cyberaudit-skill 3.0.0

package/skills/cyberaudit/shared/COMPLIANCE.md

@@ -0,0 +1,307 @@
+# ⚖️ COMPLIANCE — CYBERAUDIT SKILL
+# Regulatory compliance guide for auditing
+
+═══════════════════════════════════════════════════════════════
+  USAGE : This file guides the agent to assess regulatory
+  compliance during the audit. Loaded automatically
+  when sensitive data is detected or requested
+  explicitly.
+═══════════════════════════════════════════════════════════════
+
+═══════════════════════════════════════════════════════════════
+               GDPR — GENERAL DATA PROTECTION REGULATION
+═══════════════════════════════════════════════════════════════
+
+APPLICABILITY
+─────────────
+  Applies if :
+  → The application processes data of EU residents
+  → Regardless of the company's hosting country
+  → Personal data = any info identifying a person
+
+  Personal data concerned :
+  → First name, last name, email, phone
+  → IP address (considered personal data)
+  → Location data
+  → Online identifiers (cookies, device ID)
+  → Health data (special category — enhanced protection)
+  → Biometric data (special category)
+  → Financial / banking data
+
+GDPR TECHNICAL REQUIREMENTS
+──────────────────────────
+
+  ARTICLE 25 — Privacy by Design & by Default
+  ┌──────────────────────────────────────────────────────────┐
+  │ CHECK :                                                  │
+  │ □ Minimal collection (only what is necessary)           │
+  │ □ Defined and enforced retention period                 │
+  │ □ Unnecessary data automatically deleted                 │
+  │ □ Pseudonymization of data when possible                │
+  │ □ Encryption of personal data at rest                    │
+  │ □ Encryption in transit (HTTPS)                         │
+  │ □ Access to personal data logged                        │
+  │ □ Restrictive privacy settings by default               │
+  └──────────────────────────────────────────────────────────┘
+
+  ARTICLE 32 — Security of processing
+  ┌──────────────────────────────────────────────────────────┐
+  │ CHECK :                                                  │
+  │ □ Encryption of personal data                           │
+  │ □ Confidentiality, integrity, availability ensured      │
+  │ □ Ability to restore after an incident                   │
+  │ □ Regular testing and evaluation procedure              │
+  │ □ Password hashing (bcrypt/argon2)                      │
+  │ □ Strong authentication for PII data access             │
+  │ □ RBAC limiting access to personal data                 │
+  └──────────────────────────────────────────────────────────┘
+
+  ARTICLE 33 — Breach notification
+  ┌──────────────────────────────────────────────────────────┐
+  │ CHECK :                                                  │
+  │ □ Logging of PII data access and modifications          │
+  │ □ Ability to detect a breach (monitoring)               │
+  │ □ Ability to identify compromised data                  │
+  │ □ Documented notification procedure (72h)               │
+  └──────────────────────────────────────────────────────────┘
+
+  USER RIGHTS — Technical requirements
+  ┌──────────────────────────────────────────────────────────┐
+  │ Right of access (Art. 15)                                │
+  │   □ User data export available                          │
+  │   □ Readable format (JSON, CSV)                         │
+  │                                                          │
+  │ Right to erasure (Art. 17)                               │
+  │   □ Effective deletion (not just deactivation)          │
+  │   □ Cascade deletion (all tables)                       │
+  │   □ Deletion in backups (policy)                        │
+  │                                                          │
+  │ Right to data portability (Art. 20)                     │
