count": 13,
33
+ "prefix": "IAC"
34
+ }
35
+ ]
36
+ },
37
+ "requirements": [
38
+ {
39
+ "requirement_id": "AUT-001",
40
+ "type": "base",
41
+ "category": "AUT",
42
+ "domain": null,
43
+ "name": "MFA obrigatório",
44
+ "applicable_levels": {
45
+ "L1": false,
46
+ "L2": true,
47
+ "L3": true
48
+ },
49
+ "source_chapter": 2,
50
+ "source_file": "02-lista-requisitos-base.md"
51
+ },
52
+ {
53
+ "requirement_id": "AUT-002",
54
+ "type": "base",
55
+ "category": "AUT",
56
+ "domain": null,
57
+ "name": "Política de passwords",
58
+ "applicable_levels": {
59
+ "L1": true,
60
+ "L2": true,
61
+ "L3": true
62
+ },
63
+ "source_chapter": 2,
64
+ "source_file": "02-lista-requisitos-base.md"
65
+ },
66
+ {
67
+ "requirement_id": "AUT-003",
68
+ "type": "base",
69
+ "category": "AUT",
70
+ "domain": null,
71
+ "name": "Proteção contra brute force",
72
+ "applicable_levels": {
73
+ "L1": true,
74
+ "L2": true,
75
+ "L3": true
76
+ },
77
+ "source_chapter": 2,
78
+ "source_file": "02-lista-requisitos-base.md"
79
+ },
80
+ {
81
+ "requirement_id": "AUT-004",
82
+ "type": "base",
83
+ "category": "AUT",
84
+ "domain": null,
85
+ "name": "Revogação ativa de sessões",
86
+ "applicable_levels": {
87
+ "L1": true,
88
+ "L2": true,
89
+ "L3": true
90
+ },
91
+ "source_chapter": 2,
92
+ "source_file": "02-lista-requisitos-base.md"
93
+ },
94
+ {
95
+ "requirement_id": "AUT-005",
96
+ "type": "base",
97
+ "category": "AUT",
98
+ "domain": null,
99
+ "name": "Expiração automática de sessão",
100
+ "applicable_levels": {
101
+ "L1": true,
102
+ "L2": true,
103
+ "L3": true
104
+ },
105
+ "source_chapter": 2,
106
+ "source_file": "02-lista-requisitos-base.md"
107
+ },
108
+ {
109
+ "requirement_id": "AUT-006",
110
+ "type": "base",
111
+ "category": "AUT",
112
+ "domain": null,
113
+ "name": "Proibição de credenciais em claro",
114
+ "applicable_levels": {
115
+ "L1": true,
116
+ "L2": true,
117
+ "L3": true
118
+ },
119
+ "source_chapter": 2,
120
+ "source_file": "02-lista-requisitos-base.md"
121
+ },
122
+ {
123
+ "requirement_id": "AUT-007",
124
+ "type": "base",
125
+ "category": "AUT",
126
+ "domain": null,
127
+ "name": "Suporte a autenticação federada",
128
+ "applicable_levels": {
129
+ "L1": false,
130
+ "L2": true,
131
+ "L3": true
132
+ },
133
+ "source_chapter": 2,
134
+ "source_file": "02-lista-requisitos-base.md"
135
+ },
136
+ {
137
+ "requirement_id": "AUT-008",
138
+ "type": "base",
139
+ "category": "AUT",
140
+ "domain": null,
141
+ "name": "Step-up para ações sensíveis",
142
+ "applicable_levels": {
143
+ "L1": false,
144
+ "L2": true,
145
+ "L3": true
146
+ },
147
+ "source_chapter": 2,
148
+ "source_file": "02-lista-requisitos-base.md"
149
+ },
150
+ {
151
+ "requirement_id": "AUT-009",
152
+ "type": "base",
153
+ "category": "AUT",
154
+ "domain": null,
155
+ "name": "Reautenticação para alterações críticas",
156
+ "applicable_levels": {
157
+ "L1": true,
158
+ "L2": true,
159
+ "L3": true
160
+ },
161
+ "source_chapter": 2,
162
+ "source_file": "02-lista-requisitos-base.md"
163
+ },
164
+ {
165
+ "requirement_id": "AUT-010",
166
+ "type": "base",
167
+ "category": "AUT",
168
+ "domain": null,
169
+ "name": "Alerta de acessos suspeitos",
170
+ "applicable_levels": {
171
+ "L1": false,
172
+ "L2": true,
173
+ "L3": true
174
+ },
175
+ "source_chapter": 2,
176
+ "source_file": "02-lista-requisitos-base.md"
177
+ },
178
+ {
179
+ "requirement_id": "ACC-001",
180
+ "type": "base",
181
+ "category": "ACC",
182
+ "domain": null,
183
+ "name": "Controlo de acesso RBAC",
184
+ "applicable_levels": {
185
+ "L1": true,
186
+ "L2": true,
187
+ "L3": true
188
+ },
189
+ "source_chapter": 2,
190
+ "source_file": "02-lista-requisitos-base.md"
191
+ },
192
+ {
193
+ "requirement_id": "ACC-002",
194
+ "type": "base",
195
+ "category": "ACC",
196
+ "domain": null,
197
+ "name": "Princípio do menor privilégio",
198
+ "applicable_levels": {
199
+ "L1": true,
200
+ "L2": true,
201
+ "L3": true
202
+ },
203
+ "source_chapter": 2,
204
+ "source_file": "02-lista-requisitos-base.md"
205
+ },
206
+ {
207
+ "requirement_id": "ACC-003",
208
+ "type": "base",
209
+ "category": "ACC",
210
+ "domain": null,
211
+ "name": "Bloqueio e auditoria de acessos ilegítimos",
212
+ "applicable_levels": {
213
+ "L1": true,
214
+ "L2": true,
215
+ "L3": true
216
+ },
217
+ "source_chapter": 2,
218
+ "source_file": "02-lista-requisitos-base.md"
219
+ },
220
+ {
221
+ "requirement_id": "ACC-004",
222
+ "type": "base",
223
+ "category": "ACC",
224
+ "domain": null,
225
+ "name": "Separação de perfis",
226
+ "applicable_levels": {
227
+ "L1": true,
228
+ "L2": true,
229
+ "L3": true
230
+ },
231
+ "source_chapter": 2,
232
+ "source_file": "02-lista-requisitos-base.md"
233
+ },
234
+ {
235
+ "requirement_id": "ACC-005",
236
+ "type": "base",
237
+ "category": "ACC",
238
+ "domain": null,
239
+ "name": "Controlo de acesso a APIs e serviços",
240
+ "applicable_levels": {
241
+ "L1": true,
242
+ "L2": true,
243
+ "L3": true
244
+ },
245
+ "source_chapter": 2,
246
+ "source_file": "02-lista-requisitos-base.md"
247
+ },
248
+ {
249
+ "requirement_id": "ACC-006",
250
+ "type": "base",
251
+ "category": "ACC",
252
+ "domain": null,
253
+ "name": "Proteção de recursos sensíveis",
254
+ "applicable_levels": {
255
+ "L1": true,
256
+ "L2": true,
257
+ "L3": true
258
+ },
259
+ "source_chapter": 2,
260
+ "source_file": "02-lista-requisitos-base.md"
261
+ },
262
+ {
263
+ "requirement_id": "ACC-007",
264
+ "type": "base",
265
+ "category": "ACC",
266
+ "domain": null,
267
+ "name": "Validação do modelo de acesso",
268
+ "applicable_levels": {
269
+ "L1": false,
270
+ "L2": true,
271
+ "L3": true
272
+ },
273
+ "source_chapter": 2,
274
+ "source_file": "02-lista-requisitos-base.md"
275
+ },
276
+ {
277
+ "requirement_id": "ACC-008",
278
+ "type": "base",
279
+ "category": "ACC",
280
+ "domain": null,
281
+ "name": "Revogação em tempo real",
282
