launchprep 0.0.1 → 0.1.0

package/src/rules.json

@@ -0,0 +1,3651 @@
+{
+"version": "0.1",
+"count": 288,
+"rules": [
+{
+"id": "SEC-001",
+"title": ".env committed to version control",
+"severity": "critical",
+"requires": [],
+"tier": 1,
+"check": "git ls-files matches ^\\.env(\\.|$) and not .env.example",
+"fix": "git rm --cached .env; add to .gitignore; ROTATE every key in it",
+"note": "rotation is the part everyone skips. history retains the file.",
+"sources": [
+"DXmVjvwjpgQ",
+"DYsfrtjJ608",
+"DYiqd6pJ3d8"
+],
+"category": "secrets"
+},
+{
+"id": "SEC-002",
+"title": ".env absent from .gitignore",
+"severity": "high",
+"requires": [],
+"tier": 1,
+"check": ".gitignore lacks a pattern matching .env",
+"sources": [
+"DYsfrtjJ608"
+],
+"category": "secrets"
+},
+{
+"id": "SEC-003",
+"title": "Hardcoded API key / token / password in source",
+"severity": "critical",
+"requires": [],
+"tier": 1,
+"check": "entropy + provider prefix scan (sk-, sk-ant-, AKIA, ghp_, xoxb-, eyJ...) outside .env",
+"sources": [
+"DWNKkeHkTLF",
+"DZE5kabhdnI"
+],
+"category": "secrets"
+},
+{
+"id": "SEC-004",
+"title": "Server-only secret exposed to the client bundle",
+"severity": "critical",
+"requires": [
+"surface in [web-app, web-site]"
+],
+"tier": 1,
+"check": "NEXT_PUBLIC_/VITE_/REACT_APP_ prefix on a name matching (KEY|SECRET|TOKEN|PASSWORD), or a secret literal reachable from a client component",
+"note": "the single most common vibe-coder leak. the prefix makes it PUBLIC, and the name reads like it is protected.",
+"sources": [
+"DWNKkeHkTLF",
+"DXmVjvwjpgQ"
+],
+"category": "secrets"
+},
+{
+"id": "SEC-005",
+"title": "Supabase service_role key used outside a server context",
+"severity": "critical",
+"requires": [
+"stack.database == supabase"
+],
+"tier": 1,
+"check": "service_role key referenced in a client component, edge config, or NEXT_PUBLIC_ var",
+"note": "service_role bypasses RLS entirely. in the browser it is a full database handover.",
+"sources": [
+"DXvKgfFJF7a"
+],
+"category": "secrets"
+},
+{
+"id": "SEC-006",
+"title": "Paid-API key called directly from the browser",
+"severity": "critical",
+"requires": [
+"calls_llm == true"
+],
+"tier": 1,
+"check": "LLM SDK instantiated in client-side code, or provider endpoint called from browser",
+"fix": "proxy through your own server route; never ship the provider key",
+"sources": [
+"DZ7qlTboUvg"
+],
+"category": "secrets"
+},
+{
+"id": "SEC-007",
+"title": "No key-rotation path",
+"severity": "medium",
+"requires": [
+"stage == production"
+],
+"tier": 2,
+"check": "keys are read from a single hardcoded env var with no versioning or rotation runbook",
+"note": "corpus says 'rotate immediately' but nobody ships a way TO rotate.",
+"sources": [
+"DYsfrtjJ608"
+],
+"category": "secrets"
+},
+{
+"id": "SEC-008",
+"title": "Long-lived credential where a short-lived one is available",
+"severity": "medium",
+"requires": [
+"stage == production"
+],
+"tier": 2,
+"check": "static API key used against a provider that supports STS / short-lived tokens",
+"sources": [
+"DZE5kabhdnI"
+],
+"category": "secrets"
+},
+{
+"id": "AUTH-001",
+"title": "Session token stored in localStorage",
+"severity": "high",
+"requires": [
+"has_accounts == true",
+"surface in [web-app, web-site]"
+],
+"tier": 1,
+"check": "localStorage.setItem / getItem with a token-like key",
+"fix": "httpOnly + Secure + SameSite cookie",
+"note": "localStorage is readable by any XSS. a cookie with httpOnly is not.",
+"sources": [
+"DZU1RKoT5Nc"
+],
+"category": "authentication"
+},
+{
+"id": "AUTH-002",
+"title": "Role or permission read from client-controlled storage",
+"severity": "critical",
+"requires": [
+"has_accounts == true"
+],
+"tier": 1,
+"check": "role/isAdmin/plan/tier read from localStorage, sessionStorage, cookie, or JWT claim without server-side re-verification",
+"note": "the corpus demo is literally 'open Application storage, change Member to Admin, refresh'.",
+"sources": [
+"DZsXW-HonCi",
+"DZU1RKoT5Nc"
+],
+"category": "authentication"
+},
+{
+"id": "AUTH-003",
+"title": "No brute-force limit on login",
+"severity": "high",
+"requires": [
+"has_accounts == true"
+],
+"tier": 1,
+"check": "login route has no attempt counter / lockout / rate limit",
+"fix": "max 5 attempts per identifier per 15 min, plus IP-level cap",
+"sources": [
+"DWNKkeHkTLF",
+"DXrtdLeDIfy"
+],
+"category": "authentication"
+},
+{
+"id": "AUTH-004",
+"title": "Password reset endpoint unthrottled",
+"severity": "high",
+"requires": [
+"has_accounts == true",
+"sends_email == true"
+],
+"tier": 1,
+"check": "password-reset route lacks rate limiting",
+"note": "corpus example \u2014 67,000 requests at 2am against one reset endpoint.",
+"sources": [
+"DakvEI-xDZ4"
+],
+"category": "authentication"
+},
+{
+"id": "AUTH-005",
+"title": "No email verification \u2014 anyone can register as anyone",
+"severity": "medium",
+"requires": [
+"has_accounts == true",
+"is_public == true"
+],
+"tier": 2,
+"sources": [
+"DZU1RKoT5Nc"
+],
+"category": "authentication"
+},
+{
+"id": "AUTH-006",
+"title": "No 2FA option for privileged accounts",
+"severity": "medium",
+"requires": [
+"has_admin_panel == true",
+"stage == production"
+],
+"tier": 2,
+"sources": [
+"DZU1RKoT5Nc",
+"DXrtdLeDIfy"
+],
+"category": "authentication"
+},
+{
+"id": "AUTH-007",
+"title": "Session not invalidated on logout",
+"severity": "high",
+"requires": [
+"has_accounts == true"
+],
+"tier": 2,
+"check": "logout clears client state only; token remains valid server-side",
+"note": "corpus test \u2014 'log out, paste the old URL back, are you still in?'",
+"sources": [
+"DY-mNQ_PGRh"
+],
+"category": "authentication"
+},
+{
+"id": "AUTH-008",
+"title": "Password stored without a modern KDF",
+"severity": "critical",
+"requires": [
+"stack.auth == custom"
+],
+"tier": 1,
+"check": "password hashing absent, or md5/sha1/sha256 without bcrypt/argon2/scrypt",
+"sources": [
+"DWKYy3tE-Vq"
+],
+"category": "authentication"
+},
+{
+"id": "AUTH-009",
+"title": "No credential-stuffing defence",
+"severity": "medium",
+"requires": [
+"has_accounts == true",
+"stage == production",
+"is_public == true"
+],
+"tier": 2,
+"check": "no breached-password check, no anomalous-login detection",
+"sources": [
+"DXrtdLeDIfy"
+],
+"category": "authentication"
+},
+{
+"id": "AUTH-010",
+"title": "SSH exposed to the internet without a VPN or bastion",
+"severity": "high",
+"requires": [
+"stack.host in [vps, aws, gcp]"
+],
+"tier": 2,
+"fix": "Tailscale / WireGuard / bastion; close port 22 publicly",
+"sources": [
+"DaITYf0IdHs"
+],
+"category": "authentication"
+},
+{
+"id": "AUTHZ-001",
+"title": "Supabase table with RLS disabled",
+"severity": "critical",
+"requires": [
+"stack.database == supabase",
+"has_accounts == true"
+],
+"tier": 1,
+"check": "table in migrations without ENABLE ROW LEVEL SECURITY",
+"note": "corpus calls this the single most common vulnerability found across startups AND enterprises. RLS is OFF by default for raw-SQL tables.",
+"sources": [
+"DXvKgfFJF7a",
+"DYsfrtjJ608",
+"DXrtdLeDIfy"
+],
+"category": "authorization"
+},
+{
+"id": "AUTHZ-002",
+"title": "RLS enabled but policy is permissive",
+"severity": "critical",
+"requires": [
+"stack.database == supabase",
+"has_accounts == true"
+],
+"tier": 2,
+"has_static_approximation": true,
+"check": "policy USING (true) or lacking an auth.uid() ownership predicate",
+"note": "reads as protected in the dashboard, is not. worse than RLS being off, because it produces false confidence.",
+"sources": [
+"DXvKgfFJF7a"
+],
+"category": "authorization"
+},
+{
+"id": "AUTHZ-003",
+"title": "IDOR \u2014 object accessed by ID without an ownership check",
+"severity": "critical",
+"requires": [
+"has_accounts == true"
+],
+"tier": 2,
+"has_static_approximation": true,
+"check": "route reads a path/query ID and queries by it without filtering on the session user",
+"note": "corpus test \u2014 'paste another user's URL into your browser, what happens?'",
+"sources": [
+"DY-mNQ_PGRh",
+"DWKYy3tE-Vq",
+"DXkMgEJERJg"
+],
+"category": "authorization"
+},
+{
+"id": "AUTHZ-004",
+"title": "Admin authorization enforced only in the UI",
+"severity": "critical",
+"requires": [
+"has_admin_panel == true"
+],
+"tier": 2,
+"has_static_approximation": true,
+"check": "admin route/component guarded client-side with no server-side role check",
+"sources": [
+"DaITYf0IdHs",
+"DZU1RKoT5Nc"
+],
+"category": "authorization"
+},
+{
+"id": "AUTHZ-005",
+"title": "Usage limits stored in a row the user can modify",
+"severity": "critical",
+"requires": [
+"calls_llm == true",
+"has_accounts == true"
+],
+"tier": 2,
+"has_static_approximation": true,
+"check": "quota/credit/token-limit column on a table the user has write access to",
+"note": "THE canonical AI-app breach in this corpus \u2014 a user cleared their own AI usage limit, and could have cleared everyone's. $10k exposure.",
+"sources": [
+"DXvKgfFJF7a",
+"DZ-AORszRRS"
+],
+"category": "authorization"
+},
+{
+"id": "AUTHZ-006",
+"title": "Missing tenant scope on a domain query",
+"severity": "critical",
+"requires": [
+"tenancy == multi-tenant-shared-db"
+],
+"tier": 2,
+"has_static_approximation": true,
+"check": "query against a tenant-scoped table without a tenant_id/org_id predicate",
+"gate_note": "SKIPPED for single-user apps \u2014 this is the rule that would tell WhatsApp it is missing Stories.",
+"sources": [
+"DXvKgfFJF7a"
+],
+"category": "authorization"
+},
+{
+"id": "AUTHZ-007",
+"title": "Tenant id taken from the request instead of the session",
+"severity": "critical",
+"requires": [
+"tenancy == multi-tenant-shared-db"
+],
+"tier": 2,
+"check": "org_id/tenant_id read from body, query, or header rather than the verified session",
+"sources": [],
+"category": "authorization"
+},
+{
+"id": "AUTHZ-008",
+"title": "Sensitive columns colocated with user-writable data",
+"severity": "high",
+"requires": [
+"has_accounts == true"
+],
+"tier": 2,
+"check": "credits/role/limits/is_admin on the same table the user can update",
+"note": "corpus \u2014 'he put the users in the same table as token management, so as he's counting, people can see it'",
+"sources": [
+"DZ-AORszRRS"
+],
+"category": "authorization"
+},
+{
+"id": "RATE-001",
+"title": "No rate limiting on any endpoint",
+"severity": "high",
+"requires": [
+"is_public == true"
+],
+"tier": 1,
+"check": "no rate-limit middleware, no gateway policy, no per-route limiter",
+"sources": [
+"DWNKkeHkTLF",
+"DXrtdLeDIfy",
+"DaFxeS7tBNf"
+],
+"category": "rate-limiting"
+},
+{
+"id": "RATE-002",
+"title": "Unauthenticated endpoint limited only per-user",
+"severity": "medium",
