penthera 1.1.0

package/docs/owasp-wstg-coverage.md

@@ -0,0 +1,79 @@
+# OWASP WSTG coverage map
+
+Penthera maps its probes to the [OWASP Web Security Testing Guide (WSTG) v4.2](https://owasp.org/www-project-web-security-testing-guide/). This document is the canonical reference; scan reports include a summary table generated from `lib/owasp-wstg.js`.
+
+## Coverage by profile
+
+| Profile | Penthera probes | WSTG areas | Destructive payloads |
+|---------|-----------------|------------|----------------------|
+| **quick** | Headers, OpenAPI, auth smoke | INFO, CONF, ATHN | No |
+| **standard** | Full non-destructive black-box + repo | INFO, CONF, CRYP, ATHN, ATHZ, SESS, CLNT | No |
+| **deep** | standard + recon + injections + fuzz | All above + INPV, BUSL | Yes |
+
+## Probe → WSTG mapping
+
+| Penthera probe | WSTG IDs | Profiles | Mode |
+|----------------|----------|----------|------|
+| Reachability & fingerprint | WSTG-INFO-02, WSTG-INFO-04 | quick, standard, deep | URL |
+| Endpoint discovery | WSTG-INFO-06, WSTG-INFO-07 | standard, deep | URL |
+| TLS / certificate audit | WSTG-CRYP-01, WSTG-CRYP-02 | standard, deep | URL |
+| Security headers | WSTG-CONF-12, WSTG-CONF-13, WSTG-CONF-14 | quick, standard, deep | URL |
+| OpenAPI / Swagger exposure | WSTG-INFO-09, WSTG-CONF-02 | quick, standard, deep | URL |
+| Sensitive file templates | WSTG-CONF-02, WSTG-CONF-04 | standard, deep | URL |
+| CORS validation | WSTG-CLNT-07 | standard, deep | URL |
+| Cookie security | WSTG-SESS-02 | standard, deep | URL |
+| Auth endpoint hardening | WSTG-ATHN-03, WSTG-ATHN-10 | quick, standard, deep | URL |
+| Client-side-only auth | WSTG-ATHZ-02, WSTG-CLNT-01 | standard, deep | URL |
+| JWT probes | WSTG-ATHN-04, WSTG-SESS-10 | standard, deep | URL |
+| IDOR / BOLA | WSTG-ATHZ-04, WSTG-ATHZ-05 | standard, deep | URL |
+| OAuth open redirect | WSTG-ATHN-11, WSTG-CLNT-04 | standard, deep | URL |
+| Retire.js (JS CVEs) | WSTG-CONF-04, WSTG-CLNT-02 | standard, deep | URL |
+| Parameter discovery | WSTG-INFO-06 | standard, deep | URL |
+| OSINT recon | WSTG-INFO-01, WSTG-INFO-07 | deep | URL |
+| SQL injection | WSTG-INPV-05 | deep | URL |
+| SSTI | WSTG-INPV-18 | deep | URL |
+| SSRF | WSTG-INPV-19 | deep | URL |
+| Reflected XSS | WSTG-INPV-01, WSTG-CLNT-01 | deep | URL |
+| Command injection | WSTG-INPV-12 | deep | URL |
+| Open redirect (injection suite) | WSTG-CLNT-04 | deep | URL |
+| API fuzzing | WSTG-INPV-11, WSTG-BUSL-05 | deep | URL |
+| Secret scanning | WSTG-CONF-02, WSTG-CONF-05 | quick, standard, deep | Repo |
+| Route / trust-boundary analysis | WSTG-ATHZ-02, WSTG-CONF-02 | quick, standard, deep | Repo |
+| Risky code patterns | WSTG-INPV-01, WSTG-INPV-12 | standard, deep | Repo |
+
+## WSTG categories not covered (yet)
+
+Penthera does **not** currently automate these WSTG areas:
+
+| Category | Examples | Planned |
+|----------|----------|---------|
+| WSTG-IDNT | Registration, username policy | v0.4 |
+| WSTG-ERRH | Verbose stack traces in all contexts | Partial (template scans) |
+| WSTG-BUSL | Full business-logic workflows | Partial (fuzz only) |
+| WSTG-APIT | GraphQL-specific tests | v0.4 |
+| Manual / social | Phishing, physical access | Out of scope |
+
+## Finding category → WSTG
+
+When a finding is reported, Penthera tags it with relevant WSTG IDs in JSON (`finding.wstg[]`), SARIF (`properties.tags`), and Markdown reports.
