@sun-asterisk/sunlint 1.3.36 → 1.3.38

package/config/rules/rules-registry-generated.json

@@ -1833,8 +1833,8 @@
       ]
     },
     "D001": {
-      "name": "Keep parameter names consistent when overriding methods",
-      "description": "Maintain consistency between inherited classes",
+      "name": "Recommended Lint Rules Should Be Enabled",
+      "description": "Ensure code quality through standard lint configurations",
       "category": "Common",
       "severity": "major",
       "languages": [
@@ -1848,7 +1848,9 @@
         "code-quality"
       ],
       "tools": [
-        "`dart lint` (`avoid_renaming_method_parameters`)"
+        "`dart lint` (flutter_lints",
+        "very_good_analysis",
+        "lints)"
       ],
       "framework": "All",
       "principles": [
@@ -3562,25 +3564,25 @@
       ]
     },
     "S001": {
-      "name": "Fail securely when access control errors occur",
-      "description": "Ensure the system does not accidentally grant access when errors occur, helping to reduce the risk of unauthorized access and protect sensitive resources.",
+      "name": "Authenticate backend component communications securely",
+      "description": "Ensure all communications between backend components (APIs, middleware, data layers) are authenticated using secure, short-lived credentials instead of static secrets.",
       "category": "Common",
       "severity": "critical",
       "languages": [
         "All languages"
       ],
-      "version": "1.1",
-      "status": "draft",
+      "version": "2.0",
+      "status": "activated",
       "tags": [
         "Common",
         "readability",
         "code-quality"
       ],
       "tools": [
-        "SonarQube (S4524)",
-        "PMD (SecurityCodeGuidelines)",
         "Manual Review",
-        "Unit Test"
+        "IAM Policy Audit",
+        "mTLS Scanner",
+        "Secret Rotation Checker"
       ],
       "framework": "All",
       "principles": [
@@ -3589,24 +3591,26 @@
       ]
     },
     "S002": {
-      "name": "Avoid IDOR vulnerabilities in CRUD operations",
-      "description": "Prevent unauthorized access to sensitive data by verifying users' actual access rights, avoiding reliance solely on IDs in URLs.",
+      "name": "Protect against OS command injection",
+      "description": "Prevent OS command injection attacks by ensuring all operating system calls use parameterized queries or proper output encoding.",
       "category": "Common",
       "severity": "critical",
       "languages": [
         "All languages"
       ],
-      "version": "1.1",
-      "status": "draft",
+      "version": "2.0",
+      "status": "activated",
       "tags": [
         "Common",
         "readability",
         "code-quality"
       ],
       "tools": [
-        "SonarQube (S6142",
-        "S2076)",
-        "Semgrep (custom rule)",
+        "SonarQube (S2076",
+        "S4721)",
+        "Semgrep (command-injection)",
+        "Bandit (B602",
+        "B603)",
         "Manual Review"
       ],
       "framework": "All",
@@ -3668,14 +3672,14 @@
       ]
     },
     "S005": {
-      "name": "Do not use Origin header for authentication or access control",
-      "description": "Prevent authentication or authorization decisions based on `Origin` header – which can be easily spoofed from the client side and is unreliable for security purposes.",
+      "name": "Enforce authorization at trusted service layer",
+      "description": "Ensure authorization rules are enforced at a trusted server-side service layer, not relying on client-side controls that can be manipulated.",
       "category": "Common",
-      "severity": "major",
+      "severity": "critical",
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
+      "version": "2.0",
       "status": "activated",
       "tags": [
         "Common",
@@ -3684,7 +3688,8 @@
       ],
       "tools": [
         "Manual Review",
-        "Semgrep (custom rule)",
+        "Static Analysis",
+        "Penetration Testing",
         "SonarQube (custom rule)"
       ],
       "framework": "All",
@@ -3694,14 +3699,14 @@
       ]
     },
     "S006": {
-      "name": "Do not send recovery or activation codes in plaintext",
-      "description": "Prevent leakage of verification codes, recovery codes, or activation tokens if email/SMS is intercepted or exposed – thereby minimizing the risk of account takeover attacks.",
+      "name": "Do not use default credentials for service authentication",
+      "description": "Ensure service authentication never uses default or well-known credentials that attackers can easily guess or find in documentation.",
