security-mcp 1.1.4 → 1.3.1

package/dist/gate/checks/graphql.js

@@ -6,6 +6,191 @@ import { sanitizeErrorMessage } from "../result.js";
 import { searchRepo } from "../../repo/search.js";
 import fg from "fast-glob";
 import { readFileSafe } from "../../repo/fs.js";
+async function checkGraphqlIntrospection() {
+    const findings = [];
+    // Find GraphQL server instantiation sites
+    const serverHits = await searchRepo({
+        query: String.raw `ApolloServer|createServer|buildSchema|makeExecutableSchema|new GraphQL`,
+        isRegex: true,
+        maxMatches: 200
+    });
+    if (serverHits.length === 0)
+        return findings;
+    // Check for explicit disabling of introspection near server setup
+    const disableHits = await searchRepo({
+        query: String.raw `introspection\s*:\s*false|disableIntrospection|NoIntrospection|validationRules.*introspection`,
+        isRegex: true,
+        maxMatches: 200
+    });
+    // Check for introspection: true explicitly set
+    const alwaysOnHits = await searchRepo({
+        query: String.raw `introspection\s*:\s*true`,
+        isRegex: true,
+        maxMatches: 200
+    });
+    // Filter always-on hits that have no NODE_ENV guard
+    const unguardedAlwaysOn = alwaysOnHits.filter((m) => !/NODE_ENV|process\.env/i.test(m.preview));
+    if (unguardedAlwaysOn.length > 0) {
+        findings.push({
+            id: "GRAPHQL_INTROSPECTION_ALWAYS_ON",
+            title: "GraphQL introspection is explicitly enabled without a NODE_ENV guard",
+            severity: "CRITICAL",
+            evidence: unguardedAlwaysOn.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+            files: [...new Set(unguardedAlwaysOn.slice(0, 10).map((m) => m.file))],
+            requiredActions: [
+                "Disable introspection unconditionally in production.",
+                "Use `introspection: process.env.NODE_ENV !== 'production'` at minimum."
+            ]
+        });
+    }
+    else if (disableHits.length === 0) {
+        // Server setup found but introspection is not explicitly disabled
+        findings.push({
+            id: "GRAPHQL_INTROSPECTION_ENABLED",
+            title: "GraphQL introspection is enabled by default; ensure it is disabled in production with `introspection: process.env.NODE_ENV !== 'production'`",
+            severity: "HIGH",
+            evidence: serverHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+            files: [...new Set(serverHits.slice(0, 10).map((m) => m.file))],
+            requiredActions: [
+                "Disable introspection in non-dev environments.",
+                "Use persisted queries instead of ad-hoc introspection in production."
+            ]
+        });
+    }
+    return findings;
+}
+async function checkGraphqlAliasAmplification(graphqlInUse) {
+    if (!graphqlInUse)
+        return [];
+    const findings = [];
+    const complexityHits = await searchRepo({
+        query: String.raw `complexityPlugin|costAnalysis|queryComplexity|createComplexityRule`,
+        isRegex: true,
+        maxMatches: 200
+    });
+    if (complexityHits.length === 0) {
+        findings.push({
+            id: "GRAPHQL_NO_COMPLEXITY_LIMIT",
+            title: "No GraphQL query complexity limiter detected",
+            severity: "HIGH",
+            requiredActions: [
+                "Add graphql-query-complexity or graphql-cost-analysis to limit query cost.",
+                "Set a maximum complexity budget to prevent amplified alias abuse."
+            ]
+        });
+        return findings;
+    }
+    // Complexity limiter found — check if it accounts for aliases
+    const aliasHits = await searchRepo({
+        query: String.raw `aliasCost|aliasMultiplier|alias.*cost|fieldCost.*alias`,
+        isRegex: true,
+        maxMatches: 200
+    });
+    if (aliasHits.length === 0) {
+        findings.push({
+            id: "GRAPHQL_ALIAS_AMPLIFICATION",
+            title: "GraphQL complexity limiter found but alias cost not configured — alias amplification attacks possible",
+            severity: "HIGH",
+            evidence: complexityHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+            files: [...new Set(complexityHits.slice(0, 10).map((m) => m.file))],
+            requiredActions: [
+                "Configure alias cost or alias multiplier in the complexity plugin.",
+                "Without alias accounting, attackers can use field aliasing to bypass complexity limits."