+
+| Finding category | WSTG IDs |
+|------------------|----------|
+| `tls` | WSTG-CRYP-01, WSTG-CRYP-02 |
+| `exposure` | WSTG-CONF-02, WSTG-CONF-04 |
+| `cors` | WSTG-CLNT-07 |
+| `cookie` | WSTG-SESS-02 |
+| `auth` | WSTG-ATHN-03, WSTG-ATHN-04 |
+| `secrets` | WSTG-CONF-02, WSTG-CONF-05 |
+| `sqli` | WSTG-INPV-05 |
+| `xss` | WSTG-INPV-01, WSTG-CLNT-01 |
+| `ssrf` | WSTG-INPV-19 |
+| `cmdi` | WSTG-INPV-12 |
+| `open-redirect` | WSTG-CLNT-04, WSTG-ATHN-11 |
+| `rate-limiting` | WSTG-ATHN-10 |
+
+## References
+
+- [OWASP WSTG on GitHub](https://github.com/OWASP/wstg)
+- Penthera implementation: `lib/owasp-wstg.js`
+- Report integration: `src/report/markdown.js`, `src/reporter.js`

package/lib/adaptive-probes.js

@@ -0,0 +1,334 @@
+/**
+ * Adaptive Probe Engine (Portable)
+ *
+ * Multi-step probes that escalate based on results:
+ *   Observe → Hypothesize → Test → Analyze → Repeat
+ *
+ * Each probe chain starts with a hypothesis and adapts.
+ * Results feed into the SecurityKnowledgeGraph for chain discovery.
+ */
+
+const DEFAULT_TIMEOUT = 10_000;
+
+async function probe(base, path, opts = {}) {
+  const url = `${base}${path}`;
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), opts.timeout || DEFAULT_TIMEOUT);
+  const start = Date.now();
+  try {
+    const res = await fetch(url, { ...opts, signal: controller.signal });
+    const elapsed = Date.now() - start;
+    let body = null;
+    const ct = res.headers.get("content-type") || "";
+    if (ct.includes("json")) {
+      try { body = await res.json(); } catch { body = null; }
+    } else {
+      try { body = await res.text(); } catch { body = null; }
+    }
+    return {
+      url: path, status: res.status,
+      headers: Object.fromEntries(res.headers.entries()),
+      body, elapsed, ok: res.ok,
+    };
+  } catch (err) {
+    return {
+      url: path, status: 0, headers: {}, body: null,
+      elapsed: Date.now() - start, ok: false,
+      error: err.name === "AbortError" ? "timeout" : err.message,
+    };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+/**
+ * Chain 1: Auth Escalation, tries increasingly privileged access
+ */
+export async function probeAuthEscalation(base, route, graph) {
+  const findings = [];
+  const url = route.url.replace(/:(\w+)/g, "test-$1");
+
+  // Step 1: No auth
+  const noAuth = await probe(base, url, {
+    method: route.methods[0] === "GET" ? "GET" : "POST",
+    ...(route.methods[0] !== "GET" ? {
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({}),
+    } : {}),
+  });
+  graph.addProbeResult({ probe: "auth-escalation", step: "no-auth", ...noAuth });
+
+  if (noAuth.status === 200 && !route.auth.includes("public")) {
+    findings.push(graph.addFinding({
+      severity: "critical", category: "auth-bypass",
+      title: `Unauthenticated access to ${url}`,
+      detail: `Expected 401 for ${route.auth.join("+")} route, got 200`,
+      routeUrl: route.url, probeData: noAuth,
+    }));
+    return findings;
+  }
+
+  // Step 2: Fake Bearer token
+  const fakeAuth = await probe(base, url, {
+    method: route.methods[0] === "GET" ? "GET" : "POST",
+    headers: { "Content-Type": "application/json", Authorization: "Bearer fake-token-AAAA" },
+    ...(route.methods[0] !== "GET" ? { body: JSON.stringify({}) } : {}),
+  });
+  graph.addProbeResult({ probe: "auth-escalation", step: "fake-bearer", ...fakeAuth });
+
+  if (fakeAuth.status === 200 && !route.auth.includes("public")) {
+    findings.push(graph.addFinding({
+      severity: "critical", category: "auth-bypass",
+      title: `Fake Bearer token accepted on ${url}`,
+      detail: `Route accepted an arbitrary Bearer token`,
+      routeUrl: route.url, probeData: fakeAuth,
+    }));
+  }
+
+  // Step 3: CVE-2025-29927 middleware bypass (admin routes)
+  if (route.auth.includes("admin")) {
+    const cveBypass = await probe(base, url, {
+      method: route.methods[0] === "GET" ? "GET" : "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "x-middleware-subrequest": "middleware:middleware:middleware:middleware:middleware",
+      },
+      ...(route.methods[0] !== "GET" ? { body: JSON.stringify({}) } : {}),
+    });
+    graph.addProbeResult({ probe: "auth-escalation", step: "cve-2025-29927", ...cveBypass });
