bmad-plus 0.21.0 → 0.22.0

package/src/bmad-plus/packs/pack-seo/scripts/seo_apis.py

@@ -10,6 +10,9 @@ Connects to:
 Requires: GOOGLE_API_KEY environment variable (free, no OAuth).
 Get one at: https://console.cloud.google.com/apis/credentials
 
+The key travels in the x-goog-api-key header only: never in a request URL, where proxies
+and server logs keep it, and never in a result, a log line or an error message.
+
 Author: Laurent Rochetta
 License: MIT
 """
@@ -17,6 +20,7 @@ License: MIT
 import argparse
 import json
 import os
+import re
 import sys
 from typing import Optional
 
@@ -27,12 +31,56 @@ except ImportError:
     sys.exit(1)
 
 
-API_KEY = os.environ.get("GOOGLE_API_KEY", "")
+API_KEY = os.environ.get("GOOGLE_API_KEY", "").strip()
+KEY_HEADER = "x-goog-api-key"
+# Printable ASCII without spaces: anything else cannot be a header value, and the error
+# requests would raise for it quotes the value.
+KEY_SHAPE = re.compile(r"[\x21-\x7e]+")
 
 PSI_ENDPOINT = "https://www.googleapis.com/pagespeedonline/v5/runPagespeed"
 CRUX_ENDPOINT = "https://chromeuxreport.googleapis.com/v1/records:queryRecord"
 RICH_RESULTS_ENDPOINT = "https://searchconsole.googleapis.com/v1/urlTestingTools/mobileFriendlyTest:run"
 
+SESSION = requests.Session()
+
+
+def _key_problem() -> Optional[str]:
+    """Why no request can be sent, without ever quoting the key; None when it can."""
+    if not API_KEY:
+        return "GOOGLE_API_KEY not set. Get one at https://console.cloud.google.com/apis/credentials"
+    if not KEY_SHAPE.fullmatch(API_KEY):
+        return "GOOGLE_API_KEY is malformed: an API key is printable ASCII without spaces"
+    return None
+
+
+def _redact(text: str) -> str:
+    """Remove the key from text headed for a result, a log or the terminal."""
+    return text.replace(API_KEY, "[GOOGLE_API_KEY]") if API_KEY else text
+
+
+def _failure(api: str, error: Exception) -> dict:
+    return {"error": _redact(f"{api} request failed: {error}")}
+
+
+def _send(method: str, endpoint: str, timeout: int, **body):
+    """
+    Send one request to a Google API with the key in its header.
+
+    Redirects are refused, not followed: requests would carry this header to whatever host
+    a redirect names (it strips only Authorization), and no Google API answers with one.
+    """
+    response = SESSION.request(
+        method,
+        endpoint,
+        headers={KEY_HEADER: API_KEY},
+        timeout=timeout,
+        allow_redirects=False,
+        **body,
+    )
+    if 300 <= response.status_code < 400:
+        raise requests.HTTPError(f"unexpected redirect ({response.status_code}), not followed", response=response)
+    return response
+
 
 # ── PageSpeed Insights ─────────────────────────────────────────────
 
@@ -48,25 +96,25 @@ def run_pagespeed(url: str, strategy: str = "mobile", categories: Optional[list]
     Returns:
         Structured result with scores, audits, and opportunities
     """
-    if not API_KEY:
-        return {"error": "GOOGLE_API_KEY not set. Get one at https://console.cloud.google.com/apis/credentials"}
+    problem = _key_problem()
+    if problem:
+        return {"error": problem}
 
     if categories is None:
         categories = ["PERFORMANCE", "ACCESSIBILITY", "BEST_PRACTICES", "SEO"]
 
     params = {
         "url": url,
-        "key": API_KEY,
         "strategy": strategy,
         "category": categories,
     }
 
     try:
-        response = requests.get(PSI_ENDPOINT, params=params, timeout=120)
+        response = _send("GET", PSI_ENDPOINT, 120, params=params)
         response.raise_for_status()
         data = response.json()
-    except requests.RequestException as e:
-        return {"error": f"PSI API request failed: {e}"}
+    except (requests.RequestException, ValueError) as e:
+        return _failure("PSI API", e)
 