+  │   □ Export in an interoperable format                   │
+  │                                                          │
+  │ Right to rectification (Art. 16)                        │
+  │   □ Modification of personal data possible              │
+  └──────────────────────────────────────────────────────────┘
+
+COMMON GDPR FINDINGS TO DETECT
+───────────────────────────────────
+
+  CRITICAL — Personal data in plaintext in database
+    Pattern : Unencrypted columns for : ssn, passport,
+              health_data, payment_method, biometric_data
+    Severity : HIGH (GDPR special categories = CRITICAL)
+    Remediation : AES-256 encryption at application level
+                  or transparent database encryption
+
+  CRITICAL — No retention period
+    Pattern : No cron/job for automatic deletion,
+              data kept indefinitely
+    Severity : MEDIUM
+    Remediation : Implement a retention policy
+                  with automatic deletion
+
+  HIGH — Logs containing personal data
+    Pattern : console.log(user), logger.info({email, name}),
+              requests logged with body containing PII
+    Severity : HIGH
+    Remediation : Mask/pseudonymize in logs
+
+  HIGH — No right to erasure
+    Pattern : No DELETE /user/account route,
+              soft delete only
+    Severity : MEDIUM
+    Remediation : Implement full deletion
+
+  MEDIUM — Cookies without consent
+    Pattern : Analytics/tracking cookies without banner,
+              persistent non-essential cookies
+    Severity : MEDIUM
+    Remediation : Implement a CMP (Consent Management)
+
+═══════════════════════════════════════════════════════════════
+               PCI-DSS — PAYMENT CARD INDUSTRY DATA SECURITY STANDARD
+═══════════════════════════════════════════════════════════════
+
+APPLICABILITY
+─────────────
+  Applies if :
+  → The application processes, stores, or transmits card data
+  → Card numbers, CVV, expiration dates, PIN
+  → EVEN if using Stripe/PayPal (reduced scope
+    but minimum requirements still apply)
+
+GOLDEN RULE OF PCI-DSS FOR DEVELOPERS
+──────────────────────────────────────────
+
+  NEVER STORE :
+  → CVV/CVC (security code) — ABSOLUTELY FORBIDDEN
+  → Card number in plaintext
+  → PIN in plaintext
+  → Full magnetic stripe data
+
+  If using Stripe/PayPal (recommended) :
+  → Never see card data on server side
+  → Use Stripe tokens (tok_xxx, pm_xxx) only
+  → Validated webhook signature
+
+COMMON PCI-DSS FINDINGS
+──────────────────────────
+
+  CRITICAL — Storing the CVV
+    Pattern : cvv column, card_security_code in database
+              Log containing a CVV
+    Severity : CRITICAL — direct PCI-DSS violation
+    Remediation : Immediate deletion, never store
+
+  CRITICAL — Card number in plaintext
+    Pattern : card_number, pan, credit_card column not tokenized
+    Severity : CRITICAL
+    Remediation : Tokenization via Stripe/Braintree,
+                  or encryption + masking (1234 **** **** 5678)
+
+  HIGH — Stripe webhook without signature validation
+    Pattern : app.post('/webhook/stripe', (req, res) => {
+                const event = req.body // No verification !
+    Severity : HIGH
+    Remediation :
+      const event = stripe.webhooks.constructEvent(
+        req.rawBody,
+        req.headers['stripe-signature'],
+        process.env.STRIPE_WEBHOOK_SECRET
+      )
+
+  HIGH — Stripe Live key in plaintext in code
+    Pattern : sk_live_xxxxxxxx in source code
+    Severity : CRITICAL (exposed secret)
+    Remediation : Environment variable immediately,
+                  rotate the compromised key
+
+  MEDIUM — Logs with card numbers (even partial)
+    Pattern : logger.info('Payment for card:', cardNumber)
+    Severity : HIGH
+    Remediation : Never log card data
+
+═══════════════════════════════════════════════════════════════
