@zerothreatai/vulnerability-registry 4.0.0 → 6.0.0

package/dist/compliances/hipaa.js

@@ -0,0 +1,187 @@
+import { ComplianceCode } from '../compliance-codes';
+import { ComplianceCategory } from '../types';
+import { idsByCategory, idsByCodes, idsByCodePrefix, mergeIds } from './helpers.js';
+const authIds = idsByCategory('authentication');
+const injectionIds = idsByCategory('injection');
+const xssIds = idsByCategory('xss');
+const ssrfIds = idsByCategory('ssrf');
+const configIds = idsByCategory('configuration');
+const disclosureIds = idsByCategory('information_disclosure');
+const cookieIds = idsByCodePrefix(['COOKIE_']);
+const dirbrowseIds = idsByCodePrefix(['DIRBROWSE_']);
+const jwtIds = idsByCodePrefix(['JWT_']);
+const hstsIds = idsByCodes([
+    'HEADER_MISSING_HSTS',
+    'HEADER_HSTS_BAD_MAX_AGE',
+    'HEADER_HSTS_SHORT_MAX_AGE',
+    'HEADER_HSTS_NO_INCLUDESUBDOMAINS',
+    'HEADER_HSTS_PRELOAD_LOW_MAX_AGE',
+    'HEADER_DRIFT_HSTS',
+]);
+const cookieSecureIds = idsByCodes([
+    'COOKIE_SAMESITE_NONE_WITHOUT_SECURE',
+    'COOKIE_SESSION_MISSING_SECURE',
+    'COOKIE_MISSING_SECURE',
+    'COOKIE_HOST_PREFIX_INVALID',
+    'COOKIE_SECURE_PREFIX_INVALID',
+]);
+const allAppSecIds = mergeIds(authIds, injectionIds, xssIds, ssrfIds, configIds, disclosureIds);
+const accessControlIds = mergeIds(authIds, cookieIds, dirbrowseIds, disclosureIds);
+const authAndCookieIds = mergeIds(authIds, cookieIds);
+const cryptoIds = mergeIds(jwtIds, hstsIds, cookieSecureIds);
+const integrityIds = mergeIds(injectionIds, xssIds);
+export const HIPAA_COMPLIANCE = {
+    [ComplianceCode.HIPAA_164_105_PROTECT_PRIVATE_HEALTH_INFO]: {
+        id: 164,
+        code: ComplianceCode.HIPAA_164_105_PROTECT_PRIVATE_HEALTH_INFO,
+        title: 'S.Rule - Part 164, Subpart A, 164.105 Protect Private Health Info',
+        description: 'Make sure private electronic health information is kept safe and secure from anyone who shouldn’t see it.',
+        complianceStandard: ComplianceCategory.HIPAA,
+        relatedVulnerabilityIds: allAppSecIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.HIPAA_164_306_A_1_KEEP_INFO_SAFE]: {
+        id: 165,
+        code: ComplianceCode.HIPAA_164_306_A_1_KEEP_INFO_SAFE,
+        title: 'S.Rule - Part 164, Subpart C, 164.306(a)(1) Keep Info Safe and Available',
+        description: 'Make sure health info stays private, accurate, and ready to use when needed.',
+        complianceStandard: ComplianceCategory.HIPAA,
+        relatedVulnerabilityIds: allAppSecIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.HIPAA_164_306_A_2_PROTECT_AGAINST_THREATS]: {
+        id: 166,
+        code: ComplianceCode.HIPAA_164_306_A_2_PROTECT_AGAINST_THREATS,
+        title: 'S.Rule - Part 164, Subpart C, 164.306(a)(2) Protect Against Threats',
+        description: 'Put systems in place to stop hackers or anything else that might harm the health info.',
+        complianceStandard: ComplianceCategory.HIPAA,
+        relatedVulnerabilityIds: allAppSecIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.HIPAA_164_306_A_3_STOP_UNAUTHORIZED_ACCESS]: {
+        id: 167,
+        code: ComplianceCode.HIPAA_164_306_A_3_STOP_UNAUTHORIZED_ACCESS,
+        title: 'S.Rule - Part 164, Subpart C, 164.306(a)(3) Stop Unauthorized Access',