       "category": "Common",
-      "severity": "major",
+      "severity": "critical",
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
+      "version": "2.0",
       "status": "activated",
       "tags": [
         "Common",
@@ -3710,9 +3715,10 @@
       ],
       "tools": [
         "Manual Review",
-        "Semgrep (custom rule)",
-        "Secret Detection (regex scanner)",
-        "SonarQube (custom rule)"
+        "Secret Scanner",
+        "GitLeaks",
+        "TruffleHog",
+        "CI/CD Policy Checks"
       ],
       "framework": "All",
       "principles": [
@@ -3721,14 +3727,14 @@
       ]
     },
     "S007": {
-      "name": "Do not store OTP codes in plaintext",
-      "description": "Protect the system from OTP reuse attacks if database/logs are accessed without authorization. OTP, magic-links, or reset codes must be treated like passwords – only stored in one-way hashed form, not recoverable.",
+      "name": "Perform output encoding before interpreter use",
+      "description": "Ensure the application performs proper output encoding and escaping as a final step before data is used by the target interpreter, preventing injection attacks.",
       "category": "Common",
       "severity": "major",
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
+      "version": "2.0",
       "status": "activated",
       "tags": [
         "Common",
@@ -3736,10 +3742,11 @@
         "code-quality"
       ],
       "tools": [
-        "Manual Review",
-        "Semgrep (custom rule)",
-        "Secret Detection",
-        "SonarQube (custom rule)"
+        "SonarQube (S5131",
+        "S2076)",
+        "Semgrep (injection rules)",
+        "ESLint",
+        "Manual Review"
       ],
       "framework": "All",
       "principles": [
@@ -3748,42 +3755,41 @@
       ]
     },
     "S008": {
-      "name": "Encryption algorithms and parameters must support flexible configuration and upgrades (crypto agility)",
-      "description": "Avoid binding the system to outdated cryptographic algorithms or parameters (like MD5, SHA-1, DES...), ensuring easy upgrades when standards change or new vulnerabilities emerge.",
+      "name": "Validate and sanitize SVG content",
+      "description": "Ensure user-supplied SVG (Scalable Vector Graphics) content is validated or sanitized to prevent script injection and other attacks.",
       "category": "Common",
       "severity": "major",
       "languages": [
         "All languages"
       ],
-      "version": "1.1",
-      "status": "draft",
+      "version": "2.0",
+      "status": "activated",
       "tags": [
         "Common",
         "readability",
         "code-quality"
       ],
       "tools": [
+        "DOMPurify",
+        "svg-sanitizer",
         "Manual Review",
-        "Semgrep (custom rule)",
-        "Secret Scanners",
-        "SonarQube (custom rule)"
+        "CSP Headers"
       ],
       "framework": "All",
       "principles": [
         "CODE_QUALITY",
-        "MAINTAINABILITY",
         "SECURITY"
       ]
     },
     "S009": {
-      "name": "Do not use insecure encryption modes, padding, or cryptographic algorithms",
-      "description": "Prevent security vulnerabilities from using outdated encryption or hash algorithms, insecure padding/encryption modes leading to data exposure, pattern leakage, or padding oracle attacks.",
+      "name": "Use only approved cryptographic algorithms, modes, and hash functions",
+      "description": "Prevent cryptographic vulnerabilities by ensuring only secure block modes, padding schemes, ciphers, and hash functions are used throughout the application.",
       "category": "Common",
       "severity": "major",
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
+      "version": "2.0",
       "status": "activated",
       "tags": [
         "Common",
@@ -3830,14 +3836,14 @@
       ]
     },
     "S011": {
-      "name": "GUIDs used for security purposes must be generated according to UUID v4 standard with CSPRNG",
-      "description": "Prevent guessing, recreation, or exploitation of GUIDs when used as identifiers for sensitive resources, by ensuring GUIDs are generated according to UUID v4 standard with cryptographically secure random number generators (CSPRNG).",
+      "name": "Enable Encrypted Client Hello (ECH) for TLS",
+      "description": "Prevent exposure of sensitive metadata during TLS handshake by enabling Encrypted Client Hello (ECH) to protect Server Name Indication (SNI) and other client hello fields.",
       "category": "Common",
       "severity": "major",
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
+      "version": "2.0",
