@xenos1996/usat 1.0.0

package/rules/stacks/iac.yaml

@@ -0,0 +1,128 @@
+id: stacks/iac
+title: Infrastructure as Code & Cloud
+section: S15
+section_title: Platform-Specific
+description: 'Activated when Terraform/OpenTofu, Pulumi, Ansible, or Kubernetes manifests are detected.'
+version: '1.0'
+skip_when:
+  all:
+    - { fact: 'has:terraform', op: 'absent' }
+    - { fact: 'has:kubernetes', op: 'absent' }
+    - { fact: 'project:iac', op: 'absent' }
+
+rules:
+  - id: IAC-001
+    title: No public exposure of storage buckets or databases
+    section: S15
+    section_title: Platform-Specific
+    severity: CRITICAL
+    class: security
+    applies_when: { fact: 'has:terraform' }
+    check:
+      kind: grep_wrong
+      pattern: '(acl\s*=\s*[''"]public-read|publicly_accessible\s*=\s*true|0\.0\.0\.0/0|cidr_blocks\s*=\s*\[\s*[''"]0\.0\.0\.0/0|Effect\s*=\s*[''"]Allow[\s\S]{0,120}Principal\s*=\s*[''"]\*)'
+      include: ['**/*.tf', '**/*.tfvars', '**/*.{yaml,yml,json}']
+      exclude: ['**/node_modules/**']
+    why: 'This is the single most common cause of cloud data breaches, and it is one line of config.'
+    remediation: 'Default to private; allowlist specific principals/CIDRs; add an automated check (Checkov/tfsec) in CI.'
+    references: ['CWE-284', 'CIS-AWS-2.1.5', 'ASVS-14.1.3']
+
+  - id: IAC-002
+    title: Encryption at rest is enabled
+    section: S15
+    section_title: Platform-Specific
+    severity: HIGH
+    class: security
+    applies_when: { fact: 'has:terraform' }
+    check:
+      kind: grep_present
+      pattern: '(encrypted\s*=\s*true|storage_encrypted\s*=\s*true|sse_algorithm|kms_key_id|enable_disk_encryption|customer_managed_key)'
+      include: ['**/*.tf', '**/*.tfvars', '**/*.{yaml,yml}']
+      exclude: ['**/node_modules/**']
+    why: 'Unencrypted volumes and buckets fail every compliance framework you will ever be asked about.'
+    remediation: 'Enable encryption with a customer-managed KMS key on all storage, databases, and queues.'
+    references: ['CIS-AWS-2.2.1', 'ASVS-8.1.1', 'GDPR-Art.32']
+
+  - id: IAC-003
+    title: IaC is validated and scanned before apply
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: supply-chain
+    applies_when: { fact: 'has:ci' }
+    check:
+      kind: grep_present
+      pattern: '(terraform validate|terraform plan|tflint|checkov|tfsec|trivy config|kubeconform|kubeval|pulumi preview|ansible-lint)'
+      include:
+        [
+          '.github/workflows/*.yml',
+          '.github/workflows/*.yaml',
+          '.gitlab-ci.yml',
+          'Makefile',
+          'justfile',
+          '.pre-commit-config.yaml',
+        ]
+      flags: i
+    why: '`terraform apply` on unreviewed HCL is a production change with no diff shown to anybody.'
+    remediation: 'Run validate → plan → policy scan on every PR; require approval before apply.'
+    references: ['NIST-SSDF-PO.5', 'CIS']
+
+  - id: IAC-004
+    title: State is stored remotely and locked
+    section: S15
+    section_title: Platform-Specific
+    severity: HIGH
+    class: operations
+    applies_when: { fact: 'has:terraform' }
+    check:
+      kind: grep_present
+      pattern: '(backend\s+"(s3|azurerm|gcs|remote|http|cos)|dynamodb_table|use_lockfile|lock_table)'
+      include: ['**/*.tf', '**/backend.tf', '**/*.hcl']
+    why: 'Local state means a laptop is the source of truth for your infrastructure, and concurrent applies corrupt it.'
+    remediation: 'Configure a remote backend with locking (S3 + DynamoDB, GCS, or Terraform Cloud).'