+        description: 'Make sure no one can use or see health info without permission.',
+        complianceStandard: ComplianceCategory.HIPAA,
+        relatedVulnerabilityIds: accessControlIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.HIPAA_164_308_A_1_I_PREVENT_FIX_PROBLEMS]: {
+        id: 168,
+        code: ComplianceCode.HIPAA_164_308_A_1_I_PREVENT_FIX_PROBLEMS,
+        title: 'S.Rule - Part 164, Subpart C, 164.308(a)(1) (i) Prevent and Fix Problems',
+        description: 'Create rules to spot and fix security problems before they cause damage.',
+        complianceStandard: ComplianceCategory.HIPAA,
+        relatedVulnerabilityIds: allAppSecIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.HIPAA_164_308_A_1_II_B_LOWER_SECURITY_RISKS]: {
+        id: 169,
+        code: ComplianceCode.HIPAA_164_308_A_1_II_B_LOWER_SECURITY_RISKS,
+        title: 'S.Rule - Part 164, Subpart C, 164.308(a)(1)(ii)(B) Lower Security Risks',
+        description: 'Take steps to make sure the risk of problems, like data leaks, is as low as possible.',
+        complianceStandard: ComplianceCategory.HIPAA,
+        relatedVulnerabilityIds: allAppSecIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.HIPAA_164_308_A_5_II_B_BLOCK_MALWARE]: {
+        id: 170,
+        code: ComplianceCode.HIPAA_164_308_A_5_II_B_BLOCK_MALWARE,
+        title: 'S.Rule - Part 164, Subpart C, 164.308(a)(5)(ii)(B) Block Viruses and Malware',
+        description: 'Set up tools to block harmful software like viruses and ransomware.',
+        complianceStandard: ComplianceCategory.HIPAA,
+        relatedVulnerabilityIds: [],
+        isNotApplicable: true,
+    },
+    [ComplianceCode.HIPAA_164_308_A_5_II_C_WATCH_LOGINS]: {
+        id: 171,
+        code: ComplianceCode.HIPAA_164_308_A_5_II_C_WATCH_LOGINS,
+        title: 'S.Rule - Part 164, Subpart C, 164.308(a)(5)(ii)(C) Watch Logins',
+        description: 'Keep track of who’s logging in and report anything that seems suspicious.',
+        complianceStandard: ComplianceCategory.HIPAA,
+        relatedVulnerabilityIds: [],
+        isNotApplicable: true,
+    },
+    [ComplianceCode.HIPAA_164_308_A_5_II_D_PROTECT_PASSWORDS]: {
+        id: 172,
+        code: ComplianceCode.HIPAA_164_308_A_5_II_D_PROTECT_PASSWORDS,
+        title: 'S.Rule - Part 164, Subpart C, 164.308(a)(5)(ii)(D) Protect Passwords',
+        description: 'Make sure passwords are strong, secure, and regularly updated.',
+        complianceStandard: ComplianceCategory.HIPAA,
+        relatedVulnerabilityIds: authAndCookieIds,
+        isNotApplicable: true,
+    },
+    [ComplianceCode.HIPAA_164_308_A_7_I_PLAN_EMERGENCIES]: {
+        id: 173,
+        code: ComplianceCode.HIPAA_164_308_A_7_I_PLAN_EMERGENCIES,
+        title: 'S.Rule - Part 164, Subpart C, 164.308(a)(7)(i) Plan for Emergencies',
+        description: 'Have a backup plan ready if something happens, like a power outage or system crash, so health info stays safe.',
+        complianceStandard: ComplianceCategory.HIPAA,
+        relatedVulnerabilityIds: [],
+        isNotApplicable: true,
+    },
+    [ComplianceCode.HIPAA_164_312_A_1_CONTROL_ACCESS]: {
+        id: 174,
+        code: ComplianceCode.HIPAA_164_312_A_1_CONTROL_ACCESS,