     # Extract scores
     result = {
@@ -161,8 +209,9 @@ def run_crux(url: str, form_factor: str = "PHONE") -> dict:
     Returns:
         Field CWV data at 75th percentile
     """
-    if not API_KEY:
-        return {"error": "GOOGLE_API_KEY not set"}
+    problem = _key_problem()
+    if problem:
+        return {"error": problem}
 
     # Try URL-level first, fall back to origin
     from urllib.parse import urlparse
@@ -175,28 +224,20 @@ def run_crux(url: str, form_factor: str = "PHONE") -> dict:
     }
 
     try:
-        response = requests.post(
-            f"{CRUX_ENDPOINT}?key={API_KEY}",
-            json=payload,
-            timeout=30,
-        )
+        response = _send("POST", CRUX_ENDPOINT, 30, json=payload)
 
         if response.status_code == 404:
             # No URL-level data, try origin
             payload = {"origin": origin, "formFactor": form_factor}
-            response = requests.post(
-                f"{CRUX_ENDPOINT}?key={API_KEY}",
-                json=payload,
-                timeout=30,
-            )
+            response = _send("POST", CRUX_ENDPOINT, 30, json=payload)
 
         if response.status_code == 404:
             return {"error": f"No CrUX data available for {url} (not enough traffic)"}
 
         response.raise_for_status()
         data = response.json()
-    except requests.RequestException as e:
-        return {"error": f"CrUX API request failed: {e}"}
+    except (requests.RequestException, ValueError) as e:
+        return _failure("CrUX API", e)
 
     result = {
         "url": url,
@@ -264,21 +305,18 @@ def run_rich_results_test(url: str) -> dict:
     Returns:
         Mobile-friendly status and detected structured data
     """
-    if not API_KEY:
-        return {"error": "GOOGLE_API_KEY not set"}
+    problem = _key_problem()
+    if problem:
+        return {"error": problem}
 
     payload = {"url": url}
 
     try:
-        response = requests.post(
-            f"{RICH_RESULTS_ENDPOINT}?key={API_KEY}",
-            json=payload,
-            timeout=60,
-        )
+        response = _send("POST", RICH_RESULTS_ENDPOINT, 60, json=payload)
         response.raise_for_status()
         data = response.json()
-    except requests.RequestException as e:
-        return {"error": f"URL Testing API request failed: {e}"}
+    except (requests.RequestException, ValueError) as e:
+        return _failure("URL Testing API", e)
 
     result = {
         "url": url,
@@ -383,6 +421,10 @@ def main():
         print("   Enable: PageSpeed Insights API + Chrome UX Report API", file=sys.stderr)
         print("   Set: export GOOGLE_API_KEY=your_key", file=sys.stderr)
         sys.exit(1)
+    problem = _key_problem()
+    if problem:
+        print(f"⚠️  {problem}", file=sys.stderr)
+        sys.exit(1)
 
     if args.all:
         result = run_all(args.url)

package/src/bmad-plus/packs/pack-seo/scripts/seo_report.py

@@ -3,7 +3,7 @@
 SEO Report — Professional HTML audit report generator.
 
 Features:
-- Single-file HTML with inline CSS (no external deps)
+- Single-file HTML with inline CSS and system fonts: opening it requests nothing
 - SVG radar chart for score visualization
 - Color-coded issue cards (Critical/High/Medium/Low)
 - Quick Wins section
@@ -67,8 +67,8 @@ def generate_radar_svg(scores: dict, size: int = 300) -> str:
         svg_parts.append(f'<line x1="{cx}" y1="{cy}" x2="{x2}" y2="{y2}" stroke="#e2e8f0" stroke-width="1"/>')
 
         lx, ly = point(angle, radius + 20)
-        label = short_labels.get(categories[i], categories[i][:6])
-        svg_parts.append(f'<text x="{lx}" y="{ly}" text-anchor="middle" font-size="11" fill="#64748b" font-family="Inter,sans-serif">{label}</text>')
+        label = html.escape(short_labels.get(categories[i], str(categories[i])[:6]))
+        svg_parts.append(f'<text x="{lx}" y="{ly}" text-anchor="middle" font-size="11" fill="#64748b">{label}</text>')
 
