torusguard 1.3.3 → 1.3.4

package/.torusguard/runs/run-20260910-130454-audit/findings.md

@@ -0,0 +1,386 @@
+# TorusGuard Security Audit Findings: run-20260910-130454-audit
+- Target Root: `C:\Users\Admin\Desktop\TorusGuard`
+- Total Scored Findings: `27`
+- Identified Clusters: `5`
+- Generated At: `2026-09-10 13:04:54 IST`
+
+---
+## Summary of Findings
+
+### [Critical] TG-SEC-001 - Hardcoded Secret or API Key in Tracked Source
+- **Finding ID:** `TG-SEC-001-bb5e4b77`
+- **Location:** `examples/vulnerable-react-express/server/index.js:9`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded JWT signing secret
+```
+
+// TG-SEC-001: Hardcoded JWT secret
+const JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';
+
+// TG-PLATFORM-001: Wildcard CORS with credentials
+```
+
+### [Critical] TG-SEC-001 - Hardcoded Secret or API Key in Tracked Source
+- **Finding ID:** `TG-SEC-001-c393d596`
+- **Location:** `examples/vulnerable-react-express/server/index.js:18`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+
+const users = [
+  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },
+  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },
+];
+```
+
+### [Critical] TG-DB-002 - Privileged Database Secret or Master Role Key in Client Code
+- **Finding ID:** `TG-DB-002-d9bd69df`
+- **Location:** `demo/playground/vulnerable_nextjs/actions.ts:9`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-client-leak`
+- **Description:** Service role key or raw database connection string reference in frontend code
+```
+
+// Finding 1: TG-CLIENT-001 - Backend admin key exposed in client-accessible code
+export const SUPABASE_SERVICE_ROLE_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.demo_secret_token_1234567890";
+
+interface UserRecord {
+```
+
+### [Critical] TG-DB-002 - Privileged Database Secret or Master Role Key in Client Code
+- **Finding ID:** `TG-DB-002-d5bb277d`
+- **Location:** `skills/torusguard/payload/scripts/audit_runner.py:209`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-client-leak`
+- **Description:** Service role key or raw database connection string reference in frontend code
+```
+        "cluster": "cluster-client-leak",
+        "patterns": [
+            (re.compile(r'\b(?:SUPABASE_SERVICE_ROLE_KEY|DATABASE_URL)\b'), "Service role key or raw database connection string reference in frontend code")
+        ]
+    },
+```
+
+### [Critical] TG-DIFF-001 - Disabled TLS / SSL Certificate Validation
+- **Finding ID:** `TG-DIFF-001-c87ad73a`
+- **Location:** `skills/torusguard/payload/scripts/audit_runner.py:284`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled TLS certificate verification (verify=False)
+```
+        "cluster": "cluster-transport-security",
+        "patterns": [
+            (re.compile(r'\bverify\s*=\s*False\b'), "Disabled TLS certificate verification (verify=False)"),
+            (re.compile(r'\bInsecureSkipVerify\s*:\s*true\b'), "Disabled Go TLS certificate verification (InsecureSkipVerify: true)"),
+            (re.compile(r'\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*[\'"]?0[\'"]?'), "Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)"),
+```
+
+### [Critical] TG-DIFF-001 - Disabled TLS / SSL Certificate Validation
+- **Finding ID:** `TG-DIFF-001-3c58bc29`
+- **Location:** `skills/torusguard/payload/scripts/audit_runner.py:285`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
+        "patterns": [
+            (re.compile(r'\bverify\s*=\s*False\b'), "Disabled TLS certificate verification (verify=False)"),
+            (re.compile(r'\bInsecureSkipVerify\s*:\s*true\b'), "Disabled Go TLS certificate verification (InsecureSkipVerify: true)"),
