@xenos1996/usat 1.0.0

package/rules/stacks/compliance.yaml

@@ -0,0 +1,157 @@
+id: stacks/compliance
+title: Accessibility, i18n & Compliance
+section: S13
+section_title: Accessibility, i18n & Compliance
+description: >
+  Accessibility, internationalisation, and regulatory obligations. Most of
+  these are judgement calls — USAT records what it can and asks for evidence
+  on the rest.
+version: '1.0'
+skip_when: { fact: 'maturity:prototype' }
+
+rules:
+  - id: COMP-001
+    title: Interactive elements are keyboard accessible
+    section: S13
+    section_title: Accessibility, i18n & Compliance
+    severity: MEDIUM
+    class: compliance
+    applies_when:
+      any:
+        - { fact: 'platform:web' }
+        - { fact: 'platform:mobile' }
+    check: { kind: manual }
+    evidence: 'Tab through the main flow: can you reach and operate everything? Is focus always visible?'
+    why: 'Keyboard access is table stakes for screen readers, motor impairments, and power users alike.'
+    remediation: 'Use native controls; never remove focus outlines without a replacement; test with keyboard only.'
+    references: ['WCAG-2.1.1', 'WCAG-2.4.7', 'EN-301-549']
+
+  - id: COMP-002
+    title: Form inputs have associated labels
+    section: S13
+    section_title: Accessibility, i18n & Compliance
+    severity: MEDIUM
+    class: compliance
+    applies_when: { fact: 'platform:web' }
+    check: { kind: manual }
+    evidence: 'Every input has a <label for>, aria-label, or aria-labelledby — and placeholder alone does not count.'
+    why: 'Unlabelled inputs are unusable with a screen reader and are the most common WCAG failure.'
+    remediation: 'Associate label elements; add eslint-plugin-jsx-a11y to catch regressions.'
+    references: ['WCAG-3.3.2', 'WCAG-1.3.1']
+
+  - id: COMP-003
+    title: Colour contrast meets WCAG AA
+    section: S13
+    section_title: Accessibility, i18n & Compliance
+    severity: MEDIUM
+    class: compliance
+    applies_when: { fact: 'platform:web' }
+    check: { kind: manual }
+    evidence: 'Contrast ratio for body text (≥4.5:1) and large text (≥3:1), including placeholder and disabled states.'
+    why: 'Low contrast is the most common accessibility defect and the easiest to fix.'
+    remediation: 'Run axe/Lighthouse; fix the reported contrast failures; check dark mode too.'
+    references: ['WCAG-1.4.3']
+
+  - id: COMP-004
+    title: Content is not hardcoded to one locale
+    section: S13
+    section_title: Accessibility, i18n & Compliance
+    severity: MEDIUM
+    class: compliance
+    applies_when:
+      any:
+        - { fact: 'platform:web' }
+        - { fact: 'platform:mobile' }
+    check:
+      kind: grep_present
+      pattern: '(i18n|i18next|react-intl|vue-i18n|lingui|next-intl|Localizable|NSLocalizedString|intl\.|translations?/)'
+      include: ['**/*.{ts,tsx,js,jsx,vue,svelte,swift,kt,java,json,yaml,yml}']
+      exclude: ['**/node_modules/**', '**/Pods/**']
+      flags: i
+    why: 'Retrofitting i18n after launch means touching every string in the codebase.'
+    remediation: 'Extract user-facing strings now, even if you ship one language.'
+    references: ['WCAG-3.1.1', 'i18n-Best-Practices']
+
+  - id: COMP-005
+    title: Dates, numbers, and currencies are locale-aware
+    section: S13
+    section_title: Accessibility, i18n & Compliance
+    severity: LOW
+    class: compliance
+    applies_when: { fact: 'practice:i18n' }
+    check: { kind: manual }
+    evidence: 'Formatting via Intl/ICU rather than string concatenation or a hardcoded MM/DD/YYYY.'
+    why: '13/01/2026 is a valid date in most of the world and a bug report in the US.'
+    remediation: 'Use Intl.DateTimeFormat / Intl.NumberFormat everywhere; store timestamps in UTC.'