+
+    if (cveBypass.status === 200) {
+      findings.push(graph.addFinding({
+        severity: "critical", category: "auth-bypass",
+        title: `CVE-2025-29927 middleware bypass on ${url}`,
+        detail: `x-middleware-subrequest header bypassed auth`,
+        routeUrl: route.url, probeData: cveBypass,
+      }));
+    }
+  }
+
+  // Step 4: Common secret guesses (cron routes)
+  if (route.auth.includes("cron")) {
+    for (const guess of ["secret", "password", "cron", "Bearer cron", ""]) {
+      const secretProbe = await probe(base, url, {
+        method: "GET", headers: { Authorization: `Bearer ${guess}` },
+      });
+      if (secretProbe.status === 200) {
+        findings.push(graph.addFinding({
+          severity: "high", category: "auth-bypass",
+          title: `Weak CRON_SECRET on ${url}`,
+          detail: `Guessed secret: "${guess}"`,
+          routeUrl: route.url, probeData: secretProbe,
+        }));
+        break;
+      }
+    }
+  }
+
+  return findings;
+}
+
+/**
+ * Chain 2: HTTP Method Confusion
+ */
+export async function probeMethodConfusion(base, route, graph) {
+  const findings = [];
+  const url = route.url.replace(/:(\w+)/g, "test-$1");
+  const unexpected = ["GET", "POST", "PUT", "DELETE", "PATCH"].filter(m => !route.methods.includes(m));
+
+  for (const method of unexpected) {
+    const res = await probe(base, url, {
+      method,
+      headers: { "Content-Type": "application/json", Authorization: "Bearer test-token" },
+      ...(["POST", "PUT", "PATCH"].includes(method) ? { body: JSON.stringify({}) } : {}),
+    });
+    graph.addProbeResult({ probe: "method-confusion", method, ...res });
+
+    if (res.status === 200) {
+      findings.push(graph.addFinding({
+        severity: "low", category: "method-confusion",
+        title: `Unexpected ${method} accepted on ${url}`,
+        detail: `Route exports ${route.methods.join(",")} but accepted ${method}`,
+        routeUrl: route.url, probeData: res,
+      }));
+    }
+  }
+  return findings;
+}
+
+/**
+ * Chain 3: Prototype Pollution
+ */
+export async function probePrototypePollution(base, route, graph) {
+  const findings = [];
+  if (!route.methods.includes("POST")) return findings;
+  const url = route.url.replace(/:(\w+)/g, "test-$1");
+
+  for (const payload of [
+    { "__proto__": { "isAdmin": true } },
+    { "constructor": { "prototype": { "isAdmin": true } } },
+    { "__proto__": { "role": "admin" } },
+  ]) {
+    const res = await probe(base, url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: "Bearer test-token" },
+      body: JSON.stringify(payload),
+    });
+    graph.addProbeResult({ probe: "prototype-pollution", payload: Object.keys(payload)[0], ...res });
+
+    if (res.status === 200 && res.body?.isAdmin) {
+      findings.push(graph.addFinding({
+        severity: "critical", category: "injection",
+        title: `Prototype pollution on ${url}`,
+        detail: `__proto__ payload resulted in isAdmin:true`,
+        routeUrl: route.url, probeData: res,
+      }));
+    }
+  }
+  return findings;
+}
+
+/**
+ * Chain 4: Information Leakage
+ */
+export async function probeInfoLeakage(base, route, graph) {
+  const findings = [];
+  const url = route.url.replace(/:(\w+)/g, "test-$1");
+
+  const triggers = [
+    { body: "not-json", contentType: "application/json" },
+    { body: JSON.stringify({ __invalid: true }), contentType: "application/json" },
+    { body: "", contentType: "application/json" },
+  ];
+
+  for (const trigger of triggers) {
+    const res = await probe(base, url, {
+      method: route.methods.includes("POST") ? "POST" : "GET",
+      headers: { "Content-Type": trigger.contentType, Authorization: "Bearer trigger-error-token" },
+      ...(route.methods.includes("POST") ? { body: trigger.body } : {}),
+    });
+
+    if (res.status >= 400 && typeof res.body === "string") {
+      for (const { pattern, name } of [
+        { pattern: /at\s+\w+\s+\(.*\.js:\d+:\d+\)/, name: "stack-trace" },
+        { pattern: /node_modules/, name: "dependency-path" },
+        { pattern: /\/Users\/|\/home\/|\/var\//, name: "filesystem-path" },
+        { pattern: /FIREBASE_|GOOGLE_|STRIPE_|OPENAI_|DATABASE_/, name: "env-var-name" },
