torusguard 1.3.4 → 1.3.5

package/.torusguard/.manifest.json

@@ -1,6 +1,7 @@
 {
   "ARCHITECTURE.md": "cdc690a856e82574a6574ab6b1ad8a2d8b3b8264c36931c6212321066eed82e4",
   "TORUSGUARD.md": "c980b0ddd3778d5981f6c16c64015c60dc713b6f151fc531bc5681ecd770fb50",
+  "rules_catalog.json": "e0b32c1bdde0f19fa390aba26a02b7e5ba1b59b251f9fffd501815b48f2d9af9",
   "agents/auditor.md": "4ba2c92982823d0886c7ae369126cd5ddd322085a85d3b7e7fa23154f8753314",
   "agents/profiler.md": "0ee9ebbddf4ebd557d454dda8472fffea471e263abeccf40298163084b7ce9a9",
   "agents/remediator.md": "f708a0e315760e8d519bd640d22bdf6b7ec61ed7de3da69bd038bd60dc3d5b47",
@@ -92,43 +93,43 @@
   "rules/authorization/TG-AUTH-006-mass-assignment.md": "9544e6df5d7420eb4dce4fbddd63f21103d82d91fedaedcfe041943b18452472",
   "rules/authorization/TG-AUTH-007-missing-property-level-authorization.md": "5a1afe03c03d8d3fe7ce952ead8ab011c1c209d029361ce183bf8091216914d0",
   "rules/authorization/TG-AUTH-008-untrusted-role-header-injection.md": "74cac648fd6c6b49523be499ecf878240b9ea58d1086c1b84c17532d4ba4ee49",
-  "rules/business-logic/TG-BIZ-001-client-controlled-sensitive-business-value.md": "4e837ee5cb053db5ead273bb2e5d934f870ece007c41913362e3138f17b6bcf8",
-  "rules/business-logic/TG-BIZ-002-replayable-one-time-operation.md": "906133df5a576d77515e20a2523f58452dbd22fccdfc4193ebb487298d42b0eb",
-  "rules/business-logic/TG-BIZ-003-missing-workflow-state-validation.md": "86f180dc7ed54665aef7b9077ad991bbb969e01371972dfa89c0f5353571d20c",
-  "rules/business-logic/TG-BIZ-004-unrestricted-sensitive-business-flow.md": "946950e4779b04cd57fd046a162d61bc33b302ccd29db97361d3e3a70b34a177",
-  "rules/cache/TG-CACHE-001-sensitive-response-publicly-cacheable.md": "8f0789c6851dc560e15f26f1f7d26d3670e7212fa7f5bc7e1c09bd09ef1b8edf",
-  "rules/cache/TG-CACHE-002-missing-user-cache-isolation.md": "cf29c883b880e4afdeebb0d74fd9b1622c6a395fd8486e142f175b90ee948874",
-  "rules/cache/TG-CACHE-003-sensitive-data-in-url.md": "c15a8eebfe32716ede037dc594dd01800e341f4b6f3b056d6f76a9a9af57ffb9",
-  "rules/csrf/TG-CSRF-001-missing-csrf-protection.md": "322f2f1bd964426823f1adb7dc20085d1d95aeef557b8d9f74e24d457dd885f6",
-  "rules/csrf/TG-CSRF-002-unsafe-credentialed-cross-origin-request.md": "43ee1934cc01ed2378b73e587efac8e357b4089dfbef23a57ba9ebe633816157",
+  "rules/business-logic/TG-BIZ-001-client-controlled-sensitive-business-value.md": "e86c4f9c9d791f8eeea2464fdaf280bfb6a03bd3704e4a5c04725206ed117fd3",
+  "rules/business-logic/TG-BIZ-002-replayable-one-time-operation.md": "fc30c85ba39ff14f701958c50aba5fc8fe381944dd8a0beecbb1692797fc7fb7",
+  "rules/business-logic/TG-BIZ-003-missing-workflow-state-validation.md": "120d8cb59423b01b887a2f6d96f52a485fe9463ee48d77f7d05d9cd7ec4d69b4",
+  "rules/business-logic/TG-BIZ-004-unrestricted-sensitive-business-flow.md": "ccd82baec26c015079d78c9c70fc5cca35dcbc6dc973a860b23d7392708e6e79",
+  "rules/cache/TG-CACHE-001-sensitive-response-publicly-cacheable.md": "e84d9d314b1616bdda54345fdf0203732e68e375dc7e144d9e2aa7619f9cafb8",
+  "rules/cache/TG-CACHE-002-missing-user-cache-isolation.md": "4e305be49dd14a34d29c9283b535a72ad6cd84c5bd52afb3f006403f2e5a6850",
+  "rules/cache/TG-CACHE-003-sensitive-data-in-url.md": "235f3eed546b58aa8f04e155aeaef4e0206dd696517a7854983ab9ce8fe61030",
+  "rules/csrf/TG-CSRF-001-missing-csrf-protection.md": "42fcf19ae244a36b3b64d03200b6d4c1acf1b265fdb2fe6a85de8dd69b3837fe",
+  "rules/csrf/TG-CSRF-002-unsafe-credentialed-cross-origin-request.md": "c01a55e31e4aaaea8c9f630b514c1ad242b513ab99111534939584ae4fe1a58c",
   "rules/custom/README.md": "f2128661ad3bc4085a69ddfbabbb2211930215fc42a25e2ab2d3e7a4b749a639",
   "rules/edge/TG-EDGE-001-serverless-global-state-leak.md": "82fe764a67228c71359b340a983cb37dc8bf4521d030846e0cea433de43c52d3",
   "rules/edge/TG-EDGE-003-aws-lambda-ephemeral-cold-start.md": "2659db7d38b6689d1d3a99ad5f2504ea264b3d3a601ab38186737b12d4d42c17",