+        title: 'S.Rule - Part 164, Subpart C, 164.312(a)(1) Control Who Can See Info',
+        description: 'Limit access to health info to only those who really need it.',
+        complianceStandard: ComplianceCategory.HIPAA,
+        relatedVulnerabilityIds: accessControlIds,
+        isNotApplicable: true,
+    },
+    [ComplianceCode.HIPAA_164_312_C_1_PREVENT_CHANGES]: {
+        id: 175,
+        code: ComplianceCode.HIPAA_164_312_C_1_PREVENT_CHANGES,
+        title: 'S.Rule - Part 164, Subpart C, 164.312(c)(1) Prevent Changes or Deletion',
+        description: 'Make sure no one can change or delete health info without permission.',
+        complianceStandard: ComplianceCategory.HIPAA,
+        relatedVulnerabilityIds: [],
+        isNotApplicable: true,
+    },
+    [ComplianceCode.HIPAA_164_312_D_VERIFY_IDENTITY]: {
+        id: 176,
+        code: ComplianceCode.HIPAA_164_312_D_VERIFY_IDENTITY,
+        title: 'S.Rule - Part 164, Subpart C, 164.312(d) Double-Check Who’s Asking for Access',
+        description: 'Confirm that anyone asking to see health info is who they say they are.',
+        complianceStandard: ComplianceCategory.HIPAA,
+        relatedVulnerabilityIds: authAndCookieIds,
+        isNotApplicable: true,
+    },
+    [ComplianceCode.HIPAA_164_312_E_1_PROTECT_ONLINE_INFO]: {
+        id: 177,
+        code: ComplianceCode.HIPAA_164_312_E_1_PROTECT_ONLINE_INFO,
+        title: 'S.Rule - Part 164, Subpart C, 164.312(e)(1) Protect Info Sent Online',
+        description: 'Make sure health info is safe when sent over the internet.',
+        complianceStandard: ComplianceCategory.HIPAA,
+        relatedVulnerabilityIds: cryptoIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.HIPAA_164_312_E_2_I_PREVENT_UNAUTHORIZED_CHANGES]: {
+        id: 178,
+        code: ComplianceCode.HIPAA_164_312_E_2_I_PREVENT_UNAUTHORIZED_CHANGES,
+        title: 'S.Rule - Part 164, Subpart C, 164.312(e)(2)(i) Prevent Unauthorized Changes',
+        description: 'Ensure health info sent electronically isn’t changed without anyone knowing.',
+        complianceStandard: ComplianceCategory.HIPAA,
+        relatedVulnerabilityIds: integrityIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.HIPAA_164_312_E_2_II_USE_ENCRYPTION]: {
+        id: 179,
+        code: ComplianceCode.HIPAA_164_312_E_2_II_USE_ENCRYPTION,
+        title: 'S.Rule - Part 164, Subpart C, 164.312(e)(2)(ii) Use Encryption to Keep Info Safe',
+        description: 'Encrypt health info when it’s sent online to keep it private.',
+        complianceStandard: ComplianceCategory.HIPAA,
+        relatedVulnerabilityIds: cryptoIds,
+        isNotApplicable: true,
+    },
+    [ComplianceCode.HIPAA_164_530_C_2_I_KEEP_INFO_SHARED]: {
+        id: 180,
+        code: ComplianceCode.HIPAA_164_530_C_2_I_KEEP_INFO_SHARED,
+        title: 'P.Rule - Part 164, Subpart E, 164.530(c)(2)(i) Keep Info From Being Shared',
+        description: 'Take care to stop health info from being shared accidentally or on purpose with the wrong people.',
+        complianceStandard: ComplianceCategory.HIPAA,
+        relatedVulnerabilityIds: mergeIds(disclosureIds, accessControlIds),
+        isNotApplicable: true,
+    },
+};