+        { pattern: /192\.168\.|10\.\d+\.|172\.(?:1[6-9]|2\d|3[01])\./, name: "internal-ip" },
+      ]) {
+        if (pattern.test(res.body)) {
+          findings.push(graph.addFinding({
+            severity: name === "stack-trace" || name === "env-var-name" ? "medium" : "low",
+            category: "info-leak",
+            title: `${name} leaked on ${url}`,
+            detail: `Error response contains ${name} pattern`,
+            routeUrl: route.url, probeData: { status: res.status },
+          }));
+          break;
+        }
+      }
+    }
+  }
+  return findings;
+}
+
+/**
+ * Chain 5: CORS Probe
+ */
+export async function probeCors(base, route, graph) {
+  const findings = [];
+  const url = route.url.replace(/:(\w+)/g, "test-$1");
+
+  for (const origin of [
+    "https://evil-attacker.com", "null",
+    "https://your-app.evil.com", "https://your-app-typo.com",
+  ]) {
+    const res = await probe(base, url, {
+      method: "OPTIONS",
+      headers: { Origin: origin, "Access-Control-Request-Method": "POST" },
+    });
+    const acao = res.headers["access-control-allow-origin"];
+    if (acao === origin) {
+      findings.push(graph.addFinding({
+        severity: origin === "null" ? "high" : "medium",
+        category: "cors-misconfiguration",
+        title: `CORS reflects evil origin on ${url}`,
+        detail: `Origin "${origin}" reflected`,
+        routeUrl: route.url, probeData: { origin, reflected: acao },
+      }));
+    }
+    if (acao === "*") {
+      findings.push(graph.addFinding({
+        severity: "medium", category: "cors-misconfiguration",
+        title: `CORS wildcard on ${url}`,
+        detail: `Access-Control-Allow-Origin: *`,
+        routeUrl: route.url, probeData: { origin, reflected: acao },
+      }));
+    }
+  }
+  return findings;
+}
+
+/**
+ * Chain 6: Content-Type Confusion
+ */
+export async function probeContentTypeConfusion(base, route, graph) {
+  const findings = [];
+  if (!route.methods.includes("POST")) return findings;
+  const url = route.url.replace(/:(\w+)/g, "test-$1");
+
+  for (const { ct, body } of [
+    { ct: "application/xml", body: '<?xml version="1.0"?><root><evil>true</evil></root>' },
+    { ct: "application/x-www-form-urlencoded", body: "email=test@test.com&admin=true" },
+  ]) {
+    const res = await probe(base, url, {
+      method: "POST",
+      headers: { "Content-Type": ct, Authorization: "Bearer test-token" },
+      body,
+    });
+    graph.addProbeResult({ probe: "content-type-confusion", contentType: ct, ...res });
+
+    if (res.status === 200) {
+      findings.push(graph.addFinding({
+        severity: "low", category: "content-type-confusion",
+        title: `Unexpected Content-Type accepted on ${url}`,
+        detail: `Sent ${ct} but got 200`,
+        routeUrl: route.url, probeData: res,
+      }));
+    }
+  }
+  return findings;
+}
+
+/**
+ * Chain 7: Timing Analysis
+ */
+export async function probeTimingAnalysis(base, route, graph) {
+  const findings = [];
+  const url = route.url.replace(/:(\w+)/g, "test-$1");
+
+  const timings = [];
+  for (let i = 0; i < 5; i++) {
+    const res = await probe(base, url, {
+      method: route.methods[0] === "GET" ? "GET" : "POST",
+      headers: { "Content-Type": "application/json", Authorization: "Bearer timing-test-token" },
+      ...(route.methods[0] !== "GET" ? { body: JSON.stringify({}) } : {}),
+    });
+    timings.push(res.elapsed);
+  }
+
+  const avg = timings.reduce((a, b) => a + b, 0) / timings.length;
+  const variance = Math.sqrt(timings.reduce((sum, t) => sum + (t - avg) ** 2, 0) / timings.length);
+
+  graph.addProbeResult({ probe: "timing-analysis", url: route.url, avgMs: Math.round(avg), varianceMs: Math.round(variance) });
+
+  if (variance > 100 && route.auth.includes("cron")) {
+    findings.push(graph.addFinding({
+      severity: "info", category: "timing",
+      title: `High timing variance on ${url}`,
+      detail: `avg=${Math.round(avg)}ms variance=${Math.round(variance)}ms`,
+      routeUrl: route.url,
+    }));
+  }
+  return findings;
+}

package/lib/attack-surface.js

@@ -0,0 +1,149 @@
+/**
+ * Attack Surface Discovery (Portable)
+ *
+ * Auto-discovers API routes from the filesystem for Next.js App Router projects.
