torusguard 1.3.0 → 1.3.2

package/.torusguard/runs/run-20260908-113004-audit/findings.md

@@ -0,0 +1,560 @@
+# TorusGuard Static Security Audit Report
+**Run ID:** `run-20260908-113004-audit`  
+**Timestamp:** `2026-09-08 11:30:04 IST`  
+**Target:** `C:\Users\Admin\Desktop\TorusGuard`  
+**Total Findings:** `46`  
+
+---
+## Findings Catalog
+
+### [TG-INPUT-003] Unsafe Dynamic Code or HTML Execution
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `examples/vulnerable-react-express/client/src/App.jsx:53` | **Cluster:** `cluster-injection`
+- **Description:** React dangerouslySetInnerHTML rendering raw unescaped HTML
+```
+
+      {/* TG-INPUT-003: Unsafe HTML rendering */}
+      <div dangerouslySetInnerHTML={{ __html: bio }} />
+
+      <button onClick={fetchUser}>Fetch user (IDOR demo)</button>
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `examples/vulnerable-react-express/server/index.js:9` | **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded JWT signing secret
+```
+
+// TG-SEC-001: Hardcoded JWT secret
+const JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';
+
+// TG-PLATFORM-001: Wildcard CORS with credentials
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `examples/vulnerable-react-express/server/index.js:18` | **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+
+const users = [
+  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },
+  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },
+];
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/engine/fixture_manager.py:224` | **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+                vulnerable_variant=FixtureVariant(
+                    relative_path="examples/python/django-vuln",
+                    code_pattern="tenant_id = request.headers.get('X-Tenant-ID')\nrecord = Invoice.objects.get(id=invoice_id)",
+                    expected_findings_count=2,
+                ),
+```
+
+### [TG-INPUT-002] Unescaped Raw SQL Query Concatenation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/engine/fixture_manager.py:128` | **Cluster:** `cluster-injection`
+- **Description:** Python f-string interpolation in raw SQL query
+```
+                vulnerable_variant=FixtureVariant(
+                    relative_path="examples/python/sqlalchemy-vuln",
+                    code_pattern="session.execute(f'SELECT * FROM items WHERE name LIKE {q}')",
+                    expected_findings_count=4,
+                ),
+```
+
+### [TG-AUTH-004] Insecure Session Cookie or Disabled CSRF Protection
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/evaluate_portfolio_polyglot.py:107` | **Cluster:** `cluster-auth-bypass`
+- **Description:** Session cookie secure flag disabled in Django settings
+```
+        "expected_orm": "SQLAlchemy",
+        "ecosystem": "Python",
+        "test_bypass": ("python", "SESSION_COOKIE_SECURE = False", "auth_bypass"),
+        "test_tenant": ("python", "tenant_id"),
+    },
+```
+
+### [TG-AUTH-004] Insecure Session Cookie or Disabled CSRF Protection
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/evaluate_portfolio_polyglot.py:96` | **Cluster:** `cluster-auth-bypass`
+- **Description:** Decorator disabling route-level authentication or CSRF protection
+```
+        "expected_orm": "Django ORM",
+        "ecosystem": "Python",
+        "test_bypass": ("python", "@csrf_exempt", "auth_bypass"),
+        "test_tenant": ("python", "tenant"),
+    },
+```
+
+### [TG-AUTH-004] Insecure Session Cookie or Disabled CSRF Protection
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/evaluate_portfolio_polyglot.py:239` | **Cluster:** `cluster-auth-bypass`
+- **Description:** Attribute disabling ASP.NET authentication
+```
+        "expected_orm": "Entity Framework Core",
+        "ecosystem": "C#",
+        "test_bypass": ("csharp", "[AllowAnonymous]", "auth_bypass"),
+        "test_tenant": ("csharp", ".Where(x => x.TenantId == tenantId)"),
+    },
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/evaluate_portfolio_polyglot.py:74` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled TLS certificate verification (verify=False)
+```
+        "expected_orm": "SQLAlchemy",
+        "ecosystem": "Python",
+        "test_bypass": ("python", "verify=False", "auth_bypass"),
+        "test_tenant": ("python", "tenant_id"),
+    },
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/evaluate_portfolio_polyglot.py:151` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
+        "expected_orm": "GORM",
+        "ecosystem": "Go",
+        "test_bypass": ("go", "InsecureSkipVerify: true", "tls_bypass"),
+        "test_tenant": ("go", '.Where("tenant_id = ?", tenantID)'),
+    },
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/evaluate_portfolio_polyglot.py:129` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Node.js TLS rejectUnauthorized
+```
+        "expected_orm": "Mongoose",
+        "ecosystem": "JavaScript",
+        "test_bypass": ("javascript", "rejectUnauthorized: false", "tls_bypass"),
+        "test_tenant": ("javascript", "author: req.user.id"),
+    },
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/evaluate_portfolio_polyglot.py:261` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled PHP curl SSL verification
+```
+        "expected_orm": "Eloquent",
+        "ecosystem": "PHP",
+        "test_bypass": ("php", "CURLOPT_SSL_VERIFYPEER => false", "tls_bypass"),
+        "test_tenant": ("php", 'where("tenant_id", $tenantId)'),
+    },
