torusguard 1.3.4 → 1.3.5

package/.torusguard/runs/run-20260912-215555-audit/findings.md

@@ -0,0 +1,232 @@
+# TorusGuard Security Audit Findings: run-20260912-215555-audit
+- Target Root: `C:\Users\Admin\Desktop\TorusGuard`
+- Total Scored Findings: `16`
+- Identified Clusters: `7`
+- Generated At: `2026-09-12 21:55:55 IST`
+
+---
+## Summary of Findings
+
+### [Critical] TG-SEC-001 - Hardcoded Secret or API Key in Tracked Source
+- **Finding ID:** `TG-SEC-001-bb5e4b77`
+- **Location:** `examples/vulnerable-react-express/server/index.js:9`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded JWT signing secret
+```
+
+// TG-SEC-001: Hardcoded JWT secret
+const JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';
+
+// TG-PLATFORM-001: Wildcard CORS with credentials
+```
+
+### [Critical] TG-SEC-001 - Hardcoded Secret or API Key in Tracked Source
+- **Finding ID:** `TG-SEC-001-c393d596`
+- **Location:** `examples/vulnerable-react-express/server/index.js:18`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+
+const users = [
+  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },
+  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },
+];
+```
+
+### [Critical] TG-DB-002 - Privileged Database Credential in Browser Context
+- **Finding ID:** `TG-DB-002-d9bd69df`
+- **Location:** `demo/playground/vulnerable_nextjs/actions.ts:9`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-client-leak`
+- **Description:** Service role key or raw database connection string reference in frontend code
+```
+
+// Finding 1: TG-CLIENT-001 - Backend admin key exposed in client-accessible code
+export const SUPABASE_SERVICE_ROLE_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.demo_secret_token_1234567890";
+
+interface UserRecord {
+```
+
+### [Critical] TG-SSRF-004 - Unbounded Outbound Request Without Timeout
+- **Finding ID:** `TG-SSRF-004-dcf3f71e`
+- **Location:** `examples/python/fastapi-hardened/main.py:30`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Python requests call without explicit timeout parameter
+```
+    if not is_safe_url(url):
+        raise HTTPException(status_code=400, detail="Invalid destination address")
+    response = requests.get(url, timeout=5)
+    return {"status": response.status_code, "content": response.text}
+
+```
+
+### [Critical] TG-SSRF-004 - Unbounded Outbound Request Without Timeout
+- **Finding ID:** `TG-SSRF-004-d8472223`
+- **Location:** `examples/python/fastapi-vuln/main.py:9`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Python requests call without explicit timeout parameter
+```
+@app.get("/fetch")
+def fetch_url(url: str):
+    response = requests.get(url)
+    return {"status": response.status_code, "content": response.text}
+
+```
+
+### [High] TG-INPUT-003 - Unsafe Dynamic Code or HTML Execution
+- **Finding ID:** `TG-INPUT-003-fea9421e`
+- **Location:** `examples/vulnerable-react-express/client/src/App.jsx:53`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-injection`
+- **Description:** React dangerouslySetInnerHTML rendering raw unescaped HTML
+```
+
+      {/* TG-INPUT-003: Unsafe HTML rendering */}
+      <div dangerouslySetInnerHTML={{ __html: bio }} />
+
+      <button onClick={fetchUser}>Fetch user (IDOR demo)</button>
+```
+
+### [High] TG-PLATFORM-001 - Wildcard CORS With Credentials
+- **Finding ID:** `TG-PLATFORM-001-7dd35cb4`
+- **Location:** `examples/vulnerable-react-express/server/index.js:12`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Wildcard CORS origin configured in Express middleware
+```
+
+// TG-PLATFORM-001: Wildcard CORS with credentials
+app.use(cors({ origin: '*', credentials: true }));
+
+// TG-PLATFORM-004: No explicit JSON body size limit
+```
+
+### [High] TG-AUTH-003 - Missing Object-Level Authorization (IDOR)
+- **Finding ID:** `TG-AUTH-003-6a05e509`
+- **Location:** `examples/hardened-react-express/server/index.js:49`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** JWT verification missing explicit algorithms restriction parameter
+```
+  if (!token) return res.status(401).json({ error: 'Unauthorized' });
+  try {
+    req.user = jwt.verify(token, process.env.JWT_SECRET);
