devflow-kit 1.8.3 → 2.0.1

package/src/assets/skills/security/references/patterns.md

@@ -0,0 +1,271 @@
+# Security — Correct Patterns
+
+Extended correct patterns for security implementation with literature citations.
+
+## Injection Prevention
+
+### SQL Injection Prevention [1][6]
+```typescript
+// SECURE: Parameterized queries — never interpolate user data [6]
+const user = await db.query('SELECT * FROM users WHERE id = $1', [userId]);
+const result = await db.query('SELECT * FROM products WHERE name LIKE $1', [`%${search}%`]);
+```
+
+### NoSQL Injection Prevention [1][6]
+```typescript
+// SECURE: Coerce to string — reject operator objects
+const username = String(req.body.username);
+const user = await db.users.findOne({ username });
+
+// SECURE: Escape regex special characters
+const escaped = userInput.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+db.users.find({ name: { $regex: escaped } });
+```
+
+### Command Injection Prevention [6][9]
+```typescript
+// SECURE: Use execFile with arguments array — OS escapes args [9]
+execFile('ls', [userInput]);
+spawn('convert', [filename, 'output.png']);
+
+// SECURE: Validate input format before use
+const hostnamePattern = /^[a-zA-Z0-9.-]+$/;
+if (!hostnamePattern.test(hostname)) throw new Error('Invalid hostname');
+spawn('ping', ['-c', '4', hostname]);
+```
+
+### Path Traversal Prevention [1][6]
+```typescript
+// SECURE: Normalize and validate path stays within upload dir
+const requestedPath = path.normalize(path.join('./uploads', path.basename(req.params.filename)));
+const absoluteUploads = path.resolve('./uploads');
+const absoluteRequested = path.resolve(requestedPath);
+
+if (!absoluteRequested.startsWith(absoluteUploads + path.sep)) {
+  throw new Error('Path traversal attempt blocked');
+}
+fs.readFile(absoluteRequested);
+```
+
+### LDAP Injection Prevention [6][9]
+```typescript
+// SECURE: Escape LDAP special characters
+function escapeLDAP(str: string): string {
+  return str.replace(/[\\*()]/g, char => `\\${char.charCodeAt(0).toString(16)}`);
+}
+const filter = `(uid=${escapeLDAP(username)})`;
+ldap.search(baseDN, filter);
+```
+
+### Template Injection Prevention [1][20]
+```typescript
+// SECURE: Never build templates from user input — pass data as context only
+const template = 'Hello <%= name %>!';
+ejs.render(template, { name: req.body.name });
+```
+
+---
+
+## Authentication Patterns
+
+### Password Validation [2][7]
+```typescript
+import { z } from 'zod';
+
+// NIST 800-63 minimum: 15-char passphrase or 12-char with complexity [7]
+const PasswordSchema = z.string()
+  .min(12, 'Password must be at least 12 characters')
+  .max(128)
+  .regex(/[A-Z]/).regex(/[a-z]/).regex(/[0-9]/).regex(/[^A-Za-z0-9]/);
+
+async function validatePassword(password: string): Promise<Result<void, Error>> {
+  const schemaResult = PasswordSchema.safeParse(password);
+  if (!schemaResult.success) {
+    return { ok: false, error: new Error(schemaResult.error.message) };
+  }
+  // Check against breach databases (HaveIBeenPwned) [7]
+  const breachCount = await pwnedPassword(password);
+  if (breachCount > 0) return { ok: false, error: new Error('Password found in breach database') };
+  return { ok: true, value: undefined };
+}
+```
+
+### Secure Session Management [4][7]
+```typescript
+// SECURE: httpOnly + Secure + SameSite cookie [4][16]
+res.cookie('session', token, {
+  httpOnly: true,
+  secure: true,
+  sameSite: 'strict',  // CSRF prevention [16]
+  maxAge: 3600000      // 1 hour
+});
+
+// Rotate session ID on privilege change to prevent session fixation [4][7]
+async function login(userId: string, res: Response): Promise<void> {
+  const newSessionId = crypto.randomBytes(32).toString('hex');
+  await sessionStore.destroy(req.sessionID);