   "rules/graphql/TG-GQL-001-missing-query-depth-or-complexity-limits.md": "bfee2cb26c71871cc4b93e224dc56c18de0d0ea692a431f7b27a51e7e408873f",
-  "rules/graphql/TG-GQL-002-resolver-missing-authorization.md": "81859a712d482ded016507c7a67e16358a6a29a3c9a9dc04495c907e155a0589",
-  "rules/graphql/TG-GQL-003-unbounded-graphql-pagination-or-batching.md": "b6c3b95ed97b704d4fc43155f1cd3cd844d69f0040cdcad9e1051dbd055f3ca9",
-  "rules/graphql/TG-GQL-004-unnecessary-production-introspection.md": "034fb574fe79346f1c859ff143e4ab70110fff2950a3900fac324f490a837888",
-  "rules/secrets/TG-SEC-005-secret-in-git-history.md": "22ba761d8375aa249bd6a8284de1dce9c7aeda0f26b8fa20d660eb46d09ec711",
-  "rules/secrets/TG-SEC-006-secret-in-build-artifact.md": "7130799c3218ae953a1673bdbb6b7afddfcbf6d0a95500ea558334915b9a0199",
-  "rules/secrets/TG-SEC-007-secret-in-test-or-example-fixture.md": "558092260732217666d3fcbce6cce57856f082e5fcc77eb34d19cb29e666ac2c",
+  "rules/graphql/TG-GQL-002-resolver-missing-authorization.md": "e6429fdcf130478446a2711eac83bd64cc502aad8baa35c04de26958d23e5b0f",
+  "rules/graphql/TG-GQL-003-unbounded-graphql-pagination-or-batching.md": "c2e2beb37c4d86f4ba564e1a1fd9587626df3793b9c5dc9e13d0cf0ce3bfe09a",
+  "rules/graphql/TG-GQL-004-unnecessary-production-introspection.md": "54311588945abc1d79e99a0001390821ccb4434772297b2395e7081d276d6602",
+  "rules/secrets/TG-SEC-005-secret-in-git-history.md": "089dbe9653b2a4df652ba049b40147434d6abc70c239ac7db81bdcb9d6579387",
+  "rules/secrets/TG-SEC-006-secret-in-build-artifact.md": "ed20b1c9044149df5257ad8140bd787db7f77063b890dad9ba32efaf4d554fe5",
+  "rules/secrets/TG-SEC-007-secret-in-test-or-example-fixture.md": "b3d4b9f1d0fd9656aa9a586e133209904c1f3b75a2b7e7c1ecb825a125663e6d",
   "rules/ssrf/TG-SSRF-001-user-controlled-server-side-url-fetch.md": "d6a9bee4b60c1f2a02f83dfc59c71e4aefb2284431cead83703d2882ba8813e1",
-  "rules/ssrf/TG-SSRF-002-missing-internal-network-protection.md": "a421a1f85e6dffe11cfa570deb976213bf044f69ec5061dae1a7f3e6b0893759",
-  "rules/ssrf/TG-SSRF-003-unsafe-redirect-following.md": "b6c43733600a6b1849cae64f16ca4eb2d16bd440a6a8c890ff8ad25e38fec292",
-  "rules/ssrf/TG-SSRF-004-unbounded-outbound-request.md": "be3fd4f403605cf75d8f27448f2b305fd7ff327e6626091c13af14434971589c",
-  "rules/supply-chain/TG-SUPPLY-001-missing-or-ignored-dependency-lockfile.md": "f19b10647789c7fa57eccbb5b220f925195cee391f2f1253258322f113855f23",
+  "rules/ssrf/TG-SSRF-002-missing-internal-network-protection.md": "6cc87c5be9de739f291d724cec9e2897b7c4abb48bf938cafe824ec29634c878",
+  "rules/ssrf/TG-SSRF-003-unsafe-redirect-following.md": "1f0e92b6783f1ab10310f98bea64df6fec82bd61b311828787e273e2db9878fa",
+  "rules/ssrf/TG-SSRF-004-unbounded-outbound-request.md": "24fbbb0b5d57a1399397e25849bb25b307f9f03c66c34d67bffe9bdc675c4aeb",
+  "rules/supply-chain/TG-SUPPLY-001-missing-or-ignored-dependency-lockfile.md": "30ceac40228e8777491d3f5613f7660e75f186a07256be7af1c6bc1576f17f3d",
   "rules/supply-chain/TG-SUPPLY-002-vulnerable-dependency-review-missing.md": "f80f2717fdba26e1520bb40276edb6d88835eb8c307e170ff8ab9572187f338f",
-  "rules/supply-chain/TG-SUPPLY-003-unsafe-ci-cd-secret-exposure.md": "73eadb6a87ae7f7a66f04be03622720ce6ec9389fdce1b1844047088daf8a389",
-  "rules/supply-chain/TG-SUPPLY-004-unpinned-ci-action.md": "492d50e5bddcf3cfb82f1e44baefe4afd1311728cd77aa7bb89f721808ddb4ba",
-  "rules/supply-chain/TG-SUPPLY-005-unsafe-dependency-install-script.md": "5960008c0182c2e809089975ecec6ac4f2caa393953abe4d223cce4b2274a8b8",
+  "rules/supply-chain/TG-SUPPLY-003-unsafe-ci-cd-secret-exposure.md": "43add6a6a01e8a1f206d67678906bb21349889453b148247694dfd53e8aa6b93",
+  "rules/supply-chain/TG-SUPPLY-004-unpinned-ci-action.md": "d8f4ea71de97a6455c84734c94805d520a6666fa0460a3dd63780c7fd4618052",
+  "rules/supply-chain/TG-SUPPLY-005-unsafe-dependency-install-script.md": "20657c6ad29b1ad046fbab5523fbf809f37598898415b2dfbf76f55826578305",
