security-mcp 1.1.3 → 1.3.1

package/README.md

@@ -17,15 +17,13 @@ Works with **Claude Code, GitHub Copilot, Cursor, Codex, Replit**, and any MCP-c
 
 ## Table of Contents
 
+- [What's New in v1.3.0](#whats-new-in-v130)
 - [What Problem Does This Solve?](#what-problem-does-this-solve)
 - [Who Is This For?](#who-is-this-for)
 - [Two Modes - Pick Your Depth](#two-modes---pick-your-depth)
 - [Quick Start - Install in 60 Seconds](#quick-start---install-in-60-seconds)
-- [Step-by-Step Installation Guide](#step-by-step-installation-guide)
-  - [Claude Code](#step-by-step-claude-code)
-  - [Cursor](#step-by-step-cursor)
-  - [VS Code / GitHub Copilot](#step-by-step-vs-code--github-copilot)
-  - [Manual Configuration](#manual-configuration-any-mcp-editor)
+- [Installation](#installation)
+- [Verify Your Installation](#verify-your-installation)
 - [How to Run Your First Security Review](#how-to-run-your-first-security-review)
 - [CI/CD Security Gate](#cicd-security-gate)
 - [What Gets Fixed Automatically](#what-gets-fixed-automatically)
@@ -40,6 +38,117 @@ Works with **Claude Code, GitHub Copilot, Cursor, Codex, Replit**, and any MCP-c
 
