@zivis/appsec-pack 1.2.0 → 1.3.0

package/dist/manifest.json

@@ -2,10 +2,10 @@
   "schema_version": "1.0.0",
   "pack_id": "appsec",
   "pack_type": "appsec",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "min_cli_version": "0.1.0-alpha.1",
   "description": "ZIVIS AppSec testing methodology — base guidance plus targeted scopes.",
-  "built_at": "2026-08-27T20:23:54.096Z",
+  "built_at": "2026-08-31T00:30:17.528Z",
   "base": {
     "path": "TEST.md",
     "sha256": "48ab72f5b5c830d0ecb93159b45049732a88e375195517a59fccf64aa17f94e9"
@@ -16,110 +16,500 @@
       "label": "Architecture & Attack Surface",
       "description": "Entry-point inventory, trust boundaries, and data flow across the application.",
       "path": "scopes/architecture.md",
-      "sha256": "8981d8f7f3d277ba6319c1e7ec36c349141576abce2574ae79c3b8d3e303eddc"
+      "sha256": "8981d8f7f3d277ba6319c1e7ec36c349141576abce2574ae79c3b8d3e303eddc",
+      "tests": [
+        {
+          "id": "ARCH-001",
+          "title": "Entry-point inventory completeness"
+        },
+        {
+          "id": "ARCH-002",
+          "title": "Trust boundary mapping"
+        },
+        {
+          "id": "ARCH-003",
+          "title": "Untrusted-input data-flow tracing"
+        },
+        {
+          "id": "ARCH-004",
+          "title": "Per-surface authentication posture"
+        },
+        {
+          "id": "ARCH-005",
+          "title": "Third-party integration and secret-exposure inventory"
+        },
+        {
+          "id": "ARCH-006",
+          "title": "Routed surface vs. published spec/doc drift"
+        }
+      ]
     },
     {
       "id": "auth",
       "label": "Authentication",
       "description": "Login, session establishment, credential handling, MFA.",
       "path": "scopes/auth.md",
-      "sha256": "6a59506cd28214842073c70383a481a5267f8a1643d1b564b7708a5179d97874"
+      "sha256": "6a59506cd28214842073c70383a481a5267f8a1643d1b564b7708a5179d97874",
+      "tests": [
+        {
+          "id": "AUTH-001",
+          "title": "Credential storage hashing strength"
+        },
+        {
+          "id": "AUTH-002",
+          "title": "Constant-time credential/token comparison"
+        },
+        {
+          "id": "AUTH-003",
+          "title": "Authentication transport security (no credentials in URL/plaintext)"
+        },
+        {
+          "id": "AUTH-004",
+          "title": "Server-side MFA / step-up enforcement"
+        },
+        {
+          "id": "AUTH-005",
+          "title": "Password reset & account recovery token handling"
+        },
+        {
+          "id": "AUTH-006",
+          "title": "Rate limiting / lockout on auth-sensitive endpoints"
+        },
+        {
+          "id": "AUTH-007",
+          "title": "Username / account enumeration resistance"
+        },
+        {
+          "id": "AUTH-008",
+          "title": "Default or weak credentials in seeds, fixtures, or docs"
+        }
+      ]
     },
     {
       "id": "authorization",
       "label": "Authorization",
       "description": "Access control, object-level permissions, privilege boundaries.",
       "path": "scopes/authorization.md",
-      "sha256": "3cf76877749f666eba67a09e67ad476ef93e570dc2cdd173f640c86b578d3091"
+      "sha256": "3cf76877749f666eba67a09e67ad476ef93e570dc2cdd173f640c86b578d3091",
+      "tests": [
+        {
+          "id": "AUTHZ-001",
+          "title": "Object-level access control (IDOR/BOLA)"
+        },
+        {
+          "id": "AUTHZ-002",
+          "title": "Function-level access control (BFLA)"
+        },
+        {
+          "id": "AUTHZ-003",
+          "title": "Tenant / org isolation"
+        },
+        {
+          "id": "AUTHZ-004",
+          "title": "Property-level authorization / mass-assignment (BOPLA)"
+        },
+        {
+          "id": "AUTHZ-005",
+          "title": "Privilege escalation via parameter tampering or missing state-transition check"
+        },
+        {
+          "id": "AUTHZ-006",
+          "title": "Cross-route authorization consistency for the same object"
+        }
+      ]
     },
     {
       "id": "session",
       "label": "Session Management",
       "description": "Token lifecycle, invalidation, CSRF, and cookie security.",
       "path": "scopes/session.md",
-      "sha256": "0677be2ea9ef9b5a217825c834eb288ff57510bde28d2f3343066c1a17136fba"
+      "sha256": "0677be2ea9ef9b5a217825c834eb288ff57510bde28d2f3343066c1a17136fba",
+      "tests": [