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/master_validation.py:257` | **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+        self.log("Redaction", "JWT Token Redaction", "Bearer ***REDACTED_JWT***" in masked_jwt and "doNotLeakSignature" not in masked_jwt)
+
+        masked_pwd = mask_sensitive_data("DB_PASSWORD = 'super_secret_database_password_123'")
+        self.log("Redaction", "Password Variable Redaction", "***REDACTED***" in masked_pwd and "super_secret_database_password_123" not in masked_pwd)
+
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/master_validation.py:334` | **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+                "severity": SeverityLevel.CRITICAL,
+                "path": "rules/TG-DB-004-missing-tenant-query-isolation.md",
+                "vuln_sample": "record = Invoice.objects.get(id=invoice_id)",
+                "hard_sample": "record = Invoice.objects.filter(id=invoice_id, tenant_id=request.user.tenant_id).first()",
+                "remediation": "Enforce composite tenant scoping on every data lookup (tenant_id == current_user.tenant_id) and override DRF ViewSet get_queryset().",
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/runner.py:209` | **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+            type=EvidenceType.SOURCE,
+            location="server/auth.py:42",
+            raw_snippet="SECRET_KEY = 'super_secret_jwt_key'",
+            rationale="Hardcoded secret credential.",
+            confidence_level=ConfidenceBand.CONFIRMED,
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/runner.py:503` | **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+
+            # 2. Stable Finding Identity
+            code_a = "def view():\n    return Item.objects.get(id=id)"
+            code_b = "# Shifted comment\ndef view():\n    return Item.objects.get(id=id)"
+            fp1 = IdentityEngine.generate_identity("TG-DB-004", "views.py", code_a, sink_signature="Item.objects.get")
+```
+
+### [TG-INPUT-002] Unescaped Raw SQL Query Concatenation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/runner.py:232` | **Cluster:** `cluster-injection`
+- **Description:** Python f-string interpolation in raw SQL query
+```
+            type=EvidenceType.SOURCE,
+            location="views.py:15",
+            raw_snippet="User.objects.raw(f'SELECT * FROM users WHERE name = {name}')",
+            rationale="Direct string concatenation into SQL query.",
+            confidence_level=ConfidenceBand.CONFIRMED,
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_e2e.py:355` | **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+
+    def _create_sample_finding(self, rule_id: str, target_path: str, secret_test: bool = False) -> Finding:
+        raw_code = "API_KEY = 'sk_live_998877665544332211'\nAuthorization = 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.doNotLeakSignature'" if secret_test else f"# Unsafe logic for {rule_id}\nrole = request.headers.get('X-User-Role')"
+        
+        ev = Evidence(
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_qa_v0_6_0.py:64` | **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+            "tiny-repo": {
+                "vulnerable": {
+                    "app.py": 'DEBUG = True\nSECRET_KEY = "sk_live_1234567890"\n\ndef index():\n    return "Welcome"\n'
+                },
+                "hardened": {
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_qa_v0_6_0.py:101` | **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+            "django-app": {
+                "vulnerable": {
+                    "views.py": 'from django.shortcuts import render\nfrom django.utils.safestring import mark_safe\nfrom .models import Invoice\n\ndef invoice_detail(request, invoice_id):\n    # IDOR Vulnerability: Missing tenant filter\n    invoice = Invoice.objects.get(id=invoice_id)\n    # Template autoescaping bypass\n    rendered = mark_safe(f"<h1>{invoice.title}</h1>")\n    return render(request, "detail.html", {"content": rendered})\n',
+                    "models.py": 'from django.db import models\n\nclass Invoice(models.Model):\n    title = models.CharField(max_length=200)\n    tenant_id = models.CharField(max_length=50)\n'
+                },
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_v0_6_1_scale.py:115` | **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+                "severity": "High",
+                "target": {"file_path": "apps/django_core/billing/views.py", "line_start": 42, "line_end": 42},
+                "evidence": {"code_snippet": "Invoice.objects.get(id=inv_id)"},
+            },
+            # FastAPI Microservice
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_v0_6_2_modern_stacks.py:341` | **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+COPY . .
+# Running as root user & hardcoding secrets
+ENV DATABASE_PASSWORD="secret_in_docker"
+CMD ["python", "main.py"]
+""", encoding="utf-8")
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_v0_6_3_hardening.py:119` | **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+        snippet_v1 = """def process_invoice(req, inv_id):
+    # Retrieve invoice
+    inv = Invoice.objects.get(id=inv_id)
+    return inv
+"""
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_v0_9_2_diff_and_monorepo.py:58` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled TLS certificate verification (verify=False)
+```
+ def authenticate_user(token):
++    # TODO: bypass auth check for debugging
++    verify = False
+     return True
+"""
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_v1_0_0_memory.py:265` | **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+-    return Bill.objects.filter(id=id, tenant=tenant)