+            ]
+        });
+    }
+    return findings;
+}
+async function checkGraphqlResolverInjection() {
+    const findings = [];
+    const resolverInjectionHits = await searchRepo({
+        query: String.raw `(?:resolve|resolver)\s*\([^)]*\)\s*\{[^}]*(?:SELECT|INSERT|UPDATE|DELETE|\$where|\$regex|aggregate)\s*['"].*\$\{args\.`,
+        isRegex: true,
+        maxMatches: 200
+    });
+    const resolverInjectionBroadHits = await searchRepo({
+        query: String.raw `resolve.*\{[^}]*(?:SELECT|INSERT)[^}]*\$\{args`,
+        isRegex: true,
+        maxMatches: 200
+    });
+    const allHits = [...resolverInjectionHits, ...resolverInjectionBroadHits];
+    const uniqueHits = allHits.filter((hit, idx, arr) => arr.findIndex((h) => h.file === hit.file && h.line === hit.line) === idx);
+    if (uniqueHits.length > 0) {
+        findings.push({
+            id: "GRAPHQL_RESOLVER_INJECTION",
+            title: "GraphQL resolver argument concatenated into raw SQL/NoSQL query — injection via resolver args (CWE-89/CWE-943)",
+            severity: "CRITICAL",
+            evidence: uniqueHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+            files: [...new Set(uniqueHits.slice(0, 10).map((m) => m.file))],
+            requiredActions: [
+                "Never interpolate resolver args directly into SQL or NoSQL queries.",
+                "Use parameterized queries or an ORM to pass resolver arguments safely.",
+                "Validate and sanitize all args before use in any query expression."
+            ]
+        });
+    }
+    return findings;
+}
+async function checkGraphqlAliasBatching() {
+    const findings = [];
+    const serverHits = await searchRepo({
+        query: String.raw `(?:ApolloServer|makeExecutableSchema|buildSchema|graphqlHTTP)\s*\(`,
+        isRegex: true,
+        maxMatches: 200
+    });
+    if (serverHits.length === 0)
+        return findings;
+    const aliasLimitHits = await searchRepo({
+        query: String.raw `(?:maxAliasCount|depthLimit|complexityLimit|queryComplexity|fieldExtensions.*complexity)`,
+        isRegex: true,
+        maxMatches: 200
+    });
+    if (aliasLimitHits.length === 0) {
+        findings.push({
+            id: "GRAPHQL_ALIAS_BATCHING",
+            title: "GraphQL server without alias count limit — N+1 batching enables account enumeration and DoS (CWE-770)",
+            severity: "HIGH",
+            evidence: serverHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+            files: [...new Set(serverHits.slice(0, 10).map((m) => m.file))],
+            requiredActions: [
+                "Add a maxAliasCount or equivalent alias limit to the GraphQL server configuration.",
+                "Use graphql-query-complexity or graphql-depth-limit to bound alias expansion.",
+                "Without limits, attackers can batch aliased fields to enumerate data or exhaust backend resources."