+        {
+          "id": "SESSION-001",
+          "title": "Token issuance & rotation (fixation resistance)"
+        },
+        {
+          "id": "SESSION-002",
+          "title": "Server-side session invalidation on logout"
+        },
+        {
+          "id": "SESSION-003",
+          "title": "Idle and absolute session expiration"
+        },
+        {
+          "id": "SESSION-004",
+          "title": "Session cookie attributes (HttpOnly/Secure/SameSite)"
+        },
+        {
+          "id": "SESSION-005",
+          "title": "CSRF protection on state-changing requests"
+        },
+        {
+          "id": "SESSION-006",
+          "title": "JWT algorithm/signature/expiry handling"
+        },
+        {
+          "id": "SESSION-007",
+          "title": "Concurrent-session and device-revocation behavior"
+        }
+      ]
     },
     {
       "id": "api",
       "label": "API Security",
       "description": "Endpoint-level security for REST/GraphQL/RPC surfaces.",
       "path": "scopes/api.md",
-      "sha256": "a38c796aed3f754d105ed64bc8d84ce1fc0ee9c2b199d0ecdef46e8245cc6ad4"
+      "sha256": "a38c796aed3f754d105ed64bc8d84ce1fc0ee9c2b199d0ecdef46e8245cc6ad4",
+      "tests": [
+        {
+          "id": "API-001",
+          "title": "Shadow / undocumented / debug / version-skew endpoint inventory"
+        },
+        {
+          "id": "API-002",
+          "title": "Cross-endpoint authorization consistency (list vs. detail, v1 vs. v2, REST vs. GraphQL)"
+        },
+        {
+          "id": "API-003",
+          "title": "Mass-assignment / BOPLA on API request binding"
+        },
+        {
+          "id": "API-004",
+          "title": "Unrestricted resource consumption (rate limits, pagination, query complexity)"
+        },
+        {
+          "id": "API-005",
+          "title": "Unsafe consumption of upstream/third-party API responses"
+        },
+        {
+          "id": "API-006",
+          "title": "Routed endpoints vs. published API spec drift"
+        }
+      ]
     },
     {
       "id": "input",
       "label": "Input Validation",
       "description": "Injection, deserialization, and untrusted-input handling.",
       "path": "scopes/input.md",
-      "sha256": "f4c4d04960d49679dd7f8966d9b28d83bb0a2aae49e0634f956a060f91e61127"
+      "sha256": "f4c4d04960d49679dd7f8966d9b28d83bb0a2aae49e0634f956a060f91e61127",
+      "tests": [
+        {
+          "id": "INPUT-001",
+          "title": "SQL / NoSQL injection"
+        },
+        {
+          "id": "INPUT-002",
+          "title": "Command injection"
+        },
+        {
+          "id": "INPUT-003",
+          "title": "Server-side template injection (SSTI)"
+        },
+        {
+          "id": "INPUT-004",
+          "title": "Path traversal"
+        },
+        {
+          "id": "INPUT-005",
+          "title": "Unsafe deserialization / prototype pollution"
+        },
+        {
+          "id": "INPUT-006",
+          "title": "LDAP / XPath / header / log injection"
+        }
+      ]
     },
     {
       "id": "business-logic",
       "label": "Business Logic",
       "description": "Workflow bypass, race conditions, and abuse of legitimate features.",
       "path": "scopes/business-logic.md",
-      "sha256": "c375b1cc36f8ede1f39a21b72271f9c8e40d4390513a87fc023c7402fa353845"
+      "sha256": "c375b1cc36f8ede1f39a21b72271f9c8e40d4390513a87fc023c7402fa353845",
+      "tests": [
+        {
+          "id": "BIZLOGIC-001",
+          "title": "Workflow / state-machine bypass"
+        },
+        {
+          "id": "BIZLOGIC-002",
+          "title": "Race conditions on shared or single-use resources"
+        },
+        {
+          "id": "BIZLOGIC-003",
+          "title": "Server-trusted client value tampering (price/quantity/role)"
+        },
+        {
+          "id": "BIZLOGIC-004",
+          "title": "Legitimate-feature abuse at unintended scale"
+        },
+        {
+          "id": "BIZLOGIC-005",
+          "title": "Negative/overflow quantities, idempotency replay, step-reordering"
+        }
+      ]
     },
     {
       "id": "data",
       "label": "Data Protection",
       "description": "Sensitive-data exposure, encryption at rest/in transit.",
       "path": "scopes/data.md",
-      "sha256": "294e1ad60edfeca61748d91924ab7c7fc747806ab192342e7219464af9752c8f"
+      "sha256": "294e1ad60edfeca61748d91924ab7c7fc747806ab192342e7219464af9752c8f",
+      "tests": [
+        {
+          "id": "DATA-001",
