torusguard 1.0.0 → 1.3.1

package/.torusguard/.manifest.json

@@ -1,5 +1,5 @@
 {
-  "ARCHITECTURE.md": "0ecacc797932daaf95ccf5032c47f11550c9b6fe07cdfece5c075e11ec5e9cf7",
+  "ARCHITECTURE.md": "cdc690a856e82574a6574ab6b1ad8a2d8b3b8264c36931c6212321066eed82e4",
   "TORUSGUARD.md": "c980b0ddd3778d5981f6c16c64015c60dc713b6f151fc531bc5681ecd770fb50",
   "agents/auditor.md": "4ba2c92982823d0886c7ae369126cd5ddd322085a85d3b7e7fa23154f8753314",
   "agents/profiler.md": "0ee9ebbddf4ebd557d454dda8472fffea471e263abeccf40298163084b7ce9a9",
@@ -7,94 +7,212 @@
   "agents/reviewer.md": "69b280bb8a7b2fe425644d01a6f9cb454f9629f348782cd14968657076977c28",
   "agents/validator.md": "79fc4431de5c5507f8730aee6c5c3e61fd238cbf8cf8c7c6aac462eee9761ed6",
   "config/scope.json": "b198a86186b4c6d5e1af516bf4e3a6afa8878e622ca1d57a5bf72d294f8c6f25",
-  "config/slash-commands.json": "5390f0d26f8117a62e56c58147d3a0d2deab1a20956302b212703281d13fa84e",
-  "config/torusguard.json": "b979d6ead31e64a63729e050d820f3e3228d3c825972a60ccae2087e6b27f574",
-  "references/django-security.md": "a15b7eb11b51dd1970d3d65544cf79ebea91fb99dc0e085e58a56532a718dce7",
-  "references/drf-security.md": "c7a7af3acaef895bf4798590acc88b3a2e9831a49eb2d23b4d8f31540ab264cc",
-  "references/express-security.md": "dff1db15e614d29d8c272f9da345b418077e62dc883fe210c7a50c552c76493f",
-  "references/fastapi-security.md": "933a08a3f096f70cb75c6a1e6d887c96a1613bb9f9def3904bb76e8c21cc7668",
-  "references/firebase-security.md": "11b1c51d530ff70230e2419475fceb9382f05c4334145366c66bb1304448f5b5",
-  "references/flask-security.md": "96d438980272f6fa95c825ef01baae55989c19618470b044dde1458a421a92f4",
-  "references/nextjs-security.md": "57f17d00ce24bf06d2826ab9d774177342ff892f6c9bc4193d6b65345d6c7661",
-  "references/react-vite-security.md": "d6468a6f623f02e58250a43327e27825b5dc7df34edf6ee27da2398bab94d6a4",
-  "references/sqlalchemy-security.md": "50421be1fba477721f9f1f5a877d4359420cf61ee9bda136e21998a3c1338e1c",
-  "references/supabase-security.md": "52a53aff66b3d94e5d07484f458252015ad3d713fa07162f59db89581ee597b6",
-  "rules/README.md": "a1b80344b0ca199a4917bdbd00463a8ae1459187f65467dbd627ce93a103042e",
-  "rules/TORUSGUARD.md": "fc7e0852ae0a92c45017f11dbc83c562b94ab957e7816d9903b95fb6849a9e5b",
-  "rules/active/TG-DIFF-001.md": "f67be0f2725eb23c3d11a8a7a4c29dcee648d3f9743e122a2197e8892f4da4de",
-  "rules/active/TG-DIFF-002.md": "1058cf5ba4e700176cf74eb55fb6304d320d3be5fdd011c5c61780d2a99c1a0e",
-  "rules/active/TG-DIFF-003.md": "0ffc0872ba4e0db9d087d5f2764d5d178401d2fab3cb1d129b387452ca489741",
-  "schemas/authorization.schema.json": "59af3c6038270e0bc3541a353b2a4a53b7f5d11a37e0012875d6a69c0f1d0bab",
-  "schemas/confidence.schema.json": "08b3a564d7370e123dd5bfadde9fb077d2954e36b523685b9e1d7bdd2aa4b8cb",
-  "schemas/evidence.schema.json": "d3dcaa10fd2420a4046ea68836fb836a55d003ada4cdc6682229f232881182bf",
-  "schemas/finding.schema.json": "e0a7c28fa4a5f84bdedb5cf5223da26348250d633479d2dbf7ce3ebd6790a852",
+  "config/slash-commands.json": "305c1dc5b556e8d64ad9dd585dafac1a9955cf1bd5321429955b19b7a62736b6",
+  "config/torusguard.json": "55dbde335997421a01c97709fd1672ad70fa921bfe8346dd57552b799db2419e",
+  "references/csharp-security.md": "d6e267855b08ed4fdff26f3b876f089ae1f90a7ec6546cba7e8173380d9daa9d",
+  "references/django-security.md": "26ea5535ac435e61489df1e381ac62b19e81702edfe095e78c937be93fa15ea7",
+  "references/drf-security.md": "c6796398317b0f264d89fff598404e126d819e69e1ea0a5129924a5eb2a7af9d",
+  "references/express-security.md": "3b9896c4c9cfac3199c830db07c661bad1d4529863cab77605db760550def98e",
+  "references/fastapi-security.md": "45136325e7cc65aa78af848636f6e18fc0e871978599505cff3ac95c5823d3d4",
+  "references/firebase-security.md": "c49eaf58e28b7aa37234ea09f13716fe78357521cdd260d5e536d920e9f406b7",
+  "references/flask-security.md": "f359ffdb6ca8c60eaccde2767c8177ed1e2d4fd1391d869405026262fda79f25",
+  "references/go-security.md": "a008606e7698c372140c2c5f5e0ec3c11ac34ae760847650a99c0aee102e6138",
+  "references/java-security.md": "6f27483e271be9d73af0d00fee280a74aeafb08f584cd3313ca349936f779ee6",
+  "references/nextjs-security.md": "4cfa06225a31bc415501ca7d58adc8c12078cc263b78770ae398c7dadcb1e7a2",
+  "references/polyglot-security-matrix.md": "d69453814969b5fd33800baa77433b7ae9564264153cddfd45aa0b87756ed919",
+  "references/react-vite-security.md": "bcc6c38644ff6c939059f12d0f4fc34d3abd338a6c1a0e8406addcd3e50fae45",
+  "references/rust-security.md": "3975f69bb0d983171b521766ca9e0022632acff83439d2f0406599a551702a64",
+  "references/sqlalchemy-security.md": "a3671325d4d0dfac95c2f9ef41fa7fccb440400e35dd53bcd0c1984e48626cb2",
+  "references/supabase-security.md": "4f057d247c9b35a29105ed5e9f74c61b378b33cbc674cbcfa82dbb8174f98ac5",
+  "rules/README.md": "68042664fdf04d81621e3775953963a624869d36ed87e4fa52d9f93eb10a6940",
+  "rules/TG-AUTH-001-weak-password-storage.md": "f6b45b9ea8eaaec5304bd653c714dfb256178cbc2940908ca536f0054e9f2b8f",
+  "rules/TG-AUTH-002-client-only-authorization.md": "9646546b7f9cb8e8512685b652df7b330b59cd2e62c6eb60ce62baab16394868",
+  "rules/TG-AUTH-003-missing-object-authorization.md": "8d8bcd1b63d972e3db50101a8393cc1cd7cd9a91857a4a0c27df1df27333d6de",
