torusguard 1.3.3 → 1.3.4

package/.torusguard/runs/run-20260910-120238-audit/findings.md

@@ -0,0 +1,560 @@
+# TorusGuard Static Security Audit Report
+**Run ID:** `run-20260910-120238-audit`  
+**Timestamp:** `2026-09-10 12:02:38 IST`  
+**Target:** `C:\Users\Admin\Desktop\TorusGuard`  
+**Total Findings:** `46`  
+
+---
+## Findings Catalog
+
+### [TG-INPUT-003] Unsafe Dynamic Code or HTML Execution
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `examples/vulnerable-react-express/client/src/App.jsx:53` | **Cluster:** `cluster-injection`
+- **Description:** React dangerouslySetInnerHTML rendering raw unescaped HTML
+```
+
+      {/* TG-INPUT-003: Unsafe HTML rendering */}
+      <div dangerouslySetInnerHTML={{ __html: bio }} />
+
+      <button onClick={fetchUser}>Fetch user (IDOR demo)</button>
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `examples/vulnerable-react-express/server/index.js:9` | **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded JWT signing secret
+```
+
+// TG-SEC-001: Hardcoded JWT secret
+const JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';
+
+// TG-PLATFORM-001: Wildcard CORS with credentials
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `examples/vulnerable-react-express/server/index.js:18` | **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+
+const users = [
+  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },
+  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },
+];
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/engine/fixture_manager.py:224` | **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+                vulnerable_variant=FixtureVariant(
+                    relative_path="examples/python/django-vuln",
+                    code_pattern="tenant_id = request.headers.get('X-Tenant-ID')\nrecord = Invoice.objects.get(id=invoice_id)",
+                    expected_findings_count=2,
+                ),
+```
+
+### [TG-INPUT-002] Unescaped Raw SQL Query Concatenation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/engine/fixture_manager.py:128` | **Cluster:** `cluster-injection`
+- **Description:** Python f-string interpolation in raw SQL query
+```
+                vulnerable_variant=FixtureVariant(
+                    relative_path="examples/python/sqlalchemy-vuln",
+                    code_pattern="session.execute(f'SELECT * FROM items WHERE name LIKE {q}')",
+                    expected_findings_count=4,
+                ),
+```
+
+### [TG-AUTH-004] Insecure Session Cookie or Disabled CSRF Protection
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/evaluate_portfolio_polyglot.py:107` | **Cluster:** `cluster-auth-bypass`
+- **Description:** Session cookie secure flag disabled in Django settings
+```
+        "expected_orm": "SQLAlchemy",
+        "ecosystem": "Python",
+        "test_bypass": ("python", "SESSION_COOKIE_SECURE = False", "auth_bypass"),
+        "test_tenant": ("python", "tenant_id"),
+    },
+```
+
+### [TG-AUTH-004] Insecure Session Cookie or Disabled CSRF Protection
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/evaluate_portfolio_polyglot.py:96` | **Cluster:** `cluster-auth-bypass`
+- **Description:** Decorator disabling route-level authentication or CSRF protection
+```
+        "expected_orm": "Django ORM",
+        "ecosystem": "Python",
+        "test_bypass": ("python", "@csrf_exempt", "auth_bypass"),
+        "test_tenant": ("python", "tenant"),
+    },
+```
+
+### [TG-AUTH-004] Insecure Session Cookie or Disabled CSRF Protection
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/evaluate_portfolio_polyglot.py:239` | **Cluster:** `cluster-auth-bypass`
+- **Description:** Attribute disabling ASP.NET authentication
+```
+        "expected_orm": "Entity Framework Core",
+        "ecosystem": "C#",
+        "test_bypass": ("csharp", "[AllowAnonymous]", "auth_bypass"),
+        "test_tenant": ("csharp", ".Where(x => x.TenantId == tenantId)"),
+    },
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/evaluate_portfolio_polyglot.py:74` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled TLS certificate verification (verify=False)
+```
+        "expected_orm": "SQLAlchemy",
+        "ecosystem": "Python",
+        "test_bypass": ("python", "verify=False", "auth_bypass"),
+        "test_tenant": ("python", "tenant_id"),
+    },
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/evaluate_portfolio_polyglot.py:151` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
+        "expected_orm": "GORM",
+        "ecosystem": "Go",
+        "test_bypass": ("go", "InsecureSkipVerify: true", "tls_bypass"),
+        "test_tenant": ("go", '.Where("tenant_id = ?", tenantID)'),
+    },
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/evaluate_portfolio_polyglot.py:129` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Node.js TLS rejectUnauthorized