+ "applicable_levels": {
283
+ "L1": true,
284
+ "L2": true,
285
+ "L3": true
286
+ },
287
+ "source_chapter": 2,
288
+ "source_file": "02-lista-requisitos-base.md"
289
+ },
290
+ {
291
+ "requirement_id": "ACC-009",
292
+ "type": "base",
293
+ "category": "ACC",
294
+ "domain": null,
295
+ "name": "Autorização baseada em atributos (ABAC)",
296
+ "applicable_levels": {
297
+ "L1": false,
298
+ "L2": false,
299
+ "L3": true
300
+ },
301
+ "source_chapter": 2,
302
+ "source_file": "02-lista-requisitos-base.md"
303
+ },
304
+ {
305
+ "requirement_id": "ACC-010",
306
+ "type": "base",
307
+ "category": "ACC",
308
+ "domain": null,
309
+ "name": "Revisão periódica de permissões",
310
+ "applicable_levels": {
311
+ "L1": false,
312
+ "L2": true,
313
+ "L3": true
314
+ },
315
+ "source_chapter": 2,
316
+ "source_file": "02-lista-requisitos-base.md"
317
+ },
318
+ {
319
+ "requirement_id": "LOG-001",
320
+ "type": "base",
321
+ "category": "LOG",
322
+ "domain": null,
323
+ "name": "Registo de eventos críticos",
324
+ "applicable_levels": {
325
+ "L1": true,
326
+ "L2": true,
327
+ "L3": true
328
+ },
329
+ "source_chapter": 2,
330
+ "source_file": "02-lista-requisitos-base.md"
331
+ },
332
+ {
333
+ "requirement_id": "LOG-002",
334
+ "type": "base",
335
+ "category": "LOG",
336
+ "domain": null,
337
+ "name": "Atributos mínimos em logs",
338
+ "applicable_levels": {
339
+ "L1": true,
340
+ "L2": true,
341
+ "L3": true
342
+ },
343
+ "source_chapter": 2,
344
+ "source_file": "02-lista-requisitos-base.md"
345
+ },
346
+ {
347
+ "requirement_id": "LOG-003",
348
+ "type": "base",
349
+ "category": "LOG",
350
+ "domain": null,
351
+ "name": "Proteção de integridade e acesso aos logs",
352
+ "applicable_levels": {
353
+ "L1": true,
354
+ "L2": true,
355
+ "L3": true
356
+ },
357
+ "source_chapter": 2,
358
+ "source_file": "02-lista-requisitos-base.md"
359
+ },
360
+ {
361
+ "requirement_id": "LOG-004",
362
+ "type": "base",
363
+ "category": "LOG",
364
+ "domain": null,
365
+ "name": "Análise periódica de logs",
366
+ "applicable_levels": {
367
+ "L1": false,
368
+ "L2": true,
369
+ "L3": true
370
+ },
371
+ "source_chapter": 2,
372
+ "source_file": "02-lista-requisitos-base.md"
373
+ },
374
+ {
375
+ "requirement_id": "LOG-005",
376
+ "type": "base",
377
+ "category": "LOG",
378
+ "domain": null,
379
+ "name": "Retenção mínima dos logs",
380
+ "applicable_levels": {
381
+ "L1": true,
382
+ "L2": true,
383
+ "L3": true
384
+ },
385
+ "source_chapter": 2,
386
+ "source_file": "02-lista-requisitos-base.md"
387
+ },
388
+ {
389
+ "requirement_id": "LOG-006",
390
+ "type": "base",
391
+ "category": "LOG",
392
+ "domain": null,
393
+ "name": "Envio para sistema centralizado",
394
+ "applicable_levels": {
395
+ "L1": false,
396
+ "L2": true,
397
+ "L3": true
398
+ },
399
+ "source_chapter": 2,
400
+ "source_file": "02-lista-requisitos-base.md"
401
+ },
402
+ {
403
+ "requirement_id": "LOG-007",
404
+ "type": "base",
405
+ "category": "LOG",
406
+ "domain": null,
407
+ "name": "Classificação e deteção de anomalias",
408
+ "applicable_levels": {
409
+ "L1": false,
410
+ "L2": true,
411
+ "L3": true
412
+ },
413
+ "source_chapter": 2,
414
+ "source_file": "02-lista-requisitos-base.md"
415
+ },
416
+ {
417
+ "requirement_id": "LOG-008",
418
+ "type": "base",
419
+ "category": "LOG",
420
+ "domain": null,
421
+ "name": "Alarme em falhas do mecanismo de logging",
422
+ "applicable_levels": {
423
+ "L1": false,
424
+ "L2": true,
425
+ "L3": true
426
+ },
427
+ "source_chapter": 2,
428
+ "source_file": "02-lista-requisitos-base.md"
429
+ },
430
+ {
431
+ "requirement_id": "LOG-009",
432
+ "type": "base",
433
+ "category": "LOG",
434
+ "domain": null,
435
+ "name": "Logs suportam resposta a incidentes",
436
+ "applicable_levels": {
437
+ "L1": false,
438
+ "L2": true,
439
+ "L3": true
440
+ },
441
+ "source_chapter": 2,
442
+ "source_file": "02-lista-requisitos-base.md"
443
+ },
444
+ {
445
+ "requirement_id": "LOG-010",
446
+ "type": "base",
447
+ "category": "LOG",
448
+ "domain": null,
449
+ "name": "Logging de eventos críticos de negócio",
450
+ "applicable_levels": {
451
+ "L1": false,
452
+ "L2": false,
453
+ "L3": true
454
+ },
455
+ "source_chapter": 2,
456
+ "source_file": "02-lista-requisitos-base.md"
457
+ },
458
+ {
459
+ "requirement_id": "SES-001",
460
+ "type": "base",
461
+ "category": "SES",
462
+ "domain": null,
463
+ "name": "Expiração automática por inatividade",
464
+ "applicable_levels": {
465
+ "L1": true,
466
+ "L2": true,
467
+ "L3": true
468
+ },
469
+ "source_chapter": 2,
470
+ "source_file": "02-lista-requisitos-base.md"
471
+ },
472
+ {
473
+ "requirement_id": "SES-002",
474
+ "type": "base",
475
+ "category": "SES",
476
+ "domain": null,
477
+ "name": "Logout manual e após alteração de credenciais",
478
+ "applicable_levels": {
479
+ "L1": true,
480
+ "L2": true,
481
+ "L3": true
482
+ },
483
+ "source_chapter": 2,
484
+ "source_file": "02-lista-requisitos-base.md"
485
+ },
486
+ {
487
+ "requirement_id": "SES-003",
488
+ "type": "base",
489
+ "category": "SES",
490
+ "domain": null,
491
+ "name": "Identificadores de sessão imprevisíveis",
492
+ "applicable_levels": {
493
+ "L1": true,
494
+ "L2": true,
495
+ "L3": true
496
+ },
497
+ "source_chapter": 2,
498
+ "source_file": "02-lista-requisitos-base.md"
499
+ },
500
+ {
501
+ "requirement_id": "SES-004",
502
+ "type": "base",
503
+ "category": "SES",
504
+ "domain": null,
505
+ "name": "Transmissão segura dos tokens",
506
+ "applicable_levels": {
507
+ "L1": true,
508
+ "L2": true,
509
+ "L3": true
510
+ },
511
+ "source_chapter": 2,
512
+ "source_file": "02-lista-requisitos-base.md"
513
+ },
514
+ {
515
+ "requirement_id": "SES-005",
516
+ "type": "base",
517
+ "category": "SES",
518
+ "domain": null,
519
+ "name": "Ligação da sessão ao contexto do cliente",
520
+ "applicable_levels": {
521
+ "L1": false,
522
+ "L2": true,
523
+ "L3": true
