security-mcp 1.1.4 → 1.3.1

package/README.md

@@ -17,17 +17,12 @@ Works with **Claude Code, GitHub Copilot, Cursor, Codex, Replit**, and any MCP-c
 
 ## Table of Contents
 
-- [What's New in 1.1.4](#whats-new-in-114)
+- [What's New in v1.3.0](#whats-new-in-v130)
 - [What Problem Does This Solve?](#what-problem-does-this-solve)
 - [Who Is This For?](#who-is-this-for)
 - [Two Modes - Pick Your Depth](#two-modes---pick-your-depth)
 - [Quick Start - Install in 60 Seconds](#quick-start---install-in-60-seconds)
-- [Step-by-Step Installation Guide](#step-by-step-installation-guide)
-  - [Claude Code](#step-by-step-claude-code)
-  - [Cursor](#step-by-step-cursor)
-  - [VS Code / GitHub Copilot](#step-by-step-vs-code--github-copilot)
-  - [Windsurf](#step-by-step-windsurf)
-  - [Manual Configuration](#manual-configuration-any-mcp-editor)
+- [Installation](#installation)
 - [Verify Your Installation](#verify-your-installation)
 - [How to Run Your First Security Review](#how-to-run-your-first-security-review)
 - [CI/CD Security Gate](#cicd-security-gate)
@@ -43,54 +38,114 @@ Works with **Claude Code, GitHub Copilot, Cursor, Codex, Replit**, and any MCP-c
 
 ---
 
-## What's New in 1.1.4
+## What's New in v1.3.0
 
-### 20 Checks (up from 18) - Deep Injection + Deep Auth Modules
+v1.3.0 delivers **104 new blindspot detection checks** across 7 threat domains, discovered by running a full 8-agent CISO Orchestrator pass followed by an adversarial pentest verification round. It also closes 5 critical security vulnerabilities in the gate engine itself.
 
-Two new deep-check modules run automatically for web and API surfaces:
+### 42 Deep Injection Patterns (was 15)
 
-**`checkInjectionDeep`** — 11 new patterns: XXE (CWE-611), SSTI (CWE-94), prototype pollution (CWE-1321), open redirect (CWE-601), NoSQL operator injection (CWE-943), CRLF injection (CWE-113), unsafe YAML load (CWE-502), unsafe deserialization, path traversal (CWE-22), log injection (CWE-117), SSRF (CWE-918).
+`checkInjectionDeep` now covers 42 detection patterns:
 
-**`checkAuthDeep`** — 12 new patterns: JWT algorithm confusion / `alg:none` (CWE-327), session fixation (CWE-384), OAuth missing state parameter (CWE-352), OAuth `redirect_uri` open redirect (CWE-601), PKCE not enforced (RFC 7636), hardcoded JWT secret (CWE-798), missing rate limit on auth endpoints (CWE-307), plaintext password comparison (CWE-256), SAML signature validation disabled (CWE-347), insecure cookie flags (CWE-1004/614), refresh token not rotated (CWE-613), JWT HS/RS confusion (CVE-2015-9235 pattern).
+| Added in v1.3.0 | ATT&CK | What It Catches |
+| --- | --- | --- |
+| **SSTI (Java/PHP)** | T1059 | FreeMarker, Thymeleaf, Velocity, Twig, Smarty template injection |
+| **SpEL / OGNL injection** | T1059 | Spring Expression Language and OGNL via user-controlled string eval |
+| **Pickle / Java deserialization** | T1059.001 | Unsafe `pickle.loads`, `ObjectInputStream`, `readObject` on untrusted data |
+| **Second-order injection** | T1059 | Data stored to DB then later executed — two-pass file-correlation check |
+| **CSS injection** | T1059 | User content reflected inside `<style>` or `style=` without sanitization |
+| **Elasticsearch injection** | T1059 | Dynamic query construction in Elasticsearch DSL with user input |
+| **WebSocket injection** | T1059 | User-controlled data in `ws.send()` without validation |
+| **SSE-CRLF** | T1059 | CRLF in Server-Sent Events `data:` field hijacking the SSE stream |
+| **PDF / document injection** | T1059 | User input in PDF field generation without escaping |
+| **HTTP response splitting** | T1059 | CRLF in HTTP header values |
+| **Bracket-notation prototype pollution** | T1203 | `obj[key] = value` with user-controlled keys |
+
+Plus all original patterns: XXE, SSTI multiline, LDAP, XPath, JNDI/Log4Shell, MongoDB `$where`, prototype pollution, CRLF, unsafe YAML, deserialization, path traversal, log injection, SSRF, command injection, ReDoS, SQL/ORM (Prisma, Sequelize, Knex, TypeORM), Redis `EVAL`, HTTP header injection.
 