+          "title": "Sensitive data in logs and error responses"
+        },
+        {
+          "id": "DATA-002",
+          "title": "Overbroad API response field exposure"
+        },
+        {
+          "id": "DATA-003",
+          "title": "Encryption at rest for credentials/PII"
+        },
+        {
+          "id": "DATA-004",
+          "title": "Encryption in transit (TLS enforcement)"
+        },
+        {
+          "id": "DATA-005",
+          "title": "Weak or misused cryptographic primitives"
+        },
+        {
+          "id": "DATA-006",
+          "title": "Data retention / exposure in caches, backups, or third-party sinks"
+        }
+      ]
     },
     {
       "id": "secrets",
       "label": "Secrets Management",
       "description": "Credential/token storage, rotation, and leakage risk.",
       "path": "scopes/secrets.md",
-      "sha256": "7dc99c9d847ca351daa2035ee2ffbf5f88385ec81cb877dba37467aab9979c86"
+      "sha256": "7dc99c9d847ca351daa2035ee2ffbf5f88385ec81cb877dba37467aab9979c86",
+      "tests": [
+        {
+          "id": "SECRETS-001",
+          "title": "Hardcoded credentials/tokens in source, config, CI, or image layers"
+        },
+        {
+          "id": "SECRETS-002",
+          "title": "Secrets present in git history"
+        },
+        {
+          "id": "SECRETS-003",
+          "title": "Plaintext secrets in logs, error output, or client-visible responses"
+        },
+        {
+          "id": "SECRETS-004",
+          "title": "Over-broad-scoped or non-expiring tokens"
+        },
+        {
+          "id": "SECRETS-005",
+          "title": "Secrets shipped in the frontend bundle or public assets"
+        },
+        {
+          "id": "SECRETS-006",
+          "title": "Install-time / build-time secret exposure"
+        }
+      ]
     },
     {
       "id": "dependencies",
       "label": "Dependency Risk",
       "description": "Vulnerable or malicious third-party dependencies.",
       "path": "scopes/dependencies.md",
-      "sha256": "cf66b5df2daf6bc1a6d6498128bec0153d29397002e7b306bfd10efc5248f2a0"
+      "sha256": "cf66b5df2daf6bc1a6d6498128bec0153d29397002e7b306bfd10efc5248f2a0",
+      "tests": [
+        {
+          "id": "DEPS-001",
+          "title": "Known-vulnerable dependencies against the resolved lockfile"
+        },
+        {
+          "id": "DEPS-002",
+          "title": "CVE reachability triage"
+        },
+        {
+          "id": "DEPS-003",
+          "title": "Dependency confusion / substitution risk"
+        },
+        {
+          "id": "DEPS-004",
+          "title": "Typosquat / low-reputation package detection"
+        },
+        {
+          "id": "DEPS-005",
+          "title": "Install-time script risk (preinstall/postinstall/setup.py)"
+        },
+        {
+          "id": "DEPS-006",
+          "title": "Unmaintained/abandoned packages in a sensitive code path"
+        }
+      ]
     },
     {
       "id": "ssrf",
       "label": "SSRF",
       "description": "Server-side request forgery via user-influenced outbound requests.",
       "path": "scopes/ssrf.md",
-      "sha256": "38ceb02a760de599cf8ac3245fbd22e428addc02acca1132ceb3dd2dd156d69e"
+      "sha256": "38ceb02a760de599cf8ac3245fbd22e428addc02acca1132ceb3dd2dd156d69e",
+      "tests": [
+        {
+          "id": "SSRF-001",
+          "title": "User-influenced server-side outbound request targets"
+        },
+        {
+          "id": "SSRF-002",
+          "title": "Internal-target reachability (metadata/localhost/private CIDR)"
+        },
+        {
+          "id": "SSRF-003",
+          "title": "Egress filter-bypass surface (redirects, encoding, DNS rebinding)"
+        },
+        {
+          "id": "SSRF-004",
+          "title": "Blind SSRF via out-of-band canary"
+        }
+      ]
     },
     {
       "id": "uploads",
       "label": "File Upload",
       "description": "Upload handling, storage, and downstream processing risk.",
       "path": "scopes/uploads.md",
-      "sha256": "8dd281dadfb357f2b1e2becdbe0c56225b91d615ad474848b649f425e80ddec1"
+      "sha256": "8dd281dadfb357f2b1e2becdbe0c56225b91d615ad474848b649f425e80ddec1",
+      "tests": [
+        {
+          "id": "UPLOAD-001",
+          "title": "Server-side content-based file-type validation"
+        },
+        {
+          "id": "UPLOAD-002",
+          "title": "Upload storage location relative to the web root"
+        },
+        {
+          "id": "UPLOAD-003",