+               HIPAA — HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT
+═══════════════════════════════════════════════════════════════
+
+APPLICABILITY
+─────────────
+  Applies if :
+  → US application processing PHI (Protected Health Information)
+  → Health data : diagnoses, prescriptions, results,
+    medical records, health insurance data
+
+HIPAA TECHNICAL REQUIREMENTS (SAFEGUARDS)
+─────────────────────────────────────────
+
+  □ Encryption of PHI at rest (AES-256 minimum)
+  □ Encryption of PHI in transit (TLS 1.2+)
+  □ Unique user access control
+  □ Audit logs of all PHI accesses
+  □ Automatic logout after inactivity
+  □ Strong authentication mandatory
+  □ Mobile device encryption
+  □ Documented breach procedure (60 days notification)
+
+COMMON HIPAA FINDINGS
+────────────────────────
+
+  CRITICAL — PHI not encrypted in database
+    Fields : diagnosis, prescription, medical_record,
+             health_condition, lab_results
+    Remediation : AES-256 encryption at application level
+
+  CRITICAL — PHI in logs
+    Pattern : logger.debug('Patient data:', patient)
+    Remediation : Never log PHI
+
+  HIGH — No audit trail for PHI accesses
+    Pattern : No logging of PHI reads/modifications
+    Remediation : Log each access with user_id, timestamp,
+                  action, resource_id
+
+  HIGH — Session without timeout
+    Pattern : No inactive session expiration
+    Remediation : 15 minute inactivity timeout for PHI
+
+═══════════════════════════════════════════════════════════════
+               SOC 2 — SERVICE ORGANIZATION CONTROL 2
+═══════════════════════════════════════════════════════════════
+
+APPLICABILITY
+─────────────
+  Often required by B2B Enterprise customers
+  Especially in SaaS, cloud services
+
+RELEVANT TRUST SERVICE CRITERIA
+───────────────────────────────────
+
+  CC6 — Logical and Physical Access Controls
+  □ MFA on all admin access
+  □ Principle of least privilege
+  □ Quarterly access review
+  □ Immediate revocation upon departure
+
+  CC7 — System Operations
+  □ Anomaly monitoring
+  □ Intrusion detection
+  □ Alerts on security events
+
+  CC8 — Change Management
+  □ Security tests in CI/CD pipeline
+  □ Code review before merge
+  □ Audit trail of changes
+
+  CC9 — Risk Mitigation
+  □ Third-party vendor management
+  □ Dependency audit
+  □ Incident management procedure
+
+═══════════════════════════════════════════════════════════════
+               COMPLIANCE CHECKLIST FOR THE AGENT
+═══════════════════════════════════════════════════════════════
+
+AUTOMATIC COMPLIANCE CONTEXT DETECTION
+─────────────────────────────────────────────
+
+  If the app contains these patterns → enable GDPR :
+  → Columns : email, name, phone, address, ip_address,
+              birth_date, gender, nationality
+  → Routes : /register, /profile, /user
+  → Mentions : gdpr, rgpd, dpo, privacy
+
+  If the app contains these patterns → enable PCI-DSS :
+  → Columns : card_number, cvv, expiry, pan
+  → Imports : stripe, braintree, paypal, square
+  → Routes : /payment, /checkout, /billing
+
+  If the app contains these patterns → enable HIPAA :
+  → Columns : diagnosis, prescription, medical, health,
+              patient, ehr, emr
+  → Imports : hl7, fhir
+  → Context mentioned in the code/README
+
+COMPLIANCE SCORING
+───────────────────
+
+  COMPLIANT     : All applicable requirements met
+  PARTIAL       : >70% of requirements met
+  NON-COMPLIANT : <70% of requirements met
+  CRITICAL      : Direct violation of a mandatory rule
+                  (e.g.: CVV stored = direct PCI-DSS violation)
+
+LEGAL NOTICE
+────────────────────
+
+  This compliance guide is provided for informational purposes
+  to guide the technical audit. It does not constitute
+  legal advice. For official certification,
+  consult a certified auditor (QSA for PCI-DSS,
+  DPO for GDPR, HIPAA Privacy Officer for HIPAA).