524
+ },
525
+ "source_chapter": 2,
526
+ "source_file": "02-lista-requisitos-base.md"
527
+ },
528
+ {
529
+ "requirement_id": "SES-006",
530
+ "type": "base",
531
+ "category": "SES",
532
+ "domain": null,
533
+ "name": "Revogação explícita da sessão",
534
+ "applicable_levels": {
535
+ "L1": true,
536
+ "L2": true,
537
+ "L3": true
538
+ },
539
+ "source_chapter": 2,
540
+ "source_file": "02-lista-requisitos-base.md"
541
+ },
542
+ {
543
+ "requirement_id": "SES-007",
544
+ "type": "base",
545
+ "category": "SES",
546
+ "domain": null,
547
+ "name": "Prevenção de sessões long-lived",
548
+ "applicable_levels": {
549
+ "L1": false,
550
+ "L2": true,
551
+ "L3": true
552
+ },
553
+ "source_chapter": 2,
554
+ "source_file": "02-lista-requisitos-base.md"
555
+ },
556
+ {
557
+ "requirement_id": "SES-008",
558
+ "type": "base",
559
+ "category": "SES",
560
+ "domain": null,
561
+ "name": "Scope, TTL e revogação de tokens JWT",
562
+ "applicable_levels": {
563
+ "L1": false,
564
+ "L2": true,
565
+ "L3": true
566
+ },
567
+ "source_chapter": 2,
568
+ "source_file": "02-lista-requisitos-base.md"
569
+ },
570
+ {
571
+ "requirement_id": "VAL-001",
572
+ "type": "base",
573
+ "category": "VAL",
574
+ "domain": null,
575
+ "name": "Validação geral de entradas externas",
576
+ "applicable_levels": {
577
+ "L1": true,
578
+ "L2": true,
579
+ "L3": true
580
+ },
581
+ "source_chapter": 2,
582
+ "source_file": "02-lista-requisitos-base.md"
583
+ },
584
+ {
585
+ "requirement_id": "VAL-002",
586
+ "type": "base",
587
+ "category": "VAL",
588
+ "domain": null,
589
+ "name": "Uso de whitelists em vez de blacklists",
590
+ "applicable_levels": {
591
+ "L1": true,
592
+ "L2": true,
593
+ "L3": true
594
+ },
595
+ "source_chapter": 2,
596
+ "source_file": "02-lista-requisitos-base.md"
597
+ },
598
+ {
599
+ "requirement_id": "VAL-003",
600
+ "type": "base",
601
+ "category": "VAL",
602
+ "domain": null,
603
+ "name": "Validadores de esquema (ex: JSON/XML schema)",
604
+ "applicable_levels": {
605
+ "L1": false,
606
+ "L2": true,
607
+ "L3": true
608
+ },
609
+ "source_chapter": 2,
610
+ "source_file": "02-lista-requisitos-base.md"
611
+ },
612
+ {
613
+ "requirement_id": "VAL-004",
614
+ "type": "base",
615
+ "category": "VAL",
616
+ "domain": null,
617
+ "name": "Sanitização contra injeções",
618
+ "applicable_levels": {
619
+ "L1": true,
620
+ "L2": true,
621
+ "L3": true
622
+ },
623
+ "source_chapter": 2,
624
+ "source_file": "02-lista-requisitos-base.md"
625
+ },
626
+ {
627
+ "requirement_id": "VAL-005",
628
+ "type": "base",
629
+ "category": "VAL",
630
+ "domain": null,
631
+ "name": "Validação antes do uso interno",
632
+ "applicable_levels": {
633
+ "L1": true,
634
+ "L2": true,
635
+ "L3": true
636
+ },
637
+ "source_chapter": 2,
638
+ "source_file": "02-lista-requisitos-base.md"
639
+ },
640
+ {
641
+ "requirement_id": "VAL-006",
642
+ "type": "base",
643
+ "category": "VAL",
644
+ "domain": null,
645
+ "name": "Mensagens de erro seguras na validação",
646
+ "applicable_levels": {
647
+ "L1": true,
648
+ "L2": true,
649
+ "L3": true
650
+ },
651
+ "source_chapter": 2,
652
+ "source_file": "02-lista-requisitos-base.md"
653
+ },
654
+ {
655
+ "requirement_id": "VAL-007",
656
+ "type": "base",
657
+ "category": "VAL",
658
+ "domain": null,
659
+ "name": "Testes automáticos contra entradas maliciosas",
660
+ "applicable_levels": {
661
+ "L1": false,
662
+ "L2": true,
663
+ "L3": true
664
+ },
665
+ "source_chapter": 2,
666
+ "source_file": "02-lista-requisitos-base.md"
667
+ },
668
+ {
669
+ "requirement_id": "ERR-001",
670
+ "type": "base",
671
+ "category": "ERR",
672
+ "domain": null,
673
+ "name": "Erros não expõem dados sensíveis",
674
+ "applicable_levels": {
675
+ "L1": true,
676
+ "L2": true,
677
+ "L3": true
678
+ },
679
+ "source_chapter": 2,
680
+ "source_file": "02-lista-requisitos-base.md"
681
+ },
682
+ {
683
+ "requirement_id": "ERR-002",
684
+ "type": "base",
685
+ "category": "ERR",
686
+ "domain": null,
687
+ "name": "Mensagens genéricas no cliente",
688
+ "applicable_levels": {
689
+ "L1": true,
690
+ "L2": true,
691
+ "L3": true
692
+ },
693
+ "source_chapter": 2,
694
+ "source_file": "02-lista-requisitos-base.md"
695
+ },
696
+ {
697
+ "requirement_id": "ERR-003",
698
+ "type": "base",
699
+ "category": "ERR",
700
+ "domain": null,
701
+ "name": "Não revelar existência de recursos",
702
+ "applicable_levels": {
703
+ "L1": true,
704
+ "L2": true,
705
+ "L3": true
706
+ },
707
+ "source_chapter": 2,
708
+ "source_file": "02-lista-requisitos-base.md"
709
+ },
710
+ {
711
+ "requirement_id": "ERR-004",
712
+ "type": "base",
713
+ "category": "ERR",
714
+ "domain": null,
715
+ "name": "Mensagens localizadas e seguras",
716
+ "applicable_levels": {
717
+ "L1": true,
718
+ "L2": true,
719
+ "L3": true
720
+ },
721
+ "source_chapter": 2,
722
+ "source_file": "02-lista-requisitos-base.md"
723
+ },
724
+ {
725
+ "requirement_id": "ERR-005",
726
+ "type": "base",
727
+ "category": "ERR",
728
+ "domain": null,
729
+ "name": "Gestão padronizada e centralizada",
730
+ "applicable_levels": {
731
+ "L1": false,
732
+ "L2": true,
733
+ "L3": true
734
+ },
735
+ "source_chapter": 2,
736
+ "source_file": "02-lista-requisitos-base.md"
737
+ },
738
+ {
739
+ "requirement_id": "ERR-006",
740
+ "type": "base",
741
+ "category": "ERR",
742
+ "domain": null,
743
+ "name": "Testes automáticos para erros excessivos",
744
+ "applicable_levels": {
745
+ "L1": false,
746
+ "L2": true,
747
+ "L3": true
748
+ },
749
+ "source_chapter": 2,
750
+ "source_file": "02-lista-requisitos-base.md"
751
+ },
752
+ {
753
+ "requirement_id": "ERR-007",
754
+ "type": "base",
755
+ "category": "ERR",
756
+ "domain": null,
757
+ "name": "Logs de erro com ID de sessão/contexto seguro",
758
+ "applicable_levels": {
759
+ "L1": false,
760
+ "L2": true,
761
+ "L3": true
762
+ },
763
+ "source_chapter": 2,
764
