torusguard 1.3.0 → 1.3.1

package/.torusguard/.manifest.json

@@ -24,12 +24,111 @@
   "references/rust-security.md": "3975f69bb0d983171b521766ca9e0022632acff83439d2f0406599a551702a64",
   "references/sqlalchemy-security.md": "a3671325d4d0dfac95c2f9ef41fa7fccb440400e35dd53bcd0c1984e48626cb2",
   "references/supabase-security.md": "4f057d247c9b35a29105ed5e9f74c61b378b33cbc674cbcfa82dbb8174f98ac5",
-  "rules/README.md": "a1b80344b0ca199a4917bdbd00463a8ae1459187f65467dbd627ce93a103042e",
+  "rules/README.md": "68042664fdf04d81621e3775953963a624869d36ed87e4fa52d9f93eb10a6940",
+  "rules/TG-AUTH-001-weak-password-storage.md": "f6b45b9ea8eaaec5304bd653c714dfb256178cbc2940908ca536f0054e9f2b8f",
+  "rules/TG-AUTH-002-client-only-authorization.md": "9646546b7f9cb8e8512685b652df7b330b59cd2e62c6eb60ce62baab16394868",
+  "rules/TG-AUTH-003-missing-object-authorization.md": "8d8bcd1b63d972e3db50101a8393cc1cd7cd9a91857a4a0c27df1df27333d6de",
+  "rules/TG-AUTH-004-insecure-session-cookie.md": "570e96a0888906eef85b69c99d40bcd84530c583ae1b1b3834a4b7f9e0c0d417",
+  "rules/TG-AUTH-005-unsafe-password-reset.md": "06b654e1f19d93fd37d4397c67f8bb44bc31837a512a770b27511ddf9f25b516",
+  "rules/TG-CLIENT-001-public-production-source-maps.md": "7ce0186b77ae03ade442bada6bac27343554c2e826b3afe44106bd693dc181ce",
+  "rules/TG-CLIENT-002-sensitive-client-bundle-content.md": "c6e9d496d7033aa52e7c5048e7229265ef7738f56fe3c837a9b91babd5ba6107",
+  "rules/TG-DB-001-frontend-database-query.md": "df171d4ea8ad032bc32211ea40abbb45473c6ef4d17488bee1ff68c5a3592078",
+  "rules/TG-DB-002-privileged-database-credential.md": "61290846ccde22a7ea7fba721977df7f6f8d95a3317f41f57eaade183521196b",
+  "rules/TG-DB-003-frontend-admin-sdk.md": "83ea2908ff5c359f43f3c8630fbfe7c5cff3ebe917ea4ef73683ad43f77b4ea1",
+  "rules/TG-DB-004-missing-tenant-query-isolation.md": "e41641f946e241e550f3eae1ab48fe921663de7e4b75cb96fa47ebda0d17986d",
+  "rules/TG-INPUT-001-missing-server-validation.md": "a5d6d128aa443d2ae4a7cb3bdebddaf0fbb9aaa9d7dea2353f7465994a53ff82",
+  "rules/TG-INPUT-002-raw-sql-concatenation.md": "3c53f2ee5ce25ce31018ac640d599f7d904d1c13f9f704e17a338d6a7cef1a23",
+  "rules/TG-INPUT-003-unsafe-html-or-code-execution.md": "b56f2a88329f6e1efb887b1f0b4418a52e01cdc5bd57d57b9f33dc40ebf1edb0",
+  "rules/TG-INPUT-004-unrestricted-file-upload.md": "d665fb7ede456c24d12229cec22b30374a4dc036c3fe3a41ece22f97ab78a1f4",
+  "rules/TG-INPUT-005-unsafe-template-rendering-and-escaping.md": "b6006e741a303d8ff2cd65ef417e6199e5dcf8fe7d603941244db82f6cbe1753",
+  "rules/TG-INPUT-006-unsafe-file-path-traversal.md": "5edb665cd2c41b659849c96d0d4b801a6365e130be12c51733a3d6f17cfd85ed",
+  "rules/TG-PLATFORM-001-wildcard-cors-with-credentials.md": "fb8154f5b8051e94886c956b1e7bdbc5f316739795b8fb9bb493223ca774fe25",
+  "rules/TG-PLATFORM-002-missing-security-headers.md": "207f489453d6256b5d794f79be25c66e9f932ae5cb561b3e8b50d26a28f6a07a",
+  "rules/TG-PLATFORM-003-production-stack-trace-exposure.md": "298c75b928c160720243e42ce5bf43397e73cf50ed472482d5ef3f7635fcb839",
+  "rules/TG-PLATFORM-004-missing-request-size-limits.md": "6e628516f00bc0b22d5c762c6d320fd5475fd43a0a82ea1e0d38d4a537631c56",
+  "rules/TG-RATE-001-unlimited-auth-endpoint.md": "32df2ba9dc1e9e7e0e3848a534648172c7722eb2d0c29b1c8eb017744acf4372",
+  "rules/TG-RATE-002-unlimited-public-write-endpoint.md": "a64fe65c7d7dd2c0708880445a504332c9b2817249ae577d5417ea5e1a696e54",
+  "rules/TG-RATE-003-unbounded-resource-consumption.md": "64ecc6f5c5538c84a231c86e58d9d4723fcbf3c7f5c610a4f6e21cd3116d46ad",
+  "rules/TG-SEC-001-hardcoded-secrets.md": "c53c604f6c3b6d34dbbc8f22ac974448fef9a11770684f54a471e8778a13d9cc",
+  "rules/TG-SEC-002-public-environment-secrets.md": "ae9c49ee83bde7782f7394c05a5bffcadf1c39984f4f6b7437fa600bf1401b68",
+  "rules/TG-SEC-003-tracked-env-file.md": "b08d9ffa7dbcf799fc8edc3c07d56a4a61abf5970d7bd44bd7f5608e36df7c29",
+  "rules/TG-SEC-004-sensitive-logging.md": "c8dced7aa7ba44a2a9ec3dfa281c938eee96c311a6a6b25036b7f7e06c2c2de0",
