torusguard 1.3.3 → 1.3.5

package/.torusguard/runs/run-20260912-214110-audit/findings.md

@@ -0,0 +1,534 @@
+# TorusGuard Security Audit Findings: run-20260912-214110-audit
+- Target Root: `C:\Users\Admin\Desktop\TorusGuard`
+- Total Scored Findings: `38`
+- Identified Clusters: `9`
+- Generated At: `2026-09-12 21:41:10 IST`
+
+---
+## Summary of Findings
+
+### [Critical] TG-SEC-001 - Hardcoded Secret or API Key in Tracked Source
+- **Finding ID:** `TG-SEC-001-bb5e4b77`
+- **Location:** `examples/vulnerable-react-express/server/index.js:9`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded JWT signing secret
+```
+
+// TG-SEC-001: Hardcoded JWT secret
+const JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';
+
+// TG-PLATFORM-001: Wildcard CORS with credentials
+```
+
+### [Critical] TG-SEC-001 - Hardcoded Secret or API Key in Tracked Source
+- **Finding ID:** `TG-SEC-001-c393d596`
+- **Location:** `examples/vulnerable-react-express/server/index.js:18`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+
+const users = [
+  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },
+  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },
+];
+```
+
+### [Critical] TG-DB-002 - Privileged Database Credential in Browser Context
+- **Finding ID:** `TG-DB-002-d9bd69df`
+- **Location:** `demo/playground/vulnerable_nextjs/actions.ts:9`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-client-leak`
+- **Description:** Service role key or raw database connection string reference in frontend code
+```
+
+// Finding 1: TG-CLIENT-001 - Backend admin key exposed in client-accessible code
+export const SUPABASE_SERVICE_ROLE_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.demo_secret_token_1234567890";
+
+interface UserRecord {
+```
+
+### [Critical] TG-DIFF-001 - Accidental Security Check Bypass in Patch Additions
+- **Finding ID:** `TG-DIFF-001-671d3513`
+- **Location:** `skills/torusguard/payload/scripts/harden_runner.py:246`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled TLS certificate verification (verify=False)
+```
+    # Strategy 8: TLS Verification Bypass (TG-DIFF-001)
+    elif rule_id == "TG-DIFF-001":
+        if "verify=False" in target_line:
+            fixed_line = target_line.replace("verify=False", "verify=True")
+            new_lines[line_number - 1] = fixed_line
+```
+
+### [Critical] TG-DIFF-001 - Accidental Security Check Bypass in Patch Additions
+- **Finding ID:** `TG-DIFF-001-b6549484`
+- **Location:** `skills/torusguard/payload/scripts/harden_runner.py:256`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
+            applied_rule = True
+            fix_explanation = "Restored TLS certificate authority validation (rejectUnauthorized: true)"
+        elif "InsecureSkipVerify: true" in target_line:
+            fixed_line = target_line.replace("InsecureSkipVerify: true", "InsecureSkipVerify: false")
+            new_lines[line_number - 1] = fixed_line
+```
+
+### [Critical] TG-DIFF-001 - Accidental Security Check Bypass in Patch Additions
+- **Finding ID:** `TG-DIFF-001-c4cfaa8a`
+- **Location:** `skills/torusguard/payload/scripts/harden_runner.py:251`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Node.js TLS rejectUnauthorized
+```
+            applied_rule = True
+            fix_explanation = "Restored mandatory TLS certificate verification (verify=True)"
+        elif "rejectUnauthorized: false" in target_line:
+            fixed_line = target_line.replace("rejectUnauthorized: false", "rejectUnauthorized: true")
+            new_lines[line_number - 1] = fixed_line
+```
+
+### [Critical] TG-DIFF-001 - Accidental Security Check Bypass in Patch Additions
+- **Finding ID:** `TG-DIFF-001-7db54483`
+- **Location:** `skills/torusguard/payload/scripts/rules_sync.py:180`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled TLS certificate verification (verify=False)
+```
+
+    if not bypass_guards:
+        bypass_rule = "4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, `@csrf_exempt`, or `bypass_auth=True`."