-### Coverage Completeness Protocol (§0)
+### 43 Deep Auth Patterns (was 16)
 
-Every security review now runs a mandatory 5-step protocol before reporting any result:
+`checkAuthDeep` now covers 43 detection patterns:
 
-1. **Complete file inventory** — enumerate all source files into `coverage-manifest.json`; no attack class can be called CLEAN without checking every file.
-2. **Taint tracking** — trace every user-controlled input (`req.body`, `req.query`, WebSocket, env, file uploads, external API responses) to all downstream sinks, classifying each SAFE / UNSAFE / UNRESOLVED.
-3. **Negative assertions** — after each attack class: `ATTACK CLASS: {name} | FILES: N/N | PATTERNS: {list} | RESULT: CLEAN`.
-4. **Fix verification loop** — after every fix, re-run the triggering check and confirm it no longer fires before advancing.
-5. **All-or-nothing mandate** — every HIGH/CRITICAL finding is either FIXED (verified clean) or BLOCKED (risk-accepted, gate failing, remediation plan written to `deferred-fixes.json`).
+| Added in v1.3.0 | CWE | What It Catches |
+| --- | --- | --- |
+| **JWT `kid` injection** | CWE-20 | `kid` header used as file path or SQL expression for key material |
+| **JWKS URI override** | CWE-20 | Attacker-controlled `jku` / `x5u` headers pointing to external key stores |
+| **OAuth client secret in repo** | CWE-798 | `client_secret` literals or env defaults checked into source |
+| **Session token in URL** | CWE-598 | Session IDs in query parameters — logged by every proxy |
+| **Low-entropy token** | CWE-330 | Token / secret generated with `Math.random()` or timestamp-seeded RNG |
+| **Remember-me no rotation** | CWE-613 | Persistent login tokens never rotated on use |
+| **Password reset single-use** | CWE-640 | Reset tokens reusable after initial redemption |
+| **Account enumeration** | CWE-204 | Different error messages for valid vs. invalid usernames |
+| **Bcrypt cost factor** | CWE-916 | `bcrypt.hash(pw, N)` where N < 12 |
+
+Plus all original patterns: JWT alg:none/HS-RS confusion, session fixation, OAuth state/redirect_uri/PKCE, hardcoded JWT secret, rate limit on auth, plaintext password compare, SAML signature bypass, insecure cookie flags, refresh token rotation, API key in URL, reset token expiry, admin route without authz, timing oracle.
+
+### 31 Business Logic Patterns (was 8)
+
+`checkBusinessLogic` now catches 31 patterns including 13 new e-commerce and payment abuse vectors:
+
+- **Currency confusion** — mixed-currency arithmetic without normalization
+- **Discount stacking** — coupon codes combined with promotions without stack limits
+- **Order fulfillment bypass** — status transitions that skip required payment/verification steps
+- **Webhook timestamp** — missing replay-window check on webhook signature verification
+- **Tax / shipping parameter tamper** — client-supplied tax and shipping totals accepted server-side
+- **Client-side total** — final order amount derived from a browser-supplied value
+- **Referral abuse** — self-referral detection absent from referral credit logic
+- **Email normalization** — `user+tag@domain.com` not normalized when enforcing unique accounts
+- **Feature flag bypass** — feature flags controllable via client-supplied headers or query params
+- **API version bypass** — security controls on v2 routes not enforced on legacy v1 endpoints
+- **Double-spend payment** — concurrent payment requests without idempotency key enforcement
+- **Free trial abuse** — trial period enforced only by client-supplied start date
+- **Pagination abuse** — unlimited page size parameter enabling full-table data dump
+
+### 32 Supply Chain Deep Patterns (was 16)
+
+`checkSupplyChainDeep` now covers 32 patterns. New additions detect obfuscated payloads, malicious package scripts, and exfiltration channels that bypass standard SAST tools — including keyloggers, reverse shells, cryptomining signatures, DNS exfiltration, clipboard monitoring, and more.
+
+### Critical Security Fixes
+
+| ID | Severity | Fix |
+| --- | --- | --- |
+| **VULN-001** | CRITICAL | Dead multiline regex in `checkSecondOrderInjection` silently nulled the entire injection-deep module — replaced with two-pass file-correlation |
+| **VULN-002** | HIGH | Symlink traversal in `policy.ts` glob calls — `followSymbolicLinks: false` enforced |
+| **VULN-003** | HIGH | Evidence previews leaked secret values — `redactSecrets()` added to `search.ts` |
+| **AUTH-OBO-01** | HIGH | Lockout off-by-one in `auth.ts` allowed 4 attempts instead of 3 |
+| **META-01/03/04** | MEDIUM | Prompt injection vectors in MCP server — `_notice` framing and `sanitizePromptParam()` added |
 
-### Enhanced Threat Model Template
+### Also in v1.2.1
 
-The `security.threat_model` tool now generates a more complete template including LINDDUN privacy threat analysis (Linking, Identifying, Non-repudiation, Detecting, Data Disclosure, Unawareness, Non-compliance), TRIKE risk matrix (actor-action-asset-risk), DREAD scoring, attack trees for the top 3 critical paths, adversary profiles mapped to ATT&CK techniques, and supply chain threat enumeration.
+- OWASP Top 10 now **10/10 covered** — A09 (Security Logging and Monitoring Failures) fully completed
+- NIST AU-11 / PCI Req 10 log retention detection added to `checkAuthDeep`
+- ISO 42001 §9.1 routing decision audit log added to model router
+- `runScanners` (gitleaks / semgrep / trivy / checkov / osv-scanner) wired into the gate — was implemented but never called since v1.0; now active check 27
 