   "rules/TORUSGUARD.md": "c980b0ddd3778d5981f6c16c64015c60dc713b6f151fc531bc5681ecd770fb50",
+  "rules/active/TG-AUTH-001-weak-password-storage.md": "f6b45b9ea8eaaec5304bd653c714dfb256178cbc2940908ca536f0054e9f2b8f",
+  "rules/active/TG-AUTH-002-client-only-authorization.md": "9646546b7f9cb8e8512685b652df7b330b59cd2e62c6eb60ce62baab16394868",
+  "rules/active/TG-AUTH-003-missing-object-authorization.md": "8d8bcd1b63d972e3db50101a8393cc1cd7cd9a91857a4a0c27df1df27333d6de",
+  "rules/active/TG-AUTH-004-insecure-session-cookie.md": "570e96a0888906eef85b69c99d40bcd84530c583ae1b1b3834a4b7f9e0c0d417",
+  "rules/active/TG-AUTH-005-unsafe-password-reset.md": "06b654e1f19d93fd37d4397c67f8bb44bc31837a512a770b27511ddf9f25b516",
+  "rules/active/TG-CLIENT-001-public-production-source-maps.md": "7ce0186b77ae03ade442bada6bac27343554c2e826b3afe44106bd693dc181ce",
+  "rules/active/TG-CLIENT-002-sensitive-client-bundle-content.md": "c6e9d496d7033aa52e7c5048e7229265ef7738f56fe3c837a9b91babd5ba6107",
+  "rules/active/TG-DB-001-frontend-database-query.md": "df171d4ea8ad032bc32211ea40abbb45473c6ef4d17488bee1ff68c5a3592078",
+  "rules/active/TG-DB-002-privileged-database-credential.md": "61290846ccde22a7ea7fba721977df7f6f8d95a3317f41f57eaade183521196b",
+  "rules/active/TG-DB-003-frontend-admin-sdk.md": "83ea2908ff5c359f43f3c8630fbfe7c5cff3ebe917ea4ef73683ad43f77b4ea1",
+  "rules/active/TG-DB-004-missing-tenant-query-isolation.md": "e41641f946e241e550f3eae1ab48fe921663de7e4b75cb96fa47ebda0d17986d",
   "rules/active/TG-DIFF-001.md": "9633466d6aa787ddb0d9df40a18b1bc31c1e12d59d2e11e7ceac4ad8e042770c",
   "rules/active/TG-DIFF-002.md": "330f5200eb93da0b7a25515d3cc0f37839e0d91cc8ee0b870663f70c554211a3",
   "rules/active/TG-DIFF-003.md": "f87730a95446f685f80ac859740883013d832a3c681355fe34ddab0b45e377b8",
+  "rules/active/TG-INPUT-001-missing-server-validation.md": "a5d6d128aa443d2ae4a7cb3bdebddaf0fbb9aaa9d7dea2353f7465994a53ff82",
+  "rules/active/TG-INPUT-002-raw-sql-concatenation.md": "3c53f2ee5ce25ce31018ac640d599f7d904d1c13f9f704e17a338d6a7cef1a23",
+  "rules/active/TG-INPUT-003-unsafe-html-or-code-execution.md": "b56f2a88329f6e1efb887b1f0b4418a52e01cdc5bd57d57b9f33dc40ebf1edb0",
+  "rules/active/TG-INPUT-004-unrestricted-file-upload.md": "d665fb7ede456c24d12229cec22b30374a4dc036c3fe3a41ece22f97ab78a1f4",
+  "rules/active/TG-INPUT-005-unsafe-template-rendering-and-escaping.md": "b6006e741a303d8ff2cd65ef417e6199e5dcf8fe7d603941244db82f6cbe1753",
+  "rules/active/TG-INPUT-006-unsafe-file-path-traversal.md": "5edb665cd2c41b659849c96d0d4b801a6365e130be12c51733a3d6f17cfd85ed",
+  "rules/active/TG-PLATFORM-001-wildcard-cors-with-credentials.md": "fb8154f5b8051e94886c956b1e7bdbc5f316739795b8fb9bb493223ca774fe25",
+  "rules/active/TG-PLATFORM-002-missing-security-headers.md": "207f489453d6256b5d794f79be25c66e9f932ae5cb561b3e8b50d26a28f6a07a",
+  "rules/active/TG-PLATFORM-003-production-stack-trace-exposure.md": "298c75b928c160720243e42ce5bf43397e73cf50ed472482d5ef3f7635fcb839",
+  "rules/active/TG-PLATFORM-004-missing-request-size-limits.md": "6e628516f00bc0b22d5c762c6d320fd5475fd43a0a82ea1e0d38d4a537631c56",
+  "rules/active/TG-RATE-001-unlimited-auth-endpoint.md": "32df2ba9dc1e9e7e0e3848a534648172c7722eb2d0c29b1c8eb017744acf4372",
+  "rules/active/TG-RATE-002-unlimited-public-write-endpoint.md": "a64fe65c7d7dd2c0708880445a504332c9b2817249ae577d5417ea5e1a696e54",
+  "rules/active/TG-RATE-003-unbounded-resource-consumption.md": "64ecc6f5c5538c84a231c86e58d9d4723fcbf3c7f5c610a4f6e21cd3116d46ad",
+  "rules/active/TG-SEC-001-hardcoded-secrets.md": "c53c604f6c3b6d34dbbc8f22ac974448fef9a11770684f54a471e8778a13d9cc",
+  "rules/active/TG-SEC-002-public-environment-secrets.md": "ae9c49ee83bde7782f7394c05a5bffcadf1c39984f4f6b7437fa600bf1401b68",
+  "rules/active/TG-SEC-003-tracked-env-file.md": "b08d9ffa7dbcf799fc8edc3c07d56a4a61abf5970d7bd44bd7f5608e36df7c29",
+  "rules/active/TG-SEC-004-sensitive-logging.md": "c8dced7aa7ba44a2a9ec3dfa281c938eee96c311a6a6b25036b7f7e06c2c2de0",