+    next();
+  } catch {
+```
+
+### [High] TG-INPUT-001 - Missing Server-Side Request Validation
+- **Finding ID:** `TG-INPUT-001-c7457f38`
+- **Location:** `examples/vulnerable-react-express/server/index.js:27`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-injection`
+- **Description:** Destructuring unvalidated req.body without schema validation
+```
+// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)
+app.post('/api/login', (req, res) => {
+  const { email, password } = req.body;
+  console.log('Login attempt:', { email, password }); // TG-SEC-004
+  const user = users.find((u) => u.email === email && u.password === password);
+```
+
+### [High] TG-RATE-001 - Unlimited Authentication Endpoint
+- **Finding ID:** `TG-RATE-001-dcd0a3c7`
+- **Location:** `examples/vulnerable-react-express/server/index.js:26`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-rate-limiting`
+- **Description:** Authentication POST endpoint defined without rate-limiting middleware
+```
+// TG-SEC-004: Logs sensitive data
+// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)
+app.post('/api/login', (req, res) => {
+  const { email, password } = req.body;
+  console.log('Login attempt:', { email, password }); // TG-SEC-004
+```
+
+### [Medium] TG-PLATFORM-002 - Missing Security Headers
+- **Finding ID:** `TG-PLATFORM-002-1f383dcf`
+- **Location:** `examples/hardened-react-express/server/index.js:17`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-platform`
+- **Description:** Express application initialized without helmet security headers middleware
+```
+}
+
+const app = express();
+const PORT = 3001;
+const isProd = process.env.NODE_ENV === 'production';
+```
+
+### [Medium] TG-SEC-004 - Sensitive Information in Logs
+- **Finding ID:** `TG-SEC-004-dbbc17f7`
+- **Location:** `examples/vulnerable-react-express/client/src/App.jsx:30`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Plaintext credential or token logged to output sink
+```
+    const data = await res.json();
+    // TG-CLIENT-002: Sensitive console logging
+    console.log('Login token:', data.token, 'config:', clientConfig);
+    setMessage(JSON.stringify(data));
+  }
+```
+
+### [Medium] TG-CLIENT-001 - Public Production Source Maps
+- **Finding ID:** `TG-CLIENT-001-1ba4789e`
+- **Location:** `examples/vulnerable-react-express/client/vite.config.js:7`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-client-leak`
+- **Description:** Build config emitting unminified source maps in production output
+```
+export default defineConfig({
+  plugins: [react()],
+  build: { sourcemap: true },
+  server: {
+    port: 5173,
+```
+
+### [Medium] TG-SEC-004 - Sensitive Information in Logs
+- **Finding ID:** `TG-SEC-004-08753da5`
+- **Location:** `examples/vulnerable-react-express/server/index.js:28`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Plaintext credential or token logged to output sink
+```
+app.post('/api/login', (req, res) => {
+  const { email, password } = req.body;
+  console.log('Login attempt:', { email, password }); // TG-SEC-004
+  const user = users.find((u) => u.email === email && u.password === password);
+  if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration
+```
+
+### [Medium] TG-RATE-002 - Unlimited Public Write Endpoint
+- **Finding ID:** `TG-RATE-002-d67d7c98`
+- **Location:** `examples/vulnerable-react-express/server/index.js:54`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-rate-limiting`
+- **Description:** Public submission endpoint defined without rate-limiting or captcha defense
+```
+// TG-INPUT-001: No validation
+// TG-RATE-002: Unlimited contact endpoint
+app.post('/api/contact', (req, res) => {
+  res.json({ received: req.body });
+});
+```
+
+### [Medium] TG-PLATFORM-002 - Missing Security Headers
+- **Finding ID:** `TG-PLATFORM-002-eef342ec`
+- **Location:** `examples/vulnerable-react-express/server/index.js:5`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-platform`
+- **Description:** Express application initialized without helmet security headers middleware
+```
+const jwt = require('jsonwebtoken');
+
+const app = express();
+const PORT = 3001;
+
+```