     # Data polygon
     data_points = []
@@ -203,11 +203,10 @@ def generate_html_report(audit_data: dict) -> str:
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>SEO Audit Report — {domain_esc}</title>
     <style>
-        @import url('https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap');
-
+        /* Installed faces only: opening the report asks nothing of any server. */
         * {{ margin: 0; padding: 0; box-sizing: border-box; }}
         body {{
-            font-family: 'Inter', -apple-system, sans-serif;
+            font-family: system-ui, "Segoe UI", Roboto, "Helvetica Neue", "Noto Sans", "Liberation Sans", Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Noto Color Emoji";
             background: #f8fafc;
             color: #1e293b;
             line-height: 1.6;

package/src/bmad-plus/packs/pack-seo/scripts/seo_screenshot.py

@@ -7,16 +7,57 @@ Features:
 - Above-the-fold element detection
 - Full-page capture option
 - PNG output with configurable quality
-
-Requires: playwright (pip install playwright && playwright install chromium)
+- SSRF protection shared with seo_fetch.py: the target is validated once and
+  Chromium is pinned to that address, so the browser reaches the audited host
+  and nothing else
+
+Network policy. Chromium resolves names itself, so validating the URL is not
+enough: a DNS-rebinding answer, a redirect or any subresource could take it
+to an internal address. The browser is therefore confined by three guards:
+
+1. Resolver pinning: --host-resolver-rules maps the audited host to the
+   address seo_fetch validated and makes every other name unresolvable.
+2. Proxy trap: every request except those for the audited host goes to a
+   proxy whose name cannot resolve, so it fails even when it names an IP
+   literal, loopback included (the bypass list drops Chromium's implicit
+   loopback bypass).
+3. Interception: each request and WebSocket the page opens is checked
+   before it leaves; anything outside the audited host is aborted.
+
+Playwright routes only the first URL of a redirect chain, so the hops of a
+redirect (of the page or of a subresource) are held by guards 1 and 2, each
+of which holds on its own. Every request a guard stops, redirect hops
+included, is reported in ``blocked_requests``.
+
+Third-party subresources (CDN images, fonts, analytics, embeds) are blocked,
+not validated one by one: the resolver rules are fixed at launch, so a host
+discovered while rendering could not be pinned, and a capture that contacted
+it would send the auditor's IP address to parties nobody chose. The
+screenshot shows the page as its own host serves it. A redirect to another
+host fails the capture; capture the final URL instead. Service workers are
+blocked and WebRTC may not open UDP sockets of its own.
+
+Requires: playwright >= 1.48 (pip install playwright && playwright install chromium)
 
 Author: Laurent Rochetta
 License: MIT
 """
 
 import argparse
+import ipaddress
+import re
 import sys
+from urllib.parse import urlparse
+
+import seo_fetch
 
+# The proxy that non-audited requests are sent to. ".invalid" never resolves
+# (RFC 6761) and the resolver rules refuse every name but the audited host.
+TRAP_PROXY = "http://blocked.invalid:9"
+LOCAL_SCHEMES = frozenset({"about", "blob", "data"})
+NETWORK_SCHEMES = frozenset({"http", "https", "ws", "wss"})
+_HOSTNAME = re.compile(r"[a-z0-9_-]+(?:\.[a-z0-9_-]+)*\.?")
+_MAX_REPORTED = 50
 
 VIEWPORTS = {
     "mobile": {"width": 375, "height": 812, "device_scale_factor": 3, "is_mobile": True},
@@ -26,6 +67,93 @@ VIEWPORTS = {
 }
 