+"requires": [
+"is_public == true"
+],
+"tier": 2,
+"check": "rate limiter keys on user id for routes reachable before login",
+"note": "corpus correction from a security professional \u2014 on a public endpoint the caller has no identity yet, so user-based limiting does nothing. key on IP + fingerprint + global ceiling.",
+"sources": [
+"DZE5kabhdnI"
+],
+"category": "rate-limiting"
+},
+{
+"id": "RATE-003",
+"title": "No spend ceiling on paid-API endpoints",
+"severity": "critical",
+"requires": [
+"calls_llm == true"
+],
+"tier": 2,
+"has_static_approximation": true,
+"check": "no global daily/monthly cost cap enforced before calling the provider",
+"note": "corpus scenarios \u2014 $50,000 Anthropic bill, $20k AWS invoice, $4,000 overnight. a per-request rate limit does NOT bound total spend.",
+"sources": [
+"DY4xvIAAo-m",
+"DZ7qlTboUvg",
+"DYsfrtjJ608"
+],
+"category": "rate-limiting"
+},
+{
+"id": "RATE-004",
+"title": "No per-user quota on AI features",
+"severity": "high",
+"requires": [
+"calls_llm == true",
+"has_accounts == true"
+],
+"tier": 2,
+"has_static_approximation": true,
+"check": "no per-user token/request budget enforced server-side",
+"sources": [
+"DXvKgfFJF7a",
+"DYsfrtjJ608"
+],
+"category": "rate-limiting"
+},
+{
+"id": "RATE-005",
+"title": "Outbound email unthrottled",
+"severity": "high",
+"requires": [
+"sends_email == true"
+],
+"tier": 2,
+"check": "transactional email send has no per-user or global rate limit",
+"note": "corpus \u2014 a live attack creating fake users to spam a GDPR-request email endpoint. the author survived only because email was rate limited.",
+"sources": [
+"DZmTu7Kgr0W"
+],
+"category": "rate-limiting"
+},
+{
+"id": "RATE-006",
+"title": "No IP ban / blocklist mechanism",
+"severity": "medium",
+"requires": [
+"is_public == true",
+"stage == production"
+],
+"tier": 2,
+"note": "rate limiting slows an attacker; banning stops one. corpus author was mid-attack and had no way to block the source.",
+"sources": [
+"DZmTu7Kgr0W"
+],
+"category": "rate-limiting"
+},
+{
+"id": "RATE-007",
+"title": "No bot protection on signup",
+"severity": "medium",
+"requires": [
+"has_accounts == true",
+"is_public == true"
+],
+"tier": 2,
+"check": "no captcha / turnstile / proof-of-work on registration",
+"sources": [
+"DZmTu7Kgr0W",
+"DWKYy3tE-Vq"
+],
+"category": "rate-limiting"
+},
+{
+"id": "AI-001",
+"title": "User input reaches the system-prompt position",
+"severity": "critical",
+"requires": [
+"calls_llm == true",
+"llm_input_from_user == true"
+],
+"tier": 2,
+"has_static_approximation": true,
+"check": "request-derived string concatenated into the system role",
+"fix": "user content goes in the user turn, wrapped in explicit delimiters, never interpolated into system instructions",
+"sources": [
+"DYsfrtjJ608",
+"DaITYf0IdHs"
+],
+"category": "ai-safety"
+},
+{
+"id": "AI-002",
+"title": "No delimiting of untrusted content",
+"severity": "high",
+"requires": [
+"calls_llm == true",
+"llm_input_from_user == true"
+],
+"tier": 2,
+"check": "user or retrieved content injected into a prompt with no delimiter or instruction-hierarchy framing",
+"sources": [
+"DYsfrtjJ608"
+],
+"category": "ai-safety"
+},
+{
+"id": "AI-003",
+"title": "No max_tokens ceiling on completions",
+"severity": "high",
+"requires": [
+"calls_llm == true"
+],
+"tier": 1,
+"origin": "gap",
+"check": "provider call omits max_tokens, or sets it above the plan's economics",
+"note": "unbounded output is unbounded cost, per request.",
+"category": "ai-safety"
+},
+{
+"id": "AI-004",
+"title": "No model allowlist",
+"severity": "medium",
+"requires": [
+"calls_llm == true"
+],
+"tier": 1,
+"origin": "gap",
+"check": "model id derived from request input, or no constant/allowlist",
+"note": "a client-chosen model is a client-chosen price.",
+"category": "ai-safety"
+},
+{
+"id": "AI-005",
+"title": "No provider-side budget alert configured",
+"severity": "high",
+"requires": [
+"calls_llm == true",
+"stage == production"
+],
+"tier": 2,
+"origin": "gap",
+"note": "the last line of defence when application limits fail. every major provider offers it; almost nobody turns it on.",
+"category": "ai-safety"
+},
+{
+"id": "AI-006",
+"title": "LLM tool/function scope exceeds least privilege",
+"severity": "critical",
+"requires": [
+"calls_llm == true",
+"llm_tools_enabled == true"
+],
+"tier": 2,
+"origin": "gap",
+"check": "model-callable tools expose destructive or cross-tenant operations without a confirmation gate",
+"note": "prompt injection plus a delete tool is remote code execution with extra steps.",
+"sources": [
+"DaITYf0IdHs"
+],
+"category": "ai-safety"
+},
+{
+"id": "AI-007",
+"title": "Model output rendered as HTML without sanitisation",
+"severity": "critical",
+"requires": [
+"calls_llm == true",
+"surface in [web-app, web-site]"
+],
+"tier": 1,
+"origin": "gap",
+"check": "completion piped to dangerouslySetInnerHTML / v-html / innerHTML",
+"note": "injection in, XSS out.",
+"category": "ai-safety"
+},
+{
+"id": "AI-008",
+"title": "Model output used in a privileged operation without validation",
+"severity": "critical",
+"requires": [
+"calls_llm == true"
+],
+"tier": 2,
+"has_static_approximation": true,
+"origin": "gap",
+"check": "completion flows into a SQL string, shell command, file path, fetch URL, or eval",
+"category": "ai-safety"
+},
+{
+"id": "AI-009",
+"title": "No streaming timeout / runaway-generation guard",
+"severity": "medium",
+"requires": [
+"calls_llm == true"
+],
+"tier": 2,
+"origin": "gap",
+"check": "streamed completion with no abort signal or wall-clock bound",
+"category": "ai-safety"
+},
+{
+"id": "AI-010",
+"title": "Prompts and completions logged with user PII",
+"severity": "high",
+"requires": [
+"calls_llm == true",
+"data_sensitivity != none"
+],
+"tier": 2,
+"origin": "gap",
+"note": "prompt logs are the most-forgotten PII store in an AI app, and they are exactly what a GDPR deletion request has to reach.",
+"category": "ai-safety"
+},
+{
+"id": "AI-011",
+"title": "No retry/backoff on provider 429s",
+"severity": "medium",
+"requires": [
+"calls_llm == true",
+"stage == production"
+],
+"tier": 1,
+"origin": "gap",
+"category": "ai-safety"
+},
+{
+"id": "AI-012",
+"title": "Serverless host used for long-running agent work",
+"severity": "high",
+"requires": [
+"calls_llm == true",
+"stack.host in [vercel, netlify]"
+],
+"tier": 2,
+"check": "agent loop or multi-minute generation on a function with a hard timeout",
+"note": "corpus makes this claim loudly. it is correct for long-running agents and wrong for simple completions \u2014 gate on actual expected duration, and warn rather than fail.",
+"sources": [
+"DYfCwY4NUFm"
+],
+"category": "ai-safety"
+},
+{
+"id": "AI-013",
+"title": "No cost attribution per user or tenant",
+"severity": "medium",
+"requires": [
+"calls_llm == true",
+"business_model in [b2b-saas, b2c, marketplace]"
+],
+"tier": 2,
+"origin": "gap",
+"note": "without it you cannot tell abuse from success, or price the product.",
+"category": "ai-safety"
+},
+{
+"id": "PAY-001",
+"title": "Webhook signature not verified",
+"severity": "critical",
+"requires": [
+"handles_payments != none",
+"has_webhooks_in == true"
+],
+"tier": 1,
+"check": "webhook route parses the body without constructEvent / signature check",
+"note": "an unverified webhook endpoint is an unauthenticated 'mark this order paid' API.",
+"sources": [
+"DY1g56bk9_o"
+],
+"category": "payments"
+},
+{
+"id": "PAY-002",
+"title": "No idempotency key on charge creation",
+"severity": "high",
+"requires": [
+"handles_payments in [stripe, paddle, lemonsqueezy]"
+],
+"tier": 2,
+"check": "payment intent created without a client-generated idempotency key",
+"note": "corpus \u2014 a Wi-Fi hiccup plus a retry equals a duplicate charge.",
+"sources": [
+"DY1g56bk9_o"
+],
+"category": "payments"
+},
+{
+"id": "PAY-003",
+"title": "Webhook events not deduplicated by event id",
+"severity": "high",
+"requires": [
+"handles_payments != none",
+"has_webhooks_in == true"
+],
+"tier": 2,
+"check": "no processed-event table / unique constraint on provider event id",
+"sources": [
+"DY1g56bk9_o"
+],
+"category": "payments"
+},
+{
+"id": "PAY-004",
+"title": "Payment state overwritten in place instead of appended",
+"severity": "medium",
+"requires": [
+"handles_payments != none"
+],
+"tier": 2,
+"check": "single mutable status column updated per event, no ledger table",
+"note": "corpus \u2014 'the moment a regulator or finance person asks what happened on this payment, you've got nothing.' also breaks on out-of-order events.",
+"sources": [
+"DY1g56bk9_o"
+],
+"category": "payments"
+},
+{
+"id": "PAY-005",
+"title": "Entitlement derived from an API poll rather than webhook state",
+"severity": "high",
+"requires": [
+"has_subscriptions == true"
+],
+"tier": 2,
+"check": "subscription status read by calling the provider API at request time, or updated only on the checkout return path",
+"note": "corpus \u2014 pull model guarantees your DB and the provider drift, and users get charged the wrong amount.",
+"sources": [
+"DYTwl74My3S"
+],
+"category": "payments"
+},
+{
+"id": "PAY-006",
+"title": "Price or amount accepted from the client",
+"severity": "critical",
+"requires": [
+"handles_payments != none"
+],
+"tier": 1,
+"check": "amount/price/currency read from the request body when creating a charge",
+"category": "payments"
+},
+{
+"id": "PAY-007",
+"title": "No handling for out-of-order webhook delivery",
+"severity": "medium",
+"requires": [
+"handles_payments != none",
+"has_webhooks_in == true"
+],
+"tier": 2,
+"check": "state machine assumes chronological arrival",
+"sources": [
+"DY1g56bk9_o"
+],
+"category": "payments"
+},
+{
+"id": "PAY-008",
+"title": "App Store subscription prerequisites incomplete",
+"severity": "high",
+"requires": [
+"surface in [mobile-ios]",
+"has_subscriptions == true"
+],
+"tier": 2,
+"check": "paid apps agreement unsigned, terms of use absent from description, subscriptions not approved",
+"note": "corpus \u2014 four consecutive rejections over exactly these.",
+"sources": [
+"DXez-ZWkRgl"
+],
+"category": "payments"
+},
+{
+"id": "DATA-001",
+"title": "Unbounded list query \u2014 no pagination",
+"severity": "high",
+"requires": [
+"stack.database != none"
+],
+"tier": 1,
+"check": "list endpoint without limit/offset or cursor",
+"note": "corpus \u2014 fine at 50 users, loads 50,000 rows at 500.",
+"sources": [
+"DaDPJM4x1qM"
+],
+"category": "data-and-scale"
+},
+{
+"id": "DATA-002",
+"title": "N+1 query pattern",
+"severity": "high",
+"requires": [
+"stack.database != none"
+],
+"tier": 2,
