launchprep 0.4.0 → 0.5.0

package/README.md

@@ -69,6 +69,27 @@ the report link keeps working, and that link expires.
 
 If there is no terminal — CI, a script — it refuses rather than assuming yes.
 
+## Telling it about your app
+
+Some things are not in the code — where your users live, whether your AI is
+allowed to act, how many people you expect. Those checks are skipped, and the
+scan lists them. Put the answers in `launchprep.json` at the top of your
+project and run again:
+
+```json
+{
+  "jurisdictions": ["eu"],
+  "has_accounts": true,
+  "llm_tools_enabled": true,
+  "stage": "production"
+}
+```
+
+What you state beats what was detected, and the report shows it back under
+**You said** so a wrong answer is visible rather than silently changing
+results. The free scan is unlimited, so correcting and re-running costs
+nothing.
+
 ## In CI
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "launchprep",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Launch readiness checker. Reads your code and tells you what will break before your users find out.",
   "type": "module",
   "bin": {
@@ -17,7 +17,7 @@
   "scripts": {
     "verify": "node scripts/verify-readonly.mjs",
     "pretest": "node scripts/verify-readonly.mjs",
-    "test": "node test/run.mjs && node test/gate.mjs && node test/redact.mjs",
+    "test": "node test/run.mjs && node test/gate.mjs && node test/redact.mjs && node test/git-history.mjs && node test/no-false-alarms.mjs && node test/answers.mjs",
     "prepack": "node scripts/prepare-publish.mjs",
     "postpack": "node scripts/restore-after-publish.mjs"
   },

package/src/checks-ai.mjs

@@ -1,12 +1,21 @@
 // AI cost and safety. Barely covered by the corpus, which is exactly why it
 // matters: this is the family nobody else is checking.
+import { looksLikePlaceholder } from './placeholder.mjs';
+
 const finding = (id, title, severity, file, line, detail, fix) =>
   ({ id, title, severity, file, line, detail, fix });
 
 const lineOf = (text, i) => text.slice(0, i).split('\n').length;
 const isCode = (p) => /\.(ts|tsx|js|jsx|mjs|cjs|py)$/.test(p);
-const isServer = (p) => /\/(api|routes?|server|actions?|controllers?|lib|services?)\//.test(p);
-const isClient = (p) => /\/(components?|pages?|app|src)\//.test(p) && !isServer(p);
+// (^|/) not just / — a slash was REQUIRED before the word, so a project laid
+// out as api/src/... or server/src/... or backend/src/... never matched as a
+// server, and then matched as a browser because it contains /src/. Result: the
+// scanner told people running a plain Node backend that their API key was
+// "shipped to every visitor". It fired twice on this repository's own api/.
+// A fabricated CRITICAL is the failure this whole product is built to avoid.
+// 'backend' and 'worker' added because they are as common as 'server'.
+const isServer = (p) => /(^|\/)(api|routes?|server|backend|actions?|controllers?|handlers?|endpoints?|resolvers?|lib|services?|workers?|jobs?)\//.test(p);
+const isClient = (p) => /(^|\/)(components?|pages?|app|src|client|frontend|ui|views?)\//.test(p) && !isServer(p);
 
 const LLM_CALL = /\.(messages|chat\.completions|completions|responses)\.create\s*\(|generateText\s*\(|streamText\s*\(|\.generateContent\s*\(/;
 
@@ -148,12 +157,24 @@ export const AI_CHECKS = [
     const out = [];
     for (const f of repo.files) {
       if (!f.text || !isCode(f.path)) continue;
-      const re = /\b(eval|exec|execSync|spawnSync|Function)\s*\(|\.query\s*\(\s*`/g;
+      // `exec` as a bare word is two different things. `child_process.exec(cmd)`
+      // runs a program; `re.exec(text)` is how JavaScript matches a regular
+      // expression, and appears in ordinary code constantly - three times in
+      // this scanner's own source, which is how it reported three CRITICALs
+      // about itself. So `.exec(` preceded by a dot only counts when the thing
+      // before the dot is actually child_process.
+      const re = /(?<![.\w])(eval|execSync|execFileSync|spawnSync|Function)\s*\(|(?<![.\w])exec\s*\(|\b(?:child_process|cp|shell)\.exec(?:File)?\s*\(|\.query\s*\(\s*`/g;
       let m;
       while ((m = re.exec(f.text))) {
         const around = f.text.slice(Math.max(0, m.index - 600), m.index + 200);
         if (!LLM_CALL.test(around) &&
             !/\b(completion|aiResponse|modelOutput|generated|llmResult)\b/i.test(around)) continue;
+        // "generated" and "completion" are ordinary English words. Requiring
+        // the neighbourhood to ALSO look like a model call stops a comment
+        // containing "generated" from turning a regex into a CRITICAL.
+        const ls = f.text.lastIndexOf('\n', m.index) + 1;
+        let le = f.text.indexOf('\n', m.index); if (le < 0) le = f.text.length;
+        if (looksLikePlaceholder(m[0], f.text.slice(ls, le), f.path)) continue;
         out.push(finding('AI-008', 'Model output used in a privileged operation', 'critical',
           f.path, lineOf(f.text, m.index),
           'What the model returns is being executed or used to build a query. Anyone who can steer the model can steer this.',
@@ -187,6 +208,12 @@ export const AI_CHECKS = [
 // ---- provider key used straight from the browser -------------------------
 { id: 'SEC-006', run(repo, profile) {
     if (!profile.calls_llm) return [];
+    // An app with no browser cannot ship a key to one. profile -> gate -> check
+    // is the whole idea of this scanner, and this check skipped the profile
+    // step: on an api-only, CLI or library project every src/ file looked like
+    // browser code, so a plain Node script was told its key is "shipped to
+    // every visitor" when it has no visitors.
+    if (['api-only', 'cli', 'library', 'mobile-ios', 'mobile-android'].includes(profile.surface)) return [];
     const out = [];
     for (const f of repo.files) {
       if (!f.text || !isCode(f.path) || !isClient(f.path)) continue;

package/src/checks-deploy.mjs

@@ -1,4 +1,6 @@
 // Deployment and transport. Mechanically detectable, high volume.
+import { looksLikePlaceholder } from './placeholder.mjs';
+
 const finding = (id, title, severity, file, line, detail, fix) =>
   ({ id, title, severity, file, line, detail, fix });
 const lineOf = (t, i) => t.slice(0, i).split('\n').length;
@@ -33,6 +35,12 @@ export const DEPLOY_CHECKS = [
       f.text.split('\n').forEach((line, i) => {
         if (/\$\{\{\s*secrets\./.test(line)) return;           // the correct pattern
         const m = line.match(SECRET_VALUE);
+        // Every project that tests against a database puts a throwaway one in
+        // CI - postgres:postgres@localhost/..._test. That is not a credential,
+        // and flagging it as a CRITICAL on nearly every real repository is how
+        // a scanner loses the right to be believed. This repo's own CI was
+        // flagged by this check.
+        if (m && looksLikePlaceholder(m[0], line, f.path)) return;
         if (m) out.push(finding('DEP-002', 'Credential written into the CI config', 'critical',
           f.path, i + 1,
           'This value is committed to the repository and printed in build logs. Anyone with read access to either has it.',

package/src/checks.mjs

@@ -9,6 +9,8 @@ import { FRAMEWORK_CHECKS } from './checks-frameworks.mjs';
 import { BATCH2_CHECKS } from './checks-batch2.mjs';
 import { BATCH3_CHECKS } from './checks-batch3.mjs';
 import { BATCH4_CHECKS } from './checks-batch4.mjs';
+import { scanGitHistory } from './git-history.mjs';
+import { looksLikePlaceholder } from './placeholder.mjs';
 
 const finding = (id, title, severity, file, line, detail, fix) =>
   ({ id, title, severity, file, line, detail, fix });
@@ -17,6 +19,32 @@ const lineOf = (text, index) => text.slice(0, index).split('\n').length;
 
 const BASE_CHECKS = [
 
+// SEC-009 — a key that was committed, then "removed". SEC-001/003 read the
+// working tree, so deleting the line hides it from them while it stays in
+// .git forever and travels with every clone. scope:'root' because history is
+// a property of the repository, not of a workspace.
+//
+// Only vendor-prefixed keys are looked for. See the long note in
+// git-history.mjs: a test private key and a real one are byte-identical, so
+// including those types fired on 15 of 68 real repositories and every hit was
+// a fixture. Narrowed to unmistakable prefixes it fires on 0 of 20.
+{ id:'SEC-009', scope:'root', run(repo){
+    const res = scanGitHistory(repo.root);
+    if (!res.findings.length) return [];
+    const kinds = [...new Set(res.findings.map(f => f.label))];
+    const what = kinds.length === 1 ? kinds[0]
+      : `${kinds.slice(0, -1).join(', ')} and ${kinds[kinds.length - 1]}`;
+    const n = res.findings.length;
+    return [finding('SEC-009',
+      `${n === 1 ? 'A key was' : `${n} keys were`} committed and is still in your git history`,
+      'critical', '.git', 1,
+      `Your ${what} appears in an old commit. Removing it from the file did not remove it — ` +
+      'every clone, fork and fetch of this repository still carries it, and anyone who has ever ' +
+      'had a copy can read it. Treat it as public.',
+      'Rotate the key at the provider now — that is what actually stops it being used. ' +
+      'Rewriting history afterwards is optional and does not help anyone who already cloned.')];
+  }},
+
 { id:'SEC-002', run(repo){
     const gi = repo.read('.gitignore');
     if (gi === null) return [];
@@ -85,6 +113,14 @@ const BASE_CHECKS = [
       for (const [re,label] of PATTERNS){
         let m; re.lastIndex=0;
         while ((m=re.exec(f.text))){
+          // The shape of a key is not a key. AWS publishes AKIAIOSFODNN7EXAMPLE
+          // in its own docs; a regex that LOOKS FOR keys contains one by
+          // definition; a test fixture is meant to. Scanning this repository
+          // produced four CRITICALs and every one was the scanner reading its
+          // own detection patterns back to itself.
+          const ls = f.text.lastIndexOf('\n', m.index) + 1;
+          let le = f.text.indexOf('\n', m.index); if (le < 0) le = f.text.length;
+          if (looksLikePlaceholder(m[0], f.text.slice(ls, le), f.path)) continue;
           out.push(finding('SEC-003',`Hardcoded ${label}`,'critical',
             f.path, lineOf(f.text,m.index),
             `A live ${label} is written directly into this file.`,

package/src/git-history.mjs

@@ -0,0 +1,255 @@
+// Read git's object store to find secrets that were committed and later
+// "removed".
+//
+// SEC-001 and SEC-003 read the working tree. That misses the mistake people
+// actually make: commit a key, notice, delete the line, commit again, and
+// believe it is gone. It is not. Every old version of every file is still in
+// .git, and it travels with every clone, every fork and every fetch. The
+// scanner's own finding text already said "deleting it later does not remove it
+// from git history" — and then did not look there.
+//
+// Read-only, and directly: verify-readonly.mjs forbids shelling out, so there
+// is no `git log` here. Loose objects are zlib streams on disk; packed objects
+// live in a packfile with its own index. Both are just reads.
+//
+// This is deliberately NOT a full git implementation. It reads blobs — the file
+// contents — and never needs to walk commits, resolve trees or understand
+// branches, because the question is only "does any version of anything in this
+// repository contain a secret", and every version of everything is a blob.
+import { readdirSync, readFileSync, existsSync, statSync } from 'node:fs';
+import { inflateSync, inflateRawSync } from 'node:zlib';
+import { join } from 'node:path';
+
+// ONLY credentials whose format means one thing and cannot mean another.
+//
+// This list was cut down after measuring, and the cut is the whole reason this
+// check is shippable. The first version looked for private keys, database URLs
+// and AWS/Google/Slack keys too, and fired on 15 of 68 real repositories — every
+// single hit a test fixture, a docker-compose service, or documentation. Five
+// rounds of filters got that to 22% and no further, because of one fact that no
+// amount of pattern-matching can get around:
+//
+//   A test private key and a production private key are BYTE-IDENTICAL. So are
+//   a docker-compose password and a real one. Only intent separates them, and
+//   intent is not in the value.
+//
+// A vendor-prefixed key is different: `sk_live_` is issued by Stripe and means
+// a live secret key, always. Nobody's test fixture has a real one. Narrowed to
+// these, the check fires on 2 of 21 repositories — and one of those two is
+// GitLab's own repository, which contains GitLab test tokens.
+//
+// The dropped types are not a gap we are hiding: SEC-001 and SEC-003 still find
+// all of them in the working tree. What is given up is only finding THOSE kinds
+// in deleted history, which is the exact case where they cannot be judged.
+const SECRETS = [
+  [/\bsk_live_[A-Za-z0-9]{20,}/g,            'Stripe live secret key'],
+  [/\brk_live_[A-Za-z0-9]{20,}/g,            'Stripe restricted live key'],
+  [/\bwhsec_[A-Za-z0-9]{24,}/g,              'Stripe webhook signing secret'],
+  [/\bsk-ant-[A-Za-z0-9_-]{24,}/g,           'Anthropic API key'],
+  [/\bsk-proj-[A-Za-z0-9_-]{24,}/g,          'OpenAI project key'],
+  [/\bghp_[A-Za-z0-9]{36,}/g,                'GitHub personal access token'],
+  [/\bgho_[A-Za-z0-9]{36,}/g,                'GitHub OAuth token'],
+  [/\bglpat-[A-Za-z0-9_-]{20,}/g,            'GitLab personal access token'],
+  [/\bSG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/g, 'SendGrid API key'],
+];
+
+// The first audit of this check fired on 7 of 8 major repositories and every
+// single hit was documentation, a test fixture or a secretlint allowlist — the
+// exact "matched a shape instead of judging the context" failure this codebase
+// has already made seven times. Three filters, in order of how much they caught:
+//
+//  1. The VALUE itself is a sample. `sk_live_abcdefghijk...` and
+//     `redis://username:password@host:port/db` are not credentials, they are
+//     the shape of one written down. A real secret is high-entropy; a fake one
+//     spells words, runs the alphabet, or literally says "password".
+//  2. The surrounding LINE is prose or a fixture — a docs code fence, an
+//     `expect(...)`, an allowlist entry.
+//  3. The blob is a documentation or test FILE.
+const FAKE_VALUE = [
+  // No \b: a fixture key spells the word INSIDE the token, e.g.
+  // sk_live_51H8xExAmPlEkEyAbCdEf123. Word boundaries never match there, and
+  // that gap let this check fire on its own repository's test file.
+  /(example|sample|dummy|placeholder|fake|changeme|redacted|notreal|donotuse)/i,
+  /\b(your[_-]?key|my[_-]?secret|xxx+)\b/i,
+  /abcdefghij|0123456789|qwerty|lorem/i,
+  // A substitution of ANY form means the real value is not here: ${VAR},
+  // {{var}}, [password], <password>, %s, $VAR. Every remaining false positive
+  // in the first two audits was one of these.
+  /[$%]\{|\{\{|\[[a-z][a-z0-9_.-]*\]|<[a-z][a-z0-9_.-]*>|\$[A-Z_][A-Z0-9_]*/i,
+  // credentials that are the words for credentials
+  /:\/\/(?:user|username|admin|root|foo|bar|test|me|you)[^:@/]*:(?:pass|password|passwd|secret|hunter2|foo|bar|test)/i,
+  // A password containing "test", "demo", "local" or "dev" is a fixture. The
+  // corpus is full of mostest_password, knextest, devpassword.
+  /:\/\/[^:@/]+:[^@/]*(?:test|demo|local|dev|dummy|ci)[^@/]*@/i,
+  // A password that merely repeats the username or the service is a default,
+  // not a secret: postgres:postgres@, mysql:mysql@, redis:redis@.
+  /:\/\/([a-z0-9_-]+):\1@/i,
+  // The host is an internal service name from a docker-compose or CI network —
+  // a single label with no dot, e.g. @postgres:5432, @db, @mysql. A production
+  // database is reached at a real hostname.
+  /@(?:postgres|postgresql|mysql|mariadb|mongo|mongodb|redis|db|database|cache|queue)(?:[-_][a-z0-9-]+)?(?::\d+)?(?:[/?]|$)/i,
+  // a placeholder host is a placeholder URL
+  /@(?:localhost|127\.0\.0\.1|0\.0\.0\.0|host|hostname|example\.(?:com|org|net)|your[^\s/]*)(?:[:/]|$)/i,
+  // no dot in the host at all: not a routable production endpoint
+  /:\/\/[^@/]+@[a-z0-9_-]+(?::\d+)?(?:[/?]|$)/i,
+  // AWS's own documentation key
+  /^AKIAIOSFODNN7EXAMPLE$/,
+];
+// Entropy: a real key is random. `sk_live_abcdef...` is not. Measured over the
+// secret's payload, after the recognisable prefix.
+function looksRandom(value) {
+  const body = value.replace(/^(sk_live_|rk_live_|whsec_|sk-ant-|sk-proj-|AKIA|AIza|gh[pousr]_|glpat-|xox[baprs]-|SG\.)/, '');
+  if (body.length < 12) return true;                 // too short to judge; keep it
+  const set = new Set(body.replace(/[^A-Za-z0-9]/g, ''));
+  if (set.size < 8) return false;                    // e.g. all a-f, or one repeated run
+  // sequential alphabet or digits is the signature of a hand-typed placeholder
+  let runs = 0;
+  for (let i = 1; i < body.length; i++) if (body.charCodeAt(i) === body.charCodeAt(i - 1) + 1) runs++;
+  return runs < body.length * 0.3;
+}
+// The line the secret sits on. Docs, assertions and allowlists are not leaks.
+const FAKE_LINE = /(^\s*[#*]|^\s*\/\/|\.\. |::$|`{1,3}|expect\(|assert|describe\(|it\(|test\(|allows?"?\s*:|allowlist|secretlint|gitleaks|trufflehog|\.md:|<\/?[a-z]+>)/i;
+
+// What the secret was ASSIGNED TO, looking back from the match. A real key and
+// a test key are byte-identical — the only difference is intent, and intent is
+// written in the name above it. `EXAMPLE_PRIVATE_KEY = """`, `KEY1 = """` under
+// a "Keys and certificates for tests" docstring, `TEST_CERT`, `FIXTURE_KEY`.
+// This was the last class of false positive left in the corpus audit.
+const FAKE_DECLARATION = /\b(example|sample|test|tests|testing|fixture|mock|stub|dummy|fake|demo|placeholder|invalid|expired|revoked|specimen)[a-z0-9_]*\s*[:=]\s*(?:"""|'''|["'`]|$)/i;
+// The blob is documentation or a fixture. Detected from the content, since a
+// blob does not carry its path.
+//
+// The strongest signal is that the blob IS a test file. A test asserting that
+// secret-handling works necessarily contains secret-shaped strings — this
+// scanner's own test/redact.mjs does, and that is what made SEC-009 fire on
+// Launchprep's own repository the first time it ran. A key inside a test file
+// is a fixture; a real one would never be committed there deliberately.
+const FAKE_BLOB = /(^|\n)(#{1,3} |\.\. _|={3,}$|-{3,}$)|describe\(|it\(['"`]|def test_|class Test|@pytest|\bfixtures?\b/i;
+const IS_TEST_FILE = /(^|\n)\s*(?:import|from|const|let|require)[^\n]*\b(?:assert|chai|jest|mocha|vitest|pytest|unittest|testing)\b|(^|\n)\s*(?:describe|it|test)\s*\(|(^|\n)\s*(?:def test_|class Test)|\bok\(['"`]|expect\(/;
+
+// A blob big enough to be a build artefact or a vendored bundle is not where a
+// human pasted a key, and inflating hundreds of them is the whole cost here.
+const MAX_BLOB = 400_000;
+// A ceiling on total work so an enormous repository cannot make a scan hang.
+// Reached only on repositories with very deep history; reported honestly when
+// it happens rather than silently truncating.
+const MAX_OBJECTS = 20_000;
+
+function looseObjects(objDir, budget) {
+  const out = [];
+  let buckets;
+  try { buckets = readdirSync(objDir); } catch { return out; }
+  for (const b of buckets) {
+    if (!/^[0-9a-f]{2}$/.test(b)) continue;
+    let files;
+    try { files = readdirSync(join(objDir, b)); } catch { continue; }
+    for (const f of files) {
+      if (out.length >= budget) return out;
+      out.push({ id: b + f, path: join(objDir, b, f) });
+    }
+  }
+  return out;
+}
+
+// A packfile stores objects as a stream of zlib chunks with no per-object
+// offsets available without parsing .idx. Rather than implement idx parsing and
+// delta reconstruction — a large amount of code for a small gain — the packfile
+// is scanned for the zlib streams it contains and each is inflated where it
+// can be. Objects stored as deltas against another object are skipped: they are
+// modifications of a base, and a secret introduced in one shows up in the full
+// copy of some version anyway. Reported in `partial` so a clean result on a
+// packed repository never silently claims more than it checked.
+function packedBlobs(packDir, budget, onBlob) {
+  let files;
+  try { files = readdirSync(packDir); } catch { return { scanned: 0, partial: false }; }
+  let scanned = 0, partial = false;
+  for (const f of files.filter(x => x.endsWith('.pack'))) {
+    let buf;
+    try { buf = readFileSync(join(packDir, f)); } catch { continue; }
+    // header: 'PACK', version, count
+    if (buf.length < 12 || buf.toString('latin1', 0, 4) !== 'PACK') continue;
+    // Walk looking for zlib stream starts (0x78 followed by a valid check byte).
+    // Inflating from a wrong offset simply throws and is skipped, so a false
+    // start costs nothing but a try/catch.
+    for (let i = 12; i < buf.length - 2; i++) {
+      if (scanned >= budget) { partial = true; return { scanned, partial }; }
+      if (buf[i] !== 0x78) continue;
+      const b1 = buf[i + 1];
+      if (((buf[i] << 8) | b1) % 31 !== 0) continue;
+      try {
+        const inflated = inflateSync(buf.subarray(i), { finishFlush: 2 /* Z_SYNC_FLUSH */ });
+        if (inflated.length && inflated.length <= MAX_BLOB) {
+          scanned++;
+          onBlob(inflated.toString('utf8'), `${f}@${i}`);
+        }
+      } catch { /* not a stream start, or a delta we do not reconstruct */ }
+    }
+  }
+  return { scanned, partial };
+}
+
+// Returns { findings, objectsScanned, partial, reason }.
+// `reason` is set when history could not be read at all, so the caller can say
+// so rather than implying a clean history.
+export function scanGitHistory(root) {
+  const gitDir = join(root, '.git');
+  if (!existsSync(gitDir)) return { findings: [], objectsScanned: 0, partial: false, reason: 'no-git' };
+  // A worktree or submodule has .git as a FILE pointing elsewhere. Not followed:
+  // the pointer can lead outside the directory the user asked us to scan, and
+  // reading outside it is not ours to do.
+  try { if (!statSync(gitDir).isDirectory()) return { findings: [], objectsScanned: 0, partial: false, reason: 'git-is-a-file' }; }
+  catch { return { findings: [], objectsScanned: 0, partial: false, reason: 'no-git' }; }
+
+  const seen = new Set();
+  const findings = [];
+  let objectsScanned = 0;
+
+  const inspect = (text, where) => {
+    if (!text || text.length > MAX_BLOB) return;
+    // A documentation page or a test file can contain any number of
+    // key-shaped strings and none of them are leaks.
+    const docish = FAKE_BLOB.test(text.slice(0, 2000)) || IS_TEST_FILE.test(text.slice(0, 4000));
+    for (const [re, label] of SECRETS) {
+      re.lastIndex = 0;
+      let m;
+      while ((m = re.exec(text))) {
+        const value = m[0];
+        if (FAKE_VALUE.some(f => f.test(value))) continue;
+        if (!looksRandom(value)) continue;
+        // the line it sits on decides as much as the value does
+        const ls = text.lastIndexOf('\n', m.index) + 1;
+        let le = text.indexOf('\n', m.index); if (le < 0) le = text.length;
+        const line = text.slice(ls, le);
+        if (FAKE_LINE.test(line)) continue;
+        // Look back a few hundred characters for the declaration this value was
+        // assigned to, and for a test/fixture docstring above it.
+        const before = text.slice(Math.max(0, m.index - 300), m.index);
+        if (FAKE_DECLARATION.test(before)) continue;
+        if (/\b(for tests?|test (?:keys?|certs?|fixtures?|data)|do not use|not a real)\b/i.test(before)) continue;
+        if (docish) continue;
+        // One finding per distinct secret, however many old commits carry it.
+        const key = label + ':' + value.slice(0, 24);
+        if (seen.has(key)) continue;
+        seen.add(key);
+        findings.push({ label, where, hint: value.slice(0, 7) + '…' });
+      }
+    }
+  };
+
+  const objDir = join(gitDir, 'objects');
+  for (const o of looseObjects(objDir, MAX_OBJECTS)) {
+    try {
+      const raw = inflateSync(readFileSync(o.path));
+      const nul = raw.indexOf(0);
+      if (nul < 0) continue;
+      if (!raw.subarray(0, nul).toString('latin1').startsWith('blob')) continue;
+      objectsScanned++;
+      inspect(raw.subarray(nul + 1).toString('utf8'), o.id.slice(0, 8));
+    } catch { /* unreadable object; skipped */ }
+  }
+
+  const packed = packedBlobs(join(objDir, 'pack'), MAX_OBJECTS - objectsScanned, inspect);
+  objectsScanned += packed.scanned;
+
+  return { findings, objectsScanned, partial: packed.partial, reason: null };
+}