+```
+        "expected_orm": "Mongoose",
+        "ecosystem": "JavaScript",
+        "test_bypass": ("javascript", "rejectUnauthorized: false", "tls_bypass"),
+        "test_tenant": ("javascript", "author: req.user.id"),
+    },
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/evaluate_portfolio_polyglot.py:261` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled PHP curl SSL verification
+```
+        "expected_orm": "Eloquent",
+        "ecosystem": "PHP",
+        "test_bypass": ("php", "CURLOPT_SSL_VERIFYPEER => false", "tls_bypass"),
+        "test_tenant": ("php", 'where("tenant_id", $tenantId)'),
+    },
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/master_validation.py:257` | **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+        self.log("Redaction", "JWT Token Redaction", "Bearer ***REDACTED_JWT***" in masked_jwt and "doNotLeakSignature" not in masked_jwt)
+
+        masked_pwd = mask_sensitive_data("DB_PASSWORD = 'super_secret_database_password_123'")
+        self.log("Redaction", "Password Variable Redaction", "***REDACTED***" in masked_pwd and "super_secret_database_password_123" not in masked_pwd)
+
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/runner.py:209` | **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+            type=EvidenceType.SOURCE,
+            location="server/auth.py:42",
+            raw_snippet="SECRET_KEY = 'super_secret_jwt_key'",
+            rationale="Hardcoded secret credential.",
+            confidence_level=ConfidenceBand.CONFIRMED,
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/runner.py:503` | **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+
+            # 2. Stable Finding Identity
+            code_a = "def view():\n    return Item.objects.get(id=id)"
+            code_b = "# Shifted comment\ndef view():\n    return Item.objects.get(id=id)"
+            fp1 = IdentityEngine.generate_identity("TG-DB-004", "views.py", code_a, sink_signature="Item.objects.get")
+```
+
+### [TG-INPUT-002] Unescaped Raw SQL Query Concatenation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/runner.py:256` | **Cluster:** `cluster-injection`
+- **Description:** Python f-string interpolation in raw SQL query
+```
+            framework_pattern=FrameworkPattern(
+                framework="Django",
+                unsafe_snippet="User.objects.raw(f'SELECT * FROM users WHERE name = {name}')",
+                safe_snippet="User.objects.raw('SELECT * FROM users WHERE name = %s', [name])",
+            ),
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_e2e.py:355` | **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+
+    def _create_sample_finding(self, rule_id: str, target_path: str, secret_test: bool = False) -> Finding:
+        raw_code = "API_KEY = 'sk_live_998877665544332211'\nAuthorization = 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.doNotLeakSignature'" if secret_test else f"# Unsafe logic for {rule_id}\nrole = request.headers.get('X-User-Role')"
+        
+        ev = Evidence(
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_qa_v0_6_0.py:64` | **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+            "tiny-repo": {
+                "vulnerable": {
+                    "app.py": 'DEBUG = True\nSECRET_KEY = "sk_live_1234567890"\n\ndef index():\n    return "Welcome"\n'
+                },
+                "hardened": {
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_qa_v0_6_0.py:101` | **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+            "django-app": {
+                "vulnerable": {
+                    "views.py": 'from django.shortcuts import render\nfrom django.utils.safestring import mark_safe\nfrom .models import Invoice\n\ndef invoice_detail(request, invoice_id):\n    # IDOR Vulnerability: Missing tenant filter\n    invoice = Invoice.objects.get(id=invoice_id)\n    # Template autoescaping bypass\n    rendered = mark_safe(f"<h1>{invoice.title}</h1>")\n    return render(request, "detail.html", {"content": rendered})\n',
+                    "models.py": 'from django.db import models\n\nclass Invoice(models.Model):\n    title = models.CharField(max_length=200)\n    tenant_id = models.CharField(max_length=50)\n'
+                },
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_v0_6_1_scale.py:115` | **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+                "severity": "High",
+                "target": {"file_path": "apps/django_core/billing/views.py", "line_start": 42, "line_end": 42},
+                "evidence": {"code_snippet": "Invoice.objects.get(id=inv_id)"},
+            },
+            # FastAPI Microservice
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_v0_6_2_modern_stacks.py:341` | **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+COPY . .