+  "rules/agent/TG-AGENT-001-prompt-injection-system-context.md": "d14e6c25b31c489bdb8fc9dc1309b65c7b831d3e4d2f2c989e4239ecf2a638b5",
+  "rules/agent/TG-AGENT-002-unsafe-tool-dispatch-unsandboxed-execution.md": "810bcdbb8017a739db0ec5b6fad3d92ce33a69455c4c89462eaf4314aac93308",
+  "rules/agent/TG-AGENT-003-broad-mcp-tool-scoping.md": "8746e948e0849e6569f19b510cd70007a58e76b75048fc4cebd1a2079894bf5c",
+  "rules/agent/TG-AGENT-004-persistent-memory-cross-session-leakage.md": "b3c322e56231b4450fcfe2436803c87a560e91390ff3055386dadae5ebc693e5",
+  "rules/authorization/TG-AUTH-006-mass-assignment.md": "9544e6df5d7420eb4dce4fbddd63f21103d82d91fedaedcfe041943b18452472",
+  "rules/authorization/TG-AUTH-007-missing-property-level-authorization.md": "5a1afe03c03d8d3fe7ce952ead8ab011c1c209d029361ce183bf8091216914d0",
+  "rules/authorization/TG-AUTH-008-untrusted-role-header-injection.md": "74cac648fd6c6b49523be499ecf878240b9ea58d1086c1b84c17532d4ba4ee49",
+  "rules/business-logic/TG-BIZ-001-client-controlled-sensitive-business-value.md": "4e837ee5cb053db5ead273bb2e5d934f870ece007c41913362e3138f17b6bcf8",
+  "rules/business-logic/TG-BIZ-002-replayable-one-time-operation.md": "906133df5a576d77515e20a2523f58452dbd22fccdfc4193ebb487298d42b0eb",
+  "rules/business-logic/TG-BIZ-003-missing-workflow-state-validation.md": "86f180dc7ed54665aef7b9077ad991bbb969e01371972dfa89c0f5353571d20c",
+  "rules/business-logic/TG-BIZ-004-unrestricted-sensitive-business-flow.md": "946950e4779b04cd57fd046a162d61bc33b302ccd29db97361d3e3a70b34a177",
+  "rules/cache/TG-CACHE-001-sensitive-response-publicly-cacheable.md": "8f0789c6851dc560e15f26f1f7d26d3670e7212fa7f5bc7e1c09bd09ef1b8edf",
+  "rules/cache/TG-CACHE-002-missing-user-cache-isolation.md": "cf29c883b880e4afdeebb0d74fd9b1622c6a395fd8486e142f175b90ee948874",
+  "rules/cache/TG-CACHE-003-sensitive-data-in-url.md": "c15a8eebfe32716ede037dc594dd01800e341f4b6f3b056d6f76a9a9af57ffb9",
+  "rules/csrf/TG-CSRF-001-missing-csrf-protection.md": "322f2f1bd964426823f1adb7dc20085d1d95aeef557b8d9f74e24d457dd885f6",
+  "rules/csrf/TG-CSRF-002-unsafe-credentialed-cross-origin-request.md": "43ee1934cc01ed2378b73e587efac8e357b4089dfbef23a57ba9ebe633816157",
   "rules/custom/README.md": "f2128661ad3bc4085a69ddfbabbb2211930215fc42a25e2ab2d3e7a4b749a639",
+  "rules/edge/TG-EDGE-001-serverless-global-state-leak.md": "82fe764a67228c71359b340a983cb37dc8bf4521d030846e0cea433de43c52d3",
+  "rules/edge/TG-EDGE-003-aws-lambda-ephemeral-cold-start.md": "2659db7d38b6689d1d3a99ad5f2504ea264b3d3a601ab38186737b12d4d42c17",
+  "rules/graphql/TG-GQL-001-missing-query-depth-or-complexity-limits.md": "bfee2cb26c71871cc4b93e224dc56c18de0d0ea692a431f7b27a51e7e408873f",
+  "rules/graphql/TG-GQL-002-resolver-missing-authorization.md": "81859a712d482ded016507c7a67e16358a6a29a3c9a9dc04495c907e155a0589",
+  "rules/graphql/TG-GQL-003-unbounded-graphql-pagination-or-batching.md": "b6c3b95ed97b704d4fc43155f1cd3cd844d69f0040cdcad9e1051dbd055f3ca9",
+  "rules/graphql/TG-GQL-004-unnecessary-production-introspection.md": "034fb574fe79346f1c859ff143e4ab70110fff2950a3900fac324f490a837888",
+  "rules/secrets/TG-SEC-005-secret-in-git-history.md": "22ba761d8375aa249bd6a8284de1dce9c7aeda0f26b8fa20d660eb46d09ec711",
+  "rules/secrets/TG-SEC-006-secret-in-build-artifact.md": "7130799c3218ae953a1673bdbb6b7afddfcbf6d0a95500ea558334915b9a0199",
+  "rules/secrets/TG-SEC-007-secret-in-test-or-example-fixture.md": "558092260732217666d3fcbce6cce57856f082e5fcc77eb34d19cb29e666ac2c",
+  "rules/ssrf/TG-SSRF-001-user-controlled-server-side-url-fetch.md": "d6a9bee4b60c1f2a02f83dfc59c71e4aefb2284431cead83703d2882ba8813e1",
+  "rules/ssrf/TG-SSRF-002-missing-internal-network-protection.md": "a421a1f85e6dffe11cfa570deb976213bf044f69ec5061dae1a7f3e6b0893759",
+  "rules/ssrf/TG-SSRF-003-unsafe-redirect-following.md": "b6c43733600a6b1849cae64f16ca4eb2d16bd440a6a8c890ff8ad25e38fec292",