 
+class CaptureError(RuntimeError):
+    """The page could not be loaded under the network policy."""
+
+
+def pin_target(url: str) -> "tuple[str, str, str]":
+    """Validate a URL with seo_fetch's rules and return ``(url, host, address)``.
+
+    ``host`` is the name as Chromium will send it (lowercase ASCII, IDNA
+    encoded, no brackets) and ``address`` the public address it is pinned to.
+    Raises seo_fetch.UnsafeURLError on anything seo_fetch would refuse, and on
+    a host that cannot be written safely into a resolver rule.
+    """
+    if not urlparse(url).scheme:
+        url = f"https://{url}"
+    hostname, address = seo_fetch.resolve_target(url)
+    try:
+        host = hostname.encode("idna").decode("ascii").lower()
+    except UnicodeError:
+        raise seo_fetch.UnsafeURLError(f"host name cannot be encoded: {hostname}") from None
+    try:
+        ipaddress.ip_address(host)
+    except ValueError:
+        if not _HOSTNAME.fullmatch(host):
+            raise seo_fetch.UnsafeURLError(f"unsupported host name: {hostname}") from None
+    return url, host, address
+
+
+def isolation_options(host: str, address: str) -> dict:
+    """Chromium launch options that confine the browser to ``host`` at ``address``."""
+    pinned = f"[{address}]" if ":" in address else address
+    rule_host = f"[{host}]" if ":" in host else host
+    return {
+        "args": [
+            f"--host-resolver-rules=MAP {rule_host} {pinned}, MAP * ~NOTFOUND",
+            "--force-webrtc-ip-handling-policy=disable_non_proxied_udp",
+            "--webrtc-ip-handling-policy=disable_non_proxied_udp",
+            "--dns-prefetch-disable",
+            # The last matching bypass rule wins: "<-loopback>" first drops
+            # Chromium's implicit loopback bypass without overriding the host.
+            f"--proxy-server={TRAP_PROXY}",
+            f"--proxy-bypass-list=<-loopback>;{rule_host}",
+        ],
+    }
+
+
+class RequestGuard:
+    """Let through the requests of one host; abort and record all others."""
+
+    def __init__(self, host: str):
+        self.host = host
+        self.blocked: "list[str]" = []
+
+    def allows(self, url: str) -> bool:
+        parsed = urlparse(url)
+        if parsed.scheme in LOCAL_SCHEMES:
+            return True
+        return parsed.scheme in NETWORK_SCHEMES and parsed.hostname == self.host
+
+    def _refuse(self, url: str) -> None:
+        if url not in self.blocked and len(self.blocked) < _MAX_REPORTED:
+            self.blocked.append(url)
+
+    def on_request(self, route) -> None:
+        url = route.request.url
+        if self.allows(url):
+            route.continue_()
+        else:
+            self._refuse(url)
+            route.abort("blockedbyclient")
+
+    def on_request_failed(self, request) -> None:
+        # A redirect hop off the host never reaches on_request: the resolver
+        # rules or the trap proxy stop it, and it fails here instead.
+        if not self.allows(request.url):
+            self._refuse(request.url)
+
+    def on_websocket(self, ws) -> None:
+        # A route that is not connected to the server stays a local mock:
+        # nothing leaves the browser. It is not closed, because Playwright
+        # runs this handler on its event loop, where the synchronous close()
+        # would wait for itself forever.
+        if self.allows(ws.url):
+            ws.connect_to_server()
+        else:
+            self._refuse(ws.url)
+
+
 def capture_screenshot(
     url: str,
     output: str = "screenshot.png",
@@ -42,8 +170,15 @@ def capture_screenshot(
         viewport: Viewport preset (mobile, tablet, desktop, desktop-hd)
         full_page: Capture full page scroll or just viewport
         wait_ms: Wait time after page load (ms)
+
+    Raises seo_fetch.UnsafeURLError before any browser starts when the URL
+    breaks seo_fetch's rules, and CaptureError when the page cannot load
+    under the network policy (see the module docstring).
     """
+    url, host, address = pin_target(url)
     try:
+        from playwright.sync_api import Error as PlaywrightError
+        from playwright.sync_api import TimeoutError as PlaywrightTimeoutError
         from playwright.sync_api import sync_playwright
     except ImportError:
         print(
@@ -55,9 +190,15 @@ def capture_screenshot(
 
     vp = VIEWPORTS.get(viewport, VIEWPORTS["desktop"])
 