+ "source_file": "02-lista-requisitos-base.md"
765
+ },
766
+ {
767
+ "requirement_id": "CFG-001",
768
+ "type": "base",
769
+ "category": "CFG",
770
+ "domain": null,
771
+ "name": "Debug e flags desativados em produção",
772
+ "applicable_levels": {
773
+ "L1": true,
774
+ "L2": true,
775
+ "L3": true
776
+ },
777
+ "source_chapter": 2,
778
+ "source_file": "02-lista-requisitos-base.md"
779
+ },
780
+ {
781
+ "requirement_id": "CFG-002",
782
+ "type": "base",
783
+ "category": "CFG",
784
+ "domain": null,
785
+ "name": "Separação de ambientes com validação automática",
786
+ "applicable_levels": {
787
+ "L1": true,
788
+ "L2": true,
789
+ "L3": true
790
+ },
791
+ "source_chapter": 2,
792
+ "source_file": "02-lista-requisitos-base.md"
793
+ },
794
+ {
795
+ "requirement_id": "CFG-003",
796
+ "type": "base",
797
+ "category": "CFG",
798
+ "domain": null,
799
+ "name": "Sem hardcoded de parâmetros",
800
+ "applicable_levels": {
801
+ "L1": true,
802
+ "L2": true,
803
+ "L3": true
804
+ },
805
+ "source_chapter": 2,
806
+ "source_file": "02-lista-requisitos-base.md"
807
+ },
808
+ {
809
+ "requirement_id": "CFG-004",
810
+ "type": "base",
811
+ "category": "CFG",
812
+ "domain": null,
813
+ "name": "Configuração externa e com permissões controladas",
814
+ "applicable_levels": {
815
+ "L1": true,
816
+ "L2": true,
817
+ "L3": true
818
+ },
819
+ "source_chapter": 2,
820
+ "source_file": "02-lista-requisitos-base.md"
821
+ },
822
+ {
823
+ "requirement_id": "CFG-005",
824
+ "type": "base",
825
+ "category": "CFG",
826
+ "domain": null,
827
+ "name": "Validação de configuração no arranque",
828
+ "applicable_levels": {
829
+ "L1": false,
830
+ "L2": true,
831
+ "L3": true
832
+ },
833
+ "source_chapter": 2,
834
+ "source_file": "02-lista-requisitos-base.md"
835
+ },
836
+ {
837
+ "requirement_id": "CFG-006",
838
+ "type": "base",
839
+ "category": "CFG",
840
+ "domain": null,
841
+ "name": "Uso de cofres e gestão segura de segredos",
842
+ "applicable_levels": {
843
+ "L1": false,
844
+ "L2": true,
845
+ "L3": true
846
+ },
847
+ "source_chapter": 2,
848
+ "source_file": "02-lista-requisitos-base.md"
849
+ },
850
+ {
851
+ "requirement_id": "CFG-007",
852
+ "type": "base",
853
+ "category": "CFG",
854
+ "domain": null,
855
+ "name": "Monitorização de drift de configuração",
856
+ "applicable_levels": {
857
+ "L1": false,
858
+ "L2": false,
859
+ "L3": true
860
+ },
861
+ "source_chapter": 2,
862
+ "source_file": "02-lista-requisitos-base.md"
863
+ },
864
+ {
865
+ "requirement_id": "API-001",
866
+ "type": "base",
867
+ "category": "API",
868
+ "domain": null,
869
+ "name": "Autenticação e autorização de chamadas API",
870
+ "applicable_levels": {
871
+ "L1": true,
872
+ "L2": true,
873
+ "L3": true
874
+ },
875
+ "source_chapter": 2,
876
+ "source_file": "02-lista-requisitos-base.md"
877
+ },
878
+ {
879
+ "requirement_id": "API-002",
880
+ "type": "base",
881
+ "category": "API",
882
+ "domain": null,
883
+ "name": "Endpoints desnecessários ocultos ou removidos",
884
+ "applicable_levels": {
885
+ "L1": true,
886
+ "L2": true,
887
+ "L3": true
888
+ },
889
+ "source_chapter": 2,
890
+ "source_file": "02-lista-requisitos-base.md"
891
+ },
892
+ {
893
+ "requirement_id": "API-003",
894
+ "type": "base",
895
+ "category": "API",
896
+ "domain": null,
897
+ "name": "Validação de input em APIs",
898
+ "applicable_levels": {
899
+ "L1": true,
900
+ "L2": true,
901
+ "L3": true
902
+ },
903
+ "source_chapter": 2,
904
+ "source_file": "02-lista-requisitos-base.md"
905
+ },
906
+ {
907
+ "requirement_id": "API-004",
908
+ "type": "base",
909
+ "category": "API",
910
+ "domain": null,
911
+ "name": "Rate limiting e deteção de abusos",
912
+ "applicable_levels": {
913
+ "L1": false,
914
+ "L2": true,
915
+ "L3": true
916
+ },
917
+ "source_chapter": 2,
918
+ "source_file": "02-lista-requisitos-base.md"
919
+ },
920
+ {
921
+ "requirement_id": "API-005",
922
+ "type": "base",
923
+ "category": "API",
924
+ "domain": null,
925
+ "name": "Proteção por TLS e certificados atualizados",
926
+ "applicable_levels": {
927
+ "L1": true,
928
+ "L2": true,
929
+ "L3": true
930
+ },
931
+ "source_chapter": 2,
932
+ "source_file": "02-lista-requisitos-base.md"
933
+ },
934
+ {
935
+ "requirement_id": "API-006",
936
+ "type": "base",
937
+ "category": "API",
938
+ "domain": null,
939
+ "name": "Verificação de SDKs e wrappers usados",
940
+ "applicable_levels": {
941
+ "L1": true,
942
+ "L2": true,
943
+ "L3": true
944
+ },
945
+ "source_chapter": 2,
946
+ "source_file": "02-lista-requisitos-base.md"
947
+ },
948
+ {
949
+ "requirement_id": "API-007",
950
+ "type": "base",
951
+ "category": "API",
952
+ "domain": null,
953
+ "name": "Logging e auditoria de chamadas externas",
954
+ "applicable_levels": {
955
+ "L1": false,
956
+ "L2": true,
957
+ "L3": true
958
+ },
959
+ "source_chapter": 2,
960
+ "source_file": "02-lista-requisitos-base.md"
961
+ },
962
+ {
963
+ "requirement_id": "INT-001",
964
+ "type": "base",
965
+ "category": "INT",
966
+ "domain": null,
967
+ "name": "Validação de mensagens entre sistemas",
968
+ "applicable_levels": {
969
+ "L1": true,
970
+ "L2": true,
971
+ "L3": true
972
+ },
973
+ "source_chapter": 2,
974
+ "source_file": "02-lista-requisitos-base.md"
975
+ },
976
+ {
977
+ "requirement_id": "INT-002",
978
+ "type": "base",
979
+ "category": "INT",
980
+ "domain": null,
981
+ "name": "Autenticação mútua ou tokens seguros",
982
+ "applicable_levels": {
983
+ "L1": true,
984
+ "L2": true,
985
+ "L3": true
986
+ },
987
+ "source_chapter": 2,
988
+ "source_file": "02-lista-requisitos-base.md"
989
+ },
990
+ {
991
+ "requirement_id": "INT-003",
992
+ "type": "base",
993
+ "category": "INT",
994
+ "domain": null,
995
+ "name": "Transmissão cifrada com TLS",
996
+ "applicable_levels": {
997
+ "L1": true,
998
+ "L2": true,
999
+ "L3": true
1000
+ },
1001
+ "source_chapter": 2,
1002
+ "source_file": "02-lista-requisitos-base.md"