+    else:
+        bypass_rule = f"4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, or {', '.join(bypass_guards[:2])}."
+```
+
+### [Critical] TG-DIFF-001 - Accidental Security Check Bypass in Patch Additions
+- **Finding ID:** `TG-DIFF-001-77bc2f9b`
+- **Location:** `skills/torusguard/payload/scripts/rules_sync.py:157`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
+    if "go" in stack_lower:
+        sql_guards.append("`db.Query(..., args)` / GORM")
+        bypass_guards.append("`InsecureSkipVerify: true`")
+    if "rust" in stack_lower:
+        sql_guards.append("`sqlx::query!` / Diesel")
+```
+
+### [Critical] TG-DIFF-001 - Accidental Security Check Bypass in Patch Additions
+- **Finding ID:** `TG-DIFF-001-cb5ae7e9`
+- **Location:** `skills/torusguard/payload/scripts/rules_sync.py:172`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Node.js TLS rejectUnauthorized
+```
+    if "typescript" in stack_lower or "javascript" in stack_lower or "next" in stack_lower or "express" in stack_lower:
+        sql_guards.append("Prisma / Drizzle binders")
+        bypass_guards.append("`rejectUnauthorized: false`")
+
+    if not sql_guards:
+```
+
+### [Critical] TG-DIFF-001 - Accidental Security Check Bypass in Patch Additions
+- **Finding ID:** `TG-DIFF-001-0e4204af`
+- **Location:** `skills/torusguard/payload/scripts/rules_sync.py:169`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled PHP curl SSL verification
+```
+    if "php" in stack_lower:
+        sql_guards.append("PDO prepared statements / Eloquent")
+        bypass_guards.append("`CURLOPT_SSL_VERIFYPEER => false`")
+    if "typescript" in stack_lower or "javascript" in stack_lower or "next" in stack_lower or "express" in stack_lower:
+        sql_guards.append("Prisma / Drizzle binders")
+```
+
+### [Critical] TG-SSRF-002 - Missing Internal Network Protection
+- **Finding ID:** `TG-SSRF-002-8378a839`
+- **Location:** `core/clustering.py:53`
+- **Confidence Score:** `65/100` (Medium Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Hardcoded internal loopback or cloud metadata endpoint target
+```
+        "cluster_id": "cluster-ssrf-network",
+        "title": "Unvalidated Outbound HTTP Requests & Network Boundary Leakage",
+        "shared_remediation_path": "Validate destination URLs against strict allowlists and block internal IP ranges (127.0.0.1, 169.254.169.254).",
+        "shared_verification_plan": "Attempt outbound requests to loopback and link-local metadata endpoints."
+    },
+```
+
+### [Critical] TG-SSRF-002 - Missing Internal Network Protection
+- **Finding ID:** `TG-SSRF-002-d08ed1ca`
+- **Location:** `examples/hardened-react-express/client/vite.config.js:7`
+- **Confidence Score:** `65/100` (Medium Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Hardcoded internal loopback or cloud metadata endpoint target
+```
+  plugins: [react()],
+  build: { sourcemap: false },
+  server: { port: 5173, proxy: { '/api': 'http://localhost:3001' } },
+});
+```
+
+### [Critical] TG-SSRF-002 - Missing Internal Network Protection
+- **Finding ID:** `TG-SSRF-002-a79cf464`
+- **Location:** `examples/hardened-react-express/server/index.js:121`
+- **Confidence Score:** `65/100` (Medium Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Hardcoded internal loopback or cloud metadata endpoint target
+```
+});
+
+seed().then(() => app.listen(PORT, () => console.log(`Hardened demo http://localhost:${PORT}`)));
+```
+
+### [Critical] TG-SSRF-002 - Missing Internal Network Protection
+- **Finding ID:** `TG-SSRF-002-3c5a7c3c`
+- **Location:** `examples/vulnerable-react-express/client/src/App.jsx:42`
+- **Confidence Score:** `65/100` (Medium Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Hardcoded internal loopback or cloud metadata endpoint target
+```