+    references: ['WCAG-3.1.2', 'ICU']
+
+  - id: COMP-006
+    title: A privacy policy and terms exist and match reality
+    section: S13
+    section_title: Accessibility, i18n & Compliance
+    severity: MEDIUM
+    class: compliance
+    applies_when:
+      any:
+        - { fact: 'has:pii' }
+        - { fact: 'maturity:production' }
+    check: { kind: manual }
+    evidence: 'Links to the live policy, and a check that it names the data you actually collect and the processors you actually use.'
+    why: 'A policy that does not match the code is worse than no policy: it is a documented misrepresentation.'
+    remediation: 'Generate the data inventory from your code, then write the policy to match it.'
+    references: ['GDPR-Art.13', 'CCPA']
+
+  - id: COMP-007
+    title: Data subject rights are implemented
+    section: S13
+    section_title: Accessibility, i18n & Compliance
+    severity: HIGH
+    class: compliance
+    applies_when: { fact: 'has:pii' }
+    check: { kind: manual }
+    evidence: 'Working flows for access (export), erasure, and correction — and the response time SLA.'
+    why: 'GDPR/CCPA give you 30 days. Without a built flow, each request is an ad-hoc database operation.'
+    remediation: 'Build export and delete endpoints behind authentication; log the request and the completion.'
+    references: ['GDPR-Art.15', 'GDPR-Art.17', 'CCPA']
+
+  - id: COMP-008
+    title: Card data is kept out of scope
+    section: S13
+    section_title: Accessibility, i18n & Compliance
+    severity: HIGH
+    class: compliance
+    applies_when: { fact: 'has:payments' }
+    check: { kind: manual }
+    evidence: 'Whether PAN/CVV ever touches your servers, or whether you use a hosted field / tokenisation (SAQ A/A-EP).'
+    why: 'Storing card data drags your entire infrastructure into PCI-DSS scope. Tokenisation removes it.'
+    remediation: 'Use provider-hosted fields or a tokenisation proxy; never log or store full card numbers.'
+    references: ['PCI-DSS-4.0', 'ASVS-8.3.1']
+
+  - id: COMP-009
+    title: Cookie / consent notice is compliant
+    section: S13
+    section_title: Accessibility, i18n & Compliance
+    severity: MEDIUM
+    class: compliance
+    applies_when: { fact: 'platform:web' }
+    check: { kind: manual }
+    evidence: 'Consent is opt-in for non-essential cookies, is as easy to refuse as to accept, and is recorded.'
+    why: '"By using this site you agree" has not been valid consent in the EU since 2018.'
+    remediation: 'Add a consent manager that defaults to rejected and stores the choice per user.'
+    references: ['ePrivacy', 'GDPR-Art.7']
+
+  - id: COMP-010
+    title: Source files carry an SPDX license identifier
+    section: S13
+    section_title: Accessibility, i18n & Compliance
+    severity: LOW
+    class: compliance
+    applies_when: { fact: 'project:library' }
+    check:
+      kind: grep_present
+      pattern: '(SPDX-License-Identifier|@license)'
+      include: ['**/*.{ts,js,py,go,rs,java,kt,c,h,css}']
+      exclude: ['**/node_modules/**']
+    why: 'Machine-readable licensing is what lets consumers automate compliance — and it costs one line per file.'
+    remediation: 'Add `// SPDX-License-Identifier: MIT` headers; enforce with a lint rule (REUSE).'
+    references: ['SPDX', 'REUSE-Spec']

package/rules/stacks/containers.yaml

@@ -0,0 +1,124 @@
+id: stacks/containers
+title: Containers & Runtime
+section: S15
+section_title: Platform-Specific
+description: 'Activated when Docker, compose, or Kubernetes manifests are detected.'
+version: '1.0'
+skip_when: { fact: 'has:containers', op: 'absent' }
+
+rules:
+  - id: CTNR-001
+    title: Container does not run as root
+    section: S15
+    section_title: Platform-Specific
+    severity: HIGH
+    class: security
+    check:
+      kind: grep_present
+      pattern: '(USER\s+(?!root\b)\w+|--chown=|runAsNonRoot\s*:\s*true|securityContext)'
+      include: ['Dockerfile*', '**/Dockerfile*', '**/*.{yaml,yml}', 'docker-compose*.yml']
+      exclude: ['**/node_modules/**']
+    why: 'A root process inside the container is one kernel exploit away from root on the host.'