+            ]
+        });
+    }
+    return findings;
+}
+async function checkGraphqlCircularFragments(graphqlInUse) {
+    if (!graphqlInUse)
+        return [];
+    const findings = [];
+    const fragmentProtectionHits = await searchRepo({
+        query: String.raw `NoSchemaIntrospectionCustomRule|maxFragmentDepth|FragmentDepthLimit`,
+        isRegex: true,
+        maxMatches: 200
+    });
+    const validationRulesHits = await searchRepo({
+        query: String.raw `specifiedRules|validationRules`,
+        isRegex: true,
+        maxMatches: 200
+    });
+    const hasFragmentProtection = fragmentProtectionHits.length > 0 ||
+        validationRulesHits.some((m) => /maxFragmentDepth|FragmentDepthLimit/i.test(m.preview));
+    if (!hasFragmentProtection) {
+        findings.push({
+            id: "GRAPHQL_CIRCULAR_FRAGMENT_RISK",
+            title: "No GraphQL fragment depth limiting detected — circular fragment DoS risk",
+            severity: "MEDIUM",
+            requiredActions: [
+                "Add fragment depth limiting via a custom validation rule.",
+                "Use graphql-depth-limit or implement NoSchemaIntrospectionCustomRule with fragment cycle detection.",
+                "Circular fragments can be used to exhaust server resources."
+            ]
+        });
+    }
+    return findings;
+}
 export async function checkGraphQL(_opts) {
     const findings = [];
     try {
@@ -18,25 +203,10 @@ export async function checkGraphQL(_opts) {
         if (graphqlHits.length === 0) {
             return [];
         }
-        // 2. Introspection enabled in prod
-        const introspectionHits = await searchRepo({
-            query: String.raw `introspection.*true|disableIntrospection.*false|GraphQLSchema.*introspection`,
-            isRegex: true,
-            maxMatches: 200
-        });
-        if (introspectionHits.length > 0) {
-            findings.push({
-                id: "GRAPHQL_INTROSPECTION_ENABLED",
-                title: "GraphQL introspection is enabled — exposes full schema to attackers",
-                severity: "HIGH",
-                evidence: introspectionHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
-                files: [...new Set(introspectionHits.slice(0, 10).map((m) => m.file))],
-                requiredActions: [
-                    "Disable introspection in non-dev environments.",
-                    "Use persisted queries instead of ad-hoc introspection in production."
-                ]
-            });
-        }
+        const graphqlInUse = true;
+        // 2. Introspection check (corrected: fire when NOT explicitly disabled)
+        const introspectionFindings = await checkGraphqlIntrospection();
+        findings.push(...introspectionFindings);
         // 3. No query depth/complexity limiting
         const depthLimitHits = await searchRepo({
             query: String.raw `depthLimit|complexityLimit|queryComplexity|createComplexityRule|maxDepth`,
@@ -119,6 +289,18 @@ export async function checkGraphQL(_opts) {
                 ]
             });
         }
+        // 7. Alias amplification detection
+        const aliasFindings = await checkGraphqlAliasAmplification(graphqlInUse);
+        findings.push(...aliasFindings);
+        // 8. Circular fragment protection
+        const fragmentFindings = await checkGraphqlCircularFragments(graphqlInUse);
+        findings.push(...fragmentFindings);
+        // 9. Resolver injection
+        const resolverInjectionFindings = await checkGraphqlResolverInjection();
+        findings.push(...resolverInjectionFindings);
+        // 10. Alias batching without limit
+        const aliasBatchingFindings = await checkGraphqlAliasBatching();
+        findings.push(...aliasBatchingFindings);
     }
     catch (err) {
         console.warn("[checkGraphQL] Internal error:", sanitizeErrorMessage(err instanceof Error ? err.message : String(err)));

package/dist/gate/checks/infra.js

@@ -24,7 +24,7 @@ const IAM_WILDCARD_PATTERN = String.raw `"Action"\s*:\s*"\*"|` + // AWS IAM wild
     String.raw `roles/owner|roles/editor|` + // GCP over-privileged built-in roles
     String.raw `allUsers|allAuthenticatedUsers|` + // GCP public IAM
