torusguard 1.3.2 → 1.3.4

package/.torusguard/runs/run-20260910-130454-audit/findings.json

@@ -0,0 +1,893 @@
+[
+  {
+    "finding_id": "TG-SEC-001-bb5e4b77",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded JWT signing secret",
+    "severity": "Critical",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 9,
+    "matched_text": "JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION'",
+    "snippet": "\n// TG-SEC-001: Hardcoded JWT secret\nconst JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';\n\n// TG-PLATFORM-001: Wildcard CORS with credentials",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 9,
+      "end_line": 9
+    },
+    "confidence_score": 80,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 80,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-001-c393d596",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded credential or API secret string",
+    "severity": "Critical",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 18,
+    "matched_text": "password: 'password123'",
+    "snippet": "\nconst users = [\n  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },\n  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },\n];",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 18,
+      "end_line": 18
+    },
+    "confidence_score": 80,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 80,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DB-002-d9bd69df",
+    "rule_id": "TG-DB-002",
+    "title": "Privileged Database Secret or Master Role Key in Client Code",
+    "description": "Service role key or raw database connection string reference in frontend code",
+    "severity": "Critical",
+    "category": "database",
+    "cluster": "cluster-client-leak",
+    "file_path": "demo/playground/vulnerable_nextjs/actions.ts",
+    "line_number": 9,
+    "matched_text": "SUPABASE_SERVICE_ROLE_KEY",
+    "snippet": "\n// Finding 1: TG-CLIENT-001 - Backend admin key exposed in client-accessible code\nexport const SUPABASE_SERVICE_ROLE_KEY = \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.demo_secret_token_1234567890\";\n\ninterface UserRecord {",
+    "is_test": false,
+    "target": {
+      "file_path": "demo/playground/vulnerable_nextjs/actions.ts",
+      "start_line": 9,
+      "end_line": 9
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DB-002-d5bb277d",
+    "rule_id": "TG-DB-002",
+    "title": "Privileged Database Secret or Master Role Key in Client Code",
+    "description": "Service role key or raw database connection string reference in frontend code",
+    "severity": "Critical",
+    "category": "database",
+    "cluster": "cluster-client-leak",
+    "file_path": "skills/torusguard/payload/scripts/audit_runner.py",
+    "line_number": 209,
+    "matched_text": "SUPABASE_SERVICE_ROLE_KEY",
+    "snippet": "        \"cluster\": \"cluster-client-leak\",\n        \"patterns\": [\n            (re.compile(r'\\b(?:SUPABASE_SERVICE_ROLE_KEY|DATABASE_URL)\\b'), \"Service role key or raw database connection string reference in frontend code\")\n        ]\n    },",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/audit_runner.py",
+      "start_line": 209,
+      "end_line": 209
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-c87ad73a",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled TLS certificate verification (verify=False)",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/audit_runner.py",
+    "line_number": 284,
+    "matched_text": "verify=False",
+    "snippet": "        \"cluster\": \"cluster-transport-security\",\n        \"patterns\": [\n            (re.compile(r'\\bverify\\s*=\\s*False\\b'), \"Disabled TLS certificate verification (verify=False)\"),\n            (re.compile(r'\\bInsecureSkipVerify\\s*:\\s*true\\b'), \"Disabled Go TLS certificate verification (InsecureSkipVerify: true)\"),\n            (re.compile(r'\\bNODE_TLS_REJECT_UNAUTHORIZED\\s*=\\s*[\\'\"]?0[\\'\"]?'), \"Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)\"),",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/audit_runner.py",
+      "start_line": 284,
+      "end_line": 284
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-3c58bc29",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled Go TLS certificate verification (InsecureSkipVerify: true)",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/audit_runner.py",
+    "line_number": 285,
+    "matched_text": "InsecureSkipVerify: true",
+    "snippet": "        \"patterns\": [\n            (re.compile(r'\\bverify\\s*=\\s*False\\b'), \"Disabled TLS certificate verification (verify=False)\"),\n            (re.compile(r'\\bInsecureSkipVerify\\s*:\\s*true\\b'), \"Disabled Go TLS certificate verification (InsecureSkipVerify: true)\"),\n            (re.compile(r'\\bNODE_TLS_REJECT_UNAUTHORIZED\\s*=\\s*[\\'\"]?0[\\'\"]?'), \"Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)\"),\n            (re.compile(r'\\brejectUnauthorized\\s*:\\s*false\\b'), \"Disabled Node.js TLS rejectUnauthorized\"),",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/audit_runner.py",