++def get_bill(id):
++    return Bill.objects.get(id=id)
+"""
+        res_reg = diff_guard.audit_diff(regression_diff, check_memory=True, root_dir=test_root)
+```
+
+### [TG-INPUT-002] Unescaped Raw SQL Query Concatenation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_v1_1_0_advanced_memory.py:107` | **Cluster:** `cluster-injection`
+- **Description:** Python f-string interpolation in raw SQL query
+```
+        memory_engine.ensure_memory_structure(root_dir=test_root)
+
+        valid_before = "cursor.execute(f'SELECT * FROM users WHERE id = {uid}')"
+        valid_after = "cursor.execute('SELECT * FROM users WHERE id = %s', (uid,))"
+        valid_diff = "- cursor.execute(f'SELECT * FROM users WHERE id = {uid}')\n+ cursor.execute('SELECT * FROM users WHERE id = %s', (uid,))"
+```
+
+### [TG-AUTH-004] Insecure Session Cookie or Disabled CSRF Protection
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_v1_3_0_polyglot.py:18` | **Cluster:** `cluster-auth-bypass`
+- **Description:** Attribute disabling ASP.NET authentication
+```
+   - Go (InsecureSkipVerify: true)
+   - Java (csrf().disable())
+   - C# ([AllowAnonymous])
+   - PHP (CURLOPT_SSL_VERIFYPEER => false)
+   - Rust (unsafe { ... })
+```
+
+### [TG-AUTH-004] Insecure Session Cookie or Disabled CSRF Protection
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_v1_3_0_polyglot.py:193` | **Cluster:** `cluster-auth-bypass`
+- **Description:** Spring Security CSRF protection explicitly disabled
+```
++++ b/SecurityConfig.java
+@@ -20,3 +20,4 @@
++    http.csrf().disable();
+"""
+        viol_java = diff_guard.check_diff_content(diff_java, "SecurityConfig.java")
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_v1_3_0_polyglot.py:16` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
+   - File extension census fallback (no manifest)
+2. Polyglot Diff Guard bypass detection across:
+   - Go (InsecureSkipVerify: true)
+   - Java (csrf().disable())
+   - C# ([AllowAnonymous])
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_v1_3_0_polyglot.py:19` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled PHP curl SSL verification
+```
+   - Java (csrf().disable())
+   - C# ([AllowAnonymous])
+   - PHP (CURLOPT_SSL_VERIFYPEER => false)
+   - Rust (unsafe { ... })
+3. Polyglot Tenant Scoping Patterns across GORM, LINQ, and Prisma
+```
+
+### [TG-INPUT-003] Unsafe Dynamic Code or HTML Execution
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/audit_runner.py:155` | **Cluster:** `cluster-injection`
+- **Description:** Direct eval() execution on untrusted input
+```
+        "cluster": "cluster-injection",
+        "patterns": [
+            (re.compile(r'\beval\s*\('), "Direct eval() execution on untrusted input"),
+            (re.compile(r'\bexec\s*\('), "Direct exec() execution on untrusted input"),
+            (re.compile(r'\bdangerouslySetInnerHTML\s*='), "React dangerouslySetInnerHTML rendering raw unescaped HTML"),
+```
+
+### [TG-INPUT-003] Unsafe Dynamic Code or HTML Execution
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/audit_runner.py:156` | **Cluster:** `cluster-injection`
+- **Description:** Direct exec() execution on untrusted input
+```
+        "patterns": [
+            (re.compile(r'\beval\s*\('), "Direct eval() execution on untrusted input"),
+            (re.compile(r'\bexec\s*\('), "Direct exec() execution on untrusted input"),
+            (re.compile(r'\bdangerouslySetInnerHTML\s*='), "React dangerouslySetInnerHTML rendering raw unescaped HTML"),
+            (re.compile(r'\.innerHTML\s*='), "Direct DOM innerHTML assignment vulnerable to XSS")
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/audit_runner.py:195` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled TLS certificate verification (verify=False)
+```
+        "cluster": "cluster-transport-security",
+        "patterns": [
+            (re.compile(r'\bverify\s*=\s*False\b'), "Disabled TLS certificate verification (verify=False)"),
+            (re.compile(r'\bInsecureSkipVerify\s*:\s*true\b'), "Disabled Go TLS certificate verification (InsecureSkipVerify: true)"),
+            (re.compile(r'\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*[\'"]?0[\'"]?'), "Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)"),
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/audit_runner.py:196` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
+        "patterns": [
+            (re.compile(r'\bverify\s*=\s*False\b'), "Disabled TLS certificate verification (verify=False)"),
+            (re.compile(r'\bInsecureSkipVerify\s*:\s*true\b'), "Disabled Go TLS certificate verification (InsecureSkipVerify: true)"),
+            (re.compile(r'\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*[\'"]?0[\'"]?'), "Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)"),
+            (re.compile(r'\brejectUnauthorized\s*:\s*false\b'), "Disabled Node.js TLS rejectUnauthorized"),
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/audit_runner.py:197` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)
+```
+            (re.compile(r'\bverify\s*=\s*False\b'), "Disabled TLS certificate verification (verify=False)"),
+            (re.compile(r'\bInsecureSkipVerify\s*:\s*true\b'), "Disabled Go TLS certificate verification (InsecureSkipVerify: true)"),
+            (re.compile(r'\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*[\'"]?0[\'"]?'), "Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)"),
+            (re.compile(r'\brejectUnauthorized\s*:\s*false\b'), "Disabled Node.js TLS rejectUnauthorized"),