+    guard = RequestGuard(host)
+
+    # Leaving the block stops the Playwright driver, which ends the browser
+    # on every path, errors included.
     with sync_playwright() as p:
-        browser = p.chromium.launch(headless=True)
+        browser = p.chromium.launch(headless=True, **isolation_options(host, address))
         context = browser.new_context(
+            service_workers="block",
+            accept_downloads=False,
             viewport={"width": vp["width"], "height": vp["height"]},
             device_scale_factor=vp["device_scale_factor"],
             is_mobile=vp["is_mobile"],
@@ -70,13 +211,24 @@ def capture_screenshot(
             ),
         )
 
+        if not hasattr(context, "route_web_socket"):
+            raise CaptureError("Playwright 1.48 or later is required to guard WebSockets")
+        context.route("**/*", guard.on_request)
+        context.route_web_socket("**/*", guard.on_websocket)
+        context.on("requestfailed", guard.on_request_failed)
         page = context.new_page()
 
         try:
-            page.goto(url, wait_until="networkidle", timeout=30000)
-        except Exception:
-            # Fallback: wait for load event instead
-            page.goto(url, wait_until="load", timeout=30000)
+            try:
+                page.goto(url, wait_until="networkidle", timeout=30000)
+            except PlaywrightTimeoutError:
+                # Fallback: wait for load event instead
+                page.goto(url, wait_until="load", timeout=30000)
+        except PlaywrightError as e:
+            raise CaptureError(
+                f"{url} did not load under the network policy (a redirect to another host"
+                f" or a non-public address is refused): {e.message.splitlines()[0]}"
+            ) from None
 
         # Wait for dynamic content
         page.wait_for_timeout(wait_ms)
@@ -148,6 +300,7 @@ def capture_screenshot(
 
         browser.close()
 
+    metrics["blocked_requests"] = guard.blocked
     return metrics
 
 
@@ -172,13 +325,20 @@ def main():
 
     import json
 
-    metrics = capture_screenshot(
-        url=args.url,
-        output=args.output,
-        viewport=args.viewport,
-        full_page=args.full,
-        wait_ms=args.wait,
-    )
+    try:
+        metrics = capture_screenshot(
+            url=args.url,
+            output=args.output,
+            viewport=args.viewport,
+            full_page=args.full,
+            wait_ms=args.wait,
+        )
+    except seo_fetch.UnsafeURLError as e:
+        print(f"Error: Blocked: {e}", file=sys.stderr)
+        sys.exit(1)
+    except CaptureError as e:
+        print(f"Error: {e}", file=sys.stderr)
+        sys.exit(1)
 
     print(f"Screenshot saved: {args.output}", file=sys.stderr)
 
@@ -196,6 +356,8 @@ def main():
         print(f"  Horizontal scroll: {'⚠️ YES' if metrics['has_horizontal_scroll'] else '✅ No'}")
         print(f"  Body font size: {metrics['body_font_size_px']}px {'✅' if metrics['body_font_size_px'] >= 16 else '⚠️ <16px'}")
         print(f"  DOM elements: {metrics['dom_element_count']:,}")
+        if metrics["blocked_requests"]:
+            print(f"  Blocked requests (not the audited host): {len(metrics['blocked_requests'])}")
 
 
 if __name__ == "__main__":