 ---
 
+## What's New in v1.3.0
+
+v1.3.0 delivers **104 new blindspot detection checks** across 7 threat domains, discovered by running a full 8-agent CISO Orchestrator pass followed by an adversarial pentest verification round. It also closes 5 critical security vulnerabilities in the gate engine itself.
+
+### 42 Deep Injection Patterns (was 15)
+
+`checkInjectionDeep` now covers 42 detection patterns:
+
+| Added in v1.3.0 | ATT&CK | What It Catches |
+| --- | --- | --- |
+| **SSTI (Java/PHP)** | T1059 | FreeMarker, Thymeleaf, Velocity, Twig, Smarty template injection |
+| **SpEL / OGNL injection** | T1059 | Spring Expression Language and OGNL via user-controlled string eval |
+| **Pickle / Java deserialization** | T1059.001 | Unsafe `pickle.loads`, `ObjectInputStream`, `readObject` on untrusted data |
+| **Second-order injection** | T1059 | Data stored to DB then later executed — two-pass file-correlation check |
+| **CSS injection** | T1059 | User content reflected inside `<style>` or `style=` without sanitization |
+| **Elasticsearch injection** | T1059 | Dynamic query construction in Elasticsearch DSL with user input |
+| **WebSocket injection** | T1059 | User-controlled data in `ws.send()` without validation |
+| **SSE-CRLF** | T1059 | CRLF in Server-Sent Events `data:` field hijacking the SSE stream |
+| **PDF / document injection** | T1059 | User input in PDF field generation without escaping |
+| **HTTP response splitting** | T1059 | CRLF in HTTP header values |
+| **Bracket-notation prototype pollution** | T1203 | `obj[key] = value` with user-controlled keys |
+
+Plus all original patterns: XXE, SSTI multiline, LDAP, XPath, JNDI/Log4Shell, MongoDB `$where`, prototype pollution, CRLF, unsafe YAML, deserialization, path traversal, log injection, SSRF, command injection, ReDoS, SQL/ORM (Prisma, Sequelize, Knex, TypeORM), Redis `EVAL`, HTTP header injection.
+
+### 43 Deep Auth Patterns (was 16)
+
+`checkAuthDeep` now covers 43 detection patterns:
+
+| Added in v1.3.0 | CWE | What It Catches |
+| --- | --- | --- |
+| **JWT `kid` injection** | CWE-20 | `kid` header used as file path or SQL expression for key material |
+| **JWKS URI override** | CWE-20 | Attacker-controlled `jku` / `x5u` headers pointing to external key stores |
+| **OAuth client secret in repo** | CWE-798 | `client_secret` literals or env defaults checked into source |
+| **Session token in URL** | CWE-598 | Session IDs in query parameters — logged by every proxy |
+| **Low-entropy token** | CWE-330 | Token / secret generated with `Math.random()` or timestamp-seeded RNG |
+| **Remember-me no rotation** | CWE-613 | Persistent login tokens never rotated on use |
+| **Password reset single-use** | CWE-640 | Reset tokens reusable after initial redemption |
+| **Account enumeration** | CWE-204 | Different error messages for valid vs. invalid usernames |
+| **Bcrypt cost factor** | CWE-916 | `bcrypt.hash(pw, N)` where N < 12 |
+
+Plus all original patterns: JWT alg:none/HS-RS confusion, session fixation, OAuth state/redirect_uri/PKCE, hardcoded JWT secret, rate limit on auth, plaintext password compare, SAML signature bypass, insecure cookie flags, refresh token rotation, API key in URL, reset token expiry, admin route without authz, timing oracle.
+
+### 31 Business Logic Patterns (was 8)
+
+`checkBusinessLogic` now catches 31 patterns including 13 new e-commerce and payment abuse vectors:
+
+- **Currency confusion** — mixed-currency arithmetic without normalization
+- **Discount stacking** — coupon codes combined with promotions without stack limits
+- **Order fulfillment bypass** — status transitions that skip required payment/verification steps
+- **Webhook timestamp** — missing replay-window check on webhook signature verification
+- **Tax / shipping parameter tamper** — client-supplied tax and shipping totals accepted server-side
+- **Client-side total** — final order amount derived from a browser-supplied value
+- **Referral abuse** — self-referral detection absent from referral credit logic
+- **Email normalization** — `user+tag@domain.com` not normalized when enforcing unique accounts
+- **Feature flag bypass** — feature flags controllable via client-supplied headers or query params
+- **API version bypass** — security controls on v2 routes not enforced on legacy v1 endpoints
+- **Double-spend payment** — concurrent payment requests without idempotency key enforcement
+- **Free trial abuse** — trial period enforced only by client-supplied start date
+- **Pagination abuse** — unlimited page size parameter enabling full-table data dump
+
+### 32 Supply Chain Deep Patterns (was 16)
+
+`checkSupplyChainDeep` now covers 32 patterns. New additions detect obfuscated payloads, malicious package scripts, and exfiltration channels that bypass standard SAST tools — including keyloggers, reverse shells, cryptomining signatures, DNS exfiltration, clipboard monitoring, and more.
+
+### Critical Security Fixes
+
+| ID | Severity | Fix |
+| --- | --- | --- |
+| **VULN-001** | CRITICAL | Dead multiline regex in `checkSecondOrderInjection` silently nulled the entire injection-deep module — replaced with two-pass file-correlation |
+| **VULN-002** | HIGH | Symlink traversal in `policy.ts` glob calls — `followSymbolicLinks: false` enforced |
+| **VULN-003** | HIGH | Evidence previews leaked secret values — `redactSecrets()` added to `search.ts` |
+| **AUTH-OBO-01** | HIGH | Lockout off-by-one in `auth.ts` allowed 4 attempts instead of 3 |
+| **META-01/03/04** | MEDIUM | Prompt injection vectors in MCP server — `_notice` framing and `sanitizePromptParam()` added |
+
+### Also in v1.2.1
+
+- OWASP Top 10 now **10/10 covered** — A09 (Security Logging and Monitoring Failures) fully completed
+- NIST AU-11 / PCI Req 10 log retention detection added to `checkAuthDeep`
+- ISO 42001 §9.1 routing decision audit log added to model router
+- `runScanners` (gitleaks / semgrep / trivy / checkov / osv-scanner) wired into the gate — was implemented but never called since v1.0; now active check 27
+
+### Also in v1.2.0
+
+- **Secrets** — dotfiles glob, base64/hex decode pre-pass, 10 new token formats (Vercel, PlanetScale, Databricks, Linear, Railway, npmrc, HuggingFace, ARM, Twilio), gitleaks history scan, split-string heuristic
+- **Injection** — SQL/ORM detection (Prisma `$queryRaw`, Sequelize, Knex, TypeORM), JNDI/Log4Shell, LDAP, XPath, Redis `EVAL`, ReDoS static catastrophic-backtracking patterns
+- **Cryptography** — AES-CBC-without-HMAC (+ split-string evasion fix), GCM nonce reuse and timestamp IV, RSA PKCS#1v1.5, SHA-256-as-password-hash, hardcoded PBKDF2 salt, `rejectUnauthorized: false`, weak TLS min version
+- **Checklists** — all 6 surface checklists updated with `automated: true` entries for every new check ID
+
+### MCP Caller Authentication
+
+Protect the MCP server channel against rogue processes that obtain stdio access:
+
+```bash
+export SECURITY_MCP_SHARED_SECRET="$(openssl rand -hex 32)"
+```
+
+When set, every tool call is blocked until the AI agent calls `security.authenticate` with the matching token. Uses constant-time HMAC comparison (CWE-208), 3-strike lockout, and minimum 16-byte secret enforcement. Backwards-compatible — when unset, all tools are immediately available.
+
+### Policy HMAC Integrity Signing
+
+Prevent tampered policy files from silently disabling severity blocking:
+
+```bash
+export SECURITY_POLICY_HMAC_KEY="$(openssl rand -hex 32)"
+npx security-mcp sign-policy
+```
+
+When set, the gate rejects any policy file whose HMAC sidecar (`.hmac`) does not match — making it impossible to quietly change `severity_block: ["HIGH","CRITICAL"]` to `[]` without detection.
+
+---
+
 ## What Problem Does This Solve?
 