     String.raw `"role"\s*:\s*"roles/owner"|` + // GCP Terraform owner binding
-    String.raw `contributor|Owner\b.*roleDefinitionId`; // Azure Contributor/Owner
+    String.raw `\bContributor\b.*roleDefinitionId|\bOwner\b.*roleDefinitionId`; // Azure Contributor/Owner (word-bounded to avoid matching variable names)
 // Public network exposure — Terraform, K8s, CloudFormation, ARM, CDK
 const PUBLIC_INGRESS_PATTERN = String.raw `0\.0\.0\.0/0|::/0|` +
     String.raw `public\s*=\s*true|` +
@@ -148,5 +148,250 @@ export async function checkInfra(_) {
             ]
         });
     }
+    // 6–16. Additional cloud-specific checks (all searches run in parallel)
+    const [imdsv1Results, lambdaUrlNoAuthResults, ecrNoScanResults, ecsHostNetworkResults, cloudtrailNotMultiregionResults, s3NoAccessLoggingResults, vpcNoFlowLogsResults, assumeRoleResults, externalIdResults, gcpDefaultSaResults, gcpProjectSshResults, gcpExternalIpResults, azurePublicNetworkResults, dbNoDeletionProtectionResults, vpcEndpointResults, awsInfraResults, guarddutyResults, securityHubResults,] = await Promise.all([
+        // hop_limit [2-9] misses values >= 10; use \d{2,}|[2-9] to catch all insecure values
+        searchRepo({ query: String.raw `http_tokens\s*=\s*"optional"|http_put_response_hop_limit\s*=\s*(?:[2-9]|\d{2,})`, isRegex: true, maxMatches: 200 }),
+        searchRepo({ query: String.raw `(?:FunctionUrlAuthType|authorization_type)\s*[=:]\s*"NONE"`, isRegex: true, maxMatches: 200 }),
+        searchRepo({ query: String.raw `scan_on_push\s*=\s*false`, isRegex: true, maxMatches: 200 }),
+        searchRepo({ query: String.raw `(?:network_mode|networkMode)\s*[=:]\s*"host"`, isRegex: true, maxMatches: 200 }),
+        searchRepo({ query: String.raw `is_multi_region_trail\s*=\s*false|"IsMultiRegionTrail"\s*:\s*false`, isRegex: true, maxMatches: 200 }),
+        searchRepo({ query: String.raw `"LoggingEnabled"\s*:\s*\{\s*\}|target_bucket\s*=\s*""`, isRegex: true, maxMatches: 200 }),
+        // aws_vpc has no enable_flow_log attr; use aws_flow_log resource absence as the signal instead
+        searchRepo({ query: String.raw `aws_flow_log`, isRegex: true, maxMatches: 200 }),
+        searchRepo({ query: String.raw `"Action"\s*:\s*"sts:AssumeRole"`, isRegex: true, maxMatches: 200 }),
+        searchRepo({ query: String.raw `sts:ExternalId`, isRegex: true, maxMatches: 200 }),
+        searchRepo({ query: String.raw `-compute@developer\.gserviceaccount\.com`, isRegex: true, maxMatches: 200 }),
+        searchRepo({ query: String.raw `"ssh-keys"\s*:`, isRegex: true, maxMatches: 200 }),
+        // access_config {} catches only ephemeral IPs; access_config { nat_ip = ... } (static) also exposes external IP
+        searchRepo({ query: String.raw `access_config\s*\{`, isRegex: true, maxMatches: 200 }),
+        searchRepo({ query: String.raw `public_network_access_enabled\s*=\s*true`, isRegex: true, maxMatches: 200 }),
+        searchRepo({ query: String.raw `(?:deletion_protection|enable_deletion_protection)\s*=\s*false`, isRegex: true, maxMatches: 200 }),
+        searchRepo({ query: String.raw `aws_vpc_endpoint`, isRegex: true, maxMatches: 200 }),
+        searchRepo({ query: String.raw `aws_(?:instance|ecs_service|lambda_function)`, isRegex: true, maxMatches: 200 }),
+        searchRepo({ query: String.raw `aws_guardduty_detector`, isRegex: true, maxMatches: 200 }),
+        searchRepo({ query: String.raw `aws_securityhub_account`, isRegex: true, maxMatches: 200 }),
+    ]);
+    // 6. IMDSv1 accessible
+    if (imdsv1Results.length > 0) {
+        findings.push({
+            id: "INFRA_IMDSV1_ACCESSIBLE",
+            title: "IMDSv1 still accessible on EC2 — SSRF attackers can reach 169.254.169.254 for IAM credentials",
+            severity: "CRITICAL",
+            evidence: imdsv1Results.slice(0, 20).map((m) => `${m.file}:${m.line}: ${m.preview}`),
+            requiredActions: [
+                "Set http_tokens = \"required\" on all aws_instance and launch template resources.",
+                "Set http_put_response_hop_limit = 1 to prevent hop-based SSRF escalation.",
+                "Enforce IMDSv2-only at the AWS account level via EC2 default metadata options."