+  "rules/ssrf/TG-SSRF-004-unbounded-outbound-request.md": "be3fd4f403605cf75d8f27448f2b305fd7ff327e6626091c13af14434971589c",
+  "rules/supply-chain/TG-SUPPLY-001-missing-or-ignored-dependency-lockfile.md": "f19b10647789c7fa57eccbb5b220f925195cee391f2f1253258322f113855f23",
+  "rules/supply-chain/TG-SUPPLY-002-vulnerable-dependency-review-missing.md": "f80f2717fdba26e1520bb40276edb6d88835eb8c307e170ff8ab9572187f338f",
+  "rules/supply-chain/TG-SUPPLY-003-unsafe-ci-cd-secret-exposure.md": "73eadb6a87ae7f7a66f04be03622720ce6ec9389fdce1b1844047088daf8a389",
+  "rules/supply-chain/TG-SUPPLY-004-unpinned-ci-action.md": "492d50e5bddcf3cfb82f1e44baefe4afd1311728cd77aa7bb89f721808ddb4ba",
+  "rules/supply-chain/TG-SUPPLY-005-unsafe-dependency-install-script.md": "5960008c0182c2e809089975ecec6ac4f2caa393953abe4d223cce4b2274a8b8",
+  "rules/supply-chain/TG-SUPPLY-006-container-build-secret-persistence.md": "eaadfc37364f150aa08212afd9a629bb084bdd705c6663534b6ea6c74f383053",
+  "rules/webhook/TG-WEBHOOK-001-missing-webhook-signature-verification.md": "3d2f4de4683ac18f4fdfea3e191fe7bdb305c845c76343ab05205d9f3ea3ee73",
+  "rules/webhook/TG-WEBHOOK-002-replayable-webhook.md": "e5f26c0874b5d0974b8aa55c664281a6643b08f87ad1c28cfcaebbb58172956c",
+  "rules/webhook/TG-WEBHOOK-003-missing-webhook-idempotency.md": "bc5cc14d0112260b60120c2d5b0d670477884a0cddbe608408318f006534028d",
+  "rules/webhook/TG-WEBHOOK-004-unvalidated-webhook-event-type.md": "5a5d0eacbaa803e499b05cb59506eaaa8a7b311666c6db4ce1490ae227132102",
+  "rules/websocket/TG-WS-001-unauthenticated-websocket-handshake.md": "b700f08ae47d12f9ed014905c04a4542fcb1bdc34064fb8eb01168f92f5752ae",
+  "rules/websocket/TG-WS-002-missing-channel-level-authorization.md": "32bb0234600ee1712bdbe9190fcf2b5f2ca43987e266fd130e4bd4444bed9712",
+  "rules/websocket/TG-WS-003-unvalidated-websocket-message.md": "b801bd9131b63df2e36132a47a15d1f38c6786bdb696fad5c70059d8d419153c",
+  "rules/websocket/TG-WS-004-unbounded-websocket-connections.md": "5ffa620c039192ade9e44dba83ebba2325f71676767950ea53c620ccfc86a1ad",
   "schemas/authorization.schema.json": "84885c9edc930a22c777d8685219f1f25b5320c0c6062722e3ba09f1fe417ad4",
   "schemas/confidence.schema.json": "09c5098f55f3936e9231ba417ace4fa7aa9ebc49233b4bfa88a4103ef6f1202c",
   "schemas/evidence.schema.json": "7dff029c34965e9aeee932028d11bf30d4f3ff76f8137af382bf3d3dc2c0df10",
@@ -42,18 +141,23 @@
   "schemas/remediation.schema.json": "544904239f871dec9552973e01e09dc1f40dbb8330f20d98c319f3b24031d630",
   "schemas/retest.schema.json": "97c0407ca4365a524020c430912f686f698cc0de90043194621071e9fc681cc7",
   "schemas/runtime-evidence.schema.json": "929d2b094c1cd1f7f9db07be1eba5994e8002477eab3fd24140e1e973fd18cc1",
-  "scripts/diff_guard.py": "c2bb88f6e958063c16c06d35eba747ee259bbe79077c7194c3e2eb427195bf70",
-  "scripts/finding_scorer.py": "54c574019b31065dd8fe3bd61676657c2db0f0cf7275e308b7bf933536d422b9",
-  "scripts/html_reporter.py": "540929c9c79369bc8b6fae58857bb80b6fd492041168f5f1e4ea69ab6d324d84",
-  "scripts/manifest_builder.py": "ce351a18ed5092099019d4f469a8cf9c4ae186a426ff9c711ee2c0402755abb9",
-  "scripts/memory_engine.py": "05ae1f17e7b4dc9a79aab429427c2cf401846d9e710dd6c3fe317d834b157529",
+  "scripts/apply_runner.py": "f5f9406b01b56070fea86e524c04b16255998d88e67e3be9e2517fb52aba82a8",
+  "scripts/audit_runner.py": "71553ca6c2d57df6f7323d41abc0216ecedb821fcf0eb5fd502290bd6dec6ae4",
+  "scripts/diff_guard.py": "0dc178cdde1ac0ae1a1ea4b2eb2ce1756b2126f6156909cf55d85249f115fcbd",
+  "scripts/finding_scorer.py": "885c7cbb7a8def2ceda0266e5a7f893938e41debc7501f7400a17a606b22dc23",
+  "scripts/harden_runner.py": "1384b74d57df0bd7f50930128e28aba5245a72795ac876aa1065d8ae83a03045",
+  "scripts/html_reporter.py": "f2bc401e9dfebda2c0e078897247210b2c8b83cba24add00e618821f9cae9eda",
+  "scripts/manifest_builder.py": "c0137927789a9e40a08243e630ac3c6990beb1b87807934e98906c8ad0b99a97",
+  "scripts/memory_engine.py": "b715d0ca030e95eb06ad6eda99027535df8a7e37d64897c023be6a291cf13dc6",