+      "start_line": 285,
+      "end_line": 285
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-8ed55f94",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/audit_runner.py",
+    "line_number": 286,
+    "matched_text": "NODE_TLS_REJECT_UNAUTHORIZED=0",
+    "snippet": "            (re.compile(r'\\bverify\\s*=\\s*False\\b'), \"Disabled TLS certificate verification (verify=False)\"),\n            (re.compile(r'\\bInsecureSkipVerify\\s*:\\s*true\\b'), \"Disabled Go TLS certificate verification (InsecureSkipVerify: true)\"),\n            (re.compile(r'\\bNODE_TLS_REJECT_UNAUTHORIZED\\s*=\\s*[\\'\"]?0[\\'\"]?'), \"Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)\"),\n            (re.compile(r'\\brejectUnauthorized\\s*:\\s*false\\b'), \"Disabled Node.js TLS rejectUnauthorized\"),\n            (re.compile(r'\\bCURLOPT_SSL_VERIFYPEER\\s*(?:=>|,)\\s*(?:false|0)\\b', re.IGNORECASE), \"Disabled PHP curl SSL verification\")",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/audit_runner.py",
+      "start_line": 286,
+      "end_line": 286
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-5447a47c",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled TLS certificate verification (verify=False)",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/diff_guard.py",
+    "line_number": 20,
+    "matched_text": "verify=False",
+    "snippet": "    (re.compile(r'(?:#|//|/\\*)\\s*(?:TODO\\s*:?\\s*)?(?:bypass|skip|disable)[_\\s]*(?:auth|security|check|guard|filter|csrf|tenant)', re.IGNORECASE), \"Suspicious authentication or security check bypass comment\"),\n    # TLS / Certificate validation bypasses across Python, Go, Node, Java, C#, PHP, Rust\n    (re.compile(r'\\bverify\\s*=\\s*False\\b'), \"Disabled TLS certificate verification (verify=False)\"),\n    (re.compile(r'\\bInsecureSkipVerify\\s*:\\s*true\\b'), \"Disabled Go TLS certificate verification (InsecureSkipVerify: true)\"),\n    (re.compile(r'\\bNODE_TLS_REJECT_UNAUTHORIZED\\s*=\\s*[\\'\"]?0[\\'\"]?'), \"Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)\"),",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/diff_guard.py",
+      "start_line": 20,
+      "end_line": 20
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-7afc81ff",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled Go TLS certificate verification (InsecureSkipVerify: true)",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/diff_guard.py",
+    "line_number": 21,
+    "matched_text": "InsecureSkipVerify: true",
+    "snippet": "    # TLS / Certificate validation bypasses across Python, Go, Node, Java, C#, PHP, Rust\n    (re.compile(r'\\bverify\\s*=\\s*False\\b'), \"Disabled TLS certificate verification (verify=False)\"),\n    (re.compile(r'\\bInsecureSkipVerify\\s*:\\s*true\\b'), \"Disabled Go TLS certificate verification (InsecureSkipVerify: true)\"),\n    (re.compile(r'\\bNODE_TLS_REJECT_UNAUTHORIZED\\s*=\\s*[\\'\"]?0[\\'\"]?'), \"Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)\"),\n    (re.compile(r'\\brejectUnauthorized\\s*:\\s*false\\b'), \"Disabled Node.js TLS rejectUnauthorized\"),",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/diff_guard.py",
+      "start_line": 21,
+      "end_line": 21
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-7b466146",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/diff_guard.py",
+    "line_number": 22,
+    "matched_text": "NODE_TLS_REJECT_UNAUTHORIZED=0",
+    "snippet": "    (re.compile(r'\\bverify\\s*=\\s*False\\b'), \"Disabled TLS certificate verification (verify=False)\"),\n    (re.compile(r'\\bInsecureSkipVerify\\s*:\\s*true\\b'), \"Disabled Go TLS certificate verification (InsecureSkipVerify: true)\"),\n    (re.compile(r'\\bNODE_TLS_REJECT_UNAUTHORIZED\\s*=\\s*[\\'\"]?0[\\'\"]?'), \"Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)\"),\n    (re.compile(r'\\brejectUnauthorized\\s*:\\s*false\\b'), \"Disabled Node.js TLS rejectUnauthorized\"),\n    (re.compile(r'\\b(?:TrustAllStrategy|NoopHostnameVerifier|DangerousAcceptAnyServerCertificateValidator)\\b'), \"Disabled Java / C# TLS certificate validation\"),",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/diff_guard.py",
+      "start_line": 22,
+      "end_line": 22
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-59a123c6",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled PHP curl SSL verification",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/diff_guard.py",
+    "line_number": 26,
+    "matched_text": "CURLOPT_SSL_VERIFYPEER => false",
