devflow-kit 1.8.2 → 2.0.0

package/src/assets/skills/rust/references/patterns.md

@@ -0,0 +1,247 @@
+# Rust Extended Patterns
+
+Extended correct patterns for Rust with literature citations. Reference from main SKILL.md.
+
+## Typestate Pattern [4][27]
+
+Encode valid state transitions in the type system so invalid sequences don't compile.
+Zero-sized phantom types add no runtime cost [4][15].
+
+```rust
+// States are zero-sized types — no runtime cost [18]
+struct Draft;
+struct Published;
+struct Archived;
+
+struct Article<State> {
+    title: String,
+    body: String,
+    _state: std::marker::PhantomData<State>,
+}
+
+impl Article<Draft> {
+    pub fn new(title: String, body: String) -> Self {
+        Article { title, body, _state: std::marker::PhantomData }
+    }
+
+    pub fn publish(self) -> Article<Published> {
+        Article { title: self.title, body: self.body, _state: std::marker::PhantomData }
+    }
+}
+
+impl Article<Published> {
+    pub fn archive(self) -> Article<Archived> {
+        Article { title: self.title, body: self.body, _state: std::marker::PhantomData }
+    }
+}
+
+// article.archive() on Draft won't compile — transition enforced at compile time [15][27]
+```
+
+---
+
+## Error Handling Hierarchy [8][9][16]
+
+Layer errors from specific (library) to general (application). `thiserror` for precise
+typed errors; `anyhow` for ergonomic propagation in binaries [8][16].
+
+```rust
+// Library: precise, typed errors — callers can match on variants [8][9]
+#[derive(thiserror::Error, Debug)]
+pub enum RepoError {
+    #[error("entity {entity} with id {id} not found")]
+    NotFound { entity: &'static str, id: String },
+    #[error("duplicate key: {0}")]
+    Duplicate(String),
+    #[error("connection failed")]
+    Connection(#[from] sqlx::Error),
+}
+
+// Application: ergonomic error propagation with context [9]
+use anyhow::{Context, Result};
+
+fn run() -> Result<()> {
+    let config = load_config()
+        .context("failed to load configuration")?;
+    let db = connect_db(&config.database_url)
+        .context("failed to connect to database")?;
+    serve(db, config.port)
+        .context("server exited with error")
+}
+```
+
+---
+
+## Trait Objects vs Generics [1, Ch.17][20]
+
+### Use Generics for Performance (Monomorphization) [18][20]
+
+```rust
+// Compiler generates specialized code per type — zero-cost [18]
+fn largest<T: PartialOrd>(list: &[T]) -> Option<&T> {
+    list.iter().reduce(|a, b| if a >= b { a } else { b })
+}
+```
+
+### Use Trait Objects for Heterogeneous Collections [1, Ch.17]
+
+```rust
+trait Handler: Send + Sync {
+    fn handle(&self, request: &Request) -> Response;
+}
+
+struct Router {
+    routes: Vec<Box<dyn Handler>>, // Different concrete types in one Vec [1, Ch.17]
+}
+```
+
+### Decision Guide [5, Item 12]
+
+| Criteria | Generics | Trait Objects |
+|----------|----------|--------------|
+| Known types at compile time | Yes | No |
+| Heterogeneous collection | No | Yes |
+| Performance-critical | Yes | Acceptable overhead |
+| Binary size concern | Increases | Minimal |
+
+---
+
+## Smart Pointers [1, Ch.15]
+
+### Box — Heap Allocation [1, Ch.15]
+
+```rust
+// Recursive types require indirection — Box provides single ownership [1, Ch.15]
+enum List<T> {
+    Cons(T, Box<List<T>>),
+    Nil,
+}
+```
+
+### Rc/Arc — Shared Ownership [1, Ch.15]
+
+```rust
+use std::sync::Arc;
+
+// Shared read-only config across threads — Arc enables this safely [29]
+let config = Arc::new(load_config()?);
+let config_clone = Arc::clone(&config);
+tokio::spawn(async move {
+    use_config(&config_clone).await;
+});
+```
+
+### When to Use Each [5, Item 8]
+
+| Pointer | Use Case |
+|---------|----------|
+| `Box<T>` | Single owner, heap allocation, recursive types |
+| `Rc<T>` | Multiple owners, single-threaded |
+| `Arc<T>` | Multiple owners, multi-threaded [29] |
+| `Cow<'a, T>` | Clone-on-write, flexible borrowing [2, C-BORROW] |
+
+---
+
+## From/Into Conversions [2][5, Item 5]
+
+Implement `From` to get `Into` for free. Prefer `From` over `Into` in implementations
+(the orphan rule makes `From` more usable) [2].