 When you use an AI coding assistant to build features fast, security is easy to skip - not because you don't care, but because:
@@ -120,169 +229,32 @@ For a full 39-agent deep audit:
 
 ---
 
-## Step-by-Step Installation Guide
-
-### Step-by-Step: Claude Code
-
-**Prerequisite:** Node.js 20+ installed. Check with `node --version`.
-
-**Step 1 - Run the installer:**
-
-```bash
-npx -y security-mcp@latest install --claude-code
-```
-
-This writes the MCP server config to `~/.claude/settings.json`.
-
-**Step 2 - Verify the config was written:**
-
-```bash
-cat ~/.claude/settings.json
-```
-
-You should see:
-
-```json
-{
-  "mcpServers": {
-    "security-mcp": {
-      "command": "npx",
-      "args": ["-y", "security-mcp@latest", "serve"]
-    }
-  }
-}
-```
-
-**Step 3 - Restart Claude Code** to pick up the new MCP server.
-
-**Step 4 - Verify the tools loaded.** In Claude Code, run:
-
-```text
-/mcp
-```
-
-You should see `security-mcp` listed as a connected server with `security.*`, `orchestration.*`, and `repo.*` tools available.
-
-**Step 5 - Run your first security review:**
-
-```text
-/senior-security-engineer
-```
-
-The agent will ask:
-
-- **A) Recent changes** - scans only what changed since your last commit (fastest, use daily)
-- **B) Full codebase** - scans everything (use for new projects or after major changes)
-- **C) Specific files or folders** - scans exactly what you specify
-
-Pick one and let it run.
-
----
-
-### Step-by-Step: Cursor
-
-**Step 1 - Run the installer:**
-
-```bash
-npx -y security-mcp@latest install --cursor
-```
-
-This writes to `~/.cursor/mcp.json`.
-
-**Step 2 - Verify:**
-
-```bash
-cat ~/.cursor/mcp.json
-```
-
-Expected output:
-
-```json
-{
-  "mcpServers": {
-    "security-mcp": {
-      "command": "npx",
-      "args": ["-y", "security-mcp@latest", "serve"]
-    }
-  }
-}
-```
-
-**Step 3 - Restart Cursor.**
+## Installation
 
-**Step 4 - Open Cursor's MCP panel** (Settings -> MCP) and confirm `security-mcp` shows as connected.
+> **Prerequisite:** Node.js 20+. Check with `node --version`.
 
-**Step 5 - In the Cursor AI chat, type:**
-
-```text
-Use /senior-security-engineer to review my recent changes
-```
-
----
-
-### Step-by-Step: VS Code / GitHub Copilot
-
-**Step 1 - Run the installer:**
+### One Command — Auto-detects Your Editor
 
 ```bash
-npx -y security-mcp@latest install --vscode
-```
-
-This writes to your VS Code user `settings.json`.
-
-**Step 2 - Verify in VS Code:**
-
-Open Command Palette (`Cmd+Shift+P` / `Ctrl+Shift+P`) -> `Preferences: Open User Settings (JSON)`.
-
-You should see:
-
-```json
-{
-  "mcp.servers": {
-    "security-mcp": {
-      "command": "npx",
-      "args": ["-y", "security-mcp@latest", "serve"]
-    }
-  }
-}
-```
-
-**Step 3 - Restart VS Code.**
-
-**Step 4 - In GitHub Copilot Chat, type:**
-
-```text
-@security-mcp run /senior-security-engineer on recent changes
+npx -y security-mcp@latest install
 ```
 
----
-
-### Manual Configuration (Any MCP Editor)
+The installer detects Claude Code, Cursor, VS Code, and Windsurf automatically and writes the config to the correct location. Restart your editor when it finishes, then type `/senior-security-engineer`.
 
-If the installer doesn't detect your editor, or you prefer to configure manually:
-
-**Step 1 - Print the config snippet:**
+### Install for a Specific Editor
 
 ```bash
-npx -y security-mcp@latest config
+npx -y security-mcp@latest install --claude-code   # ~/.claude/settings.json
+npx -y security-mcp@latest install --cursor        # ~/.cursor/mcp.json
+npx -y security-mcp@latest install --vscode        # VS Code user settings.json
+npx -y security-mcp@latest install --windsurf      # ~/.windsurf/mcp.json
 ```
 
-**Step 2 - Copy the output** and paste it into your editor's MCP configuration file.
-
-**Claude Code** (`~/.claude/settings.json`):
+### Manual Config (Any MCP-Compatible Editor)
 
-```json
-{
-  "mcpServers": {
-    "security-mcp": {
-      "command": "npx",
-      "args": ["-y", "security-mcp@latest", "serve"]
-    }
-  }
-}
-```
+Add this to your editor's MCP server config and restart:
 
-**Cursor** (`~/.cursor/mcp.json`):
+**Claude Code** (`~/.claude/settings.json`) · **Cursor** (`~/.cursor/mcp.json`) · **Windsurf** (`~/.windsurf/mcp.json`):
 
 ```json
 {
@@ -295,7 +267,7 @@ npx -y security-mcp@latest config
 }
 ```
 
-**VS Code / GitHub Copilot** (`settings.json`):
+**VS Code / GitHub Copilot** (user `settings.json`):
 
 ```json
 {
@@ -308,37 +280,26 @@ npx -y security-mcp@latest config
 }
 ```
 
-**Windsurf / Codex / Replit** - use the same `command`/`args` format your editor supports for MCP servers.
-
-**Step 3 - Restart your editor** after saving the config.
-
 ---
 
-### Global Install (Optional)
-
-If you want the `security-mcp` binary available system-wide without `npx`:
+## Verify Your Installation
 
-```bash
-npm install -g security-mcp@latest
-security-mcp install-global
-```
-
-Then you can use:
+After installing, confirm everything is wired up correctly:
 
 ```bash
-security-mcp install-global --claude-code
-security-mcp install-global --cursor
-security-mcp install-global --vscode
+npx -y security-mcp@latest doctor
 ```
 
----
+This checks your Node.js version, editor config files, and installed skills — and prints `[PASS]` or `[FAIL]` per check with a fix command if anything is missing.
 