+ * Classifies auth patterns, input types, data flows, and security patterns.
+ *
+ * Set API_ROOT_PATH in pentest.config.js to your app/api directory.
+ */
+import { readdirSync, readFileSync, statSync, existsSync } from "fs";
+import { join, relative } from "path";
+
+/** Recursively find all route.js/ts files under a directory */
+function findRouteFiles(dir, files = []) {
+  if (!existsSync(dir)) return files;
+  for (const entry of readdirSync(dir)) {
+    const full = join(dir, entry);
+    if (statSync(full).isDirectory()) {
+      findRouteFiles(full, files);
+    } else if (entry === "route.js" || entry === "route.ts") {
+      files.push(full);
+    }
+  }
+  return files;
+}
+
+/** Convert filesystem path to URL path */
+function pathToUrl(filePath, apiRoot) {
+  const rel = relative(apiRoot, filePath).replace(/\/route\.(js|ts)$/, "");
+  return "/api/" + rel.replace(/\[([^\]]+)\]/g, ":$1");
+}
+
+/** Extract exported HTTP methods from source */
+function extractMethods(source) {
+  const methods = [];
+  if (/export\s+(async\s+)?function\s+GET/m.test(source)) methods.push("GET");
+  if (/export\s+(async\s+)?function\s+POST/m.test(source)) methods.push("POST");
+  if (/export\s+(async\s+)?function\s+PUT/m.test(source)) methods.push("PUT");
+  if (/export\s+(async\s+)?function\s+DELETE/m.test(source)) methods.push("DELETE");
+  if (/export\s+(async\s+)?function\s+PATCH/m.test(source)) methods.push("PATCH");
+  if (/export\s+(async\s+)?function\s+OPTIONS/m.test(source)) methods.push("OPTIONS");
+  return methods;
+}
+
+/** Classify the auth mechanism from source code patterns */
+function classifyAuth(source) {
+  const auth = [];
+  // Common auth function names, extend for your framework
+  if (/verifyAdmin|isAdmin|requireAdmin|adminAuth/.test(source)) auth.push("admin");
+  if (/verifyUser|requireAuth|getSession|getServerSession|verifyIdToken|getAdminAuth/.test(source)) {
+    if (!auth.includes("admin")) auth.push("user");
+  }
+  if (/CRON_SECRET|cronSecret|verifyCron/.test(source)) auth.push("cron");
+  if (/throttle|rateLimit|rateLimiter/.test(source)) auth.push("rate-limited");
+  if (/NODE_ENV\s*!==\s*["']development["']|NODE_ENV\s*===\s*["']development["']/.test(source)) {
+    auth.push("dev-only");
+  }
+  if (auth.length === 0) auth.push("public");
+  return auth;
+}
+
+/** Detect user-controlled input fields */
+function detectInputs(source) {
+  const inputs = [];
+  const bodyMatch = source.match(/(?:const|let)\s*\{([^}]+)\}\s*=\s*await\s+(?:req|request)\.json/);
+  if (bodyMatch) {
+    inputs.push(...bodyMatch[1].split(",").map(s => s.trim().split("=")[0].trim()).filter(Boolean));
+  }
+  const paramMatches = source.matchAll(/params\.(\w+)/g);
+  for (const m of paramMatches) inputs.push(`param:${m[1]}`);
+  const queryMatches = source.matchAll(/searchParams\.get\(["'](\w+)["']\)/g);
+  for (const m of queryMatches) inputs.push(`query:${m[1]}`);
+  return [...new Set(inputs)];
+}
+
+/** Detect external services called */
+function detectExternalCalls(source) {
+  const calls = [];
+  if (/replicate\.com|REPLICATE_API_TOKEN/.test(source)) calls.push("replicate");