   "scripts/monorepo_detector.py": "5603674136a5294ebfff89efeca0a546dd4a7deb1d184a2592ff21aff2131f73",
+  "scripts/recheck_runner.py": "bb381717a93db07fc899c98e43b1587d1d2ce6ebb1c1bd8e37d460eac7f4ab19",
+  "scripts/recipes_runner.py": "7f6dc401c4b39b2e804b4db457caed04a11022b43c90651408fd26675bef1b3b",
   "scripts/rules_sync.py": "4101b2ca8036ff4f468800b32a8d08898e8640a74d14124af53d454706a62d3a",
-  "scripts/run_manager.py": "b576fc3be9929ee6a52e67662e67f801e4e9317c158243582911e10c94a07619",
+  "scripts/run_manager.py": "b738ff70879e46547d32fac6befc61de9599f676411384280fb9819ea3ad7035",
   "scripts/safety_gate.py": "3379b7534b2590cf563717a448983ad8ed7e8f174f0ad65683d33e8a10f51558",
   "scripts/sarif_exporter.py": "35c66637413afc4b72d5bd426638447c77231d2a8594dce5addceffd4803a20d",
   "scripts/stack_detect.py": "7848006e3cd6e828f7dbe189a8c9728abd58e021ff02efbc4230ef8ca3444596",
-  "skills/torusguard/SKILL.md": "e772e348716aee26e424ec96be5bd6750dbebcefc248bc4dab0df1e6c0e24fcf",
+  "skills/torusguard/SKILL.md": "595008bf365b77729118b0312ec636fb72668ee57f458087ed555a00e1d3db6b",
   "skills/torusguard/bootstrap.py": "20cf16a30fc26cfa0e585708c103ab481751eebec569b61907f1d0b83bad7d99",
   "skills/torusguard/references/auth-and-sessions.md": "c3e4b9600cb53fc28c993922dc880accbec5783ac90d5ee98d63b52762d19525",
   "skills/torusguard/references/business-logic-and-abuse.md": "58e87df2864d468af70c1ff39f5d540c687fa846b671457f85046ab2065fe99c",

package/.torusguard/rules/README.md

@@ -1,62 +1,93 @@
-# TorusGuard Security Rule Catalog & Activation System
-
-This directory manages the active and custom security rules enforced by TorusGuard.
-
----
-
-## 1. Rule Architecture & Taxonomy
-
-TorusGuard security rules follow a canonical identifier pattern: `TG-<CATEGORY>-<NUMBER>`.
-
-| Category Prefix | Domain Area | Focus & Vulnerability Classes |
-| :--- | :--- | :--- |
-| `TG-AUTH` | Authentication & Authorization | Missing tenant scoping, client-only route guards, session cookie flags, insecure password resets |
-| `TG-INPUT` | Input Validation & Injection | SQL injection, unsafe HTML/template rendering, unvalidated file uploads, path traversal |
-| `TG-SEC` | Secrets & Configuration | Hardcoded API keys, tracked `.env` files, sensitive logging, exposed cloud credentials |
-| `TG-DB` | Database & ORM Security | Frontend direct DB access, admin SDK exposure, missing multi-tenant query isolation |
-| `TG-CLIENT` | Frontend & Client Bundles | Public production source maps, sensitive secrets embedded in client build assets |
-| `TG-RATE` | Rate Limiting & Resource Abuse | Unlimited auth endpoints, unbounded pagination, excessive resource consumption |
-| `TG-PLATFORM` | Platform & Gateway Hardening | Wildcard CORS with credentials, missing security headers, exposed stack traces |
-| `TG-SSRF` | Outbound Requests & SSRF | Unvalidated HTTP client destinations, metadata IP access, internal network probing |
-| `TG-SUPPLY` | Dependency & Supply Chain | Unpinned dependencies, known CVEs, malicious dependency confusion risks |
-
----
-
-## 2. Active Rules System (`rules/active/`)
-
-When you run `/torusguard init`, TorusGuard automatically inspects your project stack and activates relevant rules in `rules/active/`.
-
-- **Universal Rules:** Always activated (`TG-SEC-*`, `TG-INPUT-*`, `TG-AUTH-*`).
-- **Framework-Specific Rules:**
-  - Python / Django: `TG-DB-004`, `TG-RATE-001`, `TG-PLATFORM-*`.
-  - Next.js / React: `TG-CLIENT-*`, `TG-PLATFORM-001`, `TG-AUTH-002`.
-  - API / Node.js: `TG-INPUT-001`, `TG-SSRF-001`, `TG-RATE-002`.
-
----
-
-## 3. Creating Custom Rules
-
-You can add custom rules directly into this directory or configure a custom path in `.torusguard/config/torusguard.json`:
-
-```markdown
-# TG-CUSTOM-001: Require Organization UUID on All Tenant Queries
-
-**Severity:** High  
-**Category:** authentication-authorization  
-**Confidence Base:** 80  
-
-### Vulnerability Pattern
-Ensure every database query on multi-tenant models filters explicitly by `org_id` or `tenant_id`.