+
+```rust
+// Implement From for automatic Into [2]
+impl From<CreateUserRequest> for User {
+    fn from(req: CreateUserRequest) -> Self {
+        User {
+            id: Uuid::new_v4(),
+            name: req.name,
+            email: req.email,
+            created_at: Utc::now(),
+        }
+    }
+}
+
+// Callers get Into for free — accept impl Into<User> for flexibility [2, C-BORROW]
+fn save_user(user: impl Into<User>) -> Result<(), DbError> {
+    let user: User = user.into();
+    Ok(())
+}
+```
+
+---
+
+## Derive and Trait Best Practices [2][12]
+
+```rust
+// Derive the standard set for data types [2]
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct UserId(String);
+
+// Derive serde for serialization boundaries — serde is the ecosystem standard [12]
+#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
+pub struct ApiResponse<T> {
+    pub data: T,
+    pub metadata: Metadata,
+}
+```
+
+### Trait Implementation Order Convention [2]
+
+1. Standard library traits (`Debug`, `Display`, `Clone`, `PartialEq`)
+2. Conversion traits (`From`, `Into`, `TryFrom`)
+3. Iterator traits (`Iterator`, `IntoIterator`)
+4. Serde traits (`Serialize`, `Deserialize`) [12]
+5. Custom traits (domain-specific)
+
+---
+
+## Async Patterns [13]
+
+### spawn_blocking for CPU Work [13]
+
+```rust
+// Offload CPU-bound work to dedicated thread pool — never block the async runtime [13]
+async fn process_file(path: &str) -> Result<Report, AppError> {
+    let path = path.to_string();
+    let report = tokio::task::spawn_blocking(move || {
+        parse_large_file(&path) // CPU-bound, safe to block thread
+    }).await??;
+    Ok(report)
+}
+```
+
+### Channel Patterns [1, Ch.16][13]
+
+```rust
+use tokio::sync::mpsc;
+
+// Prefer channels over shared state for communication [1, Ch.16]
+let (tx, mut rx) = mpsc::channel::<Work>(100);
+
+tokio::spawn(async move {
+    while let Some(work) = rx.recv().await {
+        process(work).await;
+    }
+});
+```
+
+---
+
+## Module Organization [2][10, Ch.3]
+
+```
+src/
+├── lib.rs          # Public API re-exports only [2]
+├── error.rs        # Crate-level error types [8]
+├── domain/
+│   ├── mod.rs      # Domain re-exports
+│   ├── user.rs     # User entity and logic
+│   └── order.rs    # Order entity and logic
+├── repo/
+│   ├── mod.rs      # Repository trait definitions
+│   └── postgres.rs # Concrete implementation
+└── api/
+    ├── mod.rs      # Route registration
+    └── handlers.rs # HTTP handlers
+```
+
+Keep `lib.rs` thin — re-export only the public API. Internal modules use `pub(crate)` [2].