+    <div style={{ maxWidth: 560, margin: '2rem auto', fontFamily: 'sans-serif' }}>
+      <h1>Vulnerable Demo</h1>
+      <p style={{ color: 'crimson' }}>Intentionally insecure — localhost lab only</p>
+
+      <form onSubmit={login}>
+```
+
+### [Critical] TG-SSRF-002 - Missing Internal Network Protection
+- **Finding ID:** `TG-SSRF-002-13c81e3a`
+- **Location:** `examples/vulnerable-react-express/client/src/config.js:5`
+- **Confidence Score:** `65/100` (Medium Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Hardcoded internal loopback or cloud metadata endpoint target
+```
+  apiUrl: import.meta.env.VITE_API_URL,
+  // FAKE DEMO ONLY — never put real database URLs in client code
+  demoDbUrl: 'postgresql://demo:FAKE_PASSWORD@localhost:5432/demo',
+};
+```
+
+### [Critical] TG-SSRF-002 - Missing Internal Network Protection
+- **Finding ID:** `TG-SSRF-002-b0f87c06`
+- **Location:** `examples/vulnerable-react-express/client/vite.config.js:10`
+- **Confidence Score:** `65/100` (Medium Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Hardcoded internal loopback or cloud metadata endpoint target
+```
+  server: {
+    port: 5173,
+    proxy: { '/api': 'http://localhost:3001' },
+  },
+});
+```
+
+### [Critical] TG-SSRF-002 - Missing Internal Network Protection
+- **Finding ID:** `TG-SSRF-002-ee77c629`
+- **Location:** `examples/vulnerable-react-express/server/index.js:82`
+- **Confidence Score:** `65/100` (Medium Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Hardcoded internal loopback or cloud metadata endpoint target
+```
+});
+
+app.listen(PORT, () => console.log(`Vulnerable demo server http://localhost:${PORT}`));
+```
+
+### [Critical] TG-SSRF-002 - Missing Internal Network Protection
+- **Finding ID:** `TG-SSRF-002-a0d1eac8`
+- **Location:** `skills/torusguard/payload/config/scope.json:4`
+- **Confidence Score:** `65/100` (Medium Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Hardcoded internal loopback or cloud metadata endpoint target
+```
+  "$schema": "../schemas/authorization.schema.json",
+  "authorization": {
+    "target": "localhost",
+    "owner_confirmed": false,
+    "scope_type": "source_code_only",
+```
+
+### [Critical] TG-SSRF-002 - Missing Internal Network Protection
+- **Finding ID:** `TG-SSRF-002-3ead2e3d`
+- **Location:** `skills/torusguard/payload/scripts/harden_runner.py:208`
+- **Confidence Score:** `65/100` (Medium Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Hardcoded internal loopback or cloud metadata endpoint target
+```
+            fix_explanation = "Replaced wildcard CORS configuration with strict origin whitelist environment variable"
+        elif "cors(" in target_line and ("origin: '*'" in target_line or 'origin: "*"' in target_line):
+            fixed_line = target_line.replace("origin: '*'", "origin: process.env.ALLOWED_ORIGIN || 'http://localhost:5173'")
+            fixed_line = fixed_line.replace('origin: "*"', "origin: process.env.ALLOWED_ORIGIN || 'http://localhost:5173'")
+            if fixed_line != target_line:
+```
+
+### [Critical] TG-SSRF-004 - Unbounded Outbound Request Without Timeout
+- **Finding ID:** `TG-SSRF-004-dcf3f71e`
+- **Location:** `examples/python/fastapi-hardened/main.py:30`
+- **Confidence Score:** `55/100` (Medium Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Python requests call without explicit timeout parameter
+```
+    if not is_safe_url(url):
+        raise HTTPException(status_code=400, detail="Invalid destination address")
+    response = requests.get(url, timeout=5)
+    return {"status": response.status_code, "content": response.text}
+
+```
+
+### [Critical] TG-SSRF-004 - Unbounded Outbound Request Without Timeout
+- **Finding ID:** `TG-SSRF-004-d8472223`
+- **Location:** `examples/python/fastapi-vuln/main.py:9`