+    references: ['Terraform-Backends']
+
+  - id: IAC-005
+    title: IAM follows least privilege
+    section: S15
+    section_title: Platform-Specific
+    severity: HIGH
+    class: security
+    applies_when: { fact: 'has:terraform' }
+    check:
+      kind: grep_absent
+      pattern: '(Action\s*=\s*[''"]\*[''"]|actions\s*=\s*\[\s*[''"]\*[''"]|Resource\s*=\s*[''"]\*[''"]\s*$)'
+      include: ['**/*.tf', '**/*.{yaml,yml,json}']
+      exclude: ['**/node_modules/**']
+    why: '`Action: "*"` on `Resource: "*"` is administrator access with a nicer YAML indent.'
+    remediation: 'Enumerate the exact actions and resources; separate read and write roles; review quarterly.'
+    references: ['CIS-AWS-1.16', 'ASVS-4.1.1']
+
+  - id: IAC-006
+    title: Cloud spend is tagged and budgeted
+    section: S15
+    section_title: Platform-Specific
+    severity: LOW
+    class: operations
+    applies_when: { fact: 'has:terraform' }
+    check: { kind: manual }
+    evidence: 'A required-tags policy (owner, service, environment) and budget alerts at 50/80/100%.'
+    why: 'Untagged resources are how a forgotten load balancer costs $4,000 for eleven months.'
+    remediation: 'Enforce tags in policy (OPA/Sentinel); set per-environment budgets with alerts.'
+    references: ['FinOps', 'AWS-Well-Architected:Cost']
+
+  - id: IAC-007
+    title: Kubernetes manifests avoid privileged containers
+    section: S15
+    section_title: Platform-Specific
+    severity: HIGH
+    class: security
+    applies_when: { fact: 'has:kubernetes' }
+    check:
+      kind: grep_absent
+      pattern: '(privileged\s*:\s*true|hostPID\s*:\s*true|hostNetwork\s*:\s*true|allowPrivilegeEscalation\s*:\s*true|capabilities\s*:[\s\S]{0,60}add\s*:[\s\S]{0,40}\[\s*[''"]?ALL)'
+      include: ['**/*.{yaml,yml}']
+      exclude: ['**/node_modules/**']
+    why: 'A privileged container is root on the node. There is almost always a narrower capability that works.'
+    remediation: 'Drop ALL capabilities and add back only what is needed; use Pod Security Admission "restricted".'
+    references: ['CIS-K8s-5.2.1', 'NSA-K8s-Hardening']

package/rules/stacks/jvm.yaml

@@ -0,0 +1,150 @@
+id: stacks/jvm
+title: Java / Kotlin / JVM
+section: S15
+section_title: Platform-Specific
+description: 'Activated when Java, Kotlin, or Scala is detected.'
+version: '1.0'
+skip_when:
+  all:
+    - { fact: 'lang:java', op: 'absent' }
+    - { fact: 'lang:kotlin', op: 'absent' }
+    - { fact: 'lang:scala', op: 'absent' }
+
+rules:
+  - id: JVM-001
+    title: Dependency versions are managed centrally
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: supply-chain
+    check:
+      kind: grep_present
+      pattern: '(dependencyManagement|<dependencyManagement>|versions?\.toml|catalog|constraints\s*\{|dependencyResolutionManagement)'
+      include:
+        [
+          'pom.xml',
+          'build.gradle*',
+          'settings.gradle*',
+          'build.gradle.kts',
+          'gradle/libs.versions.toml',
+        ]
+      flags: i
+    why: 'Without a BOM or version catalog, five modules drift into five versions of the same library.'
+    remediation: 'Maven: dependencyManagement. Gradle: a version catalog in gradle/libs.versions.toml.'
+    references: ['Maven-BOM', 'Gradle-Version-Catalogs']
+
+  - id: JVM-002
+    title: No hardcoded credentials in configuration
+    section: S15
+    section_title: Platform-Specific
+    severity: CRITICAL
+    class: security
+    check:
+      kind: grep_absent
+      pattern: '(password|passwd|secret|token|api[_-]?key)\s*[:=]\s*[''"]?(?!\$\{|#\{|\{\{)[A-Za-z0-9/+_-]{8,}'
+      include:
+        ['**/*.{properties,yml,yaml,xml,conf}', '**/application*.yml', '**/application*.properties']
+      exclude: ['**/src/test/**', '**/test/**']
+      flags: i
+    why: 'application.properties is committed. Anything in it is public.'