+# Running as root user & hardcoding secrets
+ENV DATABASE_PASSWORD="secret_in_docker"
+CMD ["python", "main.py"]
+""", encoding="utf-8")
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_v0_6_3_hardening.py:119` | **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+        snippet_v1 = """def process_invoice(req, inv_id):
+    # Retrieve invoice
+    inv = Invoice.objects.get(id=inv_id)
+    return inv
+"""
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_v0_9_2_diff_and_monorepo.py:58` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled TLS certificate verification (verify=False)
+```
+ def authenticate_user(token):
++    # TODO: bypass auth check for debugging
++    verify = False
+     return True
+"""
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_v1_0_0_memory.py:265` | **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+-    return Bill.objects.filter(id=id, tenant=tenant)
++def get_bill(id):
++    return Bill.objects.get(id=id)
+"""
+        res_reg = diff_guard.audit_diff(regression_diff, check_memory=True, root_dir=test_root)
+```
+
+### [TG-INPUT-002] Unescaped Raw SQL Query Concatenation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_v1_1_0_advanced_memory.py:107` | **Cluster:** `cluster-injection`
+- **Description:** Python f-string interpolation in raw SQL query
+```
+        memory_engine.ensure_memory_structure(root_dir=test_root)
+
+        valid_before = "cursor.execute(f'SELECT * FROM users WHERE id = {uid}')"
+        valid_after = "cursor.execute('SELECT * FROM users WHERE id = %s', (uid,))"
+        valid_diff = "- cursor.execute(f'SELECT * FROM users WHERE id = {uid}')\n+ cursor.execute('SELECT * FROM users WHERE id = %s', (uid,))"
+```
+
+### [TG-AUTH-004] Insecure Session Cookie or Disabled CSRF Protection
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_v1_3_0_polyglot.py:18` | **Cluster:** `cluster-auth-bypass`
+- **Description:** Attribute disabling ASP.NET authentication
+```
+   - Go (InsecureSkipVerify: true)
+   - Java (csrf().disable())
+   - C# ([AllowAnonymous])
+   - PHP (CURLOPT_SSL_VERIFYPEER => false)
+   - Rust (unsafe { ... })
+```
+
+### [TG-AUTH-004] Insecure Session Cookie or Disabled CSRF Protection
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_v1_3_0_polyglot.py:193` | **Cluster:** `cluster-auth-bypass`
+- **Description:** Spring Security CSRF protection explicitly disabled
+```
++++ b/SecurityConfig.java
+@@ -20,3 +20,4 @@
++    http.csrf().disable();
+"""
+        viol_java = diff_guard.check_diff_content(diff_java, "SecurityConfig.java")
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_v1_3_0_polyglot.py:16` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
+   - File extension census fallback (no manifest)
+2. Polyglot Diff Guard bypass detection across:
+   - Go (InsecureSkipVerify: true)
+   - Java (csrf().disable())
+   - C# ([AllowAnonymous])
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `harness/validate_v1_3_0_polyglot.py:19` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled PHP curl SSL verification
+```
+   - Java (csrf().disable())
+   - C# ([AllowAnonymous])
+   - PHP (CURLOPT_SSL_VERIFYPEER => false)
+   - Rust (unsafe { ... })
+3. Polyglot Tenant Scoping Patterns across GORM, LINQ, and Prisma
+```
+
+### [TG-INPUT-003] Unsafe Dynamic Code or HTML Execution
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/audit_runner.py:155` | **Cluster:** `cluster-injection`
+- **Description:** Direct eval() execution on untrusted input
+```
+        "cluster": "cluster-injection",
+        "patterns": [
+            (re.compile(r'\beval\s*\('), "Direct eval() execution on untrusted input"),
+            (re.compile(r'\bexec\s*\('), "Direct exec() execution on untrusted input"),
+            (re.compile(r'\bdangerouslySetInnerHTML\s*='), "React dangerouslySetInnerHTML rendering raw unescaped HTML"),
+```
+
+### [TG-INPUT-003] Unsafe Dynamic Code or HTML Execution
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/audit_runner.py:156` | **Cluster:** `cluster-injection`
+- **Description:** Direct exec() execution on untrusted input
+```
+        "patterns": [
+            (re.compile(r'\beval\s*\('), "Direct eval() execution on untrusted input"),
+            (re.compile(r'\bexec\s*\('), "Direct exec() execution on untrusted input"),
+            (re.compile(r'\bdangerouslySetInnerHTML\s*='), "React dangerouslySetInnerHTML rendering raw unescaped HTML"),