-
-### Unsafe Pattern
-```python
-# Unsafe: Queries tenant data globally without org predicate
-TenantRecord.objects.filter(status="active")
-```
-
-### Safe Pattern
-```python
-# Safe: Scoped to requesting organization
-TenantRecord.objects.filter(org_id=request.user.org_id, status="active")
-```
-```
+# TorusGuard Rule Catalog
+
+Stable rule IDs for TorusGuard v1.3.0. Each rule has a dedicated document in this directory.
+
+## Severity Definitions
+
+| Severity | Meaning |
+|----------|---------|
+| **Critical** | Secret exposure or flaw enabling immediate compromise of sensitive systems/data |
+| **High** | Exploitable weakness likely to expose or modify sensitive data, accounts, or privileged operations |
+| **Medium** | Important defense gap with meaningful but contextual impact |
+| **Low** | Hardening improvement or limited direct impact |
+| **Info** | Best-practice observation requiring human judgment |
+
+## Rule Index
+
+### Secrets and Configuration
+
+| ID | Title | Default Severity |
+|----|-------|------------------|
+| [TG-SEC-001](TG-SEC-001-hardcoded-secrets.md) | Hardcoded Secret | Critical |
+| [TG-SEC-002](TG-SEC-002-public-environment-secrets.md) | Sensitive Value in Public Environment Variable | Critical |
+| [TG-SEC-003](TG-SEC-003-tracked-env-file.md) | Tracked Environment File | High |
+| [TG-SEC-004](TG-SEC-004-sensitive-logging.md) | Sensitive Data Logging | Medium |
+
+### Frontend Database Exposure
+
+| ID | Title | Default Severity |
+|----|-------|------------------|
+| [TG-DB-001](TG-DB-001-frontend-database-query.md) | Database Query in Frontend Source | High |
+| [TG-DB-002](TG-DB-002-privileged-database-credential.md) | Privileged Database Credential in Browser Code | Critical |
+| [TG-DB-003](TG-DB-003-frontend-admin-sdk.md) | Frontend Admin SDK or Privileged Client | Critical |
+
+### Input and Injection
+
+| ID | Title | Default Severity |
+|----|-------|------------------|
+| [TG-INPUT-001](TG-INPUT-001-missing-server-validation.md) | Missing Server-Side Input Validation | High |
+| [TG-INPUT-002](TG-INPUT-002-raw-sql-concatenation.md) | Raw SQL Concatenation | Critical |
+| [TG-INPUT-003](TG-INPUT-003-unsafe-html-or-code-execution.md) | Unsafe HTML or Dynamic Code Execution | High |
+| [TG-INPUT-004](TG-INPUT-004-unrestricted-file-upload.md) | Unrestricted File Upload | High |
+
+### Authentication and Authorization
+
+| ID | Title | Default Severity |
+|----|-------|------------------|
+| [TG-AUTH-001](TG-AUTH-001-weak-password-storage.md) | Weak Password Storage | Critical |
+| [TG-AUTH-002](TG-AUTH-002-client-only-authorization.md) | Client-Only Authorization | High |
+| [TG-AUTH-003](TG-AUTH-003-missing-object-authorization.md) | Missing Object-Level Authorization (IDOR) | High |
+| [TG-AUTH-004](TG-AUTH-004-insecure-session-cookie.md) | Insecure Session Cookie | High |
+| [TG-AUTH-005](TG-AUTH-005-unsafe-password-reset.md) | Unsafe Password Reset or Account Recovery | High |
+
+### Rate Limiting and Resource Abuse
+
+| ID | Title | Default Severity |
+|----|-------|------------------|
+| [TG-RATE-001](TG-RATE-001-unlimited-auth-endpoint.md) | Unlimited Authentication Endpoint | High |
+| [TG-RATE-002](TG-RATE-002-unlimited-public-write-endpoint.md) | Unlimited Public Write or Expensive Endpoint | Medium |
+| [TG-RATE-003](TG-RATE-003-unbounded-resource-consumption.md) | Unbounded Resource Consumption | High |
+
+### Client Exposure
+
+| ID | Title | Default Severity |
+|----|-------|------------------|
+| [TG-CLIENT-001](TG-CLIENT-001-public-production-source-maps.md) | Public Production Source Maps | Medium |
+| [TG-CLIENT-002](TG-CLIENT-002-sensitive-client-bundle-content.md) | Sensitive Client Bundle Content | High |
+
+### Platform Hardening
+
+| ID | Title | Default Severity |
+|----|-------|------------------|
+| [TG-PLATFORM-001](TG-PLATFORM-001-wildcard-cors-with-credentials.md) | Wildcard CORS With Credentials | High |
+| [TG-PLATFORM-002](TG-PLATFORM-002-missing-security-headers.md) | Missing Security Headers | Medium |
+| [TG-PLATFORM-003](TG-PLATFORM-003-production-stack-trace-exposure.md) | Production Stack Trace or Internal Error Exposure | Medium |
+| [TG-PLATFORM-004](TG-PLATFORM-004-missing-request-size-limits.md) | Missing Request Size Limits | Medium |
+
+## Area Mapping for `/TorusGuard check`
+
+| Area | Rules |
+|------|-------|
+| `secrets` | TG-SEC-001 … TG-SEC-004 |
+| `database` | TG-DB-001 … TG-DB-003 |
+| `input` | TG-INPUT-001 … TG-INPUT-004 |
+| `auth` | TG-AUTH-001 … TG-AUTH-005 |
+| `rate-limit` | TG-RATE-001 … TG-RATE-003 |
+| `client` | TG-CLIENT-001 … TG-CLIENT-002 |
+| `platform` | TG-PLATFORM-001 … TG-PLATFORM-004 |
+
+## Related Documentation
+
+- Reference modules: `skills/TorusGuard/references/`
+- Framework guides: `guides/`
+- Example mappings: `examples/vulnerable-react-express/vulnerabilities.md`, `examples/hardened-react-express/fixes.md`

package/.torusguard/rules/TG-AUTH-001-weak-password-storage.md

@@ -0,0 +1,103 @@
+# TG-AUTH-001: Weak Password Storage
+
+## Severity
+Critical
+
+## Applies To
+- User registration and login systems
+- Password reset and credential update flows
+- Legacy account import/migration jobs
+- Identity providers that store local credentials
+
+## Why It Matters
+Weak password storage enables catastrophic compromise when databases leak through attacks, backups, logs, or insider misuse.