+    remediation: 'Add `USER node` (or a dedicated non-root uid) and `securityContext.runAsNonRoot: true` in Kubernetes.'
+    references: ['CWE-250', 'CIS-Docker-4.1', 'ASVS-14.1.3']
+
+  - id: CTNR-002
+    title: Multi-stage builds are used
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: performance
+    check:
+      kind: grep_present
+      pattern: 'FROM\s+\S+\s+AS\s+\w+'
+      include: ['Dockerfile*', '**/Dockerfile*']
+      flags: i
+    why: 'Without multi-stage, your production image ships the compiler, the test suite, and your .git directory.'
+    remediation: 'Build in one stage, copy only the artifact into a slim runtime stage.'
+    references: ['Docker-Multi-Stage']
+
+  - id: CTNR-003
+    title: Base image is minimal and pinned
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: supply-chain
+    check:
+      kind: grep_absent
+      pattern: 'FROM\s+\S+:latest\s*$|FROM\s+\w+\s*$'
+      include: ['Dockerfile*', '**/Dockerfile*']
+      flags: i
+    why: ':latest means the image changes under you with no commit, and full distro images carry hundreds of CVEs.'
+    remediation: 'Pin a digest or an exact tag; prefer alpine, distroless, or chainguard images.'
+    references: ['OpenSSF-Scorecard:Pinned-Dependencies', 'CIS-Docker-4.2']
+
+  - id: CTNR-004
+    title: A .dockerignore exists
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: supply-chain
+    check:
+      kind: any_file
+      patterns: ['.dockerignore']
+    why: 'Without it, the build context copies node_modules, .git, and — frequently — .env into the build.'
+    remediation: 'Add .dockerignore excluding .git, node_modules, .env, secrets, and local build output.'
+    references: ['CIS-Docker']
+
+  - id: CTNR-005
+    title: No secrets baked into the image
+    section: S15
+    section_title: Platform-Specific
+    severity: CRITICAL
+    class: security
+    check:
+      kind: grep_absent
+      pattern: '(ARG\s+(SECRET|TOKEN|PASSWORD|KEY)|ENV\s+(SECRET|TOKEN|PASSWORD|API_KEY|AWS_SECRET)\s*=|COPY\s+\.env)'
+      include: ['Dockerfile*', '**/Dockerfile*', 'docker-compose*.yml', 'compose.yaml']
+      flags: i
+    why: 'ENV and ARG values are visible in `docker history` to anyone who pulls the image.'
+    remediation: 'Inject secrets at runtime (env from the orchestrator, mounted files, or a secret manager).'
+    references: ['CWE-798', 'CIS-Docker-4.10']
+
+  - id: CTNR-006
+    title: HEALTHCHECK is defined
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: operations
+    check:
+      kind: grep_present
+      pattern: '(HEALTHCHECK|livenessProbe|readinessProbe)'
+      include: ['Dockerfile*', '**/Dockerfile*', 'docker-compose*.yml', '**/*.{yaml,yml}']
+    why: 'The orchestrator cannot restart a container it does not know is sick.'
+    remediation: 'Add HEALTHCHECK (Docker) or liveness/readiness probes (Kubernetes) hitting your /health endpoint.'
+    references: ['K8s-Probes', 'CIS-Docker-4.6']
+
+  - id: CTNR-007
+    title: Kubernetes workloads declare resource limits
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: performance
+    applies_when: { fact: 'has:kubernetes' }
+    check:
+      kind: grep_present
+      pattern: 'resources\s*:\s*(\s*$|[\s\S]{0,80}(limits|requests)\s*:)'
+      include: ['**/*.{yaml,yml}']
+      exclude: ['**/node_modules/**']
+    why: 'One pod with no limits can starve every other pod on the node.'
+    remediation: 'Set requests and limits on CPU and memory for every container; add a LimitRange as a backstop.'
+    references: ['K8s-Resource-Management', 'CIS-K8s']
+
+  - id: CTNR-008
+    title: Images are scanned and signed
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: supply-chain
+    applies_when: { fact: 'maturity:production' }
+    check: { kind: manual }
+    evidence: 'Trivy/Grype in the pipeline and cosign signatures verified at admission (or a documented plan to add both).'