+          "title": "Filename handling (path traversal, overwrite, encoding tricks)"
+        },
+        {
+          "id": "UPLOAD-004",
+          "title": "Downstream parser exposure on uploaded content"
+        },
+        {
+          "id": "UPLOAD-005",
+          "title": "Upload size/quantity limits and decompression amplification"
+        },
+        {
+          "id": "UPLOAD-006",
+          "title": "SVG/HTML upload leading to stored XSS when served inline"
+        }
+      ]
     },
     {
       "id": "frontend",
       "label": "Frontend Security",
       "description": "Client-side/browser security (XSS, CSP, postMessage, etc).",
       "path": "scopes/frontend.md",
-      "sha256": "12ebe94f037059c29249fe7407979e29081e5d6ebc6d152450e28185a17d86fc"
+      "sha256": "12ebe94f037059c29249fe7407979e29081e5d6ebc6d152450e28185a17d86fc",
+      "tests": [
+        {
+          "id": "FRONTEND-001",
+          "title": "Cross-site scripting at DOM/HTML sinks"
+        },
+        {
+          "id": "FRONTEND-002",
+          "title": "Content-Security-Policy strength and coverage"
+        },
+        {
+          "id": "FRONTEND-003",
+          "title": "postMessage origin validation"
+        },
+        {
+          "id": "FRONTEND-004",
+          "title": "Client-side storage of sensitive data"
+        },
+        {
+          "id": "FRONTEND-005",
+          "title": "Secrets/keys in the shipped frontend bundle"
+        },
+        {
+          "id": "FRONTEND-006",
+          "title": "Clickjacking/framing controls and client-driven open redirects"
+        }
+      ]
     },
     {
       "id": "infra",
       "label": "Infrastructure & IaC",
       "description": "IaC misconfiguration, container hygiene, exposed management endpoints.",
       "path": "scopes/infra.md",
-      "sha256": "ef414bd4033c9fd089a9e7b29f57a9eaecb07d32352305d580ffa82bea45b57a"
+      "sha256": "ef414bd4033c9fd089a9e7b29f57a9eaecb07d32352305d580ffa82bea45b57a",
+      "tests": [
+        {
+          "id": "INFRA-001",
+          "title": "IaC misconfiguration (network, IAM, storage, encryption)"
+        },
+        {
+          "id": "INFRA-002",
+          "title": "Container image and runtime hygiene"
+        },
+        {
+          "id": "INFRA-003",
+          "title": "Exposed unauthenticated management/debug/actuator endpoints"
+        },
+        {
+          "id": "INFRA-004",
+          "title": "Kubernetes posture (privileged pods, network policy, RBAC)"
+        },
+        {
+          "id": "INFRA-005",
+          "title": "CI/CD pipeline security (secrets, unpinned actions, deploy credentials)"
+        }
+      ]
     },
     {
       "id": "ai",
       "label": "AI Surface Security",
       "description": "LLM/agent-specific risks — prompt injection, tool misuse.",
       "path": "scopes/ai.md",
-      "sha256": "388f41a43a185a7c522de3256e05f63f98e558dc621789bf0aa6bb960bc1d1fa"
+      "sha256": "388f41a43a185a7c522de3256e05f63f98e558dc621789bf0aa6bb960bc1d1fa",
+      "tests": [
+        {
+          "id": "AI-001",
+          "title": "Direct prompt injection"
+        },
+        {
+          "id": "AI-002",
+          "title": "Indirect / cross-domain prompt injection via retrieved content"
+        },
+        {
+          "id": "AI-003",
+          "title": "System-prompt / tool-schema extraction"
+        },
+        {
+          "id": "AI-004",
+          "title": "Excessive agency (unguarded side-effecting actions)"
+        },
+        {
+          "id": "AI-005",
+          "title": "Insecure output handling"
+        },
+        {
+          "id": "AI-006",
+          "title": "Cross-tenant RAG leakage"
+        },
+        {
+          "id": "AI-007",
+          "title": "Denial-of-wallet via unbounded model spend"
+        }
+      ]
     }
   ],
   "signature": {
     "algorithm": "ed25519",
     "key_id": "zivis-pack-prod-2026-08",
-    "signature": "P4h55DxlAw0jvVzmrH/pFxWWUpkwa6pDqO/uKRcO+UqF3Vm1vTV0UIeZPWRS+0NMoOXksrx1HXsqbZ10ND3qCA=="
+    "signature": "q/n+xQgg+mxYRjggansXubKqTEMCJ9eJIpfb1EkE16FRtyNcWTgvHjG2vYpUyNuE2Ua3VRi7FW1Nc5d+vl2oDQ=="
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zivis/appsec-pack",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "ZIVIS AppSec testing methodology — public self-service pack consumed by `zivis test`. See methodology-packs/appsec/pack.yaml for the authoring source.",
   "license": "Apache-2.0",
   "homepage": "https://zivis.ai",