       "status": "activated",
       "tags": [
         "Common",
@@ -3845,26 +3851,25 @@
         "code-quality"
       ],
       "tools": [
-        "Manual Review",
-        "Semgrep (uuid version rules)",
-        "Static Analyzer",
-        "SonarQube (custom rule)"
+        "SSL Labs",
+        "testssl.sh",
+        "Browser DevTools",
+        "Manual TLS Config Review"
       ],
       "framework": "All",
       "principles": [
-        "CODE_QUALITY",
         "SECURITY"
       ]
     },
     "S012": {
-      "name": "Protect secrets and encrypt sensitive data",
-      "description": "Protect encryption keys, passwords, access tokens, API keys... from exposure through source code, `.env` files, or logs. Ensure sensitive data is always encrypted and keys are managed securely through Key Vault or HSM.",
+      "name": "Use secrets management solution for backend secrets",
+      "description": "Ensure all backend secrets are securely managed using a dedicated secrets management solution, never stored in source code or build artifacts.",
       "category": "Common",
-      "severity": "major",
+      "severity": "critical",
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
+      "version": "2.0",
       "status": "activated",
       "tags": [
         "Common",
@@ -3872,15 +3877,16 @@
         "code-quality"
       ],
       "tools": [
-        "SonarQube (S2068",
-        "S5547)",
+        "Vault",
+        "AWS Secrets Manager",
+        "Azure Key Vault",
         "GitLeaks",
         "TruffleHog",
-        "Semgrep (hardcoded-secrets)",
-        "Secret Scanner CI/CD"
+        "HSM"
       ],
       "framework": "All",
       "principles": [
+        "CODE_QUALITY",
         "SECURITY"
       ]
     },
@@ -4022,28 +4028,30 @@
       ]
     },
     "S018": {
-      "name": "Prefer Allow List for Input Validation",
-      "description": "Ensure all user inputs or external data sources are strictly validated by accepting only known good values. This reduces the risk of attacks like XSS, SQL Injection, and other security issues caused by malformed or unexpected input.",
+      "name": "Do not store sensitive data in browser storage",
+      "description": "Prevent sensitive data exposure by ensuring browser storage mechanisms do not contain sensitive information, except for session tokens.",
       "category": "Common",
       "severity": "major",
       "languages": [
         "All languages"
       ],
-      "version": "1.1",
-      "status": "draft",
+      "version": "2.0",
+      "status": "activated",
       "tags": [
         "Common",
         "readability",
         "code-quality"
       ],
       "tools": [
+        "Browser DevTools",
         "Static Analysis (Semgrep",
-        "SonarQube)",
-        "Manual Review",
-        "Input Validation Libraries"
+        "ESLint)",
+        "Manual Code Review",
+        "Security Audit"
       ],
       "framework": "All",
       "principles": [
+        "CODE_QUALITY",
         "SECURITY"
       ]
     },
@@ -4100,27 +4108,25 @@
       ]
     },
     "S021": {
-      "name": "Sanitize user-generated Markdown, CSS, and XSL content",
-      "description": "Prevent script injection via user-generated content in Markdown, CSS, or XSL.",
+      "name": "Set Referrer-Policy to prevent sensitive data leakage",
+      "description": "Prevent leakage of sensitive URL data (path, query parameters, hostname) to third-party services via the `Referer` HTTP header.",
       "category": "Common",
       "severity": "major",
       "languages": [
         "All languages"
       ],
-      "version": "1.1",
-      "status": "draft",
+      "version": "2.0",
+      "status": "activated",
       "tags": [
         "Common",
         "readability",
         "code-quality"
       ],
       "tools": [
-        "DOMPurify",
-        "sanitize-html",
-        "markdown-it",
-        "Bandit (Python)",
-        "Manual Review",
-        "SonarQube (custom rule)"
+        "Browser DevTools",
+        "Security Headers Scanner",
+        "OWASP ZAP",
+        "Manual Review"
       ],
       "framework": "All",
       "principles": [
@@ -4158,14 +4164,14 @@
       ]
     },
     "S023": {
-      "name": "Prevent JSON Injection and JSON eval attacks",
-      "description": "Prevent JavaScript execution via unsafe JSON handling or injection attacks.",
+      "name": "Use output encoding when building dynamic JavaScript/JSON",
+      "description": "Prevent JavaScript and JSON injection by applying proper output encoding when dynamically building JavaScript content or JSON data.",
       "category": "Common",
       "severity": "major",
