kastell 2.0.0 → 2.2.0

package/dist/core/audit/checks/ddos.js

@@ -3,6 +3,7 @@
  * Parses sysctl output into 8 DDoS-specific audit checks.
  * Handles Docker/Coolify platform guard for DDOS-TW-REUSE.
  */
+import { CHECK_IDS } from "../checkIds.js";
 import { extractSysctlValue } from "./shared/sysctl.js";
 const CATEGORY = "DDoS Hardening";
 export const parseDdosChecks = (sectionOutput, platform) => {
@@ -12,7 +13,7 @@ export const parseDdosChecks = (sectionOutput, platform) => {
     // DDOS-SYN-BACKLOG: net.ipv4.tcp_max_syn_backlog >= 2048
     const synBacklog = extractSysctlValue(output, "net.ipv4.tcp_max_syn_backlog");
     const ddosSynBacklog = {
-        id: "DDOS-SYN-BACKLOG",
+        id: CHECK_IDS.DDOS.DDOS_SYN_BACKLOG,
         category: CATEGORY,
         name: "TCP SYN Backlog Queue Size",
         severity: "warning",
@@ -30,7 +31,7 @@ export const parseDdosChecks = (sectionOutput, platform) => {
     // DDOS-SYNACK-RETRIES: net.ipv4.tcp_synack_retries <= 3
     const synackRetries = extractSysctlValue(output, "net.ipv4.tcp_synack_retries");
     const ddosSynackRetries = {
-        id: "DDOS-SYNACK-RETRIES",
+        id: CHECK_IDS.DDOS.DDOS_SYNACK_RETRIES,
         category: CATEGORY,
         name: "TCP SYNACK Retry Count Limited",
         severity: "warning",
@@ -48,7 +49,7 @@ export const parseDdosChecks = (sectionOutput, platform) => {
     // DDOS-FIN-TIMEOUT: net.ipv4.tcp_fin_timeout <= 30
     const finTimeout = extractSysctlValue(output, "net.ipv4.tcp_fin_timeout");
     const ddosFinTimeout = {
-        id: "DDOS-FIN-TIMEOUT",
+        id: CHECK_IDS.DDOS.DDOS_FIN_TIMEOUT,
         category: CATEGORY,
         name: "TCP FIN Timeout Reduced",
         severity: "warning",
@@ -66,7 +67,7 @@ export const parseDdosChecks = (sectionOutput, platform) => {
     // DDOS-TW-REUSE: net.ipv4.tcp_tw_reuse = 1 (but Docker platforms are exempt)
     const twReuse = extractSysctlValue(output, "net.ipv4.tcp_tw_reuse");
     const ddosTwReuse = {
-        id: "DDOS-TW-REUSE",
+        id: CHECK_IDS.DDOS.DDOS_TW_REUSE,
         category: CATEGORY,
         name: "TCP TIME_WAIT Reuse Enabled",
         severity: "info",
@@ -88,7 +89,7 @@ export const parseDdosChecks = (sectionOutput, platform) => {
     // DDOS-ICMP-RATELIMIT: net.ipv4.icmp_ratelimit <= 1000
     const icmpRatelimit = extractSysctlValue(output, "net.ipv4.icmp_ratelimit");
     const ddosIcmpRatelimit = {
-        id: "DDOS-ICMP-RATELIMIT",
+        id: CHECK_IDS.DDOS.DDOS_ICMP_RATELIMIT,
         category: CATEGORY,
         name: "ICMP Rate Limiting Configured",
         severity: "info",
@@ -106,7 +107,7 @@ export const parseDdosChecks = (sectionOutput, platform) => {
     // DDOS-ICMP-BOGUS: net.ipv4.icmp_ignore_bogus_error_responses = 1
     const icmpBogus = extractSysctlValue(output, "net.ipv4.icmp_ignore_bogus_error_responses");
     const ddosIcmpBogus = {
-        id: "DDOS-ICMP-BOGUS",
+        id: CHECK_IDS.DDOS.DDOS_ICMP_BOGUS,
         category: CATEGORY,
         name: "Bogus ICMP Error Responses Ignored",
         severity: "info",
@@ -124,7 +125,7 @@ export const parseDdosChecks = (sectionOutput, platform) => {
     // DDOS-SOMAXCONN: net.core.somaxconn >= 1024
     const somaxconn = extractSysctlValue(output, "net.core.somaxconn");
     const ddosSomaxconn = {
-        id: "DDOS-SOMAXCONN",
+        id: CHECK_IDS.DDOS.DDOS_SOMAXCONN,
         category: CATEGORY,
         name: "Socket Listen Backlog (somaxconn) Size",
         severity: "warning",
@@ -142,7 +143,7 @@ export const parseDdosChecks = (sectionOutput, platform) => {
     // DDOS-SYN-RETRIES: net.ipv4.tcp_syn_retries <= 3
     const synRetries = extractSysctlValue(output, "net.ipv4.tcp_syn_retries");
     const ddosSynRetries = {
-        id: "DDOS-SYN-RETRIES",
+        id: CHECK_IDS.DDOS.DDOS_SYN_RETRIES,
         category: CATEGORY,
         name: "TCP SYN Retry Count Limited",
         severity: "info",

package/dist/core/audit/checks/ddos.js.map

@@ -1 +1 @@
-{"version":3,"file":"ddos.js","sourceRoot":"","sources":["../../../../src/core/audit/checks/ddos.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAElC,MAAM,CAAC,MAAM,eAAe,GAAgB,CAAC,aAAqB,EAAE,QAAgB,EAAgB,EAAE;IACpG,MAAM,IAAI,GAAG,CAAC,aAAa,IAAI,aAAa,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IAC7F,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;IACzC,MAAM,UAAU,GAAG,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,CAAC;IAEpE,yDAAyD;IACzD,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;IAC9E,MAAM,cAAc,GAAe;QACjC,EAAE,EAAE,kBAAkB;QACtB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,IAAI;QAC9E,YAAY,EAAE,IAAI;YAChB,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,UAAU,KAAK,IAAI;gBACnB,CAAC,CAAC,kCAAkC,UAAU,EAAE;gBAChD,CAAC,CAAC,qBAAqB;QAC3B,aAAa,EAAE,sCAAsC;QACrD,UAAU,EACR,0HAA0H;QAC5H,aAAa,EAAE,MAAM;QACrB,OAAO,EACL,uPAAuP;KAC1P,CAAC;IAEF,wDAAwD;IACxD,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC;IAChF,MAAM,iBAAiB,GAAe;QACpC,EAAE,EAAE,qBAAqB;QACzB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,gCAAgC;QACtC,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,CAAC;QACjF,YAAY,EAAE,IAAI;YAChB,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,aAAa,KAAK,IAAI;gBACtB,CAAC,CAAC,iCAAiC,aAAa,EAAE;gBAClD,CAAC,CAAC,qBAAqB;QAC3B,aAAa,EAAE,kCAAkC;QACjD,UAAU,EACR,kHAAkH;QACpH,aAAa,EAAE,MAAM;QACrB,OAAO,EACL,yOAAyO;KAC5O,CAAC;IAEF,mDAAmD;IACnD,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IAC1E,MAAM,cAAc,GAAe;QACjC,EAAE,EAAE,kBAAkB;QACtB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE;QAC5E,YAAY,EAAE,IAAI;YAChB,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,UAAU,KAAK,IAAI;gBACnB,CAAC,CAAC,8BAA8B,UAAU,EAAE;gBAC5C,CAAC,CAAC,qBAAqB;QAC3B,aAAa,EAAE,gCAAgC;QAC/C,UAAU,EACR,8GAA8G;QAChH,aAAa,EAAE,MAAM;QACrB,OAAO,EACL,uPAAuP;KAC1P,CAAC;IAEF,6EAA6E;IAC7E,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACpE,MAAM,WAAW,GAAe;QAC9B,EAAE,EAAE,eAAe;QACnB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG;QAC1D,YAAY,EAAE,IAAI;YAChB,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,OAAO,KAAK,IAAI;gBAChB,CAAC,CAAC,2BAA2B,OAAO,EAAE;gBACtC,CAAC,CAAC,qBAAqB;QAC3B,aAAa,EAAE,UAAU;YACvB,CAAC,CAAC,sCAAsC;YACxC,CAAC,CAAC,2BAA2B;QAC/B,UAAU,EACR,sGAAsG;QACxG,aAAa,EAAE,MAAM;QACrB,OAAO,EAAE,UAAU;YACjB,CAAC,CAAC,+IAA+I;YACjJ,CAAC,CAAC,wMAAwM;KAC7M,CAAC;IAEF,uDAAuD;IACvD,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;IAC5E,MAAM,iBAAiB,GAAe;QACpC,EAAE,EAAE,qBAAqB;QACzB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,+BAA+B;QACrC,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,IAAI;QACpF,YAAY,EAAE,IAAI;YAChB,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,aAAa,KAAK,IAAI;gBACtB,CAAC,CAAC,6BAA6B,aAAa,EAAE;gBAC9C,CAAC,CAAC,qBAAqB;QAC3B,aAAa,EAAE,iCAAiC;QAChD,UAAU,EACR,gHAAgH;QAClH,aAAa,EAAE,MAAM;QACrB,OAAO,EACL,gOAAgO;KACnO,CAAC;IAEF,kEAAkE;IAClE,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,EAAE,4CAA4C,CAAC,CAAC;IAC3F,MAAM,aAAa,GAAe;QAChC,EAAE,EAAE,iBAAiB;QACrB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,oCAAoC;QAC1C,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG;QACxC,YAAY,EAAE,IAAI;YAChB,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,SAAS,KAAK,IAAI;gBAClB,CAAC,CAAC,gDAAgD,SAAS,EAAE;gBAC7D,CAAC,CAAC,qBAAqB;QAC3B,aAAa,EAAE,gDAAgD;QAC/D,UAAU,EACR,gJAAgJ;QAClJ,aAAa,EAAE,MAAM;QACrB,OAAO,EACL,0LAA0L;KAC7L,CAAC;IAEF,6CAA6C;IAC7C,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACnE,MAAM,aAAa,GAAe;QAChC,EAAE,EAAE,gBAAgB;QACpB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,wCAAwC;QAC9C,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,IAAI;QAC5E,YAAY,EAAE,IAAI;YAChB,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,SAAS,KAAK,IAAI;gBAClB,CAAC,CAAC,wBAAwB,SAAS,EAAE;gBACrC,CAAC,CAAC,qBAAqB;QAC3B,aAAa,EAAE,4BAA4B;QAC3C,UAAU,EACR,wGAAwG;QAC1G,aAAa,EAAE,MAAM;QACrB,OAAO,EACL,2PAA2P;KAC9P,CAAC;IAEF,kDAAkD;IAClD,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IAC1E,MAAM,cAAc,GAAe;QACjC,EAAE,EAAE,kBAAkB;QACtB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC;QAC3E,YAAY,EAAE,IAAI;YAChB,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,UAAU,KAAK,IAAI;gBACnB,CAAC,CAAC,8BAA8B,UAAU,EAAE;gBAC5C,CAAC,CAAC,qBAAqB;QAC3B,aAAa,EAAE,+BAA+B;QAC9C,UAAU,EACR,4GAA4G;QAC9G,aAAa,EAAE,MAAM;QACrB,OAAO,EACL,mKAAmK;KACtK,CAAC;IAEF,OAAO;QACL,cAAc;QACd,iBAAiB;QACjB,cAAc;QACd,WAAW;QACX,iBAAiB;QACjB,aAAa;QACb,aAAa;QACb,cAAc;KACf,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"ddos.js","sourceRoot":"","sources":["../../../../src/core/audit/checks/ddos.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAElC,MAAM,CAAC,MAAM,eAAe,GAAgB,CAAC,aAAqB,EAAE,QAAgB,EAAgB,EAAE;IACpG,MAAM,IAAI,GAAG,CAAC,aAAa,IAAI,aAAa,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IAC7F,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;IACzC,MAAM,UAAU,GAAG,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,CAAC;IAEpE,yDAAyD;IACzD,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;IAC9E,MAAM,cAAc,GAAe;QACjC,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,gBAAgB;QACnC,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,IAAI;QAC9E,YAAY,EAAE,IAAI;YAChB,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,UAAU,KAAK,IAAI;gBACnB,CAAC,CAAC,kCAAkC,UAAU,EAAE;gBAChD,CAAC,CAAC,qBAAqB;QAC3B,aAAa,EAAE,sCAAsC;QACrD,UAAU,EACR,0HAA0H;QAC5H,aAAa,EAAE,MAAM;QACrB,OAAO,EACL,uPAAuP;KAC1P,CAAC;IAEF,wDAAwD;IACxD,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC;IAChF,MAAM,iBAAiB,GAAe;QACpC,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,mBAAmB;QACtC,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,gCAAgC;QACtC,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,CAAC;QACjF,YAAY,EAAE,IAAI;YAChB,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,aAAa,KAAK,IAAI;gBACtB,CAAC,CAAC,iCAAiC,aAAa,EAAE;gBAClD,CAAC,CAAC,qBAAqB;QAC3B,aAAa,EAAE,kCAAkC;QACjD,UAAU,EACR,kHAAkH;QACpH,aAAa,EAAE,MAAM;QACrB,OAAO,EACL,yOAAyO;KAC5O,CAAC;IAEF,mDAAmD;IACnD,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IAC1E,MAAM,cAAc,GAAe;QACjC,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,gBAAgB;QACnC,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE;QAC5E,YAAY,EAAE,IAAI;YAChB,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,UAAU,KAAK,IAAI;gBACnB,CAAC,CAAC,8BAA8B,UAAU,EAAE;gBAC5C,CAAC,CAAC,qBAAqB;QAC3B,aAAa,EAAE,gCAAgC;QAC/C,UAAU,EACR,8GAA8G;QAChH,aAAa,EAAE,MAAM;QACrB,OAAO,EACL,uPAAuP;KAC1P,CAAC;IAEF,6EAA6E;IAC7E,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACpE,MAAM,WAAW,GAAe;QAC9B,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,aAAa;QAChC,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG;QAC1D,YAAY,EAAE,IAAI;YAChB,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,OAAO,KAAK,IAAI;gBAChB,CAAC,CAAC,2BAA2B,OAAO,EAAE;gBACtC,CAAC,CAAC,qBAAqB;QAC3B,aAAa,EAAE,UAAU;YACvB,CAAC,CAAC,sCAAsC;YACxC,CAAC,CAAC,2BAA2B;QAC/B,UAAU,EACR,sGAAsG;QACxG,aAAa,EAAE,MAAM;QACrB,OAAO,EAAE,UAAU;YACjB,CAAC,CAAC,+IAA+I;YACjJ,CAAC,CAAC,wMAAwM;KAC7M,CAAC;IAEF,uDAAuD;IACvD,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;IAC5E,MAAM,iBAAiB,GAAe;QACpC,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,mBAAmB;QACtC,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,+BAA+B;QACrC,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,IAAI;QACpF,YAAY,EAAE,IAAI;YAChB,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,aAAa,KAAK,IAAI;gBACtB,CAAC,CAAC,6BAA6B,aAAa,EAAE;gBAC9C,CAAC,CAAC,qBAAqB;QAC3B,aAAa,EAAE,iCAAiC;QAChD,UAAU,EACR,gHAAgH;QAClH,aAAa,EAAE,MAAM;QACrB,OAAO,EACL,gOAAgO;KACnO,CAAC;IAEF,kEAAkE;IAClE,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,EAAE,4CAA4C,CAAC,CAAC;IAC3F,MAAM,aAAa,GAAe;QAChC,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,eAAe;QAClC,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,oCAAoC;QAC1C,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG;QACxC,YAAY,EAAE,IAAI;YAChB,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,SAAS,KAAK,IAAI;gBAClB,CAAC,CAAC,gDAAgD,SAAS,EAAE;gBAC7D,CAAC,CAAC,qBAAqB;QAC3B,aAAa,EAAE,gDAAgD;QAC/D,UAAU,EACR,gJAAgJ;QAClJ,aAAa,EAAE,MAAM;QACrB,OAAO,EACL,0LAA0L;KAC7L,CAAC;IAEF,6CAA6C;IAC7C,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACnE,MAAM,aAAa,GAAe;QAChC,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,cAAc;QACjC,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,wCAAwC;QAC9C,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,IAAI;QAC5E,YAAY,EAAE,IAAI;YAChB,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,SAAS,KAAK,IAAI;gBAClB,CAAC,CAAC,wBAAwB,SAAS,EAAE;gBACrC,CAAC,CAAC,qBAAqB;QAC3B,aAAa,EAAE,4BAA4B;QAC3C,UAAU,EACR,wGAAwG;QAC1G,aAAa,EAAE,MAAM;QACrB,OAAO,EACL,2PAA2P;KAC9P,CAAC;IAEF,kDAAkD;IAClD,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IAC1E,MAAM,cAAc,GAAe;QACjC,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,gBAAgB;QACnC,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC;QAC3E,YAAY,EAAE,IAAI;YAChB,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,UAAU,KAAK,IAAI;gBACnB,CAAC,CAAC,8BAA8B,UAAU,EAAE;gBAC5C,CAAC,CAAC,qBAAqB;QAC3B,aAAa,EAAE,+BAA+B;QAC9C,UAAU,EACR,4GAA4G;QAC9G,aAAa,EAAE,MAAM;QACrB,OAAO,EACL,mKAAmK;KACtK,CAAC;IAEF,OAAO;QACL,cAAc;QACd,iBAAiB;QACjB,cAAc;QACd,WAAW;QACX,iBAAiB;QACjB,aAAa;QACb,aAAa;QACb,cAAc;KACf,CAAC;AACJ,CAAC,CAAC"}

package/dist/core/audit/checks/dns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dns.d.ts","sourceRoot":"","sources":["../../../../src/core/audit/checks/dns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAa,WAAW,EAAoB,MAAM,aAAa,CAAC;AA+L5E,eAAO,MAAM,cAAc,EAAE,WAyC5B,CAAC"}
+{"version":3,"file":"dns.d.ts","sourceRoot":"","sources":["../../../../src/core/audit/checks/dns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAa,WAAW,EAAoB,MAAM,aAAa,CAAC;AA+L5E,eAAO,MAAM,cAAc,EAAE,WAuC5B,CAAC"}

package/dist/core/audit/checks/dns.js

@@ -3,9 +3,10 @@
  * Parses DNSSEC status, DoH/DoT tool presence, resolv.conf protection,
  * and nameserver configuration into 4 security checks.
  */
+import { CHECK_IDS } from "../checkIds.js";
 const DNS_CHECKS = [
     {
-        id: "DNS-DNSSEC-ENABLED",
+        id: CHECK_IDS.DNS.DNS_DNSSEC_ENABLED,
         name: "DNSSEC Validation Enabled",
         severity: "warning",
         check: (output) => {
@@ -23,7 +24,7 @@ const DNS_CHECKS = [
         explain: "DNSSEC validation prevents DNS cache poisoning and man-in-the-middle attacks by verifying cryptographic signatures on DNS responses. Without it, DNS responses can be spoofed to redirect traffic to malicious servers.",
     },
     {
-        id: "DNS-DOH-DOT-AVAILABLE",
+        id: CHECK_IDS.DNS.DNS_DOH_DOT_AVAILABLE,
         name: "DNS over HTTPS/TLS Tool Installed",
         severity: "info",
         check: (output) => {
@@ -43,7 +44,7 @@ const DNS_CHECKS = [
         explain: "DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt DNS queries preventing network-level DNS interception and manipulation. Installing a DoH/DoT resolver protects DNS traffic from passive surveillance and active tampering.",
     },
     {
-        id: "DNS-RESOLV-IMMUTABLE",
+        id: CHECK_IDS.DNS.DNS_RESOLV_IMMUTABLE,
         name: "/etc/resolv.conf Protected from Modification",
         severity: "warning",
         check: (output) => {
@@ -61,7 +62,7 @@ const DNS_CHECKS = [
         explain: "An unprotected /etc/resolv.conf can be overwritten by DHCP clients, network managers, or malicious processes to redirect all DNS queries to an attacker-controlled resolver, enabling DNS hijacking without any kernel compromise.",
     },
     {
-        id: "DNS-NAMESERVER-CONFIGURED",
+        id: CHECK_IDS.DNS.DNS_NAMESERVER_CONFIGURED,
         name: "Nameserver Configured in resolv.conf",
         severity: "warning",
         check: (output) => {
@@ -81,7 +82,7 @@ const DNS_CHECKS = [
         explain: "A nameserver must be configured in /etc/resolv.conf for the system to perform DNS lookups. Without it, domain name resolution fails entirely, breaking all network services that rely on hostnames rather than IP addresses.",
     },
     {
-        id: "DNS-MULTIPLE-NAMESERVERS",
+        id: CHECK_IDS.DNS.DNS_MULTIPLE_NAMESERVERS,
         name: "Multiple DNS Nameservers Configured",
         severity: "info",
         check: (output) => {
@@ -105,7 +106,7 @@ const DNS_CHECKS = [
         explain: "A single DNS nameserver creates a single point of failure; multiple servers ensure DNS resolution survives outages.",
     },
     {
-        id: "DNS-RESOLV-NOT-LOCALHOST-ONLY",
+        id: CHECK_IDS.DNS.DNS_RESOLV_NOT_LOCALHOST_ONLY,
         name: "DNS Resolution Not Limited to Localhost Only",
         severity: "info",
         check: (output) => {
@@ -135,7 +136,7 @@ const DNS_CHECKS = [
         explain: "DNS resolution relying solely on localhost without a running resolver causes total DNS failure.",
     },
     {
-        id: "DNS-LOCAL-RESOLVER-ACTIVE",
+        id: CHECK_IDS.DNS.DNS_LOCAL_RESOLVER_ACTIVE,
         name: "systemd-resolved Local Resolver Active",
         severity: "info",
         check: (output) => {
@@ -152,7 +153,7 @@ const DNS_CHECKS = [
         explain: "A local DNS resolver provides caching, DNSSEC validation, and protection against DNS cache poisoning from upstream resolvers.",
     },
     {
-        id: "DNS-SEARCH-DOMAIN-SET",
+        id: CHECK_IDS.DNS.DNS_SEARCH_DOMAIN_SET,
         name: "DNS Search Domain Configured",
         severity: "info",
         check: (output) => {

package/dist/core/audit/checks/dns.js.map

@@ -1 +1 @@