+- **Confidence Score:** `55/100` (Medium Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Python requests call without explicit timeout parameter
+```
+@app.get("/fetch")
+def fetch_url(url: str):
+    response = requests.get(url)
+    return {"status": response.status_code, "content": response.text}
+
+```
+
+### [Critical] TG-SSRF-004 - Unbounded Outbound Request Without Timeout
+- **Finding ID:** `TG-SSRF-004-4ac97262`
+- **Location:** `skills/torusguard/payload/scripts/harden_runner.py:341`
+- **Confidence Score:** `55/100` (Medium Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Python requests call without explicit timeout parameter
+```
+                fix_explanation = "Wrapped outbound URL in validateSafeUrl domain whitelist guard"
+        elif "requests.get(" in target_line and "validate_url(" not in target_line:
+            fixed_line = re.sub(r'requests\.get\(\s*([^,\)]+)', r'requests.get(validate_safe_url(\1)', target_line)
+            if fixed_line != target_line:
+                new_lines[line_number - 1] = fixed_line
+```
+
+### [Critical] TG-GQL-004 - Unnecessary Production Introspection
+- **Finding ID:** `TG-GQL-004-a6ecb0bb`
+- **Location:** `skills/torusguard/payload/scripts/harden_runner.py:365`
+- **Confidence Score:** `55/100` (Medium Confidence)
+- **Cluster:** `cluster-graphql`
+- **Description:** GraphQL schema introspection enabled in configuration
+```
+    # Strategy 18: Production Introspection Disablement (TG-GQL-004)
+    elif rule_id == "TG-GQL-004":
+        if "introspection: true" in target_line or "introspection: True" in target_line:
+            fixed_line = re.sub(r'introspection\s*:\s*(?:true|True)', 'introspection: process.env.NODE_ENV !== "production"', target_line)
+            new_lines[line_number - 1] = fixed_line
+```
+
+### [High] TG-INPUT-003 - Unsafe Dynamic Code or HTML Execution
+- **Finding ID:** `TG-INPUT-003-fea9421e`
+- **Location:** `examples/vulnerable-react-express/client/src/App.jsx:53`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-injection`
+- **Description:** React dangerouslySetInnerHTML rendering raw unescaped HTML
+```
+
+      {/* TG-INPUT-003: Unsafe HTML rendering */}
+      <div dangerouslySetInnerHTML={{ __html: bio }} />
+
+      <button onClick={fetchUser}>Fetch user (IDOR demo)</button>
+```
+
+### [High] TG-PLATFORM-001 - Wildcard CORS With Credentials
+- **Finding ID:** `TG-PLATFORM-001-7dd35cb4`
+- **Location:** `examples/vulnerable-react-express/server/index.js:12`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Wildcard CORS origin configured in Express middleware
+```
+
+// TG-PLATFORM-001: Wildcard CORS with credentials
+app.use(cors({ origin: '*', credentials: true }));
+
+// TG-PLATFORM-004: No explicit JSON body size limit
+```
+
+### [High] TG-PLATFORM-001 - Wildcard CORS With Credentials
+- **Finding ID:** `TG-PLATFORM-001-1a813dde`
+- **Location:** `skills/torusguard/payload/scripts/harden_runner.py:202`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Wildcard CORS origin enabled across entire application
+```
+    # Strategy 5: Permissive CORS with Credentials (TG-PLATFORM-001)
+    elif rule_id == "TG-PLATFORM-001":
+        if "CORS_ALLOW_ALL_ORIGINS = True" in target_line:
+            replacement = f'{indent}CORS_ALLOWED_ORIGINS = [os.environ.get("ALLOWED_ORIGIN", "https://app.example.com")]'
+            new_lines[line_number - 1] = replacement
+```
+
+### [High] TG-AUTH-004 - Insecure Session Cookie Configuration
+- **Finding ID:** `TG-AUTH-004-f60870ef`
+- **Location:** `skills/torusguard/payload/scripts/rules_sync.py:180`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Decorator disabling route-level authentication or CSRF protection
+```
+
+    if not bypass_guards:
+        bypass_rule = "4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, `@csrf_exempt`, or `bypass_auth=True`."