+  await sessionStore.create(newSessionId, { userId, createdAt: Date.now(), lastAccess: Date.now() });
+  res.cookie('session', newSessionId, { httpOnly: true, secure: true, sameSite: 'strict', maxAge: 3600000 });
+}
+```
+
+### Secure JWT Handling [17]
+```typescript
+// SECURE: Explicit algorithm, expiry, issuer — RFC 8725 requirements [17]
+jwt.sign(payload, process.env.JWT_SECRET, {
+  algorithm: 'HS256',  // pin algorithm — prevents "none" and RS→HS confusion [17]
+  expiresIn: '15m',
+  issuer: 'myapp'
+});
+
+jwt.verify(token, secret, {
+  algorithms: ['HS256'],  // allowlist — block algorithm substitution [17]
+  issuer: 'myapp'
+});
+
+// Refresh token rotation — store JTI for revocation [17]
+async function createTokenPair(userId: string): Promise<TokenPair> {
+  const accessToken = jwt.sign({ userId, type: 'access' }, process.env.JWT_ACCESS_SECRET,
+    { algorithm: 'HS256', expiresIn: '15m' });
+  const refreshToken = jwt.sign(
+    { userId, type: 'refresh', jti: crypto.randomUUID() },
+    process.env.JWT_REFRESH_SECRET, { algorithm: 'HS256', expiresIn: '7d' });
+  // Store refresh token hash for revocation
+  await tokenStore.save({ jti: jwt.decode(refreshToken).jti, userId,
+    expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000) });
+  return { accessToken, refreshToken };
+}
+```
+
+### Authorization Patterns [2][4]
+```typescript
+// RBAC: Role-Based Access Control [4]
+type Permission = 'read' | 'write' | 'delete' | 'admin';
+const ROLES: Record<string, Permission[]> = {
+  viewer: ['read'],
+  editor: ['read', 'write'],
+  admin: ['read', 'write', 'delete', 'admin']
+};
+
+function requirePermission(...required: Permission[]) {
+  return (req: Request, res: Response, next: NextFunction) => {
+    const userPerms = ROLES[req.user.role] ?? [];
+    if (!required.every(p => userPerms.includes(p))) {
+      return res.status(403).json({ error: 'Insufficient permissions' });
+    }
+    next();
+  };
+}
+
+// ABAC: Attribute-Based Access Control for ownership checks [2]
+const policies = [
+  { resource: 'post', action: 'delete',
+    check: (user: User, post: Post) => user.role === 'admin' || post.authorId === user.id }
+];
+```
+
+---
+
+## Cryptography Patterns
+
+### Secret Management [4][8]
+```typescript
+// SECURE: Validate secrets schema at startup — fail fast [8]
+const SecretsSchema = z.object({
+  DB_PASSWORD: z.string().min(20),
+  JWT_SECRET: z.string().min(64),
+  ENCRYPTION_KEY: z.string().length(64)
+});
+
+function loadSecrets(): Result<Secrets, Error> {
+  const result = SecretsSchema.safeParse(process.env);
+  if (!result.success) return { ok: false, error: new Error('Invalid secrets configuration') };
+  return { ok: true, value: result.data };
+}
+```
+
+### Password Hashing [24]
+```typescript
+// SECURE: Argon2id — PHC winner, memory-hard, side-channel resistant [24]
+import argon2 from 'argon2';
+
+async function hashPassword(password: string): Promise<string> {
+  return argon2.hash(password, {
+    type: argon2.argon2id,
+    memoryCost: 65536,  // 64 MB
+    timeCost: 3,
+    parallelism: 4
+  });
+}
+
+// SECURE: bcrypt cost ≥12 — widely supported alternative [24]
+import bcrypt from 'bcrypt';
+async function hashPasswordBcrypt(password: string): Promise<string> {
+  return bcrypt.hash(password, 12);
+}
+```
+
+### Authenticated Encryption [25]
+```typescript
+// SECURE: AES-256-GCM — authenticated encryption prevents tampering [25]
+function encrypt(plaintext: string, key: Buffer): EncryptedData {
+  const iv = crypto.randomBytes(12);  // 96-bit IV for GCM
+  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+  let ciphertext = cipher.update(plaintext, 'utf8', 'hex');
+  ciphertext += cipher.final('hex');
+  return { ciphertext, iv: iv.toString('hex'), authTag: cipher.getAuthTag().toString('hex') };
+}
+```