   "rules/supply-chain/TG-SUPPLY-006-container-build-secret-persistence.md": "eaadfc37364f150aa08212afd9a629bb084bdd705c6663534b6ea6c74f383053",
-  "rules/webhook/TG-WEBHOOK-001-missing-webhook-signature-verification.md": "3d2f4de4683ac18f4fdfea3e191fe7bdb305c845c76343ab05205d9f3ea3ee73",
-  "rules/webhook/TG-WEBHOOK-002-replayable-webhook.md": "e5f26c0874b5d0974b8aa55c664281a6643b08f87ad1c28cfcaebbb58172956c",
-  "rules/webhook/TG-WEBHOOK-003-missing-webhook-idempotency.md": "bc5cc14d0112260b60120c2d5b0d670477884a0cddbe608408318f006534028d",
-  "rules/webhook/TG-WEBHOOK-004-unvalidated-webhook-event-type.md": "5a5d0eacbaa803e499b05cb59506eaaa8a7b311666c6db4ce1490ae227132102",
+  "rules/webhook/TG-WEBHOOK-001-missing-webhook-signature-verification.md": "4d4e516a0765c4b9d26c675374ea5fe73319a3883555dc368ef2633d67499e6a",
+  "rules/webhook/TG-WEBHOOK-002-replayable-webhook.md": "9d0dad0f993bfc4b3aaf035bb5b1fb362c3e6556168ef63e2b7053f288dbf8a6",
+  "rules/webhook/TG-WEBHOOK-003-missing-webhook-idempotency.md": "6a9b2346379ee37b73079a8ed67c9cbae8ba2b1f8c6b862eeb76a9d1a8d465c9",
+  "rules/webhook/TG-WEBHOOK-004-unvalidated-webhook-event-type.md": "676dc47739de188ef44315be88745dd23c0b72fbed90b461b7865aadba1ff8dd",
   "rules/websocket/TG-WS-001-unauthenticated-websocket-handshake.md": "b700f08ae47d12f9ed014905c04a4542fcb1bdc34064fb8eb01168f92f5752ae",
-  "rules/websocket/TG-WS-002-missing-channel-level-authorization.md": "32bb0234600ee1712bdbe9190fcf2b5f2ca43987e266fd130e4bd4444bed9712",
-  "rules/websocket/TG-WS-003-unvalidated-websocket-message.md": "b801bd9131b63df2e36132a47a15d1f38c6786bdb696fad5c70059d8d419153c",
-  "rules/websocket/TG-WS-004-unbounded-websocket-connections.md": "5ffa620c039192ade9e44dba83ebba2325f71676767950ea53c620ccfc86a1ad",
+  "rules/websocket/TG-WS-002-missing-channel-level-authorization.md": "7a6a4be54c8fad3575bfa1bef02960285ec304f0021bdb22c586e238ad026c0d",
+  "rules/websocket/TG-WS-003-unvalidated-websocket-message.md": "f593e1f7fa3678150f1fcfa368c6f3b741cd236de19f15cb340bb906e12ba9ce",
+  "rules/websocket/TG-WS-004-unbounded-websocket-connections.md": "e700a0fddd7febf8c520bf0e5c5d4c3a2fb1d29d46dabaeb7bf982b95404e0c1",
   "schemas/authorization.schema.json": "84885c9edc930a22c777d8685219f1f25b5320c0c6062722e3ba09f1fe417ad4",
   "schemas/confidence.schema.json": "09c5098f55f3936e9231ba417ace4fa7aa9ebc49233b4bfa88a4103ef6f1202c",
   "schemas/evidence.schema.json": "7dff029c34965e9aeee932028d11bf30d4f3ff76f8137af382bf3d3dc2c0df10",
@@ -141,23 +142,25 @@
   "schemas/remediation.schema.json": "544904239f871dec9552973e01e09dc1f40dbb8330f20d98c319f3b24031d630",
   "schemas/retest.schema.json": "97c0407ca4365a524020c430912f686f698cc0de90043194621071e9fc681cc7",
   "schemas/runtime-evidence.schema.json": "929d2b094c1cd1f7f9db07be1eba5994e8002477eab3fd24140e1e973fd18cc1",
-  "scripts/apply_runner.py": "2218a02538e821d88bb95211ae907705bea9b0533e43504912d5e3655f69de0c",
-  "scripts/audit_runner.py": "71553ca6c2d57df6f7323d41abc0216ecedb821fcf0eb5fd502290bd6dec6ae4",
+  "scripts/apply_runner.py": "3863c894d0a57f4a71206dca802b26755f361958f085b4636f112350bde221a2",
+  "scripts/audit_runner.py": "bdf4784ebec526a6f980879ce80aa7693ad2a8268fd4fa0334130ac3c1a7b22a",
   "scripts/diff_guard.py": "0dc178cdde1ac0ae1a1ea4b2eb2ce1756b2126f6156909cf55d85249f115fcbd",
-  "scripts/finding_scorer.py": "885c7cbb7a8def2ceda0266e5a7f893938e41debc7501f7400a17a606b22dc23",
-  "scripts/harden_runner.py": "cf813ec241db73de94fe76d4929dcfc6dd7826e50c84986c50fa28175717ed93",
-  "scripts/html_reporter.py": "f2bc401e9dfebda2c0e078897247210b2c8b83cba24add00e618821f9cae9eda",
+  "scripts/finding_scorer.py": "a5315be6ee256c01c4539da3d1905ebc8d0840a356b83c55f9f6f2654a9f0c60",
+  "scripts/harden_runner.py": "c7a8074eaa9f6ebe61a17c553fd07bb543efcb1d5b4e01f24fd856367c048a70",
+  "scripts/html_reporter.py": "30982f279b501834009159d7142624c973f36f2517b884a0ce4868d7ca42d1f3",
