@soleur/opencode 0.0.0-stage → 3.354.2

package/skills/gdpr-gate/references/layers/data-in-transit.md

@@ -0,0 +1,331 @@
+<!-- Adapted from gosprinto/compliance-skills (MIT) — see NOTICE -->
+# Layer: Data in Transit
+
+## When This Layer Loads
+
+Auto-trigger inline when Claude is about to generate:
+- Any `fetch`, `axios`, `requests`, `http` or similar HTTP client code
+- Any middleware, interceptor, or request/response logger
+- Any webhook handler or inbound HTTP endpoint
+- Any internal service-to-service API call
+- Any URL construction that includes user data
+- Any request logging or monitoring setup
+
+Also loads during full repo scan.
+
+---
+
+## T-01: PII in URL Query Parameters
+
+What to grep:
+```
+?email=
+?phone=
+?ssn=
+?token=          (in URL, not header)
+?key=
+`/api/users?email=${
+`/search?phone=${
+req.query.email
+req.query.ssn
+params[:email]
+request.GET['email']
+```
+
+Flag when:
+- PII passed as query parameter in any HTTP call
+- Auth tokens in query strings: `?token=abc123`, `?api_key=xyz`
+- Email used as query param for lookup: `/verify?email=john@doe.com`
+
+Why it matters: Query parameters appear in:
+- Server access logs (stored indefinitely by default)
+- Browser history
+- HTTP Referer headers sent to third parties
+- CDN and proxy logs
+- Analytics tools that capture full URLs
+
+Fix pattern:
+```javascript
+// Wrong
+await fetch(`/api/users?email=${email}&dob=${dob}`)
+await fetch(`/api/verify?token=${resetToken}`)
+
+// Right — POST body for PII, opaque IDs in URLs
+await fetch('/api/users/lookup', {
+  method: 'POST',
+  body: JSON.stringify({ email, dob }),
+  headers: { 'Content-Type': 'application/json' }
+})
+
+// For tokens — use short path param that's opaque, not the PII itself
+await fetch(`/api/verify/${opaqueCode}`)
+// Server resolves opaqueCode to user server-side — email never in URL
+```
+
+Regulation: CCPA, HIPAA, PCI-DSS
+
+---
+
+## T-02: Hardcoded HTTP (Not HTTPS) for Internal Calls
+
+What to grep:
+```
+http://          (in fetch, axios, requests, etc — not localhost)
+'http://api.
+"http://service.
+http://internal.
+http://microservice.
+requests.get('http://
+axios.get('http://
+fetch('http://
+RestClient.get('http://
+```
+
+Flag when:
+- Internal service-to-service calls over HTTP (not HTTPS)
+- Hardcoded `http://` to non-localhost URLs in API clients
+- Database connection strings using unencrypted protocol
+
+Note: `http://localhost` is acceptable in development. Flag all others.
+
+Fix pattern:
+```javascript
+// Wrong
+const response = await axios.get('http://user-service.internal/api/users')
+const data = await fetch('http://payments-api/charge')
+
+// Right
+const response = await axios.get('https://user-service.internal/api/users')
+// Also: enforce via environment variables, never hardcode protocol+host
+const API_BASE = process.env.USER_SERVICE_URL  // set to https:// in env
+```
+
+Regulation: HIPAA (transmission security), PCI-DSS, GLBA
+
+---
+
+## T-03: Webhook Signature Not Verified
+
+What to grep:
+```
+app.post('/webhook'
+router.post('/webhook'
+app.post('/hooks/
+def webhook(
+async webhook(
+stripe.webhooks.      (check if constructEvent is used)
+```
+
+Flag when:
+- Webhook endpoint processes payload without verifying signature
+- No `x-signature`, `x-hub-signature`, or vendor-specific header check
+- Signature present but not validated before payload is processed
+
+Why it matters: Unverified webhooks allow anyone to POST fake events
+to your endpoint — including fake payment confirmations or user data.