+            ]
+        });
+    }
+    // 7. Lambda URL no auth
+    if (lambdaUrlNoAuthResults.length > 0) {
+        findings.push({
+            id: "INFRA_LAMBDA_URL_NO_AUTH",
+            title: "Lambda function URL with no authentication — publicly invocable by anyone",
+            severity: "CRITICAL",
+            evidence: lambdaUrlNoAuthResults.slice(0, 20).map((m) => `${m.file}:${m.line}: ${m.preview}`),
+            requiredActions: [
+                "Set authorization_type = \"AWS_IAM\" on all aws_lambda_function_url resources.",
+                "Use a CloudFront distribution with signed URLs or an API Gateway with IAM/Cognito auth as an alternative.",
+                "If public invocation is intentional, add CORS restrictions and rate limiting."
+            ]
+        });
+    }
+    // 8. ECR scan on push disabled
+    if (ecrNoScanResults.length > 0) {
+        findings.push({
+            id: "INFRA_ECR_NO_SCAN",
+            title: "ECR scan-on-push disabled — container images deployed without CVE scanning",
+            severity: "HIGH",
+            evidence: ecrNoScanResults.slice(0, 20).map((m) => `${m.file}:${m.line}: ${m.preview}`),
+            requiredActions: [
+                "Set scan_on_push = true on all aws_ecr_repository resources.",
+                "Enable ECR Enhanced Scanning (Inspector-based) for continuous vulnerability monitoring.",
+                "Gate deployments on zero critical/high CVEs using CI checks against ECR scan results."
+            ]
+        });
+    }
+    // 9. ECS host network
+    if (ecsHostNetworkResults.length > 0) {
+        findings.push({
+            id: "INFRA_ECS_HOST_NETWORK",
+            title: "ECS task using host network mode — bypasses container network isolation",
+            severity: "HIGH",
+            evidence: ecsHostNetworkResults.slice(0, 20).map((m) => `${m.file}:${m.line}: ${m.preview}`),
+            requiredActions: [
+                "Use network_mode = \"awsvpc\" for Fargate or bridge mode for EC2 ECS tasks.",
+                "Host networking exposes all host ports to the container — remove unless strictly required.",
+                "Apply security groups at the task level when using awsvpc mode."
+            ]
+        });
+    }
+    // 10. CloudTrail not multi-region
+    if (cloudtrailNotMultiregionResults.length > 0) {
+        findings.push({
+            id: "INFRA_CLOUDTRAIL_NOT_MULTIREGION",
+            title: "CloudTrail is not multi-region — attacker actions in secondary regions go unlogged",
+            severity: "HIGH",
+            evidence: cloudtrailNotMultiregionResults.slice(0, 20).map((m) => `${m.file}:${m.line}: ${m.preview}`),
+            requiredActions: [
+                "Set is_multi_region_trail = true on all aws_cloudtrail resources.",
+                "Enable CloudTrail in all opted-in regions including global service events.",
+                "Send CloudTrail logs to a dedicated, cross-account S3 bucket with MFA delete enabled."