+  "rules/TG-AUTH-004-insecure-session-cookie.md": "570e96a0888906eef85b69c99d40bcd84530c583ae1b1b3834a4b7f9e0c0d417",
+  "rules/TG-AUTH-005-unsafe-password-reset.md": "06b654e1f19d93fd37d4397c67f8bb44bc31837a512a770b27511ddf9f25b516",
+  "rules/TG-CLIENT-001-public-production-source-maps.md": "7ce0186b77ae03ade442bada6bac27343554c2e826b3afe44106bd693dc181ce",
+  "rules/TG-CLIENT-002-sensitive-client-bundle-content.md": "c6e9d496d7033aa52e7c5048e7229265ef7738f56fe3c837a9b91babd5ba6107",
+  "rules/TG-DB-001-frontend-database-query.md": "df171d4ea8ad032bc32211ea40abbb45473c6ef4d17488bee1ff68c5a3592078",
+  "rules/TG-DB-002-privileged-database-credential.md": "61290846ccde22a7ea7fba721977df7f6f8d95a3317f41f57eaade183521196b",
+  "rules/TG-DB-003-frontend-admin-sdk.md": "83ea2908ff5c359f43f3c8630fbfe7c5cff3ebe917ea4ef73683ad43f77b4ea1",
+  "rules/TG-DB-004-missing-tenant-query-isolation.md": "e41641f946e241e550f3eae1ab48fe921663de7e4b75cb96fa47ebda0d17986d",
+  "rules/TG-INPUT-001-missing-server-validation.md": "a5d6d128aa443d2ae4a7cb3bdebddaf0fbb9aaa9d7dea2353f7465994a53ff82",
+  "rules/TG-INPUT-002-raw-sql-concatenation.md": "3c53f2ee5ce25ce31018ac640d599f7d904d1c13f9f704e17a338d6a7cef1a23",
+  "rules/TG-INPUT-003-unsafe-html-or-code-execution.md": "b56f2a88329f6e1efb887b1f0b4418a52e01cdc5bd57d57b9f33dc40ebf1edb0",
+  "rules/TG-INPUT-004-unrestricted-file-upload.md": "d665fb7ede456c24d12229cec22b30374a4dc036c3fe3a41ece22f97ab78a1f4",
+  "rules/TG-INPUT-005-unsafe-template-rendering-and-escaping.md": "b6006e741a303d8ff2cd65ef417e6199e5dcf8fe7d603941244db82f6cbe1753",
+  "rules/TG-INPUT-006-unsafe-file-path-traversal.md": "5edb665cd2c41b659849c96d0d4b801a6365e130be12c51733a3d6f17cfd85ed",
+  "rules/TG-PLATFORM-001-wildcard-cors-with-credentials.md": "fb8154f5b8051e94886c956b1e7bdbc5f316739795b8fb9bb493223ca774fe25",
+  "rules/TG-PLATFORM-002-missing-security-headers.md": "207f489453d6256b5d794f79be25c66e9f932ae5cb561b3e8b50d26a28f6a07a",
+  "rules/TG-PLATFORM-003-production-stack-trace-exposure.md": "298c75b928c160720243e42ce5bf43397e73cf50ed472482d5ef3f7635fcb839",
+  "rules/TG-PLATFORM-004-missing-request-size-limits.md": "6e628516f00bc0b22d5c762c6d320fd5475fd43a0a82ea1e0d38d4a537631c56",
+  "rules/TG-RATE-001-unlimited-auth-endpoint.md": "32df2ba9dc1e9e7e0e3848a534648172c7722eb2d0c29b1c8eb017744acf4372",
+  "rules/TG-RATE-002-unlimited-public-write-endpoint.md": "a64fe65c7d7dd2c0708880445a504332c9b2817249ae577d5417ea5e1a696e54",
+  "rules/TG-RATE-003-unbounded-resource-consumption.md": "64ecc6f5c5538c84a231c86e58d9d4723fcbf3c7f5c610a4f6e21cd3116d46ad",
+  "rules/TG-SEC-001-hardcoded-secrets.md": "c53c604f6c3b6d34dbbc8f22ac974448fef9a11770684f54a471e8778a13d9cc",
+  "rules/TG-SEC-002-public-environment-secrets.md": "ae9c49ee83bde7782f7394c05a5bffcadf1c39984f4f6b7437fa600bf1401b68",
+  "rules/TG-SEC-003-tracked-env-file.md": "b08d9ffa7dbcf799fc8edc3c07d56a4a61abf5970d7bd44bd7f5608e36df7c29",
+  "rules/TG-SEC-004-sensitive-logging.md": "c8dced7aa7ba44a2a9ec3dfa281c938eee96c311a6a6b25036b7f7e06c2c2de0",
+  "rules/TORUSGUARD.md": "c980b0ddd3778d5981f6c16c64015c60dc713b6f151fc531bc5681ecd770fb50",
+  "rules/active/TG-AUTH-001-weak-password-storage.md": "f6b45b9ea8eaaec5304bd653c714dfb256178cbc2940908ca536f0054e9f2b8f",
+  "rules/active/TG-AUTH-002-client-only-authorization.md": "9646546b7f9cb8e8512685b652df7b330b59cd2e62c6eb60ce62baab16394868",
+  "rules/active/TG-AUTH-003-missing-object-authorization.md": "8d8bcd1b63d972e3db50101a8393cc1cd7cd9a91857a4a0c27df1df27333d6de",
+  "rules/active/TG-AUTH-004-insecure-session-cookie.md": "570e96a0888906eef85b69c99d40bcd84530c583ae1b1b3834a4b7f9e0c0d417",
+  "rules/active/TG-AUTH-005-unsafe-password-reset.md": "06b654e1f19d93fd37d4397c67f8bb44bc31837a512a770b27511ddf9f25b516",
+  "rules/active/TG-CLIENT-001-public-production-source-maps.md": "7ce0186b77ae03ade442bada6bac27343554c2e826b3afe44106bd693dc181ce",
+  "rules/active/TG-CLIENT-002-sensitive-client-bundle-content.md": "c6e9d496d7033aa52e7c5048e7229265ef7738f56fe3c837a9b91babd5ba6107",
+  "rules/active/TG-DB-001-frontend-database-query.md": "df171d4ea8ad032bc32211ea40abbb45473c6ef4d17488bee1ff68c5a3592078",
+  "rules/active/TG-DB-002-privileged-database-credential.md": "61290846ccde22a7ea7fba721977df7f6f8d95a3317f41f57eaade183521196b",
+  "rules/active/TG-DB-003-frontend-admin-sdk.md": "83ea2908ff5c359f43f3c8630fbfe7c5cff3ebe917ea4ef73683ad43f77b4ea1",
+  "rules/active/TG-DB-004-missing-tenant-query-isolation.md": "e41641f946e241e550f3eae1ab48fe921663de7e4b75cb96fa47ebda0d17986d",
+  "rules/active/TG-DIFF-001.md": "9633466d6aa787ddb0d9df40a18b1bc31c1e12d59d2e11e7ceac4ad8e042770c",
+  "rules/active/TG-DIFF-002.md": "330f5200eb93da0b7a25515d3cc0f37839e0d91cc8ee0b870663f70c554211a3",
+  "rules/active/TG-DIFF-003.md": "f87730a95446f685f80ac859740883013d832a3c681355fe34ddab0b45e377b8",
+  "rules/active/TG-INPUT-001-missing-server-validation.md": "a5d6d128aa443d2ae4a7cb3bdebddaf0fbb9aaa9d7dea2353f7465994a53ff82",
+  "rules/active/TG-INPUT-002-raw-sql-concatenation.md": "3c53f2ee5ce25ce31018ac640d599f7d904d1c13f9f704e17a338d6a7cef1a23",