+    why: 'Unsigned images mean anything that can push to the registry can run in your cluster.'
+    remediation: 'Scan on push, sign with cosign, and enforce verification with a policy controller.'
+    references: ['SLSA-Build-L2', 'Sigstore-Cosign']

package/rules/stacks/data.yaml

@@ -0,0 +1,165 @@
+id: stacks/data
+title: Data & Database
+section: S6
+section_title: Data & Database
+description: 'Activated when a database, ORM, or migrations directory is detected.'
+version: '1.0'
+skip_when: { fact: 'has:database', op: 'absent' }
+
+rules:
+  - id: DATA-001
+    title: A migration system is in place
+    section: S6
+    section_title: Data & Database
+    severity: HIGH
+    class: correctness
+    check:
+      kind: any_file
+      patterns:
+        [
+          'migrations/**',
+          'prisma/migrations/**',
+          'alembic/**',
+          'db/migrate/**',
+          '**/migrations/*.sql',
+          'knexfile.*',
+          'flyway/**',
+          'liquibase/**',
+          'atlas.hcl',
+          'drizzle/**',
+        ]
+    why: 'Schema changes applied by hand cannot be reviewed, repeated, or rolled back.'
+    remediation: 'Adopt the migration tool for your ORM; never alter production schema manually.'
+    references: ['NIST-SSDF-PO.5']
+
+  - id: DATA-002
+    title: Foreign keys / relations are defined
+    section: S6
+    section_title: Data & Database
+    severity: MEDIUM
+    class: correctness
+    check:
+      kind: grep_present
+      pattern: '(references\s*\(|FOREIGN KEY|foreignKey|@ManyToOne|@Relation|belongs_to|has_many|ForeignKey\(|onDelete)'
+      include: ['**/*.{sql,prisma,py,ts,js,go,rs,java,kt,rb,php}']
+      exclude: ['**/node_modules/**', '**/tests/**']
+      flags: i
+    why: 'Relations enforced only in application code are relations that drift out of sync the first time someone writes a script.'
+    remediation: 'Declare constraints at the DB level; add a periodic orphan-row check if you cannot.'
+    references: ['ASVS-5.3.4']
+
+  - id: DATA-003
+    title: Indexes exist on queried columns
+    section: S6
+    section_title: Data & Database
+    severity: MEDIUM
+    class: performance
+    check: { kind: manual }
+    evidence: 'The five heaviest queries and their EXPLAIN plans. Any sequential scan on a large table needs a justification.'
+    why: 'Most "the database is slow" incidents are one missing index on one column.'
+    remediation: 'Index every foreign key and every column in a WHERE/ORDER BY on a large table; verify with EXPLAIN.'
+    references: ['Use-The-Index-Luke']
+
+  - id: DATA-004
+    title: No N+1 query patterns
+    section: S6
+    section_title: Data & Database
+    severity: HIGH
+    class: performance
+    check: { kind: manual }
+    evidence: 'Query logs for the main list endpoints: is there one query per row, or one query with a join/include?'
+    why: 'An endpoint that works with 10 rows falls over at 10,000 — usually in production, rarely in staging.'
+    remediation: 'Eager-load relations (include/join/prefetch_related); add query counting assertions to tests.'
+    references: ['ORM-N+1']
+
+  - id: DATA-005
+    title: List queries are paginated
+    section: S6
+    section_title: Data & Database
+    severity: HIGH
+    class: performance
+    check:
+      kind: grep_present
+      pattern: '(\.limit\s*\(|take\s*:\s*|LIMIT\s+\d|first\s*:\s*|pageSize|per_page|cursor\s*:\s*|page_size|Top\s+\d+)'
+      include: ['**/*.{ts,tsx,js,py,go,rs,java,kt,rb,php,graphql,sql}']
+      exclude: ['**/node_modules/**', '**/migrations/**', '**/*.test.*']
+      flags: i
+    why: 'An unbounded SELECT is a denial-of-service you wrote yourself, usually accidentally.'
+    remediation: 'Enforce a default and maximum page size on every list endpoint; prefer cursor pagination.'