   "scripts/manifest_builder.py": "c0137927789a9e40a08243e630ac3c6990beb1b87807934e98906c8ad0b99a97",
   "scripts/memory_engine.py": "b715d0ca030e95eb06ad6eda99027535df8a7e37d64897c023be6a291cf13dc6",
   "scripts/monorepo_detector.py": "5603674136a5294ebfff89efeca0a546dd4a7deb1d184a2592ff21aff2131f73",
-  "scripts/recheck_runner.py": "bb381717a93db07fc899c98e43b1587d1d2ce6ebb1c1bd8e37d460eac7f4ab19",
-  "scripts/recipes_runner.py": "7f6dc401c4b39b2e804b4db457caed04a11022b43c90651408fd26675bef1b3b",
+  "scripts/recheck_runner.py": "0c51d91b37bd3babf228b4b12b0e9d65953c8eae2e2e46596a1d42af8d057f71",
+  "scripts/recipes_runner.py": "cd9ffba5fed53057aac56241dcbfda1e68248f323e51bbde3fe711634b099600",
+  "scripts/report_sync.py": "278666954207a9eef1d479872546b99c16a8ded46bd3238ac9a09e2856b69813",
   "scripts/rules_sync.py": "4101b2ca8036ff4f468800b32a8d08898e8640a74d14124af53d454706a62d3a",
   "scripts/run_manager.py": "b738ff70879e46547d32fac6befc61de9599f676411384280fb9819ea3ad7035",
   "scripts/safety_gate.py": "3379b7534b2590cf563717a448983ad8ed7e8f174f0ad65683d33e8a10f51558",
-  "scripts/sarif_exporter.py": "35c66637413afc4b72d5bd426638447c77231d2a8594dce5addceffd4803a20d",
-  "scripts/stack_detect.py": "7848006e3cd6e828f7dbe189a8c9728abd58e021ff02efbc4230ef8ca3444596",
-  "skills/torusguard/SKILL.md": "4b5cb127bea1f7e78e3452637c3e13117f8ece46de65ec791f2de3ef750e5bd5",
+  "scripts/sarif_exporter.py": "f060cfaf91dfb6b8e9c4036e354704204dfa8054720501f0ce2fadae0fb89540",
+  "scripts/stack_detect.py": "3f755d9353d5a8fd33a25486d6af0101a1d1b0c2f70f5a28bb2af2fe6050adc2",
+  "scripts/term_ui.py": "4870714add208f3da53c76a1250b1ceb8c104c0b708384e73427210dd0b50e6a",
+  "skills/torusguard/SKILL.md": "856f4b615a508a2864ffbd75d8bb5de713219249c6fdd1c47080fa6517eee60c",
   "skills/torusguard/bootstrap.py": "3d946f388cb4befa739c9d3b1404255d9a8ea5770ebbb79e5a1b9839589e9bc7",
   "skills/torusguard/references/auth-and-sessions.md": "c3e4b9600cb53fc28c993922dc880accbec5783ac90d5ee98d63b52762d19525",
   "skills/torusguard/references/business-logic-and-abuse.md": "58e87df2864d468af70c1ff39f5d540c687fa846b671457f85046ab2065fe99c",
@@ -187,32 +190,32 @@
   "skills/torusguard/references/ssrf-and-outbound-requests.md": "5ce59ebada2f227b3e0a27f612b59a47801c152d24d2d4d533bee435f32b1b05",
   "skills/torusguard/references/webhook-security.md": "8fd27cce1562a3dfda8d4fae29bef7cfd47a65c1e89c6868cdbcac161ccd2be8",
   "skills/torusguard/references/websocket-security.md": "b5315e49432184c006664436d689d426b7322fc6fbbba2899a9ea5e5bab74c92",
-  "skills/torusguard-apply/SKILL.md": "09ddf90b436eae0fd54264dbf3c34f564a4481ec4806e2dcf311bfee5ce44d6b",
-  "skills/torusguard-audit/SKILL.md": "f879e280d357ea7f124c647ce39af2b24b79db608c9edd018f26e5312625a8b5",
-  "skills/torusguard-authorize/SKILL.md": "689729cfebbf6880869ef4ab1b43657f35c873a782f87a03f26727550f7964d4",
-  "skills/torusguard-exploit-check/SKILL.md": "c674040a917d95190e198b5fe386a0f08b00424e2037b814a133fa8bf1449f73",
-  "skills/torusguard-full/SKILL.md": "f7da4dbd708b31710bddeb5a1f30e1273b134fee1daae89399a17b596ff0128b",
-  "skills/torusguard-harden/SKILL.md": "326fa84bda4832f96b19d73824c3472dfe185247ed3e3db9715dd943d46d9874",
-  "skills/torusguard-init/SKILL.md": "534a1a4aff2510dbf7924fe74d7d338ed352f757a23b1c5427b9f758019cd911",
-  "skills/torusguard-recheck/SKILL.md": "457b2a1cce064a738fbe43f0dba6b4393f1630a82f60698ea5ebe655ec017e50",
-  "skills/torusguard-report/SKILL.md": "f6f6de3a8b56c4538d02307c5afaf99c508561140cccfe8ea16c2ae87768b64d",
-  "skills/torusguard-status/SKILL.md": "23afc632b70b80304952e2559a109d5877f97a048039a818a65b378dc604e19e",
-  "skills/torusguard-verify/SKILL.md": "842ca8ca3ad194886605a7fafb98d4309cba695b86a627b24206b5b139eef5c6",
-  "skills/torusguard-web-validate/SKILL.md": "b3cd9952601cfe89dbe98765bd61be22b434e5aaf5700751348591919e595ad4",
+  "skills/torusguard-apply/SKILL.md": "77d79ef7e0f13c13cf2bf547c799c36bf17463f2ffdd44de4d7943bb7dd1ec38",