-{"version":3,"file":"dns.js","sourceRoot":"","sources":["../../../../src/core/audit/checks/dns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgBH,MAAM,UAAU,GAAkB;IAChC;QACE,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,2BAA2B;QACjC,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;YAChB,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACtC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,8BAA8B,EAAE,CAAC;YACxE,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACvC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,+BAA+B,EAAE,CAAC;YAC1E,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,uCAAuC,EAAE,CAAC;QAClF,CAAC;QACD,aAAa,EAAE,yEAAyE;QACxF,UAAU,EAAE,8GAA8G;QAC1H,aAAa,EAAE,SAAS;QACxB,OAAO,EACL,yNAAyN;KAC5N;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,mCAAmC;QACzC,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;YAChB,gCAAgC;YAChC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAC3D,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,2BAA2B,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC/E,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC;gBAClD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,oDAAoD,EAAE,CAAC;YAC/F,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,+CAA+C,EAAE,CAAC;QAC1F,CAAC;QACD,aAAa,EAAE,qDAAqD;QACpE,UAAU,EAAE,gEAAgE;QAC5E,aAAa,EAAE,MAAM;QACrB,OAAO,EACL,gOAAgO;KACnO;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,IAAI,EAAE,8CAA8C;QACpD,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;YAChB,IAAI,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAC7C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,qDAAqD,EAAE,CAAC;YAC/F,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBAC3C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,wDAAwD,EAAE,CAAC;YACnG,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,4DAA4D,EAAE,CAAC;QACvG,CAAC;QACD,aAAa,EAAE,8FAA8F;QAC7G,UAAU,EAAE,uHAAuH;QACnI,aAAa,EAAE,SAAS;QACxB,OAAO,EACL,oOAAoO;KACvO;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,IAAI,EAAE,sCAAsC;QAC5C,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;YAChB,6BAA6B;YAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC1D,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,0BAA0B,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC9E,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;gBACjD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,+CAA+C,EAAE,CAAC;YAC1F,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,kDAAkD,EAAE,CAAC;QAC7F,CAAC;QACD,aAAa,EAAE,0DAA0D;QACzE,UAAU,EAAE,+CAA+C;QAC3D,aAAa,EAAE,MAAM;QACrB,OAAO,EACL,8NAA8N;KACjO;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,IAAI,EAAE,qCAAqC;QAC3C,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;YAChB,wDAAwD;YACxD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,sCAAsC,EAAE,CAAC;YACjF,CAAC;YACD,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,KAAK,IAAI,CAAC,CAAC;YAC1B,OAAO;gBACL,MAAM;gBACN,YAAY,EAAE,MAAM;oBAClB,CAAC,CAAC,GAAG,KAAK,+CAA+C;oBACzD,CAAC,CAAC,QAAQ,KAAK,kDAAkD;aACpE,CAAC;QACJ,CAAC;QACD,aAAa,EAAE,2DAA2D;QAC1E,UAAU,EAAE,oEAAoE;QAChF,aAAa,EAAE,MAAM;QACrB,OAAO,EACL,qHAAqH;KACxH;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,IAAI,EAAE,8CAA8C;QACpD,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;YAChB,iDAAiD;YACjD,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACvF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,iDAAiD,EAAE,CAAC;YAC5F,CAAC;YACD,2CAA2C;YAC3C,MAAM,eAAe,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBACjD,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACtD,OAAO,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,YAAY,CAAC;YACnE,CAAC,CAAC,CAAC;YACH,mFAAmF;YACnF,MAAM,gBAAgB,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,eAAe,IAAI,gBAAgB,CAAC;YACnD,OAAO;gBACL,MAAM;gBACN,YAAY,EAAE,MAAM;oBAClB,CAAC,CAAC,wDAAwD;oBAC1D,CAAC,CAAC,sFAAsF;aAC3F,CAAC;QACJ,CAAC;QACD,aAAa,EAAE,2EAA2E;QAC1F,UAAU,EAAE,+CAA+C;QAC3D,aAAa,EAAE,MAAM;QACrB,OAAO,EACL,iGAAiG;KACpG;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,IAAI,EAAE,wCAAwC;QAC9C,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;YAChB,uEAAuE;YACvE,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3C,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,8BAA8B;aACvF,CAAC;QACJ,CAAC;QACD,aAAa,EAAE,oCAAoC;QACnD,UAAU,EAAE,yCAAyC;QACrD,aAAa,EAAE,SAAS;QACxB,OAAO,EACL,+HAA+H;KAClI;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,8BAA8B;QACpC,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;YAChB,sEAAsE;YACtE,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAChF,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,YAAY,EAAE,SAAS;oBACrB,CAAC,CAAC,qDAAqD;oBACvD,CAAC,CAAC,iDAAiD;aACtD,CAAC;QACJ,CAAC;QACD,aAAa,EAAE,mDAAmD;QAClE,UAAU,EAAE,+CAA+C;QAC3D,aAAa,EAAE,MAAM;QACrB,OAAO,EACL,wGAAwG;KAC3G;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAgB,CACzC,aAAqB,EACrB,SAAiB,EACH,EAAE;IAChB,MAAM,IAAI,GACR,CAAC,aAAa;QACd,aAAa,CAAC,IAAI,EAAE,KAAK,KAAK;QAC9B,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;IAEzC,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC5B,IAAI,IAAI,EAAE,CAAC;YACT,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,QAAQ,EAAE,cAAc;gBACxB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,MAAM,EAAE,KAAK;gBACb,YAAY,EAAE,qBAAqB;gBACnC,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,UAAU,EAAE,GAAG,CAAC,UAAU;gBAE1B,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,OAAO,EAAE,GAAG,CAAC,OAAO;aACrB,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnD,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,QAAQ,EAAE,cAAc;YACxB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM;YACN,YAAY;YACZ,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,UAAU,EAAE,GAAG,CAAC,UAAU;YAE1B,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,OAAO,EAAE,GAAG,CAAC,OAAO;SACrB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC"}