package/.torusguard/runs/run-20260912-215555-audit/manifest.json

@@ -0,0 +1,13 @@
+{
+  "run_id": "run-20260912-215555-audit",
+  "command": "audit",
+  "target_name": "TorusGuard",
+  "created_at": "2026-09-12 21:55:55 IST",
+  "created_at_iso": "2026-09-12T21:55:55.372927+05:30",
+  "status": "completed",
+  "torusguard_version": "1.3.0",
+  "findings_count": 16,
+  "confirmed_fixed_count": 0,
+  "regressed_count": 0,
+  "remediation_bundles_count": 6
+}

package/.torusguard/runs/run-20260912-215555-audit/remediation.md

@@ -0,0 +1,102 @@
+# TorusGuard Governed Remediation Catalog
+**Run ID:** `run-20260912-215555-audit`  
+**Generated:** `2026-09-12 21:56:47 IST`  
+**Candidate Bundles Formulated:** `6`  
+
+---
+## Formulated Candidate Patches
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Target:** `examples/vulnerable-react-express/server/index.js:9` | **Bundle ID:** `bnd-tg-sec-001-9-e22e50`
+- **Strategy:** Migrated hardcoded JWT secret to environment variable process.env.JWT_SECRET
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -7,5 +7,5 @@
+ 
+ // TG-SEC-001: Hardcoded JWT secret
+-const JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';
++const JWT_SECRET = process.env.JWT_SECRET || "";
+ 
+ // TG-PLATFORM-001: Wildcard CORS with credentials
+```
+
+### [TG-SSRF-004] Unbounded Outbound Request Without Timeout
+- **Target:** `examples/python/fastapi-vuln/main.py:9` | **Bundle ID:** `bnd-tg-ssrf-004-9-9803ad`
+- **Strategy:** Injected explicit 10-second request timeout to prevent resource exhaustion
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/examples/python/fastapi-vuln/main.py
++++ b/examples/python/fastapi-vuln/main.py
+@@ -7,5 +7,5 @@
+ @app.get("/fetch")
+ def fetch_url(url: str):
+-    response = requests.get(url)
++    response = requests.get(url, timeout=10)
+     return {"status": response.status_code, "content": response.text}
+```
+
+### [TG-INPUT-003] Unsafe Dynamic Code or HTML Execution
+- **Target:** `examples/vulnerable-react-express/client/src/App.jsx:53` | **Bundle ID:** `bnd-tg-input-003-53-d167b4`
+- **Strategy:** Replaced raw dangerouslySetInnerHTML injection with safe React text interpolation
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/examples/vulnerable-react-express/client/src/App.jsx
++++ b/examples/vulnerable-react-express/client/src/App.jsx
+@@ -51,5 +51,5 @@
+ 
+       {/* TG-INPUT-003: Unsafe HTML rendering */}
+-      <div dangerouslySetInnerHTML={{ __html: bio }} />
++      <div>{bio}</div>
+ 
+       <button onClick={fetchUser}>Fetch user (IDOR demo)</button>
+```
+
+### [TG-PLATFORM-001] Wildcard CORS With Credentials
+- **Target:** `examples/vulnerable-react-express/server/index.js:12` | **Bundle ID:** `bnd-tg-platform-001-12-cf8156`
+- **Strategy:** Constrained wildcard CORS origin to process.env.ALLOWED_ORIGIN with secure fallback
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -10,5 +10,5 @@
+ 
+ // TG-PLATFORM-001: Wildcard CORS with credentials
+-app.use(cors({ origin: '*', credentials: true }));
++app.use(cors({ origin: process.env.ALLOWED_ORIGIN || 'http://localhost:5173', credentials: true }));
+ 
+ // TG-PLATFORM-004: No explicit JSON body size limit
+```
+
+### [TG-AUTH-003] Missing Object-Level Authorization (IDOR)
+- **Target:** `examples/hardened-react-express/server/index.js:49` | **Bundle ID:** `bnd-tg-auth-003-49-7c96f3`
+- **Strategy:** Restricted JWT verification to explicit algorithm list ['HS256']
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/examples/hardened-react-express/server/index.js
++++ b/examples/hardened-react-express/server/index.js
+@@ -47,5 +47,5 @@
+   if (!token) return res.status(401).json({ error: 'Unauthorized' });
+   try {
+-    req.user = jwt.verify(token, process.env.JWT_SECRET);
++    req.user = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] });
+     next();
+   } catch {
+```
+
+### [TG-RATE-001] Unlimited Authentication Endpoint
+- **Target:** `examples/vulnerable-react-express/server/index.js:26` | **Bundle ID:** `bnd-tg-rate-001-26-affcfa`
+- **Strategy:** Injected authLimiter rate-limiting middleware to protect authentication endpoint from brute force
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -24,5 +24,5 @@
+ // TG-SEC-004: Logs sensitive data
+ // TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)
+-app.post('/api/login', (req, res) => {
++app.post('/api/login', authLimiter, (req, res) => {
+   const { email, password } = req.body;
+   console.log('Login attempt:', { email, password }); // TG-SEC-004
+```