+
+Fix pattern:
+```javascript
+// Wrong
+app.post('/webhook/stripe', express.json(), async (req, res) => {
+  const event = req.body  // trusting payload blindly
+  await processEvent(event)
+})
+
+// Right
+app.post('/webhook/stripe',
+  express.raw({ type: 'application/json' }),  // raw body needed for sig check
+  async (req, res) => {
+    const sig = req.headers['stripe-signature']
+    let event
+    try {
+      event = stripe.webhooks.constructEvent(req.body, sig, process.env.STRIPE_WEBHOOK_SECRET)
+    } catch (err) {
+      return res.status(400).send('Webhook signature verification failed')
+    }
+    await processEvent(event)
+  }
+)
+```
+
+Regulation: PCI-DSS, FTC Act
+
+---
+
+## T-04: PII in HTTP Headers (Non-Auth)
+
+What to grep:
+```
+req.headers['x-user-email'
+res.setHeader('x-user-
+headers: { 'x-email':
+'X-User-Data':
+'X-Customer-Info':
+```
+
+Flag when:
+- PII passed in custom HTTP headers between services
+- Full user object serialized into a custom header
+- Email, phone, or SSN in a forwarded header
+
+Why it matters: Headers appear in proxy logs, CDN logs, and load balancer logs.
+Custom headers with PII create unintended log exposure across your infrastructure.
+
+Fix pattern:
+```javascript
+// Wrong
+await fetch('/api/process', {
+  headers: {
+    'X-User-Email': user.email,
+    'X-User-Phone': user.phone,
+    'X-User-Data': JSON.stringify(user)
+  }
+})
+
+// Right — pass opaque user ID only, resolve server-side
+await fetch('/api/process', {
+  headers: {
+    'X-User-Id': user.id,           // opaque ID only
+    'Authorization': `Bearer ${token}`
+  }
+})
+```
+
+Regulation: CCPA, HIPAA
+
+---
+
+## T-05: Sensitive Data in Request Logging Middleware
+
+What to grep:
+```
+morgan(
+app.use(logger(
+expressWinston.logger(
+requestLogger
+logRequests
+before_action :log
+rack middleware
+```
+
+Flag when:
+- Request logging middleware logs full request body
+- No body sanitization before logging
+- Response body logged (may contain PII from DB)
+
+Fix pattern:
+```javascript
+// Wrong
+app.use(morgan('combined'))  // logs full URL including query params with PII
+app.use((req, res, next) => {
+  console.log(req.body)  // logs passwords, PII
+  next()
+})
+
+// Right
+app.use(morgan(':method :url :status :response-time ms'))
+// Custom sanitizing middleware
+app.use((req, res, next) => {
+  const safeBody = sanitizeForLog(req.body, ['password', 'ssn', 'card_number', 'cvv'])
+  req.log = { method: req.method, path: req.path, body: safeBody }
+  next()
+})
+
+function sanitizeForLog(body, sensitiveFields) {
+  const safe = { ...body }
+  sensitiveFields.forEach(f => { if (safe[f]) safe[f] = '[REDACTED]' })
+  return safe
+}
+```
+
+Regulation: CCPA, HIPAA, PCI-DSS
+
+---
+
+## T-06: HTTPS Not Enforced
+
+What to grep:
+```
+http://             (non-localhost hardcoded URLs in server config)
+HSTS
+helmet(             (check if hsts is configured)
+Strict-Transport-Security
+force_ssl
+config.force_ssl
+SECURE_SSL_REDIRECT (Django)
+```
+
+Flag when:
+- No HSTS header configured in production middleware
+- No HTTP → HTTPS redirect middleware
+- `http://` hardcoded in allowed origins or callback URLs
+- `helmet()` used without HSTS config
+- Django `SECURE_SSL_REDIRECT = False` or not set
+
+Fix pattern:
+```javascript
+// Wrong — no HTTPS enforcement
+app.use(helmet())  // helmet defaults don't include HSTS
+
+// Right
+app.use(helmet({
+  hsts: {
+    maxAge: 31536000,       // 1 year
+    includeSubDomains: true,
+    preload: true
+  }
+}))
+
+// HTTP → HTTPS redirect middleware
+app.use((req, res, next) => {
+  if (process.env.NODE_ENV === 'production' && !req.secure) {
+    return res.redirect(301, `https://${req.headers.host}${req.url}`)
+  }
+  next()
+})
+```
+
+```python
+# Django settings.py
+SECURE_SSL_REDIRECT = True          # redirect HTTP → HTTPS
+SECURE_HSTS_SECONDS = 31536000      # 1 year
+SECURE_HSTS_INCLUDE_SUBDOMAINS = True
+SECURE_HSTS_PRELOAD = True
+SESSION_COOKIE_SECURE = True
+CSRF_COOKIE_SECURE = True
+```
+
+```ruby
+# Rails config/environments/production.rb
+config.force_ssl = true
+```
+
+Regulation: HIPAA (transmission security), PCI-DSS, GLBA
+
+---
+
+## DT-EU-CB: Cross-Border Transfer (GDPR Chapter V)
+
+EU extension (not in upstream Sprinto). Chapter V (Articles 44-49) restricts personal-data transfers outside the EEA / countries lacking an adequacy decision.