+{"version":3,"file":"dns.js","sourceRoot":"","sources":["../../../../src/core/audit/checks/dns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAa3C,MAAM,UAAU,GAAkB;IAChC;QACE,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,kBAAkB;QACpC,IAAI,EAAE,2BAA2B;QACjC,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;YAChB,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACtC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,8BAA8B,EAAE,CAAC;YACxE,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACvC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,+BAA+B,EAAE,CAAC;YAC1E,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,uCAAuC,EAAE,CAAC;QAClF,CAAC;QACD,aAAa,EAAE,yEAAyE;QACxF,UAAU,EAAE,8GAA8G;QAC1H,aAAa,EAAE,SAAS;QACxB,OAAO,EACL,yNAAyN;KAC5N;IACD;QACE,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,qBAAqB;QACvC,IAAI,EAAE,mCAAmC;QACzC,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;YAChB,gCAAgC;YAChC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAC3D,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,2BAA2B,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC/E,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC;gBAClD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,oDAAoD,EAAE,CAAC;YAC/F,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,+CAA+C,EAAE,CAAC;QAC1F,CAAC;QACD,aAAa,EAAE,qDAAqD;QACpE,UAAU,EAAE,gEAAgE;QAC5E,aAAa,EAAE,MAAM;QACrB,OAAO,EACL,gOAAgO;KACnO;IACD;QACE,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,oBAAoB;QACtC,IAAI,EAAE,8CAA8C;QACpD,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;YAChB,IAAI,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAC7C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,qDAAqD,EAAE,CAAC;YAC/F,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBAC3C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,wDAAwD,EAAE,CAAC;YACnG,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,4DAA4D,EAAE,CAAC;QACvG,CAAC;QACD,aAAa,EAAE,8FAA8F;QAC7G,UAAU,EAAE,uHAAuH;QACnI,aAAa,EAAE,SAAS;QACxB,OAAO,EACL,oOAAoO;KACvO;IACD;QACE,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,yBAAyB;QAC3C,IAAI,EAAE,sCAAsC;QAC5C,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;YAChB,6BAA6B;YAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC1D,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,0BAA0B,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC9E,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;gBACjD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,+CAA+C,EAAE,CAAC;YAC1F,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,kDAAkD,EAAE,CAAC;QAC7F,CAAC;QACD,aAAa,EAAE,0DAA0D;QACzE,UAAU,EAAE,+CAA+C;QAC3D,aAAa,EAAE,MAAM;QACrB,OAAO,EACL,8NAA8N;KACjO;IACD;QACE,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,wBAAwB;QAC1C,IAAI,EAAE,qCAAqC;QAC3C,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;YAChB,wDAAwD;YACxD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,sCAAsC,EAAE,CAAC;YACjF,CAAC;YACD,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,KAAK,IAAI,CAAC,CAAC;YAC1B,OAAO;gBACL,MAAM;gBACN,YAAY,EAAE,MAAM;oBAClB,CAAC,CAAC,GAAG,KAAK,+CAA+C;oBACzD,CAAC,CAAC,QAAQ,KAAK,kDAAkD;aACpE,CAAC;QACJ,CAAC;QACD,aAAa,EAAE,2DAA2D;QAC1E,UAAU,EAAE,oEAAoE;QAChF,aAAa,EAAE,MAAM;QACrB,OAAO,EACL,qHAAqH;KACxH;IACD;QACE,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,6BAA6B;QAC/C,IAAI,EAAE,8CAA8C;QACpD,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;YAChB,iDAAiD;YACjD,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACvF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,iDAAiD,EAAE,CAAC;YAC5F,CAAC;YACD,2CAA2C;YAC3C,MAAM,eAAe,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBACjD,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACtD,OAAO,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,YAAY,CAAC;YACnE,CAAC,CAAC,CAAC;YACH,mFAAmF;YACnF,MAAM,gBAAgB,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,eAAe,IAAI,gBAAgB,CAAC;YACnD,OAAO;gBACL,MAAM;gBACN,YAAY,EAAE,MAAM;oBAClB,CAAC,CAAC,wDAAwD;oBAC1D,CAAC,CAAC,sFAAsF;aAC3F,CAAC;QACJ,CAAC;QACD,aAAa,EAAE,2EAA2E;QAC1F,UAAU,EAAE,+CAA+C;QAC3D,aAAa,EAAE,MAAM;QACrB,OAAO,EACL,iGAAiG;KACpG;IACD;QACE,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,yBAAyB;QAC3C,IAAI,EAAE,wCAAwC;QAC9C,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;YAChB,uEAAuE;YACvE,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3C,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,8BAA8B;aACvF,CAAC;QACJ,CAAC;QACD,aAAa,EAAE,oCAAoC;QACnD,UAAU,EAAE,yCAAyC;QACrD,aAAa,EAAE,SAAS;QACxB,OAAO,EACL,+HAA+H;KAClI;IACD;QACE,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,qBAAqB;QACvC,IAAI,EAAE,8BAA8B;QACpC,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;YAChB,sEAAsE;YACtE,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAChF,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,YAAY,EAAE,SAAS;oBACrB,CAAC,CAAC,qDAAqD;oBACvD,CAAC,CAAC,iDAAiD;aACtD,CAAC;QACJ,CAAC;QACD,aAAa,EAAE,mDAAmD;QAClE,UAAU,EAAE,+CAA+C;QAC3D,aAAa,EAAE,MAAM;QACrB,OAAO,EACL,wGAAwG;KAC3G;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAgB,CACzC,aAAqB,EACrB,SAAiB,EACH,EAAE;IAChB,MAAM,IAAI,GACR,CAAC,aAAa;QACd,aAAa,CAAC,IAAI,EAAE,KAAK,KAAK;QAC9B,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;IAEzC,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC5B,IAAI,IAAI,EAAE,CAAC;YACT,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,QAAQ,EAAE,cAAc;gBACxB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,MAAM,EAAE,KAAK;gBACb,YAAY,EAAE,qBAAqB;gBACnC,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,OAAO,EAAE,GAAG,CAAC,OAAO;aACrB,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnD,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,QAAQ,EAAE,cAAc;YACxB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM;YACN,YAAY;YACZ,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,OAAO,EAAE,GAAG,CAAC,OAAO;SACrB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/core/audit/checks/docker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../../src/core/audit/checks/docker.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAc,WAAW,EAAE,MAAM,aAAa,CAAC;AA8D3D,eAAO,MAAM,iBAAiB,EAAE,WA6qB/B,CAAC"}
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../../src/core/audit/checks/docker.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAc,WAAW,EAAE,MAAM,aAAa,CAAC;AA+D3D,eAAO,MAAM,iBAAiB,EAAE,WA6qB/B,CAAC"}

package/dist/core/audit/checks/docker.js

@@ -3,6 +3,7 @@
  * Parses docker info/ps output into 6 security checks with semantic IDs.
  * Platform-aware: Docker checks adjust for coolify/dokploy vs bare.