+  "rules/active/TG-INPUT-003-unsafe-html-or-code-execution.md": "b56f2a88329f6e1efb887b1f0b4418a52e01cdc5bd57d57b9f33dc40ebf1edb0",
+  "rules/active/TG-INPUT-004-unrestricted-file-upload.md": "d665fb7ede456c24d12229cec22b30374a4dc036c3fe3a41ece22f97ab78a1f4",
+  "rules/active/TG-INPUT-005-unsafe-template-rendering-and-escaping.md": "b6006e741a303d8ff2cd65ef417e6199e5dcf8fe7d603941244db82f6cbe1753",
+  "rules/active/TG-INPUT-006-unsafe-file-path-traversal.md": "5edb665cd2c41b659849c96d0d4b801a6365e130be12c51733a3d6f17cfd85ed",
+  "rules/active/TG-PLATFORM-001-wildcard-cors-with-credentials.md": "fb8154f5b8051e94886c956b1e7bdbc5f316739795b8fb9bb493223ca774fe25",
+  "rules/active/TG-PLATFORM-002-missing-security-headers.md": "207f489453d6256b5d794f79be25c66e9f932ae5cb561b3e8b50d26a28f6a07a",
+  "rules/active/TG-PLATFORM-003-production-stack-trace-exposure.md": "298c75b928c160720243e42ce5bf43397e73cf50ed472482d5ef3f7635fcb839",
+  "rules/active/TG-PLATFORM-004-missing-request-size-limits.md": "6e628516f00bc0b22d5c762c6d320fd5475fd43a0a82ea1e0d38d4a537631c56",
+  "rules/active/TG-RATE-001-unlimited-auth-endpoint.md": "32df2ba9dc1e9e7e0e3848a534648172c7722eb2d0c29b1c8eb017744acf4372",
+  "rules/active/TG-RATE-002-unlimited-public-write-endpoint.md": "a64fe65c7d7dd2c0708880445a504332c9b2817249ae577d5417ea5e1a696e54",
+  "rules/active/TG-RATE-003-unbounded-resource-consumption.md": "64ecc6f5c5538c84a231c86e58d9d4723fcbf3c7f5c610a4f6e21cd3116d46ad",
+  "rules/active/TG-SEC-001-hardcoded-secrets.md": "c53c604f6c3b6d34dbbc8f22ac974448fef9a11770684f54a471e8778a13d9cc",
+  "rules/active/TG-SEC-002-public-environment-secrets.md": "ae9c49ee83bde7782f7394c05a5bffcadf1c39984f4f6b7437fa600bf1401b68",
+  "rules/active/TG-SEC-003-tracked-env-file.md": "b08d9ffa7dbcf799fc8edc3c07d56a4a61abf5970d7bd44bd7f5608e36df7c29",
+  "rules/active/TG-SEC-004-sensitive-logging.md": "c8dced7aa7ba44a2a9ec3dfa281c938eee96c311a6a6b25036b7f7e06c2c2de0",
+  "rules/agent/TG-AGENT-001-prompt-injection-system-context.md": "d14e6c25b31c489bdb8fc9dc1309b65c7b831d3e4d2f2c989e4239ecf2a638b5",
+  "rules/agent/TG-AGENT-002-unsafe-tool-dispatch-unsandboxed-execution.md": "810bcdbb8017a739db0ec5b6fad3d92ce33a69455c4c89462eaf4314aac93308",
+  "rules/agent/TG-AGENT-003-broad-mcp-tool-scoping.md": "8746e948e0849e6569f19b510cd70007a58e76b75048fc4cebd1a2079894bf5c",
+  "rules/agent/TG-AGENT-004-persistent-memory-cross-session-leakage.md": "b3c322e56231b4450fcfe2436803c87a560e91390ff3055386dadae5ebc693e5",
+  "rules/authorization/TG-AUTH-006-mass-assignment.md": "9544e6df5d7420eb4dce4fbddd63f21103d82d91fedaedcfe041943b18452472",
+  "rules/authorization/TG-AUTH-007-missing-property-level-authorization.md": "5a1afe03c03d8d3fe7ce952ead8ab011c1c209d029361ce183bf8091216914d0",
+  "rules/authorization/TG-AUTH-008-untrusted-role-header-injection.md": "74cac648fd6c6b49523be499ecf878240b9ea58d1086c1b84c17532d4ba4ee49",
+  "rules/business-logic/TG-BIZ-001-client-controlled-sensitive-business-value.md": "4e837ee5cb053db5ead273bb2e5d934f870ece007c41913362e3138f17b6bcf8",
+  "rules/business-logic/TG-BIZ-002-replayable-one-time-operation.md": "906133df5a576d77515e20a2523f58452dbd22fccdfc4193ebb487298d42b0eb",
+  "rules/business-logic/TG-BIZ-003-missing-workflow-state-validation.md": "86f180dc7ed54665aef7b9077ad991bbb969e01371972dfa89c0f5353571d20c",
+  "rules/business-logic/TG-BIZ-004-unrestricted-sensitive-business-flow.md": "946950e4779b04cd57fd046a162d61bc33b302ccd29db97361d3e3a70b34a177",
+  "rules/cache/TG-CACHE-001-sensitive-response-publicly-cacheable.md": "8f0789c6851dc560e15f26f1f7d26d3670e7212fa7f5bc7e1c09bd09ef1b8edf",
+  "rules/cache/TG-CACHE-002-missing-user-cache-isolation.md": "cf29c883b880e4afdeebb0d74fd9b1622c6a395fd8486e142f175b90ee948874",
+  "rules/cache/TG-CACHE-003-sensitive-data-in-url.md": "c15a8eebfe32716ede037dc594dd01800e341f4b6f3b056d6f76a9a9af57ffb9",
+  "rules/csrf/TG-CSRF-001-missing-csrf-protection.md": "322f2f1bd964426823f1adb7dc20085d1d95aeef557b8d9f74e24d457dd885f6",
+  "rules/csrf/TG-CSRF-002-unsafe-credentialed-cross-origin-request.md": "43ee1934cc01ed2378b73e587efac8e357b4089dfbef23a57ba9ebe633816157",
+  "rules/custom/README.md": "f2128661ad3bc4085a69ddfbabbb2211930215fc42a25e2ab2d3e7a4b749a639",
+  "rules/edge/TG-EDGE-001-serverless-global-state-leak.md": "82fe764a67228c71359b340a983cb37dc8bf4521d030846e0cea433de43c52d3",
+  "rules/edge/TG-EDGE-003-aws-lambda-ephemeral-cold-start.md": "2659db7d38b6689d1d3a99ad5f2504ea264b3d3a601ab38186737b12d4d42c17",
+  "rules/graphql/TG-GQL-001-missing-query-depth-or-complexity-limits.md": "bfee2cb26c71871cc4b93e224dc56c18de0d0ea692a431f7b27a51e7e408873f",
+  "rules/graphql/TG-GQL-002-resolver-missing-authorization.md": "81859a712d482ded016507c7a67e16358a6a29a3c9a9dc04495c907e155a0589",
+  "rules/graphql/TG-GQL-003-unbounded-graphql-pagination-or-batching.md": "b6c3b95ed97b704d4fc43155f1cd3cd844d69f0040cdcad9e1051dbd055f3ca9",
+  "rules/graphql/TG-GQL-004-unnecessary-production-introspection.md": "034fb574fe79346f1c859ff143e4ab70110fff2950a3900fac324f490a837888",
+  "rules/secrets/TG-SEC-005-secret-in-git-history.md": "22ba761d8375aa249bd6a8284de1dce9c7aeda0f26b8fa20d660eb46d09ec711",
