@xenos1996/usat 1.0.0

package/rules/stacks/node-typescript.yaml

@@ -0,0 +1,166 @@
+id: stacks/node-typescript
+title: Node.js / TypeScript
+section: S15
+section_title: Platform-Specific
+description: 'Activated when JavaScript or TypeScript is detected.'
+version: '1.0'
+skip_when:
+  all:
+    - { fact: 'lang:typescript', op: 'absent' }
+    - { fact: 'lang:javascript', op: 'absent' }
+    - { fact: 'pm:node', op: 'absent' }
+
+rules:
+  - id: NODE-001
+    title: Node runtime version is pinned
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: operations
+    check:
+      kind: grep_present
+      pattern: '(node-version-file|node-version:|"engines"|"volta"|"packageManager"|\.nvmrc)'
+      include:
+        [
+          'package.json',
+          '.nvmrc',
+          '.node-version',
+          '.github/workflows/*.yml',
+          '.github/workflows/*.yaml',
+          '.gitlab-ci.yml',
+        ]
+      flags: i
+    why: '"Works on my Node" is a real bug class — native modules, syntax support, and crypto defaults all shift between majors.'
+    remediation: 'Add .nvmrc plus "engines": { "node": ">=20" } and node-version-file: .nvmrc in CI.'
+    references: ['Node-Release-Schedule']
+
+  - id: NODE-002
+    title: TypeScript strict mode is on
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: correctness
+    applies_when: { fact: 'lang:typescript' }
+    check:
+      kind: grep_present
+      pattern: '"strict"\s*:\s*true|"extends"\s*:\s*(.*strict|@tsconfig/strict)'
+      include: ['**/tsconfig*.json']
+      flags: i
+    why: 'TypeScript without strict is TypeScript with the safety features switched off.'
+    remediation: 'Set "strict": true. If the migration is large, enable one flag at a time (strictNullChecks first).'
+    references: ['TS-Handbook']
+
+  - id: NODE-003
+    title: Unhandled promise rejections are handled
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: correctness
+    applies_when: { fact: 'platform:server' }
+    check:
+      kind: grep_present
+      pattern: '(unhandledRejection|uncaughtException|process\.on\(\s*[''"]unhandled)'
+      include: ['**/*.{ts,js,mjs,cjs}']
+      exclude: ['**/*.test.*', '**/*.spec.*', '**/node_modules/**']
+      flags: i
+    why: 'An unhandled rejection takes the process down in Node 15+, silently dropping in-flight requests.'
+    remediation: 'Register process handlers for unhandledRejection/uncaughtException that log and exit non-zero so the orchestrator restarts cleanly.'
+    references: ['CWE-248', 'Node-Docs']
+
+  - id: NODE-004
+    title: No private registry credentials committed
+    section: S15
+    section_title: Platform-Specific
+    severity: CRITICAL
+    class: security
+    check:
+      kind: grep_absent
+      pattern: '(//[^/]*npm[^/]*/:[_-]?authToken|_auth\s*=|NPM_TOKEN\s*=\s*[A-Za-z0-9_-]{16,})'
+      include:
+        [
+          '.npmrc',
+          '**/.npmrc',
+          '.yarnrc*',
+          '.github/workflows/*.yml',
+          '.github/workflows/*.yaml',
+          'Dockerfile*',
+        ]
+      flags: i
+    why: 'A committed registry token is publish access to your package (and everything it can reach).'
+    remediation: 'Use ${{ secrets.NPM_TOKEN }} in CI and `npm config set` at runtime. Rotate anything already exposed.'
+
+  - id: NODE-005
+    title: No deprecated Node APIs in use
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: maintainability
+    check:
+      kind: grep_deprecated
+      pattern: '(new Buffer\s*\(|url\.parse\s*\(|crypto\.createCipher\s*\(|domain\.create|require\(\s*[''"]sys[''"]|new (?:punycode|querystring))'
+      include: ['**/*.{ts,tsx,js,jsx,mjs,cjs}']
+      exclude: ['**/*.test.*', '**/node_modules/**']
+    why: 'Deprecated APIs are usually deprecated because they are unsafe (createCipher) or broken (url.parse).'