1003
+ },
1004
+ {
1005
+ "requirement_id": "INT-004",
1006
+ "type": "base",
1007
+ "category": "INT",
1008
+ "domain": null,
1009
+ "name": "Proibição de protocolos inseguros",
1010
+ "applicable_levels": {
1011
+ "L1": true,
1012
+ "L2": true,
1013
+ "L3": true
1014
+ },
1015
+ "source_chapter": 2,
1016
+ "source_file": "02-lista-requisitos-base.md"
1017
+ },
1018
+ {
1019
+ "requirement_id": "INT-005",
1020
+ "type": "base",
1021
+ "category": "INT",
1022
+ "domain": null,
1023
+ "name": "Assinatura e integridade de mensagens",
1024
+ "applicable_levels": {
1025
+ "L1": false,
1026
+ "L2": true,
1027
+ "L3": true
1028
+ },
1029
+ "source_chapter": 2,
1030
+ "source_file": "02-lista-requisitos-base.md"
1031
+ },
1032
+ {
1033
+ "requirement_id": "INT-006",
1034
+ "type": "base",
1035
+ "category": "INT",
1036
+ "domain": null,
1037
+ "name": "Validação cruzada de origem e destino",
1038
+ "applicable_levels": {
1039
+ "L1": false,
1040
+ "L2": true,
1041
+ "L3": true
1042
+ },
1043
+ "source_chapter": 2,
1044
+ "source_file": "02-lista-requisitos-base.md"
1045
+ },
1046
+ {
1047
+ "requirement_id": "INT-007",
1048
+ "type": "base",
1049
+ "category": "INT",
1050
+ "domain": null,
1051
+ "name": "Monitorização e deteção de padrões anómalos",
1052
+ "applicable_levels": {
1053
+ "L1": false,
1054
+ "L2": false,
1055
+ "L3": true
1056
+ },
1057
+ "source_chapter": 2,
1058
+ "source_file": "02-lista-requisitos-base.md"
1059
+ },
1060
+ {
1061
+ "requirement_id": "INT-008",
1062
+ "type": "base",
1063
+ "category": "INT",
1064
+ "domain": null,
1065
+ "name": "Revisão de segurança e contrato em integrações",
1066
+ "applicable_levels": {
1067
+ "L1": false,
1068
+ "L2": false,
1069
+ "L3": true
1070
+ },
1071
+ "source_chapter": 2,
1072
+ "source_file": "02-lista-requisitos-base.md"
1073
+ },
1074
+ {
1075
+ "requirement_id": "REQ-001",
1076
+ "type": "base",
1077
+ "category": "REQ",
1078
+ "domain": null,
1079
+ "name": "Inclusão de requisitos de segurança",
1080
+ "applicable_levels": {
1081
+ "L1": true,
1082
+ "L2": true,
1083
+ "L3": true
1084
+ },
1085
+ "source_chapter": 2,
1086
+ "source_file": "02-lista-requisitos-base.md"
1087
+ },
1088
+ {
1089
+ "requirement_id": "REQ-002",
1090
+ "type": "base",
1091
+ "category": "REQ",
1092
+ "domain": null,
1093
+ "name": "Revisão formal de segurança dos requisitos",
1094
+ "applicable_levels": {
1095
+ "L1": true,
1096
+ "L2": true,
1097
+ "L3": true
1098
+ },
1099
+ "source_chapter": 2,
1100
+ "source_file": "02-lista-requisitos-base.md"
1101
+ },
1102
+ {
1103
+ "requirement_id": "REQ-003",
1104
+ "type": "base",
1105
+ "category": "REQ",
1106
+ "domain": null,
1107
+ "name": "Alinhamento com classificação de risco",
1108
+ "applicable_levels": {
1109
+ "L1": true,
1110
+ "L2": true,
1111
+ "L3": true
1112
+ },
1113
+ "source_chapter": 2,
1114
+ "source_file": "02-lista-requisitos-base.md"
1115
+ },
1116
+ {
1117
+ "requirement_id": "REQ-004",
1118
+ "type": "base",
1119
+ "category": "REQ",
1120
+ "domain": null,
1121
+ "name": "Versionamento e gestão de requisitos",
1122
+ "applicable_levels": {
1123
+ "L1": true,
1124
+ "L2": true,
1125
+ "L3": true
1126
+ },
1127
+ "source_chapter": 2,
1128
+ "source_file": "02-lista-requisitos-base.md"
1129
+ },
1130
+ {
1131
+ "requirement_id": "REQ-005",
1132
+ "type": "base",
1133
+ "category": "REQ",
1134
+ "domain": null,
1135
+ "name": "Nova análise de ameaça após alteração de requisito",
1136
+ "applicable_levels": {
1137
+ "L1": false,
1138
+ "L2": true,
1139
+ "L3": true
1140
+ },
1141
+ "source_chapter": 2,
1142
+ "source_file": "02-lista-requisitos-base.md"
1143
+ },
1144
+ {
1145
+ "requirement_id": "REQ-006",
1146
+ "type": "base",
1147
+ "category": "REQ",
1148
+ "domain": null,
1149
+ "name": "Rastreabilidade requisito → ameaça → teste",
1150
+ "applicable_levels": {
1151
+ "L1": false,
1152
+ "L2": true,
1153
+ "L3": true
1154
+ },
1155
+ "source_chapter": 2,
1156
+ "source_file": "02-lista-requisitos-base.md"
1157
+ },
1158
+ {
1159
+ "requirement_id": "REQ-007",
1160
+ "type": "base",
1161
+ "category": "REQ",
1162
+ "domain": null,
1163
+ "name": "Revisão iterativa com equipas",
1164
+ "applicable_levels": {
1165
+ "L1": false,
1166
+ "L2": true,
1167
+ "L3": true
1168
+ },
1169
+ "source_chapter": 2,
1170
+ "source_file": "02-lista-requisitos-base.md"
1171
+ },
1172
+ {
1173
+ "requirement_id": "DST-001",
1174
+ "type": "base",
1175
+ "category": "DST",
1176
+ "domain": null,
1177
+ "name": "Repositórios autenticados e auditáveis",
1178
+ "applicable_levels": {
1179
+ "L1": true,
1180
+ "L2": true,
1181
+ "L3": true
1182
+ },
1183
+ "source_chapter": 2,
1184
+ "source_file": "02-lista-requisitos-base.md"
1185
+ },
1186
+ {
1187
+ "requirement_id": "DST-002",
1188
+ "type": "base",
1189
+ "category": "DST",
1190
+ "domain": null,
1191
+ "name": "Aprovação para publicação pública",
1192
+ "applicable_levels": {
1193
+ "L1": false,
1194
+ "L2": true,
1195
+ "L3": true
1196
+ },
1197
+ "source_chapter": 2,
1198
+ "source_file": "02-lista-requisitos-base.md"
1199
+ },
1200
+ {
1201
+ "requirement_id": "DST-003",
1202
+ "type": "base",
1203
+ "category": "DST",
1204
+ "domain": null,
1205
+ "name": "Assinatura digital ou checksum",
1206
+ "applicable_levels": {
1207
+ "L1": false,
1208
+ "L2": true,
1209
+ "L3": true
1210
+ },
1211
+ "source_chapter": 2,
1212
+ "source_file": "02-lista-requisitos-base.md"
1213
+ },
1214
+ {
1215
+ "requirement_id": "DST-004",
1216
+ "type": "base",
1217
+ "category": "DST",
1218
+ "domain": null,
1219
+ "name": "Inclusão de SBOM nos artefactos",
1220
+ "applicable_levels": {
1221
+ "L1": false,
1222
+ "L2": true,
1223
+ "L3": true
1224
+ },
1225
+ "source_chapter": 2,
1226
+ "source_file": "02-lista-requisitos-base.md"
1227
+ },
1228
+ {
1229
+ "requirement_id": "DST-005",
1230
+ "type": "base",
1231
+ "category": "DST",
1232
+ "domain": null,