+  "rules/secrets/TG-SEC-006-secret-in-build-artifact.md": "7130799c3218ae953a1673bdbb6b7afddfcbf6d0a95500ea558334915b9a0199",
+  "rules/secrets/TG-SEC-007-secret-in-test-or-example-fixture.md": "558092260732217666d3fcbce6cce57856f082e5fcc77eb34d19cb29e666ac2c",
+  "rules/ssrf/TG-SSRF-001-user-controlled-server-side-url-fetch.md": "d6a9bee4b60c1f2a02f83dfc59c71e4aefb2284431cead83703d2882ba8813e1",
+  "rules/ssrf/TG-SSRF-002-missing-internal-network-protection.md": "a421a1f85e6dffe11cfa570deb976213bf044f69ec5061dae1a7f3e6b0893759",
+  "rules/ssrf/TG-SSRF-003-unsafe-redirect-following.md": "b6c43733600a6b1849cae64f16ca4eb2d16bd440a6a8c890ff8ad25e38fec292",
+  "rules/ssrf/TG-SSRF-004-unbounded-outbound-request.md": "be3fd4f403605cf75d8f27448f2b305fd7ff327e6626091c13af14434971589c",
+  "rules/supply-chain/TG-SUPPLY-001-missing-or-ignored-dependency-lockfile.md": "f19b10647789c7fa57eccbb5b220f925195cee391f2f1253258322f113855f23",
+  "rules/supply-chain/TG-SUPPLY-002-vulnerable-dependency-review-missing.md": "f80f2717fdba26e1520bb40276edb6d88835eb8c307e170ff8ab9572187f338f",
+  "rules/supply-chain/TG-SUPPLY-003-unsafe-ci-cd-secret-exposure.md": "73eadb6a87ae7f7a66f04be03622720ce6ec9389fdce1b1844047088daf8a389",
+  "rules/supply-chain/TG-SUPPLY-004-unpinned-ci-action.md": "492d50e5bddcf3cfb82f1e44baefe4afd1311728cd77aa7bb89f721808ddb4ba",
+  "rules/supply-chain/TG-SUPPLY-005-unsafe-dependency-install-script.md": "5960008c0182c2e809089975ecec6ac4f2caa393953abe4d223cce4b2274a8b8",
+  "rules/supply-chain/TG-SUPPLY-006-container-build-secret-persistence.md": "eaadfc37364f150aa08212afd9a629bb084bdd705c6663534b6ea6c74f383053",
+  "rules/webhook/TG-WEBHOOK-001-missing-webhook-signature-verification.md": "3d2f4de4683ac18f4fdfea3e191fe7bdb305c845c76343ab05205d9f3ea3ee73",
+  "rules/webhook/TG-WEBHOOK-002-replayable-webhook.md": "e5f26c0874b5d0974b8aa55c664281a6643b08f87ad1c28cfcaebbb58172956c",
+  "rules/webhook/TG-WEBHOOK-003-missing-webhook-idempotency.md": "bc5cc14d0112260b60120c2d5b0d670477884a0cddbe608408318f006534028d",
+  "rules/webhook/TG-WEBHOOK-004-unvalidated-webhook-event-type.md": "5a5d0eacbaa803e499b05cb59506eaaa8a7b311666c6db4ce1490ae227132102",
+  "rules/websocket/TG-WS-001-unauthenticated-websocket-handshake.md": "b700f08ae47d12f9ed014905c04a4542fcb1bdc34064fb8eb01168f92f5752ae",
+  "rules/websocket/TG-WS-002-missing-channel-level-authorization.md": "32bb0234600ee1712bdbe9190fcf2b5f2ca43987e266fd130e4bd4444bed9712",
+  "rules/websocket/TG-WS-003-unvalidated-websocket-message.md": "b801bd9131b63df2e36132a47a15d1f38c6786bdb696fad5c70059d8d419153c",
+  "rules/websocket/TG-WS-004-unbounded-websocket-connections.md": "5ffa620c039192ade9e44dba83ebba2325f71676767950ea53c620ccfc86a1ad",
+  "schemas/authorization.schema.json": "84885c9edc930a22c777d8685219f1f25b5320c0c6062722e3ba09f1fe417ad4",
+  "schemas/confidence.schema.json": "09c5098f55f3936e9231ba417ace4fa7aa9ebc49233b4bfa88a4103ef6f1202c",
+  "schemas/evidence.schema.json": "7dff029c34965e9aeee932028d11bf30d4f3ff76f8137af382bf3d3dc2c0df10",
+  "schemas/finding.schema.json": "2cf5f7e29b2544e9dc92069394f5eb2b77bc06e8e3daaccfeea5021d177758a8",
+  "schemas/golden-recipe.schema.json": "027d7216e3d000b742ee53d8a5653586aca6a25c69e7b35de4321075ab0206d4",
   "schemas/memory-context.schema.json": "6b9e032c55ba87b2517dd1e7ca0043b8e2439e85fa4a6eac6fc6041f3091e571",
   "schemas/memory-event.schema.json": "4f653610e04fd480325d0ec77a4339bea4690f85e1d2fa0bd4f6b654c813c905",
   "schemas/memory-pattern.schema.json": "df4aae2a3034a7c64ec50b3ae27b6ee9296aac7371c2a1938508834e5f778afe",
-  "schemas/provenance.schema.json": "781215801249532414643638b6608dc8f52febc9bca43ae03827b90aecc03256",
-  "schemas/remediation.schema.json": "217cb2743ae1a912dc074382e9f05634da93f2e30a880c03f6020600ef7e43d3",
-  "schemas/retest.schema.json": "773b764082f6d2e8c3656ea105e0ce09febd1020520bf262bbcd17f5924da11e",
-  "schemas/runtime-evidence.schema.json": "dbe13741a7fb68cca2a044d47a644ee0bdaacb83a28621dc2a98bffdd59989a6",
-  "scripts/diff_guard.py": "5937b657c1047c78b7b9f0a36f3438cb699457cdb5ee56136d68b97edf56af42",
-  "scripts/finding_scorer.py": "c9f34c9153f5322c92bba824ce199ea281c450cd8edc637e61442c5f556d6183",
-  "scripts/manifest_builder.py": "136d5650a97dbb52fdf42c6d55b330a4f9593816e344b07913b0b2ba6b5cc409",
-  "scripts/memory_engine.py": "e99d34951b953bf3d96b6fca2413192de76778e6519278d4213fa3a72bc9b05f",
-  "scripts/monorepo_detector.py": "38f1eb948ee2856f175e1212956bce211effdd1327d3a31f7303d32ba9478ebe",
-  "scripts/run_manager.py": "b576fc3be9929ee6a52e67662e67f801e4e9317c158243582911e10c94a07619",
+  "schemas/provenance.schema.json": "8b8e8ddb5c2ca643ae2d5ef6503eceddad3bd4ebe7ae8dd2449090c2ad24e818",
+  "schemas/remediation.schema.json": "544904239f871dec9552973e01e09dc1f40dbb8330f20d98c319f3b24031d630",
+  "schemas/retest.schema.json": "97c0407ca4365a524020c430912f686f698cc0de90043194621071e9fc681cc7",
+  "schemas/runtime-evidence.schema.json": "929d2b094c1cd1f7f9db07be1eba5994e8002477eab3fd24140e1e973fd18cc1",
+  "scripts/apply_runner.py": "f5f9406b01b56070fea86e524c04b16255998d88e67e3be9e2517fb52aba82a8",