+    references: ['CWE-770', 'ASVS-4.3.2']
+
+  - id: DATA-006
+    title: Connection pooling is configured
+    section: S6
+    section_title: Data & Database
+    severity: MEDIUM
+    class: performance
+    check:
+      kind: grep_present
+      pattern: '(pool|pool_size|max_?connections|connection_limit|MaximumPoolSize|poolSize|HikariCP|db_pool)'
+      include: ['**/*.{ts,js,py,go,rs,java,kt,rb,php,yml,yaml,toml,env,example,prisma}']
+      exclude: ['**/node_modules/**']
+      flags: i
+    why: 'Without a pool, every request opens a connection and the database runs out at the worst possible moment.'
+    remediation: 'Configure a pool sized to (cores × 2) + spindle count as a starting point; add a pgbouncer if needed.'
+    references: ['Postgres-Pooling']
+
+  - id: DATA-007
+    title: Multi-step writes are transactional
+    section: S6
+    section_title: Data & Database
+    severity: HIGH
+    class: correctness
+    check:
+      kind: grep_present
+      pattern: '(\$transaction|beginTransaction|BEGIN\s*;|withTransaction|atomic\s*\(|session\.with_transaction|db\.transaction)'
+      include: ['**/*.{ts,js,py,go,rs,java,kt,rb,php}']
+      exclude: ['**/node_modules/**', '**/migrations/**', '**/*.test.*']
+      flags: i
+    why: 'A half-applied write is worse than a failed one: the data looks fine until someone reconciles it.'
+    remediation: 'Wrap related writes in a transaction; make the operation idempotent so retries are safe.'
+    references: ['ASVS-5.3.4']
+
+  - id: DATA-008
+    title: No SELECT * in hot paths
+    section: S6
+    section_title: Data & Database
+    severity: LOW
+    class: performance
+    check:
+      kind: grep_wrong
+      pattern: 'SELECT\s+\*\s+FROM'
+      include: ['**/*.{sql,ts,js,py,go,rs,java,kt,rb,php}']
+      exclude: ['**/node_modules/**', '**/migrations/**', '**/tests/**']
+    why: 'SELECT * breaks when the schema changes, and pulls columns nobody needs across the network.'
+    remediation: 'Select the columns you use.'
+    references: ['Use-The-Index-Luke']
+
+  - id: DATA-009
+    title: Delete strategy is defined
+    section: S6
+    section_title: Data & Database
+    severity: LOW
+    class: compliance
+    check: { kind: manual }
+    evidence: 'Whether records are hard-deleted or soft-deleted, and how that interacts with retention and erasure requests.'
+    why: '"Delete the account" needs a defined answer before a regulator or a customer asks for it.'
+    remediation: 'Pick one per entity type; document it; make sure erasure requests honour the choice everywhere.'
+    references: ['GDPR-Art.17']
+
+  - id: DATA-010
+    title: Row-level access is enforced in the data layer
+    section: S6
+    section_title: Data & Database
+    severity: HIGH
+    class: security
+    applies_when:
+      any:
+        - { fact: 'db:postgres' }
+        - { fact: 'orm:prisma' }
+        - { fact: 'orm:sqlalchemy' }
+    check: { kind: manual }
+    evidence: 'Whether tenant/user scoping is applied by the query layer itself (RLS, a scoped repository) or by remembering to add a WHERE clause.'
+    why: 'Scoping that depends on remembering is scoping that will be forgotten exactly once, catastrophically.'
+    remediation: 'Use Postgres RLS or a repository pattern that requires the tenant scope; test cross-tenant reads explicitly.'
+    references: ['ASVS-4.2.1', 'OWASP-A01:2021']

package/rules/stacks/go.yaml

@@ -0,0 +1,134 @@
+id: stacks/go
+title: Go
+section: S15
+section_title: Platform-Specific
+description: 'Activated when Go is detected.'
+version: '1.0'
+skip_when: { fact: 'lang:go', op: 'absent' }
+
+rules:
+  - id: GO-001
+    title: go.mod declares the Go version
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: operations
+    check:
+      kind: grep_present
+      pattern: '^go\s+\d+\.\d+'
+      include: ['go.mod']
+    why: 'Without it the toolchain guesses, and the guess changes when the runner image updates.'
+    remediation: 'Add `go 1.22` to go.mod and pin the same version in CI.'