+            (re.compile(r'\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*[\'"]?0[\'"]?'), "Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)"),
+            (re.compile(r'\brejectUnauthorized\s*:\s*false\b'), "Disabled Node.js TLS rejectUnauthorized"),
+```
+
+### [Critical] TG-DIFF-001 - Disabled TLS / SSL Certificate Validation
+- **Finding ID:** `TG-DIFF-001-8ed55f94`
+- **Location:** `skills/torusguard/payload/scripts/audit_runner.py:286`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)
+```
+            (re.compile(r'\bverify\s*=\s*False\b'), "Disabled TLS certificate verification (verify=False)"),
+            (re.compile(r'\bInsecureSkipVerify\s*:\s*true\b'), "Disabled Go TLS certificate verification (InsecureSkipVerify: true)"),
+            (re.compile(r'\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*[\'"]?0[\'"]?'), "Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)"),
+            (re.compile(r'\brejectUnauthorized\s*:\s*false\b'), "Disabled Node.js TLS rejectUnauthorized"),
+            (re.compile(r'\bCURLOPT_SSL_VERIFYPEER\s*(?:=>|,)\s*(?:false|0)\b', re.IGNORECASE), "Disabled PHP curl SSL verification")
+```
+
+### [Critical] TG-DIFF-001 - Disabled TLS / SSL Certificate Validation
+- **Finding ID:** `TG-DIFF-001-5447a47c`
+- **Location:** `skills/torusguard/payload/scripts/diff_guard.py:20`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled TLS certificate verification (verify=False)
+```
+    (re.compile(r'(?:#|//|/\*)\s*(?:TODO\s*:?\s*)?(?:bypass|skip|disable)[_\s]*(?:auth|security|check|guard|filter|csrf|tenant)', re.IGNORECASE), "Suspicious authentication or security check bypass comment"),
+    # TLS / Certificate validation bypasses across Python, Go, Node, Java, C#, PHP, Rust
+    (re.compile(r'\bverify\s*=\s*False\b'), "Disabled TLS certificate verification (verify=False)"),
+    (re.compile(r'\bInsecureSkipVerify\s*:\s*true\b'), "Disabled Go TLS certificate verification (InsecureSkipVerify: true)"),
+    (re.compile(r'\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*[\'"]?0[\'"]?'), "Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)"),
+```
+
+### [Critical] TG-DIFF-001 - Disabled TLS / SSL Certificate Validation
+- **Finding ID:** `TG-DIFF-001-7afc81ff`
+- **Location:** `skills/torusguard/payload/scripts/diff_guard.py:21`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
+    # TLS / Certificate validation bypasses across Python, Go, Node, Java, C#, PHP, Rust
+    (re.compile(r'\bverify\s*=\s*False\b'), "Disabled TLS certificate verification (verify=False)"),
+    (re.compile(r'\bInsecureSkipVerify\s*:\s*true\b'), "Disabled Go TLS certificate verification (InsecureSkipVerify: true)"),
+    (re.compile(r'\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*[\'"]?0[\'"]?'), "Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)"),
+    (re.compile(r'\brejectUnauthorized\s*:\s*false\b'), "Disabled Node.js TLS rejectUnauthorized"),
+```
+
+### [Critical] TG-DIFF-001 - Disabled TLS / SSL Certificate Validation
+- **Finding ID:** `TG-DIFF-001-7b466146`
+- **Location:** `skills/torusguard/payload/scripts/diff_guard.py:22`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)
+```
+    (re.compile(r'\bverify\s*=\s*False\b'), "Disabled TLS certificate verification (verify=False)"),
+    (re.compile(r'\bInsecureSkipVerify\s*:\s*true\b'), "Disabled Go TLS certificate verification (InsecureSkipVerify: true)"),
+    (re.compile(r'\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*[\'"]?0[\'"]?'), "Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)"),
+    (re.compile(r'\brejectUnauthorized\s*:\s*false\b'), "Disabled Node.js TLS rejectUnauthorized"),
+    (re.compile(r'\b(?:TrustAllStrategy|NoopHostnameVerifier|DangerousAcceptAnyServerCertificateValidator)\b'), "Disabled Java / C# TLS certificate validation"),