+  "skills/torusguard-audit/SKILL.md": "d2aa109d8e259c3280224cdc6ad7ef6478d760f8bad86752dc06884e86a1ba9c",
+  "skills/torusguard-authorize/SKILL.md": "1b66217657be61faa34af0c76481525cf9f4ed60d56de80089c1c19e6c354b0d",
+  "skills/torusguard-exploit-check/SKILL.md": "093e9b6eba7cf1b5d46c2c56eb6623600098bb67044febf6be2b10442b3934c2",
+  "skills/torusguard-full/SKILL.md": "630fbe832d3669c34a468c9a76ae6470272c400fdafea3ceace7954e120f3b45",
+  "skills/torusguard-harden/SKILL.md": "17ba802bb8857ec27e6ee5d3b2949a6cca7d0c152ec0c1db6d56a8903288bb57",
+  "skills/torusguard-init/SKILL.md": "1605503074181534e7c9925719bb832e8c47264b1ea40d2f9c77d627d3fe0326",
+  "skills/torusguard-recheck/SKILL.md": "1a4a657801a8ba4202d1411a4a016af20811648e238ef6a909e0866e62391cb6",
+  "skills/torusguard-report/SKILL.md": "86cb2bec41dff274d349adf42320b60bb29afaa26da900c9c5c779a2417ab725",
+  "skills/torusguard-status/SKILL.md": "751a8b7074d3464feceed71781f0eacb63d3bd70e354144802a243ba32dac526",
+  "skills/torusguard-verify/SKILL.md": "a1b408524fc125373b5a562ff335bfcf96de4cfc01d251a738f7ce8289bd2874",
+  "skills/torusguard-web-validate/SKILL.md": "0b77fdf6ccff3a5631c3951779740943fb48b22ba62e536d406ae999a473c1d1",
   "templates/audit-report.template.md": "71149dd05b01a74287a47781fdc71fd2d1b4b70337da303bf78767d0410a6c90",
   "templates/authorization.template.md": "81ef843d42a19412c369f383b787465ac24173c0b14c1f5f211786eab3d10e8b",
   "templates/finding-card.template.md": "8f756edbd3e4139d3da2fb96f35bd2d2b267b33b754f187b590a89584265c1e6",
   "templates/remediation-bundle.template.md": "4d85a540e3a2e74f9b21fc8a2a1072e27ca03e97cd67ca482f529cfe722acc4d",
-  "workflows/apply.md": "dc66ef6c59ecf1996d45921ac83ba5dd2503a9f3624c8e6f24568745a072b871",
-  "workflows/audit.md": "969df4767b311f6468fb10ad4c98c302feb7112bafa86c14c59c8b9f5d481c89",
-  "workflows/authorize.md": "1ac2e3adb367a04bd20b2b6a062f6a65703e4aa6a815fe0affc0697faa433588",
-  "workflows/exploit-check.md": "67073930ea86219a4efd54dac4206dfc37775a660ff1b6960ed2bfea0528b4a0",
-  "workflows/harden.md": "56d7f8098f19c34bc581a49b5e4bacc42858606ebf1cc35c848bdfaca8744409",
-  "workflows/init.md": "d1e6ae9a98c30b2c3b46081c8195f524bcd8d3bc9004562d230b56c704fec02b",
-  "workflows/memory.md": "c034f9266380db3c05e9ffed943c2bb4ba73c060507e3508e47b543a035a5873",
-  "workflows/recheck.md": "106442712bfb87c6c1c9bc0ed660c6c291d4d6a0a6b860f4f93397440dba08d5",
-  "workflows/report.md": "35c7cc44d94ee49d8fea6b75ae7ea524790fd0e6208b5f27b84bc4fdab469b0c",
-  "workflows/status.md": "a14a92b8b4c30fdf9e9c073c51de4d0057f43519df03e9661117e62e65ac1d08",
-  "workflows/verify.md": "f96e8db92f067395d82f7ef8fd32c7c00e6c41ea1731347aadba2fbaed118cdf",
-  "workflows/web-validate.md": "5ef05154671582d95b2d05358f0a4f7ea52fe6ff3d3f238b732b3490925bc7f7"
+  "workflows/apply.md": "fde7e879db5879bc6c8e67b5bd40473065688bba91149a01f66ad4739f4c8443",
+  "workflows/audit.md": "b02a7d2536c81b35ab4519b7f9eda3396d08f09da581ef299dc8fed83b4c082d",
+  "workflows/authorize.md": "71b14c2ffa24b1ad511d019a7da86854bf1bf94c282f563e05e9ad3b8493e8ca",
+  "workflows/exploit-check.md": "01c0a51e4b12a9dbb1d4f2b28d0bb495d92f95b786f5f1df59467b8fc6c61855",
+  "workflows/harden.md": "e68a78c47a2c4ec1d65adb08104d2fa16eb0c4530cf9b78400fd147f2076fb95",
+  "workflows/init.md": "f71438745a7e8d59dcf2e1089f7c5ccf2340e7909e56e1257b24c8ca79353162",
+  "workflows/memory.md": "faf93f39917fb6d0da23f9794e8337e643fd0a240cc46ca702fef84e02f5b867",
+  "workflows/recheck.md": "426a719a9c4233a653daa8fe0265370492f3a17a422517f7930549c991d25c93",
+  "workflows/report.md": "2aad2cbf2ffc781355e1186bb28a29b3da5efbacc57c8f44c9976aa635f0b120",
+  "workflows/status.md": "f3445bbf90402df819472180d5ae251a17b4f491ea3402d74f134bf55c2bf570",
+  "workflows/verify.md": "48f37892d329287059492ffaebf7022253fd5515a0a1a3253799e5cea765a21a",
+  "workflows/web-validate.md": "4d81294432e4d06e6c21db9a517b7cf1052744df3d821ed947a7751acb4fe39f"
 }