-### Expanded Release Checklists
+### Also in v1.2.0
 
-All domain-specific release checklists now include:
+- **Secrets** — dotfiles glob, base64/hex decode pre-pass, 10 new token formats (Vercel, PlanetScale, Databricks, Linear, Railway, npmrc, HuggingFace, ARM, Twilio), gitleaks history scan, split-string heuristic
+- **Injection** — SQL/ORM detection (Prisma `$queryRaw`, Sequelize, Knex, TypeORM), JNDI/Log4Shell, LDAP, XPath, Redis `EVAL`, ReDoS static catastrophic-backtracking patterns
+- **Cryptography** — AES-CBC-without-HMAC (+ split-string evasion fix), GCM nonce reuse and timestamp IV, RSA PKCS#1v1.5, SHA-256-as-password-hash, hardcoded PBKDF2 salt, `rejectUnauthorized: false`, weak TLS min version
+- **Checklists** — all 6 surface checklists updated with `automated: true` entries for every new check ID
 
-- **OAuth/OIDC** — PKCE with S256, state/nonce verification, exact-match `redirect_uri`, code reuse prevention, audience validation
-- **Business Logic** — idempotency keys on payment mutations, negative input validation, race condition testing for balance/quota/inventory
-- **Serialization/Injection** — XXE, SSTI, unsafe YAML, deserialization, prototype pollution, open redirect, CRLF in every checklist
-- **AI/LLM** — system prompt extraction resistance, multi-turn attack chains, multimodal injection, agentic tool allowlist, AML.T0054/T0057 mitigations
-- **Payments (PCI DSS 4.0)** — PAN masking, DOM mutation monitoring, EMV 3DS 2.2+, Magecart prevention (SRI on checkout pages)
-- **Observability Gate** (new) — anomaly detection baselines, SLO definitions for security events, alert fatigue review, runbook coverage
+### MCP Caller Authentication
 
-### Windsurf Support
+Protect the MCP server channel against rogue processes that obtain stdio access:
 
-The installer now detects and configures Windsurf (`~/.windsurf/mcp.json`) automatically alongside Claude Code, Cursor, and VS Code.
+```bash
+export SECURITY_MCP_SHARED_SECRET="$(openssl rand -hex 32)"
+```
 
-### `doctor` Command
+When set, every tool call is blocked until the AI agent calls `security.authenticate` with the matching token. Uses constant-time HMAC comparison (CWE-208), 3-strike lockout, and minimum 16-byte secret enforcement. Backwards-compatible — when unset, all tools are immediately available.
 
-Verify your installation health at any time:
+### Policy HMAC Integrity Signing
+
+Prevent tampered policy files from silently disabling severity blocking:
 
 ```bash
-npx -y security-mcp@latest doctor
+export SECURITY_POLICY_HMAC_KEY="$(openssl rand -hex 32)"
+npx security-mcp sign-policy
 ```
 
-Checks Node.js version, editor configs, and skill files — prints PASS/FAIL per check with actionable fix commands.
+When set, the gate rejects any policy file whose HMAC sidecar (`.hmac`) does not match — making it impossible to quietly change `severity_block: ["HIGH","CRITICAL"]` to `[]` without detection.
 
 ---
 
@@ -174,208 +229,32 @@ For a full 39-agent deep audit:
 
 ---
 
-## Step-by-Step Installation Guide
-
-### Step-by-Step: Claude Code
+## Installation
 
-**Prerequisite:** Node.js 20+ installed. Check with `node --version`.
+> **Prerequisite:** Node.js 20+. Check with `node --version`.
 
-**Step 1 - Run the installer:**
-
-```bash
-npx -y security-mcp@latest install --claude-code
-```
-
-This writes the MCP server config to `~/.claude/settings.json`.
-
-**Step 2 - Verify the config was written:**
-
-```bash
-cat ~/.claude/settings.json
-```
-
-You should see:
-
-```json
-{
-  "mcpServers": {
-    "security-mcp": {
-      "command": "npx",
-      "args": ["-y", "security-mcp@latest", "serve"]
-    }
-  }
-}
-```
-
-**Step 3 - Restart Claude Code** to pick up the new MCP server.
-
-**Step 4 - Verify the tools loaded.** In Claude Code, run:
-
-```text
-/mcp
-```
-
-You should see `security-mcp` listed as a connected server with `security.*`, `orchestration.*`, and `repo.*` tools available.
-
-**Step 5 - Run your first security review:**
-
-```text
-/senior-security-engineer
-```
-
-The agent will ask:
-
-- **A) Recent changes** - scans only what changed since your last commit (fastest, use daily)
-- **B) Full codebase** - scans everything (use for new projects or after major changes)
-- **C) Specific files or folders** - scans exactly what you specify
-
-Pick one and let it run.
-
----
-
-### Step-by-Step: Cursor
-
-**Step 1 - Run the installer:**
-
-```bash
-npx -y security-mcp@latest install --cursor
-```
-
-This writes to `~/.cursor/mcp.json`.
-
-**Step 2 - Verify:**
-
-```bash
-cat ~/.cursor/mcp.json
-```
-
-Expected output:
-
-```json
-{
-  "mcpServers": {
-    "security-mcp": {
-      "command": "npx",
-      "args": ["-y", "security-mcp@latest", "serve"]
-    }
-  }
-}
-```
-
-**Step 3 - Restart Cursor.**
-
-**Step 4 - Open Cursor's MCP panel** (Settings -> MCP) and confirm `security-mcp` shows as connected.
-
-**Step 5 - In the Cursor AI chat, type:**
-
-```text
-Use /senior-security-engineer to review my recent changes
-```
-
----
-
-### Step-by-Step: VS Code / GitHub Copilot
-
-**Step 1 - Run the installer:**
-
-```bash
-npx -y security-mcp@latest install --vscode
-```
-
-This writes to your VS Code user `settings.json`.
-
-**Step 2 - Verify in VS Code:**
-
-Open Command Palette (`Cmd+Shift+P` / `Ctrl+Shift+P`) -> `Preferences: Open User Settings (JSON)`.
-
-You should see:
-
-```json
-{
-  "mcp.servers": {
-    "security-mcp": {
-      "command": "npx",
-      "args": ["-y", "security-mcp@latest", "serve"]
-    }
-  }
-}
-```
-
-**Step 3 - Restart VS Code.**
-
-**Step 4 - In GitHub Copilot Chat, type:**
-
-```text
-@security-mcp run /senior-security-engineer on recent changes
-```
-
----
-
-### Step-by-Step: Windsurf
-
-**Step 1 - Run the installer:**
+### One Command — Auto-detects Your Editor
 
 ```bash
 npx -y security-mcp@latest install
 ```
 