package/src/index.mjs

@@ -3,7 +3,7 @@ import { scanRepo } from './fs-scan.mjs';
 import { splitWorkspaces } from './workspace.mjs';
 import { detectProfile, toGateProfile } from './detect.mjs';
 import { gate, missingFacts } from './gate.mjs';
-import { runChecks, runRootChecks } from './checks.mjs';
+import { runChecks, runRootChecks, CHECKS } from './checks.mjs';
 import { render } from './report.mjs';
 import { existsSync, statSync } from 'node:fs';
 
@@ -41,11 +41,48 @@ if (!existsSync(target) || !statSync(target).isDirectory()) {
 const repo = scanRepo(target, { maxFiles: 12000 });
 const packages = splitWorkspaces(repo);
 
+// What the user told us about their own app, which beats what we guessed.
+//
+// The scanner works most things out from the code, but some facts are simply
+// not in the code — where the users live, whether the AI is allowed to act,
+// how many people are expected. Those checks were skipped and the report said
+// "Correct it and the checks adjust", which was false: there was no way to
+// correct anything. This is that way.
+//
+// Reading a file the user wrote is still read-only. Nothing is written.
+const stated = (() => {
+  const raw = repo.read('launchprep.json');
+  if (raw === null) return null;
+  try {
+    const j = JSON.parse(raw);
+    return (j && typeof j === 'object' && !Array.isArray(j)) ? j : null;
+  } catch (e) {
+    // A broken file must be loud. Silently ignoring it would mean the user
+    // answers the questions, sees no change, and concludes the feature is fake.
+    process.stderr.write(`\n  \x1b[31mlaunchprep.json could not be read: ${e.message}\x1b[0m\n`);
+    process.stderr.write(`  \x1b[2mIt must be valid JSON. Nothing from it was used.\x1b[0m\n\n`);
+    return null;
+  }
+})();
+
+// Merge one level deep so { "stack": { "auth": "clerk" } } overrides only auth
+// and leaves the detected framework and database alone.
+const applyStated = (profile) => {
+  if (!stated) return profile;
+  const out = { ...profile };
+  for (const [k, v] of Object.entries(stated)) {
+    if (v && typeof v === 'object' && !Array.isArray(v) && out[k] && typeof out[k] === 'object')
+      out[k] = { ...out[k], ...v };
+    else out[k] = v;
+  }
+  return out;
+};
+
 // Profile and gate every app in the repo. Libraries are profiled too - they
 // simply match very few rules, which is the correct outcome, not a bug.
 const scanned = packages.map(w => {
   const full = detectProfile(w.view, { root: repo });
-  const profile = toGateProfile(full);
+  const profile = applyStated(toGateProfile(full));
   const g = gate(profile);
   const applicableIds = new Set(g.evaluated.map(r => r.id));
   const findings = runChecks(w.view, profile, applicableIds)
@@ -86,17 +123,28 @@ const shallow = lead.gate.evaluated
 
 const questions = missingFacts(lead.profile, lead.gate.unknown).slice(0, 3);
 
+// "51 checks apply to this app" counted 17 that nothing examined — tier-2 rules
+// that need the deep scan. Counting them as applying is a silent pass on a
+// third of the headline number, which is the one thing this scanner must never
+// do. It also threw away the sentence that sells the paid tier: those 17 are
+// not a gap, they are the product.
+const implemented = new Set(CHECKS.map(c => c.id));
+const coverage = {
+  ran:       lead.gate.evaluated.filter(r => implemented.has(r.id)).length,
+  needsDeep: lead.gate.evaluated.filter(r => !implemented.has(r.id)).length,
+};
+
 if (asJson) {
   console.log(JSON.stringify({
     packages: scanned.map(s => ({
       name: s.name, profile: s.profile,
       evaluated: s.gate.evaluated.length, skipped: s.gate.skipped.length, unknown: s.gate.unknown.length,
     })),
-    findings, questions,
+    findings, questions, coverage, stated,
     shallow: shallow.map(r => ({ id: r.id, title: r.title, severity: r.severity })),
   }, null, 2));
 } else {
-  process.stdout.write(render({ repo: target, scanned, lead, findings, questions, shallow }));
+  process.stdout.write(render({ repo: target, scanned, lead, findings, questions, shallow, coverage, stated }));
 }
 
 // The gate, after the full report has printed: the human still sees

package/src/placeholder.mjs

@@ -0,0 +1,72 @@
+// Is this value a real credential, or something that only looks like one?
+//
+// This is the seventh-and-eighth instance of the mistake this codebase keeps
+// making: matching a SHAPE and calling it a secret. Scanning its own repository
+// produced five CRITICALs and every one was this —
+//
+//   .github/workflows/ci.yml   postgresql://postgres:postgres@localhost/..._test
+//   cli/src/git-history.mjs    /^AKIAIOSFODNN7EXAMPLE$/     (a detection pattern)
+//   cli/src/checks-*.mjs       the regexes that look for model output
+//
+// None is a credential. The first is the throwaway database every project with
+// CI tests spins up; the second is AWS's own published example; the third is
+// source code that describes a pattern rather than containing a secret.
+//
+// The discipline is the one written at the top of the project guide: read the
+// VALUE, and the line it sits on, not the shape. A leaked key is high-entropy,
+// points at a real host, and is not sitting inside a regex.
+//
+// The redaction pass in redact.mjs learned the same lesson separately. This is
+// the shared version so a fix in one place is a fix in both.
+
+// The value spells out that it is not real.
+const FAKE_WORDS = /(example|sample|dummy|placeholder|fake|changeme|redacted|notreal|donotuse|yourkey|your[_-]key|xxx+|test[_-]?key|foobar)/i;
+
+// Sequences a human types when inventing a key.
+const TYPED_BY_HAND = /abcdefghij|0123456789|qwerty|lorem|(.)\1{7,}/i;
+
+// A substitution means the real value is somewhere else: ${VAR}, {{var}},
+// [password], <password>, $VAR, %s.
+const SUBSTITUTION = /[$%]\{|\{\{|\[[a-z][a-z0-9_.-]*\]|<[a-z][a-z0-9_.-]*>|\$[A-Z_][A-Z0-9_]*/i;
+
+// A connection string that points nowhere real.
+const LOCAL_OR_SERVICE_HOST =
+  /@(?:localhost|127\.0\.0\.1|0\.0\.0\.0|host|hostname|example\.(?:com|org|net)|postgres|postgresql|mysql|mariadb|mongo|mongodb|redis|db|database)(?:[-_][a-z0-9-]+)?(?::\d+)?(?:[/?]|$)/i;
+// user and password are the same word, or are the words for themselves.
+const DEFAULT_CREDENTIALS =
+  /:\/\/([a-z0-9_-]+):\1@|:\/\/(?:user|username|admin|root|foo|bar|test|me)[^:@/]*:(?:pass|password|passwd|secret|hunter2|foo|bar|test)/i;
+// a password that announces it is for testing
+const TEST_CREDENTIALS = /:\/\/[^:@/]+:[^@/]*(?:test|demo|local|dev|dummy|ci|example)[^@/]*@/i;
+
+// AWS publishes these two in its own documentation. They are in a thousand
+// READMEs and are not anyone's key.
+const AWS_DOC_KEYS = /^(AKIAIOSFODNN7EXAMPLE|ASIAIOSFODNN7EXAMPLE)$/;
+
+/**
+ * @param value the matched string
+ * @param line  the whole line it appeared on (optional, but much better with it)
+ * @param path  the file path (optional)
+ */
+export function looksLikePlaceholder(value, line = '', path = '') {
+  const v = String(value);
+
+  if (FAKE_WORDS.test(v) || TYPED_BY_HAND.test(v) || SUBSTITUTION.test(v)) return true;
+  if (AWS_DOC_KEYS.test(v)) return true;
+  if (LOCAL_OR_SERVICE_HOST.test(v) || DEFAULT_CREDENTIALS.test(v) || TEST_CREDENTIALS.test(v)) return true;
+
+  const l = String(line);
+  // The line DEFINES a pattern rather than holding a secret: a regex literal,
+  // a list of shapes to look for. This is what made the scanner flag itself.
+  if (/\/\^|\^.*\$\/|\\b|\\d|\\w|\[A-Za-z0-9|\[0-9A-Z|RegExp\(|\.test\(|\.match\(/.test(l)) return true;
+  // A comment, or documentation showing the format.
+  if (/^\s*(?:[#*]|\/\/|--)/.test(l)) return true;
+  // An assertion or fixture.
+  if (/expect\(|assert|describe\(|it\(['"`]|toBe\(|toEqual\(/.test(l)) return true;
+
+  const p = String(path);
+  // A test file or a fixture directory is not where real credentials live.
+  if (/(^|\/)(test|tests|__tests__|spec|e2e|cypress|fixtures?|mocks?|__mocks__|examples?)\//.test(p)) return true;
+  if (/\.(test|spec)\.[a-z]+$/.test(p)) return true;
+
+  return false;
+}