+
+  Official references :
+  → GDPR    : https://gdpr.eu/
+  → PCI-DSS : https://www.pcisecuritystandards.org/
+  → HIPAA   : https://www.hhs.gov/hipaa/
+  → SOC 2   : https://www.aicpa.org/

package/skills/cyberaudit/shared/CVSS-GUIDE.md

@@ -0,0 +1,175 @@
+# 📊 COMPLETE CVSS GUIDE — CYBERAUDIT SKILL
+# Common Vulnerability Scoring System v3.1
+
+═══════════════════════════════════════════════════════════════
+               CVSS 3.1 — COMPLETE REFERENCE
+═══════════════════════════════════════════════════════════════
+
+FORMAT OF THE CVSS VECTOR
+───────────────────────
+  CVSS:3.1/AV:[X]/AC:[X]/PR:[X]/UI:[X]/S:[X]/C:[X]/I:[X]/A:[X]
+
+BASE METRICS (BASE SCORE)
+──────────────────────────────
+
+AV — ATTACK VECTOR
+  N (Network)   3.85  Via the Internet or remote network
+  A (Adjacent)  2.62  Same network segment (LAN, Bluetooth, WiFi)
+  L (Local)     1.55  Local access required (shell, session)
+  P (Physical)  0.20  Physical access to the device required
+
+AC — ATTACK COMPLEXITY
+  L (Low)   0.77  Reproducible conditions, no special prerequisites
+  H (High)  0.44  Specific conditions: race condition, rare config
+
+PR — PRIVILEGES REQUIRED
+  N (None)  0.85  Anonymous, no authentication
+  L (Low)   0.62  Normal user (0.68 if scope changed)
+  H (High)  0.27  Administrator (0.50 if scope changed)
+
+UI — USER INTERACTION
+  N (None)     0.85  Exploitation without victim action
+  R (Required) 0.62  The victim must click/take an action
+
+S — SCOPE
+  U (Unchanged)  Impact limited to the vulnerable component
+  C (Changed)    Impact on other components/systems
+
+C — CONFIDENTIALITY IMPACT
+  H (High)  0.56  All data exposed, or critical data
+  L (Low)   0.22  Partial access, non-critical data
+  N (None)  0.00  No impact on confidentiality
+
+I — INTEGRITY IMPACT
+  H (High)  0.56  Total modification possible, corrupted data
+  L (Low)   0.22  Partial modification possible
+  N (None)  0.00  No impact on integrity
+
+A — AVAILABILITY IMPACT
+  H (High)  0.56  Service completely unavailable
+  L (Low)   0.22  Degradation or partial interruption
+  N (None)  0.00  No impact on availability
+
+═══════════════════════════════════════════════════════════════
+               QUICK REFERENCE SCORES
+═══════════════════════════════════════════════════════════════
+
+CRITICAL (9.0 - 10.0)
+  Typical examples :
+  
+  Unauthenticated SQLi on public endpoint
+    AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0
+  
+  RCE via deserialization
+    AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0
+  
+  Full auth bypass
+    AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8
+  
+  JWT algorithm:none
+    AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N = 9.1
+
+HIGH (7.0 - 8.9)
+  Typical examples :
+  
+  IDOR on sensitive data (auth required)
+    AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N = 7.1
+  
+  Stored XSS without CSP
+    AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N = 7.6
+  
+  SSRF to internal infrastructure
+    AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N = 8.6
+  
+  Exposed secrets (active API key)
+    AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5
+  
+  Missing certificate pinning (critical app)
+    AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N = 7.4
+
+MEDIUM (4.0 - 6.9)
+  Typical examples :
+  
+  CSRF on non-critical action
+    AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N = 6.5
+  
+  Reflected XSS with partial CSP
+    AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N = 4.7
+  
+  Clickjacking on sensitive page
+    AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N = 4.3
+  
+  Open redirect
+    AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N = 5.4
+  
+  AsyncStorage with token (mobile)
+    AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 4.6
+
+LOW (0.1 - 3.9)
+  Typical examples :
+  
+  Missing X-Content-Type-Options header