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
+      "version": "2.0",
       "status": "activated",
       "tags": [
         "Common",
@@ -4174,10 +4180,9 @@
       ],
       "tools": [
         "ESLint (`no-eval`)",
-        "Semgrep (`eval-dynamic`",
-        "`json-injection`)",
-        "Bandit",
-        "SonarQube (S1523)",
+        "Semgrep (json-injection)",
+        "SonarQube (S1523",
+        "S5334)",
         "Manual Review"
       ],
       "framework": "All",
@@ -4240,14 +4245,14 @@
       ]
     },
     "S026": {
-      "name": "Apply JSON Schema Validation to input data",
-      "description": "Ensure all incoming JSON is fully validated by schema (structure, types, constraints) before processing.",
+      "name": "Use TLS encryption for all inbound and outbound connections",
+      "description": "Ensure all application connections use encrypted TLS protocol, with no fallback to insecure or unencrypted protocols.",
       "category": "Common",
-      "severity": "major",
+      "severity": "critical",
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
+      "version": "2.0",
       "status": "activated",
       "tags": [
         "Common",
@@ -4255,13 +4260,11 @@
         "code-quality"
       ],
       "tools": [
-        "AJV",
-        "jsonschema",
-        "Joi",
-        "Pydantic",
-        "Hibernate Validator",
-        "SonarQube (custom rule)",
-        "Manual Review"
+        "SSL Labs",
+        "testssl.sh",
+        "nmap",
+        "Network Traffic Analysis",
+        "Manual Config Review"
       ],
       "framework": "All",
       "principles": [
@@ -4270,14 +4273,14 @@
       ]
     },
     "S027": {
-      "name": "Never expose secrets in source code or Git",
-      "description": "Prevent leakage of credentials, API keys, tokens, or sensitive config via source code or version control.",
+      "name": "Validate mTLS client certificates before authentication",
+      "description": "Ensure mTLS client certificates are properly validated and trusted before using certificate identity for authentication or authorization decisions.",
       "category": "Common",
-      "severity": "major",
+      "severity": "critical",
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
+      "version": "2.0",
       "status": "activated",
       "tags": [
         "Common",
@@ -4285,11 +4288,10 @@
         "code-quality"
       ],
       "tools": [
-        "GitLeaks",
-        "TruffleHog",
-        "detect-secrets",
-        "git-secrets",
-        "SonarQube (custom rule)"
+        "OpenSSL",
+        "mTLS Testing Tools",
+        "Certificate Validator",
+        "Manual Config Review"
       ],
       "framework": "All",
       "principles": [
@@ -4493,14 +4495,14 @@
       ]
     },
     "S035": {
-      "name": "Set the `Path` attribute for Session Cookies to limit access scope",
-      "description": "Reduce the risk of session cookie leaks or abuse across multiple apps under the same domain (e.g., `/app1` and `/app2`) by limiting cookie scope via the `Path` attribute.",
+      "name": "Host separate applications on different hostnames",
+      "description": "Leverage same-origin policy restrictions by hosting separate applications on different hostnames to isolate resources, cookies, and prevent cross-application attacks.",
       "category": "Common",
       "severity": "major",
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
+      "version": "2.0",
       "status": "activated",
       "tags": [
         "Common",
@@ -4508,11 +4510,9 @@
         "code-quality"
       ],
       "tools": [
-        "Static Analysis",
-        "Manual Review",
-        "Chrome DevTools",
-        "Postman",
-        "SonarQube (custom rule)"
+        "Manual Architecture Review",
+        "DNS Configuration Audit",
+        "Browser DevTools"
       ],
       "framework": "All",
       "principles": [
@@ -4521,14 +4521,14 @@
       ]
     },
     "S036": {
-      "name": "Prevent LFI and RFI using path validation and allow-lists",
-      "description": "Block Local File Inclusion (LFI) and Remote File Inclusion (RFI) attacks where attackers access sensitive files (e.g., `/etc/passwd`, `C:\\Windows\\system32`) or execute code from external URLs.",
+      "name": "Use internal data for file paths, validate user filenames strictly",
+      "description": "Prevent path traversal, LFI, RFI, and SSRF attacks by using internally generated file paths instead of user-submitted filenames, with strict validation when user input is unavoidable.",
       "category": "Common",
-      "severity": "major",
+      "severity": "critical",