package/dist/compliances/index.d.ts

@@ -0,0 +1,5 @@
+export { OWASP_COMPLIANCE } from './owasp.js';
+export { HIPAA_COMPLIANCE } from './hipaa.js';
+export { GDPR_COMPLIANCE } from './gdpr.js';
+export { PCI_DSS_COMPLIANCE } from './pci-dss.js';
+export { SANS_TOP_25_COMPLIANCE } from './sans-top-25.js';

package/dist/compliances/index.js

@@ -0,0 +1,5 @@
+export { OWASP_COMPLIANCE } from './owasp.js';
+export { HIPAA_COMPLIANCE } from './hipaa.js';
+export { GDPR_COMPLIANCE } from './gdpr.js';
+export { PCI_DSS_COMPLIANCE } from './pci-dss.js';
+export { SANS_TOP_25_COMPLIANCE } from './sans-top-25.js';

package/dist/compliances/owasp.d.ts

@@ -0,0 +1,2 @@
+import { ComplianceRegistry } from '../types';
+export declare const OWASP_COMPLIANCE: ComplianceRegistry;

package/dist/compliances/owasp.js

@@ -0,0 +1,127 @@
+import { ComplianceCode } from '../compliance-codes';
+import { ComplianceCategory } from '../types';
+import { idsByCategory, idsByCodes, idsByCodePrefix, mergeIds } from './helpers.js';
+const authIds = idsByCategory('authentication');
+const injectionIds = idsByCategory('injection');
+const xssIds = idsByCategory('xss');
+const ssrfIds = idsByCategory('ssrf');
+const configIds = idsByCategory('configuration');
+const disclosureIds = idsByCategory('information_disclosure');
+const accessControlIds = idsByCodePrefix(['BAC_', 'MASSASSIGN_']);
+const dirbrowseIds = idsByCodePrefix(['DIRBROWSE_']);
+const jwtIds = idsByCodePrefix(['JWT_']);
+const cookieIds = idsByCodePrefix(['COOKIE_']);
+const deserializationIds = idsByCodePrefix(['DESER_']);
+const hstsIds = idsByCodes([
+    'HEADER_MISSING_HSTS',
+    'HEADER_HSTS_BAD_MAX_AGE',
+    'HEADER_HSTS_SHORT_MAX_AGE',
+    'HEADER_HSTS_NO_INCLUDESUBDOMAINS',
+    'HEADER_HSTS_PRELOAD_LOW_MAX_AGE',
+    'HEADER_DRIFT_HSTS',
+]);
+const cookieSecureIds = idsByCodes([
+    'COOKIE_SAMESITE_NONE_WITHOUT_SECURE',
+    'COOKIE_SESSION_MISSING_SECURE',
+    'COOKIE_MISSING_SECURE',
+    'COOKIE_HOST_PREFIX_INVALID',
+    'COOKIE_SECURE_PREFIX_INVALID',
+]);
+const owaspA1Ids = mergeIds(accessControlIds, dirbrowseIds);
+const owaspA2Ids = mergeIds(jwtIds, hstsIds, cookieSecureIds);
+const owaspA3Ids = mergeIds(injectionIds, xssIds);
+const owaspA5Ids = mergeIds(configIds, disclosureIds);
+const owaspA7Ids = mergeIds(authIds, cookieIds);
+const owaspA8Ids = deserializationIds;
+export const OWASP_COMPLIANCE = {
+    [ComplianceCode.OWASP_A1_BROKEN_ACCESS_CONTROL]: {
+        id: 154,
+        code: ComplianceCode.OWASP_A1_BROKEN_ACCESS_CONTROL,
+        title: 'A1 Broken Access Control',
+        description: 'Many web applications fail to properly enforce rules on what authenticated users are allowed to access or do. This creates vulnerabilities where attackers can exploit the flaws to gain unauthorized access. For example, they might be able to log into someone else’s account, view sensitive files they shouldn’t have access to, modify other users\' data, or change their own access rights to gain additional privileges. To prevent these kinds of attacks, web applications must ensure that every user’s actions are carefully restricted based on their role and permission level, ensuring they can only interact with the parts of the system they are authorized to access.',
+        complianceStandard: ComplianceCategory.OWASP,
+        relatedVulnerabilityIds: owaspA1Ids,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.OWASP_A2_CRYPTOGRAPHIC_FAILURES]: {
+        id: 155,
+        code: ComplianceCode.OWASP_A2_CRYPTOGRAPHIC_FAILURES,
+        title: 'A2 Cryptographic Failures',
+        description: 'Many web applications and APIs fail to properly protect sensitive information, like financial details, health records, or personal identification data. When this data isn’t secured correctly, attackers can steal or alter it, leading to crimes like credit card fraud or identity theft. Sensitive data should always be encrypted, whether it’s being stored (encryption at rest) or transferred over the internet (encryption in transit). Extra care must also be taken when this data is exchanged between the user and the browser to prevent it from being compromised.',
+        complianceStandard: ComplianceCategory.OWASP,
+        relatedVulnerabilityIds: owaspA2Ids,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.OWASP_A3_INJECTION_FLAWS]: {
+        id: 156,
+        code: ComplianceCode.OWASP_A3_INJECTION_FLAWS,
+        title: 'A3 Injection Flaws',
+        description: 'Injection flaws happen when untrusted or harmful data is sent to a system as part of a command or query. This can occur with different types of data, like SQL (used for databases), NoSQL, OS (operating system commands), or LDAP (used for directory services). Attackers can exploit these flaws by sending malicious data that tricks the system into executing commands it wasn’t supposed to, or accessing data without permission. This can allow attackers to gain unauthorized control or information from the system.',
+        complianceStandard: ComplianceCategory.OWASP,
+        relatedVulnerabilityIds: owaspA3Ids,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.OWASP_A4_INSECURE_DESIGN]: {
+        id: 157,
+        code: ComplianceCode.OWASP_A4_INSECURE_DESIGN,
+        title: 'A4 Insecure Design',
+        description: 'Insecure design refers to weaknesses in the overall design of a system or software, where essential security controls are missing or not effective. This is different from implementation flaws, which are mistakes made while building the system. A system with insecure design has security gaps from the start, which can’t be fully fixed later, no matter how well the system is built. For example, if the system wasn’t designed with proper security in mind, even a perfect implementation won’t fix it. A key factor in insecure design is not properly assessing the risks the software or system might face, which leads to a failure in designing the necessary security protections.',