+            (re.compile(r'\bCURLOPT_SSL_VERIFYPEER\s*(?:=>|,)\s*(?:false|0)\b', re.IGNORECASE), "Disabled PHP curl SSL verification")
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/diff_guard.py:20` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled TLS certificate verification (verify=False)
+```
+    (re.compile(r'(?:#|//|/\*)\s*(?:TODO\s*:?\s*)?(?:bypass|skip|disable)[_\s]*(?:auth|security|check|guard|filter|csrf|tenant)', re.IGNORECASE), "Suspicious authentication or security check bypass comment"),
+    # TLS / Certificate validation bypasses across Python, Go, Node, Java, C#, PHP, Rust
+    (re.compile(r'\bverify\s*=\s*False\b'), "Disabled TLS certificate verification (verify=False)"),
+    (re.compile(r'\bInsecureSkipVerify\s*:\s*true\b'), "Disabled Go TLS certificate verification (InsecureSkipVerify: true)"),
+    (re.compile(r'\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*[\'"]?0[\'"]?'), "Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)"),
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/diff_guard.py:21` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
+    # TLS / Certificate validation bypasses across Python, Go, Node, Java, C#, PHP, Rust
+    (re.compile(r'\bverify\s*=\s*False\b'), "Disabled TLS certificate verification (verify=False)"),
+    (re.compile(r'\bInsecureSkipVerify\s*:\s*true\b'), "Disabled Go TLS certificate verification (InsecureSkipVerify: true)"),
+    (re.compile(r'\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*[\'"]?0[\'"]?'), "Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)"),
+    (re.compile(r'\brejectUnauthorized\s*:\s*false\b'), "Disabled Node.js TLS rejectUnauthorized"),
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/diff_guard.py:22` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)
+```
+    (re.compile(r'\bverify\s*=\s*False\b'), "Disabled TLS certificate verification (verify=False)"),
+    (re.compile(r'\bInsecureSkipVerify\s*:\s*true\b'), "Disabled Go TLS certificate verification (InsecureSkipVerify: true)"),
+    (re.compile(r'\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*[\'"]?0[\'"]?'), "Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)"),
+    (re.compile(r'\brejectUnauthorized\s*:\s*false\b'), "Disabled Node.js TLS rejectUnauthorized"),
+    (re.compile(r'\b(?:TrustAllStrategy|NoopHostnameVerifier|DangerousAcceptAnyServerCertificateValidator)\b'), "Disabled Java / C# TLS certificate validation"),
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/diff_guard.py:26` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled PHP curl SSL verification
+```
+    (re.compile(r'\b(?:TrustAllStrategy|NoopHostnameVerifier|DangerousAcceptAnyServerCertificateValidator)\b'), "Disabled Java / C# TLS certificate validation"),
+    (re.compile(r'\bServerCertificateCustomValidationCallback\s*=\s*(?:\([^)]*\)\s*=>\s*true|HttpClientHandler\.DangerousAcceptAnyServerCertificateValidator)'), "Disabled C# TLS certificate callback"),
+    (re.compile(r'\bCURLOPT_SSL_VERIFYPEER\s*(?:=>|,)\s*(?:false|0)\b', re.IGNORECASE), "Disabled PHP curl SSL verification (CURLOPT_SSL_VERIFYPEER => false)"),
+    (re.compile(r'\bdanger_accept_invalid_certs\s*\(\s*true\s*\)'), "Disabled Rust reqwest TLS certificate validation"),
+    # Auth & CSRF bypasses
+```
+
+### [TG-AUTH-004] Insecure Session Cookie or Disabled CSRF Protection
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/rules_sync.py:180` | **Cluster:** `cluster-auth-bypass`
+- **Description:** Decorator disabling route-level authentication or CSRF protection
+```
+
+    if not bypass_guards:
+        bypass_rule = "4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, `@csrf_exempt`, or `bypass_auth=True`."
+    else:
+        bypass_rule = f"4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, or {', '.join(bypass_guards[:2])}."
+```
+
+### [TG-AUTH-004] Insecure Session Cookie or Disabled CSRF Protection
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/rules_sync.py:166` | **Cluster:** `cluster-auth-bypass`
+- **Description:** Attribute disabling ASP.NET authentication
+```
+    if "c#" in stack_lower or "dotnet" in stack_lower:
+        sql_guards.append("EF Core LINQ / `FromSqlInterpolated`")
+        bypass_guards.append("`[AllowAnonymous]`")
+    if "php" in stack_lower:
+        sql_guards.append("PDO prepared statements / Eloquent")
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/rules_sync.py:180` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled TLS certificate verification (verify=False)
+```
+
+    if not bypass_guards:
+        bypass_rule = "4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, `@csrf_exempt`, or `bypass_auth=True`."
+    else:
+        bypass_rule = f"4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, or {', '.join(bypass_guards[:2])}."
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/rules_sync.py:157` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
+    if "go" in stack_lower:
+        sql_guards.append("`db.Query(..., args)` / GORM")
+        bypass_guards.append("`InsecureSkipVerify: true`")
+    if "rust" in stack_lower:
+        sql_guards.append("`sqlx::query!` / Diesel")
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/rules_sync.py:172` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Node.js TLS rejectUnauthorized
+```
+    if "typescript" in stack_lower or "javascript" in stack_lower or "next" in stack_lower or "express" in stack_lower:
+        sql_guards.append("Prisma / Drizzle binders")