package/src/assets/skills/rust/references/sources.md

@@ -0,0 +1,46 @@
+# Rust — Sources
+
+## Primary References
+
+| # | Source | Author(s) | Year | Access | Topics |
+|---|--------|-----------|------|--------|--------|
+| 1 | "The Rust Programming Language" (The Book) | Klabnik & Nichols | 2023 | [Free](https://doc.rust-lang.org/book/) | Ownership, borrowing, lifetimes, traits, error handling, concurrency |
+| 2 | Rust API Guidelines | Rust Team | 2024 | [Free](https://rust-lang.github.io/api-guidelines/) | C-NEWTYPE, C-BUILDER, C-BORROW, C-VALIDATE, naming, docs |
+| 3 | The Rustonomicon | Rust Team | 2024 | [Free](https://doc.rust-lang.org/nomicon/) | Unsafe Rust, memory layout, FFI, aliasing rules |
+| 4 | "Rust Design Patterns" | Rust Community | 2024 | [Free](https://rust-unofficial.github.io/patterns/) | Builder, newtype, RAII, typestate, strategy patterns |
+| 5 | "Effective Rust" | David Drysdale | 2024 | [Free](https://effective-rust.com) | 35 items for idiomatic Rust, API design, error handling |
+| 6 | "RustBelt: Securing the Foundations of the Rust Programming Language" | Jung et al. | 2018 | [Free](https://plv.mpi-sws.org/rustbelt/) | Formal verification of Rust type system and ownership semantics |
+| 7 | Clippy Lint Documentation | Rust Team | 2024 | [Free](https://rust-lang.github.io/rust-clippy/) | 700+ lints, idiomatic Rust enforcement |
+| 8 | "Error Handling in Rust" | Andrew Gallant (BurntSushi) | 2015 | [Free](https://blog.burntsushi.net/rust-error-handling/) | Error handling philosophy, trait objects vs enums, composition |
+| 9 | thiserror / anyhow documentation | David Tolnay | 2024 | [Free](https://docs.rs/thiserror) | Error type design, library vs application error strategy |
+| 10 | "Rust for Rustaceans" | Jon Gjengset | 2021 | Purchase | Advanced patterns, unsafe, macros, API design |
+| 11 | "Stacked Borrows: An Aliasing Model for Rust" | Ralf Jung | 2019 | [Free](https://plv.mpi-sws.org/stacked-borrows/) | Aliasing model formalization, unsafe code correctness |
+| 12 | serde Documentation | David Tolnay | 2024 | [Free](https://serde.rs) | Serialization framework, derive macros, custom implementations |
+| 13 | tokio Documentation | Tokio Team | 2024 | [Free](https://tokio.rs) | Async runtime, task spawning, channels, spawn_blocking |
+| 14 | Rust Reference | Rust Team | 2024 | [Free](https://doc.rust-lang.org/reference/) | Language specification, type system rules, unsafe operations |
+| 15 | "Making Illegal States Unrepresentable" | Yaron Minsky (adapted for Rust) | 2011 | [Free](https://blog.janestreet.com/effective-ml-video/) | Type-driven design, eliminating invalid states at compile time |
+| 16 | "Choosing an Error Library" (talk) | Jane Lusby (yaahc) | 2020 | [Free](https://www.youtube.com/watch?v=rAF8mLI0naQ) | Error handling ecosystem, thiserror vs anyhow vs error-stack |
+| 17 | Rust Performance Book | Nicholas Nethercote | 2024 | [Free](https://nnethercote.github.io/perf-book/) | Optimization patterns, profiling, heap allocation reduction |
+| 18 | "Zero-cost abstractions" | Rust Blog | 2015 | [Free](https://blog.rust-lang.org/2015/05/11/traits.html) | Core design principle: monomorphization, trait dispatch |
+| 19 | Rust Edition Guide | Rust Team | 2024 | [Free](https://doc.rust-lang.org/edition-guide/) | Edition migration patterns, compatibility guarantees |
+| 20 | "Abstraction without overhead: traits in Rust" | Aaron Turon | 2015 | [Free](https://blog.rust-lang.org/2015/05/11/traits.html) | Trait design philosophy, static vs dynamic dispatch |
+
+## Standards & Style Guides
+
+| # | Source | Org | Access | Topics |
+|---|--------|-----|--------|--------|
+| 21 | Rust API Guidelines — Naming (C-CASE) | Rust Team | [Free](https://rust-lang.github.io/api-guidelines/naming.html) | Casing, affixes, method naming conventions |
+| 22 | Rust API Guidelines — Type Safety (C-NEWTYPE) | Rust Team | [Free](https://rust-lang.github.io/api-guidelines/type-safety.html) | Newtype wrappers, type-safe distinctions |