package/src/bmad-plus/packs/pack-shield/README.md

@@ -88,6 +88,18 @@ Pack Shield transforms BMAD+ into a comprehensive GRC (Governance, Risk & Compli
 - `shared/cross-framework-mapper.md` — Control mapping between frameworks
 - `shared/gap-analysis-template.md` — Standardized gap analysis format
 - `shared/audit-report-template.md` — Compliance audit report format
+- `shared/assurance-case.md` + `shared/assurance-case-template.yaml` — Security assurance case bound to executed checks
+- `shared/ai-processing-register.md` + `shared/ai-processing-register-template.yaml` — Register of the AI tools a project uses
+
+## Evidence & AI Tooling
+
+These capabilities are backed by BMAD+ CLI commands, so their results are verified by code:
+
+| Capability | Command | Behaviour |
+|------------|---------|-----------|
+| Security assurance case | `bmad-plus assurance init <case>`, `run <case>`, then `verify <case> --ledger-head <head>` | Claims → arguments → evidence; evidence is only a check that ran, recorded in a hash-chained ledger with its exit code, output digest and the digests of the artifacts it wrote. Missing, failed or stale evidence (other commit, uncommitted changes or untracked files, changed command or artifact, too old) leaves the claim unsupported. `BMAD_PLUS_ASSURANCE_KEY` authenticates every record and `--ledger-head` catches removed runs; without them the ledger shows accidental edits only. `--emit-check` writes a CI check result. |
+| AI processing register | `bmad-plus ai-register init`, `bmad-plus ai-register check` | Compares `_bmad/ai-processing-register.yaml` with the AI integrations found in the project (BMAD+ adapters, tool folders, MCP servers) and warns about any not registered. Soft gate: warnings never fail; `bmad-plus doctor` reports the same. |
+| Compliance review rules | `bmad-plus review scope`, `bmad-plus review rules <path>` | `review-rules/` adds path-scoped checklists (access control, personal data, cryptography, logging, AI integrations, change and supply chain) in the `compliance` group, each tagged with the controls it examines, e.g. `ISO27001:A.8.5`, `SOC2:CC8.1`, `GDPR:Art.32`. The review checklist opens with the controls the change touches, `scope.json` records them per file, and a finding may name the ones it breaks in `controls`. A project replaces or disables them in `_bmad/review-rules.yaml`. |
 
 ## Reference Files
 - `references/` — 79 regulatory reference files extracted from upstream skills

package/src/bmad-plus/packs/pack-shield/SKILL.md

@@ -56,6 +56,11 @@ Shield transforms BMAD+ into a comprehensive GRC (Governance, Risk & Compliance)
 - Privacy Notice/Policy/Cookie Generators
 - AI Act Classifier, Roles, FRIA, Incident Reporting
 
+### Evidence & AI Tooling
+- **Security assurance case** — claims, arguments and evidence, where evidence is only a check that ran at the commit concerned (`bmad-plus assurance run|verify`)
+- **AI processing register** — the AI tools a project uses, their data, legal basis, retention and transfers, with a soft gate on unregistered tools (`bmad-plus ai-register check`, `bmad-plus doctor`)
+- **Compliance review rules** — path-scoped review checklists tagged with ISO 27001, SOC 2, GDPR, NIS2, NIST 800-53 and EU AI Act controls, so a review lists the controls a change touches
+
 ## Activation
 
 To use Shield, include this pack in your BMAD+ installation:
@@ -75,7 +80,8 @@ Then invoke the orchestrator from any conversation:
 - `shield-orchestrator.md` — Intelligent routing entry point
 - `categories/` — Framework-specific agent prompts
 - `references/` — 79 regulatory reference files
-- `shared/` — Cross-framework mapper, gap analysis & audit templates
+- `shared/` — Cross-framework mapper, gap analysis & audit templates; assurance case and AI processing register procedures with their templates
+- `review-rules/` — Control-tagged review rules, loaded by `bmad-plus review` once the pack is installed
 
 ## Attribution
 

package/src/bmad-plus/packs/pack-shield/review-rules/access-control.md

@@ -0,0 +1,10 @@
+Read the change as the person who should not get in.
+
+- **Enforcement point.** Every new route, handler, job or command checks who is calling and what they may do, on the server, before it reads or writes. A check only in the UI, in a client-side guard or in the caller is not enforcement.
+- **Object ownership.** A lookup by an id taken from the request is scoped to the caller (tenant, owner, organisation). Listing, export, search and bulk endpoints apply the same filter as the single-object read.
+- **Least privilege.** A new role, scope, permission or service account grants only what the feature needs; a wildcard, an admin fallback or a default of "allow" when the policy is missing is a defect.
+- **Authentication.** Passwords hashed with a slow, salted algorithm; comparison of secrets in constant time; MFA not bypassable through a secondary path (API token, password reset, legacy login, support impersonation).
+- **Sessions and tokens.** Expiry and revocation exist and are checked; logout and password change invalidate what they should; tokens are bound to their audience and never accepted from a query string where they would be logged.
+- **Access changes.** Granting, changing or removing a right is recorded with who did it; removal takes effect on the next request, not at the next login.
+
+Name the control a finding breaks (for example `ISO27001:A.8.5` for authentication) in the finding's description.