+  "scripts/audit_runner.py": "71553ca6c2d57df6f7323d41abc0216ecedb821fcf0eb5fd502290bd6dec6ae4",
+  "scripts/diff_guard.py": "0dc178cdde1ac0ae1a1ea4b2eb2ce1756b2126f6156909cf55d85249f115fcbd",
+  "scripts/finding_scorer.py": "885c7cbb7a8def2ceda0266e5a7f893938e41debc7501f7400a17a606b22dc23",
+  "scripts/harden_runner.py": "1384b74d57df0bd7f50930128e28aba5245a72795ac876aa1065d8ae83a03045",
+  "scripts/html_reporter.py": "f2bc401e9dfebda2c0e078897247210b2c8b83cba24add00e618821f9cae9eda",
+  "scripts/manifest_builder.py": "c0137927789a9e40a08243e630ac3c6990beb1b87807934e98906c8ad0b99a97",
+  "scripts/memory_engine.py": "b715d0ca030e95eb06ad6eda99027535df8a7e37d64897c023be6a291cf13dc6",
+  "scripts/monorepo_detector.py": "5603674136a5294ebfff89efeca0a546dd4a7deb1d184a2592ff21aff2131f73",
+  "scripts/recheck_runner.py": "bb381717a93db07fc899c98e43b1587d1d2ce6ebb1c1bd8e37d460eac7f4ab19",
+  "scripts/recipes_runner.py": "7f6dc401c4b39b2e804b4db457caed04a11022b43c90651408fd26675bef1b3b",
+  "scripts/rules_sync.py": "4101b2ca8036ff4f468800b32a8d08898e8640a74d14124af53d454706a62d3a",
+  "scripts/run_manager.py": "b738ff70879e46547d32fac6befc61de9599f676411384280fb9819ea3ad7035",
   "scripts/safety_gate.py": "3379b7534b2590cf563717a448983ad8ed7e8f174f0ad65683d33e8a10f51558",
   "scripts/sarif_exporter.py": "35c66637413afc4b72d5bd426638447c77231d2a8594dce5addceffd4803a20d",
-  "scripts/stack_detect.py": "99b7bdf9829d58ff5b8c59afd6e8b6429bbb11d830ac73dec491101cbbc41574",
-  "skills/torusguard/SKILL.md": "e772e348716aee26e424ec96be5bd6750dbebcefc248bc4dab0df1e6c0e24fcf",
-  "skills/torusguard/bootstrap.py": "7c5a13687578a8736aef25cf767d1ef3c8b82dcae0eb7efce41bf131d27a120f",
-  "skills/torusguard/references/auth-and-sessions.md": "34c2843f8c0dbe3574e54f00a39a92a1f431527ec5f69b2d64c84240d424a39e",
-  "skills/torusguard/references/business-logic-and-abuse.md": "0d6088936bc1a01023070332fccef0f2e0734358a5119379055f3d2895c22567",
-  "skills/torusguard/references/cache-and-sensitive-responses.md": "8f920cacde29c50b1f5f98de341a60db0bc607fe8c212a7e618ef7af08c86511",
-  "skills/torusguard/references/client-code-exposure.md": "1810b18c3b89a25d3f5ef9bc53a721b9d05179bcd2086d6679ad1f29f5403bb9",
-  "skills/torusguard/references/csrf-and-cross-origin.md": "1bab49feee1f31fa6b280ddba893fe5ffa0c3c9ac0a46fc4d6c96c1206b32204",
-  "skills/torusguard/references/dependency-and-supply-chain.md": "3b429214af8d1271f5e6dc24ac5ecc9a7bdaff6116a96dc60a89a2057d8d1d2a",
-  "skills/torusguard/references/django-security.md": "a15b7eb11b51dd1970d3d65544cf79ebea91fb99dc0e085e58a56532a718dce7",
-  "skills/torusguard/references/drf-security.md": "c7a7af3acaef895bf4798590acc88b3a2e9831a49eb2d23b4d8f31540ab264cc",
-  "skills/torusguard/references/fastapi-security.md": "933a08a3f096f70cb75c6a1e6d887c96a1613bb9f9def3904bb76e8c21cc7668",
-  "skills/torusguard/references/flask-security.md": "96d438980272f6fa95c825ef01baae55989c19618470b044dde1458a421a92f4",
-  "skills/torusguard/references/frontend-no-db.md": "a543c8107605777a16a0abfd5ebbaca6f216ac50f078a8c3ef485a5afe6bfdca",
-  "skills/torusguard/references/graphql-security.md": "486e7a54e9ad677ff6d08016f0d4e1f173ccbba5c89e7e806a7097e3265442cd",
-  "skills/torusguard/references/input-and-injection.md": "e632ab3031088f3f13be826886430ea7f0abf02922e29c26507f3c234c00f00d",
-  "skills/torusguard/references/mass-assignment-and-property-auth.md": "fcddd881573c1bc8fc703a796b1ddc9ba9bd8e0cc0d51d8e9a59e79cc9a5ebd9",
-  "skills/torusguard/references/platform-hardening.md": "c58d1a86536cbaeb548d8cfeaa298e3662a4367854512858bbf594735dc6f717",
-  "skills/torusguard/references/python-dependencies.md": "34969226665d60d22e658a1801cb6857a56ea669859abcf617a8b985a26f952d",
-  "skills/torusguard/references/python-security-overview.md": "2165747d64b86b12a744ee4f21ea918678bd6a179793a37bd02b2c0953190a9b",
-  "skills/torusguard/references/rate-limit-and-abuse.md": "77c5c982d9e28d7e3c1871172bdbfe76542e356d97f2197f5df0a4f56405bc21",
-  "skills/torusguard/references/secrets-and-config.md": "9abe5fe9e6556a2ffc1460876e9c98f6eacf683cd0d8a7dba82eaeef825133c6",
-  "skills/torusguard/references/sqlalchemy-security.md": "50421be1fba477721f9f1f5a877d4359420cf61ee9bda136e21998a3c1338e1c",
-  "skills/torusguard/references/ssrf-and-outbound-requests.md": "31c6c69ba14ca4a1fb866654f6c89a5c8edd636724c9d349be94c160c976749c",
-  "skills/torusguard/references/webhook-security.md": "a0c7efb663c664dd840ba99b689cb67d4688643106f8b6e80d18a424c6add386",
-  "skills/torusguard/references/websocket-security.md": "5624a84abd75bbb4eed029cd217e0c794ee452cbecc0730a8ab4d0f371537cd7",
-  "skills/torusguard-apply/SKILL.md": "9436fa5cdefa661677ada22936a3949de06aca276e4f4bb27e0ef5b7ea34edc3",
+  "scripts/stack_detect.py": "7848006e3cd6e828f7dbe189a8c9728abd58e021ff02efbc4230ef8ca3444596",
+  "skills/torusguard/SKILL.md": "595008bf365b77729118b0312ec636fb72668ee57f458087ed555a00e1d3db6b",
+  "skills/torusguard/bootstrap.py": "20cf16a30fc26cfa0e585708c103ab481751eebec569b61907f1d0b83bad7d99",
+  "skills/torusguard/references/auth-and-sessions.md": "c3e4b9600cb53fc28c993922dc880accbec5783ac90d5ee98d63b52762d19525",