+    remediation: 'Buffer.from/alloc, new URL(), crypto.createCipheriv, punycode/. Replace as you touch the file.'
+    references: ['Node-Deprecations']
+
+  - id: NODE-006
+    title: Environment variables are validated at startup
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: correctness
+    applies_when: { fact: 'platform:server' }
+    check:
+      kind: grep_present
+      pattern: '(envalid|t3-oss/env|@t3-oss/env|zod.*\.parse\(\s*process\.env|\.parse\(\s*env\b|cleanEnv|convict|dotenv-safe|env\.safeParse)'
+      include: ['**/*.{ts,js,mjs,cjs}']
+      exclude: ['**/*.test.*', '**/node_modules/**']
+      flags: i
+    why: 'A missing env var discovered at request time is a 500 in production; at startup it is a failed deploy.'
+    remediation: 'Parse process.env against a schema at boot and exit with a clear message on failure.'
+    references: ['12-Factor:Config']
+
+  - id: NODE-007
+    title: Libraries declare sideEffects / exports for tree-shaking
+    section: S15
+    section_title: Platform-Specific
+    severity: LOW
+    class: performance
+    applies_when: { fact: 'project:library' }
+    check:
+      kind: grep_present
+      pattern: '"sideEffects"\s*:|"exports"\s*:'
+      include: ['package.json']
+    why: 'Without it, bundlers ship your whole library to consumers who use one function.'
+    remediation: 'Add "sideEffects": false and an "exports" map in package.json.'
+    references: ['Webpack-Tree-Shaking']
+
+  - id: NODE-008
+    title: Module system is consistent
+    section: S15
+    section_title: Platform-Specific
+    severity: LOW
+    class: maintainability
+    applies_when: { fact: 'lang:typescript' }
+    check: { kind: manual }
+    evidence: 'Either ESM throughout ("type": "module" + .js extensions in imports) or CJS throughout — not both.'
+    why: 'Mixed ESM/CJS is the source of the most confusing Node errors in existence.'
+    remediation: 'Pick one; add "type" to package.json; configure tsconfig module/moduleResolution to match.'
+    references: ['Node-ESM']
+
+  - id: NODE-009
+    title: A fast, isolated runtime is used for tests
+    section: S15
+    section_title: Platform-Specific
+    severity: LOW
+    class: operations
+    applies_when: { fact: 'has:tests' }
+    check:
+      kind: grep_present
+      pattern: '(vitest|jest|node --test|node:test|ava|tap)'
+      include: ['package.json']
+      flags: i
+    why: 'Slow tests do not get run. Unrun tests are decoration.'
+    remediation: 'Vitest or node:test; keep the unit suite under ~30 seconds so it runs on every save.'
+    references: ['DORA']

package/rules/stacks/python.yaml

@@ -0,0 +1,175 @@
+id: stacks/python
+title: Python
+section: S15
+section_title: Platform-Specific
+description: 'Activated when Python is detected.'
+version: '1.0'
+skip_when: { fact: 'lang:python', op: 'absent' }
+
+rules:
+  - id: PY-001
+    title: Dependencies are declared in a modern manifest
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: supply-chain
+    check:
+      kind: any_file
+      patterns:
+        [
+          'pyproject.toml',
+          'requirements.txt',
+          'requirements/*.txt',
+          'Pipfile',
+          'environment.yml',
+          'setup.py',
+        ]
+    why: 'Python projects with no manifest cannot be installed reproducibly by anyone, including CI.'
+    remediation: 'Use pyproject.toml with Poetry/uv, or pin requirements.txt with pip-compile and hashes.'
+    references: ['PEP-621', 'PyPA']
+
+  - id: PY-002
+    title: Python version is pinned
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: operations
+    check:
+      kind: grep_present
+      pattern: '(python-version|python_version|requires-python|PYTHON_VERSION|\.python-version)'
+      include:
+        [
+          'pyproject.toml',
+          'setup.py',
+          'setup.cfg',
+          '.python-version',
+          '.github/workflows/*.yml',
+          '.github/workflows/*.yaml',
+          '.gitlab-ci.yml',
+          'Dockerfile*',
+          'runtime.txt',
+        ]
+      flags: i
+    why: 'Python 2→3 style breakage is rare, but 3.9→3.12 removes stdlib modules you may rely on.'