  */
+import { CHECK_IDS } from "../checkIds.js";
 /** Check if Docker is installed based on output */
 function isDockerAvailable(output) {
     if (!output || output.trim() === "N/A" || output.trim() === "")
@@ -13,38 +14,38 @@ function isDockerAvailable(output) {
 function makeDockerSkippedChecks(severity) {
     const message = "Docker not installed";
     const ids = [
-        { id: "DCK-NO-TCP-SOCKET", name: "No TCP Socket Exposed" },
-        { id: "DCK-NO-PRIVILEGED", name: "No Privileged Containers" },
-        { id: "DCK-VERSION-CURRENT", name: "Docker Version Current" },
-        { id: "DCK-USER-NAMESPACE", name: "User Namespace Enabled" },
-        { id: "DCK-NO-HOST-NETWORK", name: "No Host Network Containers" },
-        { id: "DCK-LOGGING-DRIVER", name: "Logging Driver Configured" },
-        { id: "DCK-LIVE-RESTORE", name: "Live Restore Enabled" },
-        { id: "DCK-NO-NEW-PRIVILEGES", name: "No New Privileges Default" },
-        { id: "DCK-ICC-DISABLED", name: "Inter-Container Communication Disabled" },
-        { id: "DCK-TLS-VERIFY", name: "TLS Verification Enabled" },
-        { id: "DCK-SOCKET-PERMS", name: "Docker Socket Permissions" },
-        { id: "DCK-NO-ROOT-CONTAINERS", name: "No Root Containers" },
-        { id: "DCK-READ-ONLY-ROOTFS", name: "Read-Only Root Filesystem" },
-        { id: "DCK-LOG-MAX-SIZE", name: "Log Max Size Configured" },
-        { id: "DCK-DEFAULT-ULIMITS", name: "Default Ulimits Configured" },
-        { id: "DCK-SECCOMP-ENABLED", name: "Seccomp Profile Applied" },
-        { id: "DCK-CONTENT-TRUST", name: "Docker Content Trust Enabled" },
-        { id: "DCK-NO-SENSITIVE-MOUNTS", name: "No Sensitive Mounts" },
-        { id: "DCK-APPARMOR-PROFILE", name: "AppArmor Profile Applied" },
-        { id: "DCK-NO-PRIVILEGED-PORTS", name: "No Privileged Port Bindings" },
-        { id: "DCK-NETWORK-DISABLED", name: "Custom Network Configured" },
-        { id: "DCK-LOG-DRIVER-CONFIGURED", name: "Log Driver Not None" },
-        { id: "DCK-ROOTLESS-MODE", name: "Rootless Docker Mode" },
-        { id: "DCK-NO-HOST-NETWORK-INSPECT", name: "No Host Network Mode (Inspect)" },
-        { id: "DCK-HEALTH-CHECK", name: "Container Health Checks Configured" },
-        { id: "DCK-BRIDGE-NFCALL", name: "Bridge ICC Disabled" },
-        { id: "DCK-NO-INSECURE-REGISTRY", name: "No Insecure Registries Configured" },
-        { id: "DCK-NO-EXPERIMENTAL", name: "Experimental Features Disabled" },
-        { id: "DCK-AUTH-PLUGIN", name: "Docker Authorization Plugin Configured" },
-        { id: "DCK-REGISTRY-CERTS", name: "Registry TLS Certificates Configured" },
-        { id: "DCK-SWARM-INACTIVE", name: "Docker Swarm Mode Inactive" },
-        { id: "DCK-PID-MODE", name: "No Host PID Namespace Containers" },
+        { id: CHECK_IDS.DOCKER.DCK_NO_TCP_SOCKET, name: "No TCP Socket Exposed" },
+        { id: CHECK_IDS.DOCKER.DCK_NO_PRIVILEGED, name: "No Privileged Containers" },
+        { id: CHECK_IDS.DOCKER.DCK_VERSION_CURRENT, name: "Docker Version Current" },
+        { id: CHECK_IDS.DOCKER.DCK_USER_NAMESPACE, name: "User Namespace Enabled" },
+        { id: CHECK_IDS.DOCKER.DCK_NO_HOST_NETWORK, name: "No Host Network Containers" },
+        { id: CHECK_IDS.DOCKER.DCK_LOGGING_DRIVER, name: "Logging Driver Configured" },
+        { id: CHECK_IDS.DOCKER.DCK_LIVE_RESTORE, name: "Live Restore Enabled" },
+        { id: CHECK_IDS.DOCKER.DCK_NO_NEW_PRIVILEGES, name: "No New Privileges Default" },
+        { id: CHECK_IDS.DOCKER.DCK_ICC_DISABLED, name: "Inter-Container Communication Disabled" },
+        { id: CHECK_IDS.DOCKER.DCK_TLS_VERIFY, name: "TLS Verification Enabled" },
+        { id: CHECK_IDS.DOCKER.DCK_SOCKET_PERMS, name: "Docker Socket Permissions" },
+        { id: CHECK_IDS.DOCKER.DCK_NO_ROOT_CONTAINERS, name: "No Root Containers" },
+        { id: CHECK_IDS.DOCKER.DCK_READ_ONLY_ROOTFS, name: "Read-Only Root Filesystem" },
+        { id: CHECK_IDS.DOCKER.DCK_LOG_MAX_SIZE, name: "Log Max Size Configured" },
+        { id: CHECK_IDS.DOCKER.DCK_DEFAULT_ULIMITS, name: "Default Ulimits Configured" },
+        { id: CHECK_IDS.DOCKER.DCK_SECCOMP_ENABLED, name: "Seccomp Profile Applied" },
+        { id: CHECK_IDS.DOCKER.DCK_CONTENT_TRUST, name: "Docker Content Trust Enabled" },
+        { id: CHECK_IDS.DOCKER.DCK_NO_SENSITIVE_MOUNTS, name: "No Sensitive Mounts" },
+        { id: CHECK_IDS.DOCKER.DCK_APPARMOR_PROFILE, name: "AppArmor Profile Applied" },
+        { id: CHECK_IDS.DOCKER.DCK_NO_PRIVILEGED_PORTS, name: "No Privileged Port Bindings" },
+        { id: CHECK_IDS.DOCKER.DCK_NETWORK_DISABLED, name: "Custom Network Configured" },
+        { id: CHECK_IDS.DOCKER.DCK_LOG_DRIVER_CONFIGURED, name: "Log Driver Not None" },
+        { id: CHECK_IDS.DOCKER.DCK_ROOTLESS_MODE, name: "Rootless Docker Mode" },
+        { id: CHECK_IDS.DOCKER.DCK_NO_HOST_NETWORK_INSPECT, name: "No Host Network Mode (Inspect)" },
+        { id: CHECK_IDS.DOCKER.DCK_HEALTH_CHECK, name: "Container Health Checks Configured" },
+        { id: CHECK_IDS.DOCKER.DCK_BRIDGE_NFCALL, name: "Bridge ICC Disabled" },
+        { id: CHECK_IDS.DOCKER.DCK_NO_INSECURE_REGISTRY, name: "No Insecure Registries Configured" },
+        { id: CHECK_IDS.DOCKER.DCK_NO_EXPERIMENTAL, name: "Experimental Features Disabled" },
+        { id: CHECK_IDS.DOCKER.DCK_AUTH_PLUGIN, name: "Docker Authorization Plugin Configured" },
+        { id: CHECK_IDS.DOCKER.DCK_REGISTRY_CERTS, name: "Registry TLS Certificates Configured" },
+        { id: CHECK_IDS.DOCKER.DCK_SWARM_INACTIVE, name: "Docker Swarm Mode Inactive" },
+        { id: CHECK_IDS.DOCKER.DCK_PID_MODE, name: "No Host PID Namespace Containers" },
     ];
     return ids.map((def) => ({
         id: def.id,
@@ -97,7 +98,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     const hosts = dockerInfo.Hosts ?? [];
     const hasTcpSocket = hosts.some((h) => h.startsWith("tcp://"));
     const dck01 = {
-        id: "DCK-NO-TCP-SOCKET",
+        id: CHECK_IDS.DOCKER.DCK_NO_TCP_SOCKET,
         category: "Docker",
         name: "No TCP Socket Exposed",
         severity: "critical",
@@ -111,7 +112,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     // DCK-NO-PRIVILEGED: No privileged containers