-This auto-detects Windsurf and writes to `~/.windsurf/mcp.json`.
-
-**Step 2 - Verify:**
-
-```bash
-cat ~/.windsurf/mcp.json
-```
-
-Expected output:
-
-```json
-{
-  "mcpServers": {
-    "security-mcp": {
-      "command": "npx",
-      "args": ["-y", "security-mcp@latest", "serve"]
-    }
-  }
-}
-```
-
-**Step 3 - Restart Windsurf.**
+The installer detects Claude Code, Cursor, VS Code, and Windsurf automatically and writes the config to the correct location. Restart your editor when it finishes, then type `/senior-security-engineer`.
 
-**Step 4 - In the Windsurf AI chat, type:**
-
-```text
-Use /senior-security-engineer to review my recent changes
-```
-
----
-
-### Manual Configuration (Any MCP Editor)
-
-If the installer doesn't detect your editor, or you prefer to configure manually:
-
-**Step 1 - Print the config snippet:**
+### Install for a Specific Editor
 
 ```bash
-npx -y security-mcp@latest config
+npx -y security-mcp@latest install --claude-code   # ~/.claude/settings.json
+npx -y security-mcp@latest install --cursor        # ~/.cursor/mcp.json
+npx -y security-mcp@latest install --vscode        # VS Code user settings.json
+npx -y security-mcp@latest install --windsurf      # ~/.windsurf/mcp.json
 ```
 
-**Step 2 - Copy the output** and paste it into your editor's MCP configuration file.
+### Manual Config (Any MCP-Compatible Editor)
 
-**Claude Code** (`~/.claude/settings.json`):
-
-```json
-{
-  "mcpServers": {
-    "security-mcp": {
-      "command": "npx",
-      "args": ["-y", "security-mcp@latest", "serve"]
-    }
-  }
-}
-```
+Add this to your editor's MCP server config and restart:
 
-**Cursor** (`~/.cursor/mcp.json`):
+**Claude Code** (`~/.claude/settings.json`) · **Cursor** (`~/.cursor/mcp.json`) · **Windsurf** (`~/.windsurf/mcp.json`):
 
 ```json
 {
@@ -388,7 +267,7 @@ npx -y security-mcp@latest config
 }
 ```
 
-**VS Code / GitHub Copilot** (`settings.json`):
+**VS Code / GitHub Copilot** (user `settings.json`):
 
 ```json
 {
@@ -401,39 +280,6 @@ npx -y security-mcp@latest config
 }
 ```
 
-**Windsurf / Codex / Replit** - use the same `command`/`args` format your editor supports for MCP servers.
-
-**Step 3 - Restart your editor** after saving the config.
-
----
-
-### Global Install (Optional)
-
-If you want the `security-mcp` binary available system-wide without `npx`:
-
-```bash
-npm install -g security-mcp@latest
-security-mcp install-global
-```
-
-Then you can use:
-
-```bash
-security-mcp install-global --claude-code
-security-mcp install-global --cursor
-security-mcp install-global --vscode
-```
-
----
-
-### Preview Without Writing Anything
-
-To see what the installer would do without making any changes:
-
-```bash
-npx -y security-mcp@latest install --dry-run
-```
-
 ---
 
 ## Verify Your Installation
@@ -578,7 +424,7 @@ jobs:
 
 ### What the CI Gate Checks
 
-The gate runs **20 checks in parallel** against your diff:
+The gate runs **24 check modules in parallel** against your diff:
 