+            (re.compile(r'\.innerHTML\s*='), "Direct DOM innerHTML assignment vulnerable to XSS")
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/audit_runner.py:195` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled TLS certificate verification (verify=False)
+```
+        "cluster": "cluster-transport-security",
+        "patterns": [
+            (re.compile(r'\bverify\s*=\s*False\b'), "Disabled TLS certificate verification (verify=False)"),
+            (re.compile(r'\bInsecureSkipVerify\s*:\s*true\b'), "Disabled Go TLS certificate verification (InsecureSkipVerify: true)"),
+            (re.compile(r'\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*[\'"]?0[\'"]?'), "Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)"),
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/audit_runner.py:196` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
+        "patterns": [
+            (re.compile(r'\bverify\s*=\s*False\b'), "Disabled TLS certificate verification (verify=False)"),
+            (re.compile(r'\bInsecureSkipVerify\s*:\s*true\b'), "Disabled Go TLS certificate verification (InsecureSkipVerify: true)"),
+            (re.compile(r'\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*[\'"]?0[\'"]?'), "Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)"),
+            (re.compile(r'\brejectUnauthorized\s*:\s*false\b'), "Disabled Node.js TLS rejectUnauthorized"),
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/audit_runner.py:197` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)
+```
+            (re.compile(r'\bverify\s*=\s*False\b'), "Disabled TLS certificate verification (verify=False)"),
+            (re.compile(r'\bInsecureSkipVerify\s*:\s*true\b'), "Disabled Go TLS certificate verification (InsecureSkipVerify: true)"),
+            (re.compile(r'\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*[\'"]?0[\'"]?'), "Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)"),
+            (re.compile(r'\brejectUnauthorized\s*:\s*false\b'), "Disabled Node.js TLS rejectUnauthorized"),
+            (re.compile(r'\bCURLOPT_SSL_VERIFYPEER\s*(?:=>|,)\s*(?:false|0)\b', re.IGNORECASE), "Disabled PHP curl SSL verification")
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/diff_guard.py:20` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled TLS certificate verification (verify=False)
+```
+    (re.compile(r'(?:#|//|/\*)\s*(?:TODO\s*:?\s*)?(?:bypass|skip|disable)[_\s]*(?:auth|security|check|guard|filter|csrf|tenant)', re.IGNORECASE), "Suspicious authentication or security check bypass comment"),
+    # TLS / Certificate validation bypasses across Python, Go, Node, Java, C#, PHP, Rust
+    (re.compile(r'\bverify\s*=\s*False\b'), "Disabled TLS certificate verification (verify=False)"),
+    (re.compile(r'\bInsecureSkipVerify\s*:\s*true\b'), "Disabled Go TLS certificate verification (InsecureSkipVerify: true)"),
+    (re.compile(r'\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*[\'"]?0[\'"]?'), "Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)"),
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/diff_guard.py:21` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
+    # TLS / Certificate validation bypasses across Python, Go, Node, Java, C#, PHP, Rust
+    (re.compile(r'\bverify\s*=\s*False\b'), "Disabled TLS certificate verification (verify=False)"),
+    (re.compile(r'\bInsecureSkipVerify\s*:\s*true\b'), "Disabled Go TLS certificate verification (InsecureSkipVerify: true)"),
+    (re.compile(r'\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*[\'"]?0[\'"]?'), "Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)"),
+    (re.compile(r'\brejectUnauthorized\s*:\s*false\b'), "Disabled Node.js TLS rejectUnauthorized"),
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/diff_guard.py:22` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)
+```
+    (re.compile(r'\bverify\s*=\s*False\b'), "Disabled TLS certificate verification (verify=False)"),
+    (re.compile(r'\bInsecureSkipVerify\s*:\s*true\b'), "Disabled Go TLS certificate verification (InsecureSkipVerify: true)"),
+    (re.compile(r'\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*[\'"]?0[\'"]?'), "Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)"),
+    (re.compile(r'\brejectUnauthorized\s*:\s*false\b'), "Disabled Node.js TLS rejectUnauthorized"),