+    else:
+        bypass_rule = f"4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, or {', '.join(bypass_guards[:2])}."
+```
+
+### [High] TG-AUTH-004 - Insecure Session Cookie Configuration
+- **Finding ID:** `TG-AUTH-004-6b0c7ebf`
+- **Location:** `skills/torusguard/payload/scripts/rules_sync.py:166`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Attribute disabling ASP.NET authentication
+```
+    if "c#" in stack_lower or "dotnet" in stack_lower:
+        sql_guards.append("EF Core LINQ / `FromSqlInterpolated`")
+        bypass_guards.append("`[AllowAnonymous]`")
+    if "php" in stack_lower:
+        sql_guards.append("PDO prepared statements / Eloquent")
+```
+
+### [High] TG-INPUT-001 - Missing Server-Side Request Validation
+- **Finding ID:** `TG-INPUT-001-c7457f38`
+- **Location:** `examples/vulnerable-react-express/server/index.js:27`
+- **Confidence Score:** `65/100` (Medium Confidence)
+- **Cluster:** `cluster-injection`
+- **Description:** Destructuring unvalidated req.body without schema validation
+```
+// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)
+app.post('/api/login', (req, res) => {
+  const { email, password } = req.body;
+  console.log('Login attempt:', { email, password }); // TG-SEC-004
+  const user = users.find((u) => u.email === email && u.password === password);
+```
+
+### [High] TG-RATE-001 - Unlimited Authentication Endpoint
+- **Finding ID:** `TG-RATE-001-dcd0a3c7`
+- **Location:** `examples/vulnerable-react-express/server/index.js:26`
+- **Confidence Score:** `65/100` (Medium Confidence)
+- **Cluster:** `cluster-rate-limiting`
+- **Description:** Authentication POST endpoint defined without rate-limiting middleware
+```
+// TG-SEC-004: Logs sensitive data
+// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)
+app.post('/api/login', (req, res) => {
+  const { email, password } = req.body;
+  console.log('Login attempt:', { email, password }); // TG-SEC-004
+```
+
+### [High] TG-AUTH-003 - Missing Object-Level Authorization (IDOR)
+- **Finding ID:** `TG-AUTH-003-6a05e509`
+- **Location:** `examples/hardened-react-express/server/index.js:49`
+- **Confidence Score:** `55/100` (Medium Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** JWT verification missing explicit algorithms restriction parameter
+```
+  if (!token) return res.status(401).json({ error: 'Unauthorized' });
+  try {
+    req.user = jwt.verify(token, process.env.JWT_SECRET);
+    next();
+  } catch {
+```
+
+### [Medium] TG-SEC-004 - Sensitive Information in Logs
+- **Finding ID:** `TG-SEC-004-dbbc17f7`
+- **Location:** `examples/vulnerable-react-express/client/src/App.jsx:30`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Plaintext credential or token logged to output sink
+```
+    const data = await res.json();
+    // TG-CLIENT-002: Sensitive console logging
+    console.log('Login token:', data.token, 'config:', clientConfig);
+    setMessage(JSON.stringify(data));
+  }
+```
+
+### [Medium] TG-SEC-004 - Sensitive Information in Logs
+- **Finding ID:** `TG-SEC-004-08753da5`
+- **Location:** `examples/vulnerable-react-express/server/index.js:28`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Plaintext credential or token logged to output sink
+```
+app.post('/api/login', (req, res) => {
+  const { email, password } = req.body;
+  console.log('Login attempt:', { email, password }); // TG-SEC-004