+"check": "query inside a loop over a prior result set",
+"sources": [
+"DaDPJM4x1qM"
+],
+"category": "data-and-scale"
+},
+{
+"id": "DATA-003",
+"title": "Missing index on a filtered or joined column",
+"severity": "high",
+"requires": [
+"stack.database in [postgres, supabase, mysql, planetscale]"
+],
+"tier": 1,
+"check": "WHERE / JOIN / ORDER BY column with no index in migrations",
+"note": "50ms at 100 rows, 30s at 100k. the code never changed.",
+"sources": [
+"DaDPJM4x1qM",
+"DXwtOTDA-gx"
+],
+"category": "data-and-scale"
+},
+{
+"id": "DATA-004",
+"title": "No connection pooling",
+"severity": "high",
+"requires": [
+"stack.database in [postgres, supabase, mysql]",
+"stack.host in [vercel, netlify, cloudflare]"
+],
+"tier": 1,
+"note": "serverless multiplies connections per invocation; the DB runs out first.",
+"sources": [
+"DaDPJM4x1qM"
+],
+"category": "data-and-scale"
+},
+{
+"id": "DATA-005",
+"title": "SELECT * on wide or hot tables",
+"severity": "medium",
+"requires": [
+"stack.database != none"
+],
+"tier": 1,
+"sources": [
+"DaDPJM4x1qM"
+],
+"category": "data-and-scale"
+},
+{
+"id": "DATA-006",
+"title": "No server-side input validation",
+"severity": "critical",
+"requires": [],
+"tier": 2,
+"check": "route handler consumes request body without a schema validator",
+"note": "client-side validation is a UX feature, not a control.",
+"sources": [
+"DXkMgEJERJg",
+"DWNKkeHkTLF"
+],
+"category": "data-and-scale"
+},
+{
+"id": "DATA-007",
+"title": "Raw SQL built by string concatenation",
+"severity": "critical",
+"requires": [
+"stack.orm == raw-sql"
+],
+"tier": 1,
+"check": "query string interpolating a request value",
+"sources": [
+"DY7TIvBI68X"
+],
+"category": "data-and-scale"
+},
+{
+"id": "DATA-008",
+"title": "No payload size limit",
+"severity": "medium",
+"requires": [
+"is_public == true"
+],
+"tier": 1,
+"check": "body parser without a size cap",
+"sources": [
+"DWNKkeHkTLF"
+],
+"category": "data-and-scale"
+},
+{
+"id": "DATA-009",
+"title": "Text columns not 4-byte-safe",
+"severity": "medium",
+"requires": [
+"stack.database in [mysql, planetscale]"
+],
+"tier": 1,
+"check": "utf8 rather than utf8mb4 on user-facing text columns",
+"note": "corpus failure \u2014 a user typed an emoji and the app crashed. 3-byte utf8 cannot hold a 4-byte codepoint.",
+"sources": [
+"DZvckc0vkKr"
+],
+"category": "data-and-scale"
+},
+{
+"id": "DATA-010",
+"title": "No load test before launch",
+"severity": "medium",
+"requires": [
+"stage == pre-launch",
+"expected_scale != hobby"
+],
+"tier": 2,
+"sources": [
+"DXwtOTDA-gx"
+],
+"category": "data-and-scale"
+},
+{
+"id": "DATA-011",
+"title": "Heavy work performed synchronously in the request path",
+"severity": "medium",
+"requires": [
+"sends_email == true or has_file_uploads == true"
+],
+"tier": 2,
+"check": "email send / report generation / image processing inline in a handler",
+"sources": [
+"DXwtOTDA-gx"
+],
+"category": "data-and-scale"
+},
+{
+"id": "DATA-012",
+"title": "No backup or restore procedure",
+"severity": "critical",
+"requires": [
+"stage == production",
+"stack.database != none"
+],
+"tier": 2,
+"origin": "gap",
+"note": "absent from all 73 reels. the highest-consequence omission in the corpus.",
+"category": "data-and-scale"
+},
+{
+"id": "DATA-013",
+"title": "Uploaded files served without authorization",
+"severity": "critical",
+"requires": [
+"has_file_uploads == true",
+"has_accounts == true"
+],
+"tier": 2,
+"check": "storage bucket public, or file URLs unguessable-but-unauthenticated",
+"note": "matches the user's own CRMini finding \u2014 files reachable without login.",
+"origin": "gap",
+"category": "data-and-scale"
+},
+{
+"id": "DATA-014",
+"title": "User uploads stored on ephemeral disk",
+"severity": "critical",
+"requires": [
+"has_file_uploads == true",
+"stack.host in [vercel, netlify, railway, fly, render]"
+],
+"tier": 1,
+"check": "writes to local fs on a platform with an ephemeral filesystem",
+"note": "matches CRMini \u2014 files vanish on every redeploy.",
+"origin": "gap",
+"category": "data-and-scale"
+},
+{
+"id": "INF-001",
+"title": "Single instance with no redundancy",
+"severity": "medium",
+"requires": [
+"stage == production",
+"expected_scale in [under-100k, over-100k]",
+"stack.host in [vps, aws, gcp]"
+],
+"tier": 2,
+"gate_note": "SKIPPED below 1k users. The source reel is explicit \u2014 'for a side project Kubernetes is definitely overkill.' Firing this on a hobby app is the WhatsApp-Stories failure.",
+"sources": [
+"DYyNL2XBVJ2",
+"DYXjWK0jRVQ"
+],
+"category": "infrastructure"
+},
+{
+"id": "INF-002",
+"title": "No health check or auto-restart",
+"severity": "medium",
+"requires": [
+"stage == production",
+"stack.host in [vps, aws, gcp]"
+],
+"tier": 1,
+"sources": [
+"DYyNL2XBVJ2"
+],
+"category": "infrastructure"
+},
+{
+"id": "INF-003",
+"title": "No horizontal scaling path",
+"severity": "low",
+"requires": [
+"expected_scale == over-100k"
+],
+"tier": 2,
+"sources": [
+"DYyNL2XBVJ2",
+"DYXjWK0jRVQ"
+],
+"category": "infrastructure"
+},
+{
+"id": "INF-004",
+"title": "Deploy causes downtime",
+"severity": "low",
+"requires": [
+"stage == production",
+"expected_scale != hobby"
+],
+"tier": 2,
+"sources": [
+"DYyNL2XBVJ2"
+],
+"category": "infrastructure"
+},
+{
+"id": "INF-005",
+"title": "No API gateway / single ingress with shared policy",
+"severity": "low",
+"requires": [
+"expected_scale == over-100k"
+],
+"tier": 2,
+"note": "correct at many services; pure ceremony for one Next.js app.",
+"sources": [
+"DaFxeS7tBNf"
+],
+"category": "infrastructure"
+},
+{
+"id": "INF-006",
+"title": "HTTPS not enforced",
+"severity": "high",
+"requires": [
+"is_public == true"
+],
+"tier": 1,
+"check": "no HSTS, no http->https redirect",
+"sources": [
+"DWKYy3tE-Vq"
+],
+"category": "infrastructure"
+},
+{
+"id": "INF-007",
+"title": "Permissive CORS",
+"severity": "high",
+"requires": [
+"surface in [web-app, api-only]"
+],
+"tier": 1,
+"check": "Access-Control-Allow-Origin: * on credentialed routes",
+"origin": "gap",
+"category": "infrastructure"
+},
+{
+"id": "INF-008",
+"title": "Database reachable from the public internet",
+"severity": "critical",
+"requires": [
+"stack.database != none",
+"stack.host in [vps, aws, gcp]"
+],
+"tier": 2,
+"sources": [
+"DWKYy3tE-Vq"
+],
+"category": "infrastructure"
+},
+{
+"id": "INF-009",
+"title": "Release build config diverges from debug",
+"severity": "high",
+"requires": [
+"surface in [mobile-ios, mobile-android]"
+],
+"tier": 2,
+"note": "corpus \u2014 shipped app rejected because sign-in only worked in debug.",
+"sources": [
+"DXez-ZWkRgl"
+],
+"category": "infrastructure"
+},
+{
+"id": "INF-010",
+"title": "No DNS / domain-hijack protection",
+"severity": "medium",
+"requires": [
+"is_public == true",
+"stage == production"
+],
+"tier": 2,
+"check": "registrar lock off, no DNSSEC, no monitoring of NS/A record changes",
+"note": "corpus case \u2014 hijacked domain cloaked redirects to Googlebot only, silently transferring the site's authority for months.",
+"sources": [
+"DUrp9swjYA5"
+],
+"category": "infrastructure"
+},
+{
+"id": "INF-011",
+"title": "No staging environment",
+"severity": "low",
+"requires": [
+"stage == production",
+"business_model in [b2b-saas, marketplace]"
+],
+"tier": 2,
+"origin": "gap",
+"category": "infrastructure"
+},
+{
+"id": "LEG-001",
+"title": "No privacy policy while collecting personal data",
+"severity": "high",
+"requires": [
+"data_sensitivity != none",
+"is_public == true"
+],
+"tier": 1,
+"note": "corpus is emphatic \u2014 a single contact form collecting an email is already personal data.",
+"sources": [
+"DY8VOOYBjFx",
+"DYwx1b8TDAc",
+"DaFyRMSMj7E"
+],
+"category": "legal"
+},
+{
+"id": "LEG-002",
+"title": "Cookie consent missing or non-compliant",
+"severity": "high",
+"requires": [
+"collects_analytics == true",
+"jurisdictions includes any of [eu, uk]"
+],
+"tier": 2,
+"check": "no consent UI, or analytics fires before consent, or no genuine reject option",
+"note": "corpus \u2014 'a basic we-use-cookies popup isn't enough, you must let people choose and only track after yes.'",
+"sources": [
+"DY8VOOYBjFx"
+],
+"category": "legal"
+},
+{
+"id": "LEG-003",
+"title": "No terms of service",
+"severity": "medium",
+"requires": [
+"is_public == true",
+"has_accounts == true"
+],
+"tier": 1,
+"sources": [
+"DYwx1b8TDAc"
+],
+"category": "legal"
+},
+{
+"id": "LEG-004",
+"title": "No data deletion path",
+"severity": "high",
+"requires": [
+"data_sensitivity != none",
+"jurisdictions includes any of [eu, uk, ca]"
+],
+"tier": 2,
+"note": "must reach prompt/completion logs too \u2014 see AI-010.",
+"sources": [
+"DY8VOOYBjFx"
+],
+"category": "legal"
+},
+{
+"id": "LEG-005",
+"title": "Consent checkbox absent on collection forms",
+"severity": "medium",
+"requires": [
+"data_sensitivity != none",
+"jurisdictions includes any of [eu, ru, kz]"
+],
+"tier": 2,
+"sources": [
+"DaFyRMSMj7E"
+],
+"category": "legal"
+},
+{
+"id": "LEG-006",
+"title": "Accessibility baseline unmet",
+"severity": "medium",
+"requires": [
+"surface in [web-app, web-site]",
+"is_public == true"
+],
+"tier": 1,
+"check": "missing alt text, insufficient contrast, no heading hierarchy, unlabelled controls",
+"note": "corpus flags active litigation risk in US and AU.",
+"sources": [
+"DY8VOOYBjFx"
+],
+"category": "legal"
+},
+{
+"id": "LEG-007",
+"title": "App name not checked against existing trademarks",
+"severity": "medium",
+"requires": [
+"stage in [pre-launch, production]",
+"business_model != hobby"
+],
+"tier": 2,
+"sources": [
+"DYwx1b8TDAc",
+"DZ5R87lTGMS"
+],
+"category": "legal"
+},
+{
+"id": "LEG-008",
+"title": "Data collection not declared for store submission",
+"severity": "high",
+"requires": [
+"surface in [mobile-ios, mobile-android]"
+],
+"tier": 2,
+"sources": [
+"DYwx1b8TDAc"
+],
+"category": "legal"
+},
+{
+"id": "LEG-009",
+"title": "Local data-protection registration not addressed",
+"severity": "medium",
+"requires": [
+"data_sensitivity != none",
+"jurisdictions includes any of [ru, kz, other]"
+],
+"tier": 2,
+"note": "corpus documents RU fines from \u20bd30k-500k for a missing policy alone. Non-EU jurisdictions each carry their own registration and localisation duties \u2014 do not assume GDPR compliance covers them.",
+"sources": [
+"DaFyRMSMj7E"
+],
+"category": "legal"
+},
+{
+"id": "LEG-010",
+"title": "Third-party assets used without a license",
+"severity": "medium",
+"requires": [
+"is_public == true"
+],
+"tier": 2,
+"check": "fonts, images, icons with no license record",
+"sources": [
+"DaFyRMSMj7E"
+],
+"category": "legal"
+},
+{
+"id": "OBS-001",