 | Category | What It Catches |
 | --- | --- |
@@ -601,8 +447,10 @@ The gate runs **20 checks in parallel** against your diff:
 | **AI red-team** | Static + optional dynamic probes against AI endpoints |
 | **Exceptions** | Validates any active security exceptions are non-expired and properly approved |
 | **Baseline regression** | Detects when previously-satisfied controls go missing (BASELINE_REGRESSION HIGH finding injected on regression) |
-| **Deep injection** | XXE, SSTI, prototype pollution, open redirect, NoSQL operator injection, CRLF, unsafe YAML load, deserialization, path traversal, log injection, SSRF (11 new patterns) |
-| **Deep auth** | JWT algorithm confusion, session fixation, OAuth missing state, OAuth open redirect_uri, PKCE not enforced, hardcoded JWT secret, missing rate limit on auth endpoints, plaintext password compare, SAML signature disabled, insecure cookie flags, refresh token not rotated, JWT HS/RS confusion (12 new patterns) |
+| **Deep injection** | 42 patterns — XXE, SSTI (Java/PHP), SpEL/OGNL, prototype pollution, second-order injection, NoSQL/MongoDB/Redis/LDAP/XPath injection, JNDI/Log4Shell, CRLF, WebSocket injection, CSS injection, SSE-CRLF, PDF injection, HTTP response splitting, unsafe YAML, deserialization (pickle/Java), path traversal, log injection, SSRF, command injection, ReDoS, SQL/ORM (Prisma/Sequelize/Knex/TypeORM), and more |
+| **Deep auth** | 43 patterns — JWT alg confusion/kid injection/JWKS override, session fixation, OAuth state/redirect_uri/PKCE/client secret, hardcoded JWT secret, rate limit, plaintext compare, SAML signature, cookie flags, token rotation, HS/RS confusion, API key in URL, reset expiry/single-use, admin route without authz, timing oracle, account enumeration, session token in URL, low-entropy token, bcrypt cost factor, and more |
+| **Supply chain deep** | 32 patterns — keyloggers, reverse shells, destructive commands, credential exfiltration, env variable theft, malicious postinstall scripts, dynamic require(), base64-obfuscated exec, cryptomining, sensitive file reads, unpinned dependencies, hidden file writes, DNS exfiltration, clipboard monitoring, obfuscated DOM injection, and more |
+| **Business logic** | 31 patterns — IDOR without ownership check, mass assignment, race conditions, integer overflow, currency confusion, discount stacking, order fulfillment bypass, webhook replay, tax/shipping tamper, client-side total, referral abuse, email normalization, feature flag bypass, API version bypass, double-spend, free trial abuse, pagination abuse, and more |
 
 ### Customize the Gate Policy
 
@@ -769,13 +617,15 @@ app.use(helmet({
 ┌──────────────────────────────────────────────────────────────┐
 │               Policy Gate Engine  (src/gate/policy.ts)       │
 │                                                              │
-│  20 checks run in parallel:                                  │
+│  28 checks run in parallel:                                  │
 │  checkSecrets    checkDependencies   checkApi    checkInfra  │
 │  checkCrypto     checkMobileIos      checkMobileAndroid      │
 │  checkAi         checkGraphQL        checkKubernetes         │
 │  checkDatabase   checkDlp            checkWebNextjs          │
 │  runSbomChecks   runAiRedteamChecks  runRuntimeChecks        │
-│  checkInjectionDeep (11 patterns)  checkAuthDeep (12 patterns)│
+│  runCiPipelineChecks  runDockerChecks  runScanners           │
+│  checkInjectionDeep (42 patterns)  checkAuthDeep (43 patterns)│
+│  checkSupplyChainDeep (32)  checkBusinessLogic (31)         │
 │                                                              │
 │  Surface detection -> Control catalog -> Exception handling ->  │
 │  Coverage manifest -> Taint map -> Confidence scoring -> PASS / FAIL │
@@ -812,7 +662,7 @@ User: /senior-security-engineer
   security.run_pr_gate(runId, mode, targets)
     ├── git diff / glob targets -> changed files list
     ├── detectSurfaces()  ->  web? api? infra? mobile? ai?
-    ├── 20 checks in parallel (incl. deep injection + deep auth)
+    ├── 28 checks in parallel (incl. deep injection + deep auth)
     ├── apply exceptions from .mcp/exceptions/
     ├── compute confidence score
     └── returns PASS/FAIL + findings[]
@@ -1124,6 +974,8 @@ Edit `.mcp/exceptions/security-exceptions.json`:
 | `SECURITY_GATE_EXCEPTIONS` | `.mcp/exceptions/security-exceptions.json` | Path to exceptions file (must be within project directory) |
 | `SECURITY_GATE_MODE` | `full` | Set to `file_by_file` for scoped per-file scanning |
 | `SECURITY_GATE_TARGETS` | (all changed files) | Comma-separated file paths to restrict the scan surface |
+| `SECURITY_MCP_SHARED_SECRET` | (none) | Authenticates MCP tool callers via constant-time HMAC; enables 3-strike lockout. Generate with `openssl rand -hex 32` |
+| `SECURITY_POLICY_HMAC_KEY` | (none) | Signs the policy file so any tampering is detected at gate startup. Generate with `openssl rand -hex 32` |
 
 ### Integrations (all optional)
 
@@ -1187,7 +1039,7 @@ ls ~/.claude/skills/senior-security-engineer/SKILL.md
 
 **Fix:**
 
-1. Check the config file was written (see editor-specific paths in [Manual Configuration](#manual-configuration-any-mcp-editor))
+1. Check the config file was written (see editor-specific paths in [Installation](#installation))
 2. Fully restart the editor (quit and reopen, not just reload window)
 3. Check Node.js version: `node --version` - must be 20 or higher
 