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
+      "version": "2.0",
       "status": "activated",
       "tags": [
         "Common",
@@ -4539,8 +4539,8 @@
         "Static Analysis",
         "OWASP ZAP",
         "Burp Suite",
-        "Manual Review",
-        "SonarQube (custom rule)"
+        "Semgrep (path-traversal)",
+        "Manual Review"
       ],
       "framework": "All",
       "principles": [
@@ -4604,14 +4604,14 @@
       ]
     },
     "S039": {
-      "name": "Never transmit Session Tokens via URL parameters",
-      "description": "Prevent session hijacking by ensuring session tokens are not stored in browser history, server logs, proxy logs, or leaked via Referrer headers.",
+      "name": "TLS clients must validate server certificates",
+      "description": "Ensure TLS clients validate certificates received from servers before establishing secure communication to prevent MITM attacks.",
       "category": "Common",
-      "severity": "major",
+      "severity": "critical",
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
+      "version": "2.0",
       "status": "activated",
       "tags": [
         "Common",
@@ -4619,14 +4619,14 @@
         "code-quality"
       ],
       "tools": [
+        "SSL Labs",
+        "testssl.sh",
         "Static Analysis",
-        "Manual Review",
-        "Burp Suite",
-        "Postman",
-        "SonarQube (custom rule)"
+        "Manual Code Review"
       ],
       "framework": "All",
       "principles": [
+        "CODE_QUALITY",
         "SECURITY"
       ]
     },
@@ -4639,7 +4639,7 @@
         "All languages"
       ],
       "version": "1.1",
-      "status": "draft",
+      "status": "activated",
       "tags": [
         "Common",
         "readability",
@@ -4722,7 +4722,7 @@
         "All languages"
       ],
       "version": "1.1",
-      "status": "draft",
+      "status": "activated",
       "tags": [
         "Common",
         "readability",
@@ -4795,25 +4795,25 @@
       ]
     },
     "S046": {
-      "name": "Notify users of critical account changes",
-      "description": "Alert users to sensitive actions to detect potential compromise and allow timely intervention.",
+      "name": "Use algorithm allowlist for self-contained tokens",
+      "description": "Prevent algorithm confusion and downgrade attacks by restricting token signing/verification to an explicit allowlist of algorithms.",
       "category": "Common",
-      "severity": "major",
+      "severity": "critical",
       "languages": [
         "All languages"
       ],
-      "version": "1.1",
-      "status": "draft",
+      "version": "2.0",
+      "status": "activated",
       "tags": [
         "Common",
         "readability",
         "code-quality"
       ],
       "tools": [
-        "Manual Review",
-        "Security Test",
-        "Notification Audit",
-        "SonarQube (custom rule)"
+        "JWT Debugger",
+        "Static Analysis",
+        "Manual Code Review",
+        "Security Test"
       ],
       "framework": "All",
       "principles": [
@@ -4822,14 +4822,14 @@
       ]
     },
     "S047": {
-      "name": "Secure temporary passwords and activation codes",
-      "description": "Ensure that temporary passwords and activation codes are secure, unpredictable, single-use, and time-limited.",
+      "name": "Protect OAuth code flow against CSRF attacks",
+      "description": "Prevent browser-based CSRF attacks that could trigger unauthorized OAuth token requests by implementing PKCE or state parameter validation.",
       "category": "Common",
       "severity": "major",
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
+      "version": "2.0",
       "status": "activated",
       "tags": [
         "Common",
@@ -4837,10 +4837,9 @@
         "code-quality"
       ],
       "tools": [
-        "Manual Review",
-        "Static Analysis",
-        "Audit Flow",
-        "SonarQube (custom rule)"
+        "OAuth Security Testing",
+        "Manual Code Review",
+        "OWASP ZAP"
       ],
       "framework": "All",
       "principles": [
@@ -4849,14 +4848,14 @@
       ]
     },
     "S048": {
-      "name": "Do not expose current password during reset flow",
-      "description": "Ensure the current user password is never revealed or sent in any step of the password reset process.",
+      "name": "Validate OAuth redirect URIs with exact string comparison",
+      "description": "Prevent OAuth redirect attacks by validating redirect URIs against a client-specific allowlist using exact string comparison, not pattern matching.",
       "category": "Common",
-      "severity": "major",