+"title": "No error monitoring",
+"severity": "high",
+"requires": [
+"stage == production"
+],
+"tier": 1,
+"origin": "gap",
+"category": "observability"
+},
+{
+"id": "OBS-002",
+"title": "Security-relevant events not logged",
+"severity": "medium",
+"requires": [
+"has_accounts == true",
+"stage == production"
+],
+"tier": 2,
+"check": "no log of failed logins, authz denials, or rate-limit trips",
+"note": "without these you cannot tell you are being attacked. corpus author only discovered a live attack by accident.",
+"sources": [
+"DWKYy3tE-Vq",
+"DZmTu7Kgr0W"
+],
+"category": "observability"
+},
+{
+"id": "OBS-003",
+"title": "No product analytics",
+"severity": "low",
+"requires": [
+"stage in [pre-launch, production]",
+"business_model != internal-tool"
+],
+"tier": 1,
+"sources": [
+"DXedxTZjrBy",
+"DZzunydsqWq"
+],
+"category": "observability"
+},
+{
+"id": "OBS-004",
+"title": "No uptime monitoring or alerting",
+"severity": "medium",
+"requires": [
+"stage == production"
+],
+"tier": 2,
+"note": "corpus \u2014 app down over six hours overnight, nobody watching.",
+"sources": [
+"DYyNL2XBVJ2"
+],
+"category": "observability"
+},
+{
+"id": "UX-001",
+"title": "No loading state",
+"severity": "medium",
+"requires": [
+"surface in [web-app, mobile-ios, mobile-android]"
+],
+"tier": 2,
+"sources": [
+"DYc6sGNMuow"
+],
+"category": "ux-readiness"
+},
+{
+"id": "UX-002",
+"title": "No error state \u2014 raw stack trace or blank page on failure",
+"severity": "high",
+"requires": [
+"surface in [web-app, mobile-ios, mobile-android]"
+],
+"tier": 2,
+"note": "a stack trace in the browser is both a UX failure and an information leak.",
+"sources": [
+"DYc6sGNMuow"
+],
+"category": "ux-readiness"
+},
+{
+"id": "UX-003",
+"title": "No empty state",
+"severity": "low",
+"requires": [
+"surface in [web-app, mobile-ios, mobile-android]"
+],
+"tier": 2,
+"sources": [
+"DYc6sGNMuow"
+],
+"category": "ux-readiness"
+},
+{
+"id": "UX-004",
+"title": "No onboarding path to first value",
+"severity": "low",
+"requires": [
+"stage in [pre-launch, production]",
+"business_model in [b2c, b2b-saas]"
+],
+"tier": 2,
+"sources": [
+"DXedxTZjrBy",
+"DZzunydsqWq"
+],
+"category": "ux-readiness"
+},
+{
+"id": "UX-005",
+"title": "No social preview image",
+"severity": "low",
+"requires": [
+"is_public == true",
+"surface in [web-app, web-site]"
+],
+"tier": 1,
+"sources": [
+"DZzunydsqWq"
+],
+"category": "ux-readiness"
+},
+{
+"id": "UX-006",
+"title": "No sitemap.xml / not indexable",
+"severity": "low",
+"requires": [
+"is_public == true",
+"surface == web-site"
+],
+"tier": 1,
+"sources": [
+"DZzunydsqWq",
+"DZ5Rw-RsmpP"
+],
+"category": "ux-readiness"
+},
+{
+"id": "AIOP-001",
+"title": "No fallback when the model provider is down",
+"severity": "high",
+"requires": [
+"calls_llm == true",
+"stage == production"
+],
+"tier": 2,
+"origin": "gap",
+"note": "a single-provider dependency makes their outage your outage.",
+"category": "ai-operations"
+},
+{
+"id": "AIOP-002",
+"title": "Model id pinned to an alias that can silently change",
+"severity": "medium",
+"requires": [
+"calls_llm == true",
+"stage == production"
+],
+"tier": 1,
+"origin": "gap",
+"note": "floating aliases shift behaviour and price under you with no deploy.",
+"category": "ai-operations"
+},
+{
+"id": "AIOP-003",
+"title": "No handling for model deprecation",
+"severity": "medium",
+"requires": [
+"calls_llm == true",
+"stage == production"
+],
+"tier": 2,
+"origin": "gap",
+"category": "ai-operations"
+},
+{
+"id": "AIOP-004",
+"title": "Prompt caching unused on a repeated system prompt",
+"severity": "low",
+"requires": [
+"calls_llm == true",
+"stage == production"
+],
+"tier": 2,
+"origin": "gap",
+"note": "a pure cost rule \u2014 large static prefixes re-billed on every call.",
+"category": "ai-operations"
+},
+{
+"id": "AIOP-005",
+"title": "Context window overflow unhandled",
+"severity": "high",
+"requires": [
+"calls_llm == true"
+],
+"tier": 2,
+"origin": "gap",
+"check": "conversation or document appended to a prompt with no token accounting",
+"category": "ai-operations"
+},
+{
+"id": "AIOP-006",
+"title": "No output validation against an expected schema",
+"severity": "high",
+"requires": [
+"calls_llm == true"
+],
+"tier": 2,
+"origin": "gap",
+"check": "completion parsed as JSON without schema validation or a retry path",
+"category": "ai-operations"
+},
+{
+"id": "AIOP-007",
+"title": "Retrieved documents not trust-separated from instructions",
+"severity": "critical",
+"requires": [
+"has_rag == true"
+],
+"tier": 2,
+"origin": "gap",
+"note": "indirect prompt injection \u2014 the attacker writes the document, not the message.",
+"category": "ai-operations"
+},
+{
+"id": "AIOP-008",
+"title": "Vector store not tenant-scoped",
+"severity": "critical",
+"requires": [
+"has_rag == true",
+"tenancy == multi-tenant-shared-db"
+],
+"tier": 2,
+"origin": "gap",
+"note": "embeddings leak across tenants exactly as rows do, and nobody puts RLS on them.",
+"category": "ai-operations"
+},
+{
+"id": "AIOP-009",
+"title": "Embedding model changed without reindexing",
+"severity": "medium",
+"requires": [
+"has_rag == true"
+],
+"tier": 2,
+"origin": "gap",
+"category": "ai-operations"
+},
+{
+"id": "AIOP-010",
+"title": "Agent loop has no iteration ceiling",
+"severity": "critical",
+"requires": [
+"llm_tools_enabled == true"
+],
+"tier": 1,
+"origin": "gap",
+"note": "an unbounded loop is an unbounded invoice.",
+"category": "ai-operations"
+},
+{
+"id": "AIOP-011",
+"title": "Agent tool results not size-bounded",
+"severity": "high",
+"requires": [
+"llm_tools_enabled == true"
+],
+"tier": 2,
+"origin": "gap",
+"category": "ai-operations"
+},
+{
+"id": "AIOP-012",
+"title": "No human confirmation on destructive agent tools",
+"severity": "critical",
+"requires": [
+"llm_tools_enabled == true"
+],
+"tier": 2,
+"origin": "gap",
+"category": "ai-operations"
+},
+{
+"id": "AIOP-013",
+"title": "No eval set for prompt changes",
+"severity": "medium",
+"requires": [
+"calls_llm == true",
+"stage == production"
+],
+"tier": 2,
+"origin": "gap",
+"note": "without evals a prompt edit is an untested deploy to your core logic.",
+"category": "ai-operations"
+},
+{
+"id": "AIOP-014",
+"title": "No AI usage dashboard for the operator",
+"severity": "medium",
+"requires": [
+"calls_llm == true",
+"stage == production"
+],
+"tier": 2,
+"origin": "gap",
+"category": "ai-operations"
+},
+{
+"id": "AIOP-015",
+"title": "AI features not degradable under cost pressure",
+"severity": "medium",
+"requires": [
+"calls_llm == true",
+"business_model in [b2c, b2b-saas]"
+],
+"tier": 2,
+"origin": "gap",
+"note": "when the budget cap trips, the product should degrade, not 500.",
+"category": "ai-operations"
+},
+{
+"id": "AIOP-016",
+"title": "User-facing AI errors leak provider internals",
+"severity": "medium",
+"requires": [
+"calls_llm == true"
+],
+"tier": 1,
+"origin": "gap",
+"category": "ai-operations"
+},
+{
+"id": "AIOP-017",
+"title": "No content moderation on model output",
+"severity": "medium",
+"requires": [
+"calls_llm == true",
+"is_public == true",
+"business_model == b2c"
+],
+"tier": 2,
+"origin": "gap",
+"category": "ai-operations"
+},
+{
+"id": "AIOP-018",
+"title": "Free tier allows unauthenticated AI calls",
+"severity": "critical",
+"requires": [
+"calls_llm == true",
+"is_public == true"
+],
+"tier": 2,
+"has_static_approximation": true,
+"origin": "gap",
+"note": "an unauthenticated LLM endpoint is a public API on your credit card.",
+"category": "ai-operations"
+},
+{
+"id": "AIOP-019",
+"title": "Streaming responses not cancelled on client disconnect",
+"severity": "medium",
+"requires": [
+"calls_llm == true"
+],
+"tier": 2,
+"origin": "gap",
+"note": "you keep paying for tokens nobody will read.",
+"category": "ai-operations"
+},
+{
+"id": "AIOP-020",
+"title": "Temperature or sampling unset for a deterministic task",
+"severity": "low",
+"requires": [
+"calls_llm == true"
+],
+"tier": 1,
+"origin": "gap",
+"category": "ai-operations"
+},
+{
+"id": "DEP-001",
+"title": "Secrets injected at build time instead of runtime",
+"severity": "high",
+"requires": [
+"stage in [pre-launch, production]"
+],
+"tier": 1,
+"note": "build-time inlining bakes the value into the artifact; rotation needs a rebuild.",
+"category": "deployment"
+},
+{
+"id": "DEP-002",
+"title": "Secrets present in CI logs or config",
+"severity": "critical",
+"requires": [
+"has_ci == true"
+],
+"tier": 1,
+"check": "plaintext credential in workflow yaml, or echoed to build output",
+"category": "deployment"
+},
+{
+"id": "DEP-003",
+"title": "No environment parity between local and production",
+"severity": "medium",
+"requires": [
+"stage in [pre-launch, production]"
+],
+"tier": 2,
+"check": "env vars referenced in code with no documented required set",
+"note": "corpus case \u2014 an iOS release build was missing config the debug build had, and the app shipped broken.",
+"sources": [
+"DXez-ZWkRgl"
+],
+"category": "deployment"
+},
+{
+"id": "DEP-004",
+"title": "Migrations not run as part of deploy",
+"severity": "high",
+"requires": [
+"has_migrations == true",
+"stage == production"
+],
+"tier": 2,
+"category": "deployment"
+},
+{
+"id": "DEP-005",
+"title": "Migrations are not reversible",
+"severity": "medium",
+"requires": [
+"has_migrations == true",
+"stage == production"
+],
+"tier": 1,
+"category": "deployment"
+},
+{
+"id": "DEP-006",
+"title": "Destructive migration without a backfill plan",
+"severity": "critical",
+"requires": [
+"has_migrations == true",
+"stage == production"
+],
+"tier": 2,
+"check": "DROP COLUMN / DROP TABLE / NOT NULL added in a single step",
+"category": "deployment"
+},
+{
+"id": "DEP-007",
+"title": "No rollback path",
+"severity": "high",
+"requires": [
+"stage == production"
+],
+"tier": 2,
+"category": "deployment"
+},
+{
+"id": "DEP-008",
+"title": "No health endpoint",
+"severity": "medium",
+"requires": [
+"stage == production",
+"surface in [web-app, api-only]"
+],
+"tier": 1,
+"category": "deployment"
+},
+{
+"id": "DEP-009",
+"title": "No graceful shutdown handling",
+"severity": "medium",
+"requires": [
+"stage == production",
+"has_background_jobs == true"
+],
+"tier": 1,
+"check": "no SIGTERM handler draining in-flight work",
+"category": "deployment"
+},
+{
+"id": "DEP-010",
+"title": "Dependencies unpinned",
+"severity": "medium",
+"requires": [
+"stage in [pre-launch, production]"
+],
+"tier": 1,
+"check": "no lockfile committed, or ranges in a deployed manifest",
+"category": "deployment"
+},
+{
+"id": "DEP-011",
+"title": "Known-vulnerable dependencies",
+"severity": "high",
+"requires": [],