+        complianceStandard: ComplianceCategory.OWASP,
+        relatedVulnerabilityIds: [],
+        isNotApplicable: true,
+    },
+    [ComplianceCode.OWASP_A5_SECURITY_MISCONFIGURATION]: {
+        id: 158,
+        code: ComplianceCode.OWASP_A5_SECURITY_MISCONFIGURATION,
+        title: 'A5 Security Misconfiguration',
+        description: 'Security misconfiguration is one of the most common issues found in web applications and systems. It happens when systems are not set up securely or configured properly. This can include things like using insecure default settings, incomplete configurations, or leaving cloud storage open to the public. Other examples include misconfigured security settings like HTTP headers and error messages that reveal sensitive information about the system. To protect against these risks, all components—such as operating systems, frameworks, libraries, and applications—must be securely configured from the beginning. Additionally, they need to be regularly updated and patched to fix any vulnerabilities and ensure they remain secure over time.',
+        complianceStandard: ComplianceCategory.OWASP,
+        relatedVulnerabilityIds: owaspA5Ids,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.OWASP_A6_VULNERABLE_OUTDATED_COMPONENTS]: {
+        id: 159,
+        code: ComplianceCode.OWASP_A6_VULNERABLE_OUTDATED_COMPONENTS,
+        title: 'A6 Vulnerable and Outdated Components',
+        description: 'Many web applications rely on components like libraries, frameworks, or other software modules to run. These components operate with the same permissions as the rest of the application. If any of these components have known security weaknesses, attackers can exploit them to cause serious issues, such as data loss or taking control of the server. Using outdated components with known vulnerabilities can undermine the security of the entire application, making it easier for attackers to launch attacks or cause other damage. To avoid this, it’s important to regularly update and patch these components to keep the application secure.',
+        complianceStandard: ComplianceCategory.OWASP,
+        relatedVulnerabilityIds: [],
+        isNotApplicable: true,
+    },
+    [ComplianceCode.OWASP_A7_IDENTIFICATION_AUTH_FAILURE]: {
+        id: 160,
+        code: ComplianceCode.OWASP_A7_IDENTIFICATION_AUTH_FAILURE,
+        title: 'A7 Identification and Authentication Failure',
+        description: 'Many applications have weaknesses in how they handle user login and session management. These flaws can allow attackers to steal or guess passwords, keys, or session tokens, and use them to impersonate other users. In some cases, attackers might be able to take over someone’s account temporarily or permanently. Properly securing authentication processes and session management is crucial to prevent unauthorized access and protect user identities.',
+        complianceStandard: ComplianceCategory.OWASP,
+        relatedVulnerabilityIds: owaspA7Ids,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.OWASP_A8_SOFTWARE_DATA_INTEGRITY_FAILURE]: {
+        id: 161,
+        code: ComplianceCode.OWASP_A8_SOFTWARE_DATA_INTEGRITY_FAILURE,
+        title: 'A8 Software and Data Integrity Failure',
+        description: 'Software and data integrity failures occur when code or systems aren’t protected from changes that could compromise their security. For example, if an application uses plugins, libraries, or modules from untrusted sources or repositories, attackers could introduce malicious code. Insecure continuous integration/continuous deployment (CI/CD) pipelines also pose a risk, as they could allow unauthorized access or introduce harmful code. Many apps also have auto-update features, but if the updates aren’t properly verified, attackers could upload malicious updates that get applied to all users’ installations. Another risk is when data is encoded or serialized in a way that attackers can manipulate, which could lead to vulnerabilities like insecure deserialization.',
+        complianceStandard: ComplianceCategory.OWASP,
+        relatedVulnerabilityIds: owaspA8Ids,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.OWASP_A9_LOGGING_MONITORING_FAILURES]: {
+        id: 162,
+        code: ComplianceCode.OWASP_A9_LOGGING_MONITORING_FAILURES,
+        title: 'A9 Security Logging and Monitoring Failures',
+        description: 'When an application or system doesn’t properly log or monitor activity, it becomes easier for attackers to continue their attacks unnoticed. Without effective monitoring, attackers can maintain access, move through different systems, and tamper with or steal data. Studies of security breaches show that it often takes over 200 days to detect a breach, and many breaches are first discovered by external parties, not by the system’s internal monitoring. Proper logging and real-time monitoring are crucial for detecting and responding to attacks before they cause significant damage.',
+        complianceStandard: ComplianceCategory.OWASP,
+        relatedVulnerabilityIds: [],
+        isNotApplicable: true,
+    },
+    [ComplianceCode.OWASP_A10_SSRF]: {
+        id: 163,
+        code: ComplianceCode.OWASP_A10_SSRF,
+        title: 'A10 Server-Side Request Forgery (SSRF)',
+        description: 'SSRF flaws happen when a web application accepts a user-supplied URL to fetch a remote resource but doesn’t properly validate it. This allows attackers to trick the application into sending a request to an unexpected destination, even if there are security measures like firewalls, VPNs, or network access controls in place. As a result, attackers can target internal systems or services that would normally be protected from external access.',
+        complianceStandard: ComplianceCategory.OWASP,
+        relatedVulnerabilityIds: ssrfIds,
+        isNotApplicable: false,
+    },
+};