+    AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N = 3.1
+  
+  Information disclosure (framework version)
+    AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3 → Medium
+    
+  Cookie without SameSite (limited context)
+    AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N = 3.1
+
+═══════════════════════════════════════════════════════════════
+               COMMON SCORING MISTAKES
+═══════════════════════════════════════════════════════════════
+
+ERROR 1 — Underestimating the Attack Vector
+  ❌ AV:L (Local) for a web API
+  ✅ AV:N (Network) — accessible via the Internet
+
+ERROR 2 — Ignoring the Scope Changed
+  If a SQLi gives access to the entire server:
+  S:C (Changed) because the impact goes beyond the application
+  This multiplies the score
+
+ERROR 3 — Forgetting the context
+  A "critical" vulnerability in theory can be
+  "high" in practice if:
+  → Auth required (PR:L or PR:H instead of PR:N)
+  → Non-sensitive data (C:L instead of C:H)
+
+ERROR 4 — Not using temporal metrics
+  Base Score = theoretical score
+  Temporal Score = adjusted score based on:
+  → Exploit availability
+  → Confidence level in the vulnerability
+  → Remediation available
+
+═══════════════════════════════════════════════════════════════
+               FINAL SEVERITY DECISION
+═══════════════════════════════════════════════════════════════
+
+SCORING PROCESS FOR THE AGENT:
+
+  STEP 1 : Calculate the CVSS Base Score
+  
+  STEP 2 : Apply contextual factors
+    → Application publicly exposed? → may increase
+    → PII/financial data? → may increase
+    → Mitigations in place (WAF, auth)? → may decrease
+  
+  STEP 3 : Decide the final severity
+    9.0-10.0 → CRITICAL
+    7.0-8.9  → HIGH
+    4.0-6.9  → MEDIUM
+    0.1-3.9  → LOW
+    0.0      → INFO
+  
+  STEP 4 : Always cite the full CVSS vector
+    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    Score : 9.8 (CRITICAL)
+
+REFERENCE CALCULATOR :
+  https://www.first.org/cvss/calculator/3.1
+  
+  # The 4 Missing Files — Complete Content
+
+---

package/skills/cyberaudit/shared/OWASP-MAPPER.md

@@ -0,0 +1,130 @@
+# 🗺️ OWASP MAPPER — CYBERAUDIT SKILL
+# Quick reference OWASP Top 10 Web + MASVS Mobile
+
+═══════════════════════════════════════════════════════════════
+               OWASP TOP 10 WEB 2023
+═══════════════════════════════════════════════════════════════
+
+A01:2021 — BROKEN ACCESS CONTROL (↑ from #5)
+  What it is : Access controls are not enforced
+  Examples     : IDOR, Path traversal, CORS misconfigured,
+                  Privilege escalation, admin routes without auth
+  Detect     : Look for access to resources without
+                  ownership or role verification
+  Reference    : https://owasp.org/Top10/A01_2021-Broken_Access_Control/
+
+A02:2021 — CRYPTOGRAPHIC FAILURES (↑ from #3)
+  What it is : Sensitive data poorly protected in transit or at rest
+  Examples     : Unencrypted HTTP, MD5/SHA1 for passwords,
+                  hardcoded secrets, plaintext data in database
+  Detect     : Look for unencrypted transmissions,
+                  weak algorithms, exposed secrets
+  Reference    : https://owasp.org/Top10/A02_2021-Cryptographic_Failures/
+
+A03:2021 — INJECTION (↓ from #1)
+  What it is : Untrusted data sent to an interpreter
+  Examples     : SQLi, NoSQLi, Command injection, XSS, SSTI
+  Detect     : Look for unvalidated/unparameterized inputs
+                  in queries and templates
+  Reference    : https://owasp.org/Top10/A03_2021-Injection/
+
+A04:2021 — INSECURE DESIGN (NEW)
+  What it is : Design flaws, not implementation
+  Examples     : Missing rate limiting by design,
+                  workflow without validation steps,
+                  blind trust in sources
+  Detect     : Analyze business flows and architecture
+  Reference    : https://owasp.org/Top10/A04_2021-Insecure_Design/
+
+A05:2021 — SECURITY MISCONFIGURATION (↑ from #6)
+  What it is : Default or incomplete configurations