+      "severity": "critical",
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
+      "version": "2.0",
       "status": "activated",
       "tags": [
         "Common",
@@ -4864,12 +4863,13 @@
         "code-quality"
       ],
       "tools": [
-        "Manual Review",
-        "Penetration Test",
-        "SonarQube (custom rule)"
+        "OAuth Security Testing",
+        "Manual Config Review",
+        "Penetration Testing"
       ],
       "framework": "All",
       "principles": [
+        "CODE_QUALITY",
         "SECURITY"
       ]
     },
@@ -4900,14 +4900,14 @@
       ]
     },
     "S050": {
-      "name": "Session tokens must have minimum 64-bit entropy and use secure algorithms",
-      "description": "Prevent attackers from predicting or forging session tokens by ensuring sufficient length, entropy, and cryptographic safety.",
+      "name": "Reference tokens must be unique with 128-bit entropy using CSPRNG",
+      "description": "Ensure reference tokens (session tokens, opaque tokens) are unpredictable and resistant to brute-force attacks by using cryptographically secure generation.",
       "category": "Common",
       "severity": "major",
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
+      "version": "2.0",
       "status": "activated",
       "tags": [
         "Common",
@@ -4915,9 +4915,10 @@
         "code-quality"
       ],
       "tools": [
-        "Manual Review",
         "Static Analysis",
-        "SonarQube (custom rule)"
+        "Security Audit",
+        "CSPRNG Verification",
+        "Manual Code Review"
       ],
       "framework": "All",
       "principles": [
@@ -4980,14 +4981,14 @@
       ]
     },
     "S053": {
-      "name": "Only use secure OTP algorithms like HOTP/TOTP",
-      "description": "Ensure OTPs are secure against spoofing and replay attacks by using safe, standard algorithms.",
+      "name": "Return generic error messages, hide internal details",
+      "description": "Prevent exposure of sensitive internal system data by returning generic error messages to consumers when unexpected or security-sensitive errors occur.",
       "category": "Common",
       "severity": "major",
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
+      "version": "2.0",
       "status": "activated",
       "tags": [
         "Common",
@@ -4995,10 +4996,10 @@
         "code-quality"
       ],
       "tools": [
-        "Manual Review",
-        "Unit Test",
         "Static Analysis",
-        "SonarQube (custom rule)"
+        "Penetration Testing",
+        "Error Response Audit",
+        "Manual Code Review"
       ],
       "framework": "All",
       "principles": [
@@ -5140,29 +5141,56 @@
       ]
     },
     "S059": {
-      "name": "Configure Allow List for server-side outbound requests",
-      "description": "Reduce risks from the server making outbound requests to untrusted systems (SSRF, malicious downloads, data leaks).",
+      "name": "Disable debug modes in production environments",
+      "description": "Prevent exposure of debugging features and information leakage by ensuring all debug modes are disabled in production environments.",
       "category": "Common",
       "severity": "major",
       "languages": [
         "All languages"
       ],
-      "version": "1.1",
-      "status": "draft",
+      "version": "2.0",
+      "status": "activated",
       "tags": [
         "Common",
         "readability",
         "code-quality"
       ],
       "tools": [
-        "Manual Config Review",
-        "Firewall/Proxy Logs",
-        "CloudTrail",
-        "Burp Suite Test",
-        "SonarQube (custom rule)"
+        "Configuration Audit",
+        "Penetration Testing",
+        "OWASP ZAP",
+        "Environment Checker"
+      ],
+      "framework": "All",
+      "principles": [
+        "CODE_QUALITY",
+        "SECURITY"
+      ]
+    },
+    "S060": {
+      "name": "Enforce minimum password length of 8 characters, recommend 15+",
+      "description": "Ensure user-set passwords meet minimum length requirements to provide adequate security against brute-force and dictionary attacks.",
+      "category": "Common",
+      "severity": "major",
+      "languages": [
+        "All languages"
+      ],
+      "version": "2.0",
+      "status": "activated",
+      "tags": [
+        "Common",
+        "readability",
+        "code-quality"
+      ],
+      "tools": [
+        "Static Analysis",
+        "Unit Test",
+        "Password Strength Libraries (zxcvbn)",
+        "Manual Review"
       ],
       "framework": "All",
       "principles": [
+        "CODE_QUALITY",
         "SECURITY"
       ]
     },