package/.torusguard/runs/run-20260912-215555-audit/summary.md

@@ -0,0 +1,5 @@
+# TorusGuard Audit Summary: run-20260912-215555-audit
+- Scanned Scope: C:\Users\Admin\Desktop\TorusGuard
+- Total Findings: 16
+- Root-Cause Clusters: 7
+- Generated: 2026-09-12 21:55:55 IST

package/.torusguard/runs/run-20260912-215731-audit/apply_plan.md

@@ -0,0 +1,6 @@
+# TorusGuard Governed Application Plan: run-20260912-215731-audit
+- **Total Candidate Patches:** 14
+- **Successfully Applied:** 14
+- **Skipped by Human Gate:** 0
+- **Execution Timestamp:** 2026-09-12 22:00:15 IST
+- **Rollback Directory:** `.torusguard/snapshots/run-20260912-215731-audit`

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-client-001-7-587129/metadata.json

@@ -0,0 +1,17 @@
+{
+  "bundle_id": "bnd-tg-client-001-7-587129",
+  "finding_id": "TG-CLIENT-001-1ba4789e",
+  "rule_id": "TG-CLIENT-001",
+  "title": "Public Production Source Maps",
+  "target_file": "examples/vulnerable-react-express/client/vite.config.js",
+  "line_number": 7,
+  "target_line": "  build: { sourcemap: true },",
+  "replacement_line": "  build: { sourcemap: false },",
+  "what_is_wrong": "Build config emitting unminified source maps in production output",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Disabled public production source map emission",
+  "proposed_diff": "--- a/examples/vulnerable-react-express/client/vite.config.js\n+++ b/examples/vulnerable-react-express/client/vite.config.js\n@@ -5,5 +5,5 @@\n export default defineConfig({\n   plugins: [react()],\n-  build: { sourcemap: true },\n+  build: { sourcemap: false },\n   server: {\n     port: 5173,\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "import { defineConfig } from 'vite';\nimport react from '@vitejs/plugin-react';\n\n// TG-CLIENT-001: Public production source maps enabled\nexport default defineConfig({\n  plugins: [react()],\n  build: { sourcemap: false },\n  server: {\n    port: 5173,\n    proxy: { '/api': 'http://localhost:3001' },\n  },\n});"
+}

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-client-001-7-587129/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-client-001-7-587129
+- **Rule ID:** `TG-CLIENT-001`
+- **Target File:** `examples/vulnerable-react-express/client/vite.config.js:7`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Disabled public production source map emission
+
+## Unified Diff Preview
+```diff
+--- a/examples/vulnerable-react-express/client/vite.config.js
++++ b/examples/vulnerable-react-express/client/vite.config.js
+@@ -5,5 +5,5 @@
+ export default defineConfig({
+   plugins: [react()],
+-  build: { sourcemap: true },
++  build: { sourcemap: false },
+   server: {
+     port: 5173,
+
+```

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-client-001-7-587129/patch.diff

@@ -0,0 +1,9 @@
+--- a/examples/vulnerable-react-express/client/vite.config.js
++++ b/examples/vulnerable-react-express/client/vite.config.js
+@@ -5,5 +5,5 @@
+ export default defineConfig({
+   plugins: [react()],
+-  build: { sourcemap: true },
++  build: { sourcemap: false },
+   server: {
+     port: 5173,

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-db-002-9-5f7850/metadata.json