+  "skills/torusguard/references/business-logic-and-abuse.md": "58e87df2864d468af70c1ff39f5d540c687fa846b671457f85046ab2065fe99c",
+  "skills/torusguard/references/cache-and-sensitive-responses.md": "81b4a7a08e11dafa4ec58d868c4a35f1f891d0dcdcfbcefaef81e1b9ba94f5a1",
+  "skills/torusguard/references/client-code-exposure.md": "b1628410e3dc51990a1653d6d3e3aaefbc2b5f43477b4424b46da6141bfe6984",
+  "skills/torusguard/references/csharp-security.md": "d6e267855b08ed4fdff26f3b876f089ae1f90a7ec6546cba7e8173380d9daa9d",
+  "skills/torusguard/references/csrf-and-cross-origin.md": "2e5001f9e5668beea29985be59dd7272f85640877b55af49c877f5fb8aa70320",
+  "skills/torusguard/references/dependency-and-supply-chain.md": "f54cc745217a8c49b86673794e58fd12e91774e7a2fd66d7e9d27f1a7fde16a8",
+  "skills/torusguard/references/django-security.md": "26ea5535ac435e61489df1e381ac62b19e81702edfe095e78c937be93fa15ea7",
+  "skills/torusguard/references/drf-security.md": "c6796398317b0f264d89fff598404e126d819e69e1ea0a5129924a5eb2a7af9d",
+  "skills/torusguard/references/fastapi-security.md": "45136325e7cc65aa78af848636f6e18fc0e871978599505cff3ac95c5823d3d4",
+  "skills/torusguard/references/flask-security.md": "f359ffdb6ca8c60eaccde2767c8177ed1e2d4fd1391d869405026262fda79f25",
+  "skills/torusguard/references/frontend-no-db.md": "f0aa4e25c8a144b8a05b0c4c27a4d779e49ba63c4ca6b1cc591ab5a15e7762ba",
+  "skills/torusguard/references/go-security.md": "a008606e7698c372140c2c5f5e0ec3c11ac34ae760847650a99c0aee102e6138",
+  "skills/torusguard/references/graphql-security.md": "081135fd7709fcbd2ed7bd63452454153e8e42d6b0e1118edac4155b21e180d2",
+  "skills/torusguard/references/input-and-injection.md": "dfef3af6162eb5ad9b9f516e25f69827f065b36f238facc51554eeecab4d2038",
+  "skills/torusguard/references/java-security.md": "6f27483e271be9d73af0d00fee280a74aeafb08f584cd3313ca349936f779ee6",
+  "skills/torusguard/references/mass-assignment-and-property-auth.md": "124c697286476990591d43d5a11a1a65db8b0fa72e2e6cd37c60796d2b2ccf5e",
+  "skills/torusguard/references/platform-hardening.md": "b21a2cf735711890982e86ff5c385e7574febcd7011637f35997c6dc203ccc63",
+  "skills/torusguard/references/polyglot-security-matrix.md": "d69453814969b5fd33800baa77433b7ae9564264153cddfd45aa0b87756ed919",
+  "skills/torusguard/references/python-dependencies.md": "1fc00572c52583ecf38e561add0818298085e7f9bdfb329532a6d78b9ec6ca83",
+  "skills/torusguard/references/python-security-overview.md": "a234646fc8ccf77fb84decd2fbb18b057a196807796603d0d453ece8c18397f7",
+  "skills/torusguard/references/rate-limit-and-abuse.md": "cbf5776f0ef57a54e76ab3d0d6d5b24d77c1cd4efbc6a24e4c827d8623ea98de",
+  "skills/torusguard/references/rust-security.md": "3975f69bb0d983171b521766ca9e0022632acff83439d2f0406599a551702a64",
+  "skills/torusguard/references/secrets-and-config.md": "21dac9bb94d1b08f2eef938afa073270f8be54b454dbfaf454347a1503ef8e8e",
+  "skills/torusguard/references/sqlalchemy-security.md": "a3671325d4d0dfac95c2f9ef41fa7fccb440400e35dd53bcd0c1984e48626cb2",
+  "skills/torusguard/references/ssrf-and-outbound-requests.md": "5ce59ebada2f227b3e0a27f612b59a47801c152d24d2d4d533bee435f32b1b05",
+  "skills/torusguard/references/webhook-security.md": "8fd27cce1562a3dfda8d4fae29bef7cfd47a65c1e89c6868cdbcac161ccd2be8",
+  "skills/torusguard/references/websocket-security.md": "b5315e49432184c006664436d689d426b7322fc6fbbba2899a9ea5e5bab74c92",
+  "skills/torusguard-apply/SKILL.md": "09ddf90b436eae0fd54264dbf3c34f564a4481ec4806e2dcf311bfee5ce44d6b",
   "skills/torusguard-audit/SKILL.md": "f879e280d357ea7f124c647ce39af2b24b79db608c9edd018f26e5312625a8b5",
-  "skills/torusguard-authorize/SKILL.md": "da849585f2e46c08ef528b89737be14647f1109fd365fd27f3f6da57a396724b",
-  "skills/torusguard-exploit-check/SKILL.md": "e9a173e154a88cc9cb929c59d79a65ab13d5cf9567b4112bd7f272746cf9c3f9",
-  "skills/torusguard-full/SKILL.md": "cc97684d37de378e51fefd12f6f9a7cd15cc469ce46079a0599440aa7b073f7b",
+  "skills/torusguard-authorize/SKILL.md": "689729cfebbf6880869ef4ab1b43657f35c873a782f87a03f26727550f7964d4",
+  "skills/torusguard-exploit-check/SKILL.md": "c674040a917d95190e198b5fe386a0f08b00424e2037b814a133fa8bf1449f73",
+  "skills/torusguard-full/SKILL.md": "f7da4dbd708b31710bddeb5a1f30e1273b134fee1daae89399a17b596ff0128b",
   "skills/torusguard-harden/SKILL.md": "326fa84bda4832f96b19d73824c3472dfe185247ed3e3db9715dd943d46d9874",
-  "skills/torusguard-init/SKILL.md": "1f7844d66219955581fdb266029eefdc355dbebb5741b848daf0062e606202a2",
+  "skills/torusguard-init/SKILL.md": "534a1a4aff2510dbf7924fe74d7d338ed352f757a23b1c5427b9f758019cd911",
   "skills/torusguard-recheck/SKILL.md": "457b2a1cce064a738fbe43f0dba6b4393f1630a82f60698ea5ebe655ec017e50",
-  "skills/torusguard-report/SKILL.md": "bde44d114bdc85c04472644a644a7796ed2f182a23e0c057838a3251e4910a09",
-  "skills/torusguard-status/SKILL.md": "4e71d03c71b240afd7f6108569530b7da3702634c512a74ca8dc3174f3c6b0fb",
-  "skills/torusguard-verify/SKILL.md": "10c19e0926255686351e3b75ae774880cf35562d42bd30b87a877bb8f284fc1f",
-  "skills/torusguard-web-validate/SKILL.md": "0d159f0d75f06ca97f64a52f3e414c873f8bb84b87a8230693237cde302e76ac",