+| 23 | Rust API Guidelines — Flexibility (C-BORROW) | Rust Team | [Free](https://rust-lang.github.io/api-guidelines/flexibility.html) | Borrow vs own, generic inputs, C-CALLER-CONTROL |
+| 24 | Rust API Guidelines — Builder (C-BUILDER) | Rust Team | [Free](https://rust-lang.github.io/api-guidelines/type-safety.html) | Builder pattern requirements, consuming vs non-consuming |
+| 25 | Rust API Guidelines — Validation (C-VALIDATE) | Rust Team | [Free](https://rust-lang.github.io/api-guidelines/dependability.html) | Constructor validation, error types for invalid input |
+
+## Academic & Research
+
+| # | Source | Author(s) | Year | Access | Topics |
+|---|--------|-----------|------|--------|--------|
+| 26 | "Ownership Types for Safe Programming" | Clarke et al. | 2013 | Free | Ownership type theory: formal foundation for Rust's model |
+| 27 | "Typestate-Oriented Programming" | Aldrich et al. | 2009 | [Free](https://www.cs.cmu.edu/~aldrich/papers/onward2009-state.pdf) | Typestate pattern — encoding protocol states in types |
+| 28 | "A Formalization of Rust's Type System" | Benitez | 2016 | Free | Formal type-theoretic treatment of lifetimes and borrowing |
+| 29 | "Fearless Concurrency with Rust" | Aaron Turon | 2015 | [Free](https://blog.rust-lang.org/2015/04/10/Fearless-Concurrency.html) | Send/Sync traits, data race prevention at compile time |
+| 30 | "Linear Types Can Change the World!" | Wadler | 1990 | Free | Linear type theory — conceptual foundation for Rust's ownership |

package/src/assets/skills/rust/references/violations.md

@@ -0,0 +1,252 @@
+# Rust Violation Examples
+
+Extended violation patterns for Rust reviews with literature citations. Reference from main SKILL.md.
+
+## Unwrap Abuse [8][7]
+
+`.unwrap()` in library or application code panics at runtime and gives callers no way to
+recover. The `?` operator is always available; reach for it first [8].
+
+### Unwrap in Library Code [8]
+
+```rust
+// VIOLATION: Panics on None — caller has no way to handle failure [8]
+pub fn get_username(users: &HashMap<u64, String>, id: u64) -> &str {
+    users.get(&id).unwrap() // Panics if id not found
+}
+
+// VIOLATION: Unwrap on parse without context [7]
+let port: u16 = std::env::var("PORT").unwrap().parse().unwrap();
+```
+
+### Expect Without Useful Message [8]
+
+```rust
+// VIOLATION: Message doesn't help diagnose the problem [8]
+let config = load_config().expect("failed");
+
+// CORRECT: Actionable message with remediation hint [8]
+let config = load_config().expect("failed to load config from config.toml — does file exist?");
+```
+
+---
+
+## Unnecessary Cloning [2, C-BORROW][17]
+
+Cloning to satisfy the borrow checker signals a design issue. Restructure ownership or
+accept slices/borrows. Clones in hot loops cause heap allocation per iteration [17].
+
+### Clone to Satisfy Borrow Checker [2, C-BORROW]
+
+```rust
+// VIOLATION: Cloning entire Vec to work around borrow issues [2, C-BORROW]
+fn process_items(items: &Vec<Item>) {
+    let cloned = items.clone(); // Entire Vec cloned — unnecessary allocation
+    for item in &cloned {
+        println!("{}", item.name);
+    }
+}
+
+// CORRECT: Accept &[Item] and just borrow [2, C-BORROW]
+fn process_items(items: &[Item]) {
+    for item in items {
+        println!("{}", item.name);
+    }
+}
+```
+
+### Clone in Hot Loop [17]
+
+```rust
+// VIOLATION: String allocation on every iteration — performance regression [17]
+for record in &records {
+    let key = record.id.clone();
+    map.insert(key, record);
+}
+
+// CORRECT: Borrow or use references — zero allocation [2, C-BORROW]
+for record in &records {
+    map.insert(&record.id, record);
+}
+```
+
+---
+
+## Stringly-Typed APIs [2, C-NEWTYPE][15]
+
+Using `String` or `&str` where a typed enum or newtype belongs allows typos to compile
+and failures to occur at runtime instead of compile time [15].