+
+What to grep:
+```
+fetch("https://api.<vendor>.com/...
+process.env.STRIPE_API_KEY
+process.env.OPENAI_API_KEY
+process.env.ANTHROPIC_API_KEY
+process.env.SENDGRID_API_KEY
+new <Vendor>Client(...)
+```
+
+Flag when:
+- A new third-party vendor environment variable or SDK is introduced AND the vendor's data-processing locale is outside the EEA AND the vendor is not present in `knowledge-base/legal/compliance-posture.md` Vendor DPAs
+- A request handler forwards request bodies, headers, or any user-derived field to a non-EEA endpoint
+
+Why it matters: Each new non-EEA processor is a Chapter V transfer. Without a Standard Contractual Clauses (SCC) or adequacy basis recorded in `compliance-posture.md`, the transfer lacks a lawful basis and is a regulator-complaint-shaped failure surface.
+
+Adequacy short-list (2026, non-exhaustive): EU/EEA, UK, Switzerland, Canada (commercial), Japan, South Korea, New Zealand, Argentina, Israel, Uruguay, Faroe Islands, Andorra, Guernsey, Isle of Man, Jersey. US transfers require Data Privacy Framework participation OR SCCs.
+
+Fix pattern: every new non-EEA vendor MUST land a Vendor DPA row in `compliance-posture.md` (operator-managed, gate never writes the row). The gate emits `Important` severity on detection so the row gap is visible at design time.
+
+Regulation: GDPR Chapter V (Art. 44-49), UK GDPR, Swiss FADP

package/skills/gdpr-gate/references/layers/data-lifecycle.md

@@ -0,0 +1,341 @@
+<!-- Adapted from gosprinto/compliance-skills (MIT) — see NOTICE -->
+# Layer: Data Lifecycle
+
+## When This Layer Loads
+
+Auto-trigger inline when Claude is about to generate:
+- Any delete, destroy, or remove function on user/customer records
+- Any anonymization or scrubbing function
+- Any data export or portability endpoint
+- Any cron job, scheduled task, or background worker
+- Any backup script or database dump
+- Any retention policy or cleanup job
+- Any cascade delete or foreign key relationship setup
+
+Also loads during full repo scan.
+
+---
+
+## DL-01: No Hard-Delete Path (Soft-Delete Only)
+
+What to grep:
+```
+deleted_at
+paranoid:        (Sequelize paranoid, Rails acts_as_paranoid)
+acts_as_paranoid
+SoftDelete
+is_deleted
+is_active: false (as substitute for deletion)
+```
+
+Flag when:
+- Model has `deleted_at` but no corresponding hard-delete function
+- ORM paranoid/soft-delete mode with no escape hatch
+- `is_deleted` flag set but record stays in DB indefinitely
+- No documented path to permanently purge a user's data
+
+Why it matters: CCPA right to erasure requires actual deletion, not just hiding
+records. Soft-delete alone is not sufficient — data is still in the database,
+still in backups, and still exposed in a breach.
+
+Fix pattern:
+```javascript
+// Wrong — soft delete only, no hard delete
+async function deleteUser(userId) {
+  await User.update({ deleted_at: new Date() }, { where: { id: userId } })
+  // Record still in DB, still in backups, never truly gone
+}
+
+// Right — soft delete for grace period, then hard delete
+async function deleteUser(userId) {
+  // Mark for deletion with timestamp
+  await User.update({
+    deleted_at: new Date(),
+    deletion_scheduled_at: new Date(Date.now() + 30 * 24 * 3600000) // 30 day grace
+  }, { where: { id: userId } })
+}
+
+// Scheduled job — runs nightly
+async function purgeDeletedUsers() {
+  const users = await User.findAll({
+    where: {
+      deletion_scheduled_at: { [Op.lt]: new Date() }
+    }
+  })
+  for (const user of users) {
+    await cascadeDeleteUserData(user.id)  // see DL-02
+    await user.destroy({ force: true })   // hard delete
+  }
+}
+```
+
+Regulation: CCPA (right to erasure), HIPAA
+
+---
+
+## DL-02: Deletion Doesn't Cascade to Related Tables
+
+What to grep:
+```
+User.destroy(
+User.delete(
+user.delete()
+DELETE FROM users
+await user.remove()
+```
+
+Flag when:
+- User deleted from `users` table but related records remain
+- No cascade delete on foreign keys
+- PII orphaned in: `orders`, `addresses`, `payment_methods`, `audit_logs`,
+  `sessions`, `notifications`, `support_tickets`, `analytics_events`
+- Related tables not listed in deletion function
+
+Why it matters: Deleting the user row leaves PII scattered across the database.