package/defaults/checklists/ai.json

@@ -20,6 +20,25 @@
     { "id": "ai_rag_authz", "description": "RAG retrieval enforces authorization — documents filtered by user permissions", "critical": true },
     { "id": "ai_no_pii_in_prompts", "description": "No PII, credentials, or secrets in prompt templates", "critical": true },
     { "id": "ai_fallback_handling", "description": "Model failures handled gracefully — no sensitive error details exposed to users", "critical": false },
-    { "id": "ai_owasp_llm_top10", "description": "OWASP LLM Top 10 controls reviewed and addressed for this AI surface", "critical": true }
+    { "id": "ai_owasp_llm_top10", "description": "OWASP LLM Top 10 controls reviewed and addressed for this AI surface", "critical": true },
+    { "id": "ai_context_session_isolation", "description": "Per-user session context is strictly isolated — no cross-user context bleed in multi-tenant deployments; conversation history scoped to authenticated user ID", "critical": true },
+    { "id": "ai_adversarial_probe_multi_turn", "description": "Multi-turn adversarial probing complete: role-play escapes, many-shot jailbreaks, encoded payloads (base64, l33tspeak), goal hijacking across conversation resets — all documented with pass/fail", "critical": true },
+    { "id": "ai_tool_sandboxing", "description": "AI agent tool execution sandboxed — filesystem, network, and shell access granted only via explicit allowlist; no ambient authority; each tool call requires declared capability", "critical": true },
+    { "id": "ai_model_supply_chain", "description": "AI model provider and version verified — model hash or digest pinned in configuration; shadow model substitution would be detected; provider SLA and security posture documented", "critical": false },
+    { "id": "ai_output_length_limit", "description": "Model output length limits enforced at the API layer; unbounded generation that could exhaust context or enable token flooding is blocked; streaming responses have an abort timeout", "critical": true },
+    { "id": "ai_indirect_injection_external", "title": "External content ingestion paths sanitize fetched content before LLM context injection", "severity": "critical", "automated": true },
+    { "id": "ai_markdown_exfil", "title": "LLM output stripped of markdown images and external links before rendering to clients", "severity": "critical", "automated": true },
+    { "id": "ai_memory_poisoning", "title": "Long-term memory writes validated; read-back treated as untrusted input with injection guards", "severity": "critical", "automated": true },
+    { "id": "ai_rag_corpus_poisoning", "title": "Documents ingested into vector store pass content validation and injection scanning before upsert", "severity": "high", "automated": true },
+    { "id": "ai_token_smuggling", "title": "User prompt inputs stripped of zero-width Unicode, invisible characters, and homoglyphs before processing", "severity": "high", "automated": true },
+    { "id": "ai_privilege_escalation", "title": "Agent tool list frozen at session initialization — no runtime tool registration permitted", "severity": "critical", "automated": true },
+    { "id": "ai_llm_judge_manipulation", "title": "LLM-as-judge evaluation pipelines use static server-controlled scoring criteria isolated from user input", "severity": "high", "automated": true },
+    { "id": "ai_idor_tool_calls", "title": "Agentic tool calls that accept resource IDs enforce per-request authorization before accessing the resource", "severity": "critical", "automated": true },
+    { "id": "ai_context_stuffing", "title": "Application enforces maximum input token budget per request before dispatching to LLM API", "severity": "high", "automated": true },
+    { "id": "ai_multimodal_injection", "title": "Multimodal inputs (images, PDFs, audio) passed to vision/multimodal LLMs scanned for embedded injection payloads", "severity": "critical", "automated": true },
+    { "id": "ai_vector_filter_bypass", "title": "Vector store tenant isolation uses mandatory hard filters (must/AND) not optional soft filters (should/OR)", "severity": "high", "automated": true },
+    { "id": "ai_stream_chunk_validation", "title": "Streaming LLM response chunks validated against expected SSE schema before forwarding", "severity": "high", "automated": true },
+    { "id": "ai_generated_code_audit_trail", "title": "Every execution of AI-generated code, SQL, or shell commands produces an audit log entry", "severity": "high", "automated": true },
+    { "id": "ai_embedding_inversion", "title": "Raw embedding vectors never exposed in API responses, logs, or client storage", "severity": "medium", "automated": true }
   ]
 }