package/src/questions.mjs

@@ -0,0 +1,206 @@
+// The questions the scanner asks when it cannot tell something from the code,
+// written for the person who reads the report.
+//
+// The scanner can gate on 33 facts. Five of them had wording; the other 28
+// printed their internal name — a customer saw "? llm_tools_enabled" and
+// "? has_webhooks_in" as the last thing on screen. The stated audience is
+// people who cannot read code, and those are not questions, they are variable
+// names a programmer wrote for themselves.
+//
+// Each entry carries:
+//   ask     the question, in words someone non-technical can answer
+//   answer  what to write in launchprep.json, shown so the answer is obvious
+//   why     what it unlocks, so the question does not feel like paperwork
+//
+// The rule for the wording is the same one the findings follow: name the
+// consequence, not the mechanism. "Can people sign in?" not "has_accounts".
+export const QUESTION = {
+  // --- who and where -------------------------------------------------------
+  jurisdictions: {
+    ask: 'Where do your users live?',
+    answer: '"jurisdictions": ["eu"]   — any of: eu, uk, us, ca, ru, kz, other',
+    why: 'decides which privacy laws reach you at all',
+  },
+  business_model: {
+    ask: 'Who is this for — businesses, consumers, or a marketplace?',
+    answer: '"business_model": "b2b-saas"   — b2b-saas, b2c, marketplace, internal',
+    why: 'a marketplace holds other people’s money and has different duties',
+  },
+  expected_scale: {
+    ask: 'Roughly how many users do you expect in the first year?',
+    answer: '"expected_scale": "under-100k"   — under-1k, under-100k, over-100k',
+    why: 'what is safe at 100 users falls over at 100,000',
+  },
+  audience_locale: {
+    ask: 'Do you serve more than one language or region?',
+    answer: '"audience_locale": "multi"   — single, multi',
+    why: 'dates, times and text break first when you cross a border',
+  },
+  serves_currency: {
+    ask: 'Do you charge in more than one currency?',
+    answer: '"serves_currency": "multi"   — single, multi',
+    why: 'rounding and exchange rates are where money quietly goes missing',
+  },
+  data_sensitivity: {
+    ask: 'Do you hold anything especially sensitive — money, health, or data about children?',
+    answer: '"data_sensitivity": "financial"   — normal, financial, health, children',
+    why: 'these carry duties ordinary personal data does not',
+  },
+
+  // --- what the app is -----------------------------------------------------
+  surface: {
+    ask: 'What is it — a website, a web app, an API, or a mobile app?',
+    answer: '"surface": "web-app"   — web-site, web-app, api-only, mobile-ios, mobile-android, cli, library',
+    why: 'a static site cannot have most of these problems, and is not asked about them',
+  },
+  stage: {
+    ask: 'Is this live, about to launch, or still a prototype?',
+    answer: '"stage": "pre-launch"   — prototype, pre-launch, production',
+    why: 'a prototype is not asked about backups; something about to launch is',
+  },
+  is_public: {
+    ask: 'Can anyone on the internet reach it, or is it internal only?',
+    answer: '"is_public": true',
+    why: 'an internal tool has a very different attack surface',
+  },
+  tenancy: {
+    ask: 'Do separate companies or teams share one database?',
+    answer: '"tenancy": "multi-tenant-shared-db"   — single-tenant, multi-tenant-shared-db, multi-tenant-isolated',
+    why: 'this is the setting behind "one customer can read another customer’s data"',
+  },
+
+  // --- accounts and access -------------------------------------------------
+  has_accounts: {
+    ask: 'Can people sign in?',
+    answer: '"has_accounts": true',
+    why: 'unlocks every check about logins, sessions and passwords',
+  },
+  has_roles: {
+    ask: 'Do some users have more power than others — admin, editor, viewer?',
+    answer: '"has_roles": true',
+    why: 'unlocks the checks about someone giving themselves permissions',
+  },
+  has_admin_panel: {
+    ask: 'Is there an admin area only you and your staff can reach?',
+    answer: '"has_admin_panel": true',
+    why: 'an admin page left open is the shortest path to everything',
+  },
+  has_invitations: {
+    ask: 'Can users invite other people to join them?',
+    answer: '"has_invitations": true',
+    why: 'invite links are commonly guessable or never expire',
+  },
+  stack_auth: {
+    ask: 'How do people sign in — your own code, or a service?',
+    answer: '"stack": { "auth": "supabase-auth" }   — custom, supabase-auth, clerk, auth0, nextauth, devise',
+    why: 'hand-written login code is checked far more strictly',
+  },
+
+  // --- money ---------------------------------------------------------------
+  handles_payments: {
+    ask: 'Do you take payments, and through whom?',
+    answer: '"handles_payments": "stripe"   — none, stripe, paddle, lemonsqueezy, other',
+    why: 'unlocks the checks about webhooks, refunds and money stored as decimals',
+  },
+  has_subscriptions: {
+    ask: 'Do people pay you repeatedly — a subscription?',
+    answer: '"has_subscriptions": true',
+    why: 'failed renewals and cancellations are where subscription apps leak money',
+  },
+
+  // --- AI ------------------------------------------------------------------
+  calls_llm: {
+    ask: 'Does your app call an AI model?',
+    answer: '"calls_llm": true',
+    why: 'unlocks the AI checks — runaway costs, prompt injection, model output',
+  },
+  llm_input_from_user: {
+    ask: 'Does anything a user types get sent to the AI?',
+    answer: '"llm_input_from_user": true',
+    why: 'this is the difference between a prompt you wrote and one a stranger did',
+  },
+  llm_tools_enabled: {
+    ask: 'Can the AI do things on its own — send email, call an API, change data?',
+    answer: '"llm_tools_enabled": true',
+    why: 'an AI that can only talk is a very different risk from one that can act',
+  },
+  has_rag: {
+    ask: 'Does the AI read from your own documents or database to answer?',
+    answer: '"has_rag": true',
+    why: 'documents the AI reads can carry instructions that hijack it',
+  },
+
+  // --- how it runs ---------------------------------------------------------
+  sends_email: {
+    ask: 'Does your app send email to users?',
+    answer: '"sends_email": true',
+    why: 'unlocks deliverability, unsubscribe duties and password-reset checks',
+  },
+  has_file_uploads: {
+    ask: 'Can users upload files or images?',
+    answer: '"has_file_uploads": true',
+    why: 'uploads are how a stranger gets a file onto your server',
+  },
+  has_background_jobs: {
+    ask: 'Does work happen in the background — queues, scheduled tasks?',
+    answer: '"has_background_jobs": true',
+    why: 'a job that fails silently is a job nobody knows failed',
+  },
+  has_realtime: {
+    ask: 'Is there anything live — chat, notifications, a shared cursor?',
+    answer: '"has_realtime": true',
+    why: 'live connections are authorised differently from ordinary pages',
+  },
+  has_webhooks_in: {
+    ask: 'Do other services send data INTO your app automatically?',
+    answer: '"has_webhooks_in": true',
+    why: 'an unverified webhook is an open door anyone can post through',
+  },
+  collects_analytics: {
+    ask: 'Do you track how people use the app?',
+    answer: '"collects_analytics": true',
+    why: 'tracking without consent is the most common privacy fine',
+  },
+
+  // --- the plumbing --------------------------------------------------------
+  stack_database: {
+    ask: 'What stores your data?',
+    answer: '"stack": { "database": "postgres" }   — postgres, supabase, mysql, planetscale, mongodb, sqlite, none',
+    why: 'each has its own way of leaking one customer’s rows to another',
+  },
+  stack_framework: {
+    ask: 'What is it built with?',
+    answer: '"stack": { "framework": "next" }   — next, react, vue, django, rails, express, laravel, other',
+    why: 'unlocks the checks specific to that framework’s own footguns',
+  },
+  stack_host: {
+    ask: 'Where does it run?',
+    answer: '"stack": { "host": "vercel" }   — vercel, netlify, cloudflare, railway, fly, aws, gcp, vps, other',
+    why: 'a serverless host and a rented server fail in opposite ways',
+  },
+  stack_orm: {
+    ask: 'How does your code talk to the database — a library, or hand-written SQL?',
+    answer: '"stack": { "orm": "prisma" }   — prisma, drizzle, typeorm, sequelize, activerecord, raw-sql, none',
+    why: 'hand-written SQL is checked much harder for injection',
+  },
+  has_migrations: {
+    ask: 'Do you have database migrations — versioned schema changes?',
+    answer: '"has_migrations": true',
+    why: 'a migration that cannot be undone is a deploy that cannot be undone',
+  },
+  has_ci: {
+    ask: 'Does anything run your tests automatically when you push?',
+    answer: '"has_ci": true',
+    why: 'unlocks the checks about what your pipeline does and does not catch',
+  },
+};
+
+// gate.mjs uses dotted names (stack.auth); JSON and this file use underscores
+// for the top level. One map, so neither side has to know about the other.
+const DOTTED = { stack_auth: 'stack.auth', stack_database: 'stack.database',
+                 stack_framework: 'stack.framework', stack_host: 'stack.host',
+                 stack_orm: 'stack.orm' };
+const UNDERSCORED = Object.fromEntries(Object.entries(DOTTED).map(([k, v]) => [v, k]));
+
+export const questionFor = (fact) => QUESTION[UNDERSCORED[fact] || fact] || null;
+export const factNames = () => Object.keys(QUESTION).map(k => DOTTED[k] || k);

package/src/report.mjs

@@ -1,18 +1,14 @@
 import { BRAND } from './brand.mjs';
+import { questionFor } from './questions.mjs';
 
 const C = { red:'\x1b[31m', yel:'\x1b[33m', blu:'\x1b[34m', gry:'\x1b[90m',
             bold:'\x1b[1m', dim:'\x1b[2m', grn:'\x1b[32m', cyn:'\x1b[36m', off:'\x1b[0m' };
 const SEV = { critical:[C.red,'CRITICAL'], high:[C.yel,'HIGH'], medium:[C.blu,'MEDIUM'], low:[C.gry,'LOW'] };
 
-const QUESTION = {
-  business_model:  'Who is this for — consumers, businesses, a marketplace, or internal use?',
-  jurisdictions:   'Where are your users? (EU / UK / US / other — this decides which privacy rules apply)',
-  expected_scale:  'How many users do you expect — under 1k, under 100k, or more?',
-  serves_currency: 'Do you charge in more than one currency?',
-  audience_locale: 'Do you serve more than one language or region?',
-};
+// The wording lives in questions.mjs — 33 facts, not the 5 that had text.
+// A customer used to read "? llm_tools_enabled" as the last line of a scan.
 
-export function render({ repo, scanned, lead, findings, questions, shallow = [] }) {
+export function render({ repo, scanned, lead, findings, questions, shallow = [], coverage = null, stated = null }) {
   const L = [];
   const p = (s = '') => L.push(s);
   const pr = lead.profile;
@@ -28,6 +24,21 @@ export function render({ repo, scanned, lead, findings, questions, shallow = []
   row('Type', pr.surface, ev('surface'));
   row('Stack', [pr.stack.framework, pr.stack.database, pr.stack.host].filter(Boolean).join(' · ') || '—');
   row('Accounts', pr.has_accounts ? 'yes' : 'no', ev('has_accounts'));
+
+  // What the user stated beats what we detected, so it must be VISIBLE. A wrong
+  // answer silently changing which checks run would be worse than no answers
+  // at all — they would never find out why something was skipped.
+  if (stated && Object.keys(stated).length) {
+    const flat = [];
+    for (const [k, v] of Object.entries(stated)) {
+      if (v && typeof v === 'object' && !Array.isArray(v))
+        for (const [k2, v2] of Object.entries(v)) flat.push(`${k}.${k2}=${v2}`);
+      else flat.push(`${k}=${Array.isArray(v) ? v.join('/') : v}`);
+    }
+    p(`  ${C.gry}${'You said'.padEnd(10)}${C.off}${flat.slice(0, 6).join('  ')}` +
+      `${flat.length > 6 ? `  ${C.dim}+${flat.length - 6} more${C.off}` : ''}` +
+      `  ${C.dim}(from launchprep.json)${C.off}`);
+  }
   if (pr.tenancy !== 'none') row('Tenancy', pr.tenancy, ev('tenancy'));
   if (pr.calls_llm) row('AI', (pr.llm_providers || []).join(', ') || 'yes', ev('calls_llm'));
   if (pr.handles_payments !== 'none') row('Payments', pr.handles_payments);
@@ -78,7 +89,16 @@ export function render({ repo, scanned, lead, findings, questions, shallow = []
   // ---------- what we did not check, and why ----------
   const g = lead.gate;
   p(`\n${C.bold}Coverage${C.off}`);
-  p(`  ${C.bold}${g.evaluated.length}${C.off} of ${g.total} checks apply to this app`);
+  // Say what RAN, not what applies. The difference is the tier-2 rules, which
+  // need a model to read the code — counting those as "applied" reported a
+  // pass on checks nothing performed.
+  if (coverage) {
+    p(`  ${C.bold}${coverage.ran}${C.off} of ${g.total} checks ran here`);
+    if (coverage.needsDeep)
+      p(`  ${C.bold}${coverage.needsDeep}${C.off} more apply to you but need a deep scan ${C.dim}(they need a model to read the code)${C.off}`);
+  } else {
+    p(`  ${C.bold}${g.evaluated.length}${C.off} of ${g.total} checks apply to this app`);
+  }
   p(`  ${C.dim}${g.skipped.length} skipped — they don't fit what you built${C.off}`);
 
   const bySkipFact = {};
@@ -92,10 +112,19 @@ export function render({ repo, scanned, lead, findings, questions, shallow = []
   // ---------- the three questions ----------
   if (questions.length) {
     p(`\n${C.bold}${g.unknown.length} more checks need ${questions.length} answer${questions.length === 1 ? '' : 's'}${C.off}`);
-    for (const [factName, n] of questions)
-      p(`  ${C.cyn}?${C.off} ${QUESTION[factName] || factName}  ${C.dim}(unlocks ${n})${C.off}`);
+    for (const [factName, n] of questions) {
+      const q = questionFor(factName);
+      p(`  ${C.cyn}?${C.off} ${q ? q.ask : factName}  ${C.dim}(unlocks ${n})${C.off}`);
+      if (q) p(`    ${C.dim}${q.answer}${C.off}`);
+    }
   }
 
-  p(`\n  ${C.dim}Anything above wrong? Correct it and the checks adjust.${C.off}\n`);
+  // This used to say "Correct it and the checks adjust" with no way on earth to
+  // do so — no flag, no file, no prompt. It was the last line of every scan and
+  // it invited an action that did not exist. Now it names the file that works.
+  if (questions.length)
+    p(`\n  ${C.dim}Put those in ${C.off}launchprep.json${C.dim} at the top of your project and run again — the answers unlock the checks above.${C.off}\n`);
+  else
+    p(`\n  ${C.dim}Wrong about your app? Correct it in ${C.off}launchprep.json${C.dim} and run again.${C.off}\n`);
   return L.join('\n');
 }