+```
+
+### [Critical] TG-DIFF-001 - Disabled TLS / SSL Certificate Validation
+- **Finding ID:** `TG-DIFF-001-59a123c6`
+- **Location:** `skills/torusguard/payload/scripts/diff_guard.py:26`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled PHP curl SSL verification
+```
+    (re.compile(r'\b(?:TrustAllStrategy|NoopHostnameVerifier|DangerousAcceptAnyServerCertificateValidator)\b'), "Disabled Java / C# TLS certificate validation"),
+    (re.compile(r'\bServerCertificateCustomValidationCallback\s*=\s*(?:\([^)]*\)\s*=>\s*true|HttpClientHandler\.DangerousAcceptAnyServerCertificateValidator)'), "Disabled C# TLS certificate callback"),
+    (re.compile(r'\bCURLOPT_SSL_VERIFYPEER\s*(?:=>|,)\s*(?:false|0)\b', re.IGNORECASE), "Disabled PHP curl SSL verification (CURLOPT_SSL_VERIFYPEER => false)"),
+    (re.compile(r'\bdanger_accept_invalid_certs\s*\(\s*true\s*\)'), "Disabled Rust reqwest TLS certificate validation"),
+    # Auth & CSRF bypasses
+```
+
+### [Critical] TG-DIFF-001 - Disabled TLS / SSL Certificate Validation
+- **Finding ID:** `TG-DIFF-001-7db54483`
+- **Location:** `skills/torusguard/payload/scripts/rules_sync.py:180`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled TLS certificate verification (verify=False)
+```
+
+    if not bypass_guards:
+        bypass_rule = "4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, `@csrf_exempt`, or `bypass_auth=True`."
+    else:
+        bypass_rule = f"4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, or {', '.join(bypass_guards[:2])}."
+```
+
+### [Critical] TG-DIFF-001 - Disabled TLS / SSL Certificate Validation
+- **Finding ID:** `TG-DIFF-001-77bc2f9b`
+- **Location:** `skills/torusguard/payload/scripts/rules_sync.py:157`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
+    if "go" in stack_lower:
+        sql_guards.append("`db.Query(..., args)` / GORM")
+        bypass_guards.append("`InsecureSkipVerify: true`")
+    if "rust" in stack_lower:
+        sql_guards.append("`sqlx::query!` / Diesel")
+```
+
+### [Critical] TG-DIFF-001 - Disabled TLS / SSL Certificate Validation
+- **Finding ID:** `TG-DIFF-001-cb5ae7e9`
+- **Location:** `skills/torusguard/payload/scripts/rules_sync.py:172`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Node.js TLS rejectUnauthorized
+```
+    if "typescript" in stack_lower or "javascript" in stack_lower or "next" in stack_lower or "express" in stack_lower:
+        sql_guards.append("Prisma / Drizzle binders")
+        bypass_guards.append("`rejectUnauthorized: false`")
+
+    if not sql_guards:
+```
+
+### [Critical] TG-DIFF-001 - Disabled TLS / SSL Certificate Validation
+- **Finding ID:** `TG-DIFF-001-0e4204af`
+- **Location:** `skills/torusguard/payload/scripts/rules_sync.py:169`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled PHP curl SSL verification
+```
+    if "php" in stack_lower:
+        sql_guards.append("PDO prepared statements / Eloquent")
+        bypass_guards.append("`CURLOPT_SSL_VERIFYPEER => false`")
+    if "typescript" in stack_lower or "javascript" in stack_lower or "next" in stack_lower or "express" in stack_lower:
+        sql_guards.append("Prisma / Drizzle binders")
+```
+
+### [Critical] TG-DIFF-001 - Disabled TLS / SSL Certificate Validation
+- **Finding ID:** `TG-DIFF-001-671d3513`
+- **Location:** `skills/torusguard/payload/scripts/harden_runner.py:246`
+- **Confidence Score:** `67/100` (Medium Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled TLS certificate verification (verify=False)
+```
+    # Strategy 8: TLS Verification Bypass (TG-DIFF-001)
+    elif rule_id == "TG-DIFF-001":
+        if "verify=False" in target_line:
