sinapse-ai 7.7.6 → 7.7.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -2,11 +2,60 @@
|
|
|
2
2
|
|
|
3
3
|
> **Constitution Article X — NON-NEGOTIABLE**
|
|
4
4
|
> Applies to ALL agents, ALL projects handling user data.
|
|
5
|
-
>
|
|
5
|
+
> Sources: OWASP Top 10, NIST CSF 2.0, CIS Controls v8, Zero Trust (SP 800-207),
|
|
6
|
+
> LGPD/ANPD, Supabase Security, Claude API Security, CRIABR Guide #0023,
|
|
7
|
+
> Historical breach analysis (Change Healthcare 192.7M, Ticketmaster 560M, 23andMe 6.9M)
|
|
6
8
|
|
|
7
9
|
## Rule
|
|
8
10
|
|
|
9
|
-
Every project that handles user data MUST follow these security practices from the first commit. No shortcuts, no "we'll add security later."
|
|
11
|
+
Every project that handles user data MUST follow these security practices from the first commit. No shortcuts, no "we'll add security later." Security is NOT a feature — it is the foundation.
|
|
12
|
+
|
|
13
|
+
## Pre-Deploy Gate — 25 Deployment Blockers
|
|
14
|
+
|
|
15
|
+
NENHUM projeto pode ir para producao sem passar por TODOS estes checks.
|
|
16
|
+
Os agentes DEVEM verificar e BLOQUEAR deploy se qualquer item falhar.
|
|
17
|
+
|
|
18
|
+
### TIER 1: ABSOLUTE BLOCKERS (deploy = impossivel)
|
|
19
|
+
|
|
20
|
+
| # | Blocker | Source | Check |
|
|
21
|
+
|---|---------|--------|-------|
|
|
22
|
+
| 1 | Tabela sem RLS ativado | Supabase, OWASP A01 | `SELECT tablename FROM pg_tables WHERE NOT rowsecurity` |
|
|
23
|
+
| 2 | API keys hardcoded no codigo | Claude API, CIS C3 | Hook: secret-scanning.cjs |
|
|
24
|
+
| 3 | service_role no frontend | Supabase | Grep: `service_role` em `src/`, `app/`, `pages/` |
|
|
25
|
+
| 4 | Sem MFA em contas admin/cloud/prod | Breach lessons, CIS C5-6 | Manual: verificar dashboard |
|
|
26
|
+
| 5 | APIs sem autenticacao | OWASP A01 | Review: todo endpoint precisa de auth middleware |
|
|
27
|
+
| 6 | SQL com string concatenation | OWASP A05 | Hook: sql-governance.py |
|
|
28
|
+
| 7 | Vulnerabilidades critical/high em deps | OWASP A03, CIS C7 | `npm audit --audit-level=high` |
|
|
29
|
+
| 8 | Secrets detectados no codebase | CIS C3 | `npx gitleaks detect` ou hook |
|
|
30
|
+
| 9 | Credenciais default em producao | OWASP A02 | Review: nenhum admin/admin, test/test |
|
|
31
|
+
| 10 | Sem TLS (dados em transito nao encriptados) | NIST CSF, Zero Trust | Verificar HTTPS forced |
|
|
32
|
+
|
|
33
|
+
### TIER 2: COMPLIANCE BLOCKERS (deploy = ilegal no Brasil)
|
|
34
|
+
|
|
35
|
+
| # | Blocker | Source |
|
|
36
|
+
|---|---------|--------|
|
|
37
|
+
| 11 | Sem DPO/Encarregado designado | LGPD Art. 41 |
|
|
38
|
+
| 12 | Sem capacidade de notificacao de breach (<3 dias) | LGPD Resolucao 15 |
|
|
39
|
+
| 13 | Sem mecanismo de consentimento | LGPD Art. 7-8 |
|
|
40
|
+
| 14 | Sem portal de direitos do titular | LGPD Art. 18 |
|
|
41
|
+
| 15 | Transferencia internacional sem SCCs | LGPD Art. 33 |
|
|
42
|
+
| 16 | Dados de criancas sem consentimento dos pais | LGPD Art. 14 |
|
|
43
|
+
| 17 | Sem politica de privacidade publicada | LGPD Art. 9 |
|
|
44
|
+
|
|
45
|
+
### TIER 3: OPERATIONAL BLOCKERS (deploy = irresponsavel)
|
|
46
|
+
|
|
47
|
+
| # | Blocker | Source |
|
|
48
|
+
|---|---------|--------|
|
|
49
|
+
| 18 | Sem inventario de ativos | CIS C1-2, NIST IDENTIFY |
|
|
50
|
+
| 19 | Sem logging centralizado | CIS C8, OWASP A09 |
|
|
51
|
+
| 20 | Sem plano de resposta a incidentes | CIS C17, NIST RESPOND |
|
|
52
|
+
| 21 | Sem verificacao de backup nos ultimos 90 dias | CIS C11 |
|
|
53
|
+
| 22 | Sem processo de vulnerability scanning | CIS C7, OWASP A03 |
|
|
54
|
+
| 23 | Sem segmentacao de rede | Zero Trust, breach lessons |
|
|
55
|
+
| 24 | Sem avaliacao de seguranca de vendors | NIST GOVERN, CIS C15 |
|
|
56
|
+
| 25 | Sem SSL enforcement no database | Supabase, NIST CSF |
|
|
57
|
+
|
|
58
|
+
**Licao #1 dos maiores vazamentos historicos:** A AUSENCIA DE MFA foi a causa raiz das maiores breaches de 2023-2025. MFA obrigatorio e o controle de maior ROI.
|
|
10
59
|
|
|
11
60
|
## Database Security
|
|
12
61
|
|
|
@@ -7,8 +7,8 @@
|
|
|
7
7
|
# - SHA256 hashes for change detection
|
|
8
8
|
# - File types for categorization
|
|
9
9
|
#
|
|
10
|
-
version: 7.7.
|
|
11
|
-
generated_at: "2026-04-03T02:
|
|
10
|
+
version: 7.7.7
|
|
11
|
+
generated_at: "2026-04-03T02:38:02.241Z"
|
|
12
12
|
generator: scripts/generate-install-manifest.js
|
|
13
13
|
file_count: 1118
|
|
14
14
|
files:
|