@@ -0,0 +1,17 @@
+{
+  "bundle_id": "bnd-tg-db-002-9-5f7850",
+  "finding_id": "TG-DB-002-d9bd69df",
+  "rule_id": "TG-DB-002",
+  "title": "Privileged Database Credential in Browser Context",
+  "target_file": "demo/playground/vulnerable_nextjs/actions.ts",
+  "line_number": 9,
+  "target_line": "export const SUPABASE_SERVICE_ROLE_KEY = \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.demo_secret_token_1234567890\";",
+  "replacement_line": "export const SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY || \"\";",
+  "what_is_wrong": "Service role key or raw database connection string reference in frontend code",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Replaced hardcoded privileged database credential with process.env.SUPABASE_SERVICE_ROLE_KEY",
+  "proposed_diff": "--- a/demo/playground/vulnerable_nextjs/actions.ts\n+++ b/demo/playground/vulnerable_nextjs/actions.ts\n@@ -7,5 +7,5 @@\n \n // Finding 1: TG-CLIENT-001 - Backend admin key exposed in client-accessible code\n-export const SUPABASE_SERVICE_ROLE_KEY = \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.demo_secret_token_1234567890\";\n+export const SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY || \"\";\n \n interface UserRecord {\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "/**\n * TorusGuard Playground: Vulnerable Next.js Server Action Fixture\n * Contains 2 intentional security findings for demonstration purposes:\n *   - TG-CLIENT-001 (Leaked Service Role Key)\n *   - TG-AUTH-003 (Unauthenticated Server Action Mutation)\n */\n\n// Finding 1: TG-CLIENT-001 - Backend admin key exposed in client-accessible code\nexport const SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY || \"\";\n\ninterface UserRecord {\n  id: string;\n  role: string;\n}\n\n// Finding 2: TG-AUTH-003 - Server Action performing state change without session check\nexport async function updateUserRole(userId: string, newRole: string): Promise<{ success: boolean }> {\n  \"use server\";\n\n  // VULNERABLE: Lacks auth session check e.g. const session = await auth(); if (!session?.user?.isAdmin) throw ...\n  console.log(`[VULNERABLE] Updating user ${userId} to role ${newRole} without authentication check`);\n  \n  return { success: true };\n}"
+}

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-db-002-9-5f7850/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-db-002-9-5f7850
+- **Rule ID:** `TG-DB-002`
+- **Target File:** `demo/playground/vulnerable_nextjs/actions.ts:9`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Replaced hardcoded privileged database credential with process.env.SUPABASE_SERVICE_ROLE_KEY
+
+## Unified Diff Preview
+```diff
+--- a/demo/playground/vulnerable_nextjs/actions.ts
++++ b/demo/playground/vulnerable_nextjs/actions.ts
+@@ -7,5 +7,5 @@
+ 
+ // Finding 1: TG-CLIENT-001 - Backend admin key exposed in client-accessible code
+-export const SUPABASE_SERVICE_ROLE_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.demo_secret_token_1234567890";
++export const SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY || "";
+ 
+ interface UserRecord {
+
+```

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-db-002-9-5f7850/patch.diff

@@ -0,0 +1,9 @@
+--- a/demo/playground/vulnerable_nextjs/actions.ts
++++ b/demo/playground/vulnerable_nextjs/actions.ts
+@@ -7,5 +7,5 @@
+ 
+ // Finding 1: TG-CLIENT-001 - Backend admin key exposed in client-accessible code
+-export const SUPABASE_SERVICE_ROLE_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.demo_secret_token_1234567890";
++export const SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY || "";
+ 
+ interface UserRecord {

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-input-001-27-2486f1/metadata.json