package/src/rules.json

@@ -1 +1 @@
-{"version":"0.1","count":289,"rules":[{"id":"SEC-001","title":".env committed to version control","severity":"critical","requires":[],"tier":1,"check":"git ls-files matches ^\\.env(\\.|$) and not .env.example","fix":"git rm --cached .env; add to .gitignore; ROTATE every key in it","note":"rotation is the part everyone skips. history retains the file.","category":"secrets"},{"id":"SEC-002","title":".env absent from .gitignore","severity":"high","requires":[],"tier":1,"check":".gitignore lacks a pattern matching .env","category":"secrets"},{"id":"SEC-003","title":"Hardcoded API key / token / password in source","severity":"critical","requires":[],"tier":1,"check":"entropy + provider prefix scan (sk-, sk-ant-, AKIA, ghp_, xoxb-, eyJ...) outside .env","category":"secrets"},{"id":"SEC-004","title":"Server-only secret exposed to the client bundle","severity":"critical","requires":["surface in [web-app, web-site]"],"tier":1,"check":"NEXT_PUBLIC_/VITE_/REACT_APP_ prefix on a name matching (KEY|SECRET|TOKEN|PASSWORD), or a secret literal reachable from a client component","note":"the single most common vibe-coder leak. the prefix makes it PUBLIC, and the name reads like it is protected.","category":"secrets"},{"id":"SEC-005","title":"Supabase service_role key used outside a server context","severity":"critical","requires":["stack.database == supabase"],"tier":1,"check":"service_role key referenced in a client component, edge config, or NEXT_PUBLIC_ var","note":"service_role bypasses RLS entirely. in the browser it is a full database handover.","category":"secrets"},{"id":"SEC-006","title":"Paid-API key called directly from the browser","severity":"critical","requires":["calls_llm == true"],"tier":1,"check":"LLM SDK instantiated in client-side code, or provider endpoint called from browser","fix":"proxy through your own server route; never ship the provider key","category":"secrets"},{"id":"SEC-007","tier":2,"severity":"medium","requires":["stage == production"]},{"id":"SEC-008","tier":2,"severity":"medium","requires":["stage == production"]},{"id":"AUTH-001","title":"Session token stored in localStorage","severity":"high","requires":["has_accounts == true","surface in [web-app, web-site]"],"tier":1,"check":"localStorage.setItem / getItem with a token-like key","fix":"httpOnly + Secure + SameSite cookie","note":"localStorage is readable by any XSS. a cookie with httpOnly is not.","category":"authentication"},{"id":"AUTH-002","title":"Role or permission read from client-controlled storage","severity":"critical","requires":["has_accounts == true"],"tier":1,"check":"role/isAdmin/plan/tier read from localStorage, sessionStorage, cookie, or JWT claim without server-side re-verification","note":"the corpus demo is literally 'open Application storage, change Member to Admin, refresh'.","category":"authentication"},{"id":"AUTH-003","title":"No brute-force limit on login","severity":"high","requires":["has_accounts == true"],"tier":1,"check":"login route has no attempt counter / lockout / rate limit","fix":"max 5 attempts per identifier per 15 min, plus IP-level cap","category":"authentication"},{"id":"AUTH-004","title":"Password reset endpoint unthrottled","severity":"high","requires":["has_accounts == true","sends_email == true"],"tier":1,"check":"password-reset route lacks rate limiting","note":"corpus example — 67,000 requests at 2am against one reset endpoint.","category":"authentication"},{"id":"AUTH-005","tier":2,"severity":"medium","requires":["has_accounts == true","is_public == true"]},{"id":"AUTH-006","tier":2,"severity":"medium","requires":["has_admin_panel == true","stage == production"]},{"id":"AUTH-007","tier":2,"severity":"high","requires":["has_accounts == true"]},{"id":"AUTH-008","title":"Password stored without a modern KDF","severity":"critical","requires":["stack.auth == custom"],"tier":1,"check":"password hashing absent, or md5/sha1/sha256 without bcrypt/argon2/scrypt","category":"authentication"},{"id":"AUTH-009","tier":2,"severity":"medium","requires":["has_accounts == true","stage == production","is_public == true"]},{"id":"AUTH-010","tier":2,"severity":"high","requires":["stack.host in [vps, aws, gcp]"]},{"id":"AUTHZ-001","title":"Supabase table with RLS disabled","severity":"critical","requires":["stack.database == supabase","has_accounts == true"],"tier":1,"check":"table in migrations without ENABLE ROW LEVEL SECURITY","note":"corpus calls this the single most common vulnerability found across startups AND enterprises. RLS is OFF by default for raw-SQL tables.","category":"authorization"},{"id":"AUTHZ-002","tier":2,"severity":"critical","requires":["stack.database == supabase","has_accounts == true"],"has_static_approximation":true,"title":"RLS enabled but policy is permissive"},{"id":"AUTHZ-003","tier":2,"severity":"critical","requires":["has_accounts == true"],"has_static_approximation":true,"title":"IDOR — object accessed by ID without an ownership check"},{"id":"AUTHZ-004","tier":2,"severity":"critical","requires":["has_admin_panel == true"],"has_static_approximation":true,"title":"Admin authorization enforced only in the UI"},{"id":"AUTHZ-005","tier":2,"severity":"critical","requires":["calls_llm == true","has_accounts == true"],"has_static_approximation":true,"title":"Usage limits stored in a row the user can modify"},{"id":"AUTHZ-006","tier":2,"severity":"critical","requires":["tenancy == multi-tenant-shared-db"],"has_static_approximation":true,"title":"Missing tenant scope on a domain query"},{"id":"AUTHZ-007","tier":2,"severity":"critical","requires":["tenancy == multi-tenant-shared-db"]},{"id":"AUTHZ-008","tier":2,"severity":"high","requires":["has_accounts == true"]},{"id":"RATE-001","title":"No rate limiting on any endpoint","severity":"high","requires":["is_public == true"],"tier":1,"check":"no rate-limit middleware, no gateway policy, no per-route limiter","category":"rate-limiting"},{"id":"RATE-002","tier":2,"severity":"medium","requires":["is_public == true"]},{"id":"RATE-003","tier":2,"severity":"critical","requires":["calls_llm == true"],"has_static_approximation":true,"title":"No spend ceiling on paid-API endpoints"},{"id":"RATE-004","tier":2,"severity":"high","requires":["calls_llm == true","has_accounts == true"],"has_static_approximation":true,"title":"No per-user quota on AI features"},{"id":"RATE-005","tier":2,"severity":"high","requires":["sends_email == true"]},{"id":"RATE-006","tier":2,"severity":"medium","requires":["is_public == true","stage == production"]},{"id":"RATE-007","tier":2,"severity":"medium","requires":["has_accounts == true","is_public == true"]},{"id":"AI-001","tier":2,"severity":"critical","requires":["calls_llm == true","llm_input_from_user == true"],"has_static_approximation":true,"title":"User input reaches the system-prompt position"},{"id":"AI-002","tier":2,"severity":"high","requires":["calls_llm == true","llm_input_from_user == true"]},{"id":"AI-003","title":"No max_tokens ceiling on completions","severity":"high","requires":["calls_llm == true"],"tier":1,"origin":"gap","check":"provider call omits max_tokens, or sets it above the plan's economics","note":"unbounded output is unbounded cost, per request.","category":"ai-safety"},{"id":"AI-004","title":"No model allowlist","severity":"medium","requires":["calls_llm == true"],"tier":1,"origin":"gap","check":"model id derived from request input, or no constant/allowlist","note":"a client-chosen model is a client-chosen price.","category":"ai-safety"},{"id":"AI-005","tier":2,"severity":"high","requires":["calls_llm == true","stage == production"]},{"id":"AI-006","tier":2,"severity":"critical","requires":["calls_llm == true","llm_tools_enabled == true"]},{"id":"AI-007","title":"Model output rendered as HTML without sanitisation","severity":"critical","requires":["calls_llm == true","surface in [web-app, web-site]"],"tier":1,"origin":"gap","check":"completion piped to dangerouslySetInnerHTML / v-html / innerHTML","note":"injection in, XSS out.","category":"ai-safety"},{"id":"AI-008","tier":2,"severity":"critical","requires":["calls_llm == true"],"has_static_approximation":true,"title":"Model output used in a privileged operation without validation"},{"id":"AI-009","tier":2,"severity":"medium","requires":["calls_llm == true"]},{"id":"AI-010","tier":2,"severity":"high","requires":["calls_llm == true","data_sensitivity != none"]},{"id":"AI-011","title":"No retry/backoff on provider 429s","severity":"medium","requires":["calls_llm == true","stage == production"],"tier":1,"origin":"gap","category":"ai-safety"},{"id":"AI-012","tier":2,"severity":"high","requires":["calls_llm == true","stack.host in [vercel, netlify]"]},{"id":"AI-013","tier":2,"severity":"medium","requires":["calls_llm == true","business_model in [b2b-saas, b2c, marketplace]"]},{"id":"PAY-001","title":"Webhook signature not verified","severity":"critical","requires":["handles_payments != none","has_webhooks_in == true"],"tier":1,"check":"webhook route parses the body without constructEvent / signature check","note":"an unverified webhook endpoint is an unauthenticated 'mark this order paid' API.","category":"payments"},{"id":"PAY-002","tier":2,"severity":"high","requires":["handles_payments in [stripe, paddle, lemonsqueezy]"]},{"id":"PAY-003","tier":2,"severity":"high","requires":["handles_payments != none","has_webhooks_in == true"]},{"id":"PAY-004","tier":2,"severity":"medium","requires":["handles_payments != none"]},{"id":"PAY-005","tier":2,"severity":"high","requires":["has_subscriptions == true"]},{"id":"PAY-006","title":"Price or amount accepted from the client","severity":"critical","requires":["handles_payments != none"],"tier":1,"check":"amount/price/currency read from the request body when creating a charge","category":"payments"},{"id":"PAY-007","tier":2,"severity":"medium","requires":["handles_payments != none","has_webhooks_in == true"]},{"id":"PAY-008","tier":2,"severity":"high","requires":["surface in [mobile-ios]","has_subscriptions == true"]},{"id":"DATA-001","title":"Unbounded list query — no pagination","severity":"high","requires":["stack.database != none"],"tier":1,"check":"list endpoint without limit/offset or cursor","note":"corpus — fine at 50 users, loads 50,000 rows at 500.","category":"data-and-scale"},{"id":"DATA-002","tier":2,"severity":"high","requires":["stack.database != none"]},{"id":"DATA-003","title":"Missing index on a filtered or joined column","severity":"high","requires":["stack.database in [postgres, supabase, mysql, planetscale]"],"tier":1,"check":"WHERE / JOIN / ORDER BY column with no index in migrations","note":"50ms at 100 rows, 30s at 100k. the code never changed.","category":"data-and-scale"},{"id":"DATA-004","title":"No connection pooling","severity":"high","requires":["stack.database in [postgres, supabase, mysql]","stack.host in [vercel, netlify, cloudflare]"],"tier":1,"note":"serverless multiplies connections per invocation; the DB runs out first.","category":"data-and-scale"},{"id":"DATA-005","title":"SELECT * on wide or hot tables","severity":"medium","requires":["stack.database != none"],"tier":1,"category":"data-and-scale"},{"id":"DATA-006","tier":2,"severity":"critical","requires":[]},{"id":"DATA-007","title":"Raw SQL built by string concatenation","severity":"critical","requires":["stack.orm == raw-sql"],"tier":1,"check":"query string interpolating a request value","category":"data-and-scale"},{"id":"DATA-008","title":"No payload size limit","severity":"medium","requires":["is_public == true"],"tier":1,"check":"body parser without a size cap","category":"data-and-scale"},{"id":"DATA-009","title":"Text columns not 4-byte-safe","severity":"medium","requires":["stack.database in [mysql, planetscale]"],"tier":1,"check":"utf8 rather than utf8mb4 on user-facing text columns","note":"corpus failure — a user typed an emoji and the app crashed. 3-byte utf8 cannot hold a 4-byte codepoint.","category":"data-and-scale"},{"id":"DATA-010","tier":2,"severity":"medium","requires":["stage == pre-launch","expected_scale != hobby"]},{"id":"DATA-011","tier":2,"severity":"medium","requires":["sends_email == true or has_file_uploads == true"]},{"id":"DATA-012","tier":2,"severity":"critical","requires":["stage == production","stack.database != none"]},{"id":"DATA-013","tier":2,"severity":"critical","requires":["has_file_uploads == true","has_accounts == true"]},{"id":"DATA-014","title":"User uploads stored on ephemeral disk","severity":"critical","requires":["has_file_uploads == true","stack.host in [vercel, netlify, railway, fly, render]"],"tier":1,"check":"writes to local fs on a platform with an ephemeral filesystem","note":"matches CRMini — files vanish on every redeploy.","origin":"gap","category":"data-and-scale"},{"id":"DATA-015","title":"User input concatenated into a SQL query","severity":"critical","tier":1,"check":"a request value interpolated into a SQL string instead of passed as a parameter","note":"the oldest way to lose a database and still the most common. Parameterised queries are not a mitigation, they are the fix.","origin":"gap","category":"data-and-scale"},{"id":"INF-001","tier":2,"severity":"medium","requires":["stage == production","expected_scale in [under-100k, over-100k]","stack.host in [vps, aws, gcp]"]},{"id":"INF-002","title":"No health check or auto-restart","severity":"medium","requires":["stage == production","stack.host in [vps, aws, gcp]"],"tier":1,"category":"infrastructure"},{"id":"INF-003","tier":2,"severity":"low","requires":["expected_scale == over-100k"]},{"id":"INF-004","tier":2,"severity":"low","requires":["stage == production","expected_scale != hobby"]},{"id":"INF-005","tier":2,"severity":"low","requires":["expected_scale == over-100k"]},{"id":"INF-006","title":"HTTPS not enforced","severity":"high","requires":["is_public == true"],"tier":1,"check":"no HSTS, no http->https redirect","category":"infrastructure"},{"id":"INF-007","title":"Permissive CORS","severity":"high","requires":["surface in [web-app, api-only]"],"tier":1,"check":"Access-Control-Allow-Origin: * on credentialed routes","origin":"gap","category":"infrastructure"},{"id":"INF-008","tier":2,"severity":"critical","requires":["stack.database != none","stack.host in [vps, aws, gcp]"]},{"id":"INF-009","tier":2,"severity":"high","requires":["surface in [mobile-ios, mobile-android]"]},{"id":"INF-010","tier":2,"severity":"medium","requires":["is_public == true","stage == production"]},{"id":"INF-011","tier":2,"severity":"low","requires":["stage == production","business_model in [b2b-saas, marketplace]"]},{"id":"LEG-001","title":"No privacy policy while collecting personal data","severity":"high","requires":["data_sensitivity != none","is_public == true"],"tier":1,"note":"corpus is emphatic — a single contact form collecting an email is already personal data.","category":"legal"},{"id":"LEG-002","tier":2,"severity":"high","requires":["collects_analytics == true","jurisdictions includes any of [eu, uk]"]},{"id":"LEG-003","title":"No terms of service","severity":"medium","requires":["is_public == true","has_accounts == true"],"tier":1,"category":"legal"},{"id":"LEG-004","tier":2,"severity":"high","requires":["data_sensitivity != none","jurisdictions includes any of [eu, uk, ca]"]},{"id":"LEG-005","tier":2,"severity":"medium","requires":["data_sensitivity != none","jurisdictions includes any of [eu, ru, kz]"]},{"id":"LEG-006","title":"Accessibility baseline unmet","severity":"medium","requires":["surface in [web-app, web-site]","is_public == true"],"tier":1,"check":"missing alt text, insufficient contrast, no heading hierarchy, unlabelled controls","note":"corpus flags active litigation risk in US and AU.","category":"legal"},{"id":"LEG-007","tier":2,"severity":"medium","requires":["stage in [pre-launch, production]","business_model != hobby"]},{"id":"LEG-008","tier":2,"severity":"high","requires":["surface in [mobile-ios, mobile-android]"]},{"id":"LEG-009","tier":2,"severity":"medium","requires":["data_sensitivity != none","jurisdictions includes any of [ru, kz, other]"]},{"id":"LEG-010","tier":2,"severity":"medium","requires":["is_public == true"]},{"id":"OBS-001","title":"No error monitoring","severity":"high","requires":["stage == production"],"tier":1,"origin":"gap","category":"observability"},{"id":"OBS-002","tier":2,"severity":"medium","requires":["has_accounts == true","stage == production"]},{"id":"OBS-003","title":"No product analytics","severity":"low","requires":["stage in [pre-launch, production]","business_model != internal-tool"],"tier":1,"category":"observability"},{"id":"OBS-004","tier":2,"severity":"medium","requires":["stage == production"]},{"id":"UX-001","tier":2,"severity":"medium","requires":["surface in [web-app, mobile-ios, mobile-android]"]},{"id":"UX-002","tier":2,"severity":"high","requires":["surface in [web-app, mobile-ios, mobile-android]"]},{"id":"UX-003","tier":2,"severity":"low","requires":["surface in [web-app, mobile-ios, mobile-android]"]},{"id":"UX-004","tier":2,"severity":"low","requires":["stage in [pre-launch, production]","business_model in [b2c, b2b-saas]"]},{"id":"UX-005","title":"No social preview image","severity":"low","requires":["is_public == true","surface in [web-app, web-site]"],"tier":1,"category":"ux-readiness"},{"id":"UX-006","title":"No sitemap.xml / not indexable","severity":"low","requires":["is_public == true","surface == web-site"],"tier":1,"category":"ux-readiness"},{"id":"AIOP-001","tier":2,"severity":"high","requires":["calls_llm == true","stage == production"]},{"id":"AIOP-002","title":"Model id pinned to an alias that can silently change","severity":"medium","requires":["calls_llm == true","stage == production"],"tier":1,"origin":"gap","note":"floating aliases shift behaviour and price under you with no deploy.","category":"ai-operations"},{"id":"AIOP-003","tier":2,"severity":"medium","requires":["calls_llm == true","stage == production"]},{"id":"AIOP-004","tier":2,"severity":"low","requires":["calls_llm == true","stage == production"]},{"id":"AIOP-005","tier":2,"severity":"high","requires":["calls_llm == true"]},{"id":"AIOP-006","tier":2,"severity":"high","requires":["calls_llm == true"]},{"id":"AIOP-007","tier":2,"severity":"critical","requires":["has_rag == true"]},{"id":"AIOP-008","tier":2,"severity":"critical","requires":["has_rag == true","tenancy == multi-tenant-shared-db"]},{"id":"AIOP-009","tier":2,"severity":"medium","requires":["has_rag == true"]},{"id":"AIOP-010","title":"Agent loop has no iteration ceiling","severity":"critical","requires":["llm_tools_enabled == true"],"tier":1,"origin":"gap","note":"an unbounded loop is an unbounded invoice.","category":"ai-operations"},{"id":"AIOP-011","tier":2,"severity":"high","requires":["llm_tools_enabled == true"]},{"id":"AIOP-012","tier":2,"severity":"critical","requires":["llm_tools_enabled == true"]},{"id":"AIOP-013","tier":2,"severity":"medium","requires":["calls_llm == true","stage == production"]},{"id":"AIOP-014","tier":2,"severity":"medium","requires":["calls_llm == true","stage == production"]},{"id":"AIOP-015","tier":2,"severity":"medium","requires":["calls_llm == true","business_model in [b2c, b2b-saas]"]},{"id":"AIOP-016","title":"User-facing AI errors leak provider internals","severity":"medium","requires":["calls_llm == true"],"tier":1,"origin":"gap","category":"ai-operations"},{"id":"AIOP-017","tier":2,"severity":"medium","requires":["calls_llm == true","is_public == true","business_model == b2c"]},{"id":"AIOP-018","tier":2,"severity":"critical","requires":["calls_llm == true","is_public == true"],"has_static_approximation":true,"title":"Free tier allows unauthenticated AI calls"},{"id":"AIOP-019","tier":2,"severity":"medium","requires":["calls_llm == true"]},{"id":"AIOP-020","title":"Temperature or sampling unset for a deterministic task","severity":"low","requires":["calls_llm == true"],"tier":1,"origin":"gap","category":"ai-operations"},{"id":"DEP-001","title":"Secrets injected at build time instead of runtime","severity":"high","requires":["stage in [pre-launch, production]"],"tier":1,"note":"build-time inlining bakes the value into the artifact; rotation needs a rebuild.","category":"deployment"},{"id":"DEP-002","title":"Secrets present in CI logs or config","severity":"critical","requires":["has_ci == true"],"tier":1,"check":"plaintext credential in workflow yaml, or echoed to build output","category":"deployment"},{"id":"DEP-003","tier":2,"severity":"medium","requires":["stage in [pre-launch, production]"]},{"id":"DEP-004","tier":2,"severity":"high","requires":["has_migrations == true","stage == production"]},{"id":"DEP-005","title":"Migrations are not reversible","severity":"medium","requires":["has_migrations == true","stage == production"],"tier":1,"category":"deployment"},{"id":"DEP-006","tier":2,"severity":"critical","requires":["has_migrations == true","stage == production"]},{"id":"DEP-007","tier":2,"severity":"high","requires":["stage == production"]},{"id":"DEP-008","title":"No health endpoint","severity":"medium","requires":["stage == production","surface in [web-app, api-only]"],"tier":1,"category":"deployment"},{"id":"DEP-009","title":"No graceful shutdown handling","severity":"medium","requires":["stage == production","has_background_jobs == true"],"tier":1,"check":"no SIGTERM handler draining in-flight work","category":"deployment"},{"id":"DEP-010","title":"Dependencies unpinned","severity":"medium","requires":["stage in [pre-launch, production]"],"tier":1,"check":"no lockfile committed, or ranges in a deployed manifest","category":"deployment"},{"id":"DEP-011","title":"Known-vulnerable dependencies","severity":"high","requires":[],"tier":1,"check":"audit surfaces advisories at high or critical","category":"deployment"},{"id":"DEP-012","tier":2,"severity":"medium","requires":["stage == production"]},{"id":"DEP-013","title":"Third-party script loaded without integrity check","severity":"medium","requires":["surface in [web-app, web-site]","is_public == true"],"tier":1,"check":"external <script> without SRI","category":"deployment"},{"id":"DEP-014","title":"Source maps published in production","severity":"medium","requires":["surface in [web-app, web-site]","stage == production"],"tier":1,"category":"deployment"},{"id":"DEP-015","title":"Debug mode or verbose errors enabled in production","severity":"high","requires":["stage == production"],"tier":1,"category":"deployment"},{"id":"DEP-016","title":"No CI check gating merges","severity":"low","requires":["has_ci == true","business_model in [b2b-saas, marketplace]"],"tier":1,"category":"deployment"},{"id":"DEP-017","tier":2,"severity":"medium","requires":["stage in [pre-launch, production]"]},{"id":"DEP-018","tier":2,"severity":"high","requires":["stage == production","stack.database != none"]},{"id":"RU-001","title":"Timestamps stored without timezone","severity":"high","requires":["stack.database != none"],"tier":1,"check":"timestamp column without time zone, or naive datetime written from app code","note":"works perfectly until your second user is in another country.","category":"real-user-readiness"},{"id":"RU-002","tier":2,"severity":"medium","requires":["surface in [web-app, mobile-ios, mobile-android]"]},{"id":"RU-003","title":"Money stored as float","severity":"critical","requires":["handles_payments != none or serves_currency == multi"],"tier":1,"check":"float/double/real column holding an amount","note":"rounding error in currency is a correctness bug, not a style issue.","category":"real-user-readiness"},{"id":"RU-004","title":"Currency not stored alongside amount","severity":"high","requires":["serves_currency == multi"],"tier":1,"category":"real-user-readiness"},{"id":"RU-005","tier":2,"severity":"low","requires":["data_sensitivity != none","audience_locale == multi"]},{"id":"RU-006","title":"Text input not accepting the full Unicode range","severity":"high","requires":["stack.database != none"],"tier":1,"note":"corpus — an emoji crashed a production app because the column was 3-byte utf8.","category":"real-user-readiness"},{"id":"RU-007","title":"No mobile viewport handling","severity":"high","requires":["surface in [web-app, web-site]","is_public == true"],"tier":1,"category":"real-user-readiness"},{"id":"RU-008","tier":2,"severity":"medium","requires":["surface in [mobile-ios, mobile-android]"]},{"id":"RU-009","tier":2,"severity":"medium","requires":["has_accounts == true"]},{"id":"RU-010","title":"No support or contact channel","severity":"medium","requires":["is_public == true","stage == production"],"tier":1,"category":"real-user-readiness"},{"id":"RU-011","tier":2,"severity":"high","requires":["sends_email == true","stage == production"]},{"id":"RU-012","tier":2,"severity":"medium","requires":["sends_email == true","stage == production"]},{"id":"RU-013","title":"Marketing email without an unsubscribe path","severity":"high","requires":["sends_email == true","is_public == true"],"tier":1,"category":"real-user-readiness"},{"id":"RU-014","tier":2,"severity":"high","requires":["sends_email == true"]},{"id":"RU-015","tier":2,"severity":"high","requires":["has_accounts == true","stage == production"]},{"id":"RU-016","tier":2,"severity":"high","requires":["has_accounts == true"]},{"id":"RU-017","tier":2,"severity":"high","requires":["has_accounts == true","stack.auth == custom"]},{"id":"RU-018","tier":2,"severity":"medium","requires":["has_accounts == true","is_public == true"]},{"id":"RU-019","title":"Session lifetime unbounded","severity":"medium","requires":["has_accounts == true"],"tier":1,"category":"real-user-readiness"},{"id":"RU-020","tier":2,"severity":"low","requires":["has_accounts == true","business_model in [b2c, b2b-saas]"]},{"id":"TEN-001","tier":2,"severity":"critical","requires":["tenancy == multi-tenant-shared-db","stack.database in [postgres, supabase]"]},{"id":"TEN-002","title":"No composite index on (tenant_id, ...) for hot queries","severity":"medium","requires":["tenancy == multi-tenant-shared-db"],"tier":1,"category":"multi-tenancy"},{"id":"TEN-003","title":"Invitation token does not expire","severity":"high","requires":["has_invitations == true"],"tier":1,"category":"multi-tenancy"},{"id":"TEN-004","tier":2,"severity":"critical","requires":["has_invitations == true","has_roles == true"]},{"id":"TEN-005","tier":2,"severity":"critical","requires":["has_roles == true"]},{"id":"TEN-006","tier":2,"severity":"critical","requires":["has_roles == true","tenancy == multi-tenant-shared-db"]},{"id":"TEN-007","tier":2,"severity":"high","requires":["tenancy == multi-tenant-shared-db","has_accounts == true"]},{"id":"TEN-008","tier":2,"severity":"critical","requires":["tenancy == multi-tenant-shared-db","has_file_uploads == true"]},{"id":"TEN-009","tier":2,"severity":"high","requires":["tenancy == multi-tenant-shared-db"]},{"id":"TEN-010","tier":2,"severity":"medium","requires":["tenancy == multi-tenant-shared-db","has_subscriptions == true"]},{"id":"TEN-011","tier":2,"severity":"medium","requires":["tenancy == multi-tenant-shared-db","calls_llm == true"]},{"id":"TEN-012","tier":2,"severity":"high","requires":["has_admin_panel == true","tenancy == multi-tenant-shared-db"]},{"id":"TEN-013","tier":2,"severity":"critical","requires":["tenancy == multi-tenant-shared-db"]},{"id":"TEN-014","tier":2,"severity":"high","requires":["tenancy == multi-tenant-shared-db","has_webhooks_in == true"]},{"id":"UP-001","title":"File type validated by extension or client MIME only","severity":"high","requires":["has_file_uploads == true"],"tier":1,"category":"file-uploads"},{"id":"UP-002","title":"No upload size limit","severity":"high","requires":["has_file_uploads == true"],"tier":1,"category":"file-uploads"},{"id":"UP-003","title":"Upload path built from a user-supplied filename","severity":"critical","requires":["has_file_uploads == true"],"tier":1,"check":"filename concatenated into a storage path without normalisation","category":"file-uploads"},{"id":"UP-004","tier":2,"severity":"high","requires":["has_file_uploads == true","surface in [web-app, web-site]"]},{"id":"UP-005","title":"SVG accepted without sanitisation","severity":"high","requires":["has_file_uploads == true"],"tier":1,"category":"file-uploads"},{"id":"UP-006","tier":2,"severity":"medium","requires":["has_file_uploads == true","tenancy == multi-tenant-shared-db"]},{"id":"UP-007","title":"Signed URLs with excessive lifetime","severity":"medium","requires":["has_file_uploads == true"],"tier":1,"category":"file-uploads"},{"id":"UP-008","title":"EXIF metadata not stripped from images","severity":"medium","requires":["has_file_uploads == true","data_sensitivity != none"],"tier":1,"note":"photo uploads routinely carry GPS coordinates.","category":"file-uploads"},{"id":"UP-009","tier":2,"severity":"medium","requires":["has_file_uploads == true"]},{"id":"UP-010","tier":2,"severity":"medium","requires":["has_file_uploads == true","has_accounts == true"]},{"id":"UP-011","tier":2,"severity":"medium","requires":["has_file_uploads == true"]},{"id":"UP-012","tier":2,"severity":"high","requires":["has_file_uploads == true"]},{"id":"API-001","title":"Mass assignment — request body spread into a model","severity":"critical","requires":["stack.database != none"],"tier":1,"check":"request body passed wholesale to create/update","note":"this is how a user sets their own is_admin.","category":"api-design"},{"id":"API-002","title":"Internal error details returned to the client","severity":"high","requires":["is_public == true"],"tier":1,"category":"api-design"},{"id":"API-003","title":"Stack traces reachable in production responses","severity":"high","requires":["is_public == true","stage == production"],"tier":1,"category":"api-design"},{"id":"API-004","title":"No maximum page size","severity":"medium","requires":["is_public == true"],"tier":1,"check":"limit parameter accepted without an upper bound","category":"api-design"},{"id":"API-005","title":"Sort or filter parameter interpolated into a query","severity":"critical","requires":["stack.database != none"],"tier":1,"category":"api-design"},{"id":"API-006","title":"State-changing operation exposed over GET","severity":"high","requires":["is_public == true"],"tier":1,"category":"api-design"},{"id":"API-007","tier":2,"severity":"high","requires":["has_accounts == true","surface in [web-app]"]},{"id":"API-008","tier":2,"severity":"low","requires":["surface == api-only"]},{"id":"API-009","tier":2,"severity":"low","requires":["has_accounts == true"]},{"id":"API-010","title":"No request timeout on outbound calls","severity":"medium","requires":["stage == production"],"tier":1,"category":"api-design"},{"id":"API-011","tier":2,"severity":"medium","requires":["surface == api-only","stage == production"]},{"id":"API-012","title":"Security headers missing","severity":"medium","requires":["surface in [web-app, web-site]","is_public == true"],"tier":1,"check":"no CSP, X-Content-Type-Options, Referrer-Policy, frame ancestors","category":"api-design"},{"id":"API-013","title":"Open redirect","severity":"high","requires":["is_public == true","surface in [web-app, web-site]"],"tier":1,"check":"redirect target read from a query parameter without an allowlist","category":"api-design"},{"id":"API-014","tier":2,"severity":"critical","requires":["is_public == true"],"has_static_approximation":true,"title":"SSRF — outbound request to a user-supplied URL"},{"id":"NEXT-001","tier":2,"severity":"critical","requires":["stack.framework == next","has_accounts == true"]},{"id":"NEXT-002","tier":2,"severity":"critical","requires":["stack.framework == next","has_accounts == true"]},{"id":"NEXT-003","tier":2,"severity":"high","requires":["stack.framework == next","has_accounts == true"]},{"id":"NEXT-004","tier":2,"severity":"critical","requires":["stack.framework == next","has_accounts == true"]},{"id":"NEXT-005","tier":2,"severity":"high","requires":["stack.framework == next"]},{"id":"NEXT-006","title":"Secret imported into a module reachable from the client graph","severity":"critical","requires":["stack.framework == next"],"tier":1,"category":"framework-next"},{"id":"NEXT-007","tier":2,"severity":"critical","requires":["stack.framework == next","has_accounts == true"]},{"id":"NEXT-008","tier":2,"severity":"medium","requires":["stack.framework == next"]},{"id":"NEXT-009","title":"Image optimizer allows arbitrary remote hosts","severity":"medium","requires":["stack.framework == next"],"tier":1,"check":"remotePatterns with a wildcard hostname","category":"framework-next"},{"id":"NEXT-010","title":"Route handler lacks runtime/duration config for long work","severity":"medium","requires":["stack.framework == next","calls_llm == true"],"tier":1,"category":"framework-next"},{"id":"NEXT-011","title":"Error boundary absent","severity":"medium","requires":["stack.framework == next"],"tier":1,"check":"no error.tsx / global-error.tsx","category":"framework-next"},{"id":"NEXT-012","title":"Loading UI absent on data routes","severity":"low","requires":["stack.framework == next"],"tier":1,"category":"framework-next"},{"id":"NEXT-013","title":"Cookies set without secure attributes","severity":"high","requires":["stack.framework == next","has_accounts == true"],"tier":1,"category":"framework-next"},{"id":"NEXT-014","title":"Redirect after login uses an unvalidated next parameter","severity":"high","requires":["stack.framework == next","has_accounts == true"],"tier":1,"category":"framework-next"},{"id":"SUP-001","title":"Storage bucket public by default","severity":"critical","requires":["stack.database == supabase","has_file_uploads == true"],"tier":1,"note":"mirrors the RLS problem — permissive default, silent exposure.","category":"platform-supabase"},{"id":"SUP-002","tier":2,"severity":"critical","requires":["stack.database == supabase","has_file_uploads == true"]},{"id":"SUP-003","tier":2,"severity":"critical","requires":["stack.database == supabase","has_realtime == true"]},{"id":"SUP-004","tier":2,"severity":"critical","requires":["stack.database == supabase"]},{"id":"SUP-005","tier":2,"severity":"critical","requires":["stack.database == supabase","has_accounts == true"]},{"id":"SUP-006","title":"Postgres function marked SECURITY DEFINER without a search_path","severity":"high","requires":["stack.database in [supabase, postgres]"],"tier":1,"category":"platform-supabase"},{"id":"SUP-007","tier":2,"severity":"high","requires":["stack.database == supabase"]},{"id":"SUP-008","tier":2,"severity":"low","requires":["stack.auth == supabase-auth","stage == production"]},{"id":"SUP-009","tier":2,"severity":"critical","requires":["stack.database in [supabase, postgres]","has_accounts == true"]},{"id":"SUP-010","tier":2,"severity":"high","requires":["stack.database == supabase","has_webhooks_in == true"]},{"id":"SUP-011","title":"Connection string uses the direct port under serverless","severity":"high","requires":["stack.database == supabase","stack.host in [vercel, netlify, cloudflare]"],"tier":1,"note":"use the pooler; direct connections exhaust under serverless fan-out.","category":"platform-supabase"},{"id":"SUP-012","tier":2,"severity":"high","requires":["stack.database == supabase","stage == production"]},{"id":"LIFE-001","tier":2,"severity":"medium","requires":["data_sensitivity != none","stage == production"]},{"id":"LIFE-002","tier":2,"severity":"high","requires":["data_sensitivity != none","jurisdictions includes any of [eu, uk]"]},{"id":"LIFE-003","tier":2,"severity":"high","requires":["data_sensitivity != none"]},{"id":"LIFE-004","tier":2,"severity":"medium","requires":["data_sensitivity != none","jurisdictions includes any of [eu, uk]"]},{"id":"LIFE-005","tier":2,"severity":"high","requires":["data_sensitivity in [financial, health]"]},{"id":"LIFE-006","tier":2,"severity":"high","requires":["data_sensitivity in [financial, health]"]},{"id":"LIFE-007","tier":2,"severity":"critical","requires":["data_sensitivity != none"]},{"id":"LIFE-008","tier":2,"severity":"critical","requires":["stage == production","data_sensitivity != none"]},{"id":"LIFE-009","tier":2,"severity":"medium","requires":["data_sensitivity != none","stage == production"]},{"id":"LIFE-010","tier":2,"severity":"high","requires":["collects_analytics == true","jurisdictions includes any of [eu, uk]"]},{"id":"LIFE-011","tier":2,"severity":"medium","requires":["business_model == b2b-saas","jurisdictions includes any of [eu, uk]"]},{"id":"LIFE-012","tier":2,"severity":"critical","requires":["data_sensitivity == children"]},{"id":"MOB-001","title":"Secret embedded in the app binary","severity":"critical","requires":["surface in [mobile-ios, mobile-android]"],"tier":1,"note":"a shipped binary is a public file. anything in it is published.","category":"mobile"},{"id":"MOB-002","title":"Token stored outside the platform secure store","severity":"high","requires":["surface in [mobile-ios, mobile-android]","has_accounts == true"],"tier":1,"check":"credential in UserDefaults / SharedPreferences rather than Keychain / Keystore","category":"mobile"},{"id":"MOB-003","tier":2,"severity":"medium","requires":["surface in [mobile-ios, mobile-android]","data_sensitivity in [financial, health]"]},{"id":"MOB-004","title":"Permissions requested without a usage description","severity":"high","requires":["surface in [mobile-ios, mobile-android]"],"tier":1,"category":"mobile"},{"id":"MOB-005","tier":2,"severity":"high","requires":["surface in [mobile-ios, mobile-android]"]},{"id":"MOB-006","tier":2,"severity":"medium","requires":["surface == mobile-ios","has_accounts == true"]},{"id":"MOB-007","tier":2,"severity":"high","requires":["surface in [mobile-ios, mobile-android]","has_subscriptions == true"]},{"id":"MOB-008","tier":2,"severity":"medium","requires":["surface in [mobile-ios, mobile-android]","stage == production"]},{"id":"MOB-009","tier":2,"severity":"high","requires":["surface in [mobile-ios, mobile-android]"]},{"id":"MOB-010","tier":2,"severity":"low","requires":["surface in [mobile-ios, mobile-android]","data_sensitivity in [financial, health]"]},{"id":"INC-001","tier":2,"severity":"high","requires":["has_accounts == true","stage == production"]},{"id":"INC-002","tier":2,"severity":"high","requires":["stage == production","calls_llm == true"]},{"id":"INC-003","tier":2,"severity":"low","requires":["stage == production","business_model in [b2b-saas, b2c]"]},{"id":"INC-004","title":"No security contact or disclosure path","severity":"medium","requires":["is_public == true","stage == production"],"tier":1,"origin":"gap","check":"no security.txt, no security contact","category":"incident-readiness"},{"id":"INC-005","tier":2,"severity":"high","requires":["data_sensitivity != none","jurisdictions includes any of [eu, uk]"]},{"id":"INC-006","tier":2,"severity":"critical","requires":["calls_llm == true","stage == production"]},{"id":"INC-007","tier":2,"severity":"medium","requires":["has_accounts == true","stage == production"]},{"id":"INC-008","tier":2,"severity":"medium","requires":["stage == production"]},{"id":"INC-009","tier":2,"severity":"low","requires":["stage == production","business_model == b2b-saas"]},{"id":"INC-010","tier":2,"severity":"low","requires":["stage == production","business_model == b2b-saas"]},{"id":"DJ-001","title":"DEBUG is on in a deployed setting","severity":"critical","requires":["stack.framework == django","stage in [pre-launch, production]"],"tier":1,"check":"DEBUG = True in a settings module not named local/dev","note":"Django's debug page prints settings, installed apps, the SQL that ran and a full traceback to whoever triggers the error. Django's own docs call deploying with it on a security problem.","fix":"DEBUG = False in production, and set ALLOWED_HOSTS.","category":"framework-django"},{"id":"DJ-002","title":"SECRET_KEY written into source","severity":"critical","requires":["stack.framework == django"],"tier":1,"check":"SECRET_KEY assigned a literal rather than read from the environment","note":"SECRET_KEY signs sessions, password-reset tokens and CSRF tokens. Anyone holding it can forge a session for any user.","fix":"Read it from an environment variable and rotate the committed value.","category":"framework-django"},{"id":"DJ-003","title":"ALLOWED_HOSTS accepts any host","severity":"high","requires":["stack.framework == django","is_public == true"],"tier":1,"check":"ALLOWED_HOSTS contains '*'","note":"enables host-header poisoning, which turns password-reset emails into links pointing at an attacker's domain.","category":"framework-django"},{"id":"DJ-004","title":"CSRF middleware removed","severity":"critical","requires":["stack.framework == django","has_accounts == true"],"tier":1,"check":"MIDDLEWARE lacks django.middleware.csrf.CsrfViewMiddleware","note":"it ships enabled. Its absence means someone deliberately removed it.","category":"framework-django"},{"id":"DJ-005","tier":2,"severity":"critical","requires":["stack.framework == django"]},{"id":"DJ-006","title":"Raw SQL built by interpolation","severity":"critical","requires":["stack.framework == django"],"tier":1,"check":".raw() or .extra() containing an f-string, % or .format()","fix":"Pass parameters: .raw('SELECT … WHERE id = %s', [id])","category":"framework-django"},{"id":"DJ-007","title":"HTTPS not enforced","severity":"high","requires":["stack.framework == django","stage == production","is_public == true"],"tier":1,"check":"SECURE_SSL_REDIRECT absent or False","category":"framework-django"},{"id":"DJ-008","title":"Session and CSRF cookies not marked secure","severity":"high","requires":["stack.framework == django","has_accounts == true","stage == production"],"tier":1,"check":"SESSION_COOKIE_SECURE or CSRF_COOKIE_SECURE missing or False","note":"without these the cookies travel over plain HTTP on the first request.","category":"framework-django"},{"id":"DJ-009","title":"HSTS not configured","severity":"medium","requires":["stack.framework == django","stage == production","is_public == true"],"tier":1,"check":"SECURE_HSTS_SECONDS is 0 or unset","category":"framework-django"},{"id":"DJ-010","title":"ModelForm or serializer exposes every field","severity":"critical","requires":["stack.framework == django"],"tier":1,"check":"fields = '__all__' on a ModelForm or ModelSerializer","note":"Django's own mass-assignment shape. Every column becomes writable from the request, including is_staff, is_superuser and any balance you keep on the model.","fix":"List the fields you actually accept.","category":"framework-django"},{"id":"DJ-011","tier":2,"severity":"critical","requires":["stack.framework == django","has_accounts == true"]},{"id":"DJ-012","title":"Password validators removed","severity":"medium","requires":["stack.framework == django","has_accounts == true"],"tier":1,"check":"AUTH_PASSWORD_VALIDATORS is an empty list","category":"framework-django"},{"id":"DJ-013","title":"Clickjacking protection disabled","severity":"medium","requires":["stack.framework == django","is_public == true"],"tier":1,"check":"XFrameOptionsMiddleware absent, or X_FRAME_OPTIONS set to ALLOWALL","category":"framework-django"},{"id":"DJ-014","title":"Sessions serialised with pickle","severity":"critical","requires":["stack.framework == django"],"tier":1,"check":"SESSION_SERIALIZER set to PickleSerializer","note":"combined with a leaked SECRET_KEY this is remote code execution, not just session forgery.","category":"framework-django"},{"id":"DJ-015","tier":2,"severity":"critical","requires":["stack.framework == django","has_accounts == true"]},{"id":"DJ-016","title":"DEBUG toolbar or dev-only app installed in production","severity":"high","requires":["stack.framework == django","stage == production"],"tier":1,"check":"debug_toolbar, django_extensions or silk present in production INSTALLED_APPS","category":"framework-django"},{"id":"DJ-017","tier":2,"severity":"medium","requires":["stack.framework == django","has_file_uploads == true","stage == production"]},{"id":"DJ-018","tier":2,"severity":"high","requires":["stack.framework == django","has_accounts == true","is_public == true"]},{"id":"RB-001","title":"secret_key_base committed to the repository","severity":"critical","requires":["stack.framework == rails"],"tier":1,"check":"a literal secret_key_base in config/secrets.yml, credentials.yml or an initializer","note":"signs every session cookie. With it, anyone mints a session for any user — and Rails historically deserialised session data, so it has meant RCE.","fix":"Use encrypted credentials or ENV, and rotate the exposed key.","category":"framework-rails"},{"id":"RB-002","title":"config.force_ssl not enabled in production","severity":"high","requires":["stack.framework == rails","stage == production","is_public == true"],"tier":1,"check":"config.force_ssl absent or false in config/environments/production.rb","note":"one line, and it enables the redirect, secure cookies and HSTS together.","category":"framework-rails"},{"id":"RB-003","title":"CSRF protection disabled or skipped","severity":"critical","requires":["stack.framework == rails","has_accounts == true"],"tier":1,"check":"skip_before_action :verify_authenticity_token, or protect_from_forgery with: :null_session on a state-changing controller","category":"framework-rails"},{"id":"RB-004","title":"html_safe or raw applied to user content","severity":"critical","requires":["stack.framework == rails"],"tier":1,"check":".html_safe or raw() on a value derived from params, or <%== in an ERB template","note":"ERB escapes by default. These are the ways to turn that off.","category":"framework-rails"},{"id":"RB-005","title":"SQL built by string interpolation","severity":"critical","requires":["stack.framework == rails"],"tier":1,"check":"where(\"… #{…}\"), find_by_sql or order() containing interpolation","fix":"where('email = ?', email) — the placeholder form.","category":"framework-rails"},{"id":"RB-006","title":"Strong parameters bypassed with permit!","severity":"critical","requires":["stack.framework == rails"],"tier":1,"check":"params.permit! or params.require(:x).permit!","note":"permit! whitelists everything the caller sent. Rails added strong parameters precisely because of the GitHub mass-assignment incident.","category":"framework-rails"},{"id":"RB-007","tier":2,"severity":"critical","requires":["stack.framework == rails","has_accounts == true"]},{"id":"RB-008","title":"Unsafe deserialisation of user input","severity":"critical","requires":["stack.framework == rails"],"tier":1,"check":"Marshal.load, YAML.load or Oj.load applied to request data","note":"each of these instantiates arbitrary Ruby objects. Use YAML.safe_load.","category":"framework-rails"},{"id":"RB-009","title":"File served from a user-supplied path","severity":"critical","requires":["stack.framework == rails"],"tier":1,"check":"send_file or render file: built from params","note":"../../config/master.key is a valid filename as far as the filesystem cares.","category":"framework-rails"},{"id":"RB-010","tier":2,"severity":"critical","requires":["stack.framework == rails","has_accounts == true"]},{"id":"RB-011","title":"Sensitive parameters not filtered from logs","severity":"high","requires":["stack.framework == rails","has_accounts == true"],"tier":1,"check":"config.filter_parameters omits password, token or secret","note":"otherwise plaintext passwords are written into production logs on every sign-in, and logs are backed up, shipped and searched.","category":"framework-rails"},{"id":"RB-012","title":"Detailed exception pages enabled in production","severity":"high","requires":["stack.framework == rails","stage == production"],"tier":1,"check":"config.consider_all_requests_local = true in production.rb","note":"turns every 500 into a stack trace with source and local variables.","category":"framework-rails"},{"id":"RB-013","tier":2,"severity":"high","requires":["stack.framework == rails"]},{"id":"RB-014","title":"Devise configured without lockable or timeout","severity":"medium","requires":["stack.framework == rails","stack.auth == devise","is_public == true"],"tier":1,"check":"devise model lacks :lockable, or Devise.timeout_in is unset","note":"Devise ships neither brute-force lockout nor session expiry enabled.","category":"framework-rails"},{"id":"RB-015","tier":2,"severity":"medium","requires":["stack.framework == rails","has_background_jobs == true"]}]}
+{"version":"0.1","count":290,"rules":[{"id":"SEC-001","title":".env committed to version control","severity":"critical","requires":[],"tier":1,"check":"git ls-files matches ^\\.env(\\.|$) and not .env.example","fix":"git rm --cached .env; add to .gitignore; ROTATE every key in it","note":"rotation is the part everyone skips. history retains the file.","category":"secrets"},{"id":"SEC-002","title":".env absent from .gitignore","severity":"high","requires":[],"tier":1,"check":".gitignore lacks a pattern matching .env","category":"secrets"},{"id":"SEC-003","title":"Hardcoded API key / token / password in source","severity":"critical","requires":[],"tier":1,"check":"entropy + provider prefix scan (sk-, sk-ant-, AKIA, ghp_, xoxb-, eyJ...) outside .env","category":"secrets"},{"id":"SEC-009","title":"A live key is still in your git history","severity":"critical","requires":[],"tier":1,"check":"vendor-prefixed live keys (sk_live_, rk_live_, whsec_, sk-ant-, sk-proj-, ghp_, gho_, glpat-, SG.) found in any blob in .git, read directly without shelling out. Deliberately NOT private keys or database URLs: a test fixture and a real one are byte-identical, and including them fired on 15 of 68 real repositories with every hit a fixture.","category":"secrets"},{"id":"SEC-004","title":"Server-only secret exposed to the client bundle","severity":"critical","requires":["surface in [web-app, web-site]"],"tier":1,"check":"NEXT_PUBLIC_/VITE_/REACT_APP_ prefix on a name matching (KEY|SECRET|TOKEN|PASSWORD), or a secret literal reachable from a client component","note":"the single most common vibe-coder leak. the prefix makes it PUBLIC, and the name reads like it is protected.","category":"secrets"},{"id":"SEC-005","title":"Supabase service_role key used outside a server context","severity":"critical","requires":["stack.database == supabase"],"tier":1,"check":"service_role key referenced in a client component, edge config, or NEXT_PUBLIC_ var","note":"service_role bypasses RLS entirely. in the browser it is a full database handover.","category":"secrets"},{"id":"SEC-006","title":"Paid-API key called directly from the browser","severity":"critical","requires":["calls_llm == true"],"tier":1,"check":"LLM SDK instantiated in client-side code, or provider endpoint called from browser","fix":"proxy through your own server route; never ship the provider key","category":"secrets"},{"id":"SEC-007","tier":2,"severity":"medium","requires":["stage == production"]},{"id":"SEC-008","tier":2,"severity":"medium","requires":["stage == production"]},{"id":"AUTH-001","title":"Session token stored in localStorage","severity":"high","requires":["has_accounts == true","surface in [web-app, web-site]"],"tier":1,"check":"localStorage.setItem / getItem with a token-like key","fix":"httpOnly + Secure + SameSite cookie","note":"localStorage is readable by any XSS. a cookie with httpOnly is not.","category":"authentication"},{"id":"AUTH-002","title":"Role or permission read from client-controlled storage","severity":"critical","requires":["has_accounts == true"],"tier":1,"check":"role/isAdmin/plan/tier read from localStorage, sessionStorage, cookie, or JWT claim without server-side re-verification","note":"the corpus demo is literally 'open Application storage, change Member to Admin, refresh'.","category":"authentication"},{"id":"AUTH-003","title":"No brute-force limit on login","severity":"high","requires":["has_accounts == true"],"tier":1,"check":"login route has no attempt counter / lockout / rate limit","fix":"max 5 attempts per identifier per 15 min, plus IP-level cap","category":"authentication"},{"id":"AUTH-004","title":"Password reset endpoint unthrottled","severity":"high","requires":["has_accounts == true","sends_email == true"],"tier":1,"check":"password-reset route lacks rate limiting","note":"corpus example — 67,000 requests at 2am against one reset endpoint.","category":"authentication"},{"id":"AUTH-005","tier":2,"severity":"medium","requires":["has_accounts == true","is_public == true"]},{"id":"AUTH-006","tier":2,"severity":"medium","requires":["has_admin_panel == true","stage == production"]},{"id":"AUTH-007","tier":2,"severity":"high","requires":["has_accounts == true"]},{"id":"AUTH-008","title":"Password stored without a modern KDF","severity":"critical","requires":["stack.auth == custom"],"tier":1,"check":"password hashing absent, or md5/sha1/sha256 without bcrypt/argon2/scrypt","category":"authentication"},{"id":"AUTH-009","tier":2,"severity":"medium","requires":["has_accounts == true","stage == production","is_public == true"]},{"id":"AUTH-010","tier":2,"severity":"high","requires":["stack.host in [vps, aws, gcp]"]},{"id":"AUTHZ-001","title":"Supabase table with RLS disabled","severity":"critical","requires":["stack.database == supabase","has_accounts == true"],"tier":1,"check":"table in migrations without ENABLE ROW LEVEL SECURITY","note":"corpus calls this the single most common vulnerability found across startups AND enterprises. RLS is OFF by default for raw-SQL tables.","category":"authorization"},{"id":"AUTHZ-002","tier":2,"severity":"critical","requires":["stack.database == supabase","has_accounts == true"],"has_static_approximation":true,"title":"RLS enabled but policy is permissive"},{"id":"AUTHZ-003","tier":2,"severity":"critical","requires":["has_accounts == true"],"has_static_approximation":true,"title":"IDOR — object accessed by ID without an ownership check"},{"id":"AUTHZ-004","tier":2,"severity":"critical","requires":["has_admin_panel == true"],"has_static_approximation":true,"title":"Admin authorization enforced only in the UI"},{"id":"AUTHZ-005","tier":2,"severity":"critical","requires":["calls_llm == true","has_accounts == true"],"has_static_approximation":true,"title":"Usage limits stored in a row the user can modify"},{"id":"AUTHZ-006","tier":2,"severity":"critical","requires":["tenancy == multi-tenant-shared-db"],"has_static_approximation":true,"title":"Missing tenant scope on a domain query"},{"id":"AUTHZ-007","tier":2,"severity":"critical","requires":["tenancy == multi-tenant-shared-db"]},{"id":"AUTHZ-008","tier":2,"severity":"high","requires":["has_accounts == true"]},{"id":"RATE-001","title":"No rate limiting on any endpoint","severity":"high","requires":["is_public == true"],"tier":1,"check":"no rate-limit middleware, no gateway policy, no per-route limiter","category":"rate-limiting"},{"id":"RATE-002","tier":2,"severity":"medium","requires":["is_public == true"]},{"id":"RATE-003","tier":2,"severity":"critical","requires":["calls_llm == true"],"has_static_approximation":true,"title":"No spend ceiling on paid-API endpoints"},{"id":"RATE-004","tier":2,"severity":"high","requires":["calls_llm == true","has_accounts == true"],"has_static_approximation":true,"title":"No per-user quota on AI features"},{"id":"RATE-005","tier":2,"severity":"high","requires":["sends_email == true"]},{"id":"RATE-006","tier":2,"severity":"medium","requires":["is_public == true","stage == production"]},{"id":"RATE-007","tier":2,"severity":"medium","requires":["has_accounts == true","is_public == true"]},{"id":"AI-001","tier":2,"severity":"critical","requires":["calls_llm == true","llm_input_from_user == true"],"has_static_approximation":true,"title":"User input reaches the system-prompt position"},{"id":"AI-002","tier":2,"severity":"high","requires":["calls_llm == true","llm_input_from_user == true"]},{"id":"AI-003","title":"No max_tokens ceiling on completions","severity":"high","requires":["calls_llm == true"],"tier":1,"origin":"gap","check":"provider call omits max_tokens, or sets it above the plan's economics","note":"unbounded output is unbounded cost, per request.","category":"ai-safety"},{"id":"AI-004","title":"No model allowlist","severity":"medium","requires":["calls_llm == true"],"tier":1,"origin":"gap","check":"model id derived from request input, or no constant/allowlist","note":"a client-chosen model is a client-chosen price.","category":"ai-safety"},{"id":"AI-005","tier":2,"severity":"high","requires":["calls_llm == true","stage == production"]},{"id":"AI-006","tier":2,"severity":"critical","requires":["calls_llm == true","llm_tools_enabled == true"]},{"id":"AI-007","title":"Model output rendered as HTML without sanitisation","severity":"critical","requires":["calls_llm == true","surface in [web-app, web-site]"],"tier":1,"origin":"gap","check":"completion piped to dangerouslySetInnerHTML / v-html / innerHTML","note":"injection in, XSS out.","category":"ai-safety"},{"id":"AI-008","tier":2,"severity":"critical","requires":["calls_llm == true"],"has_static_approximation":true,"title":"Model output used in a privileged operation without validation"},{"id":"AI-009","tier":2,"severity":"medium","requires":["calls_llm == true"]},{"id":"AI-010","tier":2,"severity":"high","requires":["calls_llm == true","data_sensitivity != none"]},{"id":"AI-011","title":"No retry/backoff on provider 429s","severity":"medium","requires":["calls_llm == true","stage == production"],"tier":1,"origin":"gap","category":"ai-safety"},{"id":"AI-012","tier":2,"severity":"high","requires":["calls_llm == true","stack.host in [vercel, netlify]"]},{"id":"AI-013","tier":2,"severity":"medium","requires":["calls_llm == true","business_model in [b2b-saas, b2c, marketplace]"]},{"id":"PAY-001","title":"Webhook signature not verified","severity":"critical","requires":["handles_payments != none","has_webhooks_in == true"],"tier":1,"check":"webhook route parses the body without constructEvent / signature check","note":"an unverified webhook endpoint is an unauthenticated 'mark this order paid' API.","category":"payments"},{"id":"PAY-002","tier":2,"severity":"high","requires":["handles_payments in [stripe, paddle, lemonsqueezy]"]},{"id":"PAY-003","tier":2,"severity":"high","requires":["handles_payments != none","has_webhooks_in == true"]},{"id":"PAY-004","tier":2,"severity":"medium","requires":["handles_payments != none"]},{"id":"PAY-005","tier":2,"severity":"high","requires":["has_subscriptions == true"]},{"id":"PAY-006","title":"Price or amount accepted from the client","severity":"critical","requires":["handles_payments != none"],"tier":1,"check":"amount/price/currency read from the request body when creating a charge","category":"payments"},{"id":"PAY-007","tier":2,"severity":"medium","requires":["handles_payments != none","has_webhooks_in == true"]},{"id":"PAY-008","tier":2,"severity":"high","requires":["surface in [mobile-ios]","has_subscriptions == true"]},{"id":"DATA-001","title":"Unbounded list query — no pagination","severity":"high","requires":["stack.database != none"],"tier":1,"check":"list endpoint without limit/offset or cursor","note":"corpus — fine at 50 users, loads 50,000 rows at 500.","category":"data-and-scale"},{"id":"DATA-002","tier":2,"severity":"high","requires":["stack.database != none"]},{"id":"DATA-003","title":"Missing index on a filtered or joined column","severity":"high","requires":["stack.database in [postgres, supabase, mysql, planetscale]"],"tier":1,"check":"WHERE / JOIN / ORDER BY column with no index in migrations","note":"50ms at 100 rows, 30s at 100k. the code never changed.","category":"data-and-scale"},{"id":"DATA-004","title":"No connection pooling","severity":"high","requires":["stack.database in [postgres, supabase, mysql]","stack.host in [vercel, netlify, cloudflare]"],"tier":1,"note":"serverless multiplies connections per invocation; the DB runs out first.","category":"data-and-scale"},{"id":"DATA-005","title":"SELECT * on wide or hot tables","severity":"medium","requires":["stack.database != none"],"tier":1,"category":"data-and-scale"},{"id":"DATA-006","tier":2,"severity":"critical","requires":[]},{"id":"DATA-007","title":"Raw SQL built by string concatenation","severity":"critical","requires":["stack.orm == raw-sql"],"tier":1,"check":"query string interpolating a request value","category":"data-and-scale"},{"id":"DATA-008","title":"No payload size limit","severity":"medium","requires":["is_public == true"],"tier":1,"check":"body parser without a size cap","category":"data-and-scale"},{"id":"DATA-009","title":"Text columns not 4-byte-safe","severity":"medium","requires":["stack.database in [mysql, planetscale]"],"tier":1,"check":"utf8 rather than utf8mb4 on user-facing text columns","note":"corpus failure — a user typed an emoji and the app crashed. 