+"tier": 1,
+"check": "audit surfaces advisories at high or critical",
+"category": "deployment"
+},
+{
+"id": "DEP-012",
+"title": "Abandoned dependency in a security-relevant path",
+"severity": "medium",
+"requires": [
+"stage == production"
+],
+"tier": 2,
+"category": "deployment"
+},
+{
+"id": "DEP-013",
+"title": "Third-party script loaded without integrity check",
+"severity": "medium",
+"requires": [
+"surface in [web-app, web-site]",
+"is_public == true"
+],
+"tier": 1,
+"check": "external <script> without SRI",
+"category": "deployment"
+},
+{
+"id": "DEP-014",
+"title": "Source maps published in production",
+"severity": "medium",
+"requires": [
+"surface in [web-app, web-site]",
+"stage == production"
+],
+"tier": 1,
+"category": "deployment"
+},
+{
+"id": "DEP-015",
+"title": "Debug mode or verbose errors enabled in production",
+"severity": "high",
+"requires": [
+"stage == production"
+],
+"tier": 1,
+"category": "deployment"
+},
+{
+"id": "DEP-016",
+"title": "No CI check gating merges",
+"severity": "low",
+"requires": [
+"has_ci == true",
+"business_model in [b2b-saas, marketplace]"
+],
+"tier": 1,
+"category": "deployment"
+},
+{
+"id": "DEP-017",
+"title": "Build not reproducible from a clean checkout",
+"severity": "medium",
+"requires": [
+"stage in [pre-launch, production]"
+],
+"tier": 2,
+"check": "build depends on untracked local files or manual steps",
+"category": "deployment"
+},
+{
+"id": "DEP-018",
+"title": "No documented restore drill",
+"severity": "high",
+"requires": [
+"stage == production",
+"stack.database != none"
+],
+"tier": 2,
+"note": "an untested backup is a belief, not a backup.",
+"category": "deployment"
+},
+{
+"id": "RU-001",
+"title": "Timestamps stored without timezone",
+"severity": "high",
+"requires": [
+"stack.database != none"
+],
+"tier": 1,
+"check": "timestamp column without time zone, or naive datetime written from app code",
+"note": "works perfectly until your second user is in another country.",
+"category": "real-user-readiness"
+},
+{
+"id": "RU-002",
+"title": "Dates rendered in server locale rather than the viewer's",
+"severity": "medium",
+"requires": [
+"surface in [web-app, mobile-ios, mobile-android]"
+],
+"tier": 2,
+"category": "real-user-readiness"
+},
+{
+"id": "RU-003",
+"title": "Money stored as float",
+"severity": "critical",
+"requires": [
+"handles_payments != none or serves_currency == multi"
+],
+"tier": 1,
+"check": "float/double/real column holding an amount",
+"note": "rounding error in currency is a correctness bug, not a style issue.",
+"category": "real-user-readiness"
+},
+{
+"id": "RU-004",
+"title": "Currency not stored alongside amount",
+"severity": "high",
+"requires": [
+"serves_currency == multi"
+],
+"tier": 1,
+"category": "real-user-readiness"
+},
+{
+"id": "RU-005",
+"title": "Name and address fields assume a Western format",
+"severity": "low",
+"requires": [
+"data_sensitivity != none",
+"audience_locale == multi"
+],
+"tier": 2,
+"category": "real-user-readiness"
+},
+{
+"id": "RU-006",
+"title": "Text input not accepting the full Unicode range",
+"severity": "high",
+"requires": [
+"stack.database != none"
+],
+"tier": 1,
+"note": "corpus \u2014 an emoji crashed a production app because the column was 3-byte utf8.",
+"sources": [
+"DZvckc0vkKr"
+],
+"category": "real-user-readiness"
+},
+{
+"id": "RU-007",
+"title": "No mobile viewport handling",
+"severity": "high",
+"requires": [
+"surface in [web-app, web-site]",
+"is_public == true"
+],
+"tier": 1,
+"category": "real-user-readiness"
+},
+{
+"id": "RU-008",
+"title": "No offline or flaky-network handling",
+"severity": "medium",
+"requires": [
+"surface in [mobile-ios, mobile-android]"
+],
+"tier": 2,
+"category": "real-user-readiness"
+},
+{
+"id": "RU-009",
+"title": "Destructive action without confirmation or undo",
+"severity": "medium",
+"requires": [
+"has_accounts == true"
+],
+"tier": 2,
+"category": "real-user-readiness"
+},
+{
+"id": "RU-010",
+"title": "No support or contact channel",
+"severity": "medium",
+"requires": [
+"is_public == true",
+"stage == production"
+],
+"tier": 1,
+"category": "real-user-readiness"
+},
+{
+"id": "RU-011",
+"title": "Transactional email lacks SPF/DKIM/DMARC",
+"severity": "high",
+"requires": [
+"sends_email == true",
+"stage == production"
+],
+"tier": 2,
+"note": "without these your password resets land in spam and the account is unrecoverable.",
+"category": "real-user-readiness"
+},
+{
+"id": "RU-012",
+"title": "No bounce or complaint handling",
+"severity": "medium",
+"requires": [
+"sends_email == true",
+"stage == production"
+],
+"tier": 2,
+"category": "real-user-readiness"
+},
+{
+"id": "RU-013",
+"title": "Marketing email without an unsubscribe path",
+"severity": "high",
+"requires": [
+"sends_email == true",
+"is_public == true"
+],
+"tier": 1,
+"category": "real-user-readiness"
+},
+{
+"id": "RU-014",
+"title": "User-supplied content in an email template unescaped",
+"severity": "high",
+"requires": [
+"sends_email == true"
+],
+"tier": 2,
+"category": "real-user-readiness"
+},
+{
+"id": "RU-015",
+"title": "No account deletion path",
+"severity": "high",
+"requires": [
+"has_accounts == true",
+"stage == production"
+],
+"tier": 2,
+"category": "real-user-readiness"
+},
+{
+"id": "RU-016",
+"title": "Email change not verified on both addresses",
+"severity": "high",
+"requires": [
+"has_accounts == true"
+],
+"tier": 2,
+"note": "a classic account-takeover route.",
+"category": "real-user-readiness"
+},
+{
+"id": "RU-017",
+"title": "Password change does not invalidate other sessions",
+"severity": "high",
+"requires": [
+"has_accounts == true",
+"stack.auth == custom"
+],
+"tier": 2,
+"category": "real-user-readiness"
+},
+{
+"id": "RU-018",
+"title": "No rate limit on account enumeration surfaces",
+"severity": "medium",
+"requires": [
+"has_accounts == true",
+"is_public == true"
+],
+"tier": 2,
+"check": "login/reset/signup responses distinguish existing from non-existing accounts",
+"category": "real-user-readiness"
+},
+{
+"id": "RU-019",
+"title": "Session lifetime unbounded",
+"severity": "medium",
+"requires": [
+"has_accounts == true"
+],
+"tier": 1,
+"category": "real-user-readiness"
+},
+{
+"id": "RU-020",
+"title": "No first-run empty experience",
+"severity": "low",
+"requires": [
+"has_accounts == true",
+"business_model in [b2c, b2b-saas]"
+],
+"tier": 2,
+"category": "real-user-readiness"
+},
+{
+"id": "TEN-001",
+"title": "Tenant scope enforced in application code only",
+"severity": "critical",
+"requires": [
+"tenancy == multi-tenant-shared-db",
+"stack.database in [postgres, supabase]"
+],
+"tier": 2,
+"note": "one forgotten WHERE clause is a cross-tenant breach. push it into RLS.",
+"category": "multi-tenancy"
+},
+{
+"id": "TEN-002",
+"title": "No composite index on (tenant_id, ...) for hot queries",
+"severity": "medium",
+"requires": [
+"tenancy == multi-tenant-shared-db"
+],
+"tier": 1,
+"category": "multi-tenancy"
+},
+{
+"id": "TEN-003",
+"title": "Invitation token does not expire",
+"severity": "high",
+"requires": [
+"has_invitations == true"
+],
+"tier": 1,
+"category": "multi-tenancy"
+},
+{
+"id": "TEN-004",
+"title": "Invitation accepts a role chosen by the invitee",
+"severity": "critical",
+"requires": [
+"has_invitations == true",
+"has_roles == true"
+],
+"tier": 2,
+"category": "multi-tenancy"
+},
+{
+"id": "TEN-005",
+"title": "Role change not re-verified server-side",
+"severity": "critical",
+"requires": [
+"has_roles == true"
+],
+"tier": 2,
+"category": "multi-tenancy"
+},
+{
+"id": "TEN-006",
+"title": "Member can escalate to owner",
+"severity": "critical",
+"requires": [
+"has_roles == true",
+"tenancy == multi-tenant-shared-db"
+],
+"tier": 2,
+"category": "multi-tenancy"
+},
+{
+"id": "TEN-007",
+"title": "Removed member retains an active session",
+"severity": "high",
+"requires": [
+"tenancy == multi-tenant-shared-db",
+"has_accounts == true"
+],
+"tier": 2,
+"category": "multi-tenancy"
+},
+{
+"id": "TEN-008",
+"title": "Cross-tenant file access via storage path",
+"severity": "critical",
+"requires": [
+"tenancy == multi-tenant-shared-db",
+"has_file_uploads == true"
+],
+"tier": 2,
+"check": "object path is guessable and bucket policy is not tenant-scoped",
+"category": "multi-tenancy"
+},
+{
+"id": "TEN-009",
+"title": "Tenant deletion leaves orphaned data",
+"severity": "high",
+"requires": [
+"tenancy == multi-tenant-shared-db"
+],
+"tier": 2,
+"category": "multi-tenancy"
+},
+{
+"id": "TEN-010",
+"title": "Seat count not enforced server-side",
+"severity": "medium",
+"requires": [
+"tenancy == multi-tenant-shared-db",
+"has_subscriptions == true"
+],
+"tier": 2,
+"category": "multi-tenancy"
+},
+{
+"id": "TEN-011",
+"title": "Usage metering not attributed per tenant",
+"severity": "medium",
+"requires": [
+"tenancy == multi-tenant-shared-db",
+"calls_llm == true"
+],
+"tier": 2,
+"category": "multi-tenancy"
+},
+{
+"id": "TEN-012",
+"title": "Admin impersonation without an audit record",
+"severity": "high",
+"requires": [
+"has_admin_panel == true",
+"tenancy == multi-tenant-shared-db"
+],
+"tier": 2,
+"category": "multi-tenancy"
+},
+{
+"id": "TEN-013",
+"title": "Search or aggregate query crosses tenant boundary",
+"severity": "critical",
+"requires": [
+"tenancy == multi-tenant-shared-db"
+],
+"tier": 2,
+"note": "list endpoints get scoped; COUNT and search frequently do not.",
+"category": "multi-tenancy"
+},
+{
+"id": "TEN-014",
+"title": "Webhook or callback not tenant-scoped",
+"severity": "high",
+"requires": [
+"tenancy == multi-tenant-shared-db",
+"has_webhooks_in == true"
+],
+"tier": 2,
+"category": "multi-tenancy"
+},
+{
+"id": "UP-001",
+"title": "File type validated by extension or client MIME only",
+"severity": "high",
+"requires": [
+"has_file_uploads == true"
+],
+"tier": 1,
+"category": "file-uploads"
+},
+{
+"id": "UP-002",
+"title": "No upload size limit",
+"severity": "high",
+"requires": [
+"has_file_uploads == true"
+],
+"tier": 1,
+"category": "file-uploads"
+},
+{
+"id": "UP-003",
+"title": "Upload path built from a user-supplied filename",
+"severity": "critical",
+"requires": [
+"has_file_uploads == true"
+],
+"tier": 1,
+"check": "filename concatenated into a storage path without normalisation",
+"category": "file-uploads"
+},
+{
+"id": "UP-004",
+"title": "Uploaded files served from the app origin",
+"severity": "high",
+"requires": [
+"has_file_uploads == true",
+"surface in [web-app, web-site]"
+],
+"tier": 2,
+"note": "a stored HTML or SVG becomes same-origin XSS.",
+"category": "file-uploads"
+},
+{
+"id": "UP-005",
+"title": "SVG accepted without sanitisation",