+            ]
+        });
+    }
+    // 11. S3 server access logging disabled
+    if (s3NoAccessLoggingResults.length > 0) {
+        findings.push({
+            id: "INFRA_S3_NO_ACCESS_LOGGING",
+            title: "S3 server access logging not enabled — exfiltration events undetectable post-incident",
+            severity: "MEDIUM",
+            evidence: s3NoAccessLoggingResults.slice(0, 20).map((m) => `${m.file}:${m.line}: ${m.preview}`),
+            requiredActions: [
+                "Configure server access logging on all S3 buckets by specifying a target_bucket.",
+                "Use AWS CloudTrail data events as a supplementary audit trail for S3 object-level operations.",
+                "Retain access logs for at least 90 days and ship to a SIEM for alerting."
+            ]
+        });
+    }
+    // 12. VPC flow logs missing (absence check: AWS infra present but no aws_flow_log resource found)
+    if (awsInfraResults.length > 0 && vpcNoFlowLogsResults.length === 0) {
+        findings.push({
+            id: "INFRA_VPC_NO_FLOW_LOGS",
+            title: "No aws_flow_log resource found — VPC network traffic is unlogged, lateral movement and exfiltration undetectable",
+            severity: "MEDIUM",
+            requiredActions: [
+                "Add an aws_flow_log resource for each VPC and ship logs to CloudWatch Logs or S3.",
+                "Set flow log aggregation interval to 1 minute for near-real-time detection.",
+                "Create CloudWatch metric filters and alarms for rejected traffic spikes."
+            ]
+        });
+    }
+    // 13. Cross-account trust without ExternalId
+    if (assumeRoleResults.length > 0 && externalIdResults.length === 0) {
+        findings.push({
+            id: "INFRA_CROSS_ACCOUNT_NO_EXTERNAL_ID",
+            title: "Cross-account IAM trust without sts:ExternalId condition — confused deputy attack possible",
+            severity: "HIGH",
+            evidence: assumeRoleResults.slice(0, 20).map((m) => `${m.file}:${m.line}: ${m.preview}`),
+            requiredActions: [
+                "Add a Condition block with sts:ExternalId to all cross-account AssumeRole trust policies.",
+                "Use a unique, unguessable ExternalId per third-party relationship and rotate periodically.",
+                "Audit all cross-account role trusts with AWS IAM Access Analyzer."
+            ]
+        });
+    }
+    // 14. GCP default service account
+    if (gcpDefaultSaResults.length > 0) {
+        findings.push({
+            id: "INFRA_GCP_DEFAULT_SERVICE_ACCOUNT",
+            title: "GCP instance uses default Compute Engine service account — broad project-level API permissions",
+            severity: "HIGH",
+            evidence: gcpDefaultSaResults.slice(0, 20).map((m) => `${m.file}:${m.line}: ${m.preview}`),
+            requiredActions: [
+                "Create a dedicated, least-privilege service account for each GCP compute resource.",
+                "Disable the default Compute Engine service account or remove the Editor role binding.",
+                "Use Workload Identity Federation instead of service account keys where possible."
+            ]
+        });
+    }
+    // 15. GCP project-level SSH keys
+    if (gcpProjectSshResults.length > 0) {
+        findings.push({
+            id: "INFRA_GCP_PROJECT_SSH_KEYS",
+            title: "GCP project-level SSH keys set — single key compromise grants access to all instances",
+            severity: "MEDIUM",
+            evidence: gcpProjectSshResults.slice(0, 20).map((m) => `${m.file}:${m.line}: ${m.preview}`),
+            requiredActions: [
+                "Remove project-level SSH keys from project metadata and use instance-level keys only.",
+                "Prefer OS Login over metadata-based SSH keys for centralized IAM-controlled access.",
+                "Rotate any existing project-level SSH keys immediately and audit which instances they reached."
+            ]
+        });
+    }
+    // 16. GCP compute external IP
+    if (gcpExternalIpResults.length > 0) {
+        findings.push({
+            id: "INFRA_GCP_EXTERNAL_IP",
+            title: "GCP compute instance has external IP — directly internet-reachable without load balancer",
+            severity: "MEDIUM",
+            evidence: gcpExternalIpResults.slice(0, 20).map((m) => `${m.file}:${m.line}: ${m.preview}`),
+            requiredActions: [
+                "Remove access_config blocks from google_compute_instance resources to disable external IPs.",
+                "Route traffic through a GCP Cloud Load Balancer or Cloud NAT instead of direct external IPs.",
+                "Use Identity-Aware Proxy (IAP) for admin access rather than exposing SSH/RDP externally."