+    references: ['Go-Modules']
+
+  - id: GO-002
+    title: Errors are checked, not discarded
+    section: S15
+    section_title: Platform-Specific
+    severity: HIGH
+    class: correctness
+    check: { kind: manual }
+    evidence: 'errcheck or `go vet` output; grep for `_ =` assignments and bare `_` error receivers.'
+    why: 'A discarded error is a failure that reports success. This is the canonical Go bug.'
+    remediation: 'Run errcheck in CI; handle every returned error or explicitly document why it is ignored.'
+    references: ['Go-Proverbs', 'CWE-390']
+
+  - id: GO-003
+    title: Contexts are propagated
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: correctness
+    check:
+      kind: grep_present
+      pattern: '(ctx\s+context\.Context|context\.WithTimeout|context\.WithCancel|context\.Background)'
+      include: ['**/*.go']
+      exclude: ['**/*_test.go']
+    why: 'Without context there is no cancellation, so a client disconnect leaves goroutines and DB connections hanging.'
+    remediation: 'Thread context.Context through every blocking call; derive timeouts at the boundary.'
+    references: ['Go-Context']
+
+  - id: GO-004
+    title: No panics in request paths
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: correctness
+    check:
+      kind: grep_absent
+      pattern: '\bpanic\s*\('
+      include: ['**/*.go']
+      exclude: ['**/*_test.go', '**/cmd/**', 'main.go']
+    why: 'A panic in a handler takes down the whole process, not just the request.'
+    remediation: 'Return errors. Recover in middleware that logs and returns 500.'
+    references: ['Go-Error-Handling']
+
+  - id: GO-005
+    title: go vet / staticcheck / golangci-lint runs in CI
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: maintainability
+    applies_when: { fact: 'has:ci' }
+    check:
+      kind: grep_present
+      pattern: '(go vet|golangci-lint|staticcheck|gofmt -l)'
+      include:
+        [
+          '.github/workflows/*.yml',
+          '.github/workflows/*.yaml',
+          '.gitlab-ci.yml',
+          'Makefile',
+          'justfile',
+          'Taskfile.yml',
+          '.pre-commit-config.yaml',
+        ]
+      flags: i
+    why: 'go vet finds the bug class that compiles cleanly and fails at runtime.'
+    remediation: 'Add `go vet ./...` and golangci-lint to CI; start with the default linters.'
+    references: ['Go-Vet']
+
+  - id: GO-006
+    title: Goroutine lifecycle is bounded
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: correctness
+    check: { kind: manual }
+    evidence: 'For every `go func`: what stops it? Is there a WaitGroup, a context, or an unbuffered channel that can block forever?'
+    why: 'Goroutine leaks are invisible in dev and fatal after three weeks in production.'
+    remediation: 'Tie every goroutine to a context; add a leak detector (goleak) to the test suite.'
+    references: ['Go-Concurrency']
+
+  - id: GO-007
+    title: SQL is parameterised
+    section: S15
+    section_title: Platform-Specific
+    severity: CRITICAL
+    class: security
+    applies_when: { fact: 'has:database' }
+    check:
+      kind: grep_absent
+      pattern: '(fmt\.Sprintf\(\s*[''"](SELECT|INSERT|UPDATE|DELETE)|db\.Query\(\s*[''"][^''"]*[''"]\s*\+|Exec\(\s*.*\+)'
+      include: ['**/*.go']
+      exclude: ['**/*_test.go']
+      flags: i
+    why: 'Sprintf-built SQL is textbook injection.'
+    remediation: 'Use placeholders: db.QueryContext(ctx, "SELECT ... WHERE id = $1", id).'
+    references: ['CWE-89', 'ASVS-5.3.4']
+
+  - id: GO-008
+    title: HTTP servers set timeouts
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: performance
+    applies_when: { fact: 'platform:server' }
+    check:
+      kind: grep_present
+      pattern: '(ReadHeaderTimeout|ReadTimeout|WriteTimeout|IdleTimeout)'
+      include: ['**/*.go']
+      exclude: ['**/*_test.go']
+    why: 'The default net/http server has no timeouts, which is Slowloris as a service.'
+    remediation: 'Set ReadHeaderTimeout, ReadTimeout, WriteTimeout, and IdleTimeout on http.Server.'
+    references: ['CWE-400', 'Go-http-Server']