-### Preview Without Writing Anything
+Example output:
 
-To see what the installer would do without making any changes:
+```text
+  [PASS] Node.js 22.x
+  [PASS] Claude Code config (~/.claude/settings.json)
+  [PASS] senior-security-engineer skill (~/.claude/skills/senior-security-engineer/SKILL.md)
 
-```bash
-npx -y security-mcp@latest install --dry-run
+All checks passed. Restart your editor, then type /senior-security-engineer.
 ```
 
 ---
@@ -365,7 +326,7 @@ npx -y security-mcp@latest install --dry-run
 
 1. Call `security.start_review` to create a tracked run
 2. Build a scan plan covering all relevant OWASP/NIST/ATT&CK controls
-3. Run 18 security checks in parallel across secrets, dependencies, crypto, auth, injection, cloud config, AI/LLM, mobile, and more
+3. Run 20 security checks in parallel across secrets, dependencies, crypto, auth, injection, cloud config, AI/LLM, mobile, and more
 4. Write fixes directly into your code for every finding it can remediate
 5. Generate a SHA-256 attested report at `.mcp/reports/{runId}.attestation.json`
 
@@ -463,7 +424,7 @@ jobs:
 
 ### What the CI Gate Checks
 
-The gate runs **18 checks in parallel** against your diff:
+The gate runs **24 check modules in parallel** against your diff:
 
 | Category | What It Catches |
 | --- | --- |
@@ -486,6 +447,10 @@ The gate runs **18 checks in parallel** against your diff:
 | **AI red-team** | Static + optional dynamic probes against AI endpoints |
 | **Exceptions** | Validates any active security exceptions are non-expired and properly approved |
 | **Baseline regression** | Detects when previously-satisfied controls go missing (BASELINE_REGRESSION HIGH finding injected on regression) |
+| **Deep injection** | 42 patterns — XXE, SSTI (Java/PHP), SpEL/OGNL, prototype pollution, second-order injection, NoSQL/MongoDB/Redis/LDAP/XPath injection, JNDI/Log4Shell, CRLF, WebSocket injection, CSS injection, SSE-CRLF, PDF injection, HTTP response splitting, unsafe YAML, deserialization (pickle/Java), path traversal, log injection, SSRF, command injection, ReDoS, SQL/ORM (Prisma/Sequelize/Knex/TypeORM), and more |
+| **Deep auth** | 43 patterns — JWT alg confusion/kid injection/JWKS override, session fixation, OAuth state/redirect_uri/PKCE/client secret, hardcoded JWT secret, rate limit, plaintext compare, SAML signature, cookie flags, token rotation, HS/RS confusion, API key in URL, reset expiry/single-use, admin route without authz, timing oracle, account enumeration, session token in URL, low-entropy token, bcrypt cost factor, and more |
+| **Supply chain deep** | 32 patterns — keyloggers, reverse shells, destructive commands, credential exfiltration, env variable theft, malicious postinstall scripts, dynamic require(), base64-obfuscated exec, cryptomining, sensitive file reads, unpinned dependencies, hidden file writes, DNS exfiltration, clipboard monitoring, obfuscated DOM injection, and more |
+| **Business logic** | 31 patterns — IDOR without ownership check, mass assignment, race conditions, integer overflow, currency confusion, discount stacking, order fulfillment bypass, webhook replay, tax/shipping tamper, client-side total, referral abuse, email normalization, feature flag bypass, API version bypass, double-spend, free trial abuse, pagination abuse, and more |
 
 ### Customize the Gate Policy
 
@@ -652,15 +617,18 @@ app.use(helmet({
 ┌──────────────────────────────────────────────────────────────┐
 │               Policy Gate Engine  (src/gate/policy.ts)       │
 │                                                              │
-│  18 checks run in parallel:                                  │
+│  28 checks run in parallel:                                  │
 │  checkSecrets    checkDependencies   checkApi    checkInfra  │
 │  checkCrypto     checkMobileIos      checkMobileAndroid      │
 │  checkAi         checkGraphQL        checkKubernetes         │
 │  checkDatabase   checkDlp            checkWebNextjs          │
-│  runSbomChecks   runAiRedteamChecks  runRuntimeChecks  ...  │
+│  runSbomChecks   runAiRedteamChecks  runRuntimeChecks        │
+│  runCiPipelineChecks  runDockerChecks  runScanners           │
+│  checkInjectionDeep (42 patterns)  checkAuthDeep (43 patterns)│
+│  checkSupplyChainDeep (32)  checkBusinessLogic (31)         │
 │                                                              │
 │  Surface detection -> Control catalog -> Exception handling ->  │
-│  Confidence scoring -> PASS / FAIL                           │
+│  Coverage manifest -> Taint map -> Confidence scoring -> PASS / FAIL │
 └──────────────────────────────────────────────────────────────┘
 ```
 