3-byte utf8 cannot hold a 4-byte codepoint.","category":"data-and-scale"},{"id":"DATA-010","tier":2,"severity":"medium","requires":["stage == pre-launch","expected_scale != hobby"]},{"id":"DATA-011","tier":2,"severity":"medium","requires":["sends_email == true or has_file_uploads == true"]},{"id":"DATA-012","tier":2,"severity":"critical","requires":["stage == production","stack.database != none"]},{"id":"DATA-013","tier":2,"severity":"critical","requires":["has_file_uploads == true","has_accounts == true"]},{"id":"DATA-014","title":"User uploads stored on ephemeral disk","severity":"critical","requires":["has_file_uploads == true","stack.host in [vercel, netlify, railway, fly, render]"],"tier":1,"check":"writes to local fs on a platform with an ephemeral filesystem","note":"matches CRMini — files vanish on every redeploy.","origin":"gap","category":"data-and-scale"},{"id":"DATA-015","title":"User input concatenated into a SQL query","severity":"critical","tier":1,"check":"a request value interpolated into a SQL string instead of passed as a parameter","note":"the oldest way to lose a database and still the most common. Parameterised queries are not a mitigation, they are the fix.","origin":"gap","category":"data-and-scale"},{"id":"INF-001","tier":2,"severity":"medium","requires":["stage == production","expected_scale in [under-100k, over-100k]","stack.host in [vps, aws, gcp]"]},{"id":"INF-002","title":"No health check or auto-restart","severity":"medium","requires":["stage == production","stack.host in [vps, aws, gcp]"],"tier":1,"category":"infrastructure"},{"id":"INF-003","tier":2,"severity":"low","requires":["expected_scale == over-100k"]},{"id":"INF-004","tier":2,"severity":"low","requires":["stage == production","expected_scale != hobby"]},{"id":"INF-005","tier":2,"severity":"low","requires":["expected_scale == over-100k"]},{"id":"INF-006","title":"HTTPS not enforced","severity":"high","requires":["is_public == true"],"tier":1,"check":"no HSTS, no http->https redirect","category":"infrastructure"},{"id":"INF-007","title":"Permissive CORS","severity":"high","requires":["surface in [web-app, api-only]"],"tier":1,"check":"Access-Control-Allow-Origin: * on credentialed routes","origin":"gap","category":"infrastructure"},{"id":"INF-008","tier":2,"severity":"critical","requires":["stack.database != none","stack.host in [vps, aws, gcp]"]},{"id":"INF-009","tier":2,"severity":"high","requires":["surface in [mobile-ios, mobile-android]"]},{"id":"INF-010","tier":2,"severity":"medium","requires":["is_public == true","stage == production"]},{"id":"INF-011","tier":2,"severity":"low","requires":["stage == production","business_model in [b2b-saas, marketplace]"]},{"id":"LEG-001","title":"No privacy policy while collecting personal data","severity":"high","requires":["data_sensitivity != none","is_public == true"],"tier":1,"note":"corpus is emphatic — a single contact form collecting an email is already personal data.","category":"legal"},{"id":"LEG-002","tier":2,"severity":"high","requires":["collects_analytics == true","jurisdictions includes any of [eu, uk]"]},{"id":"LEG-003","title":"No terms of service","severity":"medium","requires":["is_public == true","has_accounts == true"],"tier":1,"category":"legal"},{"id":"LEG-004","tier":2,"severity":"high","requires":["data_sensitivity != none","jurisdictions includes any of [eu, uk, ca]"]},{"id":"LEG-005","tier":2,"severity":"medium","requires":["data_sensitivity != none","jurisdictions includes any of [eu, ru, kz]"]},{"id":"LEG-006","title":"Accessibility baseline unmet","severity":"medium","requires":["surface in [web-app, web-site]","is_public == true"],"tier":1,"check":"missing alt text, insufficient contrast, no heading hierarchy, unlabelled controls","note":"corpus flags active litigation risk in US and AU.","category":"legal"},{"id":"LEG-007","tier":2,"severity":"medium","requires":["stage in [pre-launch, production]","business_model != hobby"]},{"id":"LEG-008","tier":2,"severity":"high","requires":["surface in [mobile-ios, mobile-android]"]},{"id":"LEG-009","tier":2,"severity":"medium","requires":["data_sensitivity != none","jurisdictions includes any of [ru, kz, other]"]},{"id":"LEG-010","tier":2,"severity":"medium","requires":["is_public == true"]},{"id":"OBS-001","title":"No error monitoring","severity":"high","requires":["stage == production"],"tier":1,"origin":"gap","category":"observability"},{"id":"OBS-002","tier":2,"severity":"medium","requires":["has_accounts == true","stage == production"]},{"id":"OBS-003","title":"No product analytics","severity":"low","requires":["stage in [pre-launch, production]","business_model != internal-tool"],"tier":1,"category":"observability"},{"id":"OBS-004","tier":2,"severity":"medium","requires":["stage == production"]},{"id":"UX-001","tier":2,"severity":"medium","requires":["surface in [web-app, mobile-ios, mobile-android]"]},{"id":"UX-002","tier":2,"severity":"high","requires":["surface in [web-app, mobile-ios, mobile-android]"]},{"id":"UX-003","tier":2,"severity":"low","requires":["surface in [web-app, mobile-ios, mobile-android]"]},{"id":"UX-004","tier":2,"severity":"low","requires":["stage in [pre-launch, production]","business_model in [b2c, b2b-saas]"]},{"id":"UX-005","title":"No social preview image","severity":"low","requires":["is_public == true","surface in [web-app, web-site]"],"tier":1,"category":"ux-readiness"},{"id":"UX-006","title":"No sitemap.xml / not indexable","severity":"low","requires":["is_public == true","surface == web-site"],"tier":1,"category":"ux-readiness"},{"id":"AIOP-001","tier":2,"severity":"high","requires":["calls_llm == true","stage == production"]},{"id":"AIOP-002","title":"Model id pinned to an alias that can silently change","severity":"medium","requires":["calls_llm == true","stage == production"],"tier":1,"origin":"gap","note":"floating aliases shift behaviour and price under you with no deploy.","category":"ai-operations"},{"id":"AIOP-003","tier":2,"severity":"medium","requires":["calls_llm == true","stage == production"]},{"id":"AIOP-004","tier":2,"severity":"low","requires":["calls_llm == true","stage == production"]},{"id":"AIOP-005","tier":2,"severity":"high","requires":["calls_llm == true"]},{"id":"AIOP-006","tier":2,"severity":"high","requires":["calls_llm == true"]},{"id":"AIOP-007","tier":2,"severity":"critical","requires":["has_rag == true"]},{"id":"AIOP-008","tier":2,"severity":"critical","requires":["has_rag == true","tenancy == multi-tenant-shared-db"]},{"id":"AIOP-009","tier":2,"severity":"medium","requires":["has_rag == true"]},{"id":"AIOP-010","title":"Agent loop has no iteration ceiling","severity":"critical","requires":["llm_tools_enabled == true"],"tier":1,"origin":"gap","note":"an unbounded loop is an unbounded invoice.","category":"ai-operations"},{"id":"AIOP-011","tier":2,"severity":"high","requires":["llm_tools_enabled == true"]},{"id":"AIOP-012","tier":2,"severity":"critical","requires":["llm_tools_enabled == true"]},{"id":"AIOP-013","tier":2,"severity":"medium","requires":["calls_llm == true","stage == production"]},{"id":"AIOP-014","tier":2,"severity":"medium","requires":["calls_llm == true","stage == production"]},{"id":"AIOP-015","tier":2,"severity":"medium","requires":["calls_llm == true","business_model in [b2c, b2b-saas]"]},{"id":"AIOP-016","title":"User-facing AI errors leak provider internals","severity":"medium","requires":["calls_llm == true"],"tier":1,"origin":"gap","category":"ai-operations"},{"id":"AIOP-017","tier":2,"severity":"medium","requires":["calls_llm == true","is_public == true","business_model == b2c"]},{"id":"AIOP-018","tier":2,"severity":"critical","requires":["calls_llm == true","is_public == true"],"has_static_approximation":true,"title":"Free tier allows unauthenticated AI calls"},{"id":"AIOP-019","tier":2,"severity":"medium","requires":["calls_llm == true"]},{"id":"AIOP-020","title":"Temperature or sampling unset for a deterministic task","severity":"low","requires":["calls_llm == true"],"tier":1,"origin":"gap","category":"ai-operations"},{"id":"DEP-001","title":"Secrets injected at build time instead of runtime","severity":"high","requires":["stage in [pre-launch, production]"],"tier":1,"note":"build-time inlining bakes the value into the artifact; rotation needs a rebuild.","category":"deployment"},{"id":"DEP-002","title":"Secrets present in CI logs or config","severity":"critical","requires":["has_ci == true"],"tier":1,"check":"plaintext credential in workflow yaml, or echoed to build output","category":"deployment"},{"id":"DEP-003","tier":2,"severity":"medium","requires":["stage in [pre-launch, production]"]},{"id":"DEP-004","tier":2,"severity":"high","requires":["has_migrations == true","stage == production"]},{"id":"DEP-005","title":"Migrations are not reversible","severity":"medium","requires":["has_migrations == true","stage == production"],"tier":1,"category":"deployment"},{"id":"DEP-006","tier":2,"severity":"critical","requires":["has_migrations == true","stage == production"]},{"id":"DEP-007","tier":2,"severity":"high","requires":["stage == production"]},{"id":"DEP-008","title":"No health endpoint","severity":"medium","requires":["stage == production","surface in [web-app, api-only]"],"tier":1,"category":"deployment"},{"id":"DEP-009","title":"No graceful shutdown handling","severity":"medium","requires":["stage == production","has_background_jobs == true"],"tier":1,"check":"no SIGTERM handler draining in-flight work","category":"deployment"},{"id":"DEP-010","title":"Dependencies unpinned","severity":"medium","requires":["stage in [pre-launch, production]"],"tier":1,"check":"no lockfile committed, or ranges in a deployed manifest","category":"deployment"},{"id":"DEP-011","title":"Known-vulnerable dependencies","severity":"high","requires":[],"tier":1,"check":"audit surfaces advisories at high or critical","category":"deployment"},{"id":"DEP-012","tier":2,"severity":"medium","requires":["stage == production"]},{"id":"DEP-013","title":"Third-party script loaded without integrity check","severity":"medium","requires":["surface in [web-app, web-site]","is_public == true"],"tier":1,"check":"external <script> without SRI","category":"deployment"},{"id":"DEP-014","title":"Source maps published in production","severity":"medium","requires":["surface in [web-app, web-site]","stage == production"],"tier":1,"category":"deployment"},{"id":"DEP-015","title":"Debug mode or verbose errors enabled in production","severity":"high","requires":["stage == production"],"tier":1,"category":"deployment"},{"id":"DEP-016","title":"No CI check gating merges","severity":"low","requires":["has_ci == true","business_model in [b2b-saas, marketplace]"],"tier":1,"category":"deployment"},{"id":"DEP-017","tier":2,"severity":"medium","requires":["stage in [pre-launch, production]"]},{"id":"DEP-018","tier":2,"severity":"high","requires":["stage == production","stack.database != none"]},{"id":"RU-001","title":"Timestamps stored without timezone","severity":"high","requires":["stack.database != none"],"tier":1,"check":"timestamp column without time zone, or naive datetime written from app code","note":"works perfectly until your second user is in another country.","category":"real-user-readiness"},{"id":"RU-002","tier":2,"severity":"medium","requires":["surface in [web-app, mobile-ios, mobile-android]"]},{"id":"RU-003","title":"Money stored as float","severity":"critical","requires":["handles_payments != none or serves_currency == multi"],"tier":1,"check":"float/double/real column holding an amount","note":"rounding error in currency is a correctness bug, not a style issue.","category":"real-user-readiness"},{"id":"RU-004","title":"Currency not stored alongside amount","severity":"high","requires":["serves_currency == multi"],"tier":1,"category":"real-user-readiness"},{"id":"RU-005","tier":2,"severity":"low","requires":["data_sensitivity != none","audience_locale == multi"]},{"id":"RU-006","title":"Text input not accepting the full Unicode range","severity":"high","requires":["stack.database != none"],"tier":1,"note":"corpus — an emoji crashed a production app because the column was 3-byte utf8.","category":"real-user-readiness"},{"id":"RU-007","title":"No mobile viewport handling","severity":"high","requires":["surface in [web-app, web-site]","is_public == true"],"tier":1,"category":"real-user-readiness"},{"id":"RU-008","tier":2,"severity":"medium","requires":["surface in [mobile-ios, mobile-android]"]},{"id":"RU-009","tier":2,"severity":"medium","requires":["has_accounts == true"]},{"id":"RU-010","title":"No support or contact channel","severity":"medium","requires":["is_public == true","stage == production"],"tier":1,"category":"real-user-readiness"},{"id":"RU-011","tier":2,"severity":"high","requires":["sends_email == true","stage == production"]},{"id":"RU-012","tier":2,"severity":"medium","requires":["sends_email == true","stage == production"]},{"id":"RU-013","title":"Marketing email without an unsubscribe path","severity":"high","requires":["sends_email == true","is_public == true"],"tier":1,"category":"real-user-readiness"},{"id":"RU-014","tier":2,"severity":"high","requires":["sends_email == true"]},{"id":"RU-015","tier":2,"severity":"high","requires":["has_accounts == true","stage == production"]},{"id":"RU-016","tier":2,"severity":"high","requires":["has_accounts == true"]},{"id":"RU-017","tier":2,"severity":"high","requires":["has_accounts == true","stack.auth == custom"]},{"id":"RU-018","tier":2,"severity":"medium","requires":["has_accounts == true","is_public == true"]},{"id":"RU-019","title":"Session lifetime unbounded","severity":"medium","requires":["has_accounts == true"],"tier":1,"category":"real-user-readiness"},{"id":"RU-020","tier":2,"severity":"low","requires":["has_accounts == true","business_model in [b2c, b2b-saas]"]},{"id":"TEN-001","tier":2,"severity":"critical","requires":["tenancy == multi-tenant-shared-db","stack.database in [postgres, supabase]"]},{"id":"TEN-002","title":"No composite index on (tenant_id, ...) for hot queries","severity":"medium","requires":["tenancy == multi-tenant-shared-db"],"tier":1,"category":"multi-tenancy"},{"id":"TEN-003","title":"Invitation token does not expire","severity":"high","requires":["has_invitations == true"],"tier":1,"category":"multi-tenancy"},{"id":"TEN-004","tier":2,"severity":"critical","requires":["has_invitations == true","has_roles == true"]},{"id":"TEN-005","tier":2,"severity":"critical","requires":["has_roles == true"]},{"id":"TEN-006","tier":2,"severity":"critical","requires":["has_roles == true","tenancy == multi-tenant-shared-db"]},{"id":"TEN-007","tier":2,"severity":"high","requires":["tenancy == multi-tenant-shared-db","has_accounts == true"]},{"id":"TEN-008","tier":2,"severity":"critical","requires":["tenancy == multi-tenant-shared-db","has_file_uploads == true"]},{"id":"TEN-009","tier":2,"severity":"high","requires":["tenancy == multi-tenant-shared-db"]},{"id":"TEN-010","tier":2,"severity":"medium","requires":["tenancy == multi-tenant-shared-db","has_subscriptions == true"]},{"id":"TEN-011","tier":2,"severity":"medium","requires":["tenancy == multi-tenant-shared-db","calls_llm == true"]},{"id":"TEN-012","tier":2,"severity":"high","requires":["has_admin_panel == true","tenancy == multi-tenant-shared-db"]},{"id":"TEN-013","tier":2,"severity":"critical","requires":["tenancy == multi-tenant-shared-db"]},{"id":"TEN-014","tier":2,"severity":"high","requires":["tenancy == multi-tenant-shared-db","has_webhooks_in == true"]},{"id":"UP-001","title":"File type validated by extension or client MIME only","severity":"high","requires":["has_file_uploads == true"],"tier":1,"category":"file-uploads"},{"id":"UP-002","title":"No upload size limit","severity":"high","requires":["has_file_uploads == true"],"tier":1,"category":"file-uploads"},{"id":"UP-003","title":"Upload path built from a user-supplied filename","severity":"critical","requires":["has_file_uploads == true"],"tier":1,"check":"filename concatenated into a storage path without normalisation","category":"file-uploads"},{"id":"UP-004","tier":2,"severity":"high","requires":["has_file_uploads == true","surface in [web-app, web-site]"]},{"id":"UP-005","title":"SVG accepted without sanitisation","severity":"high","requires":["has_file_uploads == true"],"tier":1,"category":"file-uploads"},{"id":"UP-006","tier":2,"severity":"medium","requires":["has_file_uploads == true","tenancy == multi-tenant-shared-db"]},{"id":"UP-007","title":"Signed URLs with excessive lifetime","severity":"medium","requires":["has_file_uploads == true"],"tier":1,"category":"file-uploads"},{"id":"UP-008","title":"EXIF metadata not stripped from images","severity":"medium","requires":["has_file_uploads == true","data_sensitivity != none"],"tier":1,"note":"photo uploads routinely carry GPS coordinates.","category":"file-uploads"},{"id":"UP-009","tier":2,"severity":"medium","requires":["has_file_uploads == true"]},{"id":"UP-010","tier":2,"severity":"medium","requires":["has_file_uploads == true","has_accounts == true"]},{"id":"UP-011","tier":2,"severity":"medium","requires":["has_file_uploads == true"]},{"id":"UP-012","tier":2,"severity":"high","requires":["has_file_uploads == true"]},{"id":"API-001","title":"Mass assignment — request body spread into a model","severity":"critical","requires":["stack.database != none"],"tier":1,"check":"request body passed wholesale to create/update","note":"this is how a user sets their own is_admin.","category":"api-design"},{"id":"API-002","title":"Internal error details returned to the client","severity":"high","requires":["is_public == true"],"tier":1,"category":"api-design"},{"id":"API-003","title":"Stack traces reachable in production responses","severity":"high","requires":["is_public == true","stage == production"],"tier":1,"category":"api-design"},{"id":"API-004","title":"No maximum page size","severity":"medium","requires":["is_public == true"],"tier":1,"check":"limit parameter accepted without an upper bound","category":"api-design"},{"id":"API-005","title":"Sort or filter parameter interpolated into a query","severity":"critical","requires":["stack.database != none"],"tier":1,"category":"api-design"},{"id":"API-006","title":"State-changing operation exposed over GET","severity":"high","requires":["is_public == true"],"tier":1,"category":"api-design"},{"id":"API-007","tier":2,"severity":"high","requires":["has_accounts == true","surface in [web-app]"]},{"id":"API-008","tier":2,"severity":"low","requires":["surface == api-only"]},{"id":"API-009","tier":2,"severity":"low","requires":["has_accounts == true"]},{"id":"API-010","title":"No request timeout on outbound calls","severity":"medium","requires":["stage == production"],"tier":1,"category":"api-design"},{"id":"API-011","tier":2,"severity":"medium","requires":["surface == api-only","stage == production"]},{"id":"API-012","title":"Security headers missing","severity":"medium","requires":["surface in [web-app, web-site]","is_public == true"],"tier":1,"check":"no CSP, X-Content-Type-Options, Referrer-Policy, frame ancestors","category":"api-design"},{"id":"API-013","title":"Open redirect","severity":"high","requires":["is_public == true","surface in [web-app, web-site]"],"tier":1,"check":"redirect target read from a query parameter without an allowlist","category":"api-design"},{"id":"API-014","tier":2,"severity":"critical","requires":["is_public == true"],"has_static_approximation":true,"title":"SSRF — outbound request to a user-supplied URL"},{"id":"NEXT-001","tier":2,"severity":"critical","requires":["stack.framework == next","has_accounts == true"]},{"id":"NEXT-002","tier":2,"severity":"critical","requires":["stack.framework == next","has_accounts == true"]},{"id":"NEXT-003","tier":2,"severity":"high","requires":["stack.framework == next","has_accounts == true"]},{"id":"NEXT-004","tier":2,"severity":"critical","requires":["stack.framework == next","has_accounts == true"]},{"id":"NEXT-005","tier":2,"severity":"high","requires":["stack.framework == next"]},{"id":"NEXT-006","title":"Secret imported into a module reachable from the client graph","severity":"critical","requires":["stack.framework == next"],"tier":1,"category":"framework-next"},{"id":"NEXT-007","tier":2,"severity":"critical","requires":["stack.framework == next","has_accounts == true"]},{"id":"NEXT-008","tier":2,"severity":"medium","requires":["stack.framework == next"]},{"id":"NEXT-009","title":"Image optimizer allows arbitrary remote hosts","severity":"medium","requires":["stack.framework == next"],"tier":1,"check":"remotePatterns with a wildcard hostname","category":"framework-next"},{"id":"NEXT-010","title":"Route handler lacks runtime/duration config for long work","severity":"medium","requires":["stack.framework == next","calls_llm == true"],"tier":1,"category":"framework-next"},{"id":"NEXT-011","title":"Error boundary absent","severity":"medium","requires":["stack.framework == next"],"tier":1,"check":"no error.tsx / global-error.tsx","category":"framework-next"},{"id":"NEXT-012","title":"Loading UI absent on data routes","severity":"low","requires":["stack.framework == next"],"tier":1,"category":"framework-next"},{"id":"NEXT-013","title":"Cookies set without secure attributes","severity":"high","requires":["stack.framework == next","has_accounts == true"],"tier":1,"category":"framework-next"},{"id":"NEXT-014","title":"Redirect after login uses an unvalidated next parameter","severity":"high","requires":["stack.framework == next","has_accounts == true"],"tier":1,"category":"framework-next"},{"id":"SUP-001","title":"Storage bucket public by default","severity":"critical","requires":["stack.database == supabase","has_file_uploads == true"],"tier":1,"note":"mirrors the RLS problem — permissive default, silent exposure.","category":"platform-supabase"},{"id":"SUP-002","tier":2,"severity":"critical","requires":["stack.database == supabase","has_file_uploads == true"]},{"id":"SUP-003","tier":2,"severity":"critical","requires":["stack.database == supabase","has_realtime == true"]},{"id":"SUP-004","tier":2,"severity":"critical","requires":["stack.database == supabase"]},{"id":"SUP-005","tier":2,"severity":"critical","requires":["stack.database == supabase","has_accounts == true"]},{"id":"SUP-006","title":"Postgres function marked SECURITY DEFINER without a search_path","severity":"high","requires":["stack.database in [supabase, postgres]"],"tier":1,"category":"platform-supabase"},{"id":"SUP-007","tier":2,"severity":"high","requires":["stack.database == supabase"]},{"id":"SUP-008","tier":2,"severity":"low","requires":["stack.auth == supabase-auth","stage == production"]},{"id":"SUP-009","tier":2,"severity":"critical","requires":["stack.database in [supabase, postgres]","has_accounts == true"]},{"id":"SUP-010","tier":2,"severity":"high","requires":["stack.database == supabase","has_webhooks_in == true"]},{"id":"SUP-011","title":"Connection string uses the direct port under serverless","severity":"high","requires":["stack.database == supabase","stack.host in [vercel, netlify, cloudflare]"],"tier":1,"note":"use the pooler; direct connections exhaust under serverless fan-out.","category":"platform-supabase"},{"id":"SUP-012","tier":2,"severity":"high","requires":["stack.database == supabase","stage == production"]},{"id":"LIFE-001","tier":2,"severity":"medium","requires":["data_sensitivity != none","stage == production"]},{"id":"LIFE-002","tier":2,"severity":"high","requires":["data_sensitivity != none","jurisdictions includes any of [eu, uk]"]},{"id":"LIFE-003","tier":2,"severity":"high","requires":["data_sensitivity != none"]},{"id":"LIFE-004","tier":2,"severity":"medium","requires":["data_sensitivity != none","jurisdictions includes any of [eu, uk]"]},{"id":"LIFE-005","tier":2,"severity":"high","requires":["data_sensitivity in [financial, health]"]},{"id":"LIFE-006","tier":2,"severity":"high","requires":["data_sensitivity in [financial, health]"]},{"id":"LIFE-007","tier":2,"severity":"critical","requires":["data_sensitivity != none"]},{"id":"LIFE-008","tier":2,"severity":"critical","requires":["stage == production","data_sensitivity != none"]},{"id":"LIFE-009","tier":2,"severity":"medium","requires":["data_sensitivity != none","stage == production"]},{"id":"LIFE-010","tier":2,"severity":"high","requires":["collects_analytics == true","jurisdictions includes any of [eu, uk]"]},{"id":"LIFE-011","tier":2,"severity":"medium","requires":["business_model == b2b-saas","jurisdictions includes any of [eu, uk]"]},{"id":"LIFE-012","tier":2,"severity":"critical","requires":["data_sensitivity == children"]},{"id":"MOB-001","title":"Secret embedded in the app binary","severity":"critical","requires":["surface in [mobile-ios, mobile-android]"],"tier":1,"note":"a shipped binary is a public file. anything in it is published.","category":"mobile"},{"id":"MOB-002","title":"Token stored outside the platform secure store","severity":"high","requires":["surface in [mobile-ios, mobile-android]","has_accounts == true"],"tier":1,"check":"credential in UserDefaults / SharedPreferences rather than Keychain / Keystore","category":"mobile"},{"id":"MOB-003","tier":2,"severity":"medium","requires":["surface in [mobile-ios, mobile-android]","data_sensitivity in [financial, health]"]},{"id":"MOB-004","title":"Permissions requested without a usage description","severity":"high","requires":["surface in [mobile-ios, mobile-android]"],"tier":1,"category":"mobile"},{"id":"MOB-005","tier":2,"severity":"high","requires":["surface in [mobile-ios, mobile-android]"]},{"id":"MOB-006","tier":2,"severity":"medium","requires":["surface == mobile-ios","has_accounts == true"]},{"id":"MOB-007","tier":2,"severity":"high","requires":["surface in [mobile-ios, mobile-android]","has_subscriptions == true"]},{"id":"MOB-008","tier":2,"severity":"medium","requires":["surface in [mobile-ios, mobile-android]","stage == production"]},{"id":"MOB-009","tier":2,"severity":"high","requires":["surface in [mobile-ios, mobile-android]"]},{"id":"MOB-010","tier":2,"severity":"low","requires":["surface in [mobile-ios, mobile-android]","data_sensitivity in [financial, health]"]},{"id":"INC-001","tier":2,"severity":"high","requires":["has_accounts == true","stage == production"]},{"id":"INC-002","tier":2,"severity":"high","requires":["stage == production","calls_llm == true"]},{"id":"INC-003","tier":2,"severity":"low","requires":["stage == production","business_model in [b2b-saas, b2c]"]},{"id":"INC-004","title":"No security contact or disclosure path","severity":"medium","requires":["is_public == true","stage == production"],"tier":1,"origin":"gap","check":"no security.txt, no security contact","category":"incident-readiness"},{"id":"INC-005","tier":2,"severity":"high","requires":["data_sensitivity != none","jurisdictions includes any of [eu, uk]"]},{"id":"INC-006","tier":2,"severity":"critical","requires":["calls_llm == true","stage == production"]},{"id":"INC-007","tier":2,"severity":"medium","requires":["has_accounts == true","stage == production"]},{"id":"INC-008","tier":2,"severity":"medium","requires":["stage == production"]},{"id":"INC-009","tier":2,"severity":"low","requires":["stage == production","business_model == b2b-saas"]},{"id":"INC-010","tier":2,"severity":"low","requires":["stage == production","business_model == b2b-saas"]},{"id":"DJ-001","title":"DEBUG is on in a deployed setting","severity":"critical","requires":["stack.framework == django","stage in [pre-launch, production]"],"tier":1,"check":"DEBUG = True in a settings module not named local/dev","note":"Django's debug page prints settings, installed apps, the SQL that ran and a full traceback to whoever triggers the error. Django's own docs call deploying with it on a security problem.","fix":"DEBUG = False in production, and set ALLOWED_HOSTS.","category":"framework-django"},{"id":"DJ-002","title":"SECRET_KEY written into source","severity":"critical","requires":["stack.framework == django"],"tier":1,"check":"SECRET_KEY assigned a literal rather than read from the environment","note":"SECRET_KEY signs sessions, password-reset tokens and CSRF tokens. Anyone holding it can forge a session for any user.","fix":"Read it from an environment variable and rotate the committed value.","category":"framework-django"},{"id":"DJ-003","title":"ALLOWED_HOSTS accepts any host","severity":"high","requires":["stack.framework == django","is_public == true"],"tier":1,"check":"ALLOWED_HOSTS contains '*'","note":"enables host-header poisoning, which turns password-reset emails into links pointing at an attacker's domain.","category":"framework-django"},{"id":"DJ-004","title":"CSRF middleware removed","severity":"critical","requires":["stack.framework == django","has_accounts == true"],"tier":1,"check":"MIDDLEWARE lacks django.middleware.csrf.CsrfViewMiddleware","note":"it ships enabled. Its absence means someone deliberately removed it.","category":"framework-django"},{"id":"DJ-005","tier":2,"severity":"critical","requires":["stack.framework == django"]},{"id":"DJ-006","title":"Raw SQL built by interpolation","severity":"critical","requires":["stack.framework == django"],"tier":1,"check":".raw() or .extra() containing an f-string, % or .format()","fix":"Pass parameters: .raw('SELECT … WHERE id = %s', [id])","category":"framework-django"},{"id":"DJ-007","title":"HTTPS not enforced","severity":"high","requires":["stack.framework == django","stage == production","is_public == true"],"tier":1,"check":"SECURE_SSL_REDIRECT absent or False","category":"framework-django"},{"id":"DJ-008","title":"Session and CSRF cookies not marked secure","severity":"high","requires":["stack.framework == django","has_accounts == true","stage == production"],"tier":1,"check":"SESSION_COOKIE_SECURE or CSRF_COOKIE_SECURE missing or False","note":"without these the cookies travel over plain HTTP on the first request.","category":"framework-django"},{"id":"DJ-009","title":"HSTS not configured","severity":"medium","requires":["stack.framework == django","stage == production","is_public == true"],"tier":1,"check":"SECURE_HSTS_SECONDS is 0 or unset","category":"framework-django"},{"id":"DJ-010","title":"ModelForm or serializer exposes every field","severity":"critical","requires":["stack.framework == django"],"tier":1,"check":"fields = '__all__' on a ModelForm or ModelSerializer","note":"Django's own mass-assignment shape. Every column becomes writable from the request, including is_staff, is_superuser and any balance you keep on the model.","fix":"List the fields you actually accept.","category":"framework-django"},{"id":"DJ-011","tier":2,"severity":"critical","requires":["stack.framework == django","has_accounts == true"]},{"id":"DJ-012","title":"Password validators removed","severity":"medium","requires":["stack.framework == django","has_accounts == true"],"tier":1,"check":"AUTH_PASSWORD_VALIDATORS is an empty list","category":"framework-django"},{"id":"DJ-013","title":"Clickjacking protection disabled","severity":"medium","requires":["stack.framework == django","is_public == true"],"tier":1,"check":"XFrameOptionsMiddleware absent, or X_FRAME_OPTIONS set to ALLOWALL","category":"framework-django"},{"id":"DJ-014","title":"Sessions serialised with pickle","severity":"critical","requires":["stack.framework == django"],"tier":1,"check":"SESSION_SERIALIZER set to PickleSerializer","note":"combined with a leaked SECRET_KEY this is remote code execution, not just session forgery.","category":"framework-django"},{"id":"DJ-015","tier":2,"severity":"critical","requires":["stack.framework == django","has_accounts == true"]},{"id":"DJ-016","title":"DEBUG toolbar or dev-only app installed in production","severity":"high","requires":["stack.framework == django","stage == production"],"tier":1,"check":"debug_toolbar, django_extensions or silk present in production INSTALLED_APPS","category":"framework-django"},{"id":"DJ-017","tier":2,"severity":"medium","requires":["stack.framework == django","has_file_uploads == true","stage == production"]},{"id":"DJ-018","tier":2,"severity":"high","requires":["stack.framework == django","has_accounts == true","is_public == true"]},{"id":"RB-001","title":"secret_key_base committed to the repository","severity":"critical","requires":["stack.framework == rails"],"tier":1,"check":"a literal secret_key_base in config/secrets.yml, credentials.yml or an initializer","note":"signs every session cookie. With it, anyone mints a session for any user — and Rails historically deserialised session data, so it has meant RCE.","fix":"Use encrypted credentials or ENV, and rotate the exposed key.","category":"framework-rails"},{"id":"RB-002","title":"config.force_ssl not enabled in production","severity":"high","requires":["stack.framework == rails","stage == production","is_public == true"],"tier":1,"check":"config.force_ssl absent or false in config/environments/production.rb","note":"one line, and it enables the redirect, secure cookies and HSTS together.","category":"framework-rails"},{"id":"RB-003","title":"CSRF protection disabled or skipped","severity":"critical","requires":["stack.framework == rails","has_accounts == true"],"tier":1,"check":"skip_before_action :verify_authenticity_token, or protect_from_forgery with: :null_session on a state-changing controller","category":"framework-rails"},{"id":"RB-004","title":"html_safe or raw applied to user content","severity":"critical","requires":["stack.framework == rails"],"tier":1,"check":".html_safe or raw() on a value derived from params, or <%== in an ERB template","note":"ERB escapes by default. These are the ways to turn that off.","category":"framework-rails"},{"id":"RB-005","title":"SQL built by string interpolation","severity":"critical","requires":["stack.framework == rails"],"tier":1,"check":"where(\"… #{…}\"), find_by_sql or order() containing interpolation","fix":"where('email = ?', email) — the placeholder form.","category":"framework-rails"},{"id":"RB-006","title":"Strong parameters bypassed with permit!","severity":"critical","requires":["stack.framework == rails"],"tier":1,"check":"params.permit! or params.require(:x).permit!","note":"permit! whitelists everything the caller sent. Rails added strong parameters precisely because of the GitHub mass-assignment incident.","category":"framework-rails"},{"id":"RB-007","tier":2,"severity":"critical","requires":["stack.framework == rails","has_accounts == true"]},{"id":"RB-008","title":"Unsafe deserialisation of user input","severity":"critical","requires":["stack.framework == rails"],"tier":1,"check":"Marshal.load, YAML.load or Oj.load applied to request data","note":"each of these instantiates arbitrary Ruby objects. Use YAML.safe_load.","category":"framework-rails"},{"id":"RB-009","title":"File served from a user-supplied path","severity":"critical","requires":["stack.framework == rails"],"tier":1,"check":"send_file or render file: built from params","note":"../../config/master.key is a valid filename as far as the filesystem cares.","category":"framework-rails"},{"id":"RB-010","tier":2,"severity":"critical","requires":["stack.framework == rails","has_accounts == true"]},{"id":"RB-011","title":"Sensitive parameters not filtered from logs","severity":"high","requires":["stack.framework == rails","has_accounts == true"],"tier":1,"check":"config.filter_parameters omits password, token or secret","note":"otherwise plaintext passwords are written into production logs on every sign-in, and logs are backed up, shipped and searched.","category":"framework-rails"},{"id":"RB-012","title":"Detailed exception pages enabled in production","severity":"high","requires":["stack.framework == rails","stage == production"],"tier":1,"check":"config.consider_all_requests_local = true in production.rb","note":"turns every 500 into a stack trace with source and local variables.","category":"framework-rails"},{"id":"RB-013","tier":2,"severity":"high","requires":["stack.framework == rails"]},{"id":"RB-014","title":"Devise configured without lockable or timeout","severity":"medium","requires":["stack.framework == rails","stack.auth == devise","is_public == true"],"tier":1,"check":"devise model lacks :lockable, or Devise.timeout_in is unset","note":"Devise ships neither brute-force lockout nor session expiry enabled.","category":"framework-rails"},{"id":"RB-015","tier":2,"severity":"medium","requires":["stack.framework == rails","has_background_jobs == true"]}]}