package/dist/compliances/pci-dss.d.ts

@@ -0,0 +1,2 @@
+import { ComplianceRegistry } from '../types';
+export declare const PCI_DSS_COMPLIANCE: ComplianceRegistry;

package/dist/compliances/pci-dss.js

@@ -0,0 +1,260 @@
+import { ComplianceCode } from '../compliance-codes';
+import { ComplianceCategory } from '../types';
+import { idsByCategory, idsByCodes, idsByCodePrefix, mergeIds } from './helpers.js';
+const authIds = idsByCategory('authentication');
+const injectionIds = idsByCategory('injection');
+const xssIds = idsByCategory('xss');
+const ssrfIds = idsByCategory('ssrf');
+const configIds = idsByCategory('configuration');
+const disclosureIds = idsByCategory('information_disclosure');
+const cookieIds = idsByCodePrefix(['COOKIE_']);
+const dirbrowseIds = idsByCodePrefix(['DIRBROWSE_']);
+const jwtIds = idsByCodePrefix(['JWT_']);
+const hstsIds = idsByCodes([
+    'HEADER_MISSING_HSTS',
+    'HEADER_HSTS_BAD_MAX_AGE',
+    'HEADER_HSTS_SHORT_MAX_AGE',
+    'HEADER_HSTS_NO_INCLUDESUBDOMAINS',
+    'HEADER_HSTS_PRELOAD_LOW_MAX_AGE',
+    'HEADER_DRIFT_HSTS',
+]);
+const cookieSecureIds = idsByCodes([
+    'COOKIE_SAMESITE_NONE_WITHOUT_SECURE',
+    'COOKIE_SESSION_MISSING_SECURE',
+    'COOKIE_MISSING_SECURE',
+    'COOKIE_HOST_PREFIX_INVALID',
+    'COOKIE_SECURE_PREFIX_INVALID',
+]);
+const allAppSecIds = mergeIds(authIds, injectionIds, xssIds, ssrfIds, configIds, disclosureIds);
+const misconfigIds = mergeIds(configIds, disclosureIds);
+const accessControlIds = mergeIds(authIds, cookieIds, dirbrowseIds, disclosureIds);
+const cryptoIds = mergeIds(jwtIds, hstsIds, cookieSecureIds);
+const injectionAndXssIds = mergeIds(injectionIds, xssIds);
+const authAndCookieIds = mergeIds(authIds, cookieIds);
+export const PCI_DSS_COMPLIANCE = {
+    [ComplianceCode.PCI_REQ_1_INSTALL_FIREWALL]: {
+        id: 74,
+        code: ComplianceCode.PCI_REQ_1_INSTALL_FIREWALL,
+        title: 'Requirement 1 Install and Maintain a Firewall Configuration',
+        description: 'Set up and maintain a firewall to create a secure barrier between cardholder data and any external threats. This protects sensitive information from unauthorized access by controlling the incoming and outgoing network traffic.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: [],
+        isNotApplicable: true,
+    },
+    [ComplianceCode.PCI_REQ_2_1_CHANGE_DEFAULT_PASSWORDS]: {
+        id: 75,
+        code: ComplianceCode.PCI_REQ_2_1_CHANGE_DEFAULT_PASSWORDS,
+        title: 'Requirement 2.1 Change Vendor-Supplied Default Passwords',
+        description: 'Always replace default passwords and remove or disable default accounts provided by vendors before setting up a system. This applies to all types of default passwords, such as those for operating systems, security software, point-of-sale terminals, and other system services, to prevent unauthorized access.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: authAndCookieIds,
+        isNotApplicable: true,
+    },
+    [ComplianceCode.PCI_REQ_2_2_1_ONE_PRIMARY_FUNCTION]: {
+        id: 76,
+        code: ComplianceCode.PCI_REQ_2_2_1_ONE_PRIMARY_FUNCTION,
+        title: 'Requirement 2.2.1 One Primary Function Per Server',
+        description: 'Implement only one primary function per server (e.g., web server, database server, DNS) to avoid coexisting functions with different security levels. If using virtualization, ensure each virtual system component performs a single function.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: [],
+        isNotApplicable: true,
+    },
+    [ComplianceCode.PCI_REQ_2_2_2_ENABLE_NECESSARY_SERVICES]: {
+        id: 77,
+        code: ComplianceCode.PCI_REQ_2_2_2_ENABLE_NECESSARY_SERVICES,
+        title: 'Requirement 2.2.2 Enable Only Necessary Services and Protocols',
+        description: 'Activate only the essential services, protocols, and daemons needed for the system to function. This minimizes potential vulnerabilities by reducing the number of unnecessary services that could be exploited by attackers.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: misconfigIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.PCI_REQ_2_2_3_SECURE_INSECURE_SERVICES]: {
+        id: 78,
+        code: ComplianceCode.PCI_REQ_2_2_3_SECURE_INSECURE_SERVICES,
+        title: 'Requirement 2.2.3 Implement Additional Security Features for Insecure Services',
+        description: 'Apply extra security measures to secure any necessary services, protocols, or daemons identified as insecure. For environments using SSL/early TLS, adhere to the requirements specified in Appendix A2 to mitigate vulnerabilities.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: cryptoIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.PCI_REQ_2_2_4_CONFIGURE_SYSTEM_PARAMETERS]: {
+        id: 79,
+        code: ComplianceCode.PCI_REQ_2_2_4_CONFIGURE_SYSTEM_PARAMETERS,
+        title: 'Requirement 2.2.4 Configure System Security Parameters',
+        description: 'Configure system security parameters to prevent misuse, ensuring systems are protected from unauthorized actions.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: misconfigIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.PCI_REQ_2_2_5_STRENGTHEN_INSECURE_SERVICES]: {
+        id: 80,
+        code: ComplianceCode.PCI_REQ_2_2_5_STRENGTHEN_INSECURE_SERVICES,
+        title: 'Requirement 2.2.5 Strengthen Security for Insecure Services',