@@ -684,10 +652,17 @@ User: /senior-security-engineer
     └── STRIDE + PASTA + ATT&CK template for changed surface
         │
         ▼
+  §0 Coverage Completeness Protocol (runs first)
+    ├── enumerate ALL source files → coverage-manifest.json
+    ├── taint-trace every user-controlled input → taint-map.json
+    ├── negative assertion per attack class: "FILES: N/N | RESULT: CLEAN"
+    └── fix verification loop: re-run check after every fix, confirm CLEAN
+        │
+        ▼
   security.run_pr_gate(runId, mode, targets)
     ├── git diff / glob targets -> changed files list
     ├── detectSurfaces()  ->  web? api? infra? mobile? ai?
-    ├── 18 checks in parallel
+    ├── 28 checks in parallel (incl. deep injection + deep auth)
     ├── apply exceptions from .mcp/exceptions/
     ├── compute confidence score
     └── returns PASS/FAIL + findings[]
@@ -695,6 +670,8 @@ User: /senior-security-engineer
         ▼
   Claude writes inline fixes for every finding
   (production-ready secure code, not suggestions)
+  Every HIGH/CRITICAL: FIXED with verified-clean re-run,
+  OR formally blocked with risk-acceptance record
         │
         ▼
   security.attest_review(runId)
@@ -853,7 +830,7 @@ Your AI uses these automatically. You don't call them directly, but understandin
 | Tool | What It Does |
 | --- | --- |
 | `security.start_review` | Starts a stateful review run; returns `runId` used to track all subsequent steps and produce the final attestation |
-| `security.run_pr_gate` | Runs 18 security checks in parallel; returns PASS/FAIL, findings with severity, and required actions |
+| `security.run_pr_gate` | Runs 20 security checks in parallel; returns PASS/FAIL, findings with severity, and required actions |
 | `security.threat_model` | Generates a STRIDE + PASTA + ATT&CK threat model template for a specific feature or surface |
 | `security.checklist` | Returns the pre-release security checklist, optionally filtered by surface (web / api / mobile / ai / infra / payments) |
 | `security.scan_strategy` | Builds an exhaustive scan plan mapping every check to OWASP, NIST, ATT&CK, and compliance controls |
@@ -997,6 +974,8 @@ Edit `.mcp/exceptions/security-exceptions.json`:
 | `SECURITY_GATE_EXCEPTIONS` | `.mcp/exceptions/security-exceptions.json` | Path to exceptions file (must be within project directory) |
 | `SECURITY_GATE_MODE` | `full` | Set to `file_by_file` for scoped per-file scanning |
 | `SECURITY_GATE_TARGETS` | (all changed files) | Comma-separated file paths to restrict the scan surface |
+| `SECURITY_MCP_SHARED_SECRET` | (none) | Authenticates MCP tool callers via constant-time HMAC; enables 3-strike lockout. Generate with `openssl rand -hex 32` |
+| `SECURITY_POLICY_HMAC_KEY` | (none) | Signs the policy file so any tampering is detected at gate startup. Generate with `openssl rand -hex 32` |
 
 ### Integrations (all optional)
 
@@ -1060,7 +1039,7 @@ ls ~/.claude/skills/senior-security-engineer/SKILL.md
 
 **Fix:**
 
-1. Check the config file was written (see editor-specific paths in [Manual Configuration](#manual-configuration-any-mcp-editor))
+1. Check the config file was written (see editor-specific paths in [Installation](#installation))
 2. Fully restart the editor (quit and reopen, not just reload window)
 3. Check Node.js version: `node --version` - must be 20 or higher
 