+
+### Timing-Safe Comparison [25]
+```typescript
+// SECURE: Constant-time comparison — prevents timing oracle attacks [25]
+import { timingSafeEqual } from 'crypto';
+
+function verifyToken(provided: string, stored: string): boolean {
+  if (provided.length !== stored.length) return false;
+  return timingSafeEqual(Buffer.from(provided), Buffer.from(stored));
+}
+```
+
+### Secure Random Generation [25]
+```typescript
+const token = crypto.randomBytes(32).toString('hex');  // session tokens
+const id = crypto.randomUUID();                        // IDs
+const code = crypto.randomInt(100000, 1000000);        // OTP codes
+```
+
+---
+
+## Headers & CSP [10][15]
+
+```typescript
+// Content-Security-Policy: nonce-based CSP preferred over unsafe-inline [15]
+const nonce = crypto.randomBytes(16).toString('base64');
+res.setHeader('Content-Security-Policy',
+  `default-src 'self'; script-src 'self' 'nonce-${nonce}'; style-src 'self'`);
+
+// HSTS: preload after testing [10]
+res.setHeader('Strict-Transport-Security', 'max-age=63072000; includeSubDomains; preload');
+res.setHeader('X-Content-Type-Options', 'nosniff');
+res.setHeader('X-Frame-Options', 'DENY');
+res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
+```
+
+## Subresource Integrity (SRI) [18]
+```html
+<!-- SECURE: Verify CDN assets by hash — prevents CDN compromise [18] -->
+<script src="https://cdn.example.com/lib.js"
+  integrity="sha384-ABC123..." crossorigin="anonymous"></script>
+```
+
+## Supply Chain [12][13]
+```bash
+# Pin exact versions
+npm install --save-exact lodash@4.17.21
+
+# Generate provenance with Sigstore in CI [13]
+cosign sign --key cosign.key artifact.tar.gz
+
+# SLSA Level 2+: hermetic build with provenance attestation [12]
+```

package/src/assets/skills/security/references/sources.md

@@ -0,0 +1,41 @@
+# Security — Sources
+
+## Primary References
+
+| # | Source | Author(s) | Year | Access | Topics |
+|---|--------|-----------|------|--------|--------|
+| 1 | OWASP Top 10 (2021) | OWASP Foundation | 2021 | [Free](https://owasp.org/Top10/) | Top vulnerability categories: injection, broken auth, misconfiguration, SSRF |
+| 2 | OWASP Application Security Verification Standard (ASVS) 4.0 | OWASP Foundation | 2021 | [Free](https://owasp.org/www-project-application-security-verification-standard/) | Application security verification requirements at three assurance levels |
+| 3 | OWASP Proactive Controls (2024) | OWASP Foundation | 2024 | [Free](https://owasp.org/www-project-proactive-controls/) | Top 10 preventive security measures for developers |
+| 4 | OWASP Cheat Sheet Series | OWASP Foundation | 2024 | [Free](https://cheatsheetseries.owasp.org) | Auth, crypto, XSS, injection, session management prevention patterns |
+| 5 | CWE Top 25 Most Dangerous Software Weaknesses (2024) | MITRE | 2024 | [Free](https://cwe.mitre.org/top25/) | Most exploited weakness categories ranked by prevalence and severity |
+| 6 | CWE-20: Improper Input Validation | MITRE | 2024 | [Free](https://cwe.mitre.org/data/definitions/20.html) | Root cause of injection and boundary-violation vulnerabilities |
+| 7 | NIST SP 800-63 Rev 4 — Digital Identity Guidelines | NIST | 2024 | [Free](https://pages.nist.gov/800-63-4/) | Password length/complexity, MFA, phishing-resistant authenticators |
+| 8 | NIST SP 800-218 — Secure Software Development Framework (SSDF) | NIST | 2022 | [Free](https://csrc.nist.gov/publications/detail/sp/800-218/final) | Secure coding practices, code review requirements, vulnerability response |
+| 9 | CERT Secure Coding Standards | SEI Carnegie Mellon | 2024 | [Free](https://wiki.sei.cmu.edu/confluence/display/seccode) | Language-specific secure coding rules (C, C++, Java, Android, Perl) |