+A CCPA deletion request must remove data from ALL tables, not just `users`.
+
+Fix pattern:
+```javascript
+// Wrong
+async function deleteUser(userId) {
+  await User.destroy({ where: { id: userId } })
+  // Orders, addresses, payment methods, sessions still in DB
+}
+
+// Right — explicit cascade
+async function cascadeDeleteUserData(userId) {
+  await db.transaction(async (t) => {
+    // Anonymize audit logs (keep for legal compliance, remove PII)
+    await AuditLog.update(
+      { user_id: null, ip_address: null, user_agent: null },
+      { where: { user_id: userId }, transaction: t }
+    )
+    // Hard delete everything else
+    await Session.destroy({ where: { user_id: userId }, transaction: t })
+    await Address.destroy({ where: { user_id: userId }, transaction: t })
+    await PaymentMethod.destroy({ where: { user_id: userId }, transaction: t })
+    await Notification.destroy({ where: { user_id: userId }, transaction: t })
+    await Order.update(  // anonymize orders (keep for accounting)
+      { user_id: null, shipping_address: '[deleted]', billing_name: '[deleted]' },
+      { where: { user_id: userId }, transaction: t }
+    )
+    await User.destroy({ where: { id: userId }, force: true, transaction: t })
+  })
+  // Also: trigger deletion from downstream vendors (email tool, CRM, analytics)
+}
+```
+
+Regulation: CCPA, HIPAA
+
+---
+
+## DL-03: Anonymization That Doesn't Actually Anonymize
+
+What to grep:
+```
+anonymize(
+anonymise(
+scrub_user(
+redact(
+null             (setting fields to null as "anonymization")
+'[deleted]'      (replacing with literal string)
+```
+
+Flag when:
+- "Anonymization" only nulls out name/email but keeps DOB + zip + gender (re-identifiable combo)
+- Email replaced with `[deleted]` but user_id kept linked to other tables
+- IP addresses kept after "anonymization"
+- Unique identifiers (phone, SSN) replaced with placeholder that's still unique
+
+Why it matters: A user with DOB + zip code + gender is re-identifiable in 87%
+of cases (Latanya Sweeney). Nulling name and email while keeping these fields
+is not anonymization — it's pseudonymization at best.
+
+Fix pattern:
+```javascript
+// Wrong — leaves re-identifiable combination
+async function anonymizeUser(userId) {
+  await User.update({
+    email: null,        // removed
+    name: null,         // removed
+    // dob, zip, gender, ip_address still present — re-identifiable
+  }, { where: { id: userId } })
+}
+
+// Right — remove or generalize all quasi-identifiers
+async function anonymizeUser(userId) {
+  await User.update({
+    email: `anon_${crypto.randomUUID()}@deleted.invalid`,  // unique but not real
+    name: null,
+    phone: null,
+    ip_address: null,
+    date_of_birth: null,          // or replace with birth_year only
+    zip_code: zip.slice(0, 3) + '00',  // generalize to 3-digit prefix
+    // Keep: aggregated/non-identifying analytics only
+  }, { where: { id: userId } })
+}
+```
+
+Regulation: CCPA, HIPAA, FTC Act
+
+---
+
+## DL-04: No Data Export / Portability Function (GDPR Art. 20 + CCPA)
+
+EU rewrite (upstream framed CCPA-only). GDPR Art. 20 grants the data subject the right to receive personal data in a "structured, commonly used and machine-readable format" and to transmit it to another controller. CCPA grants a parallel right under §1798.110/.130. Both apply.
+
+What to grep:
+```
+export_user_data
+download_my_data
+data_export
+portability
+/api/users/export
+/account/download
+```
+
+Flag when:
+- No data export endpoint or function exists in the codebase
+- Export function exists but omits tables (check it covers all PII tables — see DL-02 cascade audit)
+- Export format is not machine-readable (Art. 20 + CCPA both require structured format)
+- Export omits data subject fields obtainable under Art. 15 right of access (which is broader than Art. 20 portability)
+
+Why it matters: GDPR Art. 20 is enforceable independently of Art. 15 access requests. CCPA aligns. Without an automatable export endpoint, every DSAR becomes a manual SQL job — and the gate at FR4.3 (`GDPR-Art-17`) cannot verify deletability without evidence of complete enumeration first.