+    "snippet": "    (re.compile(r'\\b(?:TrustAllStrategy|NoopHostnameVerifier|DangerousAcceptAnyServerCertificateValidator)\\b'), \"Disabled Java / C# TLS certificate validation\"),\n    (re.compile(r'\\bServerCertificateCustomValidationCallback\\s*=\\s*(?:\\([^)]*\\)\\s*=>\\s*true|HttpClientHandler\\.DangerousAcceptAnyServerCertificateValidator)'), \"Disabled C# TLS certificate callback\"),\n    (re.compile(r'\\bCURLOPT_SSL_VERIFYPEER\\s*(?:=>|,)\\s*(?:false|0)\\b', re.IGNORECASE), \"Disabled PHP curl SSL verification (CURLOPT_SSL_VERIFYPEER => false)\"),\n    (re.compile(r'\\bdanger_accept_invalid_certs\\s*\\(\\s*true\\s*\\)'), \"Disabled Rust reqwest TLS certificate validation\"),\n    # Auth & CSRF bypasses",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/diff_guard.py",
+      "start_line": 26,
+      "end_line": 26
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-7db54483",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled TLS certificate verification (verify=False)",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+    "line_number": 180,
+    "matched_text": "verify=False",
+    "snippet": "\n    if not bypass_guards:\n        bypass_rule = \"4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, `@csrf_exempt`, or `bypass_auth=True`.\"\n    else:\n        bypass_rule = f\"4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, or {', '.join(bypass_guards[:2])}.\"",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+      "start_line": 180,
+      "end_line": 180
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-77bc2f9b",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled Go TLS certificate verification (InsecureSkipVerify: true)",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+    "line_number": 157,
+    "matched_text": "InsecureSkipVerify: true",
+    "snippet": "    if \"go\" in stack_lower:\n        sql_guards.append(\"`db.Query(..., args)` / GORM\")\n        bypass_guards.append(\"`InsecureSkipVerify: true`\")\n    if \"rust\" in stack_lower:\n        sql_guards.append(\"`sqlx::query!` / Diesel\")",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+      "start_line": 157,
+      "end_line": 157
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-cb5ae7e9",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled Node.js TLS rejectUnauthorized",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+    "line_number": 172,
+    "matched_text": "rejectUnauthorized: false",
+    "snippet": "    if \"typescript\" in stack_lower or \"javascript\" in stack_lower or \"next\" in stack_lower or \"express\" in stack_lower:\n        sql_guards.append(\"Prisma / Drizzle binders\")\n        bypass_guards.append(\"`rejectUnauthorized: false`\")\n\n    if not sql_guards:",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+      "start_line": 172,
+      "end_line": 172
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-0e4204af",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled PHP curl SSL verification",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+    "line_number": 169,
+    "matched_text": "CURLOPT_SSL_VERIFYPEER => false",
+    "snippet": "    if \"php\" in stack_lower:\n        sql_guards.append(\"PDO prepared statements / Eloquent\")\n        bypass_guards.append(\"`CURLOPT_SSL_VERIFYPEER => false`\")\n    if \"typescript\" in stack_lower or \"javascript\" in stack_lower or \"next\" in stack_lower or \"express\" in stack_lower:\n        sql_guards.append(\"Prisma / Drizzle binders\")",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+      "start_line": 169,
+      "end_line": 169
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-671d3513",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled TLS certificate verification (verify=False)",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/harden_runner.py",
+    "line_number": 246,
+    "matched_text": "verify=False",
+    "snippet": "    # Strategy 8: TLS Verification Bypass (TG-DIFF-001)\n    elif rule_id == \"TG-DIFF-001\":\n        if \"verify=False\" in target_line:\n            fixed_line = target_line.replace(\"verify=False\", \"verify=True\")\n            new_lines[line_number - 1] = fixed_line",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/harden_runner.py",
+      "start_line": 246,
+      "end_line": 246
+    },
+    "confidence_score": 67,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 12,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 67,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-b6549484",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled Go TLS certificate verification (InsecureSkipVerify: true)",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/harden_runner.py",
+    "line_number": 256,
+    "matched_text": "InsecureSkipVerify: true",