package/.torusguard/rules/business-logic/TG-BIZ-001-client-controlled-sensitive-business-value.md

@@ -1,37 +1,53 @@
 # TG-BIZ-001: Client-Controlled Sensitive Business Value
 
 ## Severity
-High by default. Raise to Critical when applicable.
+Critical. Relying on client-submitted values for critical financial, authorization, or pricing attributes allows malicious users to manipulate monetary amounts, discounts, or permissions.
 
 ## Applies To
-- Relevant endpoints and services
+- E-Commerce Checkout, Payment Handlers, Subscription APIs
+- Node.js (Express, NestJS, Next.js), Python (FastAPI, Django, Flask), Go, Java, C#
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+When client requests directly dictate sensitive pricing or balance fields (such as `amount`, `unit_price`, `discount_percent`, or `credit_balance`), attackers can tamper with request payloads to purchase items at arbitrary prices ($0.01) or grant themselves unearned credits.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- Destructuring sensitive price or discount attributes directly from `req.body` or `request.data` into payment gateways or order creation queries.
+- Absence of server-side database lookup for product prices prior to charge generation.
 
 ## Unsafe Example
 ```javascript
-// Unsafe code example
+// UNSAFE: Directly trusting price and amount from client payload
+app.post('/api/checkout', async (req, res) => {
+  const { productId, price, quantity } = req.body;
+  const total = price * quantity; // Attacker sends price: 0.01
+  await paymentGateway.charge({ amount: total });
+});
 ```
 
 ## Safe Example
 ```javascript
-// Safe code example
+// SAFE: Fetching canonical price from authoritative server database
+app.post('/api/checkout', async (req, res) => {
+  const { productId, quantity } = req.body;
+  const product = await db.product.findUnique({ where: { id: productId } });
+  if (!product) return res.status(404).json({ error: 'Product not found' });
+  const total = product.price * quantity;
+  await paymentGateway.charge({ amount: total });
+});
 ```
 
+## Ponytail Remediation Budget
+- Additions: <= 12 lines
+- Deletions: <= 4 lines
+
 ## Remediation
-1. Step one
-2. Step two
+1. Remove sensitive pricing and discount parameters from incoming client request schemas.
+2. Query the authoritative server database or catalog for the verified unit price.
+3. Calculate subtotal, taxes, and final charge amounts exclusively on the trusted server.
 
 ## Verification
-- Test case 1
-- Test case 2
-
-## False Positives and Exceptions
-An exception requires documented review.
+- Submit a checkout payload with `price: 0.01` and verify the server rejects or ignores the parameter and bills the canonical catalog price.
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-INPUT-001`: Missing Request Body Validation Schema
+- `TG-BIZ-004`: Unrestricted Sensitive Business Workflow

package/.torusguard/rules/business-logic/TG-BIZ-002-replayable-one-time-operation.md

@@ -1,37 +1,54 @@
 # TG-BIZ-002: Replayable One-Time Operation
 
 ## Severity
-High by default. Raise to Critical when applicable.
+High. Lack of idempotent tokens, nonces, or single-use consumption flags allows attackers or network retries to execute financial charges, coupon redemptions, or password resets multiple times.
 
 ## Applies To
-- Relevant endpoints and services
+- Coupon Redemptions, Financial Transfers, Voucher APIs, Password Reset Consumptions
+- Node.js, Python, Go, Java, C#
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+Transient network glitches, automated retry loops, or intentional race condition attacks (TOCTOU) can submit duplicate requests. Without single-use atomic locking, a user can redeem a $50 gift card 10 times concurrently.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- State-changing transaction handlers lacking idempotency keys, single-use nonce validation, or atomic database lock transactions (`SELECT ... FOR UPDATE`).
 
