torusguard 1.3.3 → 1.3.4

package/.torusguard/runs/run-20260910-120238-audit/findings.json

@@ -0,0 +1,1520 @@
+[
+  {
+    "finding_id": "TG-INPUT-003-fea9421e",
+    "rule_id": "TG-INPUT-003",
+    "title": "Unsafe Dynamic Code or HTML Execution",
+    "description": "React dangerouslySetInnerHTML rendering raw unescaped HTML",
+    "severity": "High",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "examples/vulnerable-react-express/client/src/App.jsx",
+    "line_number": 53,
+    "matched_text": "dangerouslySetInnerHTML=",
+    "snippet": "\n      {/* TG-INPUT-003: Unsafe HTML rendering */}\n      <div dangerouslySetInnerHTML={{ __html: bio }} />\n\n      <button onClick={fetchUser}>Fetch user (IDOR demo)</button>",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/client/src/App.jsx",
+      "start_line": 53,
+      "end_line": 53
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-001-bb5e4b77",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded JWT signing secret",
+    "severity": "Critical",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 9,
+    "matched_text": "JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION'",
+    "snippet": "\n// TG-SEC-001: Hardcoded JWT secret\nconst JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';\n\n// TG-PLATFORM-001: Wildcard CORS with credentials",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 9,
+      "end_line": 9
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-001-c393d596",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded credential or API secret string",
+    "severity": "Critical",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 18,
+    "matched_text": "password: 'password123'",
+    "snippet": "\nconst users = [\n  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },\n  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },\n];",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 18,
+      "end_line": 18
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DB-004-736da71c",
+    "rule_id": "TG-DB-004",
+    "title": "Missing Multi-Tenant Isolation in Scoped Query",
+    "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+    "severity": "High",
+    "category": "database",
+    "cluster": "cluster-tenant-isolation",
+    "file_path": "harness/engine/fixture_manager.py",
+    "line_number": 224,
+    "matched_text": ".objects.get(id=invoice_id)",
+    "snippet": "                vulnerable_variant=FixtureVariant(\n                    relative_path=\"examples/python/django-vuln\",\n                    code_pattern=\"tenant_id = request.headers.get('X-Tenant-ID')\\nrecord = Invoice.objects.get(id=invoice_id)\",\n                    expected_findings_count=2,\n                ),",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/engine/fixture_manager.py",
+      "start_line": 224,
+      "end_line": 224
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-INPUT-002-02f8e274",
+    "rule_id": "TG-INPUT-002",
+    "title": "Unescaped Raw SQL Query Concatenation",
+    "description": "Python f-string interpolation in raw SQL query",
+    "severity": "Critical",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "harness/engine/fixture_manager.py",
+    "line_number": 128,
+    "matched_text": "execute(f'SELECT * FROM items WHERE name LIKE {",
+    "snippet": "                vulnerable_variant=FixtureVariant(\n                    relative_path=\"examples/python/sqlalchemy-vuln\",\n                    code_pattern=\"session.execute(f'SELECT * FROM items WHERE name LIKE {q}')\",\n                    expected_findings_count=4,\n                ),",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/engine/fixture_manager.py",
+      "start_line": 128,
+      "end_line": 128
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-AUTH-004-33adb2d9",
+    "rule_id": "TG-AUTH-004",
+    "title": "Insecure Session Cookie or Disabled CSRF Protection",
+    "description": "Session cookie secure flag disabled in Django settings",
+    "severity": "High",
+    "category": "auth",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "harness/evaluate_portfolio_polyglot.py",
+    "line_number": 107,
+    "matched_text": "SESSION_COOKIE_SECURE = False",
+    "snippet": "        \"expected_orm\": \"SQLAlchemy\",\n        \"ecosystem\": \"Python\",\n        \"test_bypass\": (\"python\", \"SESSION_COOKIE_SECURE = False\", \"auth_bypass\"),\n        \"test_tenant\": (\"python\", \"tenant_id\"),\n    },",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/evaluate_portfolio_polyglot.py",
+      "start_line": 107,
+      "end_line": 107
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-AUTH-004-56b1c90f",
+    "rule_id": "TG-AUTH-004",
+    "title": "Insecure Session Cookie or Disabled CSRF Protection",
+    "description": "Decorator disabling route-level authentication or CSRF protection",
+    "severity": "High",