+            fixed_line = target_line.replace("verify=False", "verify=True")
+            new_lines[line_number - 1] = fixed_line
+```
+
+### [Critical] TG-DIFF-001 - Disabled TLS / SSL Certificate Validation
+- **Finding ID:** `TG-DIFF-001-b6549484`
+- **Location:** `skills/torusguard/payload/scripts/harden_runner.py:256`
+- **Confidence Score:** `67/100` (Medium Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
+            applied_rule = True
+            fix_explanation = "Restored TLS certificate authority validation (rejectUnauthorized: true)"
+        elif "InsecureSkipVerify: true" in target_line:
+            fixed_line = target_line.replace("InsecureSkipVerify: true", "InsecureSkipVerify: false")
+            new_lines[line_number - 1] = fixed_line
+```
+
+### [Critical] TG-DIFF-001 - Disabled TLS / SSL Certificate Validation
+- **Finding ID:** `TG-DIFF-001-c4cfaa8a`
+- **Location:** `skills/torusguard/payload/scripts/harden_runner.py:251`
+- **Confidence Score:** `67/100` (Medium Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Node.js TLS rejectUnauthorized
+```
+            applied_rule = True
+            fix_explanation = "Restored mandatory TLS certificate verification (verify=True)"
+        elif "rejectUnauthorized: false" in target_line:
+            fixed_line = target_line.replace("rejectUnauthorized: false", "rejectUnauthorized: true")
+            new_lines[line_number - 1] = fixed_line
+```
+
+### [High] TG-INPUT-003 - Unsafe Dynamic Code or HTML Execution
+- **Finding ID:** `TG-INPUT-003-fea9421e`
+- **Location:** `examples/vulnerable-react-express/client/src/App.jsx:53`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-injection`
+- **Description:** React dangerouslySetInnerHTML rendering raw unescaped HTML
+```
+
+      {/* TG-INPUT-003: Unsafe HTML rendering */}
+      <div dangerouslySetInnerHTML={{ __html: bio }} />
+
+      <button onClick={fetchUser}>Fetch user (IDOR demo)</button>
+```
+
+### [High] TG-PLATFORM-001 - Wildcard Permissive CORS Configuration with Credentials
+- **Finding ID:** `TG-PLATFORM-001-7dd35cb4`
+- **Location:** `examples/vulnerable-react-express/server/index.js:12`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Wildcard CORS origin configured in Express middleware
+```
+
+// TG-PLATFORM-001: Wildcard CORS with credentials
+app.use(cors({ origin: '*', credentials: true }));
+
+// TG-PLATFORM-004: No explicit JSON body size limit
+```
+
+### [High] TG-INPUT-003 - Unsafe Dynamic Code or HTML Execution
+- **Finding ID:** `TG-INPUT-003-258e642e`
+- **Location:** `skills/torusguard/payload/scripts/audit_runner.py:232`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-injection`
+- **Description:** Direct eval() execution on untrusted input
+```
+        "cluster": "cluster-injection",
+        "patterns": [
+            (re.compile(r'\beval\s*\('), "Direct eval() execution on untrusted input"),
+            (re.compile(r'\bexec\s*\('), "Direct exec() execution on untrusted input"),
+            (re.compile(r'\bdangerouslySetInnerHTML\s*='), "React dangerouslySetInnerHTML rendering raw unescaped HTML"),
+```
+
+### [High] TG-INPUT-003 - Unsafe Dynamic Code or HTML Execution
+- **Finding ID:** `TG-INPUT-003-3e9363a4`
+- **Location:** `skills/torusguard/payload/scripts/audit_runner.py:233`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-injection`
+- **Description:** Direct exec() execution on untrusted input
+```
+        "patterns": [
+            (re.compile(r'\beval\s*\('), "Direct eval() execution on untrusted input"),
+            (re.compile(r'\bexec\s*\('), "Direct exec() execution on untrusted input"),
+            (re.compile(r'\bdangerouslySetInnerHTML\s*='), "React dangerouslySetInnerHTML rendering raw unescaped HTML"),