+    remediation: 'Externalise to environment variables or a secret manager; reference with ${ENV_VAR}.'
+    references: ['CWE-798', 'ASVS-14.3.2']
+
+  - id: JVM-003
+    title: Exception handling does not swallow stack traces
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: correctness
+    check:
+      kind: grep_wrong
+      pattern: '(catch\s*\(\s*\w+\s+\w+\s*\)\s*\{\s*\}|printStackTrace\s*\(\s*\)|e\.printStackTrace)'
+      include: ['**/*.{java,kt,scala}']
+      exclude: ['**/src/test/**', '**/test/**']
+    why: 'printStackTrace writes to stderr, which usually goes nowhere useful, and an empty catch loses the error entirely.'
+    remediation: 'Log with a logger at the right level, including the context; rethrow or handle.'
+    references: ['CWE-390', 'ASVS-7.4.1']
+
+  - id: JVM-004
+    title: Parameterised SQL / JPA criteria instead of concatenation
+    section: S15
+    section_title: Platform-Specific
+    severity: CRITICAL
+    class: security
+    applies_when: { fact: 'has:database' }
+    check:
+      kind: grep_absent
+      pattern: '(createQuery\(\s*[''"][^''"]*[''"]\s*\+|createNativeQuery\(\s*.*\+|Statement\.execute(Query)?\s*\(\s*.*\+|\+?\s*[''"]\s*(SELECT|INSERT|UPDATE|DELETE)[^''"]*[''"]\s*\+)'
+      include: ['**/*.{java,kt}']
+      exclude: ['**/src/test/**', '**/test/**']
+      flags: i
+    why: 'String-concatenated JPQL is exactly as injectable as raw SQL.'
+    remediation: 'Use named parameters (:name) or the Criteria API. Never build a query string from input.'
+    references: ['CWE-89', 'ASVS-5.3.4']
+
+  - id: JVM-005
+    title: Nullability is explicit
+    section: S15
+    section_title: Platform-Specific
+    severity: LOW
+    class: correctness
+    applies_when: { fact: 'lang:kotlin' }
+    check: { kind: manual }
+    evidence: 'Count of `!!` force-unwraps and platform types crossing into Kotlin from Java.'
+    why: 'Every !! is a NullPointerException with the compiler silenced.'
+    remediation: 'Prefer ?: with a default, requireNotNull with a message, or make the Java API annotated.'
+    references: ['Kotlin-Null-Safety']
+
+  - id: JVM-006
+    title: Static analysis runs in CI
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: supply-chain
+    applies_when: { fact: 'has:ci' }
+    check:
+      kind: grep_present
+      pattern: '(spotbugs|pmd|checkstyle|errorprone|detekt|ktlint|sonar|snyk)'
+      include:
+        [
+          'pom.xml',
+          'build.gradle*',
+          '.github/workflows/*.yml',
+          '.github/workflows/*.yaml',
+          '.gitlab-ci.yml',
+        ]
+      flags: i
+    why: 'SpotBugs and Error Prone find real bugs, not just style nits, and they are free.'
+    remediation: 'Add SpotBugs/ErrorProne (Java) or detekt/ktlint (Kotlin) and fail on new high-priority findings.'
+    references: ['OpenSSF-Scorecard:SAST']
+
+  - id: JVM-007
+    title: Insecure deserialisation is avoided
+    section: S15
+    section_title: Platform-Specific
+    severity: HIGH
+    class: security
+    check:
+      kind: grep_absent
+      pattern: '(ObjectInputStream|readObject\s*\(|XMLDecoder|enableDefaultTyping|activateDefaultTyping|readValue\s*\(\s*.*,\s*Object\.class)'
+      include: ['**/*.{java,kt}']
+      exclude: ['**/src/test/**', '**/test/**']
+    why: 'Java deserialisation gadget chains are one of the most reliable RCE vectors in existence.'