+"severity": "high",
+"requires": [
+"has_file_uploads == true"
+],
+"tier": 1,
+"category": "file-uploads"
+},
+{
+"id": "UP-006",
+"title": "No malware scanning on shared files",
+"severity": "medium",
+"requires": [
+"has_file_uploads == true",
+"tenancy == multi-tenant-shared-db"
+],
+"tier": 2,
+"category": "file-uploads"
+},
+{
+"id": "UP-007",
+"title": "Signed URLs with excessive lifetime",
+"severity": "medium",
+"requires": [
+"has_file_uploads == true"
+],
+"tier": 1,
+"category": "file-uploads"
+},
+{
+"id": "UP-008",
+"title": "EXIF metadata not stripped from images",
+"severity": "medium",
+"requires": [
+"has_file_uploads == true",
+"data_sensitivity != none"
+],
+"tier": 1,
+"note": "photo uploads routinely carry GPS coordinates.",
+"category": "file-uploads"
+},
+{
+"id": "UP-009",
+"title": "Image processing performed inline",
+"severity": "medium",
+"requires": [
+"has_file_uploads == true"
+],
+"tier": 2,
+"category": "file-uploads"
+},
+{
+"id": "UP-010",
+"title": "No storage quota per user or tenant",
+"severity": "medium",
+"requires": [
+"has_file_uploads == true",
+"has_accounts == true"
+],
+"tier": 2,
+"category": "file-uploads"
+},
+{
+"id": "UP-011",
+"title": "Deleted records leave files in storage",
+"severity": "medium",
+"requires": [
+"has_file_uploads == true"
+],
+"tier": 2,
+"category": "file-uploads"
+},
+{
+"id": "UP-012",
+"title": "Zip or archive expanded without bounds",
+"severity": "high",
+"requires": [
+"has_file_uploads == true"
+],
+"tier": 2,
+"check": "archive extraction without entry count, size, or path checks",
+"category": "file-uploads"
+},
+{
+"id": "API-001",
+"title": "Mass assignment \u2014 request body spread into a model",
+"severity": "critical",
+"requires": [
+"stack.database != none"
+],
+"tier": 1,
+"check": "request body passed wholesale to create/update",
+"note": "this is how a user sets their own is_admin.",
+"category": "api-design"
+},
+{
+"id": "API-002",
+"title": "Internal error details returned to the client",
+"severity": "high",
+"requires": [
+"is_public == true"
+],
+"tier": 1,
+"category": "api-design"
+},
+{
+"id": "API-003",
+"title": "Stack traces reachable in production responses",
+"severity": "high",
+"requires": [
+"is_public == true",
+"stage == production"
+],
+"tier": 1,
+"category": "api-design"
+},
+{
+"id": "API-004",
+"title": "No maximum page size",
+"severity": "medium",
+"requires": [
+"is_public == true"
+],
+"tier": 1,
+"check": "limit parameter accepted without an upper bound",
+"category": "api-design"
+},
+{
+"id": "API-005",
+"title": "Sort or filter parameter interpolated into a query",
+"severity": "critical",
+"requires": [
+"stack.database != none"
+],
+"tier": 1,
+"category": "api-design"
+},
+{
+"id": "API-006",
+"title": "State-changing operation exposed over GET",
+"severity": "high",
+"requires": [
+"is_public == true"
+],
+"tier": 1,
+"category": "api-design"
+},
+{
+"id": "API-007",
+"title": "No CSRF protection on cookie-authenticated mutations",
+"severity": "high",
+"requires": [
+"has_accounts == true",
+"surface in [web-app]"
+],
+"tier": 2,
+"category": "api-design"
+},
+{
+"id": "API-008",
+"title": "No API versioning",
+"severity": "low",
+"requires": [
+"surface == api-only"
+],
+"tier": 2,
+"category": "api-design"
+},
+{
+"id": "API-009",
+"title": "Verbose 404 vs 403 distinction leaks existence",
+"severity": "low",
+"requires": [
+"has_accounts == true"
+],
+"tier": 2,
+"category": "api-design"
+},
+{
+"id": "API-010",
+"title": "No request timeout on outbound calls",
+"severity": "medium",
+"requires": [
+"stage == production"
+],
+"tier": 1,
+"category": "api-design"
+},
+{
+"id": "API-011",
+"title": "No idempotency on retryable mutations",
+"severity": "medium",
+"requires": [
+"surface == api-only",
+"stage == production"
+],
+"tier": 2,
+"category": "api-design"
+},
+{
+"id": "API-012",
+"title": "Security headers missing",
+"severity": "medium",
+"requires": [
+"surface in [web-app, web-site]",
+"is_public == true"
+],
+"tier": 1,
+"check": "no CSP, X-Content-Type-Options, Referrer-Policy, frame ancestors",
+"category": "api-design"
+},
+{
+"id": "API-013",
+"title": "Open redirect",
+"severity": "high",
+"requires": [
+"is_public == true",
+"surface in [web-app, web-site]"
+],
+"tier": 1,
+"check": "redirect target read from a query parameter without an allowlist",
+"category": "api-design"
+},
+{
+"id": "API-014",
+"title": "SSRF \u2014 outbound request to a user-supplied URL",
+"severity": "critical",
+"requires": [
+"is_public == true"
+],
+"tier": 2,
+"has_static_approximation": true,
+"check": "fetch to a request-derived host without an allowlist or IP filter",
+"category": "api-design"
+},
+{
+"id": "NEXT-001",
+"title": "Server Action without an authorization check",
+"severity": "critical",
+"requires": [
+"stack.framework == next",
+"has_accounts == true"
+],
+"tier": 2,
+"note": "a Server Action is a public POST endpoint. Being unexported from a page does not protect it.",
+"category": "framework-next"
+},
+{
+"id": "NEXT-002",
+"title": "Middleware matcher does not cover protected routes",
+"severity": "critical",
+"requires": [
+"stack.framework == next",
+"has_accounts == true"
+],
+"tier": 2,
+"check": "auth enforced in middleware whose matcher misses API or nested routes",
+"category": "framework-next"
+},
+{
+"id": "NEXT-003",
+"title": "Auth enforced only in middleware",
+"severity": "high",
+"requires": [
+"stack.framework == next",
+"has_accounts == true"
+],
+"tier": 2,
+"note": "defence in depth \u2014 the route handler must check too.",
+"category": "framework-next"
+},
+{
+"id": "NEXT-004",
+"title": "Route handler missing a session check",
+"severity": "critical",
+"requires": [
+"stack.framework == next",
+"has_accounts == true"
+],
+"tier": 2,
+"category": "framework-next"
+},
+{
+"id": "NEXT-005",
+"title": "Server-only data passed into a Client Component",
+"severity": "high",
+"requires": [
+"stack.framework == next"
+],
+"tier": 2,
+"check": "full record with sensitive columns serialised across the RSC boundary",
+"note": "props to a Client Component are shipped to the browser in full.",
+"category": "framework-next"
+},
+{
+"id": "NEXT-006",
+"title": "Secret imported into a module reachable from the client graph",
+"severity": "critical",
+"requires": [
+"stack.framework == next"
+],
+"tier": 1,
+"category": "framework-next"
+},
+{
+"id": "NEXT-007",
+"title": "Cached route serves per-user data",
+"severity": "critical",
+"requires": [
+"stack.framework == next",
+"has_accounts == true"
+],
+"tier": 2,
+"check": "force-static or revalidate on a route whose output varies per session",
+"note": "one user's dashboard cached and served to another.",
+"category": "framework-next"
+},
+{
+"id": "NEXT-008",
+"title": "generateStaticParams over user data",
+"severity": "medium",
+"requires": [
+"stack.framework == next"
+],
+"tier": 2,
+"category": "framework-next"
+},
+{
+"id": "NEXT-009",
+"title": "Image optimizer allows arbitrary remote hosts",
+"severity": "medium",
+"requires": [
+"stack.framework == next"
+],
+"tier": 1,
+"check": "remotePatterns with a wildcard hostname",
+"category": "framework-next"
+},
+{
+"id": "NEXT-010",
+"title": "Route handler lacks runtime/duration config for long work",
+"severity": "medium",
+"requires": [
+"stack.framework == next",
+"calls_llm == true"
+],
+"tier": 1,
+"category": "framework-next"
+},
+{
+"id": "NEXT-011",
+"title": "Error boundary absent",
+"severity": "medium",
+"requires": [
+"stack.framework == next"
+],
+"tier": 1,
+"check": "no error.tsx / global-error.tsx",
+"category": "framework-next"
+},
+{
+"id": "NEXT-012",
+"title": "Loading UI absent on data routes",
+"severity": "low",
+"requires": [
+"stack.framework == next"
+],
+"tier": 1,
+"sources": [
+"DYc6sGNMuow"
+],
+"category": "framework-next"
+},
+{
+"id": "NEXT-013",
+"title": "Cookies set without secure attributes",
+"severity": "high",
+"requires": [
+"stack.framework == next",
+"has_accounts == true"
+],
+"tier": 1,
+"category": "framework-next"
+},
+{
+"id": "NEXT-014",
+"title": "Redirect after login uses an unvalidated next parameter",
+"severity": "high",
+"requires": [
+"stack.framework == next",
+"has_accounts == true"
+],
+"tier": 1,
+"category": "framework-next"
+},
+{
+"id": "SUP-001",
+"title": "Storage bucket public by default",
+"severity": "critical",
+"requires": [
+"stack.database == supabase",
+"has_file_uploads == true"
+],
+"tier": 1,
+"note": "mirrors the RLS problem \u2014 permissive default, silent exposure.",
+"category": "platform-supabase"
+},
+{
+"id": "SUP-002",
+"title": "Storage policies absent",
+"severity": "critical",
+"requires": [
+"stack.database == supabase",
+"has_file_uploads == true"
+],
+"tier": 2,
+"category": "platform-supabase"
+},
+{
+"id": "SUP-003",
+"title": "Realtime channel without an authorization policy",
+"severity": "critical",
+"requires": [
+"stack.database == supabase",
+"has_realtime == true"
+],
+"tier": 2,
+"note": "realtime subscriptions bypass the assumptions people make about REST-only RLS.",
+"category": "platform-supabase"
+},
+{
+"id": "SUP-004",
+"title": "Edge function using the service role for user-scoped work",
+"severity": "critical",
+"requires": [
+"stack.database == supabase"
+],
+"tier": 2,
+"category": "platform-supabase"
+},
+{
+"id": "SUP-005",
+"title": "RLS policy references a client-supplied claim",
+"severity": "critical",
+"requires": [
+"stack.database == supabase",
+"has_accounts == true"
+],
+"tier": 2,
+"check": "policy reads a JWT claim the user can influence rather than auth.uid()",
+"category": "platform-supabase"
+},
+{
+"id": "SUP-006",
+"title": "Postgres function marked SECURITY DEFINER without a search_path",
+"severity": "high",
+"requires": [
+"stack.database in [supabase, postgres]"
+],
+"tier": 1,
+"category": "platform-supabase"
+},
+{
+"id": "SUP-007",
+"title": "Anon key granted write access to reference tables",
+"severity": "high",
+"requires": [
+"stack.database == supabase"
+],
+"tier": 2,
+"category": "platform-supabase"
+},
+{
+"id": "SUP-008",
+"title": "Auth email templates left at defaults",
+"severity": "low",
+"requires": [
+"stack.auth == supabase-auth",
+"stage == production"
+],
+"tier": 2,
+"category": "platform-supabase"
+},
+{
+"id": "SUP-009",
+"title": "No RLS on a view exposing base-table rows",
+"severity": "critical",
+"requires": [
+"stack.database in [supabase, postgres]",
+"has_accounts == true"
+],
+"tier": 2,
+"note": "views are the standard RLS bypass \u2014 the base table is protected, the view is not.",
+"category": "platform-supabase"
+},
+{