+Plaintext, reversible encryption, or fast unsalted hashes let attackers recover passwords quickly and reuse them across services.
+Secure, adaptive hashing with per-password salt and optional pepper drastically reduces offline cracking feasibility.
+
+## What TorusGuard Looks For
+- Passwords stored as plaintext or encoded forms such as Base64.
+- Use of outdated fast hashes (`MD5`, `SHA1`, bare `SHA256`) for password storage.
+- Same hash value for identical passwords due to missing random salt.
+- Manual cryptography routines instead of vetted password hashing libraries.
+- Logging of raw passwords or hash inputs during authentication workflows.
+
+## Unsafe Example
+```js
+import crypto from "crypto";
+
+app.post("/api/register", async (req, res) => {
+  const email = req.body.email;
+  const password = req.body.password;
+
+  // Fast hash with no salt and no work factor
+  const passwordHash = crypto.createHash("sha256").update(password).digest("hex");
+
+  await db.user.create({
+    data: { email, password_hash: passwordHash }
+  });
+
+  res.json({ ok: true });
+});
+```
+
+## Safe Example
+```js
+import argon2 from "argon2";
+
+app.post("/api/register", async (req, res) => {
+  const email = String(req.body.email || "");
+  const password = String(req.body.password || "");
+
+  if (password.length < 12) {
+    return res.status(400).json({ ok: false, error: "Password too short" });
+  }
+
+  const hash = await argon2.hash(password, {
+    type: argon2.argon2id,
+    memoryCost: 19456,
+    timeCost: 2,
+    parallelism: 1
+  });
+
+  await db.user.create({
+    data: { email, password_hash: hash }
+  });
+
+  res.json({ ok: true });
+});
+
+app.post("/api/login", async (req, res) => {
+  const user = await db.user.findUnique({ where: { email: req.body.email } });
+  if (!user) return res.status(401).json({ ok: false });
+
+  const valid = await argon2.verify(user.password_hash, String(req.body.password || ""));
+  if (!valid) return res.status(401).json({ ok: false });
+
+  res.json({ ok: true });
+});
+```
+
+## Remediation
+1. Replace insecure password storage with Argon2id, bcrypt, or scrypt using recommended cost factors.
+2. Ensure each password hash includes a unique random salt (handled by modern libraries).
+3. Add optional application-level pepper stored in a secret manager, not in the database.
+4. Remove password values from logs, traces, analytics events, and error telemetry.
+5. Migrate existing hashes using rehash-on-login or controlled reset campaigns.
+6. Periodically tune work factors based on current hardware and latency targets.
+
+## Verification
+- Inspect stored credential records and confirm they use adaptive hash formats.
+- Verify identical passwords across test accounts produce different hash outputs.
+- Benchmark login flow to ensure configured cost factors are actually applied.
+- Attempt cracking tests on sample exported hashes to validate resistance assumptions.
+- Review codebase for direct use of fast hash APIs in authentication modules.
+
+## False Positives and Exceptions
+- One-way hashes for non-password tokens may look similar but are separate controls.
+- Temporary test fixtures can include static hashes only if isolated from production data paths.
+- External identity providers reduce local password handling scope but do not exempt backup credential paths.
+
+## Related Rules
+- [TG-AUTH-005](./TG-AUTH-005-unsafe-password-reset.md)
+- [TG-AUTH-004](./TG-AUTH-004-insecure-session-cookie.md)
+- [TG-INPUT-001](./TG-INPUT-001-missing-server-validation.md)

package/.torusguard/rules/TG-AUTH-002-client-only-authorization.md

@@ -0,0 +1,85 @@
+# TG-AUTH-002: Client-Only Authorization
+
+## Severity
+High
+
+## Applies To
+- Single-page applications with protected routes
+- Mobile apps that hide privileged UI actions
+- APIs serving both user and admin clients
+- Feature-flagged operations with role constraints
+
+## Why It Matters
+Authorization enforced only in frontend code is not security control, because attackers can bypass the UI and call backend APIs directly.
+If server endpoints trust client-supplied role flags or hidden form fields, privilege escalation becomes trivial.
+Robust authorization must be verified on every sensitive backend action regardless of UI behavior.
+
+## What TorusGuard Looks For
+- Admin checks present in frontend components but absent in backend handlers.
+- API routes that trust `role`, `isAdmin`, or similar flags from request body/query.
+- Hidden buttons/menus used as the only barrier to privileged operations.
+- Use of local storage role values for security decisions.
+- Missing middleware or policy checks around destructive and high-impact endpoints.