+    remediation: 'Use JSON with an explicit schema and no polymorphic default typing; validate before binding.'
+    references: ['CWE-502', 'ASVS-5.5.1']
+
+  - id: JVM-008
+    title: JVM/container memory limits are respected
+    section: S15
+    section_title: Platform-Specific
+    severity: LOW
+    class: performance
+    applies_when: { fact: 'has:containers' }
+    check:
+      kind: grep_present
+      pattern: '(MaxRAMPercentage|UseContainerSupport|XX:\+UseContainerSupport|Xmx)'
+      include:
+        ['Dockerfile*', '**/*.sh', 'docker-compose*.yml', '**/*.{yaml,yml}', 'JAVA_TOOL_OPTIONS']
+    why: 'Without it the JVM sizes its heap from the host, not the cgroup, and gets OOM-killed.'
+    remediation: 'Set -XX:MaxRAMPercentage=75 (and leave the rest for off-heap).'
+    references: ['JVM-Container-Support']

package/rules/stacks/ml-ai.yaml

@@ -0,0 +1,140 @@
+id: stacks/ml-ai
+title: ML / AI Systems
+section: S15
+section_title: Platform-Specific
+description: 'Activated when PyTorch/TensorFlow/JAX, notebooks, or model artefacts are detected.'
+version: '1.0'
+skip_when: { fact: 'project:ml', op: 'absent' }
+
+rules:
+  - id: ML-001
+    title: Training data is versioned
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: maintainability
+    check:
+      kind: grep_present
+      pattern: '(dvc|lfs|lakefs|wandb\.Artifact|mlflow|dataset.*version|\.dvc/|data/raw)'
+      include: ['**/*.{py,yaml,yml,toml,md}', '.gitattributes', '.dvc/config']
+      exclude: ['**/node_modules/**']
+      flags: i
+    why: 'A model you cannot reproduce from its data is a result you cannot defend or debug.'
+    remediation: 'Version datasets with DVC or Git LFS; record the exact snapshot hash with every training run.'
+    references: ['DVC', 'Google-Rules-of-ML']
+
+  - id: ML-002
+    title: Model artefacts are versioned and registered
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: operations
+    check: { kind: manual }
+    evidence: 'A model registry (MLflow, Weights & Biases, SageMaker) mapping deployed model → training run → data snapshot.'
+    why: 'When production degrades, the first question is "which model is running and what was it trained on?"'
+    remediation: 'Register every candidate model with metadata; deploy by registry version, never by copying files.'
+    references: ['MLflow', 'Google-Rules-of-ML']
+
+  - id: ML-003
+    title: Training is reproducible (seeded and pinned)
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: correctness
+    check:
+      kind: grep_present
+      pattern: '(random_seed|manual_seed|set_seed|seed\s*=\s*\d+|deterministic\s*=\s*True|torch\.use_deterministic)'
+      include: ['**/*.py', '**/*.ipynb', '**/*.{yaml,yml}']
+      exclude: ['**/node_modules/**']
+      flags: i
+    why: 'Unseeded training means you cannot tell an improvement from noise.'
+    remediation: 'Seed every RNG (python, numpy, torch), pin the library versions, and record the environment.'
+    references: ['PyTorch-Reproducibility']
+
+  - id: ML-004
+    title: Model/data drift is monitored in production
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: operations
+    applies_when: { fact: 'maturity:production' }
+    check: { kind: manual }
+    evidence: 'Input distribution monitoring and a performance/label-feedback loop with alert thresholds.'
+    why: 'Models do not crash when they degrade. They just get quietly worse, and nobody notices for a quarter.'
+    remediation: 'Log input feature distributions and prediction confidence; alert on drift beyond a threshold.'
+    references: ['Google-Rules-of-ML', 'NIST-AI-RMF']
+
+  - id: ML-005
+    title: Predictions are logged for audit
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: compliance
+    applies_when: { fact: 'maturity:production' }
+    check: { kind: manual }
+    evidence: 'Per-request log of model version, input features (or a hash), output, and latency, retained per policy.'