+    "category": "auth",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "harness/evaluate_portfolio_polyglot.py",
+    "line_number": 96,
+    "matched_text": "@csrf_exempt",
+    "snippet": "        \"expected_orm\": \"Django ORM\",\n        \"ecosystem\": \"Python\",\n        \"test_bypass\": (\"python\", \"@csrf_exempt\", \"auth_bypass\"),\n        \"test_tenant\": (\"python\", \"tenant\"),\n    },",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/evaluate_portfolio_polyglot.py",
+      "start_line": 96,
+      "end_line": 96
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-AUTH-004-4a33f7e7",
+    "rule_id": "TG-AUTH-004",
+    "title": "Insecure Session Cookie or Disabled CSRF Protection",
+    "description": "Attribute disabling ASP.NET authentication",
+    "severity": "High",
+    "category": "auth",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "harness/evaluate_portfolio_polyglot.py",
+    "line_number": 239,
+    "matched_text": "[AllowAnonymous]",
+    "snippet": "        \"expected_orm\": \"Entity Framework Core\",\n        \"ecosystem\": \"C#\",\n        \"test_bypass\": (\"csharp\", \"[AllowAnonymous]\", \"auth_bypass\"),\n        \"test_tenant\": (\"csharp\", \".Where(x => x.TenantId == tenantId)\"),\n    },",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/evaluate_portfolio_polyglot.py",
+      "start_line": 239,
+      "end_line": 239
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-04571685",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled TLS certificate verification (verify=False)",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "harness/evaluate_portfolio_polyglot.py",
+    "line_number": 74,
+    "matched_text": "verify=False",
+    "snippet": "        \"expected_orm\": \"SQLAlchemy\",\n        \"ecosystem\": \"Python\",\n        \"test_bypass\": (\"python\", \"verify=False\", \"auth_bypass\"),\n        \"test_tenant\": (\"python\", \"tenant_id\"),\n    },",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/evaluate_portfolio_polyglot.py",
+      "start_line": 74,
+      "end_line": 74
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-8b55ac4b",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled Go TLS certificate verification (InsecureSkipVerify: true)",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "harness/evaluate_portfolio_polyglot.py",
+    "line_number": 151,
+    "matched_text": "InsecureSkipVerify: true",
+    "snippet": "        \"expected_orm\": \"GORM\",\n        \"ecosystem\": \"Go\",\n        \"test_bypass\": (\"go\", \"InsecureSkipVerify: true\", \"tls_bypass\"),\n        \"test_tenant\": (\"go\", '.Where(\"tenant_id = ?\", tenantID)'),\n    },",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/evaluate_portfolio_polyglot.py",
+      "start_line": 151,
+      "end_line": 151
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-91bd06b8",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled Node.js TLS rejectUnauthorized",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "harness/evaluate_portfolio_polyglot.py",
+    "line_number": 129,
+    "matched_text": "rejectUnauthorized: false",
+    "snippet": "        \"expected_orm\": \"Mongoose\",\n        \"ecosystem\": \"JavaScript\",\n        \"test_bypass\": (\"javascript\", \"rejectUnauthorized: false\", \"tls_bypass\"),\n        \"test_tenant\": (\"javascript\", \"author: req.user.id\"),\n    },",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/evaluate_portfolio_polyglot.py",
+      "start_line": 129,
+      "end_line": 129
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-cb245735",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled PHP curl SSL verification",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "harness/evaluate_portfolio_polyglot.py",
+    "line_number": 261,
+    "matched_text": "CURLOPT_SSL_VERIFYPEER => false",
+    "snippet": "        \"expected_orm\": \"Eloquent\",\n        \"ecosystem\": \"PHP\",\n        \"test_bypass\": (\"php\", \"CURLOPT_SSL_VERIFYPEER => false\", \"tls_bypass\"),\n        \"test_tenant\": (\"php\", 'where(\"tenant_id\", $tenantId)'),\n    },",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/evaluate_portfolio_polyglot.py",
+      "start_line": 261,
+      "end_line": 261
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-001-7c852ff3",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded credential or API secret string",
+    "severity": "Critical",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "harness/master_validation.py",
+    "line_number": 257,
+    "matched_text": "PASSWORD = 'super_secret_database_password_123'",