 ## Unsafe Example
-```javascript
-// Unsafe code example
+```python
+# UNSAFE: Checking balance and deducting without atomic idempotency lock
+@app.post("/api/redeem-coupon")
+def redeem_coupon(code: str, user_id: str):
+    coupon = db.query(Coupon).filter_by(code=code, used=False).first()
+    if coupon:
+        apply_credit(user_id, coupon.amount)
+        coupon.used = True
+        db.commit()
 ```
 
 ## Safe Example
-```javascript
-// Safe code example
+```python
+# SAFE: Atomic database update with idempotency check
+@app.post("/api/redeem-coupon")
+def redeem_coupon(code: str, user_id: str, idempotency_key: str):
+    with db.begin():
+        rows = db.query(Coupon).filter_by(code=code, used=False).update({"used": True})
+        if rows == 0:
+            raise HTTPException(status_code=400, detail="Coupon already redeemed")
+        apply_credit(user_id, coupon.amount)
 ```
 
+## Ponytail Remediation Budget
+- Additions: <= 14 lines
+- Deletions: <= 5 lines
+
 ## Remediation
-1. Step one
-2. Step two
+1. Require an `Idempotency-Key` header on all sensitive mutations.
+2. Execute state-changing consumption operations inside atomic database transactions with row-level locks.
+3. Mark vouchers or tokens as `consumed` in the same atomic operation before dispatching external side-effects.
 
 ## Verification
-- Test case 1
-- Test case 2
-
-## False Positives and Exceptions
-An exception requires documented review.
+- Send 5 concurrent identical redemption requests with the same coupon code; assert exactly 1 succeeds (200 OK) and 4 fail (400/409 Conflict).
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-WEBHOOK-003`: Missing Webhook Idempotency
+- `TG-BIZ-003`: Missing Workflow State Validation

package/.torusguard/rules/business-logic/TG-BIZ-003-missing-workflow-state-validation.md

@@ -1,37 +1,53 @@
-# TG-BIZ-003: Missing Workflow-State Validation
+# TG-BIZ-003: Missing Workflow State Validation
 
 ## Severity
-High by default. Raise to Critical when applicable.
+High. Skipping validation of intermediate business lifecycle states allows users to bypass mandatory verification, payment, or approval steps.
 
 ## Applies To
-- Relevant endpoints and services
+- Order Processing, Multi-Step Onboarding, Approval Pipelines, KYC Verification
+- Node.js, Python, Go, Java, C#
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+When endpoints assume prerequisite stages were completed without strictly querying the current entity state, malicious actors can invoke late-stage endpoints directly (e.g. calling `/api/orders/{id}/fulfill` on an order whose state is `PENDING_PAYMENT`).
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- State transitions (`status = 'SHIPPED'`, `status = 'APPROVED'`) executed without asserting that current status matches required prior state (`where: { status: 'PAID' }`).
 
 ## Unsafe Example
 ```javascript
-// Unsafe code example
+// UNSAFE: Transitioning order to fulfilled without checking current status
+app.post('/api/orders/:id/fulfill', async (req, res) => {
+  await db.order.update({
+    where: { id: req.params.id },
+    data: { status: 'FULFILLED' }
+  });
+});
 ```
 
 ## Safe Example
 ```javascript
-// Safe code example
+// SAFE: Atomic conditional transition verifying prerequisite state
+app.post('/api/orders/:id/fulfill', async (req, res) => {
+  const result = await db.order.updateMany({
+    where: { id: req.params.id, status: 'PAID' },
+    data: { status: 'FULFILLED' }
+  });
+  if (result.count === 0) return res.status(400).json({ error: 'Order not ready for fulfillment' });
+});
 ```
 
+## Ponytail Remediation Budget
+- Additions: <= 10 lines
+- Deletions: <= 4 lines
+
 ## Remediation
-1. Step one
-2. Step two
+1. Define a strict state machine with allowable transitions.
+2. Enforce atomic conditional updates asserting the expected source state.
+3. Return 400 or 409 errors when an invalid transition is attempted.
 
 ## Verification
-- Test case 1
-- Test case 2
-
-## False Positives and Exceptions
-An exception requires documented review.
+- Attempt to fulfill an unpaid order; confirm 400 rejection.
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-BIZ-001`: Client-Controlled Sensitive Business Value
+- `TG-AUTH-003`: Missing Object-Level Authorization

package/.torusguard/rules/business-logic/TG-BIZ-004-unrestricted-sensitive-business-flow.md

@@ -1,37 +1,47 @@
 # TG-BIZ-004: Unrestricted Sensitive Business Flow
 
 ## Severity
-High by default. Raise to Critical when applicable.
+High. Critical administrative or high-impact actions lacking step-up authentication, secondary confirmation, or multi-person governance allow compromised sessions to inflict irreversible damage.
 
 ## Applies To
-- Relevant endpoints and services
+- Tenant Deletion, Role Escalation, API Key Rotation, Wire Transfers
+- Node.js, Python, Go, Java, C#
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+Session hijacking, CSRF, or brief workstation abandonment can allow attackers to execute destructive operations (such as purging an entire organization's database or transferring company funds) if the flow executes immediately on a single unconfirmed click.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- Destructive administrative endpoints (`/delete-organization`, `/transfer-ownership`) executing without recent password re-authentication, MFA step-up verification, or explicit confirmation tokens.
 