package/defaults/checklists/ai.json

@@ -20,6 +20,25 @@
     { "id": "ai_rag_authz", "description": "RAG retrieval enforces authorization — documents filtered by user permissions", "critical": true },
     { "id": "ai_no_pii_in_prompts", "description": "No PII, credentials, or secrets in prompt templates", "critical": true },
     { "id": "ai_fallback_handling", "description": "Model failures handled gracefully — no sensitive error details exposed to users", "critical": false },
-    { "id": "ai_owasp_llm_top10", "description": "OWASP LLM Top 10 controls reviewed and addressed for this AI surface", "critical": true }
+    { "id": "ai_owasp_llm_top10", "description": "OWASP LLM Top 10 controls reviewed and addressed for this AI surface", "critical": true },
+    { "id": "ai_context_session_isolation", "description": "Per-user session context is strictly isolated — no cross-user context bleed in multi-tenant deployments; conversation history scoped to authenticated user ID", "critical": true },
+    { "id": "ai_adversarial_probe_multi_turn", "description": "Multi-turn adversarial probing complete: role-play escapes, many-shot jailbreaks, encoded payloads (base64, l33tspeak), goal hijacking across conversation resets — all documented with pass/fail", "critical": true },
+    { "id": "ai_tool_sandboxing", "description": "AI agent tool execution sandboxed — filesystem, network, and shell access granted only via explicit allowlist; no ambient authority; each tool call requires declared capability", "critical": true },
+    { "id": "ai_model_supply_chain", "description": "AI model provider and version verified — model hash or digest pinned in configuration; shadow model substitution would be detected; provider SLA and security posture documented", "critical": false },
+    { "id": "ai_output_length_limit", "description": "Model output length limits enforced at the API layer; unbounded generation that could exhaust context or enable token flooding is blocked; streaming responses have an abort timeout", "critical": true },
+    { "id": "ai_indirect_injection_external", "title": "External content ingestion paths sanitize fetched content before LLM context injection", "severity": "critical", "automated": true },
+    { "id": "ai_markdown_exfil", "title": "LLM output stripped of markdown images and external links before rendering to clients", "severity": "critical", "automated": true },
+    { "id": "ai_memory_poisoning", "title": "Long-term memory writes validated; read-back treated as untrusted input with injection guards", "severity": "critical", "automated": true },
+    { "id": "ai_rag_corpus_poisoning", "title": "Documents ingested into vector store pass content validation and injection scanning before upsert", "severity": "high", "automated": true },
+    { "id": "ai_token_smuggling", "title": "User prompt inputs stripped of zero-width Unicode, invisible characters, and homoglyphs before processing", "severity": "high", "automated": true },
+    { "id": "ai_privilege_escalation", "title": "Agent tool list frozen at session initialization — no runtime tool registration permitted", "severity": "critical", "automated": true },
+    { "id": "ai_llm_judge_manipulation", "title": "LLM-as-judge evaluation pipelines use static server-controlled scoring criteria isolated from user input", "severity": "high", "automated": true },
+    { "id": "ai_idor_tool_calls", "title": "Agentic tool calls that accept resource IDs enforce per-request authorization before accessing the resource", "severity": "critical", "automated": true },
+    { "id": "ai_context_stuffing", "title": "Application enforces maximum input token budget per request before dispatching to LLM API", "severity": "high", "automated": true },
+    { "id": "ai_multimodal_injection", "title": "Multimodal inputs (images, PDFs, audio) passed to vision/multimodal LLMs scanned for embedded injection payloads", "severity": "critical", "automated": true },
+    { "id": "ai_vector_filter_bypass", "title": "Vector store tenant isolation uses mandatory hard filters (must/AND) not optional soft filters (should/OR)", "severity": "high", "automated": true },
+    { "id": "ai_stream_chunk_validation", "title": "Streaming LLM response chunks validated against expected SSE schema before forwarding", "severity": "high", "automated": true },
+    { "id": "ai_generated_code_audit_trail", "title": "Every execution of AI-generated code, SQL, or shell commands produces an audit log entry", "severity": "high", "automated": true },
+    { "id": "ai_embedding_inversion", "title": "Raw embedding vectors never exposed in API responses, logs, or client storage", "severity": "medium", "automated": true }
   ]
 }