+            ]
+        });
+    }
+    // 17. Azure public network access
+    if (azurePublicNetworkResults.length > 0) {
+        findings.push({
+            id: "INFRA_AZURE_PUBLIC_NETWORK_ACCESS",
+            title: "Azure managed service with public_network_access_enabled=true — reachable from internet",
+            severity: "HIGH",
+            evidence: azurePublicNetworkResults.slice(0, 20).map((m) => `${m.file}:${m.line}: ${m.preview}`),
+            requiredActions: [
+                "Set public_network_access_enabled = false on all Azure managed services.",
+                "Use Private Endpoints and Private DNS Zones for internal connectivity.",
+                "Apply Azure Firewall or NSG rules to restrict any legitimately public-facing services."
+            ]
+        });
+    }
+    // 18. Database deletion protection disabled
+    if (dbNoDeletionProtectionResults.length > 0) {
+        findings.push({
+            id: "INFRA_DB_NO_DELETION_PROTECTION",
+            title: "Database resource missing deletion protection — single terraform apply can permanently destroy prod DB",
+            severity: "HIGH",
+            evidence: dbNoDeletionProtectionResults.slice(0, 20).map((m) => `${m.file}:${m.line}: ${m.preview}`),
+            requiredActions: [
+                "Set deletion_protection = true on all aws_db_instance, aws_rds_cluster, and equivalent resources.",
+                "Enable automated backups with a retention window of at least 7 days.",
+                "Use Terraform prevent_destroy lifecycle rules as an additional safeguard."
+            ]
+        });
+    }
+    // 19. Missing VPC endpoint for S3/ECR
+    if (awsInfraResults.length > 0 && vpcEndpointResults.length === 0) {
+        findings.push({
+            id: "INFRA_NO_VPC_ENDPOINT",
+            title: "No VPC endpoint found for AWS services — traffic routes over public internet",
+            severity: "MEDIUM",
+            evidence: awsInfraResults.slice(0, 20).map((m) => `${m.file}:${m.line}: ${m.preview}`),
+            requiredActions: [
+                "Create aws_vpc_endpoint resources for S3, ECR (api + dkr), and other frequently used AWS services.",
+                "Use Gateway endpoints for S3/DynamoDB (free) and Interface endpoints for other services.",
+                "Set the VPC endpoint policy to restrict access to specific S3 buckets or ECR repositories."
+            ]
+        });
+    }
+    // 20. GuardDuty not enabled
+    if (awsInfraResults.length > 0 && guarddutyResults.length === 0) {
+        findings.push({
+            id: "INFRA_GUARDDUTY_MISSING",
+            title: "No GuardDuty detector resource found — threat detection (credential misuse, crypto-mining) disabled",
+            severity: "HIGH",
+            requiredActions: [
+                "Add an aws_guardduty_detector resource with enable = true to your Terraform.",
+                "Enable GuardDuty in all AWS regions and aggregate findings into a delegated admin account.",
+                "Subscribe to GuardDuty findings via EventBridge and route high-severity alerts to your on-call channel."
+            ]
+        });
+    }
+    // 21. Security Hub not enabled
+    if (awsInfraResults.length > 0 && securityHubResults.length === 0) {
+        findings.push({
+            id: "INFRA_SECURITY_HUB_MISSING",
+            title: "AWS Security Hub not enabled — findings from GuardDuty/Inspector/Macie not centrally aggregated",
+            severity: "MEDIUM",
+            requiredActions: [
+                "Add an aws_securityhub_account resource to your Terraform.",
+                "Enable the AWS Foundational Security Best Practices and CIS AWS Foundations standards.",
+                "Aggregate Security Hub findings across regions and accounts into a central delegated admin."
+            ]
+        });
+    }
     return findings;
 }