+    why: 'You cannot investigate a harmful prediction, a bias complaint, or a regression without the record.'
+    remediation: 'Log predictions with a request ID and model version; keep PII out or pseudonymised.'
+    references: ['NIST-AI-RMF', 'EU-AI-Act-Art.12']
+
+  - id: ML-006
+    title: Bias/fairness has been evaluated
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: compliance
+    check: { kind: manual }
+    evidence: 'Evaluation sliced across relevant protected or sensitive attributes, with the results recorded.'
+    why: 'Aggregate accuracy hides per-group failure. "95% accurate" can still mean one group is systematically wrong.'
+    remediation: 'Slice metrics by relevant cohorts before launch; document known limitations in a model card.'
+    references: ['NIST-AI-RMF', 'EU-AI-Act']
+
+  - id: ML-007
+    title: Notebooks are not the deployment path
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: maintainability
+    check: { kind: manual }
+    evidence: "Whether training/inference runs from scripts or pipelines, or still from someone's notebook."
+    why: '"Run cells 1 through 14, then the one I added" is not a reproducible pipeline.'
+    remediation: 'Extract to versioned scripts and a pipeline definition; keep notebooks for exploration only.'
+    references: ['Google-Rules-of-ML']
+
+  - id: ML-008
+    title: Inference cost and latency are tracked
+    section: S15
+    section_title: Platform-Specific
+    severity: LOW
+    class: performance
+    applies_when: { fact: 'maturity:production' }
+    check: { kind: manual }
+    evidence: 'p50/p95 inference latency and cost per 1k predictions (GPU hours or API spend).'
+    why: 'LLM and GPU inference bills are the fastest-growing line item in most 2026 stacks.'
+    remediation: 'Instrument per-request token/compute cost; set budgets; cache and batch where possible.'
+    references: ['FinOps', 'OWASP-LLM06:2026']
+
+  - id: ML-009
+    title: Model files are not committed to git
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: maintainability
+    check:
+      kind: tracked_absent
+      patterns:
+        [
+          '**/*.pt',
+          '**/*.pth',
+          '**/*.ckpt',
+          '**/*.h5',
+          '**/*.safetensors',
+          '**/*.onnx',
+          '**/*.bin',
+          '**/*.pb',
+          '**/checkpoints/**',
+          '**/*.gguf',
+        ]
+    why: 'Model weights are hundreds of megabytes to tens of gigabytes. Git will remember every version, forever.'
+    remediation: 'Store weights in a model registry or object storage (DVC, S3, Hugging Face Hub) and reference by digest.'
+    references: ['DVC', 'OpenSSF-Scorecard:Binary-Artifacts']

package/rules/stacks/mobile.yaml

@@ -0,0 +1,121 @@
+id: stacks/mobile
+title: Mobile (iOS / Android / Cross-platform)
+section: S15
+section_title: Platform-Specific
+description: 'Activated when iOS, Android, React Native, Expo, or Flutter is detected.'
+version: '1.0'
+skip_when:
+  all:
+    - { fact: 'platform:mobile', op: 'absent' }
+    - { fact: 'platform:ios', op: 'absent' }
+    - { fact: 'platform:android', op: 'absent' }
+
+rules:
+  - id: MOB-001
+    title: Crash reporting is integrated
+    section: S15
+    section_title: Platform-Specific
+    severity: HIGH
+    class: operations
+    check:
+      kind: grep_present
+      pattern: '(Crashlytics|Sentry|BugSnag|Instabug|@sentry/react-native|firebase/crashlytics|crashReporting)'
+      include: ['**/*.{ts,tsx,js,json,plist,xml,gradle,kts,swift,kt,dart,yaml,yml}']
+      exclude: ['**/node_modules/**', '**/Pods/**']
+      flags: i
+    why: "On mobile you cannot watch the user's screen. Without crash reporting, your bug reports are one-star reviews."
+    remediation: 'Add Crashlytics or Sentry with symbol/dSYM upload so stack traces are readable.'