+| 10 | Mozilla Web Security Guidelines | Mozilla Corporation | 2024 | [Free](https://infosec.mozilla.org/guidelines/web_security) | CSP, CORS, HSTS, Referrer-Policy, X-Frame-Options recommendations |
+| 11 | OWASP API Security Top 10 (2023) | OWASP Foundation | 2023 | [Free](https://owasp.org/API-Security/editions/2023/en/0x00-header/) | API-specific vulnerabilities: broken object auth, mass assignment, SSRF |
+| 12 | SLSA Framework — Supply-chain Levels for Software Artifacts | Google / OpenSSF | 2024 | [Free](https://slsa.dev) | Supply chain integrity levels, provenance requirements, build hardening |
+| 13 | Sigstore Documentation | Linux Foundation / OpenSSF | 2024 | [Free](https://docs.sigstore.dev) | Keyless code signing, artifact verification, transparency log |
+| 14 | STRIDE Threat Model | Microsoft | 2022 | [Free](https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats) | Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation |
+| 15 | Content Security Policy (CSP) Level 3 | W3C | 2023 | [Free](https://www.w3.org/TR/CSP3/) | Directive syntax, nonce/hash-based allow-lists, XSS mitigation mechanism |
+| 16 | SameSite Cookies Explained | web.dev (Google) | 2020 | [Free](https://web.dev/articles/samesite-cookies-explained) | CSRF prevention, SameSite=Strict/Lax/None, cookie attribute semantics |
+| 17 | JWT Best Practices — RFC 8725 | IETF | 2020 | [Free](https://www.rfc-editor.org/rfc/rfc8725) | Algorithm confusion, weak secrets, missing validation, claim verification |
+| 18 | Subresource Integrity (SRI) | W3C | 2022 | [Free](https://www.w3.org/TR/SRI/) | Hash-based CDN tamper prevention, integrity attribute for script/link tags |
+| 19 | OWASP Testing Guide (WSTG) v4.2 | OWASP Foundation | 2021 | [Free](https://owasp.org/www-project-web-security-testing-guide/) | Security testing methodology, test cases for each vulnerability category |
+| 20 | Stanford CS 253: Web Security | Feross Aboukhadijeh | 2019 | [Free](https://web.stanford.edu/class/cs253/) | Comprehensive academic web security: XSS, CSRF, SQLi, clickjacking, CSP |
+
+## Books
+
+| # | Source | Author(s) | Year | Access | Topics |
+|---|--------|-----------|------|--------|--------|
+| 21 | "The Web Application Hacker's Handbook" 2nd ed. | Stuttard & Pinto | 2011 | Purchase | Comprehensive web app attack and defense: auth, logic flaws, injection |
+| 22 | "Secure by Design" | Deogun, Sawano & Johnsson | 2019 | Purchase | Security as architectural property, domain primitives, trust boundaries |
+| 23 | "Threat Modeling: Designing for Security" | Adam Shostack | 2014 | Purchase | Systematic threat analysis, STRIDE application, mitigation strategies |
+
+## Algorithms & Specifications
+
+| # | Source | Author(s) | Year | Access | Topics |
+|---|--------|-----------|------|--------|--------|
+| 24 | Argon2 Reference Implementation and Specification | Biryukov, Dinu & Khovratovich | 2021 | [Free](https://github.com/P-H-C/phc-winner-argon2) | Winner of PHC; memory-hard password hashing; recommended over bcrypt/scrypt |
+| 25 | "Cryptography Engineering" Ch. 3–6 | Ferguson, Schneier & Kohno | 2010 | Purchase | Random number generation, symmetric encryption, hash functions, MACs |

package/src/assets/skills/security/references/violations.md

@@ -0,0 +1,241 @@
+# Security — Violation Examples
+
+Extended violation patterns for security reviews with literature citations.
+
+## Injection Vulnerabilities [1][6]
+
+### SQL Injection [1][6]
+```typescript
+// VULNERABLE: String interpolation in query — A03:Injection [1]
+const user = await db.query(`SELECT * FROM users WHERE id = '${userId}'`);
+const result = await db.query(`SELECT * FROM products WHERE name LIKE '%${search}%'`);
+```
+**CWE-89** (SQL Injection) is in the CWE Top 25 [5]. Any unsanitized string in a query
+is exploitable. Parameterized queries are the only reliable fix [6].