+    remediation: 'Set requires-python in pyproject.toml and pin the same version in CI and the container.'
+    references: ['endoflife.date/python']
+
+  - id: PY-003
+    title: Dependencies are pinned to exact versions
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: supply-chain
+    check:
+      kind: grep_present
+      pattern: '^[a-zA-Z0-9._-]+\s*==\s*[0-9]'
+      include: ['requirements*.txt', 'requirements/*.txt']
+    why: 'Unpinned requirements mean the build changes without a commit.'
+    remediation: 'pip-compile with hashes, or Poetry/uv lockfile. Pin exact versions for applications.'
+    references: ['OpenSSF-Scorecard:Pinned-Dependencies']
+
+  - id: PY-004
+    title: No bare except clauses
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: correctness
+    check:
+      kind: grep_wrong
+      pattern: 'except\s*:\s*$|except\s+BaseException\s*:'
+      include: ['**/*.py']
+      exclude: ['**/tests/**', '**/test_*.py', '**/*_test.py']
+    why: 'A bare except swallows KeyboardInterrupt and SystemExit, and every real error with them.'
+    remediation: 'Catch the specific exceptions you can handle; let the rest propagate.'
+    references: ['PEP-8', 'CWE-396']
+
+  - id: PY-005
+    title: No mutable default arguments
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: correctness
+    check:
+      kind: grep_wrong
+      pattern: 'def\s+\w+\s*\([^)]*=\s*(\[\]|\{\}|set\(\)|list\(\)|dict\(\))'
+      include: ['**/*.py']
+      exclude: ['**/tests/**']
+    why: 'The default is evaluated once at definition time, so every call shares the same list. This bug survives code review remarkably often.'
+    remediation: 'Default to None and assign inside the function: `def f(x=None): x = x or []`.'
+    references: ['Python-Gotchas']
+
+  - id: PY-006
+    title: No unsafe deserialisation
+    section: S15
+    section_title: Platform-Specific
+    severity: CRITICAL
+    class: security
+    check:
+      kind: grep_absent
+      pattern: '(pickle\.(loads?|load)|marshal\.load|yaml\.load\s*\((?!.*Safe)|torch\.load\s*\((?!.*weights_only)|eval\s*\(\s*(input|request))'
+      include: ['**/*.py']
+      exclude: ['**/tests/**']
+    why: 'pickle.load on untrusted input is remote code execution by design. yaml.load without SafeLoader is the same class of bug.'
+    remediation: 'Use json, yaml.safe_load, or torch.load(weights_only=True). Never deserialise untrusted pickle.'
+    references: ['CWE-502', 'ASVS-5.5.1']
+
+  - id: PY-007
+    title: Subprocess calls do not use shell=True
+    section: S15
+    section_title: Platform-Specific
+    severity: HIGH
+    class: security
+    check:
+      kind: grep_absent
+      pattern: 'shell\s*=\s*True'
+      include: ['**/*.py']
+      exclude: ['**/tests/**', '**/scripts/**']
+    why: 'shell=True with any interpolated input is command injection.'
+    remediation: 'Pass an argument list: subprocess.run(["ls", "-l"], check=True).'
+    references: ['CWE-78']
+
+  - id: PY-008
+    title: Debug mode is not enabled outside local development
+    section: S15
+    section_title: Platform-Specific
+    severity: CRITICAL
+    class: security
+    check:
+      kind: grep_absent
+      pattern: '(DEBUG\s*=\s*True|debug\s*=\s*True|app\.run\(\s*[^)]*debug\s*=\s*True|FLASK_DEBUG\s*=\s*1)'
+      include: ['**/*.py', '**/*.env*', 'docker-compose*.yml', 'Dockerfile*']
+      exclude: ['**/tests/**', '**/settings/*test*', '**/test_settings*']
+      flags: i
+    why: 'Django/Flask debug mode exposes a REPL-backed traceback page — full RCE to anyone who can reach it.'
+    remediation: 'Drive DEBUG from the environment and default it to False. Assert it is False in the production settings module.'