+
+### String Where Enum Belongs [2, C-NEWTYPE]
+
+```rust
+// VIOLATION: Any typo compiles and fails at runtime [15]
+fn set_status(status: &str) {
+    match status {
+        "active" => { /* ... */ }
+        "inactive" => { /* ... */ }
+        _ => panic!("unknown status"), // Runtime failure — compiler can't help
+    }
+}
+
+// CORRECT: Compiler enforces valid values — exhaustive match [2, C-NEWTYPE][15]
+enum Status { Active, Inactive }
+
+fn set_status(status: Status) {
+    match status {
+        Status::Active => { /* ... */ }
+        Status::Inactive => { /* ... */ }
+    } // Exhaustive — no default needed
+}
+```
+
+### String IDs Instead of Newtypes [2, C-NEWTYPE]
+
+```rust
+// VIOLATION: OrderId passed where UserId expected — no compile error [15]
+fn charge_user(user_id: &str, order_id: &str) { /* ... */ }
+charge_user(order_id, user_id); // Silent logic bug
+
+// CORRECT: Newtype makes the swap a compile error [2, C-NEWTYPE]
+struct UserId(String);
+struct OrderId(String);
+fn charge_user(user_id: &UserId, order_id: &OrderId) { /* ... */ }
+```
+
+---
+
+## Unsafe Without Justification [3][11]
+
+Every `unsafe` block must have a `// SAFETY:` comment explaining the invariants that
+make the operation sound. The Stacked Borrows model formalizes what "sound" means [11].
+
+### Bare Unsafe Block [3][11]
+
+```rust
+// VIOLATION: No safety comment explaining invariants [3][11]
+unsafe {
+    let ptr = data.as_ptr();
+    std::ptr::copy_nonoverlapping(ptr, dest, len);
+}
+
+// CORRECT: Document why this is safe — sufficient for Stacked Borrows soundness [3][11]
+// SAFETY: `data` is guaranteed to be valid for `len` bytes because
+// it was allocated by `Vec::with_capacity(len)` and filled by `read_exact`.
+// `dest` is a valid pointer from `alloc::alloc(layout)` with matching size.
+// No aliasing exists: `data` and `dest` are disjoint allocations.
+unsafe {
+    std::ptr::copy_nonoverlapping(data.as_ptr(), dest, len);
+}
+```
+
+### Unnecessary Unsafe [7]
+
+```rust
+// VIOLATION: Using unsafe when safe alternative exists [7]
+unsafe fn get_element(slice: &[u8], index: usize) -> u8 {
+    *slice.get_unchecked(index)
+}
+
+// CORRECT: Safe indexing with bounds check [7]
+fn get_element(slice: &[u8], index: usize) -> Option<u8> {
+    slice.get(index).copied()
+}
+```
+
+---
+
+## Ignoring Results [8][7]
+
+Discarding `Result` values silently swallows errors. Clippy lint `must_use` catches this;
+`let _ =` is always a red flag [7][8].
+
+### Discarding Write Errors [8]
+
+```rust
+// VIOLATION: Write failure silently ignored — data loss possible [8]
+let _ = file.write_all(data);
+let _ = file.flush();
+
+// CORRECT: Propagate errors with ? [1, Ch.9]
+file.write_all(data)?;
+file.flush()?;
+```
+
+### Ignoring Lock Poisoning [1, Ch.16]
+
+```rust
+// VIOLATION: Silently ignoring poisoned mutex — undefined program state [1, Ch.16]
+let guard = mutex.lock().unwrap_or_else(|e| e.into_inner());
+
+// CORRECT: Handle or propagate the poison explicitly [1, Ch.16]
+let guard = mutex.lock().map_err(|_| AppError::LockPoisoned)?;
+```
+
+---
+
+## Concurrency Violations [1, Ch.16][29]
+
+Rust's `Send` and `Sync` traits prevent data races at compile time. Violations require
+`unsafe` to bypass these guarantees [6][29].