+    "snippet": "        self.log(\"Redaction\", \"JWT Token Redaction\", \"Bearer ***REDACTED_JWT***\" in masked_jwt and \"doNotLeakSignature\" not in masked_jwt)\n\n        masked_pwd = mask_sensitive_data(\"DB_PASSWORD = 'super_secret_database_password_123'\")\n        self.log(\"Redaction\", \"Password Variable Redaction\", \"***REDACTED***\" in masked_pwd and \"super_secret_database_password_123\" not in masked_pwd)\n",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/master_validation.py",
+      "start_line": 257,
+      "end_line": 257
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-001-950e367b",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded credential or API secret string",
+    "severity": "Critical",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "harness/runner.py",
+    "line_number": 209,
+    "matched_text": "SECRET_KEY = 'super_secret_jwt_key'",
+    "snippet": "            type=EvidenceType.SOURCE,\n            location=\"server/auth.py:42\",\n            raw_snippet=\"SECRET_KEY = 'super_secret_jwt_key'\",\n            rationale=\"Hardcoded secret credential.\",\n            confidence_level=ConfidenceBand.CONFIRMED,",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/runner.py",
+      "start_line": 209,
+      "end_line": 209
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DB-004-f0dd91bf",
+    "rule_id": "TG-DB-004",
+    "title": "Missing Multi-Tenant Isolation in Scoped Query",
+    "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+    "severity": "High",
+    "category": "database",
+    "cluster": "cluster-tenant-isolation",
+    "file_path": "harness/runner.py",
+    "line_number": 503,
+    "matched_text": ".objects.get(id=id)",
+    "snippet": "\n            # 2. Stable Finding Identity\n            code_a = \"def view():\\n    return Item.objects.get(id=id)\"\n            code_b = \"# Shifted comment\\ndef view():\\n    return Item.objects.get(id=id)\"\n            fp1 = IdentityEngine.generate_identity(\"TG-DB-004\", \"views.py\", code_a, sink_signature=\"Item.objects.get\")",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/runner.py",
+      "start_line": 503,
+      "end_line": 503
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-INPUT-002-30b66221",
+    "rule_id": "TG-INPUT-002",
+    "title": "Unescaped Raw SQL Query Concatenation",
+    "description": "Python f-string interpolation in raw SQL query",
+    "severity": "Critical",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "harness/runner.py",
+    "line_number": 256,
+    "matched_text": "raw(f'SELECT * FROM users WHERE name = {",
+    "snippet": "            framework_pattern=FrameworkPattern(\n                framework=\"Django\",\n                unsafe_snippet=\"User.objects.raw(f'SELECT * FROM users WHERE name = {name}')\",\n                safe_snippet=\"User.objects.raw('SELECT * FROM users WHERE name = %s', [name])\",\n            ),",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/runner.py",
+      "start_line": 256,
+      "end_line": 256
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-001-3a2b5eca",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded credential or API secret string",
+    "severity": "Critical",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "harness/validate_e2e.py",
+    "line_number": 355,
+    "matched_text": "API_KEY = 'sk_live_998877665544332211'",
+    "snippet": "\n    def _create_sample_finding(self, rule_id: str, target_path: str, secret_test: bool = False) -> Finding:\n        raw_code = \"API_KEY = 'sk_live_998877665544332211'\\nAuthorization = 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.doNotLeakSignature'\" if secret_test else f\"# Unsafe logic for {rule_id}\\nrole = request.headers.get('X-User-Role')\"\n        \n        ev = Evidence(",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/validate_e2e.py",
+      "start_line": 355,
+      "end_line": 355
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-001-c616aefd",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded credential or API secret string",
+    "severity": "Critical",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "harness/validate_qa_v0_6_0.py",
+    "line_number": 64,
+    "matched_text": "SECRET_KEY = \"sk_live_1234567890\"",
+    "snippet": "            \"tiny-repo\": {\n                \"vulnerable\": {\n                    \"app.py\": 'DEBUG = True\\nSECRET_KEY = \"sk_live_1234567890\"\\n\\ndef index():\\n    return \"Welcome\"\\n'\n                },\n                \"hardened\": {",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/validate_qa_v0_6_0.py",
+      "start_line": 64,
+      "end_line": 64
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DB-004-8b0bd85f",
+    "rule_id": "TG-DB-004",
+    "title": "Missing Multi-Tenant Isolation in Scoped Query",
+    "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+    "severity": "High",
+    "category": "database",
+    "cluster": "cluster-tenant-isolation",
+    "file_path": "harness/validate_qa_v0_6_0.py",
+    "line_number": 101,
+    "matched_text": ".objects.get(id=invoice_id)",