+
+### NoSQL Injection [1][6]
+```typescript
+// VULNERABLE: Direct object from request — operator injection possible
+const user = await db.users.findOne({ username: req.body.username });
+// Attacker sends: { username: { $gt: "" } } — matches all users
+
+// VULNERABLE: $where operator accepts arbitrary JS execution
+db.users.find({ $where: `this.name === '${userInput}'` });
+
+// VULNERABLE: Unescaped regex — catastrophic backtracking or full-table match
+db.users.find({ name: { $regex: userInput } });
+// Attacker sends: ".*"
+```
+
+### Command Injection [1][6][9]
+```typescript
+// VULNERABLE: User input in shell command — A03:Injection [1]
+exec(`ls ${userInput}`);
+exec(`convert ${filename} output.png`);
+exec(`ping -c 4 ${hostname}`);
+// Dangerous chars: ; | & $ ` ( ) < > \ ' "
+// Attack: userInput = "file.txt; rm -rf /"
+```
+
+### Path Traversal [1][6]
+```typescript
+// VULNERABLE: Direct path concatenation — CWE-22 [5]
+fs.readFile(`./uploads/${req.params.filename}`);  // Attack: ../../../etc/passwd
+
+// VULNERABLE: Encoded traversal not decoded before validation
+const decoded = decodeURIComponent(req.params.filename);
+fs.readFile(`./uploads/${decoded}`);  // %2e%2e%2f = ../
+```
+
+### LDAP Injection [6][9]
+```typescript
+// VULNERABLE: Unescaped LDAP filter — CWE-90 [5]
+const filter = `(uid=${username})`;
+ldap.search(baseDN, filter);
+// Attack: username = "admin)(&(password=*)"
+```
+
+### Template Injection (SSTI) [1][20]
+```typescript
+// VULNERABLE: User input as template string
+const template = `Hello ${req.body.name}!`;
+ejs.render(template);
+// Attack: name = "<%= process.env.SECRET %>" — exfiltrates env vars
+```
+
+### Header Injection (CRLF) [1][4]
+```typescript
+// VULNERABLE: CRLF injection in redirect header
+res.setHeader('Location', `/user/${userInput}`);
+// Attack: userInput = "test\r\nSet-Cookie: admin=true" — injects cookie
+```
+
+---
+
+## Authentication Vulnerabilities [1][2][7]
+
+### Weak Password Policies [7]
+```typescript
+// VULNERABLE: Below NIST 800-63 minimum [7]
+if (password.length >= 6) { /* accept */ }
+// NIST requires: ≥8 chars minimum (recommend 15-char passphrase or 12-char complex)
+```
+
+### Session Management Issues [4][7]
+```typescript
+// VULNERABLE: Session ID in URL — logged in access logs, Referer header
+app.get('/dashboard?session=abc123');
+
+// VULNERABLE: Predictable session IDs — CWE-330 [5]
+const sessionId = `user_${userId}`;  // sequential, enumerable
+
+// VULNERABLE: No session timeout — indefinite access after token theft [7]
+// VULNERABLE: No session rotation on login — session fixation attack [4]
+```
+
+### JWT Misuse [17]
+```typescript
+// VULNERABLE: Weak secret — brute-forceable [17]
+jwt.sign(payload, 'secret123');
+
+// VULNERABLE: No expiration — stolen token never expires [17]
+jwt.sign(payload, secret);  // no expiresIn
+
+// VULNERABLE: No algorithm specification — algorithm confusion attack [17]
+jwt.verify(token, secret);  // accepts 'none' algorithm or RS256→HS256 downgrade
+
+// VULNERABLE: Storing JWT in localStorage — XSS can exfiltrate [4]
+localStorage.setItem('token', jwt);
+```
+
+### Missing Authorization [1][2]
+```typescript
+// VULNERABLE: No auth check — any user can delete any user [1]
+app.delete('/api/users/:id', async (req, res) => {
+  await deleteUser(req.params.id);
+});
+
+// VULNERABLE: IDOR — no ownership check (API1: Broken Object Level Auth) [11]
+app.get('/api/orders/:id', requireAuth, async (req, res) => {
+  const order = await getOrder(req.params.id);  // any user can read any order
+  res.json(order);
+});
+```
+
+---
+
+## Cryptography Vulnerabilities [5][24][25]
+
+### Hardcoded Secrets [1][4]
+```typescript
+// VULNERABLE: Secrets in source code — A02:Cryptographic Failures [1]
+const API_KEY = 'sk-abc123xyz789';
+const dbPassword = 'admin123';