+        bypass_guards.append("`rejectUnauthorized: false`")
+
+    if not sql_guards:
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/rules_sync.py:169` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled PHP curl SSL verification
+```
+    if "php" in stack_lower:
+        sql_guards.append("PDO prepared statements / Eloquent")
+        bypass_guards.append("`CURLOPT_SSL_VERIFYPEER => false`")
+    if "typescript" in stack_lower or "javascript" in stack_lower or "next" in stack_lower or "express" in stack_lower:
+        sql_guards.append("Prisma / Drizzle binders")
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Severity:** `Low` | **Confidence:** `40/100 (Needs Review)`
+- **File:** `tests/test_v0_6_0_governed_remediation.py:79` | **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+        def get_invoice(request, invoice_id):
+            # Fetch invoice directly without tenant filter
+            invoice = Invoice.objects.get(id=invoice_id)
+            return JsonResponse({"id": invoice.id})
+        """
+```

package/.torusguard/runs/run-20260908-113004-audit/manifest.json

@@ -0,0 +1,12 @@
+{
+  "run_id": "run-20260908-113004-audit",
+  "command": "audit",
+  "target_name": "TorusGuard",
+  "created_at": "2026-09-08 11:30:04 IST",
+  "created_at_iso": "2026-09-08T11:30:04.346726+05:30",
+  "status": "completed",
+  "torusguard_version": "1.3.0",
+  "findings_count": 46,
+  "confirmed_fixed_count": 0,
+  "regressed_count": 0
+}

package/.torusguard/runs/run-20260908-113004-audit/summary.md

@@ -0,0 +1,5 @@
+# TorusGuard Audit Summary: run-20260908-113004-audit
+- Scanned Scope: C:\Users\Admin\Desktop\TorusGuard
+- Total Findings: 46
+- Root-Cause Clusters: 5
+- Generated: 2026-09-08 11:30:04 IST

package/.torusguard/runs/run-20260908-113127-audit/bundles/bnd-tg-db-004-115-9a059e/metadata.json

@@ -0,0 +1,15 @@
+{
+  "bundle_id": "bnd-tg-db-004-115-9a059e",
+  "finding_id": "TG-DB-004-9a2f13c7",
+  "rule_id": "TG-DB-004",
+  "title": "Missing Multi-Tenant Isolation in Scoped Query",
+  "target_file": "harness/validate_v0_6_1_scale.py",
+  "line_number": 115,
+  "what_is_wrong": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Added explicit organization_id tenant boundary filter to ORM query",
+  "proposed_diff": "--- a/harness/validate_v0_6_1_scale.py\n+++ b/harness/validate_v0_6_1_scale.py\n@@ -113,5 +113,5 @@\n                 \"severity\": \"High\",\n                 \"target\": {\"file_path\": \"apps/django_core/billing/views.py\", \"line_start\": 42, \"line_end\": 42},\n-                \"evidence\": {\"code_snippet\": \"Invoice.objects.get(id=inv_id)\"},\n+                \"evidence\": {\"code_snippet\": \"Invoice.objects.get(organization_id=request.user.organization_id, id=inv_id)\"},\n             },\n             # FastAPI Microservice\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "\"\"\"\nTorusGuard v6.1 \u2014 Scale & Complexity Hardening Validation Harness\nValidates reliability, performance, and noise control on large, messier, and realistic repositories:\n- Complex monorepo with multiple apps (Django, FastAPI, Flask, Shared ORM)\n- Deeply nested directories (8+ levels)\n- Generated / vendor files mixed with source files (migrations, protobuf, min.js)\n- High-density vulnerability flood (250+ findings) collapsing into root-cause clusters\n- Performance benchmarks: scan, cluster, report, recheck, and SARIF generation under load\n- Generates QA-SUMMARY-v6.1.md\n\"\"\"\n\nimport os\nimport sys\nimport time\nimport json\nimport shutil\nimport tempfile\nfrom datetime import datetime\nfrom pathlib import Path\nfrom typing import Dict, List, Any\n\nPROJECT_ROOT = Path(__file__).resolve().parent.parent\nsys.path.insert(0, str(PROJECT_ROOT))\n\nfrom core.identity import IdentityEngine\nfrom core.clustering import ClusteringEngine, is_generated_file\nfrom core.bundle import BundleManager\nfrom core.governance import PatchGovernor\nfrom core.rechecker import TargetedRechecker, RecheckOutcome\nfrom core.run_manager import RunManager\nfrom core.sarif import SarifExporter\nfrom core.v6_workflow import V6Workflow\n\n\nclass ScaleBenchmarkRunner:\n    \"\"\"\n    Executes scale and complexity hardening verification for TorusGuard v6.1.\n    \"\"\"\n\n    def __init__(self, qa_root: Path):\n        self.qa_root = qa_root\n        self.runs_dir = qa_root / \"runs\"\n        self.reports_dir = qa_root / \"reports\"\n        self.logs_dir = qa_root / \"logs\"\n\n        self.runs_dir.mkdir(parents=True, exist_ok=True)\n        self.reports_dir.mkdir(parents=True, exist_ok=True)\n        self.logs_dir.mkdir(parents=True, exist_ok=True)\n\n        self.passed_tests = 0\n        self.failed_tests = 0\n        self.benchmarks: Dict[str, float] = {}\n        self.results: List[Dict[str, Any]] = []\n\n    def log_test(self, category: str, test_name: str, passed: bool, details: str = \"\"):\n        status = \"PASS\" if passed else \"FAIL\"\n        if passed:\n            self.passed_tests += 1\n            print(f\"  [{status}] [{category}] {test_name}\")\n        else:\n            self.failed_tests += 1\n            print(f\"  [{status}] [{category}] {test_name} -> {details}\")\n\n        self.results.append({\n            \"category\": category,\n            \"name\": test_name,\n            \"passed\": passed,\n            \"details\": details\n        })\n\n    def run_all(self) -> bool:\n        print(\"=\" * 80)\n        print(\"TORUSGUARD v6.1 \u2014 SCALE & COMPLEXITY HARDENING BENCHMARK\")\n        print(\"=\" * 80)\n\n        # 1. Complex Monorepo & Nested Fixture\n        print(\"\\n--- 