+    "snippet": "            applied_rule = True\n            fix_explanation = \"Restored TLS certificate authority validation (rejectUnauthorized: true)\"\n        elif \"InsecureSkipVerify: true\" in target_line:\n            fixed_line = target_line.replace(\"InsecureSkipVerify: true\", \"InsecureSkipVerify: false\")\n            new_lines[line_number - 1] = fixed_line",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/harden_runner.py",
+      "start_line": 256,
+      "end_line": 256
+    },
+    "confidence_score": 67,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 12,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 67,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-c4cfaa8a",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled Node.js TLS rejectUnauthorized",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/harden_runner.py",
+    "line_number": 251,
+    "matched_text": "rejectUnauthorized: false",
+    "snippet": "            applied_rule = True\n            fix_explanation = \"Restored mandatory TLS certificate verification (verify=True)\"\n        elif \"rejectUnauthorized: false\" in target_line:\n            fixed_line = target_line.replace(\"rejectUnauthorized: false\", \"rejectUnauthorized: true\")\n            new_lines[line_number - 1] = fixed_line",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/harden_runner.py",
+      "start_line": 251,
+      "end_line": 251
+    },
+    "confidence_score": 67,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 12,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 67,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-INPUT-003-fea9421e",
+    "rule_id": "TG-INPUT-003",
+    "title": "Unsafe Dynamic Code or HTML Execution",
+    "description": "React dangerouslySetInnerHTML rendering raw unescaped HTML",
+    "severity": "High",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "examples/vulnerable-react-express/client/src/App.jsx",
+    "line_number": 53,
+    "matched_text": "dangerouslySetInnerHTML=",
+    "snippet": "\n      {/* TG-INPUT-003: Unsafe HTML rendering */}\n      <div dangerouslySetInnerHTML={{ __html: bio }} />\n\n      <button onClick={fetchUser}>Fetch user (IDOR demo)</button>",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/client/src/App.jsx",
+      "start_line": 53,
+      "end_line": 53
+    },
+    "confidence_score": 80,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 80,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-PLATFORM-001-7dd35cb4",
+    "rule_id": "TG-PLATFORM-001",
+    "title": "Wildcard Permissive CORS Configuration with Credentials",
+    "description": "Wildcard CORS origin configured in Express middleware",
+    "severity": "High",
+    "category": "platform",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 12,
+    "matched_text": "cors({ origin: '*'",
+    "snippet": "\n// TG-PLATFORM-001: Wildcard CORS with credentials\napp.use(cors({ origin: '*', credentials: true }));\n\n// TG-PLATFORM-004: No explicit JSON body size limit",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 12,
+      "end_line": 12
+    },
+    "confidence_score": 80,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 80,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-INPUT-003-258e642e",
+    "rule_id": "TG-INPUT-003",
+    "title": "Unsafe Dynamic Code or HTML Execution",
+    "description": "Direct eval() execution on untrusted input",
+    "severity": "High",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "skills/torusguard/payload/scripts/audit_runner.py",
+    "line_number": 232,
+    "matched_text": "eval(",
+    "snippet": "        \"cluster\": \"cluster-injection\",\n        \"patterns\": [\n            (re.compile(r'\\beval\\s*\\('), \"Direct eval() execution on untrusted input\"),\n            (re.compile(r'\\bexec\\s*\\('), \"Direct exec() execution on untrusted input\"),\n            (re.compile(r'\\bdangerouslySetInnerHTML\\s*='), \"React dangerouslySetInnerHTML rendering raw unescaped HTML\"),",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/audit_runner.py",
+      "start_line": 232,
+      "end_line": 232
+    },
+    "confidence_score": 80,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 80,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-INPUT-003-3e9363a4",
+    "rule_id": "TG-INPUT-003",
+    "title": "Unsafe Dynamic Code or HTML Execution",
+    "description": "Direct exec() execution on untrusted input",
+    "severity": "High",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "skills/torusguard/payload/scripts/audit_runner.py",
+    "line_number": 233,
+    "matched_text": "exec(",