     const hasPrivileged = /--privileged/i.test(sectionOutput) || /"Privileged":\s*true/i.test(sectionOutput);
     const dck02 = {
-        id: "DCK-NO-PRIVILEGED",
+        id: CHECK_IDS.DOCKER.DCK_NO_PRIVILEGED,
         category: "Docker",
         name: "No Privileged Containers",
         severity: "critical",
@@ -127,7 +128,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     const versionMajor = parseInt(version.split(".")[0], 10);
     const isCurrentVersion = !isNaN(versionMajor) && versionMajor >= 24;
     const dck03 = {
-        id: "DCK-VERSION-CURRENT",
+        id: CHECK_IDS.DOCKER.DCK_VERSION_CURRENT,
         category: "Docker",
         name: "Docker Version Current",
         severity: "warning",
@@ -143,7 +144,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     const hasUserns = securityOpts.some((opt) => opt.includes("userns")) ||
         sectionOutput.includes("userns-remap");
     const dck04 = {
-        id: "DCK-USER-NAMESPACE",
+        id: CHECK_IDS.DOCKER.DCK_USER_NAMESPACE,
         category: "Docker",
         name: "User Namespace Enabled",
         severity: "warning",
@@ -157,7 +158,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     // DCK-NO-HOST-NETWORK: No host network containers
     const hasHostNetwork = /--network\s*host/i.test(sectionOutput) || /"NetworkMode":\s*"host"/i.test(sectionOutput);
     const dck05 = {
-        id: "DCK-NO-HOST-NETWORK",
+        id: CHECK_IDS.DOCKER.DCK_NO_HOST_NETWORK,
         category: "Docker",
         name: "No Host Network Containers",
         severity: "warning",
@@ -172,7 +173,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     const loggingDriver = dockerInfo.LoggingDriver ?? "unknown";
     const hasLogging = loggingDriver !== "none" && loggingDriver !== "unknown";
     const dck06 = {
-        id: "DCK-LOGGING-DRIVER",
+        id: CHECK_IDS.DOCKER.DCK_LOGGING_DRIVER,
         category: "Docker",
         name: "Logging Driver Configured",
         severity: "info",
@@ -202,7 +203,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     // DCK-07: live-restore enabled
     const liveRestoreEnabled = daemonJson["live-restore"] === true || dockerInfo.LiveRestoreEnabled === true;
     const dck07 = {
-        id: "DCK-LIVE-RESTORE",
+        id: CHECK_IDS.DOCKER.DCK_LIVE_RESTORE,
         category: "Docker",
         name: "Live Restore Enabled",
         severity: "warning",
@@ -218,7 +219,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     const noNewPrivilegesDefault = securityOpts2.some((o) => o.includes("no-new-privileges")) ||
         daemonJson["no-new-privileges"] === true;
     const dck08 = {
-        id: "DCK-NO-NEW-PRIVILEGES",
+        id: CHECK_IDS.DOCKER.DCK_NO_NEW_PRIVILEGES,
         category: "Docker",
         name: "No New Privileges Default",
         severity: "warning",
@@ -234,7 +235,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
         sectionOutput.includes('"BridgeNfIcc":false') ||
         sectionOutput.includes('"BridgeNfIcc": false');
     const dck09 = {
-        id: "DCK-ICC-DISABLED",
+        id: CHECK_IDS.DOCKER.DCK_ICC_DISABLED,
         category: "Docker",
         name: "Inter-Container Communication Disabled",
         severity: "warning",
@@ -250,7 +251,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     const hasTcpExposed = tcpHosts.length > 0;
     const tlsVerifyEnabled = sectionOutput.includes('"tls":true') || sectionOutput.includes('"tlsverify":true');
     const dck10 = {
-        id: "DCK-TLS-VERIFY",
+        id: CHECK_IDS.DOCKER.DCK_TLS_VERIFY,
         category: "Docker",
         name: "TLS Verification Enabled",
         severity: "critical",
@@ -267,7 +268,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     const sockStatLine = allLines.find((l) => /^\d{3}\s+\w+\s+\w+/.test(l.trim())) ?? "";
     const sockPermOk = /^660\s+root\s+docker/.test(sockStatLine.trim());
     const dck11 = {
-        id: "DCK-SOCKET-PERMS",
+        id: CHECK_IDS.DOCKER.DCK_SOCKET_PERMS,
         category: "Docker",
         name: "Docker Socket Permissions",
         severity: "warning",
@@ -283,7 +284,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     const hasRootContainers = hasRunningContainers &&
         containerUserLines.some((l) => /User=$/.test(l.trim()) || /User=""/.test(l));
     const dck12 = {
-        id: "DCK-NO-ROOT-CONTAINERS",
+        id: CHECK_IDS.DOCKER.DCK_NO_ROOT_CONTAINERS,
         category: "Docker",
         name: "No Root Containers",
         severity: "warning",
@@ -303,7 +304,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     const allReadOnly = hasRunningContainers && readonlyLines.length > 0 &&
         readonlyLines.every((l) => l.includes("ReadonlyRootfs=true"));
     const dck13 = {
-        id: "DCK-READ-ONLY-ROOTFS",
+        id: CHECK_IDS.DOCKER.DCK_READ_ONLY_ROOTFS,
         category: "Docker",
         name: "Read-Only Root Filesystem",
         severity: "info",
@@ -323,7 +324,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     const logMaxSize = sectionOutput.includes("max-size") ||
         (typeof logOpts === "object" && logOpts !== null && "max-size" in logOpts);
     const dck14 = {
-        id: "DCK-LOG-MAX-SIZE",
+        id: CHECK_IDS.DOCKER.DCK_LOG_MAX_SIZE,
         category: "Docker",
         name: "Log Max Size Configured",
         severity: "info",
@@ -337,7 +338,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     // DCK-15: Default ulimits configured
     const hasDefaultUlimits = "default-ulimits" in daemonJson;
     const dck15 = {
-        id: "DCK-DEFAULT-ULIMITS",
+        id: CHECK_IDS.DOCKER.DCK_DEFAULT_ULIMITS,
         category: "Docker",
         name: "Default Ulimits Configured",
         severity: "info",
@@ -353,7 +354,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     const hasSeccomp = !hasRunningContainers ||
         (seccompLines.length > 0 && seccompLines.some((l) => l.includes("seccomp")));
     const dck16 = {
-        id: "DCK-SECCOMP-ENABLED",
+        id: CHECK_IDS.DOCKER.DCK_SECCOMP_ENABLED,
         category: "Docker",
         name: "Seccomp Profile Applied",
         severity: "warning",
@@ -371,7 +372,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     // DCK-17: Docker content trust