1233
+ "name": "Acesso segregado por role e ambiente",
1234
+ "applicable_levels": {
1235
+ "L1": false,
1236
+ "L2": true,
1237
+ "L3": true
1238
+ },
1239
+ "source_chapter": 2,
1240
+ "source_file": "02-lista-requisitos-base.md"
1241
+ },
1242
+ {
1243
+ "requirement_id": "DST-006",
1244
+ "type": "base",
1245
+ "category": "DST",
1246
+ "domain": null,
1247
+ "name": "Deploy apenas via pipeline validado",
1248
+ "applicable_levels": {
1249
+ "L1": false,
1250
+ "L2": true,
1251
+ "L3": true
1252
+ },
1253
+ "source_chapter": 2,
1254
+ "source_file": "02-lista-requisitos-base.md"
1255
+ },
1256
+ {
1257
+ "requirement_id": "DST-007",
1258
+ "type": "base",
1259
+ "category": "DST",
1260
+ "domain": null,
1261
+ "name": "Revogação e limpeza de artefactos comprometidos",
1262
+ "applicable_levels": {
1263
+ "L1": true,
1264
+ "L2": true,
1265
+ "L3": true
1266
+ },
1267
+ "source_chapter": 2,
1268
+ "source_file": "02-lista-requisitos-base.md"
1269
+ },
1270
+ {
1271
+ "requirement_id": "IDE-001",
1272
+ "type": "base",
1273
+ "category": "IDE",
1274
+ "domain": null,
1275
+ "name": "Ferramentas e IDEs autorizadas",
1276
+ "applicable_levels": {
1277
+ "L1": true,
1278
+ "L2": true,
1279
+ "L3": true
1280
+ },
1281
+ "source_chapter": 2,
1282
+ "source_file": "02-lista-requisitos-base.md"
1283
+ },
1284
+ {
1285
+ "requirement_id": "IDE-002",
1286
+ "type": "base",
1287
+ "category": "IDE",
1288
+ "domain": null,
1289
+ "name": "Atualização e gestão de vulnerabilidades",
1290
+ "applicable_levels": {
1291
+ "L1": true,
1292
+ "L2": true,
1293
+ "L3": true
1294
+ },
1295
+ "source_chapter": 2,
1296
+ "source_file": "02-lista-requisitos-base.md"
1297
+ },
1298
+ {
1299
+ "requirement_id": "IDE-003",
1300
+ "type": "base",
1301
+ "category": "IDE",
1302
+ "domain": null,
1303
+ "name": "Auditoria de código gerado por ferramentas",
1304
+ "applicable_levels": {
1305
+ "L1": false,
1306
+ "L2": true,
1307
+ "L3": true
1308
+ },
1309
+ "source_chapter": 2,
1310
+ "source_file": "02-lista-requisitos-base.md"
1311
+ },
1312
+ {
1313
+ "requirement_id": "IDE-004",
1314
+ "type": "base",
1315
+ "category": "IDE",
1316
+ "domain": null,
1317
+ "name": "Extensões e plugins de fontes confiáveis",
1318
+ "applicable_levels": {
1319
+ "L1": true,
1320
+ "L2": true,
1321
+ "L3": true
1322
+ },
1323
+ "source_chapter": 2,
1324
+ "source_file": "02-lista-requisitos-base.md"
1325
+ },
1326
+ {
1327
+ "requirement_id": "IDE-005",
1328
+ "type": "base",
1329
+ "category": "IDE",
1330
+ "domain": null,
1331
+ "name": "Controlo de permissões de extensões",
1332
+ "applicable_levels": {
1333
+ "L1": false,
1334
+ "L2": true,
1335
+ "L3": true
1336
+ },
1337
+ "source_chapter": 2,
1338
+ "source_file": "02-lista-requisitos-base.md"
1339
+ },
1340
+ {
1341
+ "requirement_id": "IDE-006",
1342
+ "type": "base",
1343
+ "category": "IDE",
1344
+ "domain": null,
1345
+ "name": "Evitar uso de ambientes locais sem controlo",
1346
+ "applicable_levels": {
1347
+ "L1": false,
1348
+ "L2": true,
1349
+ "L3": true
1350
+ },
1351
+ "source_chapter": 2,
1352
+ "source_file": "02-lista-requisitos-base.md"
1353
+ },
1354
+ {
1355
+ "requirement_id": "ARC-001",
1356
+ "type": "domain-specific",
1357
+ "category": "ARC",
1358
+ "domain": "architecture",
1359
+ "name": "A arquitetura deve identificar e documentar zonas de confiança e fronteiras de segurança",
1360
+ "applicable_levels": {
1361
+ "L1": true,
1362
+ "L2": true,
1363
+ "L3": true
1364
+ },
1365
+ "source_chapter": 4,
1366
+ "source_file": "01-catalogo-requisitos.md"
1367
+ },
1368
+ {
1369
+ "requirement_id": "ARC-002",
1370
+ "type": "domain-specific",
1371
+ "category": "ARC",
1372
+ "domain": "architecture",
1373
+ "name": "A exposição externa de componentes deve ser minimizada e justificada",
1374
+ "applicable_levels": {
1375
+ "L1": true,
1376
+ "L2": true,
1377
+ "L3": true
1378
+ },
1379
+ "source_chapter": 4,
1380
+ "source_file": "01-catalogo-requisitos.md"
1381
+ },
1382
+ {
1383
+ "requirement_id": "ARC-003",
1384
+ "type": "domain-specific",
1385
+ "category": "ARC",
1386
+ "domain": "architecture",
1387
+ "name": "Deve existir uma revisão de arquitetura com foco em segurança, proporcional ao risco da aplicação",
1388
+ "applicable_levels": {
1389
+ "L1": false,
1390
+ "L2": true,
1391
+ "L3": true
1392
+ },
1393
+ "source_chapter": 4,
1394
+ "source_file": "01-catalogo-requisitos.md"
1395
+ },
1396
+ {
1397
+ "requirement_id": "ARC-004",
1398
+ "type": "domain-specific",
1399
+ "category": "ARC",
1400
+ "domain": "architecture",
1401
+ "name": "As decisões de arquitetura devem ser documentadas com responsáveis, datas e justificações",
1402
+ "applicable_levels": {
1403
+ "L1": false,
1404
+ "L2": true,
1405
+ "L3": true
1406
+ },
1407
+ "source_chapter": 4,
1408
+ "source_file": "01-catalogo-requisitos.md"
1409
+ },
1410
+ {
1411
+ "requirement_id": "ARC-005",
1412
+ "type": "domain-specific",
1413
+ "category": "ARC",
1414
+ "domain": "architecture",
1415
+ "name": "A arquitetura deve considerar threat modeling nos fluxos e nos componentes críticos",
1416
+ "applicable_levels": {
1417
+ "L1": false,
1418
+ "L2": true,
1419
+ "L3": true
1420
+ },
1421
+ "source_chapter": 4,
1422
+ "source_file": "01-catalogo-requisitos.md"
1423
+ },
1424
+ {
1425
+ "requirement_id": "ARC-006",
1426
+ "type": "domain-specific",
1427
+ "category": "ARC",
1428
+ "domain": "architecture",
1429
+ "name": "A arquitetura deve integrar controlos técnicos para isolar domínios sensíveis",
1430
+ "applicable_levels": {
1431
+ "L1": true,
1432
+ "L2": true,
1433
+ "L3": true
1434
+ },
1435
+ "source_chapter": 4,
1436
+ "source_file": "01-catalogo-requisitos.md"
1437
+ },
1438
+ {
1439
+ "requirement_id": "ARC-007",
1440
+ "type": "domain-specific",
1441
+ "category": "ARC",
1442
+ "domain": "architecture",
1443
+ "name": "Devem existir padrões de arquitetura segura reutilizáveis, aprovados por segurança",