@@ -0,0 +1,17 @@
+{
+  "bundle_id": "bnd-tg-input-001-27-2486f1",
+  "finding_id": "TG-INPUT-001-c7457f38",
+  "rule_id": "TG-INPUT-001",
+  "title": "Missing Server-Side Request Validation",
+  "target_file": "examples/vulnerable-react-express/server/index.js",
+  "line_number": 27,
+  "target_line": "  const { email, password } = req.body;",
+  "replacement_line": "  if (!req.body || typeof req.body !== \"object\") return res.status(400).json({ error: \"Invalid payload\" });\n  const { email, password } = req.body;",
+  "what_is_wrong": "Destructuring unvalidated req.body without schema validation",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Added defensive request body payload validation before destructuring",
+  "proposed_diff": "--- a/examples/vulnerable-react-express/server/index.js\n+++ b/examples/vulnerable-react-express/server/index.js\n@@ -25,5 +25,5 @@\n // TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)\n app.post('/api/login', (req, res) => {\n-  const { email, password } = req.body;\n+  if (!req.body || typeof req.body !== \"object\") return res.status(400).json({ error: \"Invalid payload\" });\n  const { email, password } = req.body;\n   console.log('Login attempt:', { email, password }); // TG-SEC-004\n   const user = users.find((u) => u.email === email && u.password === password);\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "const express = require('express');\nconst cors = require('cors');\nconst jwt = require('jsonwebtoken');\n\nconst app = express();\nconst PORT = 3001;\n\n// TG-SEC-001: Hardcoded JWT secret\nconst JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';\n\n// TG-PLATFORM-001: Wildcard CORS with credentials\napp.use(cors({ origin: '*', credentials: true }));\n\n// TG-PLATFORM-004: No explicit JSON body size limit\napp.use(express.json());\n\nconst users = [\n  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },\n  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },\n];\n\n// TG-RATE-001: No rate limit on login\n// TG-AUTH-001: Plaintext password comparison\n// TG-SEC-004: Logs sensitive data\n// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)\napp.post('/api/login', (req, res) => {\n  if (!req.body || typeof req.body !== \"object\") return res.status(400).json({ error: \"Invalid payload\" });\n  const { email, password } = req.body;\n  console.log('Login attempt:', { email, password }); // TG-SEC-004\n  const user = users.find((u) => u.email === email && u.password === password);\n  if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration\n  const token = jwt.sign({ id: user.id }, JWT_SECRET);\n  res.cookie('token', token);\n  res.json({ message: 'ok', token, user });\n});\n\n// TG-AUTH-003: IDOR \u2014 no ownership check\napp.get('/api/users/:id', (req, res) => {\n  const user = users.find((u) => u.id === req.params.id);\n  if (!user) return res.status(404).json({ error: 'Not found' });\n  res.json(user);\n});\n\n// TG-INPUT-002: SQL concatenation (simulated query string)\n// TG-RATE-003: Unbounded results\napp.get('/api/search', (req, res) => {\n  const q = req.query.q || '';\n  const fakeSql = `SELECT * FROM users WHERE email LIKE '%${q}%'`;\n  const results = users.filter((u) => u.email.includes(q));\n  res.json({ query: fakeSql, results });\n});\n\n// TG-INPUT-001: No validation\n// TG-RATE-002: Unlimited contact endpoint\napp.post('/api/contact', (req, res) => {\n  res.json({ received: req.body });\n});\n\n// TG-RATE-002: Unlimited AI endpoint\napp.post('/api/ai', (req, res) => {\n  res.json({ reply: 'demo', prompt: req.body.prompt });\n});\n\n// TG-INPUT-004: Unrestricted upload (stub)\napp.post('/api/upload', (req, res) => {\n  res.json({ saved: req.body.filename });\n});\n\n// TG-AUTH-005: Unsafe password reset\napp.post('/api/reset', (req, res) => {\n  const { email } = req.body;\n  const user = users.find((u) => u.email === email);\n  if (!user) return res.status(404).json({ error: 'Email not registered' }); // enumeration\n  const token = `reset-${user.id}-12345`; // predictable\n  res.json({ resetToken: token });\n});\n\napp.use((err, req, res, next) => {\n  // TG-PLATFORM-003: Stack trace exposed\n  res.status(500).json({ error: err.message, stack: err.stack });\n});\n\napp.listen(PORT, () => console.log(`Vulnerable demo server http://localhost:${PORT}`));"
+}

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-input-001-27-2486f1/minimal_patch_plan.md

@@ -0,0 +1,22 @@
+# Remediation Plan: bnd-tg-input-001-27-2486f1
+- **Rule ID:** `TG-INPUT-001`
+- **Target File:** `examples/vulnerable-react-express/server/index.js:27`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Added defensive request body payload validation before destructuring
+
+## Unified Diff Preview
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -25,5 +25,5 @@
+ // TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)
+ app.post('/api/login', (req, res) => {
+-  const { email, password } = req.body;
++  if (!req.body || typeof req.body !== "object") return res.status(400).json({ error: "Invalid payload" });
+  const { email, password } = req.body;
+   console.log('Login attempt:', { email, password }); // TG-SEC-004
+   const user = users.find((u) => u.email === email && u.password === password);
+
+```

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-input-001-27-2486f1/patch.diff