package/defaults/checklists/api.json

@@ -22,6 +22,40 @@
     { "id": "api_secrets_scan", "description": "Secrets scan clean — no hardcoded credentials or API keys", "critical": true },
     { "id": "api_sast_pass", "description": "SAST scan passed with no CRITICAL findings", "critical": true },
     { "id": "api_threat_model", "description": "Threat model completed and reviewed for this API surface change", "critical": true },
-    { "id": "api_health_endpoint", "description": "Health/readiness endpoints do not expose sensitive version or config info", "critical": false }
+    { "id": "api_health_endpoint", "description": "Health/readiness endpoints do not expose sensitive version or config info", "critical": false },
+    { "id": "api_graphql_introspection", "description": "GraphQL introspection disabled in production; query depth limit ≤ 10 and complexity budget enforced to prevent resource exhaustion", "critical": true },
+    { "id": "api_idempotency_replay", "description": "Financial and state-changing endpoints protected against replay via idempotency keys or HMAC-timestamped signatures with a time-bound window ≤ 5 minutes", "critical": true },
+    { "id": "api_command_injection", "description": "No user-controlled input passed to child_process.exec, execSync, spawn with shell:true, or any shell interpreter — allowlisted command templates only", "critical": true },
+    { "id": "api_file_upload_validation", "description": "File upload endpoints enforce MIME type server-side (not by extension), max file size, extension allowlist, and malware scanning; files stored outside web root", "critical": true },
+    { "id": "api_timing_safe_equality", "description": "All sensitive equality checks (tokens, reset codes, HMAC digests, API keys) use crypto.timingSafeEqual — no string ===, indexOf, or includes comparisons", "critical": true },
+    { "id": "api_second_order_injection", "title": "Second-order injection prevention reviewed — data retrieved from DB never passed unsanitized to SQL/template/shell sinks", "severity": "critical", "automated": true },
+    { "id": "api_spel_ognl_injection", "title": "SpEL/OGNL/MVEL expression parsers do not evaluate user-controlled input", "severity": "critical", "automated": true },
+    { "id": "api_pickle_marshal_deserialization", "title": "Python pickle.loads/Marshal.load/PHP unserialize never called on user-supplied data", "severity": "critical", "automated": true },
+    { "id": "api_java_deserialization", "title": "Java ObjectInputStream.readObject/XStream/Kryo deserialization never used with untrusted data", "severity": "critical", "automated": true },
+    { "id": "api_elasticsearch_injection", "title": "Elasticsearch query_string and script.source do not include user input", "severity": "high", "automated": true },
+    { "id": "api_websocket_message_injection", "title": "WebSocket message handlers validate all incoming data before passing to sinks", "severity": "high", "automated": true },
+    { "id": "api_grpc_protobuf_validation", "title": "gRPC/Protobuf endpoints validate all message fields after deserialization", "severity": "high", "automated": true },
+    { "id": "api_nosql_field_injection", "title": "MongoDB query field values validated as scalar types — $gt/$regex stripped from user input", "severity": "high", "automated": true },
+    { "id": "api_http_response_splitting", "title": "HTTP response splitting prevented — writeHead/headers.set never include user CRLF sequences", "severity": "high", "automated": true },
+    { "id": "api_document_injection", "title": "PDF/Office document generation libraries sanitize user input — no formula injection (=CMD, =DDE)", "severity": "high", "automated": true },
+    { "id": "api_bracket_notation_pollution", "title": "Dynamic property assignment using user-controlled keys forbidden — bracket notation obj[userKey] validated", "severity": "high", "automated": true },
+    { "id": "api_jwt_kid_injection", "title": "JWT kid header sanitised before DB lookup or filesystem access", "severity": "critical", "automated": true },
+    { "id": "api_jwt_jwks_uri_pinned", "title": "JWKS URI pinned to static allowlist — token-supplied jwks_uri not followed", "severity": "critical", "automated": true },
+    { "id": "api_oauth_client_secret_hardcoded", "title": "OAuth client_secret not hardcoded in client-side code — public clients use PKCE only", "severity": "critical", "automated": true },
+    { "id": "api_session_token_in_url", "title": "Session identifiers never transmitted in URL query parameters", "severity": "high", "automated": true },
+    { "id": "api_token_entropy", "title": "Session and reset tokens generated with ≥ 16 bytes (128 bits) of cryptographic randomness", "severity": "high", "automated": true },
+    { "id": "api_remember_me_rotation", "title": "Persistent remember-me tokens rotated on each use, stored hashed server-side, hard-expired ≤ 30 days", "severity": "high", "automated": true },
+    { "id": "api_password_reset_single_use", "title": "Password reset tokens deleted or nullified immediately after first use", "severity": "high", "automated": true },
+    { "id": "api_account_enumeration", "title": "Login and password-reset endpoints return identical responses for invalid user vs. invalid credential", "severity": "medium", "automated": true },
+    { "id": "api_bcrypt_cost_factor", "title": "bcrypt cost factor ≥ 12 for all password hashing operations", "severity": "high", "automated": true },
+    { "id": "api_zero_iv", "title": "No all-zero or zero-filled IVs used in cipher operations — IVs generated with crypto.randomBytes", "severity": "critical", "automated": true },
+    { "id": "api_rsa_key_size", "title": "RSA key generation uses ≥ 2048 bits — no sub-2048 key sizes", "severity": "critical", "automated": true },
+    { "id": "api_dh_params", "title": "Diffie-Hellman parameters ≥ 2048 bits — no weak DH groups (modp1/2/5)", "severity": "high", "automated": true },
+    { "id": "api_forward_secrecy", "title": "TLS cipher suites require ECDHE or DHE — forward secrecy enforced", "severity": "high", "automated": true },
+    { "id": "api_graphql_resolver_injection", "title": "GraphQL resolver arguments never concatenated into raw SQL/NoSQL queries", "severity": "critical", "automated": true },
+    { "id": "api_graphql_batching", "title": "GraphQL alias count limited per request (≤ 15) — batching-based enumeration and DoS prevented", "severity": "high", "automated": true },
+    { "id": "api_sse_injection", "title": "Server-Sent Events streams strip \\r\\n from user-controlled data before writing", "severity": "high", "automated": true },
+    { "id": "api_oauth_referer_leakage", "title": "Referrer-Policy: no-referrer set on pages that receive OAuth tokens; tokens not in URL query params", "severity": "high", "automated": true },
+    { "id": "api_pagination_bounds", "title": "Pagination parameters (limit, offset, page) validated with minimum 1, maximum cap, non-negative enforcement", "severity": "medium", "automated": true }
   ]
 }