+const jwtSecret = 'mysecret';
+
+// VULNERABLE: Secrets in config objects committed to git [8]
+const config = { database: { password: 'prod_password_123' } };
+```
+
+### Weak Cryptography [5][25]
+```typescript
+// VULNERABLE: MD5/SHA1 for passwords — broken, rainbow table viable [5][25]
+crypto.createHash('md5').update(password);
+crypto.createHash('sha1').update(password);
+
+// VULNERABLE: Password as raw encryption key — no stretching [24]
+crypto.createCipheriv('aes-256-gcm', password, iv);  // must use scrypt/Argon2 first
+
+// VULNERABLE: ECB mode — identical plaintext blocks produce identical ciphertext [25]
+crypto.createCipheriv('aes-256-ecb', key, null);
+
+// VULNERABLE: CBC without authentication — padding oracle, bit-flipping attacks [25]
+crypto.createCipheriv('aes-256-cbc', key, iv);  // use GCM for authenticated encryption
+```
+
+### Insecure Random [5][25]
+```typescript
+// VULNERABLE: Math.random for security — predictable, not cryptographic [25]
+const token = Math.random().toString(36);
+const id = Date.now().toString();           // timestamp-based — guessable
+const code = Math.floor(Math.random() * 1000000);  // 2FA code — predictable
+```
+
+### Timing Attacks [25]
+```typescript
+// VULNERABLE: Early exit reveals length info through timing [25]
+function verifyToken(provided: string, stored: string): boolean {
+  return provided === stored;  // short-circuits on first mismatch — timing oracle
+}
+```
+
+---
+
+## Configuration Vulnerabilities [1][10][15]
+
+### Missing Security Headers [10][15]
+```typescript
+// VULNERABLE: No CSP — XSS can load arbitrary scripts [15]
+// VULNERABLE: No HSTS — downgrade to HTTP possible [10]
+// VULNERABLE: No X-Frame-Options — clickjacking possible [10]
+// DETECTION: Check with: curl -I https://yoursite.com | grep -i "content-security\|strict-transport\|x-frame"
+```
+
+### Permissive CORS [1][4]
+```typescript
+// VULNERABLE: Wildcard origin with credentials — CORS bypass [4]
+app.use(cors({ origin: '*', credentials: true }));
+// Credentials + wildcard is rejected by browsers but indicates configuration intent
+```
+
+### Error Information Exposure [4][8]
+```typescript
+// VULNERABLE: Stack trace to client — reveals internals [8]
+res.status(500).json({ error: err.stack });
+
+// VULNERABLE: Verbose DB errors — reveals schema structure
+res.status(500).json({ error: err.message });  // e.g. "column 'admin' does not exist"
+```
+
+---
+
+## Business Logic Vulnerabilities [1][3]
+
+### Race Conditions (TOCTOU) [1][3]
+```typescript
+// VULNERABLE: Time-of-check to time-of-use — double-spend possible [3]
+if (balance >= amount) {
+  await withdraw(userId, amount);  // another request can execute between check and write
+}
+```
+
+### Mass Assignment [1][11]
+```typescript
+// VULNERABLE: API6:Mass Assignment — user can set role, verified, etc. [11]
+await User.create(req.body);
+await User.update(userId, req.body);
+// Attack: POST { "email": "x@y.com", "role": "admin", "verified": true }
+
+// VULNERABLE: Spread operator passes all request fields
+const user = { ...req.body, createdAt: new Date() };
+```
+
+### SSRF (Server-Side Request Forgery) [1][11]
+```typescript
+// VULNERABLE: Unvalidated URL — can reach internal services [11]
+const response = await fetch(req.body.webhookUrl);
+// Attack: webhookUrl = "http://169.254.169.254/latest/meta-data/" (AWS metadata)
+// Attack: webhookUrl = "http://internal-db:5432/"
+```
+
+---
+
+## Supply Chain Vulnerabilities [12][13][18]
+
+```typescript
+// VULNERABLE: Unpinned CDN script — CDN compromise delivers malicious code
+// <script src="https://cdn.example.com/lib.js"></script>  // no integrity attribute [18]
+
+// VULNERABLE: Floating dependency versions — supply chain attack surface [12]
+// "dependencies": { "lodash": "^4.17.0" }  // range allows malicious patch releases
+```