package/defaults/checklists/api.json

@@ -22,6 +22,40 @@
     { "id": "api_secrets_scan", "description": "Secrets scan clean — no hardcoded credentials or API keys", "critical": true },
     { "id": "api_sast_pass", "description": "SAST scan passed with no CRITICAL findings", "critical": true },
     { "id": "api_threat_model", "description": "Threat model completed and reviewed for this API surface change", "critical": true },
-    { "id": "api_health_endpoint", "description": "Health/readiness endpoints do not expose sensitive version or config info", "critical": false }
+    { "id": "api_health_endpoint", "description": "Health/readiness endpoints do not expose sensitive version or config info", "critical": false },
+    { "id": "api_graphql_introspection", "description": "GraphQL introspection disabled in production; query depth limit ≤ 10 and complexity budget enforced to prevent resource exhaustion", "critical": true },
+    { "id": "api_idempotency_replay", "description": "Financial and state-changing endpoints protected against replay via idempotency keys or HMAC-timestamped signatures with a time-bound window ≤ 5 minutes", "critical": true },
+    { "id": "api_command_injection", "description": "No user-controlled input passed to child_process.exec, execSync, spawn with shell:true, or any shell interpreter — allowlisted command templates only", "critical": true },
+    { "id": "api_file_upload_validation", "description": "File upload endpoints enforce MIME type server-side (not by extension), max file size, extension allowlist, and malware scanning; files stored outside web root", "critical": true },
+    { "id": "api_timing_safe_equality", "description": "All sensitive equality checks (tokens, reset codes, HMAC digests, API keys) use crypto.timingSafeEqual — no string ===, indexOf, or includes comparisons", "critical": true },
+    { "id": "api_second_order_injection", "title": "Second-order injection prevention reviewed — data retrieved from DB never passed unsanitized to SQL/template/shell sinks", "severity": "critical", "automated": true },
+    { "id": "api_spel_ognl_injection", "title": "SpEL/OGNL/MVEL expression parsers do not evaluate user-controlled input", "severity": "critical", "automated": true },
+    { "id": "api_pickle_marshal_deserialization", "title": "Python pickle.loads/Marshal.load/PHP unserialize never called on user-supplied data", "severity": "critical", "automated": true },
+    { "id": "api_java_deserialization", "title": "Java ObjectInputStream.readObject/XStream/Kryo deserialization never used with untrusted data", "severity": "critical", "automated": true },
+    { "id": "api_elasticsearch_injection", "title": "Elasticsearch query_string and script.source do not include user input", "severity": "high", "automated": true },
+    { "id": "api_websocket_message_injection", "title": "WebSocket message handlers validate all incoming data before passing to sinks", "severity": "high", "automated": true },
+    { "id": "api_grpc_protobuf_validation", "title": "gRPC/Protobuf endpoints validate all message fields after deserialization", "severity": "high", "automated": true },
+    { "id": "api_nosql_field_injection", "title": "MongoDB query field values validated as scalar types — $gt/$regex stripped from user input", "severity": "high", "automated": true },
+    { "id": "api_http_response_splitting", "title": "HTTP response splitting prevented — writeHead/headers.set never include user CRLF sequences", "severity": "high", "automated": true },
+    { "id": "api_document_injection", "title": "PDF/Office document generation libraries sanitize user input — no formula injection (=CMD, =DDE)", "severity": "high", "automated": true },
+    { "id": "api_bracket_notation_pollution", "title": "Dynamic property assignment using user-controlled keys forbidden — bracket notation obj[userKey] validated", "severity": "high", "automated": true },
+    { "id": "api_jwt_kid_injection", "title": "JWT kid header sanitised before DB lookup or filesystem access", "severity": "critical", "automated": true },
+    { "id": "api_jwt_jwks_uri_pinned", "title": "JWKS URI pinned to static allowlist — token-supplied jwks_uri not followed", "severity": "critical", "automated": true },
+    { "id": "api_oauth_client_secret_hardcoded", "title": "OAuth client_secret not hardcoded in client-side code — public clients use PKCE only", "severity": "critical", "automated": true },
+    { "id": "api_session_token_in_url", "title": "Session identifiers never transmitted in URL query parameters", "severity": "high", "automated": true },
+    { "id": "api_token_entropy", "title": "Session and reset tokens generated with ≥ 16 bytes (128 bits) of cryptographic randomness", "severity": "high", "automated": true },
+    { "id": "api_remember_me_rotation", "title": "Persistent remember-me tokens rotated on each use, stored hashed server-side, hard-expired ≤ 30 days", "severity": "high", "automated": true },
+    { "id": "api_password_reset_single_use", "title": "Password reset tokens deleted or nullified immediately after first use", "severity": "high", "automated": true },
+    { "id": "api_account_enumeration", "title": "Login and password-reset endpoints return identical responses for invalid user vs. invalid credential", "severity": "medium", "automated": true },
+    { "id": "api_bcrypt_cost_factor", "title": "bcrypt cost factor ≥ 12 for all password hashing operations", "severity": "high", "automated": true },
+    { "id": "api_zero_iv", "title": "No all-zero or zero-filled IVs used in cipher operations — IVs generated with crypto.randomBytes", "severity": "critical", "automated": true },
+    { "id": "api_rsa_key_size", "title": "RSA key generation uses ≥ 2048 bits — no sub-2048 key sizes", "severity": "critical", "automated": true },
+    { "id": "api_dh_params", "title": "Diffie-Hellman parameters ≥ 2048 bits — no weak DH groups (modp1/2/5)", "severity": "high", "automated": true },
+    { "id": "api_forward_secrecy", "title": "TLS cipher suites require ECDHE or DHE — forward secrecy enforced", "severity": "high", "automated": true },
+    { "id": "api_graphql_resolver_injection", "title": "GraphQL resolver arguments never concatenated into raw SQL/NoSQL queries", "severity": "critical", "automated": true },
+    { "id": "api_graphql_batching", "title": "GraphQL alias count limited per request (≤ 15) — batching-based enumeration and DoS prevented", "severity": "high", "automated": true },
+    { "id": "api_sse_injection", "title": "Server-Sent Events streams strip \\r\\n from user-controlled data before writing", "severity": "high", "automated": true },
+    { "id": "api_oauth_referer_leakage", "title": "Referrer-Policy: no-referrer set on pages that receive OAuth tokens; tokens not in URL query params", "severity": "high", "automated": true },
+    { "id": "api_pagination_bounds", "title": "Pagination parameters (limit, offset, page) validated with minimum 1, maximum cap, non-negative enforcement", "severity": "medium", "automated": true }
   ]
 }