@@ -0,0 +1,10 @@
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -25,5 +25,5 @@
+ // TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)
+ app.post('/api/login', (req, res) => {
+-  const { email, password } = req.body;
++  if (!req.body || typeof req.body !== "object") return res.status(400).json({ error: "Invalid payload" });
+  const { email, password } = req.body;
+   console.log('Login attempt:', { email, password }); // TG-SEC-004
+   const user = users.find((u) => u.email === email && u.password === password);

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-input-003-53-d167b4/metadata.json

@@ -0,0 +1,17 @@
+{
+  "bundle_id": "bnd-tg-input-003-53-d167b4",
+  "finding_id": "TG-INPUT-003-fea9421e",
+  "rule_id": "TG-INPUT-003",
+  "title": "Unsafe Dynamic Code or HTML Execution",
+  "target_file": "examples/vulnerable-react-express/client/src/App.jsx",
+  "line_number": 53,
+  "target_line": "      <div dangerouslySetInnerHTML={{ __html: bio }} />",
+  "replacement_line": "      <div>{bio}</div>",
+  "what_is_wrong": "React dangerouslySetInnerHTML rendering raw unescaped HTML",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Replaced raw dangerouslySetInnerHTML injection with safe React text interpolation",
+  "proposed_diff": "--- a/examples/vulnerable-react-express/client/src/App.jsx\n+++ b/examples/vulnerable-react-express/client/src/App.jsx\n@@ -51,5 +51,5 @@\n \n       {/* TG-INPUT-003: Unsafe HTML rendering */}\n-      <div dangerouslySetInnerHTML={{ __html: bio }} />\n+      <div>{bio}</div>\n \n       <button onClick={fetchUser}>Fetch user (IDOR demo)</button>\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "import { useState } from 'react';\nimport { clientConfig } from './config';\n\n// TG-DB-001: SQL query construction in frontend (never do this)\nfunction buildSearchQuery(email) {\n  return `SELECT id, email FROM users WHERE email LIKE '%${email}%'`;\n}\n\n// TG-DB-003: Documented anti-pattern \u2014 Prisma must never run in browser\n// import { PrismaClient } from '@prisma/client'; // FORBIDDEN in client\n\nexport default function App() {\n  const [email, setEmail] = useState('');\n  const [password, setPassword] = useState('');\n  const [bio, setBio] = useState('<img src=x onerror=alert(1)>');\n  const [userId, setUserId] = useState('1');\n  const [isAdmin] = useState(localStorage.getItem('role') === 'admin'); // TG-AUTH-002\n  const [message, setMessage] = useState('');\n\n  async function login(e) {\n    e.preventDefault();\n    const res = await fetch('/api/login', {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      credentials: 'include',\n      body: JSON.stringify({ email, password }),\n    });\n    const data = await res.json();\n    // TG-CLIENT-002: Sensitive console logging\n    console.log('Login token:', data.token, 'config:', clientConfig);\n    setMessage(JSON.stringify(data));\n  }\n\n  async function fetchUser() {\n    const res = await fetch(`/api/users/${userId}`);\n    setMessage(await res.text());\n  }\n\n  return (\n    <div style={{ maxWidth: 560, margin: '2rem auto', fontFamily: 'sans-serif' }}>\n      <h1>Vulnerable Demo</h1>\n      <p style={{ color: 'crimson' }}>Intentionally insecure \u2014 localhost lab only</p>\n\n      <form onSubmit={login}>\n        <input value={email} onChange={(e) => setEmail(e.target.value)} placeholder=\"email\" />\n        <input value={password} onChange={(e) => setPassword(e.target.value)} placeholder=\"password\" type=\"password\" />\n        <button type=\"submit\">Login</button>\n      </form>\n\n      <p>Frontend SQL preview: {buildSearchQuery(email)}</p>\n\n      {/* TG-INPUT-003: Unsafe HTML rendering */}\n      <div>{bio}</div>\n\n      <button onClick={fetchUser}>Fetch user (IDOR demo)</button>\n\n      {/* TG-AUTH-002: Client-only admin gate */}\n      {isAdmin && <section><h2>Admin Panel</h2><p>Visible if localStorage role=admin \u2014 not real security</p></section>}\n\n      {message && <pre>{message}</pre>}\n    </div>\n  );\n}"
+}