+"id": "SUP-010",
+"title": "Database webhooks fire without signature verification",
+"severity": "high",
+"requires": [
+"stack.database == supabase",
+"has_webhooks_in == true"
+],
+"tier": 2,
+"category": "platform-supabase"
+},
+{
+"id": "SUP-011",
+"title": "Connection string uses the direct port under serverless",
+"severity": "high",
+"requires": [
+"stack.database == supabase",
+"stack.host in [vercel, netlify, cloudflare]"
+],
+"tier": 1,
+"note": "use the pooler; direct connections exhaust under serverless fan-out.",
+"category": "platform-supabase"
+},
+{
+"id": "SUP-012",
+"title": "No point-in-time recovery on a production project",
+"severity": "high",
+"requires": [
+"stack.database == supabase",
+"stage == production"
+],
+"tier": 2,
+"category": "platform-supabase"
+},
+{
+"id": "LIFE-001",
+"title": "No data retention policy",
+"severity": "medium",
+"requires": [
+"data_sensitivity != none",
+"stage == production"
+],
+"tier": 2,
+"category": "data-lifecycle"
+},
+{
+"id": "LIFE-002",
+"title": "Deletion is soft-only where hard deletion is required",
+"severity": "high",
+"requires": [
+"data_sensitivity != none",
+"jurisdictions includes any of [eu, uk]"
+],
+"tier": 2,
+"note": "a soft-deleted row still holds the personal data an erasure request covers.",
+"category": "data-lifecycle"
+},
+{
+"id": "LIFE-003",
+"title": "Deletion does not cascade to derived stores",
+"severity": "high",
+"requires": [
+"data_sensitivity != none"
+],
+"tier": 2,
+"check": "erasure path misses search index, cache, analytics, backups, prompt logs",
+"category": "data-lifecycle"
+},
+{
+"id": "LIFE-004",
+"title": "No data export for the user",
+"severity": "medium",
+"requires": [
+"data_sensitivity != none",
+"jurisdictions includes any of [eu, uk]"
+],
+"tier": 2,
+"category": "data-lifecycle"
+},
+{
+"id": "LIFE-005",
+"title": "Sensitive columns unencrypted at rest beyond disk encryption",
+"severity": "high",
+"requires": [
+"data_sensitivity in [financial, health]"
+],
+"tier": 2,
+"category": "data-lifecycle"
+},
+{
+"id": "LIFE-006",
+"title": "No audit trail on sensitive record access",
+"severity": "high",
+"requires": [
+"data_sensitivity in [financial, health]"
+],
+"tier": 2,
+"category": "data-lifecycle"
+},
+{
+"id": "LIFE-007",
+"title": "Production data copied to non-production environments",
+"severity": "critical",
+"requires": [
+"data_sensitivity != none"
+],
+"tier": 2,
+"category": "data-lifecycle"
+},
+{
+"id": "LIFE-008",
+"title": "Backups unencrypted or unrestricted",
+"severity": "critical",
+"requires": [
+"stage == production",
+"data_sensitivity != none"
+],
+"tier": 2,
+"category": "data-lifecycle"
+},
+{
+"id": "LIFE-009",
+"title": "Logs retain personal data indefinitely",
+"severity": "medium",
+"requires": [
+"data_sensitivity != none",
+"stage == production"
+],
+"tier": 2,
+"category": "data-lifecycle"
+},
+{
+"id": "LIFE-010",
+"title": "Analytics collects identifiers without a lawful basis",
+"severity": "high",
+"requires": [
+"collects_analytics == true",
+"jurisdictions includes any of [eu, uk]"
+],
+"tier": 2,
+"category": "data-lifecycle"
+},
+{
+"id": "LIFE-011",
+"title": "No subprocessor list where one is required",
+"severity": "medium",
+"requires": [
+"business_model == b2b-saas",
+"jurisdictions includes any of [eu, uk]"
+],
+"tier": 2,
+"category": "data-lifecycle"
+},
+{
+"id": "LIFE-012",
+"title": "Children's data collected without age gating",
+"severity": "critical",
+"requires": [
+"data_sensitivity == children"
+],
+"tier": 2,
+"category": "data-lifecycle"
+},
+{
+"id": "MOB-001",
+"title": "Secret embedded in the app binary",
+"severity": "critical",
+"requires": [
+"surface in [mobile-ios, mobile-android]"
+],
+"tier": 1,
+"note": "a shipped binary is a public file. anything in it is published.",
+"category": "mobile"
+},
+{
+"id": "MOB-002",
+"title": "Token stored outside the platform secure store",
+"severity": "high",
+"requires": [
+"surface in [mobile-ios, mobile-android]",
+"has_accounts == true"
+],
+"tier": 1,
+"check": "credential in UserDefaults / SharedPreferences rather than Keychain / Keystore",
+"category": "mobile"
+},
+{
+"id": "MOB-003",
+"title": "No certificate validation or pinning on sensitive calls",
+"severity": "medium",
+"requires": [
+"surface in [mobile-ios, mobile-android]",
+"data_sensitivity in [financial, health]"
+],
+"tier": 2,
+"category": "mobile"
+},
+{
+"id": "MOB-004",
+"title": "Permissions requested without a usage description",
+"severity": "high",
+"requires": [
+"surface in [mobile-ios, mobile-android]"
+],
+"tier": 1,
+"category": "mobile"
+},
+{
+"id": "MOB-005",
+"title": "Privacy manifest or data-safety form incomplete",
+"severity": "high",
+"requires": [
+"surface in [mobile-ios, mobile-android]"
+],
+"tier": 2,
+"sources": [
+"DYwx1b8TDAc"
+],
+"category": "mobile"
+},
+{
+"id": "MOB-006",
+"title": "Onboarding requests data the identity provider already returns",
+"severity": "medium",
+"requires": [
+"surface == mobile-ios",
+"has_accounts == true"
+],
+"tier": 2,
+"note": "corpus \u2014 rejected twice for asking a Sign in with Apple user for their name.",
+"sources": [
+"DXez-ZWkRgl"
+],
+"category": "mobile"
+},
+{
+"id": "MOB-007",
+"title": "Paid features referenced without declaring the subscription",
+"severity": "high",
+"requires": [
+"surface in [mobile-ios, mobile-android]",
+"has_subscriptions == true"
+],
+"tier": 2,
+"sources": [
+"DXez-ZWkRgl"
+],
+"category": "mobile"
+},
+{
+"id": "MOB-008",
+"title": "No forced-update path for a broken release",
+"severity": "medium",
+"requires": [
+"surface in [mobile-ios, mobile-android]",
+"stage == production"
+],
+"tier": 2,
+"note": "on mobile you cannot hotfix. you can only ask users to update.",
+"category": "mobile"
+},
+{
+"id": "MOB-009",
+"title": "Deep link accepted without validation",
+"severity": "high",
+"requires": [
+"surface in [mobile-ios, mobile-android]"
+],
+"tier": 2,
+"category": "mobile"
+},
+{
+"id": "MOB-010",
+"title": "Sensitive screens not excluded from the app switcher snapshot",
+"severity": "low",
+"requires": [
+"surface in [mobile-ios, mobile-android]",
+"data_sensitivity in [financial, health]"
+],
+"tier": 2,
+"category": "mobile"
+},
+{
+"id": "INC-001",
+"title": "No way to revoke all sessions",
+"severity": "high",
+"requires": [
+"has_accounts == true",
+"stage == production"
+],
+"tier": 2,
+"origin": "gap",
+"note": "the first move in any breach response, and almost nobody can do it.",
+"category": "incident-readiness"
+},
+{
+"id": "INC-002",
+"title": "No kill switch for an abused feature",
+"severity": "high",
+"requires": [
+"stage == production",
+"calls_llm == true"
+],
+"tier": 2,
+"origin": "gap",
+"note": "corpus author was under live attack with no way to turn the feature off.",
+"sources": [
+"DZmTu7Kgr0W"
+],
+"category": "incident-readiness"
+},
+{
+"id": "INC-003",
+"title": "No feature flags for progressive rollout",
+"severity": "low",
+"requires": [
+"stage == production",
+"business_model in [b2b-saas, b2c]"
+],
+"tier": 2,
+"origin": "gap",
+"category": "incident-readiness"
+},
+{
+"id": "INC-004",
+"title": "No security contact or disclosure path",
+"severity": "medium",
+"requires": [
+"is_public == true",
+"stage == production"
+],
+"tier": 1,
+"origin": "gap",
+"check": "no security.txt, no security contact",
+"category": "incident-readiness"
+},
+{
+"id": "INC-005",
+"title": "No breach notification plan",
+"severity": "high",
+"requires": [
+"data_sensitivity != none",
+"jurisdictions includes any of [eu, uk]"
+],
+"tier": 2,
+"origin": "gap",
+"note": "GDPR gives you 72 hours. That clock is not the time to start planning.",
+"category": "incident-readiness"
+},
+{
+"id": "INC-006",
+"title": "No alerting on anomalous spend",
+"severity": "critical",
+"requires": [
+"calls_llm == true",
+"stage == production"
+],
+"tier": 2,
+"origin": "gap",
+"note": "every corpus horror story is a bill discovered days late.",
+"sources": [
+"DY4xvIAAo-m",
+"DZ7qlTboUvg"
+],
+"category": "incident-readiness"
+},
+{
+"id": "INC-007",
+"title": "No alerting on auth failure spikes",
+"severity": "medium",
+"requires": [
+"has_accounts == true",
+"stage == production"
+],
+"tier": 2,
+"origin": "gap",
+"category": "incident-readiness"
+},
+{
+"id": "INC-008",
+"title": "Logs not retained long enough to investigate",
+"severity": "medium",
+"requires": [
+"stage == production"
+],
+"tier": 2,
+"origin": "gap",
+"category": "incident-readiness"
+},
+{
+"id": "INC-009",
+"title": "No documented on-call or escalation owner",
+"severity": "low",
+"requires": [
+"stage == production",
+"business_model == b2b-saas"
+],
+"tier": 2,
+"origin": "gap",
+"category": "incident-readiness"
+},
+{
+"id": "INC-010",
+"title": "No status page or outage communication path",
+"severity": "low",
+"requires": [
+"stage == production",
+"business_model == b2b-saas"
+],
+"tier": 2,
+"origin": "gap",
+"category": "incident-readiness"
+},
+{
+"id": "DJ-001",
+"title": "DEBUG is on in a deployed setting",
+"severity": "critical",
+"requires": [
+"stack.framework == django",
+"stage in [pre-launch, production]"
+],
+"tier": 1,
+"check": "DEBUG = True in a settings module not named local/dev",
+"note": "Django's debug page prints settings, installed apps, the SQL that ran and a full traceback to whoever triggers the error. Django's own docs call deploying with it on a security problem.",
+"fix": "DEBUG = False in production, and set ALLOWED_HOSTS.",
+"category": "framework-django"
+},
+{
+"id": "DJ-002",
+"title": "SECRET_KEY written into source",
+"severity": "critical",
+"requires": [
+"stack.framework == django"
+],
+"tier": 1,
+"check": "SECRET_KEY assigned a literal rather than read from the environment",
+"note": "SECRET_KEY signs sessions, password-reset tokens and CSRF tokens. Anyone holding it can forge a session for any user.",
+"fix": "Read it from an environment variable and rotate the committed value.",
+"category": "framework-django"
+},
+{
+"id": "DJ-003",
+"title": "ALLOWED_HOSTS accepts any host",
+"severity": "high",
+"requires": [
+"stack.framework == django",
+"is_public == true"
+],
+"tier": 1,
+"check": "ALLOWED_HOSTS contains '*'",
+"note": "enables host-header poisoning, which turns password-reset emails into links pointing at an attacker's domain.",
+"category": "framework-django"
+},
+{
+"id": "DJ-004",
+"title": "CSRF middleware removed",
+"severity": "critical",
+"requires": [
+"stack.framework == django",
+"has_accounts == true"
+],
+"tier": 1,
+"check": "MIDDLEWARE lacks django.middleware.csrf.CsrfViewMiddleware",
+"note": "it ships enabled. Its absence means someone deliberately removed it.",