 ## Unsafe Example
 ```javascript
-// Unsafe code example
+// UNSAFE: Destructive deletion executing without password re-verification
+app.delete('/api/orgs/:id', authMiddleware, async (req, res) => {
+  await db.org.delete({ where: { id: req.params.id } });
+  res.json({ success: true });
+});
 ```
 
 ## Safe Example
 ```javascript
-// Safe code example
+// SAFE: Requiring password re-authentication before executing destructive action
+app.delete('/api/orgs/:id', authMiddleware, async (req, res) => {
+  const { confirmPassword } = req.body;
+  const isValid = await verifyPassword(req.user.id, confirmPassword);
+  if (!isValid) return res.status(403).json({ error: 'Invalid password confirmation' });
+  await db.org.delete({ where: { id: req.params.id } });
+  res.json({ success: true });
+});
 ```
 
-## Remediation
-1. Step one
-2. Step two
-
-## Verification
-- Test case 1
-- Test case 2
+## Ponytail Remediation Budget
+- Additions: <= 12 lines
+- Deletions: <= 2 lines
 
-## False Positives and Exceptions
-An exception requires documented review.
+## Remediation
+1. Enforce step-up authentication (password re-prompt or TOTP code) on high-risk endpoints.
+2. Implement two-stage confirmation (`DELETE` requires prior confirmation token).
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-AUTH-002`: Client-Only Authorization
+- `TG-RATE-003`: Unbounded Resource Consumption

package/.torusguard/rules/cache/TG-CACHE-001-sensitive-response-publicly-cacheable.md

@@ -1,37 +1,45 @@
 # TG-CACHE-001: Sensitive Response Publicly Cacheable
 
 ## Severity
-High by default. Raise to Critical when applicable.
+High. Serving authenticated personal data, financial records, or credentials without private `Cache-Control` headers allows shared intermediary proxy servers and CDNs to cache and leak sensitive records to other users.
 
 ## Applies To
-- Relevant endpoints and services
+- Authenticated Endpoints, User Profiles, Billing Dashboards
+- Express, Next.js, FastAPI, Django, Flask, Rails, Spring
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+When endpoints returning PII omit cache control directives, shared corporate proxies or public edge CDNs may cache the response. Subsequent requests from other users on the same proxy can receive the cached personal data of the initial requester.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- Routes returning user profiles, tokens, or private data with `Cache-Control: public` or missing `Cache-Control` entirely.
 
 ## Unsafe Example
 ```javascript
-// Unsafe code example
+// UNSAFE: Missing cache control or explicitly public caching on private data
+app.get('/api/user/profile', authMiddleware, (req, res) => {
+  res.set('Cache-Control', 'public, max-age=3600');
+  res.json(req.user);
+});
 ```
 
 ## Safe Example
 ```javascript
-// Safe code example
+// SAFE: Explicit private no-store cache control on sensitive responses
+app.get('/api/user/profile', authMiddleware, (req, res) => {
+  res.set('Cache-Control', 'no-store, no-cache, must-revalidate, private');
+  res.set('Pragma', 'no-cache');
+  res.json(req.user);
+});
 ```
 
-## Remediation
-1. Step one
-2. Step two
-
-## Verification
-- Test case 1
-- Test case 2
+## Ponytail Remediation Budget
+- Additions: <= 4 lines
+- Deletions: <= 2 lines
 
-## False Positives and Exceptions
-An exception requires documented review.
+## Remediation
+1. Inject global middleware setting `Cache-Control: no-store, private` on all authenticated API responses.
+2. Verify reverse proxies and CDNs do not cache responses containing `Authorization` or `Cookie` headers.
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-CACHE-002`: Missing User Cache Isolation
+- `TG-PLATFORM-002`: Missing Security Headers

package/.torusguard/rules/cache/TG-CACHE-002-missing-user-cache-isolation.md

@@ -1,37 +1,51 @@
 # TG-CACHE-002: Missing User Cache Isolation
 
 ## Severity
-High by default. Raise to Critical when applicable.
+High. Storing per-user computed assets or database query results in shared application memory caches (Redis, Memcached) without tenant or user ID scoping leads to cross-user data leakage.
 
 ## Applies To
-- Relevant endpoints and services
+- Application Caching Layers (Redis, Memcached, LRU Caches)
+- Node.js, Python, Go, Java
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+If cache keys are formed using generic keys (e.g., `cache:dashboard_summary`) rather than tenant-qualified keys (`cache:tenant_{tid}:user_{uid}:dashboard_summary`), the first user to query the dashboard caches their data, and all subsequent users receive that cached data.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- Cache get/set calls where the cache key lacks user or tenant identifier variables.
 
 ## Unsafe Example
-```javascript
-// Unsafe code example
+```python
+# UNSAFE: Generic cache key shared across all users
+@app.get("/api/dashboard")
+def get_dashboard(user: User = Depends(get_current_user)):
+    data = cache.get("dashboard_data")
+    if not data:
+        data = generate_dashboard(user.id)
+        cache.set("dashboard_data", data, expire=300)
+    return data
 ```
 
 ## Safe Example
-```javascript
-// Safe code example
+```python
+# SAFE: Fully isolated cache key scoped by tenant and user
+@app.get("/api/dashboard")
+def get_dashboard(user: User = Depends(get_current_user)):
+    cache_key = f"dashboard:tenant_{user.tenant_id}:user_{user.id}"
+    data = cache.get(cache_key)
+    if not data:
+        data = generate_dashboard(user.id)
+        cache.set(cache_key, data, expire=300)
+    return data
 ```
 
-## Remediation
-1. Step one
-2. Step two
-
-## Verification
-- Test case 1
-- Test case 2
+## Ponytail Remediation Budget
+- Additions: <= 6 lines
+- Deletions: <= 3 lines
 
-## False Positives and Exceptions
-An exception requires documented review.
+## Remediation
+1. Always prefix cache keys with organizational and user identifiers.
+2. Clear tenant cache keys immediately upon logout or permissions change.
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-DB-004`: Missing Multi-Tenant Query Isolation
+- `TG-CACHE-001`: Sensitive Response Publicly Cacheable