+
+### Shared Mutable State Without Synchronization [1, Ch.16]
+
+```rust
+// VIOLATION: Data race — undefined behavior under concurrency [1, Ch.16]
+static mut COUNTER: u64 = 0;
+
+fn increment() {
+    unsafe { COUNTER += 1; } // UB — compiler/CPU may reorder or tear [6]
+}
+
+// CORRECT: Use atomics for simple counters [29]
+use std::sync::atomic::{AtomicU64, Ordering};
+static COUNTER: AtomicU64 = AtomicU64::new(0);
+
+fn increment() {
+    COUNTER.fetch_add(1, Ordering::Relaxed);
+}
+```
+
+### Blocking in Async Context [13]
+
+```rust
+// VIOLATION: Blocks the async runtime thread — starves other tasks [13]
+async fn read_file(path: &str) -> Result<String, io::Error> {
+    std::fs::read_to_string(path) // Blocking syscall in async fn
+}
+
+// CORRECT: Use async I/O or spawn_blocking for CPU/blocking work [13]
+async fn read_file(path: &str) -> Result<String, io::Error> {
+    tokio::fs::read_to_string(path).await
+}
+```
+
+---
+
+## API Design Violations [2][5]
+
+### Accepting Owned String When Borrow Suffices [2, C-BORROW]
+
+```rust
+// VIOLATION: Forces allocation at every call site [2, C-BORROW]
+fn print_greeting(name: String) {
+    println!("Hello, {}", name);
+}
+
+// CORRECT: Accept &str — callers keep ownership; String derefs to &str [2, C-BORROW]
+fn print_greeting(name: &str) {
+    println!("Hello, {}", name);
+}
+```
+
+### Missing #[must_use] on Result [7][2]
+
+```rust
+// VIOLATION: Result silently discarded — caller gets no warning [7]
+pub fn flush_buffer(&mut self) -> Result<(), IoError> { /* ... */ }
+
+// CORRECT: #[must_use] forces callers to handle or explicitly discard [7]
+#[must_use]
+pub fn flush_buffer(&mut self) -> Result<(), IoError> { /* ... */ }
+```

package/src/assets/skills/security/SKILL.md

@@ -0,0 +1,121 @@
+---
+name: security
+description: This skill should be used when reviewing code for injection flaws, auth bypasses, or hardcoded secrets.
+user-invocable: false
+allowed-tools: Read, Grep, Glob
+---
+
+# Security Patterns
+
+Domain expertise for security vulnerability detection. Use alongside `devflow:review-methodology` for complete security reviews.
+
+## Iron Law
+
+> **ASSUME ALL INPUT IS MALICIOUS**
+>
+> Every user input, URL parameter, header, and cookie is an attack vector. Use parameterized
+> queries always. Escape output always. Validate schemas always. "This field is internal"
+> is not a defense. Defense in depth, not wishful thinking. [1][6]
+
+## Vulnerability Categories
+
+### 1. Input Validation & Injection [1][6]
+
+**SQL Injection** — parameterize, never interpolate:
+```typescript
+// VULNERABLE: const query = `SELECT * FROM users WHERE email = '${email}'`;
+await db.execute("SELECT * FROM users WHERE email = ?", [email]);
+```
+
+**XSS** — text content, never innerHTML:
+```typescript
+element.textContent = userInput;  // not: element.innerHTML = userInput
+```
+
+> `references/patterns.md` — NoSQL, command injection, path traversal, LDAP injection.