+"category": "framework-django"
+},
+{
+"id": "DJ-005",
+"title": "mark_safe or |safe applied to user content",
+"severity": "critical",
+"requires": [
+"stack.framework == django"
+],
+"tier": 2,
+"check": "mark_safe(), format_html with unescaped input, or |safe in a template on a value that originates from a request",
+"note": "Django escapes templates by default. These are the two ways to switch that off.",
+"category": "framework-django"
+},
+{
+"id": "DJ-006",
+"title": "Raw SQL built by interpolation",
+"severity": "critical",
+"requires": [
+"stack.framework == django"
+],
+"tier": 1,
+"check": ".raw() or .extra() containing an f-string, % or .format()",
+"fix": "Pass parameters: .raw('SELECT \u2026 WHERE id = %s', [id])",
+"category": "framework-django"
+},
+{
+"id": "DJ-007",
+"title": "HTTPS not enforced",
+"severity": "high",
+"requires": [
+"stack.framework == django",
+"stage == production",
+"is_public == true"
+],
+"tier": 1,
+"check": "SECURE_SSL_REDIRECT absent or False",
+"category": "framework-django"
+},
+{
+"id": "DJ-008",
+"title": "Session and CSRF cookies not marked secure",
+"severity": "high",
+"requires": [
+"stack.framework == django",
+"has_accounts == true",
+"stage == production"
+],
+"tier": 1,
+"check": "SESSION_COOKIE_SECURE or CSRF_COOKIE_SECURE missing or False",
+"note": "without these the cookies travel over plain HTTP on the first request.",
+"category": "framework-django"
+},
+{
+"id": "DJ-009",
+"title": "HSTS not configured",
+"severity": "medium",
+"requires": [
+"stack.framework == django",
+"stage == production",
+"is_public == true"
+],
+"tier": 1,
+"check": "SECURE_HSTS_SECONDS is 0 or unset",
+"category": "framework-django"
+},
+{
+"id": "DJ-010",
+"title": "ModelForm or serializer exposes every field",
+"severity": "critical",
+"requires": [
+"stack.framework == django"
+],
+"tier": 1,
+"check": "fields = '__all__' on a ModelForm or ModelSerializer",
+"note": "Django's own mass-assignment shape. Every column becomes writable from the request, including is_staff, is_superuser and any balance you keep on the model.",
+"fix": "List the fields you actually accept.",
+"category": "framework-django"
+},
+{
+"id": "DJ-011",
+"title": "View has no authentication requirement",
+"severity": "critical",
+"requires": [
+"stack.framework == django",
+"has_accounts == true"
+],
+"tier": 2,
+"check": "a view that touches the ORM without @login_required, LoginRequiredMixin, or a DRF permission_class",
+"category": "framework-django"
+},
+{
+"id": "DJ-012",
+"title": "Password validators removed",
+"severity": "medium",
+"requires": [
+"stack.framework == django",
+"has_accounts == true"
+],
+"tier": 1,
+"check": "AUTH_PASSWORD_VALIDATORS is an empty list",
+"category": "framework-django"
+},
+{
+"id": "DJ-013",
+"title": "Clickjacking protection disabled",
+"severity": "medium",
+"requires": [
+"stack.framework == django",
+"is_public == true"
+],
+"tier": 1,
+"check": "XFrameOptionsMiddleware absent, or X_FRAME_OPTIONS set to ALLOWALL",
+"category": "framework-django"
+},
+{
+"id": "DJ-014",
+"title": "Sessions serialised with pickle",
+"severity": "critical",
+"requires": [
+"stack.framework == django"
+],
+"tier": 1,
+"check": "SESSION_SERIALIZER set to PickleSerializer",
+"note": "combined with a leaked SECRET_KEY this is remote code execution, not just session forgery.",
+"category": "framework-django"
+},
+{
+"id": "DJ-015",
+"title": "Queryset not scoped to the requesting user",
+"severity": "critical",
+"requires": [
+"stack.framework == django",
+"has_accounts == true"
+],
+"tier": 2,
+"check": "Model.objects.get/filter keyed on a request parameter with no user or organisation predicate",
+"note": "Django's version of the change-the-id-in-the-URL bug.",
+"category": "framework-django"
+},
+{
+"id": "DJ-016",
+"title": "DEBUG toolbar or dev-only app installed in production",
+"severity": "high",
+"requires": [
+"stack.framework == django",
+"stage == production"
+],
+"tier": 1,
+"check": "debug_toolbar, django_extensions or silk present in production INSTALLED_APPS",
+"category": "framework-django"
+},
+{
+"id": "DJ-017",
+"title": "Media files served by Django itself",
+"severity": "medium",
+"requires": [
+"stack.framework == django",
+"has_file_uploads == true",
+"stage == production"
+],
+"tier": 2,
+"check": "static() or serve() used for MEDIA_ROOT outside DEBUG",
+"note": "Django's docs are explicit that this is insecure and inefficient in production.",
+"category": "framework-django"
+},
+{
+"id": "DJ-018",
+"title": "No rate limiting on authentication views",
+"severity": "high",
+"requires": [
+"stack.framework == django",
+"has_accounts == true",
+"is_public == true"
+],
+"tier": 2,
+"check": "no django-axes, django-ratelimit or equivalent guarding login",
+"note": "Django ships no brute-force protection. Nothing is watching by default.",
+"category": "framework-django"
+},
+{
+"id": "RB-001",
+"title": "secret_key_base committed to the repository",
+"severity": "critical",
+"requires": [
+"stack.framework == rails"
+],
+"tier": 1,
+"check": "a literal secret_key_base in config/secrets.yml, credentials.yml or an initializer",
+"note": "signs every session cookie. With it, anyone mints a session for any user \u2014 and Rails historically deserialised session data, so it has meant RCE.",
+"fix": "Use encrypted credentials or ENV, and rotate the exposed key.",
+"category": "framework-rails"
+},
+{
+"id": "RB-002",
+"title": "config.force_ssl not enabled in production",
+"severity": "high",
+"requires": [
+"stack.framework == rails",
+"stage == production",
+"is_public == true"
+],
+"tier": 1,
+"check": "config.force_ssl absent or false in config/environments/production.rb",
+"note": "one line, and it enables the redirect, secure cookies and HSTS together.",
+"category": "framework-rails"
+},
+{
+"id": "RB-003",
+"title": "CSRF protection disabled or skipped",
+"severity": "critical",
+"requires": [
+"stack.framework == rails",
+"has_accounts == true"
+],
+"tier": 1,
+"check": "skip_before_action :verify_authenticity_token, or protect_from_forgery with: :null_session on a state-changing controller",
+"category": "framework-rails"
+},
+{
+"id": "RB-004",
+"title": "html_safe or raw applied to user content",
+"severity": "critical",
+"requires": [
+"stack.framework == rails"
+],
+"tier": 1,
+"check": ".html_safe or raw() on a value derived from params, or <%== in an ERB template",
+"note": "ERB escapes by default. These are the ways to turn that off.",
+"category": "framework-rails"
+},
+{
+"id": "RB-005",
+"title": "SQL built by string interpolation",
+"severity": "critical",
+"requires": [
+"stack.framework == rails"
+],
+"tier": 1,
+"check": "where(\"\u2026 #{\u2026}\"), find_by_sql or order() containing interpolation",
+"fix": "where('email = ?', email) \u2014 the placeholder form.",
+"category": "framework-rails"
+},
+{
+"id": "RB-006",
+"title": "Strong parameters bypassed with permit!",
+"severity": "critical",
+"requires": [
+"stack.framework == rails"
+],
+"tier": 1,
+"check": "params.permit! or params.require(:x).permit!",
+"note": "permit! whitelists everything the caller sent. Rails added strong parameters precisely because of the GitHub mass-assignment incident.",
+"category": "framework-rails"
+},
+{
+"id": "RB-007",
+"title": "Record loaded by id with no ownership scope",
+"severity": "critical",
+"requires": [
+"stack.framework == rails",
+"has_accounts == true"
+],
+"tier": 2,
+"check": "Model.find(params[:id]) with no current_user or tenant scope in the action",
+"fix": "current_user.invoices.find(params[:id]) \u2014 scope through the association.",
+"category": "framework-rails"
+},
+{
+"id": "RB-008",
+"title": "Unsafe deserialisation of user input",
+"severity": "critical",
+"requires": [
+"stack.framework == rails"
+],
+"tier": 1,
+"check": "Marshal.load, YAML.load or Oj.load applied to request data",
+"note": "each of these instantiates arbitrary Ruby objects. Use YAML.safe_load.",
+"category": "framework-rails"
+},
+{
+"id": "RB-009",
+"title": "File served from a user-supplied path",
+"severity": "critical",
+"requires": [
+"stack.framework == rails"
+],
+"tier": 1,
+"check": "send_file or render file: built from params",
+"note": "../../config/master.key is a valid filename as far as the filesystem cares.",
+"category": "framework-rails"
+},
+{
+"id": "RB-010",
+"title": "Controller has no authentication callback",
+"severity": "critical",
+"requires": [
+"stack.framework == rails",
+"has_accounts == true"
+],
+"tier": 2,
+"check": "a controller touching models without before_action :authenticate_user! or an equivalent, and not inheriting one",
+"category": "framework-rails"
+},
+{
+"id": "RB-011",
+"title": "Sensitive parameters not filtered from logs",
+"severity": "high",
+"requires": [
+"stack.framework == rails",
+"has_accounts == true"
+],
+"tier": 1,
+"check": "config.filter_parameters omits password, token or secret",
+"note": "otherwise plaintext passwords are written into production logs on every sign-in, and logs are backed up, shipped and searched.",
+"category": "framework-rails"
+},
+{
+"id": "RB-012",
+"title": "Detailed exception pages enabled in production",
+"severity": "high",
+"requires": [
+"stack.framework == rails",
+"stage == production"
+],
+"tier": 1,
+"check": "config.consider_all_requests_local = true in production.rb",
+"note": "turns every 500 into a stack trace with source and local variables.",
+"category": "framework-rails"
+},
+{
+"id": "RB-013",
+"title": "Mass assignment through nested attributes",
+"severity": "high",
+"requires": [
+"stack.framework == rails"
+],
+"tier": 2,
+"check": "accepts_nested_attributes_for on a model whose permitted params are not equally constrained",
+"category": "framework-rails"
+},
+{
+"id": "RB-014",
+"title": "Devise configured without lockable or timeout",
+"severity": "medium",
+"requires": [
+"stack.framework == rails",
+"stack.auth == devise",
+"is_public == true"
+],
+"tier": 1,
+"check": "devise model lacks :lockable, or Devise.timeout_in is unset",
+"note": "Devise ships neither brute-force lockout nor session expiry enabled.",
+"category": "framework-rails"
+},
+{
+"id": "RB-015",
+"title": "Background job takes raw user input as an argument",
+"severity": "medium",
+"requires": [
+"stack.framework == rails",
+"has_background_jobs == true"
+],
+"tier": 2,
+"check": "perform_later called with request parameters passed straight through",
+"note": "job arguments are serialised and often logged, and run outside the request's authorisation context.",
+"category": "framework-rails"
+}
+]
+}