+    references: ['CWE-489', 'ASVS-14.3.3']
+
+  - id: PY-009
+    title: Type hints are used on public functions
+    section: S15
+    section_title: Platform-Specific
+    severity: LOW
+    class: maintainability
+    check:
+      kind: grep_present
+      pattern: 'def\s+\w+\s*\([^)]*:\s*\w+[^)]*\)\s*(->|:)'
+      include: ['**/*.py']
+      exclude: ['**/tests/**', '**/migrations/**']
+    why: 'Hints are documentation the type checker enforces, and they make an editor useful.'
+    remediation: 'Annotate public functions first; enable mypy/pyright on the modules that matter.'
+    references: ['PEP-484']
+
+  - id: PY-010
+    title: A linter/formatter is configured for Python
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: maintainability
+    check:
+      kind: grep_present
+      pattern: '(\[tool\.ruff\]|\[tool\.black\]|\[tool\.pylint\]|\[tool\.flake8\]|ruff|flake8|pylint)'
+      include: ['pyproject.toml', 'setup.cfg', '.flake8', '.ruff.toml', '.pre-commit-config.yaml']
+      flags: i
+    why: 'Ruff runs in milliseconds and catches the errors reviewers consistently miss.'
+    remediation: 'Add ruff with a sensible rule set and wire it into pre-commit and CI.'
+    references: ['PyPA']

package/rules/stacks/rust.yaml

@@ -0,0 +1,129 @@
+id: stacks/rust
+title: Rust
+section: S15
+section_title: Platform-Specific
+description: 'Activated when Rust is detected.'
+version: '1.0'
+skip_when: { fact: 'lang:rust', op: 'absent' }
+
+rules:
+  - id: RS-001
+    title: Cargo.toml declares edition and metadata
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: maintainability
+    check:
+      kind: grep_present
+      pattern: 'edition\s*=\s*"20(18|21|24)"'
+      include: ['Cargo.toml']
+    why: 'Editions change semantics (especially 2018 module paths and 2024 closure capture). Without one you get 2015.'
+    remediation: 'Set `edition = "2021"` (or newer) and make sure CI builds with it.'
+    references: ['Rust-Editions']
+
+  - id: RS-002
+    title: No unwrap/expect in non-test code
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: correctness
+    check:
+      kind: grep_wrong
+      pattern: '\.(unwrap|expect)\s*\(\s*\)|\.unwrap\(\)'
+      include: ['**/*.rs']
+      exclude: ['**/tests/**', '**/benches/**', '**/examples/**']
+    why: 'unwrap() is a panic wearing a convenience costume. Fine in tests, a crash in production.'
+    remediation: 'Propagate with ? and a typed error, or handle the None case explicitly.'
+    references: ['Rust-Error-Handling']
+
+  - id: RS-003
+    title: unsafe blocks are justified and minimal
+    section: S15
+    section_title: Platform-Specific
+    severity: HIGH
+    class: security
+    check:
+      kind: grep_wrong
+      pattern: '(unsafe\s*\{|#!\[allow\(unsafe_code\)\]|#\[allow\(unsafe_code\)\])'
+      include: ['**/*.rs']
+      exclude: ['**/tests/**']
+    why: 'unsafe is where Rust stops protecting you. Every block needs a comment stating the invariant it upholds.'
+    remediation: 'Wrap in a safe abstraction with a documented invariant; add a // SAFETY: comment per block.'
+    references: ['Rust-Nomicon', 'CWE-119']
+
+  - id: RS-004
+    title: Clippy runs in CI
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: maintainability
+    applies_when: { fact: 'has:ci' }
+    check:
+      kind: grep_present
+      pattern: '(cargo clippy|clippy)'
+      include:
+        [
+          '.github/workflows/*.yml',
+          '.github/workflows/*.yaml',
+          '.gitlab-ci.yml',
+          'Makefile',
+          'justfile',
+          'Taskfile.yml',
+        ]
+      flags: i
+    why: 'Clippy catches the idiomatic mistakes a compiler cannot: needless clones, wrong locks, incorrect casts.'
+    remediation: 'Add `cargo clippy -- -D warnings` to CI.'