package/src/bmad-plus/packs/pack-shield/review-rules/ai-integrations.md

@@ -0,0 +1,10 @@
+Every model, agent or MCP server the change reaches is a recipient of data and a source of untrusted input.
+
+- **Register.** A new provider, model endpoint, agent tool or MCP server appears in the AI processing register (`_bmad/ai-processing-register.yaml`) with its purpose, the data it sees, legal basis, retention and transfers; `bmad-plus ai-register check` reports the ones missing.
+- **Data sent.** Prompts, context windows, retrieved documents and tool results carry only what the task needs; personal data, secrets and customer content are filtered or pseudonymised before they leave. A new field added to a prompt template is a new disclosure.
+- **Transfers.** A provider outside the EEA, or a region setting that changed, needs a transfer mechanism; a processor needs an agreement covering training use and retention of prompts.
+- **Untrusted output.** Model output and retrieved text reach no query, shell command, file path, HTML or permission decision without the same validation as user input; instructions found in data are data (prompt injection).
+- **Agent tooling.** Tools, MCP servers and agent adapters get the narrowest permissions and paths; a new tool that can write, send or spend has an explicit confirmation or an allow-list.
+- **Transparency.** A person who interacts with the system, or receives generated content presented as fact, is told it comes from an AI where the law requires it.
+
+Name the control a finding breaks (for example `GDPR:Art.28` for a processor without an agreement) in the finding's description.

package/src/bmad-plus/packs/pack-shield/review-rules/change-and-supply-chain.md

@@ -0,0 +1,10 @@
+Look at what reaches production and who could change it.
+
+- **Change path.** A pipeline change keeps review and approval before deployment: no new branch that deploys unreviewed, no `continue-on-error` or skipped job on a required check, no manual override without a record.
+- **Separation.** The identity that writes code cannot approve and deploy it alone; a workflow that widens `permissions`, adds `pull_request_target` with a checkout of untrusted code, or exposes deployment secrets to forks breaks that.
+- **Dependencies.** A new dependency comes from the expected publisher, is pinned by lockfile or hash, and is needed; actions and images are pinned to a digest or a full commit, not a moving tag. Install scripts of new packages are read.
+- **Build provenance.** Artifacts are built by the pipeline from the reviewed commit; a step that downloads and runs a script from a URL, or publishes from a developer machine, removes the link between review and release.
+- **Configuration baseline.** Hardening settings in images and manifests (non-root user, read-only filesystem, dropped capabilities, resource limits) are not weakened; a changed base image is a new supplier.
+- **Vulnerabilities.** A dependency with a known exploitable vulnerability, or a scanner disabled for convenience, is reported with its advisory id.
+
+Name the control a finding breaks (for example `ISO27001:A.8.32` for change management) in the finding's description.

package/src/bmad-plus/packs/pack-shield/review-rules/cryptography.md

@@ -0,0 +1,10 @@
+Check that the protection claimed is the protection delivered.
+
+- **Primitives.** Vetted library calls only; no home-made encryption, padding or random numbers. Reject MD5, SHA-1 or an unsalted fast hash for anything security-relevant, ECB mode, static or reused IVs and nonces, and `Math.random`-class generators for tokens or keys.
+- **Keys.** Keys and secrets come from a secret store or the environment, never from source, fixtures or container images. Each key has one purpose, a rotation path, and an owner; a key used both to sign and to encrypt is a defect.
+- **In transit.** TLS verification stays on (no `verify=False`, `rejectUnauthorized: false`, `InsecureSkipVerify`); internal calls that carry personal data or credentials are encrypted too.
+- **At rest.** Data the change stores that needs confidentiality is encrypted at the field or volume level the design promised; exports and backups receive the same protection as the primary store.
+- **Tokens and signatures.** Signed tokens pin the algorithm (no `none`, no algorithm taken from the token header), verify issuer, audience and expiry, and compare in constant time.
+- **Failure.** A decryption or verification failure is an error, never a fallback to the plaintext or unsigned path.
+
+Name the control a finding breaks (for example `ISO27001:A.8.24` for the use of cryptography) in the finding's description.