+    (re.compile(r'\b(?:TrustAllStrategy|NoopHostnameVerifier|DangerousAcceptAnyServerCertificateValidator)\b'), "Disabled Java / C# TLS certificate validation"),
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/diff_guard.py:26` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled PHP curl SSL verification
+```
+    (re.compile(r'\b(?:TrustAllStrategy|NoopHostnameVerifier|DangerousAcceptAnyServerCertificateValidator)\b'), "Disabled Java / C# TLS certificate validation"),
+    (re.compile(r'\bServerCertificateCustomValidationCallback\s*=\s*(?:\([^)]*\)\s*=>\s*true|HttpClientHandler\.DangerousAcceptAnyServerCertificateValidator)'), "Disabled C# TLS certificate callback"),
+    (re.compile(r'\bCURLOPT_SSL_VERIFYPEER\s*(?:=>|,)\s*(?:false|0)\b', re.IGNORECASE), "Disabled PHP curl SSL verification (CURLOPT_SSL_VERIFYPEER => false)"),
+    (re.compile(r'\bdanger_accept_invalid_certs\s*\(\s*true\s*\)'), "Disabled Rust reqwest TLS certificate validation"),
+    # Auth & CSRF bypasses
+```
+
+### [TG-PLATFORM-001] Wildcard Permissive CORS Configuration with Credentials
+- **Severity:** `High` | **Confidence:** `55/100 (Medium Confidence)`
+- **File:** `skills/torusguard/payload/scripts/harden_runner.py:183` | **Cluster:** `cluster-auth-bypass`
+- **Description:** Wildcard CORS origin enabled across entire application
+```
+    # Strategy 5: Permissive CORS with Credentials (TG-PLATFORM-001)
+    elif rule_id == "TG-PLATFORM-001":
+        if "CORS_ALLOW_ALL_ORIGINS = True" in target_line:
+            replacement = f'{indent}CORS_ALLOWED_ORIGINS = [os.environ.get("ALLOWED_ORIGIN", "https://app.example.com")]'
+            new_lines[line_number - 1] = replacement
+```
+
+### [TG-AUTH-004] Insecure Session Cookie or Disabled CSRF Protection
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/rules_sync.py:180` | **Cluster:** `cluster-auth-bypass`
+- **Description:** Decorator disabling route-level authentication or CSRF protection
+```
+
+    if not bypass_guards:
+        bypass_rule = "4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, `@csrf_exempt`, or `bypass_auth=True`."
+    else:
+        bypass_rule = f"4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, or {', '.join(bypass_guards[:2])}."
+```
+
+### [TG-AUTH-004] Insecure Session Cookie or Disabled CSRF Protection
+- **Severity:** `High` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/rules_sync.py:166` | **Cluster:** `cluster-auth-bypass`
+- **Description:** Attribute disabling ASP.NET authentication
+```
+    if "c#" in stack_lower or "dotnet" in stack_lower:
+        sql_guards.append("EF Core LINQ / `FromSqlInterpolated`")
+        bypass_guards.append("`[AllowAnonymous]`")
+    if "php" in stack_lower:
+        sql_guards.append("PDO prepared statements / Eloquent")
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/rules_sync.py:180` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled TLS certificate verification (verify=False)
+```
+
+    if not bypass_guards:
+        bypass_rule = "4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, `@csrf_exempt`, or `bypass_auth=True`."
+    else:
+        bypass_rule = f"4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, or {', '.join(bypass_guards[:2])}."
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/rules_sync.py:157` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
+    if "go" in stack_lower:
+        sql_guards.append("`db.Query(..., args)` / GORM")
+        bypass_guards.append("`InsecureSkipVerify: true`")
+    if "rust" in stack_lower:
+        sql_guards.append("`sqlx::query!` / Diesel")
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/rules_sync.py:172` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Node.js TLS rejectUnauthorized
+```
+    if "typescript" in stack_lower or "javascript" in stack_lower or "next" in stack_lower or "express" in stack_lower:
+        sql_guards.append("Prisma / Drizzle binders")
+        bypass_guards.append("`rejectUnauthorized: false`")
+
+    if not sql_guards:
+```
+
+### [TG-DIFF-001] Disabled TLS / SSL Certificate Validation
+- **Severity:** `Critical` | **Confidence:** `70/100 (High Confidence)`
+- **File:** `skills/torusguard/payload/scripts/rules_sync.py:169` | **Cluster:** `cluster-transport-security`
+- **Description:** Disabled PHP curl SSL verification
+```
+    if "php" in stack_lower:
+        sql_guards.append("PDO prepared statements / Eloquent")