+            (re.compile(r'\.innerHTML\s*='), "Direct DOM innerHTML assignment vulnerable to XSS")
+```
+
+### [High] TG-PLATFORM-001 - Wildcard Permissive CORS Configuration with Credentials
+- **Finding ID:** `TG-PLATFORM-001-1a813dde`
+- **Location:** `skills/torusguard/payload/scripts/harden_runner.py:202`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Wildcard CORS origin enabled across entire application
+```
+    # Strategy 5: Permissive CORS with Credentials (TG-PLATFORM-001)
+    elif rule_id == "TG-PLATFORM-001":
+        if "CORS_ALLOW_ALL_ORIGINS = True" in target_line:
+            replacement = f'{indent}CORS_ALLOWED_ORIGINS = [os.environ.get("ALLOWED_ORIGIN", "https://app.example.com")]'
+            new_lines[line_number - 1] = replacement
+```
+
+### [High] TG-AUTH-004 - Insecure Session Cookie or Disabled CSRF Protection
+- **Finding ID:** `TG-AUTH-004-f60870ef`
+- **Location:** `skills/torusguard/payload/scripts/rules_sync.py:180`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Decorator disabling route-level authentication or CSRF protection
+```
+
+    if not bypass_guards:
+        bypass_rule = "4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, `@csrf_exempt`, or `bypass_auth=True`."
+    else:
+        bypass_rule = f"4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, or {', '.join(bypass_guards[:2])}."
+```
+
+### [High] TG-AUTH-004 - Insecure Session Cookie or Disabled CSRF Protection
+- **Finding ID:** `TG-AUTH-004-6b0c7ebf`
+- **Location:** `skills/torusguard/payload/scripts/rules_sync.py:166`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Attribute disabling ASP.NET authentication
+```
+    if "c#" in stack_lower or "dotnet" in stack_lower:
+        sql_guards.append("EF Core LINQ / `FromSqlInterpolated`")
+        bypass_guards.append("`[AllowAnonymous]`")
+    if "php" in stack_lower:
+        sql_guards.append("PDO prepared statements / Eloquent")
+```
+
+### [Medium] TG-SEC-004 - Sensitive Credential or Token Logging
+- **Finding ID:** `TG-SEC-004-dbbc17f7`
+- **Location:** `examples/vulnerable-react-express/client/src/App.jsx:30`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Plaintext credential or token logged to standard output
+```
+    const data = await res.json();
+    // TG-CLIENT-002: Sensitive console logging
+    console.log('Login token:', data.token, 'config:', clientConfig);
+    setMessage(JSON.stringify(data));
+  }
+```
+
+### [Medium] TG-SEC-004 - Sensitive Credential or Token Logging
+- **Finding ID:** `TG-SEC-004-08753da5`
+- **Location:** `examples/vulnerable-react-express/server/index.js:28`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Plaintext credential or token logged to standard output
+```
+app.post('/api/login', (req, res) => {
+  const { email, password } = req.body;
+  console.log('Login attempt:', { email, password }); // TG-SEC-004
+  const user = users.find((u) => u.email === email && u.password === password);
+  if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration
+```

package/.torusguard/runs/run-20260910-130454-audit/manifest.json

@@ -0,0 +1,12 @@
+{
+  "run_id": "run-20260910-130454-audit",
+  "command": "audit",
+  "target_name": "TorusGuard",
+  "created_at": "2026-09-10 13:04:54 IST",
+  "created_at_iso": "2026-09-10T13:04:54.196373+05:30",
+  "status": "completed",
+  "torusguard_version": "1.3.0",
+  "findings_count": 27,
+  "confirmed_fixed_count": 0,
+  "regressed_count": 0
+}

package/.torusguard/runs/run-20260910-130454-audit/summary.md

@@ -0,0 +1,5 @@
+# TorusGuard Audit Summary: run-20260910-130454-audit
+- Scanned Scope: C:\Users\Admin\Desktop\TorusGuard
+- Total Findings: 27
+- Root-Cause Clusters: 5
+- Generated: 2026-09-10 13:04:54 IST