+
+### 2. Authentication & Authorization [1][2][7]
+
+```typescript
+// VULNERABLE: no auth middleware
+app.delete('/api/users/:id', async (req, res) => { await deleteUser(req.params.id); });
+
+// SECURE: layered auth
+app.delete('/api/users/:id', requireAuth, requireRole('admin'), handler);
+```
+
+NIST 800-63 minimum: 15-char passphrase or 12-char complex, phishing-resistant MFA [7].
+JWT: pin algorithm explicitly, set `expiresIn`, store refresh tokens server-side [17].
+
+### 3. Cryptography & Secrets [5][24][25]
+
+```typescript
+const API_KEY = process.env.API_KEY;           // not: hardcoded literal
+const token = crypto.randomBytes(32).toString('hex');  // not: Math.random()
+```
+
+Password hashing: Argon2id (preferred) or bcrypt cost ≥12 [24]. Encrypt with AES-256-GCM
+(authenticated). Compare secrets with `crypto.timingSafeEqual`, never `===` [25].
+
+**Reporting a found secret**: cite `file:line` and the type slug — never quote the full value.
+Use `{first ≤4 chars}…[REDACTED:{type}]` (e.g. `AKID…[REDACTED:aws-key]`).
+A found live credential is ALREADY COMPROMISED — the remediation is rotation
+(revoke and regenerate the exposed credential) plus moving to env vars or a secret store,
+not just removal from code.
+
+### 4. Configuration & Headers [10][15][16]
+
+```typescript
+app.use(helmet());
+res.setHeader('Content-Security-Policy', "default-src 'self'");  // [15]
+res.setHeader('Strict-Transport-Security', 'max-age=31536000');  // [10]
+app.use(cors({ origin: ['https://myapp.com'], credentials: true }));
+```
+
+SameSite=Strict cookies prevent CSRF [16]. SRI hashes prevent CDN tampering [18].
+
+### 5. Business Logic & API Security [1][3][11]
+
+Race conditions: wrap check-then-act in database transactions with row locks.
+Mass assignment: explicitly allowlist fields — never `User.create(req.body)` [11].
+OWASP API Top 10 [11]: Broken Object Auth (API1), Excessive Data Exposure (API3), SSRF (API7).
+
+### 6. Supply Chain [12][13]
+
+Pin dependencies to exact versions. Require SRI for CDN assets [18]. Use
+Sigstore/SLSA provenance in CI/CD to verify artifact integrity [12][13].
+
+---
+
+## Extended References
+
+| Reference | Content |
+|-----------|---------|
+| `references/sources.md` | Full bibliography (25 sources) |
+| `references/patterns.md` | Correct patterns with citations |
+| `references/violations.md` | Violation examples with citations |
+| `references/detection.md` | Grep patterns for automated scanning |
+
+## Severity Guidelines
+
+| Level | Criteria | Examples |
+|-------|----------|----------|
+| **CRITICAL** | Immediate exploitation | SQL injection in auth, RCE, hardcoded admin creds |
+| **HIGH** | Significant risk | XSS [1], broken access control, weak crypto, CSRF [16] |
+| **MEDIUM** | Moderate with conditions | Missing headers [10], permissive CORS, missing rate limits [11] |
+| **LOW** | Minor improvement | Outdated deps (no CVE), suboptimal CSP [15] |
+
+## OWASP Top 10 Reference [1]
+
+| ID | Category | Examples |
+|----|----------|----------|
+| A01 | Broken Access Control | Missing auth, IDOR, privilege escalation |
+| A02 | Cryptographic Failures | Weak hashing [24], hardcoded secrets |
+| A03 | Injection | SQL, NoSQL, command, XSS [6] |
+| A04 | Insecure Design | Missing rate limits, mass assignment [11] |
+| A05 | Security Misconfiguration | Debug enabled, missing headers [10][15] |
+| A06 | Vulnerable Components | Outdated deps, supply chain risks [12] |
+| A07 | Auth Failures | Weak passwords [7], session issues, JWT misuse [17] |
+| A08 | Data Integrity Failures | Untrusted deserialization, no SRI [18] |
+| A09 | Logging Failures | Missing security event logs [8] |
+| A10 | SSRF | Unvalidated URLs in server requests [11] |