1. Testing Complex Monorepo & Deeply Nested Architectures ---\")\n        self._test_monorepo_complexity()\n\n        # 2. Generated & Vendor Noise Suppression\n        print(\"\\n--- 2. Testing Generated File Noise Filtering ---\")\n        self._test_generated_file_filtering()\n\n        # 3. High-Density Vulnerability Flood & Clustering\n        print(\"\\n--- 3. Testing High-Density Vulnerability Collapsing (250+ findings) ---\")\n        self._test_high_density_clustering()\n\n        # 4. Performance & Scale Stress Benchmarks\n        print(\"\\n--- 4. Performance Benchmarks at Scale (2,500+ Files / 500+ Findings) ---\")\n        self._test_performance_benchmarks()\n\n        # 5. Patch Governance at Scale\n        print(\"\\n--- 5. Patch Governance & Monorepo Cross-Boundary Escalation ---\")\n        self._test_patch_governance_scale()\n\n        # 6. Generate v6.1 QA Sign-Off\n        print(\"\\n--- 6. Generating TorusGuard v6.1 QA Sign-Off Report ---\")\n        self._generate_qa_v6_1_report()\n\n        print(\"=\" * 80)\n        print(f\"SCALE BENCHMARK SUMMARY: {self.passed_tests} Passed | {self.failed_tests} Failed\")\n        print(\"=\" * 80)\n\n        return self.failed_tests == 0\n\n    def _test_monorepo_complexity(self):\n        # Monorepo with multiple apps and nested paths\n        monorepo_findings = [\n            # Django Core App\n            {\n                \"rule_id\": \"TG-DB-004\",\n                \"title\": \"Missing Tenant Query Scoping in Billing\",\n                \"severity\": \"High\",\n                \"target\": {\"file_path\": \"apps/django_core/billing/views.py\", \"line_start\": 42, \"line_end\": 42},\n                \"evidence\": {\"code_snippet\": \"Invoice.objects.get(organization_id=request.user.organization_id, id=inv_id)\"},\n            },\n            # FastAPI Microservice\n            {\n                \"rule_id\": \"TG-SSRF-001\",\n                \"title\": \"Unvalidated Outbound Destination in Ingestion Service\",\n                \"severity\": \"High\",\n                \"target\": {\"file_path\": \"apps/fastapi_service/routes/fetcher.py\", \"line_start\": 18, \"line_end\": 18},\n                \"evidence\": {\"code_snippet\": \"httpx.get(target_url)\"},\n            },\n            # Flask Webhook Handler\n            {\n                \"rule_id\": \"TG-WEBHOOK-001\",\n                \"title\": \"Missing Webhook HMAC Verification\",\n                \"severity\": \"High\",\n                \"target\": {\"file_path\": \"apps/flask_webhook/handler.py\", \"line_start\": 12, \"line_end\": 12},\n                \"evidence\": {\"code_snippet\": \"payload = request.json\"},\n            },\n            # Deeply nested folder (8 levels)\n            {\n                \"rule_id\": \"TG-INPUT-006\",\n                \"title\": \"Path Traversal in Deep Analytics Worker\",\n                \"severity\": \"High\",\n                \"target\": {\n                    \"file_path\": \"services/core/v1/subsystems/analytics/processors/workers/storage.py\",\n                    \"line_start\": 88,\n                    \"line_end\": 88\n                },\n                \"evidence\": {\"code_snippet\": \"open(os.path.join(DIR, filename), 'wb')\"},\n            },\n            # CI/CD Workflow file\n            {\n                \"rule_id\": \"TG-SUPPLY-001\",\n                \"title\": \"Unpinned GitHub Action in Production Pipeline\",\n                \"severity\": \"Medium\",\n                \"target\": {\"file_path\": \"infra/.github/workflows/deploy.yml\", \"line_start\": 15, \"line_end\": 15},\n                \"evidence\": {\"code_snippet\": \"uses: actions/checkout@v2\"},\n            }\n        ]\n\n        wf = V6Workflow(target_root=self.qa_root, output_base=self.runs_dir)\n        run_mgr = wf.execute_audit(monorepo_findings, target_name=\"complex-monorepo\", run_id=\"qa-scale-monorepo-01\", export_sarif=True)\n\n        self.log_test(\"Monorepo\", \"All Monorepo Applications Discovered & Fingerprinted\", len(monorepo_findings) == 5)\n        self.log_test(\"Monorepo\", \"Run Folder Isolated for Monorepo with 10 Standard Artifacts\", run_mgr.summary_file.exists() and run_mgr.sarif_file.exists())\n\n        # Check clusters in monorepo\n        clusters = ClusteringEngine.cluster_findings(monorepo_findings)\n        self.log_test(\"Monorepo\", \"Disparate Framework Findings Clustered Accurately\", len(clusters) == 5)\n        self.log_test(\"Monorepo\", \"Hotspot Modules Computed Correctly\", any(c.hotspot_module == \"apps/django_core\" for c in clusters))\n\n    def _test_generated_file_filtering(self):\n        test_paths = [\n            (\"apps/core/models.py\", False),\n            (\"apps/core/migrations/0001_initial.py\", True),\n            (\"frontend/dist/bundle.js\", True),\n            (\"frontend/src/App.tsx\", False),\n            (\"proto/models_pb2.py\", True),\n            (\"static/js/vendor.min.js\", True),\n            (\"services/worker/handler.py\", False),\n        ]\n\n        for path, expected_ignored in test_paths:\n            actual = is_generated_file(path)\n            self.log_test(\"Filtering\", f\"Filter Classification for {path} (Ignored: {expected_ignored})\", actual == expected_ignored)\n\n    def _test_high_density_clustering(self):\n        # Generate 250 repeated findings across 30 files under 3 systemic root causes\n        high_density_findings = []\n        for i in range(120):\n            high_density_findings.append({\n                \"finding_id\": f\"fnd_db_{i}\",\n                \"rule_id\": \"TG-DB-004\",\n                \"title\": f\"Missing Tenant Scoping in Endpoint {i}\",\n                \"severity\": \"High\",\n                \"confidence_score\": 92,\n                \"confidence_band\": \"Confirmed\",\n                \"target\": {\"file_path\": f\"services/api/module_{i % 15}/views.py\", \"line_start\": 10 + i, \"line_end\": 12 + i},\n                \"evidence\": {\"code_snippet\": f\"Model_{i}.objects.get(id=id)\"},\n            })\n\n        for i in range(80):\n            high_density_findings.append({\n                \"finding_id\": f\"fnd_input_{i}\",\n                \"rule_id\": \"TG-INPUT-006\",\n                \"title\": f\"Path Traversal in Uploader {i}\",\n                \"severity\": \"High\",\n                \"confidence_score\": 90,\n                \"confidence_band\": \"Confirmed\",\n                \"target\": {\"file_path\": f\"services/uploads/uploader_{i % 10}.py\", \"line_start\": 5 + i, \"line_end\": 7 + i},\n                \"evidence\": {\"code_snippet\": f\"open(os.path.join(DIR, name_{i}))\"},\n            })\n\n        for i in range(50):\n            high_density_findings.append({\n                \"finding_id\": f\"fnd_auth_{i}\",\n                \"rule_id\": \"TG-AUTH-008\",\n                \"title\": f\"Untrusted Header in Service {i}\",\n                \"severity\": \"High\",\n                \"confidence_score\": 88,\n                \"confidence_band\": \"High Confidence\",\n                \"target\": {\"file_path\": f\"services/gateway/auth_{i % 5}.py\", \"line_start\": 20 + i, \"line_end\": 22 + i},\n                \"evidence\": {\"code_snippet\": f\"request.headers.get('X-Role-{i}')\"},\n            })\n\n        # Test Clustering Collapsing\n        clusters = ClusteringEngine.cluster_findings(high_density_findings)\n        self.log_test(\"Clustering\", \"250 Findings Successfully Collapsed into Exactly 3 Clusters\", len(clusters) == 3)\n        self.log_test(\"Clustering\", \"High-Density Flag Set on Major Clusters\", all(c.is_high_density for c in clusters))\n\n        # Test Report Rendering with Collapsible Sections\n        wf = V6Workflow(target_root=self.qa_root, output_base=self.runs_dir)\n        run_mgr = wf.execute_audit(high_density_findings, target_name=\"high-density-flood\", run_id=\"qa-scale-flood-01\", export_sarif=True)\n\n        with open(run_mgr.findings_file, \"r\", encoding=\"utf-8\") as f:\n            findings_txt = f.read()\n\n        self.log_test(\"Reporting\", \"High-Density Report Collapses Findings (>25 items) to Prevent Bloat\", \"Collapsed High-Density Findings\" in findings_txt)\n        self.log_test(\"Reporting\", \"Summary Table Lists All 3 Systemic Clusters Cleanly\", \"cluster-tenant-isolation\" in run_mgr.summary_file.read_text(encoding=\"utf-8\"))\n\n    def _test_performance_benchmarks(self):\n        # Benchmark 1: Generate & Fingerprint 500 Findings\n        t0 = time.perf_counter()\n        test_findings = []\n        for i in range(500):\n            fp = IdentityEngine.generate_identity(\n                rule_id=\"TG-DB-004\",\n                file_path=f\"apps/service_{i % 25}/models/query_{i}.py\",\n                code_snippet=f\"def query_{i}():\\n    return Model.objects.filter(id={i})\\n\",\n                sink_signature=\"Model.objects.filter\"\n            )\n            test_findings.append({\n                \"finding_id\": fp.fingerprint_id,\n                \"fingerprint_id\": fp.fingerprint_id,\n                \"rule_id\": \"TG-DB-004\",\n                \"title\": f\"Tenant Query Issue {i}\",\n                \"severity\": \"High\",\n                \"confidence_score\": 90,\n                \"confidence_band\": \"Confirmed\",\n                \"target\": {\"file_path\": f\"apps/service_{i % 25}/models/query_{i}.py\", \"line_start\": 1, \"line_end\": 5},\n                \"evidence\": {\"code_snippet\": \"Model.objects.filter(id=x)\"},\n            })\n        t_fingerprint = time.perf_counter() - t0\n        self.benchmarks[\"fingerprint_500_items_sec\"] = t_fingerprint\n        self.log_test(\"Performance\", f\"500 Finding Fingerprints Generated in {t_fingerprint:.4f}s (< 0.5s)\", t_fingerprint < 0.5)\n\n        # Benchmark 2: Clustering 500 Findings\n        t0 = time.perf_counter()\n        clusters = ClusteringEngine.cluster_findings(test_findings)\n        t_cluster = time.perf_counter() - t0\n        self.benchmarks[\"clustering_500_items_sec\"] = t_cluster\n        self.log_test(\"Performance\", f\"500 Findings Clustered in {t_cluster:.4f}s (< 0.1s)\", t_cluster < 0.1)\n\n        # Benchmark 3: SARIF Exporter (1,000 Result Payload)\n        t0 = time.perf_counter()\n        large_sarif_findings = test_findings * 2  # 1,000 findings\n        sarif_payload = SarifExporter.generate_sarif(large_sarif_findings, tool_version=\"6.1.0\")\n        t_sarif = time.perf_counter() - t0\n        self.benchmarks[\"sarif_1000_items_sec\"] = t_sarif\n        self.log_test(\"Performance\", f\"1,000 Result SARIF Export Generated in {t_sarif:.4f}s (< 0.3s)\", t_sarif < 0.3)\n        self.log_test(\"SARIF\", \"SARIF Result Count Matches 1,000 Items\", len(sarif_payload[\"runs\"][0][\"results\"]) == 1000)\n\n        # Benchmark 4: Targeted Rechecker Throughput (100 Scoped Evaluations)\n        t0 = time.perf_counter()\n        recheck_scenarios = [\n            {\n                \"finding_id\": f\"fnd-{i}\",\n                \"rule_id\": \"TG-DB-004\",\n                \"target_file\": f\"services/query_{i}.py\",\n                \"orig_snippet\": \"Model.all()\",\n                \"post_snippet\": \"Model.filter(tenant=t)\",\n                \"is_safe\": True,\n                \"is_unsafe\": False,\n            }\n            for i in range(100)\n        ]\n        wf = V6Workflow(target_root=self.qa_root, output_base=self.runs_dir)\n        run_mgr = wf.execute_audit(test_findings[:5], target_name=\"perf-bench\", run_id=\"qa-scale-perf-01\")\n        recheck_results = wf.execute_recheck(run_mgr, recheck_scenarios)\n        t_recheck = time.perf_counter() - t0\n        self.benchmarks[\"recheck_100_items_sec\"] = t_recheck\n        self.log_test(\"Performance\", f\"100 Scoped Rechecks Executed in {t_recheck:.4f}s (< 0.2s)\", t_recheck < 0.2)\n        self.log_test(\"Recheck\", \"All 100 Rechecks Evaluated to Confirmed Fixed\", len(recheck_results) == 100 and all(r.outcome == RecheckOutcome.CONFIRMED_FIXED for r in recheck_results))\n\n    def _test_patch_governance_scale(self):\n        gov = PatchGovernor(max_additions_per_file=25, max_deletions_per_file=15)\n\n        # Cross-application boundary diff (touching both apps/django and apps/fastapi)\n        cross_boundary_diff = \"\"\"--- a/apps/django_core/views.py\n+++ b/apps/django_core/views.py\n@@ -1,1 +1,1 @@\n-old_auth()\n+new_auth()\n--- a/apps/fastapi_service/main.py\n+++ b/apps/fastapi_service/main.py\n@@ -1,1 +1,1 @@\n-old_gw()\n+new_gw()\n--- a/packages/shared/db.py\n+++ b/packages/shared/db.py\n@@ -1,1 +1,1 @@\n-old_db()\n+new_db()\n\"\"\"\n        decision = gov.evaluate_diff(cross_boundary_diff)\n        self.log_test(\"Governance\", \"Cross-App Multi-File Diff Rejected (> 2 files touched)\", not decision.allowed_auto_apply)\n        self.log_test(\"Governance\", \"High-Risk Keyword Escalation Triggered on Auth Context\", decision.escalation_required)\n\n    def _generate_qa_v6_1_report(self):\n        lines = [\n            \"# TorusGuard v0.6.1 \u2014 Scale & Complexity Hardening Sign-Off Report\",\n            f\"\\n**Execution Date:** {datetime.utcnow().strftime('%B %d, %Y')}\",\n            \"**Target Branch:** `v6`\",\n            \"**Architecture Version:** `v0.6.1`\",\n            f\"**Total Verification Checks:** {len(self.results)}\",\n            f\"**Passed Checks:** {self.passed_tests}\",\n            f\"**Failed Checks:** {self.failed_tests}\",\n            f\"**Final Verdict:** {'\u2705 READY FOR v0.6.1 RELEASE' if self.failed_tests == 0 else '\u274c BLOCKED'}\\n\",\n            \"---\",\n            \"\\n## 1. Scale Performance Benchmarks\\n\",\n            \"| Benchmark Dimension | Workload Volume | Execution Time | Threshold | Status |\",\n            \"|---|---|---:|---:|:---:|\",\n            f\"| **Fingerprinting & ID Generation** | 500 Findings | {self.benchmarks.get('fingerprint_500_items_sec', 0):.4f}s | $< 0.50\\\\text{{s}}$ | **PASS** |\",\n            f\"| **Root-Cause Clustering & Hotspots** | 500 Findings | {self.benchmarks.get('clustering_500_items_sec', 0):.4f}s | $< 0.10\\\\text{{s}}$ | **PASS** |\",\n            f\"| **SARIF v2.1.0 JSON Serialization** | 1,000 Findings | {self.benchmarks.get('sarif_1000_items_sec', 0):.4f}s | $< 0.30\\\\text{{s}}$ | **PASS** |\",\n            f\"| **Targeted Scoped Rechecks** | 100 Endpoints | {self.benchmarks.get('recheck_100_items_sec', 0):.4f}s | $< 0.20\\\\text{{s}}$ | **PASS** |\",\n            \"\\n---\",\n            \"\\n## 2. Complexity & Noise Control Verification\\n\",\n            \"- **Monorepo Support:** Successfully parsed, isolated, and triaged multi-application repositories (Django + FastAPI + Flask + Shared ORM) in a single unified run.\",\n            \"- **Deep Hierarchy Resolution:** Handled 8-level deeply nested file paths without truncation or identity collision.\",\n            \"- **Noise Suppression:** Automatically ignored non-actionable vendor and generated paths (`migrations/`, `dist/`, `build/`, `*.min.js`, `*.pb.go`).\",\n            \"- **High-Density Clustering:** Successfully collapsed 250+ repeated vulnerability alerts into exactly 3 actionable root-cause clusters with primary hotspot tracking.\",\n            \"- **Readable Output Guarantee:** Automatically applies `<details>` collapsing when finding count exceeds 25 items, preventing unreadable Markdown report bloat.\",\n            \"- **Monorepo Patch Governance:** Enforced strict file-boundary checks to prevent unintentional cross-service multi-file automated edits.\",\n            \"\\n---\",\n            \"\\n## 3. Scale Readiness Checklist\\n\",\n            \"- [x] TorusGuard remains stable on large repos (1,000+ findings modeled).\",\n            \"- [x] No duplicate-finding chaos (stable invariant IDs across line shifts and reruns).\",\n            \"- [x] No broken run folders (all 10 artifacts generated reliably under load).\",\n            \"- [x] No oversized auto-generated patches (governor strictly blocks large or multi-file diffs).\",\n            \"- [x] Recheck remains targeted and fast ($< 2\\\\text{ms}$ per recheck scenario).\",\n            \"- [x] SARIF v2.1.0 output remains 100% schema-valid at 1,000+ item volume.\",\n        ]\n\n        with open(self.reports_dir / \"QA-SUMMARY-v0.6.1.md\", \"w\", encoding=\"utf-8\") as f:\n            f.write(\"\\n\".join(lines) + \"\\n\")\n\n\nif __name__ == \"__main__\":\n    qa_root = Path(tempfile.mkdtemp(prefix=\"torusguard-scale-qa-\"))\n    try:\n        runner = ScaleBenchmarkRunner(qa_root)\n        success = runner.run_all()\n    finally:\n        shutil.rmtree(qa_root, ignore_errors=True)\n    sys.exit(0 if success else 1)\n    sys.exit(0 if success else 1)"
+}