+
+Fix pattern:
+```javascript
+// Minimum viable GDPR Art. 20 + CCPA data export
+app.get('/api/account/export', auth, async (req, res) => {
+  const userId = req.user.id
+
+  const [user, orders, addresses, activityLog] = await Promise.all([
+    User.findById(userId).select('-password_hash -ssn_encrypted'),
+    Order.findAll({ where: { user_id: userId } }),
+    Address.findAll({ where: { user_id: userId } }),
+    ActivityLog.findAll({ where: { user_id: userId } })
+  ])
+
+  const export_data = {
+    exported_at: new Date().toISOString(),
+    profile: user,
+    orders,
+    addresses,
+    activity: activityLog
+  }
+
+  res.setHeader('Content-Disposition', 'attachment; filename="my-data.json"')
+  res.setHeader('Content-Type', 'application/json')
+  res.json(export_data)
+
+  // Log the export request for audit trail
+  await AuditLog.create({ user_id: userId, action: 'data_export_requested' })
+})
+```
+
+Regulation: GDPR Art. 20 (right to data portability), GDPR Art. 15 (right of access), CCPA §1798.110/.130, CPRA
+
+---
+
+## DL-05: No Retention Policy Enforcement in Code
+
+What to grep:
+```
+created_at         (check if old records are ever purged)
+expires_at         (check if expiry is actually enforced)
+purge_at
+scheduled_deletion
+cron               (check if cleanup jobs exist)
+sidekiq            (check for cleanup workers)
+celery             (check for cleanup tasks)
+```
+
+Flag when:
+- PII tables have no cleanup job or scheduled purge
+- `expires_at` field exists but no code actually checks or enforces it
+- Session table grows unboundedly (no cleanup of expired sessions)
+- Audit logs accumulate forever with no retention limit
+
+Fix pattern:
+```javascript
+// Retention enforcement job (run nightly via cron/Sidekiq/Celery)
+async function enforceRetentionPolicies() {
+  const now = new Date()
+
+  // Expired sessions
+  await Session.destroy({
+    where: { expires_at: { [Op.lt]: now } }
+  })
+
+  // Audit logs older than 2 years
+  const twoYearsAgo = new Date(now - 2 * 365 * 24 * 3600000)
+  await AuditLog.destroy({
+    where: { created_at: { [Op.lt]: twoYearsAgo } }
+  })
+
+  // Soft-deleted users past grace period
+  await purgeDeletedUsers()
+
+  // Unverified accounts older than 30 days (never activated)
+  const thirtyDaysAgo = new Date(now - 30 * 24 * 3600000)
+  await User.destroy({
+    where: {
+      email_verified_at: null,
+      created_at: { [Op.lt]: thirtyDaysAgo }
+    },
+    force: true
+  })
+}
+```
+
+Regulation: CCPA, HIPAA, GLBA
+
+---
+
+## DL-06: PII in Database Backups Without Encryption
+
+What to grep:
+```
+pg_dump
+mysqldump
+mongodump
+backup
+db:backup
+rake db:dump
+s3.upload          (near backup-related code)
+```
+
+Flag when:
+- Backup scripts run without encryption flag
+- Backup files uploaded to S3 without server-side encryption
+- Backup destination is publicly accessible bucket
+- No TTL/lifecycle policy on backup files (kept indefinitely)
+
+Fix pattern:
+```bash
+# Wrong
+pg_dump mydb > backup.sql
+aws s3 cp backup.sql s3://my-backups/
+
+# Right
+pg_dump mydb | gzip | \
+  openssl enc -aes-256-cbc -pass env:BACKUP_ENCRYPTION_KEY | \
+  aws s3 cp - s3://my-backups/backup-$(date +%Y%m%d).sql.gz.enc \
+  --sse AES256 \
+  --storage-class STANDARD_IA
+
+# S3 bucket policy: block public access
+# S3 lifecycle rule: delete backups older than 90 days
+```
+
+```javascript
+// In application backup code
+await s3.putObject({
+  Bucket: 'my-backups',
+  Key: `backup-${Date.now()}.sql.gz`,
+  Body: encryptedBackupStream,
+  ServerSideEncryption: 'AES256',
+  ACL: 'private',                    // never public
+})
+```
+
+Regulation: HIPAA, PCI-DSS, CCPA, GLBA