+    references: ['DORA:Monitoring']
+
+  - id: MOB-002
+    title: No hardcoded API secrets in app bundles
+    section: S15
+    section_title: Platform-Specific
+    severity: CRITICAL
+    class: security
+    check:
+      kind: grep_absent
+      pattern: '(api[_-]?key|secret|token|password)\s*[:=]\s*[''"][A-Za-z0-9._-]{16,}[''"]'
+      include: ['**/*.{swift,kt,java,dart,ts,tsx,js,plist,xml,gradle,json}']
+      exclude:
+        ['**/node_modules/**', '**/Pods/**', '**/*Test*', '**/android/build/**', '**/ios/Pods/**']
+      flags: i
+    why: 'Anything in an app bundle is extractable in about four minutes with apktool or Hopper.'
+    remediation: 'Keep secrets server-side; use attestation (App Check / DeviceCheck) and short-lived tokens.'
+    references: ['OWASP-MASVS-STORAGE-1', 'CWE-798']
+
+  - id: MOB-003
+    title: Sensitive data is not stored insecurely on device
+    section: S15
+    section_title: Platform-Specific
+    severity: HIGH
+    class: security
+    check: { kind: manual }
+    evidence: 'Where tokens/PII live: Keychain/Keystore/EncryptedSharedPreferences, not AsyncStorage, UserDefaults, or a plaintext SQLite file.'
+    why: 'On a rooted or backed-up device, plaintext local storage is a data breach with extra steps.'
+    remediation: 'Use Keychain (iOS) / Keystore-backed EncryptedSharedPreferences (Android); never AsyncStorage for secrets.'
+    references: ['OWASP-MASVS-STORAGE-2', 'CWE-311']
+
+  - id: MOB-004
+    title: Network security configuration is explicit
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: security
+    check: { kind: manual }
+    evidence: 'ATS settings (iOS Info.plist) and network-security-config / cleartextTrafficPermitted (Android).'
+    why: 'Both platforms default to permissive in older templates, which means plaintext HTTP and MITM.'
+    remediation: 'Disallow cleartext traffic; pin certificates only if you can commit to a rotation process.'
+    references: ['OWASP-MASVS-NETWORK-1', 'CWE-319']
+
+  - id: MOB-005
+    title: Permissions are requested minimally and with rationale
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: compliance
+    check: { kind: manual }
+    evidence: 'Declared permissions vs. permissions actually used; where and when each is requested.'
+    why: 'Over-broad permissions are the fastest route to an app-store rejection and a privacy headline.'
+    remediation: 'Request at the moment of use with an explanation; drop anything unused.'
+    references: ['OWASP-MASVS-PLATFORM-1', 'App-Store-Review']
+
+  - id: MOB-006
+    title: Offline behaviour is handled
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: correctness
+    check: { kind: manual }
+    evidence: 'Behaviour when the network is unavailable mid-action: queued, retried, or failed with a clear message?'
+    why: 'Mobile networks drop constantly. An app that assumes connectivity corrupts data.'
+    remediation: 'Queue mutations locally and reconcile on reconnect; show a clear offline state.'
+    references: ['OWASP-MASVS']
+
+  - id: MOB-007
+    title: Privacy manifests / data collection disclosure are present
+    section: S15
+    section_title: Platform-Specific
+    severity: HIGH
+    class: compliance
+    applies_when:
+      any:
+        - { fact: 'platform:ios' }
+        - { fact: 'platform:android' }
+    check: { kind: manual }
+    evidence: 'PrivacyInfo.xcprivacy (Apple) and the Play Data Safety declaration, both matching what the app actually collects.'
+    why: 'Apple rejects apps with missing or inaccurate privacy manifests. The declaration is also legally binding.'
+    remediation: 'Enumerate every SDK that collects data, then fill in the manifest to match reality.'
+    references: ['Apple-Privacy-Manifest', 'Play-Data-Safety']
+
+  - id: MOB-008
+    title: Tested on multiple screen sizes and OS versions
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: correctness
+    check: { kind: manual }
+    evidence: 'Device matrix you test against, and whether the min-supported OS version is still patched upstream.'
+    why: '"Works on my iPhone 15 Pro" is not a test matrix.'
+    remediation: 'Test at least: smallest supported phone, a tablet, one dark-mode run, and the oldest supported OS.'
+    references: ['OWASP-MASVS']