1444
+ "applicable_levels": {
1445
+ "L1": false,
1446
+ "L2": true,
1447
+ "L3": true
1448
+ },
1449
+ "source_chapter": 4,
1450
+ "source_file": "01-catalogo-requisitos.md"
1451
+ },
1452
+ {
1453
+ "requirement_id": "ARC-008",
1454
+ "type": "domain-specific",
1455
+ "category": "ARC",
1456
+ "domain": "architecture",
1457
+ "name": "Devem ser identificados e protegidos os fluxos de dados entre zonas de confiança",
1458
+ "applicable_levels": {
1459
+ "L1": true,
1460
+ "L2": true,
1461
+ "L3": true
1462
+ },
1463
+ "source_chapter": 4,
1464
+ "source_file": "01-catalogo-requisitos.md"
1465
+ },
1466
+ {
1467
+ "requirement_id": "ARC-009",
1468
+ "type": "domain-specific",
1469
+ "category": "ARC",
1470
+ "domain": "architecture",
1471
+ "name": "Alterações significativas na arquitetura devem desencadear nova revisão de segurança",
1472
+ "applicable_levels": {
1473
+ "L1": false,
1474
+ "L2": true,
1475
+ "L3": true
1476
+ },
1477
+ "source_chapter": 4,
1478
+ "source_file": "01-catalogo-requisitos.md"
1479
+ },
1480
+ {
1481
+ "requirement_id": "ARC-010",
1482
+ "type": "domain-specific",
1483
+ "category": "ARC",
1484
+ "domain": "architecture",
1485
+ "name": "Diagrama(s) de arquitetura devem ser versionados, revistos periodicamente e acessíveis às equipas",
1486
+ "applicable_levels": {
1487
+ "L1": true,
1488
+ "L2": true,
1489
+ "L3": true
1490
+ },
1491
+ "source_chapter": 4,
1492
+ "source_file": "01-catalogo-requisitos.md"
1493
+ },
1494
+ {
1495
+ "requirement_id": "ARC-011",
1496
+ "type": "domain-specific",
1497
+ "category": "ARC",
1498
+ "domain": "architecture",
1499
+ "name": "A arquitetura de aplicações críticas deve implementar segmentação lógica e física entre ambientes",
1500
+ "applicable_levels": {
1501
+ "L1": false,
1502
+ "L2": false,
1503
+ "L3": true
1504
+ },
1505
+ "source_chapter": 4,
1506
+ "source_file": "01-catalogo-requisitos.md"
1507
+ },
1508
+ {
1509
+ "requirement_id": "ARC-012",
1510
+ "type": "domain-specific",
1511
+ "category": "ARC",
1512
+ "domain": "architecture",
1513
+ "name": "Devem ser definidos critérios formais de aprovação da arquitetura para aplicações de risco elevado",
1514
+ "applicable_levels": {
1515
+ "L1": false,
1516
+ "L2": false,
1517
+ "L3": true
1518
+ },
1519
+ "source_chapter": 4,
1520
+ "source_file": "01-catalogo-requisitos.md"
1521
+ },
1522
+ {
1523
+ "requirement_id": "ARC-013",
1524
+ "type": "domain-specific",
1525
+ "category": "ARC",
1526
+ "domain": "architecture",
1527
+ "name": "Devem existir mecanismos de validação automática da topologia em CI/CD ou repositórios como código",
1528
+ "applicable_levels": {
1529
+ "L1": false,
1530
+ "L2": false,
1531
+ "L3": true
1532
+ },
1533
+ "source_chapter": 4,
1534
+ "source_file": "01-catalogo-requisitos.md"
1535
+ },
1536
+ {
1537
+ "requirement_id": "IAC-001",
1538
+ "type": "domain-specific",
1539
+ "category": "IAC",
1540
+ "domain": "infrastructure-as-code",
1541
+ "name": "Backend remoto autenticado com *locking* ativo para controlo de estado",
1542
+ "applicable_levels": {
1543
+ "L1": false,
1544
+ "L2": true,
1545
+ "L3": true
1546
+ },
1547
+ "source_chapter": 8,
1548
+ "source_file": "08-matriz-requisitos-iac.md"
1549
+ },
1550
+ {
1551
+ "requirement_id": "IAC-002",
1552
+ "type": "domain-specific",
1553
+ "category": "IAC",
1554
+ "domain": "infrastructure-as-code",
1555
+ "name": "Ambientes (`dev`, `staging`, `prod`) segregados e versionados",
1556
+ "applicable_levels": {
1557
+ "L1": true,
1558
+ "L2": true,
1559
+ "L3": true
1560
+ },
1561
+ "source_chapter": 8,
1562
+ "source_file": "08-matriz-requisitos-iac.md"
1563
+ },
1564
+ {
1565
+ "requirement_id": "IAC-003",
1566
+ "type": "domain-specific",
1567
+ "category": "IAC",
1568
+ "domain": "infrastructure-as-code",
1569
+ "name": "Validações automáticas obrigatórias (syntax, lint, segurança, policy)",
1570
+ "applicable_levels": {
1571
+ "L1": true,
1572
+ "L2": true,
1573
+ "L3": true
1574
+ },
1575
+ "source_chapter": 8,
1576
+ "source_file": "08-matriz-requisitos-iac.md"
1577
+ },
1578
+ {
1579
+ "requirement_id": "IAC-004",
1580
+ "type": "domain-specific",
1581
+ "category": "IAC",
1582
+ "domain": "infrastructure-as-code",
1583
+ "name": "Módulos reutilizados com origem confiável e versão imutável",
1584
+ "applicable_levels": {
1585
+ "L1": false,
1586
+ "L2": true,
1587
+ "L3": true
1588
+ },
1589
+ "source_chapter": 8,
1590
+ "source_file": "08-matriz-requisitos-iac.md"
1591
+ },
1592
+ {
1593
+ "requirement_id": "IAC-005",
1594
+ "type": "domain-specific",
1595
+ "category": "IAC",
1596
+ "domain": "infrastructure-as-code",
1597
+ "name": "Histórico completo com versionamento, *tags* e *releases*",
1598
+ "applicable_levels": {
1599
+ "L1": true,
1600
+ "L2": true,
1601
+ "L3": true
1602
+ },
1603
+ "source_chapter": 8,
1604
+ "source_file": "08-matriz-requisitos-iac.md"
1605
+ },
1606
+ {
1607
+ "requirement_id": "IAC-006",
1608
+ "type": "domain-specific",
1609
+ "category": "IAC",
1610
+ "domain": "infrastructure-as-code",
1611
+ "name": "Convenções formais de naming, tagging e layout de diretórios",
1612
+ "applicable_levels": {
1613
+ "L1": false,
1614
+ "L2": true,
1615
+ "L3": true
1616
+ },
1617
+ "source_chapter": 8,
1618
+ "source_file": "08-matriz-requisitos-iac.md"
1619
+ },
1620
+ {
1621
+ "requirement_id": "IAC-007",
1622
+ "type": "domain-specific",
1623
+ "category": "IAC",
1624
+ "domain": "infrastructure-as-code",
1625
+ "name": "*Plan* rastreável e aprovado antes de qualquer *apply*",
1626
+ "applicable_levels": {
1627
+ "L1": false,
1628
+ "L2": true,
1629
+ "L3": true
1630
+ },
1631
+ "source_chapter": 8,
1632
+ "source_file": "08-matriz-requisitos-iac.md"
1633
+ },
1634
+ {
1635
+ "requirement_id": "IAC-008",
1636
+ "type": "domain-specific",
1637
+ "category": "IAC",
1638
+ "domain": "infrastructure-as-code",
1639