+    "snippet": "        \"patterns\": [\n            (re.compile(r'\\beval\\s*\\('), \"Direct eval() execution on untrusted input\"),\n            (re.compile(r'\\bexec\\s*\\('), \"Direct exec() execution on untrusted input\"),\n            (re.compile(r'\\bdangerouslySetInnerHTML\\s*='), \"React dangerouslySetInnerHTML rendering raw unescaped HTML\"),\n            (re.compile(r'\\.innerHTML\\s*='), \"Direct DOM innerHTML assignment vulnerable to XSS\")",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/audit_runner.py",
+      "start_line": 233,
+      "end_line": 233
+    },
+    "confidence_score": 80,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 80,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-PLATFORM-001-1a813dde",
+    "rule_id": "TG-PLATFORM-001",
+    "title": "Wildcard Permissive CORS Configuration with Credentials",
+    "description": "Wildcard CORS origin enabled across entire application",
+    "severity": "High",
+    "category": "platform",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "skills/torusguard/payload/scripts/harden_runner.py",
+    "line_number": 202,
+    "matched_text": "CORS_ALLOW_ALL_ORIGINS = True",
+    "snippet": "    # Strategy 5: Permissive CORS with Credentials (TG-PLATFORM-001)\n    elif rule_id == \"TG-PLATFORM-001\":\n        if \"CORS_ALLOW_ALL_ORIGINS = True\" in target_line:\n            replacement = f'{indent}CORS_ALLOWED_ORIGINS = [os.environ.get(\"ALLOWED_ORIGIN\", \"https://app.example.com\")]'\n            new_lines[line_number - 1] = replacement",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/harden_runner.py",
+      "start_line": 202,
+      "end_line": 202
+    },
+    "confidence_score": 80,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 80,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-AUTH-004-f60870ef",
+    "rule_id": "TG-AUTH-004",
+    "title": "Insecure Session Cookie or Disabled CSRF Protection",
+    "description": "Decorator disabling route-level authentication or CSRF protection",
+    "severity": "High",
+    "category": "auth",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+    "line_number": 180,
+    "matched_text": "@csrf_exempt",
+    "snippet": "\n    if not bypass_guards:\n        bypass_rule = \"4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, `@csrf_exempt`, or `bypass_auth=True`.\"\n    else:\n        bypass_rule = f\"4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, or {', '.join(bypass_guards[:2])}.\"",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+      "start_line": 180,
+      "end_line": 180
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-AUTH-004-6b0c7ebf",
+    "rule_id": "TG-AUTH-004",
+    "title": "Insecure Session Cookie or Disabled CSRF Protection",
+    "description": "Attribute disabling ASP.NET authentication",
+    "severity": "High",
+    "category": "auth",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+    "line_number": 166,
+    "matched_text": "[AllowAnonymous]",
+    "snippet": "    if \"c#\" in stack_lower or \"dotnet\" in stack_lower:\n        sql_guards.append(\"EF Core LINQ / `FromSqlInterpolated`\")\n        bypass_guards.append(\"`[AllowAnonymous]`\")\n    if \"php\" in stack_lower:\n        sql_guards.append(\"PDO prepared statements / Eloquent\")",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+      "start_line": 166,
+      "end_line": 166
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-004-dbbc17f7",
+    "rule_id": "TG-SEC-004",
+    "title": "Sensitive Credential or Token Logging",
+    "description": "Plaintext credential or token logged to standard output",
+    "severity": "Medium",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "examples/vulnerable-react-express/client/src/App.jsx",
+    "line_number": 30,
+    "matched_text": "console.log('Login token:', data.token, 'config:', clientConfig)",
+    "snippet": "    const data = await res.json();\n    // TG-CLIENT-002: Sensitive console logging\n    console.log('Login token:', data.token, 'config:', clientConfig);\n    setMessage(JSON.stringify(data));\n  }",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/client/src/App.jsx",
+      "start_line": 30,
+      "end_line": 30
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-004-08753da5",
+    "rule_id": "TG-SEC-004",
+    "title": "Sensitive Credential or Token Logging",
+    "description": "Plaintext credential or token logged to standard output",
+    "severity": "Medium",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 28,
+    "matched_text": "console.log('Login attempt:', { email, password })",
+    "snippet": "app.post('/api/login', (req, res) => {\n  const { email, password } = req.body;\n  console.log('Login attempt:', { email, password }); // TG-SEC-004\n  const user = users.find((u) => u.email === email && u.password === password);\n  if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 28,
+      "end_line": 28
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  }
+]