package/defaults/checklists/infra.json

@@ -22,6 +22,39 @@
     { "id": "infra_provenance", "description": "SLSA provenance attestation generated for release artifacts", "critical": false },
     { "id": "infra_threat_model", "description": "Threat model completed and reviewed for this infrastructure change", "critical": true },
     { "id": "infra_zero_trust", "description": "Zero Trust controls applied — explicit authentication for all service-to-service calls", "critical": true },
-    { "id": "infra_ddos_protection", "description": "DDoS protection enabled for public-facing load balancers", "critical": false }
+    { "id": "infra_ddos_protection", "description": "DDoS protection enabled for public-facing load balancers", "critical": false },
+    { "id": "infra_imdsv2_enforced", "description": "IMDSv2 enforced on all EC2/cloud instances (hop limit 1, token required); SSRF to 169.254.169.254 blocked at network layer — prevents cloud metadata credential theft", "critical": true },
+    { "id": "infra_egress_filtering", "description": "Egress network filtering restricts outbound connections to known-good destinations; unexpected outbound traffic triggers alerts within 15 minutes", "critical": true },
+    { "id": "infra_pod_security_standards", "description": "Kubernetes pods run with Restricted security context: runAsNonRoot, readOnlyRootFilesystem, allowPrivilegeEscalation:false, seccomp profile enforced", "critical": true },
+    { "id": "infra_secret_rotation", "description": "All secrets and credentials have automated rotation policy with maximum rotation interval documented and enforced; rotation failures trigger immediate alerts", "critical": true },
+    { "id": "infra_runtime_threat_detection", "description": "Runtime threat detection enabled (Falco, GuardDuty, Defender for Cloud, or equivalent) on all compute; anomalies generate alerts within 15 minutes with documented runbook", "critical": false },
+    { "id": "infra_imdsv1_accessible", "title": "IMDSv1 disabled — http_tokens=required enforced on all EC2 instances", "severity": "critical", "automated": true },
+    { "id": "infra_lambda_url_no_auth", "title": "Lambda function URLs not configured with AuthType NONE", "severity": "critical", "automated": true },
+    { "id": "infra_ecr_scan_on_push", "title": "ECR repositories have scan-on-push enabled", "severity": "high", "automated": true },
+    { "id": "infra_ecs_host_network", "title": "ECS tasks do not use host network mode", "severity": "high", "automated": true },
+    { "id": "infra_cloudtrail_multiregion", "title": "CloudTrail configured as multi-region trail", "severity": "high", "automated": true },
+    { "id": "infra_s3_access_logging", "title": "S3 server access logging enabled on all sensitive buckets", "severity": "medium", "automated": true },
+    { "id": "infra_vpc_flow_logs", "title": "VPC flow logs enabled", "severity": "medium", "automated": true },
+    { "id": "infra_cross_account_external_id", "title": "Cross-account IAM trust policies include sts:ExternalId condition", "severity": "high", "automated": true },
+    { "id": "infra_gcp_default_service_account", "title": "GCP instances do not use the default Compute Engine service account", "severity": "high", "automated": true },
+    { "id": "infra_gcp_project_ssh_keys", "title": "No GCP project-level SSH keys configured", "severity": "medium", "automated": true },
+    { "id": "infra_gcp_external_ip", "title": "GCP compute instances without external IPs unless required", "severity": "medium", "automated": true },
+    { "id": "infra_azure_public_network_access", "title": "Azure resources do not have public_network_access_enabled=true unless required", "severity": "high", "automated": true },
+    { "id": "infra_deletion_protection", "title": "All databases and stateful resources have deletion_protection=true", "severity": "high", "automated": true },
+    { "id": "infra_vpc_endpoint_s3_ecr", "title": "VPC endpoints configured for S3/ECR — service traffic does not route over public internet", "severity": "medium", "automated": true },
+    { "id": "infra_guardduty_enabled", "title": "AWS GuardDuty enabled in all regions", "severity": "high", "automated": true },
+    { "id": "infra_security_hub_enabled", "title": "AWS Security Hub enabled for centralized findings aggregation", "severity": "medium", "automated": true },
+    { "id": "k8s_run_as_root", "title": "Kubernetes containers do not run as root (runAsUser: 0)", "severity": "high", "automated": true },
+    { "id": "k8s_capabilities_not_dropped", "title": "Container capabilities fully dropped (capabilities.drop: [ALL])", "severity": "high", "automated": true },
+    { "id": "k8s_nodeport_exposure", "title": "No NodePort services exposing sensitive internal services", "severity": "medium", "automated": true },
+    { "id": "k8s_tiller_helm_v2", "title": "Helm v2 Tiller not deployed in cluster", "severity": "critical", "automated": true },
+    { "id": "k8s_docker_socket_mount", "title": "Docker socket not mounted inside any Kubernetes pod", "severity": "critical", "automated": true },
+    { "id": "k8s_api_anonymous_auth", "title": "Kubernetes API server anonymous-auth disabled", "severity": "critical", "automated": true },
+    { "id": "k8s_mtls_not_strict", "title": "Istio/Linkerd PeerAuthentication enforces STRICT mTLS mode", "severity": "high", "automated": true },
+    { "id": "docker_no_user_directive", "title": "All Dockerfiles include USER directive — containers do not run as root", "severity": "high", "automated": true },
+    { "id": "docker_add_url_no_integrity", "title": "Dockerfiles do not use ADD with remote URLs without integrity verification", "severity": "high", "automated": true },
+    { "id": "docker_secrets_in_env", "title": "No secrets in Dockerfile ENV instructions", "severity": "critical", "automated": true },
+    { "id": "docker_privileged_flag", "title": "No containers started with --privileged or privileged:true", "severity": "critical", "automated": true },
+    { "id": "docker_socket_mount", "title": "Docker socket not mounted into any container", "severity": "critical", "automated": true }
   ]
 }