+ "name": "Rastreabilidade ficheiro → recurso → ambiente",
1640
+ "applicable_levels": {
1641
+ "L1": false,
1642
+ "L2": true,
1643
+ "L3": true
1644
+ },
1645
+ "source_chapter": 8,
1646
+ "source_file": "08-matriz-requisitos-iac.md"
1647
+ },
1648
+ {
1649
+ "requirement_id": "IAC-009",
1650
+ "type": "domain-specific",
1651
+ "category": "IAC",
1652
+ "domain": "infrastructure-as-code",
1653
+ "name": "Enforcement automático de políticas em pipeline",
1654
+ "applicable_levels": {
1655
+ "L1": false,
1656
+ "L2": false,
1657
+ "L3": true
1658
+ },
1659
+ "source_chapter": 8,
1660
+ "source_file": "08-matriz-requisitos-iac.md"
1661
+ },
1662
+ {
1663
+ "requirement_id": "IAC-010",
1664
+ "type": "domain-specific",
1665
+ "category": "IAC",
1666
+ "domain": "infrastructure-as-code",
1667
+ "name": "Artefactos (`plan`, `apply`, manifests) versionados e com hash",
1668
+ "applicable_levels": {
1669
+ "L1": false,
1670
+ "L2": true,
1671
+ "L3": true
1672
+ },
1673
+ "source_chapter": 8,
1674
+ "source_file": "08-matriz-requisitos-iac.md"
1675
+ },
1676
+ {
1677
+ "requirement_id": "IAC-011",
1678
+ "type": "domain-specific",
1679
+ "category": "IAC",
1680
+ "domain": "infrastructure-as-code",
1681
+ "name": "Gestão segura de segredos (sem *hardcoding*)",
1682
+ "applicable_levels": {
1683
+ "L1": true,
1684
+ "L2": true,
1685
+ "L3": true
1686
+ },
1687
+ "source_chapter": 8,
1688
+ "source_file": "08-matriz-requisitos-iac.md"
1689
+ },
1690
+ {
1691
+ "requirement_id": "IAC-012",
1692
+ "type": "domain-specific",
1693
+ "category": "IAC",
1694
+ "domain": "infrastructure-as-code",
1695
+ "name": "Deteção automatizada de *drift* entre IaC e estado real",
1696
+ "applicable_levels": {
1697
+ "L1": false,
1698
+ "L2": true,
1699
+ "L3": true
1700
+ },
1701
+ "source_chapter": 8,
1702
+ "source_file": "08-matriz-requisitos-iac.md"
1703
+ },
1704
+ {
1705
+ "requirement_id": "IAC-013",
1706
+ "type": "domain-specific",
1707
+ "category": "IAC",
1708
+ "domain": "infrastructure-as-code",
1709
+ "name": "Revisão periódica formal de módulos e templates IaC",
1710
+ "applicable_levels": {
1711
+ "L1": false,
1712
+ "L2": false,
1713
+ "L3": true
1714
+ },
1715
+ "source_chapter": 8,
1716
+ "source_file": "08-matriz-requisitos-iac.md"
1717
+ },
1718
+ {
1719
+ "requirement_id": "ENC-001",
1720
+ "type": "base",
1721
+ "category": "ENC",
1722
+ "domain": null,
1723
+ "name": "Encriptação de dados em trânsito",
1724
+ "applicable_levels": {
1725
+ "L1": true,
1726
+ "L2": true,
1727
+ "L3": true
1728
+ },
1729
+ "source_chapter": 2,
1730
+ "source_file": "10-validacao-requisitos.md"
1731
+ },
1732
+ {
1733
+ "requirement_id": "ENC-002",
1734
+ "type": "base",
1735
+ "category": "ENC",
1736
+ "domain": null,
1737
+ "name": "Encriptação de dados em repouso",
1738
+ "applicable_levels": {
1739
+ "L1": false,
1740
+ "L2": true,
1741
+ "L3": true
1742
+ },
1743
+ "source_chapter": 2,
1744
+ "source_file": "10-validacao-requisitos.md"
1745
+ },
1746
+ {
1747
+ "requirement_id": "ENC-003",
1748
+ "type": "base",
1749
+ "category": "ENC",
1750
+ "domain": null,
1751
+ "name": "Uso de algoritmos criptográficos robustos",
1752
+ "applicable_levels": {
1753
+ "L1": false,
1754
+ "L2": true,
1755
+ "L3": true
1756
+ },
1757
+ "source_chapter": 2,
1758
+ "source_file": "10-validacao-requisitos.md"
1759
+ },
1760
+ {
1761
+ "requirement_id": "ENC-004",
1762
+ "type": "base",
1763
+ "category": "ENC",
1764
+ "domain": null,
1765
+ "name": "Proteção de passwords com hashing seguro",
1766
+ "applicable_levels": {
1767
+ "L1": true,
1768
+ "L2": true,
1769
+ "L3": true
1770
+ },
1771
+ "source_chapter": 2,
1772
+ "source_file": "10-validacao-requisitos.md"
1773
+ },
1774
+ {
1775
+ "requirement_id": "ENC-005",
1776
+ "type": "base",
1777
+ "category": "ENC",
1778
+ "domain": null,
1779
+ "name": "Gestão segura de chaves e segredos (cofre)",
1780
+ "applicable_levels": {
1781
+ "L1": false,
1782
+ "L2": false,
1783
+ "L3": true
1784
+ },
1785
+ "source_chapter": 2,
1786
+ "source_file": "10-validacao-requisitos.md"
1787
+ },
1788
+ {
1789
+ "requirement_id": "ENC-006",
1790
+ "type": "base",
1791
+ "category": "ENC",
1792
+ "domain": null,
1793
+ "name": "Prevenção de exportação indevida de dados sensíveis",
1794
+ "applicable_levels": {
1795
+ "L1": false,
1796
+ "L2": true,
1797
+ "L3": true
1798
+ },
1799
+ "source_chapter": 2,
1800
+ "source_file": "10-validacao-requisitos.md"
1801
+ },
1802
+ {
1803
+ "requirement_id": "ENC-007",
1804
+ "type": "base",
1805
+ "category": "ENC",
1806
+ "domain": null,
1807
+ "name": "Mascaramento de dados sensíveis em logs",
1808
+ "applicable_levels": {
1809
+ "L1": true,
1810
+ "L2": true,
1811
+ "L3": true
1812
+ },
1813
+ "source_chapter": 2,
1814
+ "source_file": "10-validacao-requisitos.md"
1815
+ },
1816
+ {
1817
+ "requirement_id": "ENC-008",
1818
+ "type": "base",
1819
+ "category": "ENC",
1820
+ "domain": null,
1821
+ "name": "Rotação periódica de segredos e chaves",
1822
+ "applicable_levels": {
1823
+ "L1": false,
1824
+ "L2": false,
1825
+ "L3": true
1826
+ },
1827
+ "source_chapter": 2,
1828
+ "source_file": "10-validacao-requisitos.md"
1829
+ },
1830
+ {
1831
+ "requirement_id": "ENC-009",
1832
+ "type": "base",
1833
+ "category": "ENC",
1834
+ "domain": null,
1835
+ "name": "Deteção de segredos expostos em repositórios",
1836
+ "applicable_levels": {
1837
+ "L1": false,
1838
+ "L2": true,
1839
+ "L3": true
1840
+ },
1841
+ "source_chapter": 2,
1842
+ "source_file": "10-validacao-requisitos.md"
1843
+ },
1844
+ {
1845
+ "requirement_id": "ENC-010",
1846
+ "type": "base",
1847
+ "category": "ENC",
1848
+ "domain": null,
1849
+ "name": "Prevenção de caching de dados sensíveis no browser",
1850
+ "applicable_levels": {
1851
+ "L1": false,
1852
+ "L2": true,
1853
+ "L3": true
1854
+ },
1855
+ "source_chapter": 2,
1856
+ "source_file": "10-validacao-requisitos.md"
1857
+ }
1858
+ ]
1859
+ }