+    references: ['Clippy']
+
+  - id: RS-005
+    title: No todo!/unimplemented! in shipped paths
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: correctness
+    check:
+      kind: grep_wrong
+      pattern: '(todo!\s*\(|unimplemented!\s*\(|unreachable!\s*\()'
+      include: ['src/**/*.rs']
+      exclude: ['**/tests/**']
+    why: 'unreachable! that turns out to be reachable is an abort at runtime.'
+    remediation: 'Return a Result for the unfinished paths, or finish them before release.'
+    references: ['Rust-API-Guidelines']
+
+  - id: RS-006
+    title: Dependency audit runs in CI (cargo-audit / deny)
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: supply-chain
+    applies_when: { fact: 'has:ci' }
+    check:
+      kind: grep_present
+      pattern: '(cargo-audit|cargo audit|cargo-deny|cargo deny|rustsec)'
+      include:
+        [
+          '.github/workflows/*.yml',
+          '.github/workflows/*.yaml',
+          '.gitlab-ci.yml',
+          'Makefile',
+          'justfile',
+        ]
+      flags: i
+    why: 'The RustSec advisory DB is the Rust equivalent of npm audit, and it is one CI step away.'
+    remediation: 'Add cargo-audit (advisories) and cargo-deny (licenses/bans) to CI.'
+    references: ['RustSec', 'SLSA']
+
+  - id: RS-007
+    title: Release builds are optimised and stripped
+    section: S15
+    section_title: Platform-Specific
+    severity: LOW
+    class: performance
+    applies_when: { fact: 'project:cli' }
+    check:
+      kind: grep_present
+      pattern: '(strip\s*=\s*(true|"symbols"|"debuginfo")|opt-level\s*=\s*("?[23s]"?|"z")|lto\s*=\s*)'
+      include: ['Cargo.toml']
+    why: 'The default release profile leaves debug symbols in the binary — 5–10× larger for no benefit.'
+    remediation: 'Add a [profile.release] with lto = true, strip = true, and opt-level = "z" or 3.'
+    references: ['Cargo-Profiles']

package/rules/stacks/solidity.yaml

@@ -0,0 +1,139 @@
+id: stacks/solidity
+title: Blockchain / Smart Contracts
+section: S15
+section_title: Platform-Specific
+description: 'Activated when Solidity, Foundry, or Hardhat is detected. USAT is not a substitute for a third-party audit.'
+version: '1.0'
+skip_when: { fact: 'platform:evm', op: 'absent' }
+
+rules:
+  - id: SOLID-001
+    title: Contracts are protected against reentrancy
+    section: S15
+    section_title: Platform-Specific
+    severity: CRITICAL
+    class: security
+    check: { kind: manual }
+    evidence: 'Every external call followed by a state change, or use of nonReentrant / checks-effects-interactions ordering.'
+    why: 'Reentrancy drained The DAO and has drained a great many contracts since. Funds are unrecoverable.'
+    remediation: 'Follow checks-effects-interactions; use OpenZeppelin ReentrancyGuard; never call external contracts before updating state.'
+    references: ['SWC-107', 'Consensys-Best-Practices']
+
+  - id: SOLID-002
+    title: Compiler version is 0.8+ (or SafeMath is used)
+    section: S15
+    section_title: Platform-Specific
+    severity: HIGH
+    class: security
+    check:
+      kind: grep_deprecated
+      pattern: 'pragma solidity\s+\^?0\.[0-7]\.'
+      include: ['**/*.sol']
+    why: 'Pre-0.8 Solidity wraps silently on overflow. That is how balances go negative.'
+    remediation: 'Use Solidity ^0.8.x, which reverts on overflow/underflow by default.'
+    references: ['SWC-101', 'Solidity-0.8-Breaking-Changes']
+
+  - id: SOLID-003
+    title: Access control is explicit on privileged functions
+    section: S15
+    section_title: Platform-Specific
+    severity: CRITICAL
+    class: security
+    check: { kind: manual }
+    evidence: 'For every state-changing external/public function: the modifier or require that restricts the caller.'
+    why: 'An unprotected initialise or setOwner function is a complete takeover, irrevocably.'
+    remediation: 'Use Ownable/AccessControl; require(msg.sender == owner) on every privileged entry point.'