+    "snippet": "            \"django-app\": {\n                \"vulnerable\": {\n                    \"views.py\": 'from django.shortcuts import render\\nfrom django.utils.safestring import mark_safe\\nfrom .models import Invoice\\n\\ndef invoice_detail(request, invoice_id):\\n    # IDOR Vulnerability: Missing tenant filter\\n    invoice = Invoice.objects.get(id=invoice_id)\\n    # Template autoescaping bypass\\n    rendered = mark_safe(f\"<h1>{invoice.title}</h1>\")\\n    return render(request, \"detail.html\", {\"content\": rendered})\\n',\n                    \"models.py\": 'from django.db import models\\n\\nclass Invoice(models.Model):\\n    title = models.CharField(max_length=200)\\n    tenant_id = models.CharField(max_length=50)\\n'\n                },",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/validate_qa_v0_6_0.py",
+      "start_line": 101,
+      "end_line": 101
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DB-004-9a2f13c7",
+    "rule_id": "TG-DB-004",
+    "title": "Missing Multi-Tenant Isolation in Scoped Query",
+    "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+    "severity": "High",
+    "category": "database",
+    "cluster": "cluster-tenant-isolation",
+    "file_path": "harness/validate_v0_6_1_scale.py",
+    "line_number": 115,
+    "matched_text": ".objects.get(id=inv_id)",
+    "snippet": "                \"severity\": \"High\",\n                \"target\": {\"file_path\": \"apps/django_core/billing/views.py\", \"line_start\": 42, \"line_end\": 42},\n                \"evidence\": {\"code_snippet\": \"Invoice.objects.get(id=inv_id)\"},\n            },\n            # FastAPI Microservice",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/validate_v0_6_1_scale.py",
+      "start_line": 115,
+      "end_line": 115
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-001-54f1a02a",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded credential or API secret string",
+    "severity": "Critical",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "harness/validate_v0_6_2_modern_stacks.py",
+    "line_number": 341,
+    "matched_text": "PASSWORD=\"secret_in_docker\"",
+    "snippet": "COPY . .\n# Running as root user & hardcoding secrets\nENV DATABASE_PASSWORD=\"secret_in_docker\"\nCMD [\"python\", \"main.py\"]\n\"\"\", encoding=\"utf-8\")",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/validate_v0_6_2_modern_stacks.py",
+      "start_line": 341,
+      "end_line": 341
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DB-004-e33fd263",
+    "rule_id": "TG-DB-004",
+    "title": "Missing Multi-Tenant Isolation in Scoped Query",
+    "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+    "severity": "High",
+    "category": "database",
+    "cluster": "cluster-tenant-isolation",
+    "file_path": "harness/validate_v0_6_3_hardening.py",
+    "line_number": 119,
+    "matched_text": ".objects.get(id=inv_id)",
+    "snippet": "        snippet_v1 = \"\"\"def process_invoice(req, inv_id):\n    # Retrieve invoice\n    inv = Invoice.objects.get(id=inv_id)\n    return inv\n\"\"\"",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/validate_v0_6_3_hardening.py",
+      "start_line": 119,
+      "end_line": 119
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-d12cfc06",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled TLS certificate verification (verify=False)",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "harness/validate_v0_9_2_diff_and_monorepo.py",
+    "line_number": 58,
+    "matched_text": "verify = False",
+    "snippet": " def authenticate_user(token):\n+    # TODO: bypass auth check for debugging\n+    verify = False\n     return True\n\"\"\"",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/validate_v0_9_2_diff_and_monorepo.py",
+      "start_line": 58,
+      "end_line": 58
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DB-004-14a2d74f",
+    "rule_id": "TG-DB-004",
+    "title": "Missing Multi-Tenant Isolation in Scoped Query",
+    "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+    "severity": "High",
+    "category": "database",
+    "cluster": "cluster-tenant-isolation",
+    "file_path": "harness/validate_v1_0_0_memory.py",
+    "line_number": 265,
+    "matched_text": ".objects.get(id=id)",
+    "snippet": "-    return Bill.objects.filter(id=id, tenant=tenant)\n+def get_bill(id):\n+    return Bill.objects.get(id=id)\n\"\"\"\n        res_reg = diff_guard.audit_diff(regression_diff, check_memory=True, root_dir=test_root)",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/validate_v1_0_0_memory.py",
+      "start_line": 265,
+      "end_line": 265
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-INPUT-002-8f877a5f",
+    "rule_id": "TG-INPUT-002",
+    "title": "Unescaped Raw SQL Query Concatenation",
+    "description": "Python f-string interpolation in raw SQL query",