+        description: 'For services, protocols, or daemons that are deemed insecure, extra security features should be added to protect them. This is particularly important when using SSL or early TLS; specific guidelines from Appendix A2 must be followed to ensure proper security.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: cryptoIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.PCI_REQ_2_3_ENCRYPT_NON_CONSOLE_ADMIN]: {
+        id: 81,
+        code: ComplianceCode.PCI_REQ_2_3_ENCRYPT_NON_CONSOLE_ADMIN,
+        title: 'Requirement 2.3 Encrypt Non-Console Administrative Access',
+        description: 'Use strong encryption to secure all administrative access, especially when accessing systems remotely. If SSL or early TLS is used, follow the additional requirements in Appendix A2 to ensure secure communication.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: cryptoIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.PCI_REQ_3_1_MINIMIZE_DATA_STORAGE]: {
+        id: 86,
+        code: ComplianceCode.PCI_REQ_3_1_MINIMIZE_DATA_STORAGE,
+        title: 'Requirement 3.1 Minimize Cardholder Data Storage',
+        description: 'Implement policies and procedures to store only the necessary cardholder data and securely dispose of it when no longer needed, to reduce risk and ensure compliance with data retention standards.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: disclosureIds,
+        isNotApplicable: true,
+    },
+    [ComplianceCode.PCI_REQ_4_1_STRONG_CRYPTO_TRANSMISSION]: {
+        id: 95,
+        code: ComplianceCode.PCI_REQ_4_1_STRONG_CRYPTO_TRANSMISSION,
+        title: 'Requirement 4.1 Use Strong Cryptography for Cardholder Data Transmission',
+        description: 'Ensure the use of strong cryptography and secure protocols to protect cardholder data during transmission over open, public networks. Only trusted keys and certificates should be used, and the protocol must support secure configurations with appropriate encryption strength.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: cryptoIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.PCI_REQ_6_1_IDENTIFY_RANK_VULNERABILITIES]: {
+        id: 99,
+        code: ComplianceCode.PCI_REQ_6_1_IDENTIFY_RANK_VULNERABILITIES,
+        title: 'Requirement 6.1 Identify and Rank Security Vulnerabilities',
+        description: 'Establish a process to regularly identify security vulnerabilities in systems and applications, using trusted external sources for vulnerability information. Once identified, assign a risk ranking (e.g., high, medium, or low) to each vulnerability to prioritize remediation efforts based on potential impact. This helps ensure that the most critical security flaws are addressed first.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: allAppSecIds,
+        isNotApplicable: true,
+    },
+    [ComplianceCode.PCI_REQ_6_2_INSTALL_SECURITY_PATCHES]: {
+        id: 100,
+        code: ComplianceCode.PCI_REQ_6_2_INSTALL_SECURITY_PATCHES,
+        title: 'Requirement 6.2 Install Vendor-Supplied Security Patches',
+        description: 'Protect all system components and software from known vulnerabilities by installing security patches provided by the vendor. Ensure that critical security patches are installed within one month of their release to minimize the risk of exploitation from known threats. This helps keep systems secure and up to date with the latest protections.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: allAppSecIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.PCI_REQ_6_3_1_SECURE_SOFTWARE_DEVELOPMENT]: {
+        id: 101,
+        code: ComplianceCode.PCI_REQ_6_3_1_SECURE_SOFTWARE_DEVELOPMENT,
+        title: 'Requirement 6.3.1 Secure Software Development Practices',
+        description: 'Develop and maintain secure software applications by following best practices for security throughout the development lifecycle. This applies to all software, whether created internally or custom-built by third parties, including securing web-based access and protecting against potential vulnerabilities.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: injectionAndXssIds,
+        isNotApplicable: true,
+    },
+    [ComplianceCode.PCI_REQ_6_5_1_PREVENT_INJECTION]: {
+        id: 107,
+        code: ComplianceCode.PCI_REQ_6_5_1_PREVENT_INJECTION,
+        title: 'Requirement 6.5.1 Prevent Injection Flaws in Applications',
+        description: 'Ensure that applications are protected from injection attacks, such as SQL injection and other types like OS Command, LDAP, and XPath injection, by implementing proper input validation, escaping user inputs, and using parameterized queries to prevent malicious code from being executed.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: injectionAndXssIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.PCI_REQ_6_5_2_PREVENT_BUFFER_OVERFLOW]: {
+        id: 108,
+        code: ComplianceCode.PCI_REQ_6_5_2_PREVENT_BUFFER_OVERFLOW,
+        title: 'Requirement 6.5.2 Protect Against Buffer Overflow Vulnerabilities',
+        description: 'Safeguard applications from buffer overflow attacks by ensuring proper bounds checking and input validation, preventing attackers from writing data outside allocated memory spaces and exploiting vulnerabilities in software.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: [],
+        isNotApplicable: true,
+    },
+    [ComplianceCode.PCI_REQ_6_5_3_SECURE_CRYPTOGRAPHIC_STORAGE]: {
+        id: 109,
+        code: ComplianceCode.PCI_REQ_6_5_3_SECURE_CRYPTOGRAPHIC_STORAGE,
+        title: 'Requirement 6.5.3 Secure Cryptographic Storage',