+  if (/stripe\.|STRIPE_/.test(source)) calls.push("stripe");
+  if (/GoogleGenAI|GEMINI_API_KEY|gemini|openai|OPENAI_/.test(source)) calls.push("ai-api");
+  if (/pinterest\.com|Pinterest/.test(source)) calls.push("pinterest");
+  if (/Resend|RESEND_API_KEY|sendgrid|SENDGRID/.test(source)) calls.push("email-service");
+  if (/firebaseAdmin|getAdminFirestore|prisma|mongoose/.test(source)) calls.push("database");
+  if (/getAdminAuth/.test(source)) calls.push("auth-service");
+  return calls;
+}
+
+/** Detect security-relevant patterns */
+function detectSecurityPatterns(source) {
+  const patterns = [];
+  if (/escapeHtml|sanitize|DOMPurify/.test(source)) patterns.push("html-escaped");
+  if (/timingSafeEqual|safeCompare/.test(source)) patterns.push("timing-safe");
+  if (/runTransaction|BEGIN.*COMMIT/.test(source)) patterns.push("transactional");
+  if (/isAllowedImageUrl|urlAllowlist/.test(source)) patterns.push("url-allowlist");
+  if (/err\.message|error\.message/.test(source)) patterns.push("RISK:error-leak");
+  if (/origin\s*\|\|\s*"\*"/.test(source)) patterns.push("RISK:cors-wildcard");
+  if (/JSON\.parse/.test(source) && !/\.catch/.test(source)) patterns.push("RISK:json-parse-unguarded");
+  if (/eval\s*\(/.test(source)) patterns.push("RISK:eval");
+  if (/innerHTML/.test(source)) patterns.push("RISK:innerHTML");
+  if (/exec\s*\(|spawn\s*\(|execSync/.test(source)) patterns.push("RISK:command-injection");
+  return patterns;
+}
+
+/**
+ * Discover the full attack surface from the filesystem.
+ * @param {string} apiRoot - Path to app/api directory
+ */
+export function discoverAttackSurface(apiRoot) {
+  if (!apiRoot || !existsSync(apiRoot)) {
+    console.warn(`[PENTEST] API_ROOT_PATH not found: ${apiRoot}, skipping filesystem discovery`);
+    return [];
+  }
+  const routeFiles = findRouteFiles(apiRoot);
+  return routeFiles.map((filePath) => {
+    const source = readFileSync(filePath, "utf-8");
+    const url = pathToUrl(filePath, apiRoot);
+    return {
+      url,
+      filePath: relative(join(apiRoot, "../.."), filePath),
+      methods: extractMethods(source),
+      auth: classifyAuth(source),
+      inputs: detectInputs(source),
+      externalCalls: detectExternalCalls(source),
+      securityPatterns: detectSecurityPatterns(source),
+      hasParams: url.includes(":"),
+      sourceLength: source.length,
+    };
+  }).sort((a, b) => a.url.localeCompare(b.url));
+}
+
+/**
+ * Group routes by trust boundary.
+ */
+export function groupByTrustBoundary(routes) {
+  return {
+    public: routes.filter(r => r.auth.includes("public")),
+    userAuth: routes.filter(r => r.auth.includes("user") && !r.auth.includes("admin")),
+    adminAuth: routes.filter(r => r.auth.includes("admin")),
+    cronAuth: routes.filter(r => r.auth.includes("cron") && !r.auth.includes("admin")),
+    mixed: routes.filter(r => r.auth.length > 1 && !r.auth.includes("public")),
+  };
+}
+
+/**
+ * Find routes with security risk patterns.
+ */
+export function findRiskyRoutes(routes) {
+  return routes.filter(r => r.securityPatterns.some(p => p.startsWith("RISK:")));
+}