+    "severity": "Critical",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "harness/validate_v1_1_0_advanced_memory.py",
+    "line_number": 107,
+    "matched_text": "execute(f'SELECT * FROM users WHERE id = {",
+    "snippet": "        memory_engine.ensure_memory_structure(root_dir=test_root)\n\n        valid_before = \"cursor.execute(f'SELECT * FROM users WHERE id = {uid}')\"\n        valid_after = \"cursor.execute('SELECT * FROM users WHERE id = %s', (uid,))\"\n        valid_diff = \"- cursor.execute(f'SELECT * FROM users WHERE id = {uid}')\\n+ cursor.execute('SELECT * FROM users WHERE id = %s', (uid,))\"",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/validate_v1_1_0_advanced_memory.py",
+      "start_line": 107,
+      "end_line": 107
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-AUTH-004-e838c41c",
+    "rule_id": "TG-AUTH-004",
+    "title": "Insecure Session Cookie or Disabled CSRF Protection",
+    "description": "Attribute disabling ASP.NET authentication",
+    "severity": "High",
+    "category": "auth",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "harness/validate_v1_3_0_polyglot.py",
+    "line_number": 18,
+    "matched_text": "[AllowAnonymous]",
+    "snippet": "   - Go (InsecureSkipVerify: true)\n   - Java (csrf().disable())\n   - C# ([AllowAnonymous])\n   - PHP (CURLOPT_SSL_VERIFYPEER => false)\n   - Rust (unsafe { ... })",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/validate_v1_3_0_polyglot.py",
+      "start_line": 18,
+      "end_line": 18
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-AUTH-004-ea07db54",
+    "rule_id": "TG-AUTH-004",
+    "title": "Insecure Session Cookie or Disabled CSRF Protection",
+    "description": "Spring Security CSRF protection explicitly disabled",
+    "severity": "High",
+    "category": "auth",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "harness/validate_v1_3_0_polyglot.py",
+    "line_number": 193,
+    "matched_text": ".csrf().disable()",
+    "snippet": "+++ b/SecurityConfig.java\n@@ -20,3 +20,4 @@\n+    http.csrf().disable();\n\"\"\"\n        viol_java = diff_guard.check_diff_content(diff_java, \"SecurityConfig.java\")",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/validate_v1_3_0_polyglot.py",
+      "start_line": 193,
+      "end_line": 193
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-f209dec6",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled Go TLS certificate verification (InsecureSkipVerify: true)",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "harness/validate_v1_3_0_polyglot.py",
+    "line_number": 16,
+    "matched_text": "InsecureSkipVerify: true",
+    "snippet": "   - File extension census fallback (no manifest)\n2. Polyglot Diff Guard bypass detection across:\n   - Go (InsecureSkipVerify: true)\n   - Java (csrf().disable())\n   - C# ([AllowAnonymous])",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/validate_v1_3_0_polyglot.py",
+      "start_line": 16,
+      "end_line": 16
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-ddbf5cf0",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled PHP curl SSL verification",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "harness/validate_v1_3_0_polyglot.py",
+    "line_number": 19,
+    "matched_text": "CURLOPT_SSL_VERIFYPEER => false",
+    "snippet": "   - Java (csrf().disable())\n   - C# ([AllowAnonymous])\n   - PHP (CURLOPT_SSL_VERIFYPEER => false)\n   - Rust (unsafe { ... })\n3. Polyglot Tenant Scoping Patterns across GORM, LINQ, and Prisma",
+    "is_test": false,
+    "target": {
+      "file_path": "harness/validate_v1_3_0_polyglot.py",
+      "start_line": 19,
+      "end_line": 19
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-INPUT-003-1e99dcd3",
+    "rule_id": "TG-INPUT-003",
+    "title": "Unsafe Dynamic Code or HTML Execution",
+    "description": "Direct eval() execution on untrusted input",
+    "severity": "High",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "skills/torusguard/payload/scripts/audit_runner.py",
+    "line_number": 155,
+    "matched_text": "eval(",
+    "snippet": "        \"cluster\": \"cluster-injection\",\n        \"patterns\": [\n            (re.compile(r'\\beval\\s*\\('), \"Direct eval() execution on untrusted input\"),\n            (re.compile(r'\\bexec\\s*\\('), \"Direct exec() execution on untrusted input\"),\n            (re.compile(r'\\bdangerouslySetInnerHTML\\s*='), \"React dangerouslySetInnerHTML rendering raw unescaped HTML\"),",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/audit_runner.py",
+      "start_line": 155,
+      "end_line": 155
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-INPUT-003-135bec52",
+    "rule_id": "TG-INPUT-003",
+    "title": "Unsafe Dynamic Code or HTML Execution",
+    "description": "Direct exec() execution on untrusted input",
+    "severity": "High",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "skills/torusguard/payload/scripts/audit_runner.py",