+        bypass_guards.append("`CURLOPT_SSL_VERIFYPEER => false`")
+    if "typescript" in stack_lower or "javascript" in stack_lower or "next" in stack_lower or "express" in stack_lower:
+        sql_guards.append("Prisma / Drizzle binders")
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Severity:** `Low` | **Confidence:** `40/100 (Needs Review)`
+- **File:** `tests/test_v0_6_0_governed_remediation.py:79` | **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+        def get_invoice(request, invoice_id):
+            # Fetch invoice directly without tenant filter
+            invoice = Invoice.objects.get(id=invoice_id)
+            return JsonResponse({"id": invoice.id})
+        """
+```

package/.torusguard/runs/run-20260910-120238-audit/manifest.json

@@ -0,0 +1,13 @@
+{
+  "run_id": "run-20260910-120238-audit",
+  "command": "audit",
+  "target_name": "TorusGuard",
+  "created_at": "2026-09-10 12:02:38 IST",
+  "created_at_iso": "2026-09-10T12:02:38.760060+05:30",
+  "status": "recheck_completed",
+  "torusguard_version": "1.3.0",
+  "findings_count": 46,
+  "confirmed_fixed_count": 0,
+  "regressed_count": 0,
+  "remediation_bundles_count": 16
+}

package/.torusguard/runs/run-20260910-120238-audit/recheck.md

@@ -0,0 +1,86 @@
+# TorusGuard Differential Recheck Report
+**Run ID:** `run-20260910-120238-audit`  
+**Timestamp:** `2026-09-10 12:04:44 IST`  
+
+---
+## Recheck Transition Catalog
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **File:** `harness/validate_v0_6_1_scale.py`
+- **Outcome:** `Unresolved`
+- **Verification Timestamp:** 2026-09-10 12:04:44 IST
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **File:** `harness/validate_v0_6_3_hardening.py`
+- **Outcome:** `Unresolved`
+- **Verification Timestamp:** 2026-09-10 12:04:44 IST
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **File:** `harness/validate_v1_0_0_memory.py`
+- **Outcome:** `Unresolved`
+- **Verification Timestamp:** 2026-09-10 12:04:44 IST
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **File:** `harness/runner.py`
+- **Outcome:** `Unresolved`
+- **Verification Timestamp:** 2026-09-10 12:04:44 IST
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **File:** `tests/test_v0_6_0_governed_remediation.py`
+- **Outcome:** `Unresolved`
+- **Verification Timestamp:** 2026-09-10 12:04:44 IST
+
+### [TG-INPUT-002] Unescaped Raw SQL Query Concatenation
+- **File:** `harness/validate_v1_1_0_advanced_memory.py`
+- **Outcome:** `Unresolved`
+- **Verification Timestamp:** 2026-09-10 12:04:44 IST
+
+### [TG-INPUT-002] Unescaped Raw SQL Query Concatenation
+- **File:** `harness/engine/fixture_manager.py`
+- **Outcome:** `Unresolved`
+- **Verification Timestamp:** 2026-09-10 12:04:44 IST
+
+### [TG-INPUT-002] Unescaped Raw SQL Query Concatenation
+- **File:** `harness/runner.py`
+- **Outcome:** `Unresolved`
+- **Verification Timestamp:** 2026-09-10 12:04:45 IST
+
+### [TG-INPUT-003] Unsafe Dynamic Code or HTML Execution
+- **File:** `examples/vulnerable-react-express/client/src/App.jsx`
+- **Outcome:** `Unresolved`
+- **Verification Timestamp:** 2026-09-10 12:04:45 IST
+
+### [TG-PLATFORM-001] Wildcard Permissive CORS Configuration with Credentials
+- **File:** `skills/torusguard/payload/scripts/harden_runner.py`
+- **Outcome:** `Unresolved`
+- **Verification Timestamp:** 2026-09-10 12:04:45 IST
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **File:** `harness/runner.py`
+- **Outcome:** `Unresolved`
+- **Verification Timestamp:** 2026-09-10 12:04:45 IST
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **File:** `harness/master_validation.py`
+- **Outcome:** `Unresolved`
+- **Verification Timestamp:** 2026-09-10 12:04:45 IST
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **File:** `harness/validate_v0_6_2_modern_stacks.py`
+- **Outcome:** `Unresolved`
+- **Verification Timestamp:** 2026-09-10 12:04:45 IST
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **File:** `harness/validate_e2e.py`
+- **Outcome:** `Unresolved`
+- **Verification Timestamp:** 2026-09-10 12:04:45 IST
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **File:** `harness/validate_qa_v0_6_0.py`
+- **Outcome:** `Unresolved`
+- **Verification Timestamp:** 2026-09-10 12:04:45 IST
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **File:** `examples/vulnerable-react-express/server/index.js`
+- **Outcome:** `Unresolved`
+- **Verification Timestamp:** 2026-09-10 12:04:45 IST