+        description: 'Ensure sensitive data is securely stored using strong encryption techniques to protect it from unauthorized access or disclosure, minimizing the risk of data breaches or misuse.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: cryptoIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.PCI_REQ_6_5_4_SECURE_COMM_CHANNELS]: {
+        id: 110,
+        code: ComplianceCode.PCI_REQ_6_5_4_SECURE_COMM_CHANNELS,
+        title: 'Requirement 6.5.4 Secure Communication Channels',
+        description: 'Use strong encryption protocols to protect sensitive data during transmission over networks, ensuring it cannot be intercepted or tampered with during communication.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: cryptoIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.PCI_REQ_6_5_5_PROPER_ERROR_HANDLING]: {
+        id: 111,
+        code: ComplianceCode.PCI_REQ_6_5_5_PROPER_ERROR_HANDLING,
+        title: 'Requirement 6.5.5 Proper Error Handling Practices',
+        description: 'Ensure that error messages do not reveal sensitive information that could be exploited by attackers. Implement secure error handling to log issues without exposing system details or data to unauthorized users.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: injectionAndXssIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.PCI_REQ_6_5_6_ADDRESS_HIGH_RISK_VULNS]: {
+        id: 112,
+        code: ComplianceCode.PCI_REQ_6_5_6_ADDRESS_HIGH_RISK_VULNS,
+        title: 'Requirement 6.5.6 Address High-Risk Vulnerabilities Promptly',
+        description: 'Identify and address all "high risk" vulnerabilities as part of the security vulnerability process to prevent potential breaches and protect sensitive data.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: allAppSecIds,
+        isNotApplicable: true,
+    },
+    [ComplianceCode.PCI_REQ_6_5_7_PREVENT_XSS]: {
+        id: 113,
+        code: ComplianceCode.PCI_REQ_6_5_7_PREVENT_XSS,
+        title: 'Requirement 6.5.7 Prevent Cross-Site Scripting (XSS) Vulnerabilities',
+        description: 'Ensure that web applications are secure against XSS attacks, where attackers inject malicious scripts into web pages. Implement input validation and output encoding to prevent scripts from being executed in a user\'s browser.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: xssIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.PCI_REQ_6_5_8_PREVENT_ACCESS_CONTROL_VULNS]: {
+        id: 114,
+        code: ComplianceCode.PCI_REQ_6_5_8_PREVENT_ACCESS_CONTROL_VULNS,
+        title: 'Requirement 6.5.8 Prevent Improper Access Control Vulnerabilities',
+        description: 'Ensure that web applications properly control access to sensitive resources. Implement strong access control mechanisms to prevent unauthorized users from accessing or modifying data they shouldn t, and avoid vulnerabilities like insecure direct object references, directory traversal, or unrestricted URL access.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: accessControlIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.PCI_REQ_6_5_9_PREVENT_CSRF]: {
+        id: 115,
+        code: ComplianceCode.PCI_REQ_6_5_9_PREVENT_CSRF,
+        title: 'Requirement 6.5.9 Prevent Cross-Site Request Forgery (CSRF)',
+        description: 'Implement security measures to prevent CSRF attacks, where an attacker tricks a user into making unwanted requests to a website on which the user is authenticated. Use anti-CSRF tokens and ensure that user actions are properly validated and protected from being exploited through malicious requests.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: [],
+        isNotApplicable: false,
+    },
+    [ComplianceCode.PCI_REQ_6_5_10_PREVENT_BROKEN_AUTH]: {
+        id: 116,
+        code: ComplianceCode.PCI_REQ_6_5_10_PREVENT_BROKEN_AUTH,
+        title: 'Requirement 6.5.10 Prevent Broken Authentication and Session Management',
+        description: 'Secure user authentication and session management processes to prevent unauthorized access. This includes using strong, multi-factor authentication methods, enforcing session timeouts, and ensuring that session identifiers are securely generated, stored, and invalidated after use.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: authAndCookieIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.PCI_REQ_7_RESTRICT_ACCESS_NEED_TO_KNOW]: {
+        id: 119,
+        code: ComplianceCode.PCI_REQ_7_RESTRICT_ACCESS_NEED_TO_KNOW,
+        title: 'Requirement 7 Restrict Access to System Components and Cardholder Data by Business Need-to-Know',
+        description: 'Access to sensitive system components and cardholder data should be limited only to those individuals whose job responsibilities require it. Permissions should be granted based on business needs, following the principle of least privilege to minimize security risks.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: accessControlIds,
+        isNotApplicable: true,
+    },
+    [ComplianceCode.PCI_REQ_8_1_1_ASSIGN_UNIQUE_IDS]: {
+        id: 126,
+        code: ComplianceCode.PCI_REQ_8_1_1_ASSIGN_UNIQUE_IDS,
+        title: 'Requirement 8.1.1 Assign Unique IDs for All Users',
+        description: 'Ensure every user is assigned a unique identification (ID) before they are granted access to system components or cardholder data. This helps track user activities and ensures accountability.',
+        complianceStandard: ComplianceCategory.PCIDSS,
+        relatedVulnerabilityIds: authAndCookieIds,
+        isNotApplicable: true,
+    },
+};

package/dist/compliances/sans-top-25.d.ts

@@ -0,0 +1,2 @@
+import { ComplianceRegistry } from '../types';
+export declare const SANS_TOP_25_COMPLIANCE: ComplianceRegistry;