+    "line_number": 156,
+    "matched_text": "exec(",
+    "snippet": "        \"patterns\": [\n            (re.compile(r'\\beval\\s*\\('), \"Direct eval() execution on untrusted input\"),\n            (re.compile(r'\\bexec\\s*\\('), \"Direct exec() execution on untrusted input\"),\n            (re.compile(r'\\bdangerouslySetInnerHTML\\s*='), \"React dangerouslySetInnerHTML rendering raw unescaped HTML\"),\n            (re.compile(r'\\.innerHTML\\s*='), \"Direct DOM innerHTML assignment vulnerable to XSS\")",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/audit_runner.py",
+      "start_line": 156,
+      "end_line": 156
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-fee5aee4",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled TLS certificate verification (verify=False)",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/audit_runner.py",
+    "line_number": 195,
+    "matched_text": "verify=False",
+    "snippet": "        \"cluster\": \"cluster-transport-security\",\n        \"patterns\": [\n            (re.compile(r'\\bverify\\s*=\\s*False\\b'), \"Disabled TLS certificate verification (verify=False)\"),\n            (re.compile(r'\\bInsecureSkipVerify\\s*:\\s*true\\b'), \"Disabled Go TLS certificate verification (InsecureSkipVerify: true)\"),\n            (re.compile(r'\\bNODE_TLS_REJECT_UNAUTHORIZED\\s*=\\s*[\\'\"]?0[\\'\"]?'), \"Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)\"),",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/audit_runner.py",
+      "start_line": 195,
+      "end_line": 195
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-e3171e93",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled Go TLS certificate verification (InsecureSkipVerify: true)",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/audit_runner.py",
+    "line_number": 196,
+    "matched_text": "InsecureSkipVerify: true",
+    "snippet": "        \"patterns\": [\n            (re.compile(r'\\bverify\\s*=\\s*False\\b'), \"Disabled TLS certificate verification (verify=False)\"),\n            (re.compile(r'\\bInsecureSkipVerify\\s*:\\s*true\\b'), \"Disabled Go TLS certificate verification (InsecureSkipVerify: true)\"),\n            (re.compile(r'\\bNODE_TLS_REJECT_UNAUTHORIZED\\s*=\\s*[\\'\"]?0[\\'\"]?'), \"Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)\"),\n            (re.compile(r'\\brejectUnauthorized\\s*:\\s*false\\b'), \"Disabled Node.js TLS rejectUnauthorized\"),",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/audit_runner.py",
+      "start_line": 196,
+      "end_line": 196
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-ac323d66",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/audit_runner.py",
+    "line_number": 197,
+    "matched_text": "NODE_TLS_REJECT_UNAUTHORIZED=0",
+    "snippet": "            (re.compile(r'\\bverify\\s*=\\s*False\\b'), \"Disabled TLS certificate verification (verify=False)\"),\n            (re.compile(r'\\bInsecureSkipVerify\\s*:\\s*true\\b'), \"Disabled Go TLS certificate verification (InsecureSkipVerify: true)\"),\n            (re.compile(r'\\bNODE_TLS_REJECT_UNAUTHORIZED\\s*=\\s*[\\'\"]?0[\\'\"]?'), \"Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)\"),\n            (re.compile(r'\\brejectUnauthorized\\s*:\\s*false\\b'), \"Disabled Node.js TLS rejectUnauthorized\"),\n            (re.compile(r'\\bCURLOPT_SSL_VERIFYPEER\\s*(?:=>|,)\\s*(?:false|0)\\b', re.IGNORECASE), \"Disabled PHP curl SSL verification\")",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/audit_runner.py",
+      "start_line": 197,
+      "end_line": 197
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-5447a47c",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled TLS certificate verification (verify=False)",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/diff_guard.py",
+    "line_number": 20,
+    "matched_text": "verify=False",
+    "snippet": "    (re.compile(r'(?:#|//|/\\*)\\s*(?:TODO\\s*:?\\s*)?(?:bypass|skip|disable)[_\\s]*(?:auth|security|check|guard|filter|csrf|tenant)', re.IGNORECASE), \"Suspicious authentication or security check bypass comment\"),\n    # TLS / Certificate validation bypasses across Python, Go, Node, Java, C#, PHP, Rust\n    (re.compile(r'\\bverify\\s*=\\s*False\\b'), \"Disabled TLS certificate verification (verify=False)\"),\n    (re.compile(r'\\bInsecureSkipVerify\\s*:\\s*true\\b'), \"Disabled Go TLS certificate verification (InsecureSkipVerify: true)\"),\n    (re.compile(r'\\bNODE_TLS_REJECT_UNAUTHORIZED\\s*=\\s*[\\'\"]?0[\\'\"]?'), \"Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)\"),",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/diff_guard.py",
+      "start_line": 20,
+      "end_line": 20
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-7afc81ff",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled Go TLS certificate verification (InsecureSkipVerify: true)",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/diff_guard.py",