package/defaults/checklists/infra.json

@@ -22,6 +22,39 @@
     { "id": "infra_provenance", "description": "SLSA provenance attestation generated for release artifacts", "critical": false },
     { "id": "infra_threat_model", "description": "Threat model completed and reviewed for this infrastructure change", "critical": true },
     { "id": "infra_zero_trust", "description": "Zero Trust controls applied — explicit authentication for all service-to-service calls", "critical": true },
-    { "id": "infra_ddos_protection", "description": "DDoS protection enabled for public-facing load balancers", "critical": false }
+    { "id": "infra_ddos_protection", "description": "DDoS protection enabled for public-facing load balancers", "critical": false },
+    { "id": "infra_imdsv2_enforced", "description": "IMDSv2 enforced on all EC2/cloud instances (hop limit 1, token required); SSRF to 169.254.169.254 blocked at network layer — prevents cloud metadata credential theft", "critical": true },
+    { "id": "infra_egress_filtering", "description": "Egress network filtering restricts outbound connections to known-good destinations; unexpected outbound traffic triggers alerts within 15 minutes", "critical": true },
+    { "id": "infra_pod_security_standards", "description": "Kubernetes pods run with Restricted security context: runAsNonRoot, readOnlyRootFilesystem, allowPrivilegeEscalation:false, seccomp profile enforced", "critical": true },
+    { "id": "infra_secret_rotation", "description": "All secrets and credentials have automated rotation policy with maximum rotation interval documented and enforced; rotation failures trigger immediate alerts", "critical": true },
+    { "id": "infra_runtime_threat_detection", "description": "Runtime threat detection enabled (Falco, GuardDuty, Defender for Cloud, or equivalent) on all compute; anomalies generate alerts within 15 minutes with documented runbook", "critical": false },
+    { "id": "infra_imdsv1_accessible", "title": "IMDSv1 disabled — http_tokens=required enforced on all EC2 instances", "severity": "critical", "automated": true },
+    { "id": "infra_lambda_url_no_auth", "title": "Lambda function URLs not configured with AuthType NONE", "severity": "critical", "automated": true },
+    { "id": "infra_ecr_scan_on_push", "title": "ECR repositories have scan-on-push enabled", "severity": "high", "automated": true },
+    { "id": "infra_ecs_host_network", "title": "ECS tasks do not use host network mode", "severity": "high", "automated": true },
+    { "id": "infra_cloudtrail_multiregion", "title": "CloudTrail configured as multi-region trail", "severity": "high", "automated": true },
+    { "id": "infra_s3_access_logging", "title": "S3 server access logging enabled on all sensitive buckets", "severity": "medium", "automated": true },
+    { "id": "infra_vpc_flow_logs", "title": "VPC flow logs enabled", "severity": "medium", "automated": true },
+    { "id": "infra_cross_account_external_id", "title": "Cross-account IAM trust policies include sts:ExternalId condition", "severity": "high", "automated": true },
+    { "id": "infra_gcp_default_service_account", "title": "GCP instances do not use the default Compute Engine service account", "severity": "high", "automated": true },
+    { "id": "infra_gcp_project_ssh_keys", "title": "No GCP project-level SSH keys configured", "severity": "medium", "automated": true },
+    { "id": "infra_gcp_external_ip", "title": "GCP compute instances without external IPs unless required", "severity": "medium", "automated": true },
+    { "id": "infra_azure_public_network_access", "title": "Azure resources do not have public_network_access_enabled=true unless required", "severity": "high", "automated": true },
+    { "id": "infra_deletion_protection", "title": "All databases and stateful resources have deletion_protection=true", "severity": "high", "automated": true },
+    { "id": "infra_vpc_endpoint_s3_ecr", "title": "VPC endpoints configured for S3/ECR — service traffic does not route over public internet", "severity": "medium", "automated": true },
+    { "id": "infra_guardduty_enabled", "title": "AWS GuardDuty enabled in all regions", "severity": "high", "automated": true },
+    { "id": "infra_security_hub_enabled", "title": "AWS Security Hub enabled for centralized findings aggregation", "severity": "medium", "automated": true },
+    { "id": "k8s_run_as_root", "title": "Kubernetes containers do not run as root (runAsUser: 0)", "severity": "high", "automated": true },
+    { "id": "k8s_capabilities_not_dropped", "title": "Container capabilities fully dropped (capabilities.drop: [ALL])", "severity": "high", "automated": true },
+    { "id": "k8s_nodeport_exposure", "title": "No NodePort services exposing sensitive internal services", "severity": "medium", "automated": true },
+    { "id": "k8s_tiller_helm_v2", "title": "Helm v2 Tiller not deployed in cluster", "severity": "critical", "automated": true },
+    { "id": "k8s_docker_socket_mount", "title": "Docker socket not mounted inside any Kubernetes pod", "severity": "critical", "automated": true },
+    { "id": "k8s_api_anonymous_auth", "title": "Kubernetes API server anonymous-auth disabled", "severity": "critical", "automated": true },
+    { "id": "k8s_mtls_not_strict", "title": "Istio/Linkerd PeerAuthentication enforces STRICT mTLS mode", "severity": "high", "automated": true },
+    { "id": "docker_no_user_directive", "title": "All Dockerfiles include USER directive — containers do not run as root", "severity": "high", "automated": true },
+    { "id": "docker_add_url_no_integrity", "title": "Dockerfiles do not use ADD with remote URLs without integrity verification", "severity": "high", "automated": true },
+    { "id": "docker_secrets_in_env", "title": "No secrets in Dockerfile ENV instructions", "severity": "critical", "automated": true },
+    { "id": "docker_privileged_flag", "title": "No containers started with --privileged or privileged:true", "severity": "critical", "automated": true },
+    { "id": "docker_socket_mount", "title": "Docker socket not mounted into any container", "severity": "critical", "automated": true }
   ]
 }