+  "skills/torusguard-report/SKILL.md": "f6f6de3a8b56c4538d02307c5afaf99c508561140cccfe8ea16c2ae87768b64d",
+  "skills/torusguard-status/SKILL.md": "23afc632b70b80304952e2559a109d5877f97a048039a818a65b378dc604e19e",
+  "skills/torusguard-verify/SKILL.md": "842ca8ca3ad194886605a7fafb98d4309cba695b86a627b24206b5b139eef5c6",
+  "skills/torusguard-web-validate/SKILL.md": "b3cd9952601cfe89dbe98765bd61be22b434e5aaf5700751348591919e595ad4",
   "templates/audit-report.template.md": "71149dd05b01a74287a47781fdc71fd2d1b4b70337da303bf78767d0410a6c90",
   "templates/authorization.template.md": "81ef843d42a19412c369f383b787465ac24173c0b14c1f5f211786eab3d10e8b",
   "templates/finding-card.template.md": "8f756edbd3e4139d3da2fb96f35bd2d2b267b33b754f187b590a89584265c1e6",
   "templates/remediation-bundle.template.md": "4d85a540e3a2e74f9b21fc8a2a1072e27ca03e97cd67ca482f529cfe722acc4d",
-  "workflows/apply.md": "ca7fe662f5af462d036d17ecc7e82ab8a08e1989325e9e037df6364af96e2706",
-  "workflows/audit.md": "d924b7c02d7a380c68e5c8faa69103194b098119e34c5b427585eec66f8081ca",
-  "workflows/authorize.md": "a797addf98eb0cf29acbc9dc8f21f0d61ea93cc83255379d4722ab5ce86a4c29",
-  "workflows/exploit-check.md": "9684009b835a61d5aca8827a971ee686a24c800425d86ef96f963dd27de845b8",
-  "workflows/harden.md": "509484f844c9dcd10dd14c8bb6e3456021928e6cf6abd374faaf34be8fc34ce2",
-  "workflows/init.md": "3d1668a9f6b87417c31f47c887c495f863595ed4a29074e0c5a8ee1ece1d4a35",
+  "workflows/apply.md": "dc66ef6c59ecf1996d45921ac83ba5dd2503a9f3624c8e6f24568745a072b871",
+  "workflows/audit.md": "969df4767b311f6468fb10ad4c98c302feb7112bafa86c14c59c8b9f5d481c89",
+  "workflows/authorize.md": "1ac2e3adb367a04bd20b2b6a062f6a65703e4aa6a815fe0affc0697faa433588",
+  "workflows/exploit-check.md": "67073930ea86219a4efd54dac4206dfc37775a660ff1b6960ed2bfea0528b4a0",
+  "workflows/harden.md": "56d7f8098f19c34bc581a49b5e4bacc42858606ebf1cc35c848bdfaca8744409",
+  "workflows/init.md": "d1e6ae9a98c30b2c3b46081c8195f524bcd8d3bc9004562d230b56c704fec02b",
   "workflows/memory.md": "c034f9266380db3c05e9ffed943c2bb4ba73c060507e3508e47b543a035a5873",
-  "workflows/recheck.md": "7d374c29a5585c31b81f84fb32d6a466f2e9cb339726dc0523dba25e57bc5d13",
-  "workflows/report.md": "56b3449cff362172c63093ee6150446d11bf05e3c8143661966dad9d42df1470",
-  "workflows/status.md": "921129646518c592cb47ad8e8ccf3d703e8d11ea6eb89bd21a206f545e022dba",
-  "workflows/verify.md": "e1041c38e8ada59788f66ac1bc754313a4c966c36f4c13aa6d9d9a2b90d9e06c",
-  "workflows/web-validate.md": "d3db1fea264cd89addffbc227d8452987b050e533993c394d537f50c177224d4"
+  "workflows/recheck.md": "106442712bfb87c6c1c9bc0ed660c6c291d4d6a0a6b860f4f93397440dba08d5",
+  "workflows/report.md": "35c7cc44d94ee49d8fea6b75ae7ea524790fd0e6208b5f27b84bc4fdab469b0c",
+  "workflows/status.md": "a14a92b8b4c30fdf9e9c073c51de4d0057f43519df03e9661117e62e65ac1d08",
+  "workflows/verify.md": "f96e8db92f067395d82f7ef8fd32c7c00e6c41ea1731347aadba2fbaed118cdf",
+  "workflows/web-validate.md": "5ef05154671582d95b2d05358f0a4f7ea52fe6ff3d3f238b732b3490925bc7f7"
 }

package/.torusguard/references/csharp-security.md

@@ -0,0 +1,41 @@
+# TorusGuard Skill Reference: C# & ASP.NET Core Security
+
+> **Loaded When:** A project is identified as a C# / .NET application (`*.csproj`, `*.sln`, ASP.NET Core detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Authentication & Authorization
+* `TG-AUTH-001`: Ensure controllers and endpoints have `[Authorize]` attributes.
+* Prohibit unvetted `[AllowAnonymous]` on sensitive business logic or user data endpoints.
+
+### 2. Entity Framework Core & SQL Injection
+* `TG-INPUT-002`: Use LINQ expressions or `FromSqlInterpolated` with interpolated string syntax (EF Core converts parameters automatically).
+* Prohibit raw `FromSqlRaw` with un-parameterized string concatenations.
+* `TG-DB-004`: Configure Global Query Filters (`HasQueryFilter(e => e.TenantId == _currentTenant)`) for multi-tenant safety.
+
+### 3. Anti-Forgery & TLS
+* `TG-CSRF-001`: Ensure `[ValidateAntiForgeryToken]` or `[AutoValidateAntiforgeryToken]` is applied to POST/PUT/DELETE actions.
+* Prohibit `DangerousAcceptAnyServerCertificateValidator`.
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```csharp
+// Safe Entity Framework Parameterized Query
+var user = await context.Users
+    .Where(u => u.Id == userId && u.TenantId == currentTenantId)
+    .FirstOrDefaultAsync();
+
+// Safe Global Query Filter in DbContext
+modelBuilder.Entity<Invoice>()
+    .HasQueryFilter(i => i.TenantId == _tenantProvider.GetTenantId());
+
+// Safe Controller Security
+[Authorize]
+[ApiController]
+[Route("api/[controller]")]
+public class InvoicesController : ControllerBase { ... }
+```

package/.torusguard/references/go-security.md

@@ -0,0 +1,41 @@
+# TorusGuard Skill Reference: Go Security
+
+> **Loaded When:** A project is identified as a Go application (`go.mod`, `go.sum`, or Go source files detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Database & SQL Injection
+* `TG-INPUT-002`: Ensure raw queries use parameterized placeholders (`?`, `$1`), never `fmt.Sprintf` or string concatenation.