+    "line_number": 21,
+    "matched_text": "InsecureSkipVerify: true",
+    "snippet": "    # TLS / Certificate validation bypasses across Python, Go, Node, Java, C#, PHP, Rust\n    (re.compile(r'\\bverify\\s*=\\s*False\\b'), \"Disabled TLS certificate verification (verify=False)\"),\n    (re.compile(r'\\bInsecureSkipVerify\\s*:\\s*true\\b'), \"Disabled Go TLS certificate verification (InsecureSkipVerify: true)\"),\n    (re.compile(r'\\bNODE_TLS_REJECT_UNAUTHORIZED\\s*=\\s*[\\'\"]?0[\\'\"]?'), \"Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)\"),\n    (re.compile(r'\\brejectUnauthorized\\s*:\\s*false\\b'), \"Disabled Node.js TLS rejectUnauthorized\"),",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/diff_guard.py",
+      "start_line": 21,
+      "end_line": 21
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-7b466146",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/diff_guard.py",
+    "line_number": 22,
+    "matched_text": "NODE_TLS_REJECT_UNAUTHORIZED=0",
+    "snippet": "    (re.compile(r'\\bverify\\s*=\\s*False\\b'), \"Disabled TLS certificate verification (verify=False)\"),\n    (re.compile(r'\\bInsecureSkipVerify\\s*:\\s*true\\b'), \"Disabled Go TLS certificate verification (InsecureSkipVerify: true)\"),\n    (re.compile(r'\\bNODE_TLS_REJECT_UNAUTHORIZED\\s*=\\s*[\\'\"]?0[\\'\"]?'), \"Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)\"),\n    (re.compile(r'\\brejectUnauthorized\\s*:\\s*false\\b'), \"Disabled Node.js TLS rejectUnauthorized\"),\n    (re.compile(r'\\b(?:TrustAllStrategy|NoopHostnameVerifier|DangerousAcceptAnyServerCertificateValidator)\\b'), \"Disabled Java / C# TLS certificate validation\"),",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/diff_guard.py",
+      "start_line": 22,
+      "end_line": 22
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-59a123c6",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled PHP curl SSL verification",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/diff_guard.py",
+    "line_number": 26,
+    "matched_text": "CURLOPT_SSL_VERIFYPEER => false",
+    "snippet": "    (re.compile(r'\\b(?:TrustAllStrategy|NoopHostnameVerifier|DangerousAcceptAnyServerCertificateValidator)\\b'), \"Disabled Java / C# TLS certificate validation\"),\n    (re.compile(r'\\bServerCertificateCustomValidationCallback\\s*=\\s*(?:\\([^)]*\\)\\s*=>\\s*true|HttpClientHandler\\.DangerousAcceptAnyServerCertificateValidator)'), \"Disabled C# TLS certificate callback\"),\n    (re.compile(r'\\bCURLOPT_SSL_VERIFYPEER\\s*(?:=>|,)\\s*(?:false|0)\\b', re.IGNORECASE), \"Disabled PHP curl SSL verification (CURLOPT_SSL_VERIFYPEER => false)\"),\n    (re.compile(r'\\bdanger_accept_invalid_certs\\s*\\(\\s*true\\s*\\)'), \"Disabled Rust reqwest TLS certificate validation\"),\n    # Auth & CSRF bypasses",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/diff_guard.py",
+      "start_line": 26,
+      "end_line": 26
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-PLATFORM-001-ed5dae35",
+    "rule_id": "TG-PLATFORM-001",
+    "title": "Wildcard Permissive CORS Configuration with Credentials",
+    "description": "Wildcard CORS origin enabled across entire application",
+    "severity": "High",
+    "category": "platform",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "skills/torusguard/payload/scripts/harden_runner.py",
+    "line_number": 183,
+    "matched_text": "CORS_ALLOW_ALL_ORIGINS = True",
+    "snippet": "    # Strategy 5: Permissive CORS with Credentials (TG-PLATFORM-001)\n    elif rule_id == \"TG-PLATFORM-001\":\n        if \"CORS_ALLOW_ALL_ORIGINS = True\" in target_line:\n            replacement = f'{indent}CORS_ALLOWED_ORIGINS = [os.environ.get(\"ALLOWED_ORIGIN\", \"https://app.example.com\")]'\n            new_lines[line_number - 1] = replacement",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/harden_runner.py",
+      "start_line": 183,
+      "end_line": 183
+    },
+    "confidence_score": 55,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 0,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 55,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-AUTH-004-f60870ef",
+    "rule_id": "TG-AUTH-004",
+    "title": "Insecure Session Cookie or Disabled CSRF Protection",
+    "description": "Decorator disabling route-level authentication or CSRF protection",
+    "severity": "High",
+    "category": "auth",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+    "line_number": 180,
+    "matched_text": "@csrf_exempt",
+    "snippet": "\n    if not bypass_guards:\n        bypass_rule = \"4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, `@csrf_exempt`, or `bypass_auth=True`.\"\n    else:\n        bypass_rule = f\"4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, or {', '.join(bypass_guards[:2])}.\"",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+      "start_line": 180,