+    references: ['SWC-105', 'SWC-112']
+
+  - id: SOLID-004
+    title: tx.origin is not used for authorisation
+    section: S15
+    section_title: Platform-Specific
+    severity: CRITICAL
+    class: security
+    check:
+      kind: grep_absent
+      pattern: '(require\s*\(\s*tx\.origin|if\s*\(\s*tx\.origin|msg\.sender\s*==\s*tx\.origin)'
+      include: ['**/*.sol']
+    why: 'tx.origin is the EOA that started the transaction — a phishing contract can impersonate it.'
+    remediation: 'Always authorise on msg.sender.'
+    references: ['SWC-115', 'Consensys-Best-Practices']
+
+  - id: SOLID-005
+    title: External calls are checked and treated as untrusted
+    section: S15
+    section_title: Platform-Specific
+    severity: HIGH
+    class: security
+    check:
+      kind: grep_wrong
+      pattern: '(\.call\s*\(\s*|\.send\s*\(\s*|\.transfer\s*\(\s*)(?![^\n;]*require)'
+      include: ['**/*.sol']
+    why: 'A failed low-level call returns false; it does not revert. Ignoring the return value means silent failure.'
+    remediation: 'Check the return value and revert, or use a safe wrapper (Address.sendValue).'
+    references: ['SWC-104', 'SWC-113']
+
+  - id: SOLID-006
+    title: No block.timestamp dependence for critical logic
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: security
+    check:
+      kind: grep_wrong
+      pattern: '(block\.timestamp|block\.number|now)\s*(%|/|\*|>|<)\s*\d'
+      include: ['**/*.sol']
+    why: 'Miners can nudge timestamps by seconds, which is enough to swing a block-number-based lottery.'
+    remediation: 'Use an oracle or a commit-reveal scheme for randomness; allow tolerance in time comparisons.'
+    references: ['SWC-116', 'SWC-120']
+
+  - id: SOLID-007
+    title: Events are emitted for state changes
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: maintainability
+    check: { kind: manual }
+    evidence: 'Every function that mutates meaningful state emits an event (transfer, ownership, config).'
+    why: 'Off-chain consumers (and incident responders) rely on events; without them, reconstructing history is guesswork.'
+    remediation: 'Emit an indexed event for every state transition, including parameters that identify the affected entity.'
+    references: ['Consensys-Best-Practices']
+
+  - id: SOLID-008
+    title: An emergency pause mechanism exists
+    section: S15
+    section_title: Platform-Specific
+    severity: MEDIUM
+    class: operations
+    check:
+      kind: grep_present
+      pattern: '(Pausable|whenNotPaused|_pause\s*\(|emergencyStop|circuitBreaker)'
+      include: ['**/*.sol']
+    why: 'When an exploit is live, the difference between losing everything and losing a little is a pause button.'
+    remediation: 'Add OpenZeppelin Pausable to value-moving functions, with a documented, time-bounded pausing authority.'
+    references: ['Consensys-Best-Practices']
+
+  - id: SOLID-009
+    title: A test suite with fuzzing/invariants exists
+    section: S15
+    section_title: Platform-Specific
+    severity: HIGH
+    class: correctness
+    check: { kind: manual }
+    evidence: 'Foundry invariant/fuzz tests, Echidna properties, or a Hardhat suite covering the economic edge cases.'
+    why: 'Unit tests with hand-picked inputs miss the one input that drains the pool.'
+    remediation: 'Add invariant tests for the core accounting identity (e.g. sum(balances) == totalSupply).'
+    references: ['Foundry-Invariant-Testing']
+
+  - id: SOLID-010
+    title: Third-party security audit has been performed
+    section: S15
+    section_title: Platform-Specific
+    severity: HIGH
+    class: security
+    applies_when: { fact: 'maturity:production' }
+    check: { kind: manual }
+    evidence: 'Audit report, the version it covered, and confirmation that every finding was fixed or explicitly accepted.'
+    why: 'Automated tooling catches patterns; it does not catch economic design flaws. Deployed contract code is immutable.'
+    remediation: 'Commission an audit before mainnet; publish the report and the remediation status.'
+    references: ['OpenSSF-Criticality', 'Consensys-Best-Practices']