+* `TG-DB-004`: Enforce tenant isolation in GORM queries (`db.Where("tenant_id = ?", tenantID)`).
+
+### 2. TLS & Network Security
+* `TG-DIFF-001`: Prohibit `InsecureSkipVerify: true` in `tls.Config`. Always use valid root CA pools.
+* `TG-SSRF-001`: Validate outbound URLs before issuing `http.Get` or `http.Post`.
+
+### 3. Concurrency & Goroutine Safety
+* `TG-BIZ-001`: Ensure context cancellation propagation (`ctx.Done()`) to prevent goroutine leaks.
+* Use mutexes or channels to prevent data races on shared state.
+
+### 4. Input Validation & Path Traversal
+* `TG-INPUT-006`: Sanitize file paths with `filepath.Clean` and check `strings.HasPrefix(cleanPath, baseDir)`.
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```go
+// Safe Parameterized Query
+row := db.QueryRowContext(ctx, "SELECT id, email FROM users WHERE id = ? AND tenant_id = ?", userID, tenantID)
+
+// Safe GORM Scoping
+var invoice Invoice
+result := db.Where("id = ? AND tenant_id = ?", invoiceID, currentTenantID).First(&invoice)
+
+// Safe TLS Client
+tlsConfig := &tls.Config{
+    MinVersion: tls.VersionTLS13,
+}
+client := &http.Client{Transport: &http.Transport{TLSClientConfig: tlsConfig}}
+```

package/.torusguard/references/java-security.md

@@ -0,0 +1,40 @@
+# TorusGuard Skill Reference: Java & Spring Security
+
+> **Loaded When:** A project is identified as a Java/Kotlin application (`pom.xml`, `build.gradle`, Spring Boot detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Spring Security & CSRF
+* `TG-CSRF-001`: Prohibit `.csrf().disable()` or `AbstractHttpConfigurer::disable` on state-changing browser routes.
+* `TG-PLATFORM-001`: Avoid `@CrossOrigin(origins = "*")` with `allowCredentials = "true"`.
+
+### 2. JPA & Hibernate SQL Injection
+* `TG-INPUT-002`: Use named parameters (`:param`) or `CriteriaBuilder`. Never concatenate strings into JPQL queries.
+* `TG-DB-004`: Enforce tenant isolation via `@Filter` or explicit where clauses.
+
+### 3. Insecure Deserialization & XML
+* Prohibit `ObjectInputStream.readObject()` on untrusted input without look-ahead verification.
+* Disable external entity resolution (`setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)`).
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```java
+// Safe JPA Query
+@Query("SELECT u FROM User u WHERE u.id = :id AND u.tenantId = :tenantId")
+Optional<User> findByIdAndTenantId(@Param("id") Long id, @Param("tenantId") String tenantId);
+
+// Safe Spring Security Configuration
+@Bean
+public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+    http
+        .authorizeHttpRequests(auth -> auth
+            .requestMatchers("/public/**").permitAll()
+            .anyRequest().authenticated()
+        );
+    return http.build();
+}
+```

package/.torusguard/references/polyglot-security-matrix.md

@@ -0,0 +1,25 @@
+# TorusGuard Universal Polyglot Security Matrix
+
+> **Loaded When:** Any language or framework is detected. Maps universal security invariants across major programming language ecosystems.
+
+---
+
+## 🛡️ Cross-Language Invariant Mappings
+
+| Rule Family | Python | TypeScript / Node.js | Go | Rust | Java / Kotlin | C# / .NET |
+|---|---|---|---|---|---|---|
+| **TG-SEC (Secrets)** | `os.environ["KEY"]` | `process.env.KEY` | `os.Getenv("KEY")` | `std::env::var("KEY")` | `System.getenv("KEY")` | `Environment.GetEnvironmentVariable()` |
+| **TG-DB (SQL Injection)** | `%s` / ORM bound | `$1` / Prisma / Drizzle | `?` / `$1` / GORM `?` | `sqlx::query!` / Diesel | Named parameters `:param` | `@p0` / `FromSqlInterpolated` |
+| **TG-DB-004 (Tenant Scope)** | `.filter(tenant=...)` | `where: { tenantId }` | `.Where("tenant_id = ?", tid)` | `filter(tenant_id.eq(tid))` | `WHERE e.tenantId = :tid` | `.Where(x => x.TenantId == tid)` |
+| **TG-AUTH (Access Control)** | `@login_required` / Depends | Middleware auth / Guards | Middleware handlers | Tower layer / extractors | `@PreAuthorize` / Spring Sec | `[Authorize]` attributes |
+| **TG-CSRF (Request Forgery)** | CSRF Middleware | SameSite / csurf | Gorilla CSRF | Anti-CSRF token middleware | Spring Security CSRF | `[ValidateAntiForgeryToken]` |
+| **TG-DIFF (Bypass Comments)** | No `# nosec` | No `// nosec` | No `/* nosec */` | No `#![allow(unsafe)]` | No `@SuppressWarnings` | No pragma disable |
+| **TG-DIFF (TLS Verification)** | No `verify=False` | No `rejectUnauthorized:false` | No `InsecureSkipVerify: true` | No `danger_accept_invalid_certs`| No `TrustAllStrategy` | No `DangerousAcceptAny...` |
+
+---
+
+## 🚀 Polyglot Hardening Rules of Thumb
+
+1. **Parameterize Everything:** Never concatenate raw user input into SQL, shell commands, LDAP filters, or template strings, regardless of language.
+2. **Fail Closed on Auth:** Default all endpoints to authenticated; explicitly mark public routes rather than remembering to protect private ones.
+3. **Strict Bounds:** Keep remediation diffs minimal ($\le 35$ additions, $\le 25$ deletions) to ensure auditability across all codebases.

package/.torusguard/references/rust-security.md

@@ -0,0 +1,40 @@
+# TorusGuard Skill Reference: Rust Security
+
+> **Loaded When:** A project is identified as a Rust application (`Cargo.toml` or `.rs` files detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Memory Safety & Unsafe Blocks
+* `TG-INPUT-003`: Audit and restrict `unsafe { ... }` blocks. Must include a `// SAFETY:` rationale comment.
+* Never disable standard borrow checker lints via `#![allow(unsafe_code)]`.
+
+### 2. Database & SQL Queries
+* `TG-INPUT-002`: Use compile-time checked `sqlx::query!` or Diesel query builder methods.
+* `TG-DB-004`: Enforce tenant filtering in queries (`filter(tenant_id.eq(current_tenant_id))`).
+
+### 3. Outbound Requests & TLS
+* `TG-DIFF-001`: Prohibit `danger_accept_invalid_certs(true)` in `reqwest::ClientBuilder`.
+* `TG-SSRF-001`: Enforce IP allowlists before dispatching network calls.
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```rust
+// Safe sqlx Parameterized Query
+let user = sqlx::query_as!(
+    User,
+    "SELECT id, email FROM users WHERE id = $1 AND tenant_id = $2",
+    user_id,
+    current_tenant_id
+)
+.fetch_one(&pool)
+.await?;
+
+// Safe reqwest Client (Strict TLS)
+let client = reqwest::Client::builder()
+    .timeout(std::time::Duration::from_secs(10))
+    .build()?;
+```