+  const user = users.find((u) => u.email === email && u.password === password);
+  if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration
+```
+
+### [Medium] TG-PLATFORM-002 - Missing Security Headers
+- **Finding ID:** `TG-PLATFORM-002-1f383dcf`
+- **Location:** `examples/hardened-react-express/server/index.js:17`
+- **Confidence Score:** `65/100` (Medium Confidence)
+- **Cluster:** `cluster-platform`
+- **Description:** Express application initialized without helmet security headers middleware
+```
+}
+
+const app = express();
+const PORT = 3001;
+const isProd = process.env.NODE_ENV === 'production';
+```
+
+### [Medium] TG-CLIENT-001 - Public Production Source Maps
+- **Finding ID:** `TG-CLIENT-001-1ba4789e`
+- **Location:** `examples/vulnerable-react-express/client/vite.config.js:7`
+- **Confidence Score:** `65/100` (Medium Confidence)
+- **Cluster:** `cluster-client-leak`
+- **Description:** Build config emitting unminified source maps in production output
+```
+export default defineConfig({
+  plugins: [react()],
+  build: { sourcemap: true },
+  server: {
+    port: 5173,
+```
+
+### [Medium] TG-RATE-002 - Unlimited Public Write Endpoint
+- **Finding ID:** `TG-RATE-002-d67d7c98`
+- **Location:** `examples/vulnerable-react-express/server/index.js:54`
+- **Confidence Score:** `65/100` (Medium Confidence)
+- **Cluster:** `cluster-rate-limiting`
+- **Description:** Public submission endpoint defined without rate-limiting or captcha defense
+```
+// TG-INPUT-001: No validation
+// TG-RATE-002: Unlimited contact endpoint
+app.post('/api/contact', (req, res) => {
+  res.json({ received: req.body });
+});
+```
+
+### [Medium] TG-PLATFORM-002 - Missing Security Headers
+- **Finding ID:** `TG-PLATFORM-002-eef342ec`
+- **Location:** `examples/vulnerable-react-express/server/index.js:5`
+- **Confidence Score:** `65/100` (Medium Confidence)
+- **Cluster:** `cluster-platform`
+- **Description:** Express application initialized without helmet security headers middleware
+```
+const jwt = require('jsonwebtoken');
+
+const app = express();
+const PORT = 3001;
+
+```
+
+### [Medium] TG-PLATFORM-003 - Production Stack Trace Exposure
+- **Finding ID:** `TG-PLATFORM-003-f5fce823`
+- **Location:** `skills/torusguard/payload/scripts/harden_runner.py:357`
+- **Confidence Score:** `55/100` (Medium Confidence)
+- **Cluster:** `cluster-platform`
+- **Description:** Django DEBUG mode enabled in configuration
+```
+    # Strategy 17: Production Debug Mode Disablement (TG-PLATFORM-003)
+    elif rule_id == "TG-PLATFORM-003":
+        if "DEBUG = True" in target_line:
+            fixed_line = f'{indent}DEBUG = os.environ.get("DJANGO_DEBUG", "False").lower() in ("true", "1")'
+            new_lines[line_number - 1] = fixed_line
+```

package/.torusguard/runs/run-20260912-214110-audit/manifest.json

@@ -0,0 +1,12 @@
+{
+  "run_id": "run-20260912-214110-audit",
+  "command": "audit",
+  "target_name": "TorusGuard",
+  "created_at": "2026-09-12 21:41:10 IST",
+  "created_at_iso": "2026-09-12T21:41:10.189853+05:30",
+  "status": "completed",
+  "torusguard_version": "1.3.0",
+  "findings_count": 38,
+  "confirmed_fixed_count": 0,
+  "regressed_count": 0
+}

package/.torusguard/runs/run-20260912-214110-audit/summary.md

@@ -0,0 +1,5 @@
+# TorusGuard Audit Summary: run-20260912-214110-audit
+- Scanned Scope: C:\Users\Admin\Desktop\TorusGuard
+- Total Findings: 38
+- Root-Cause Clusters: 9
+- Generated: 2026-09-12 21:41:10 IST