+      "end_line": 180
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-AUTH-004-6b0c7ebf",
+    "rule_id": "TG-AUTH-004",
+    "title": "Insecure Session Cookie or Disabled CSRF Protection",
+    "description": "Attribute disabling ASP.NET authentication",
+    "severity": "High",
+    "category": "auth",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+    "line_number": 166,
+    "matched_text": "[AllowAnonymous]",
+    "snippet": "    if \"c#\" in stack_lower or \"dotnet\" in stack_lower:\n        sql_guards.append(\"EF Core LINQ / `FromSqlInterpolated`\")\n        bypass_guards.append(\"`[AllowAnonymous]`\")\n    if \"php\" in stack_lower:\n        sql_guards.append(\"PDO prepared statements / Eloquent\")",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+      "start_line": 166,
+      "end_line": 166
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-7db54483",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled TLS certificate verification (verify=False)",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+    "line_number": 180,
+    "matched_text": "verify=False",
+    "snippet": "\n    if not bypass_guards:\n        bypass_rule = \"4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, `@csrf_exempt`, or `bypass_auth=True`.\"\n    else:\n        bypass_rule = f\"4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, or {', '.join(bypass_guards[:2])}.\"",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+      "start_line": 180,
+      "end_line": 180
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-77bc2f9b",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled Go TLS certificate verification (InsecureSkipVerify: true)",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+    "line_number": 157,
+    "matched_text": "InsecureSkipVerify: true",
+    "snippet": "    if \"go\" in stack_lower:\n        sql_guards.append(\"`db.Query(..., args)` / GORM\")\n        bypass_guards.append(\"`InsecureSkipVerify: true`\")\n    if \"rust\" in stack_lower:\n        sql_guards.append(\"`sqlx::query!` / Diesel\")",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+      "start_line": 157,
+      "end_line": 157
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-cb5ae7e9",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled Node.js TLS rejectUnauthorized",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+    "line_number": 172,
+    "matched_text": "rejectUnauthorized: false",
+    "snippet": "    if \"typescript\" in stack_lower or \"javascript\" in stack_lower or \"next\" in stack_lower or \"express\" in stack_lower:\n        sql_guards.append(\"Prisma / Drizzle binders\")\n        bypass_guards.append(\"`rejectUnauthorized: false`\")\n\n    if not sql_guards:",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+      "start_line": 172,
+      "end_line": 172
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-0e4204af",
+    "rule_id": "TG-DIFF-001",
+    "title": "Disabled TLS / SSL Certificate Validation",
+    "description": "Disabled PHP curl SSL verification",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+    "line_number": 169,
+    "matched_text": "CURLOPT_SSL_VERIFYPEER => false",
+    "snippet": "    if \"php\" in stack_lower:\n        sql_guards.append(\"PDO prepared statements / Eloquent\")\n        bypass_guards.append(\"`CURLOPT_SSL_VERIFYPEER => false`\")\n    if \"typescript\" in stack_lower or \"javascript\" in stack_lower or \"next\" in stack_lower or \"express\" in stack_lower:\n        sql_guards.append(\"Prisma / Drizzle binders\")",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+      "start_line": 169,
+      "end_line": 169
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DB-004-6a739666",
+    "rule_id": "TG-DB-004",
+    "title": "Missing Multi-Tenant Isolation in Scoped Query",
+    "description": "Django ORM .get(id=...) query lacking explicit tenant scope filter",
+    "severity": "Low",
+    "category": "database",
+    "cluster": "cluster-tenant-isolation",
+    "file_path": "tests/test_v0_6_0_governed_remediation.py",
+    "line_number": 79,
+    "matched_text": ".objects.get(id=invoice_id)",
+    "snippet": "        def get_invoice(request, invoice_id):\n            # Fetch invoice directly without tenant filter\n            invoice = Invoice.objects.get(id=invoice_id)\n            return JsonResponse({\"id\": invoice.id})\n        \"\"\"",
+    "is_test": true,
+    "target": {
+      "file_path": "tests/test_v0_6_0_governed_remediation.py",
+      "start_line": 79,
+      "end_line": 79
+    },
+    "confidence_score": 40,
+    "confidence_band": "Needs Review",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": true,
+      "test_deduction": -30,
+      "total_score": 40,
+      "classification_band": "Needs Review"
+    }
+  }
+]