+
+## Unsafe Example
+```js
+// Frontend blocks non-admin users from seeing delete button
+if (currentUser.role === "admin") {
+  showDeleteUserButton();
+}
+
+// Backend route does not verify authenticated role
+app.post("/api/admin/delete-user", async (req, res) => {
+  const targetUserId = req.body.userId;
+  await db.user.delete({ where: { id: targetUserId } });
+  res.json({ ok: true });
+});
+```
+
+## Safe Example
+```js
+function requireRole(...allowedRoles) {
+  return (req, res, next) => {
+    const role = req.auth?.role;
+    if (!allowedRoles.includes(role)) {
+      return res.status(403).json({ ok: false, error: "Forbidden" });
+    }
+    next();
+  };
+}
+
+app.post("/api/admin/delete-user", requireAuth, requireRole("admin"), async (req, res) => {
+  const targetUserId = String(req.body.userId || "");
+  if (!/^[a-f0-9-]{36}$/.test(targetUserId)) {
+    return res.status(400).json({ ok: false, error: "Invalid user id" });
+  }
+
+  await db.user.delete({ where: { id: targetUserId } });
+  res.json({ ok: true });
+});
+```
+
+## Remediation
+1. Enforce authorization checks on the server for every protected action and resource.
+2. Derive roles/permissions from authenticated server-side identity, not request payload flags.
+3. Implement centralized policy middleware to reduce inconsistent endpoint protection.
+4. Keep frontend role checks for UX only, never as the sole security mechanism.
+5. Add audit logging for privileged operations including actor, target, and outcome.
+6. Write regression tests that call endpoints directly without using the UI.
+
+## Verification
+- Call privileged endpoints with a non-admin token and verify consistent `403` responses.
+- Remove/hide frontend restrictions in browser devtools and confirm backend still blocks access.
+- Attempt sending forged `isAdmin: true` fields and verify they are ignored.
+- Inspect route registrations to ensure protected middleware is applied universally.
+- Review audit logs for denied authorization attempts.
+
+## False Positives and Exceptions
+- Public metadata endpoints may intentionally skip authorization if they contain no sensitive operations or data.
+- Early prototypes often rely on frontend checks; production deployment must not.
+- Internal admin APIs still require authorization controls unless isolated by strong network identity boundaries.
+
+## Related Rules
+- [TG-AUTH-003](./TG-AUTH-003-missing-object-authorization.md)
+- [TG-AUTH-004](./TG-AUTH-004-insecure-session-cookie.md)
+- [TG-INPUT-001](./TG-INPUT-001-missing-server-validation.md)

package/.torusguard/rules/TG-AUTH-003-missing-object-authorization.md

@@ -0,0 +1,85 @@
+# TG-AUTH-003: Missing Object-Level Authorization (IDOR)
+
+## Severity
+High
+
+## Applies To
+- APIs that fetch or modify records by ID
+- File and document retrieval endpoints
+- Multi-tenant systems with organization-scoped data
+- Billing, messaging, and profile management resources
+
+## Why It Matters
+IDOR occurs when applications expose object identifiers but fail to verify that the requester is allowed to access that specific object.
+Attackers can enumerate or guess IDs to read, modify, or delete other users' resources without needing elevated roles.
+This creates severe confidentiality and integrity breaches, especially in multi-tenant products.
+
+## What TorusGuard Looks For
+- Endpoints reading `:id` or query IDs without ownership or tenant checks.
+- `findUnique`/`getById` calls that do not include current user or tenant constraints.
+- Access to files/records based solely on untrusted identifier parameters.
+- Sequential numeric IDs exposed in URLs with missing authorization guards.
+- Update/delete operations that authenticate user identity but skip object-level policy.
+
+## Unsafe Example
+```js
+app.get("/api/invoices/:invoiceId", requireAuth, async (req, res) => {
+  const invoiceId = req.params.invoiceId;
+
+  // Authenticated, but no check that invoice belongs to this user/tenant
+  const invoice = await db.invoice.findUnique({
+    where: { id: invoiceId }
+  });
+
+  if (!invoice) return res.status(404).json({ ok: false });
+  res.json({ ok: true, invoice });
+});
+```
+
+## Safe Example
+```js
+app.get("/api/invoices/:invoiceId", requireAuth, async (req, res) => {
+  const invoiceId = String(req.params.invoiceId || "");
+  const userId = req.auth.userId;
+  const tenantId = req.auth.tenantId;
+
+  const invoice = await db.invoice.findFirst({
+    where: {
+      id: invoiceId,
+      tenant_id: tenantId,
+      customer_user_id: userId
+    }
+  });
+
+  if (!invoice) {
+    return res.status(404).json({ ok: false, error: "Not found" });
+  }
+
+  res.json({ ok: true, invoice });
+});
+```
+
+## Remediation
+1. Apply object-level authorization checks on every read, update, and delete path.
+2. Scope data queries by authenticated user, tenant, account, or policy context.
+3. Centralize authorization policies so object checks are consistent across endpoints.
+4. Avoid exposing predictable identifiers when not required; consider opaque IDs.
+5. Log access denials and anomalous ID probing attempts for detection.
+6. Add tests that attempt cross-user and cross-tenant access with valid credentials.
+
+## Verification
+- Authenticate as User A and request User B resources by changing IDs.
+- Confirm unauthorized object access returns `404` or `403` consistently without data leakage.
+- Test update and delete endpoints, not only read endpoints.
+- Validate background jobs and export endpoints enforce tenant/object constraints too.
+- Inspect ORM/database queries for required ownership predicates.
+
+## False Positives and Exceptions
+- Public resources intentionally shared across tenants should be explicitly labeled and policy-reviewed.
+- Some administrative roles can access cross-tenant objects, but this must be explicit and auditable.
+- Random UUID usage alone does not remove need for object authorization.
+
+## Related Rules
+- [TG-AUTH-002](./TG-AUTH-002-client-only-authorization.md)
+- [TG-INPUT-001](./TG-INPUT-001-missing-server-validation.md)
+- [TG-INPUT-002](./TG-INPUT-002-raw-sql-concatenation.md)