+  Examples     : Debug in prod, missing headers, CORS *, 
+                  default accounts, exposed stack traces
+  Detect     : Analyze all configurations and headers
+  Reference    : https://owasp.org/Top10/A05_2021-Security_Misconfiguration/
+
+A06:2021 — VULNERABLE AND OUTDATED COMPONENTS (↑ from #9)
+  What it is : Components with known vulnerabilities
+  Examples     : CVEs in npm/composer packages,
+                  unpatched frameworks, Log4Shell
+  Detect     : npm audit, composer audit, CVE databases
+  Reference    : https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/
+
+A07:2021 — IDENTIFICATION AND AUTHENTICATION FAILURES (↓ from #2)
+  What it is : Flaws in authentication and session management
+  Examples     : Brute force possible, weak JWT,
+                  session not invalidated, weak passwords allowed
+  Detect     : Analyze the entire authentication flow
+  Reference    : https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/
+
+A08:2021 — SOFTWARE AND DATA INTEGRITY FAILURES (NEW)
+  What it is : Code and infrastructure without integrity verification
+  Examples     : Unverified dependencies, insecure CI/CD,
+                  unsafe deserialization, unsigned auto-update
+  Detect     : Analyze the CI/CD pipeline and dependency management
+  Reference    : https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/
+
+A09:2021 — SECURITY LOGGING AND MONITORING FAILURES (↑ from #10)
+  What it is : Insufficient logging to detect attacks
+  Examples     : Missing auth logs, alerts not configured,
+                  unreadable logs, no SIEM
+  Detect     : Check what is logged and what is not
+  Reference    : https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/
+
+A10:2021 — SERVER-SIDE REQUEST FORGERY (NEW)
+  What it is : The app makes requests to unvalidated URLs
+  Examples     : Fetching user-supplied URLs,
+                  webhooks to internal URLs, resource imports
+  Detect     : Look for places where the app makes HTTP
+                  requests based on user input
+  Reference    : https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_(SSRF)/
+
+═══════════════════════════════════════════════════════════════
+               OWASP MASVS 2.0 — MOBILE
+═══════════════════════════════════════════════════════════════
+
+MASVS-STORAGE — Data Storage
+  L1 : No sensitive data in unsecured storage
+  L2 : No sensitive data in logs
+  L3 : No sensitive data in unencrypted backups
+  L4 : Sensitive data cleared if app backgrounded
+  Reference : https://mas.owasp.org/MASVS/05-MASVS-STORAGE/
+
+MASVS-CRYPTO — Cryptography
+  L1 : Use of modern cryptographic algorithms
+  L2 : Standard implementations (not custom)
+  L3 : Secrets not hardcoded
+  L4 : Cryptographic keys managed securely
+  Reference : https://mas.owasp.org/MASVS/06-MASVS-CRYPTO/
+
+MASVS-AUTH — Authentication & Authorization
+  L1 : Auth verified server-side
+  L2 : Secure session and token management
+  L3 : Biometrics correctly implemented
+  Reference : https://mas.owasp.org/MASVS/07-MASVS-AUTH/
+
+MASVS-NETWORK — Network Communication
+  L1 : HTTPS exclusively
+  L2 : Certificate verification correct
+  L3 : Certificate pinning on critical endpoints
+  Reference : https://mas.owasp.org/MASVS/08-MASVS-NETWORK/
+
+MASVS-PLATFORM — Platform Interactions
+  L1 : Correct use of platform APIs
+  L2 : Secure WebViews
+  L3 : Secure IPC (Intent, URL Schemes, Deep Links)
+  L4 : Minimal permissions
+  Reference : https://mas.owasp.org/MASVS/09-MASVS-PLATFORM/
+
+MASVS-CODE — Code Quality
+  L1 : Dependencies up to date
+  L2 : No debug features in prod
+  L3 : Proper error handling
+  Reference : https://mas.owasp.org/MASVS/10-MASVS-CODE/
+
+MASVS-RESILIENCE — Resilience (highly sensitive apps)
+  L1 : Root/Jailbreak detection
+  L2 : Anti-tampering
+  L3 : Anti-debugging
+  L4 : Obfuscation
+  Reference : https://mas.owasp.org/MASVS/11-MASVS-RESILIENCE/