     const contentTrustEnabled = sectionOutput.includes("DOCKER_CONTENT_TRUST=1");
     const dck17 = {
-        id: "DCK-CONTENT-TRUST",
+        id: CHECK_IDS.DOCKER.DCK_CONTENT_TRUST,
         category: "Docker",
         name: "Docker Content Trust Enabled",
         severity: "info",
@@ -387,7 +388,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     const hasPrivilegedFromInspect = hasRunningContainers &&
         privilegedInspectLines.some((l) => l.includes("Privileged=true"));
     const dck18 = {
-        id: "DCK-NO-SENSITIVE-MOUNTS",
+        id: CHECK_IDS.DOCKER.DCK_NO_SENSITIVE_MOUNTS,
         category: "Docker",
         name: "No Sensitive Mounts",
         severity: "warning",
@@ -406,7 +407,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     const hasApparmor = !hasRunningContainers ||
         (seccompLines.length > 0 && seccompLines.some((l) => l.includes("apparmor")));
     const dck19 = {
-        id: "DCK-APPARMOR-PROFILE",
+        id: CHECK_IDS.DOCKER.DCK_APPARMOR_PROFILE,
         category: "Docker",
         name: "AppArmor Profile Applied",
         severity: "warning",
@@ -430,7 +431,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     })
         .filter((p) => !isNaN(p) && p < 1024 && p !== 80 && p !== 443);
     const dck20 = {
-        id: "DCK-NO-PRIVILEGED-PORTS",
+        id: CHECK_IDS.DOCKER.DCK_NO_PRIVILEGED_PORTS,
         category: "Docker",
         name: "No Privileged Port Bindings",
         severity: "info",
@@ -457,7 +458,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
         return !defaultNetworks.has(norm) && !l.includes("NETWORK") && !l.includes("NAME");
     });
     const dck21 = {
-        id: "DCK-NETWORK-DISABLED",
+        id: CHECK_IDS.DOCKER.DCK_NETWORK_DISABLED,
         category: "Docker",
         name: "Custom Docker Network Configured",
         severity: "info",
@@ -475,7 +476,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     // DCK-22: Log driver not 'none'
     const dck22LogDriver = dockerInfo.LoggingDriver ?? "unknown";
     const dck22 = {
-        id: "DCK-LOG-DRIVER-CONFIGURED",
+        id: CHECK_IDS.DOCKER.DCK_LOG_DRIVER_CONFIGURED,
         category: "Docker",
         name: "Logging Driver Not None",
         severity: "warning",
@@ -492,7 +493,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     const dck23SecOpts = dockerInfo.SecurityOptions ?? [];
     const isRootless = dck23SecOpts.some((o) => o.toLowerCase().includes("rootless"));
     const dck23 = {
-        id: "DCK-ROOTLESS-MODE",
+        id: CHECK_IDS.DOCKER.DCK_ROOTLESS_MODE,
         category: "Docker",
         name: "Docker Rootless Mode",
         severity: "info",
@@ -510,7 +511,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     // DCK-24: No containers using host network mode (inspect JSON path)
     const hasHostNetworkMode = /"NetworkMode":\s*"host"/i.test(sectionOutput);
     const dck24 = {
-        id: "DCK-NO-HOST-NETWORK-INSPECT",
+        id: CHECK_IDS.DOCKER.DCK_NO_HOST_NETWORK_INSPECT,
         category: "Docker",
         name: "No Host Network Mode (Inspect)",
         severity: "warning",
@@ -531,7 +532,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     const healthCheckLines = allLines.filter((l) => l.includes("Health") || l.includes("healthy") || l.includes("unhealthy"));
     const hasHealthChecks = !hasRunningContainers || healthCheckLines.length > 0;
     const dck25 = {
-        id: "DCK-HEALTH-CHECK",
+        id: CHECK_IDS.DOCKER.DCK_HEALTH_CHECK,
         category: "Docker",
         name: "Container Health Checks Configured",
         severity: "info",
@@ -563,7 +564,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
         }
     }
     const dck26 = {
-        id: "DCK-BRIDGE-NFCALL",
+        id: CHECK_IDS.DOCKER.DCK_BRIDGE_NFCALL,
         category: "Docker",
         name: "Bridge ICC Disabled",
         severity: "warning",
@@ -587,7 +588,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
         && !/^\[127\.0\.0\.0\/8\]$/.test(insecureRegistryValue.replace(/\s/g, ""))
         && !insecureRegistryValue.includes("[]");
     const dck27 = {
-        id: "DCK-NO-INSECURE-REGISTRY",
+        id: CHECK_IDS.DOCKER.DCK_NO_INSECURE_REGISTRY,
         category: "Docker",
         name: "No Insecure Registries Configured",
         severity: "warning",
@@ -611,7 +612,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     const isExperimental = (experimentalLine !== undefined && experimentalLine.trim() === "true")
         || (lastBoolLine?.trim() === "true");
     const dck28 = {
-        id: "DCK-NO-EXPERIMENTAL",
+        id: CHECK_IDS.DOCKER.DCK_NO_EXPERIMENTAL,
         category: "Docker",
         name: "Experimental Features Disabled",
         severity: "info",
@@ -635,7 +636,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
         && authPluginValue !== "[]"
         && authPluginValue !== "[ ]";
     const dck29 = {
-        id: "DCK-AUTH-PLUGIN",
+        id: CHECK_IDS.DOCKER.DCK_AUTH_PLUGIN,
         category: "Docker",
         name: "Docker Authorization Plugin Configured",
         severity: "info",
@@ -655,7 +656,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
         && sectionOutput.includes("/etc/docker/certs.d/")
         && !sectionOutput.includes("total 0");
     const dck30 = {
-        id: "DCK-REGISTRY-CERTS",
+        id: CHECK_IDS.DOCKER.DCK_REGISTRY_CERTS,
         category: "Docker",
         name: "Registry TLS Certificates Configured",
         severity: "info",
@@ -676,7 +677,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     const swarmState = swarmStateLine?.trim() ?? "inactive";
     const swarmActive = swarmState === "active";
     const dck31 = {
-        id: "DCK-SWARM-INACTIVE",
+        id: CHECK_IDS.DOCKER.DCK_SWARM_INACTIVE,
         category: "Docker",
         name: "Docker Swarm Mode Inactive",
         severity: "info",
@@ -695,7 +696,7 @@ export const parseDockerChecks = (sectionOutput, platform) => {
     const hasHostPid = /"PidMode":\s*"host"/i.test(sectionOutput)
         || /PidMode=host/.test(sectionOutput);
     const dck32 = {
-        id: "DCK-PID-MODE",
+        id: CHECK_IDS.DOCKER.DCK_PID_MODE,
         category: "Docker",
         name: "No Host PID Namespace Containers",
         severity: "warning",