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-input-003-53-d167b4/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-input-003-53-d167b4
+- **Rule ID:** `TG-INPUT-003`
+- **Target File:** `examples/vulnerable-react-express/client/src/App.jsx:53`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Replaced raw dangerouslySetInnerHTML injection with safe React text interpolation
+
+## Unified Diff Preview
+```diff
+--- a/examples/vulnerable-react-express/client/src/App.jsx
++++ b/examples/vulnerable-react-express/client/src/App.jsx
+@@ -51,5 +51,5 @@
+ 
+       {/* TG-INPUT-003: Unsafe HTML rendering */}
+-      <div dangerouslySetInnerHTML={{ __html: bio }} />
++      <div>{bio}</div>
+ 
+       <button onClick={fetchUser}>Fetch user (IDOR demo)</button>
+
+```

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-input-003-53-d167b4/patch.diff

@@ -0,0 +1,9 @@
+--- a/examples/vulnerable-react-express/client/src/App.jsx
++++ b/examples/vulnerable-react-express/client/src/App.jsx
+@@ -51,5 +51,5 @@
+ 
+       {/* TG-INPUT-003: Unsafe HTML rendering */}
+-      <div dangerouslySetInnerHTML={{ __html: bio }} />
++      <div>{bio}</div>
+ 
+       <button onClick={fetchUser}>Fetch user (IDOR demo)</button>

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-platform-001-12-cf8156/metadata.json

@@ -0,0 +1,17 @@
+{
+  "bundle_id": "bnd-tg-platform-001-12-cf8156",
+  "finding_id": "TG-PLATFORM-001-7dd35cb4",
+  "rule_id": "TG-PLATFORM-001",
+  "title": "Wildcard CORS With Credentials",
+  "target_file": "examples/vulnerable-react-express/server/index.js",
+  "line_number": 12,
+  "target_line": "app.use(cors({ origin: '*', credentials: true }));",
+  "replacement_line": "app.use(cors({ origin: process.env.ALLOWED_ORIGIN || 'http://localhost:5173', credentials: true }));",
+  "what_is_wrong": "Wildcard CORS origin configured in Express middleware",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Constrained wildcard CORS origin to process.env.ALLOWED_ORIGIN with secure fallback",
+  "proposed_diff": "--- a/examples/vulnerable-react-express/server/index.js\n+++ b/examples/vulnerable-react-express/server/index.js\n@@ -10,5 +10,5 @@\n \n // TG-PLATFORM-001: Wildcard CORS with credentials\n-app.use(cors({ origin: '*', credentials: true }));\n+app.use(cors({ origin: process.env.ALLOWED_ORIGIN || 'http://localhost:5173', credentials: true }));\n \n // TG-PLATFORM-004: No explicit JSON body size limit\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "const express = require('express');\nconst cors = require('cors');\nconst jwt = require('jsonwebtoken');\n\nconst app = express();\nconst PORT = 3001;\n\n// TG-SEC-001: Hardcoded JWT secret\nconst JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';\n\n// TG-PLATFORM-001: Wildcard CORS with credentials\napp.use(cors({ origin: process.env.ALLOWED_ORIGIN || 'http://localhost:5173', credentials: true }));\n\n// TG-PLATFORM-004: No explicit JSON body size limit\napp.use(express.json());\n\nconst users = [\n  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },\n  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },\n];\n\n// TG-RATE-001: No rate limit on login\n// TG-AUTH-001: Plaintext password comparison\n// TG-SEC-004: Logs sensitive data\n// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)\napp.post('/api/login', (req, res) => {\n  const { email, password } = req.body;\n  console.log('Login attempt:', { email, password }); // TG-SEC-004\n  const user = users.find((u) => u.email === email && u.password === password);\n  if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration\n  const token = jwt.sign({ id: user.id }, JWT_SECRET);\n  res.cookie('token', token);\n  res.json({ message: 'ok', token, user });\n});\n\n// TG-AUTH-003: IDOR \u2014 no ownership check\napp.get('/api/users/:id', (req, res) => {\n  const user = users.find((u) => u.id === req.params.id);\n  if (!user) return res.status(404).json({ error: 'Not found' });\n  res.json(user);\n});\n\n// TG-INPUT-002: SQL concatenation (simulated query string)\n// TG-RATE-003: Unbounded results\napp.get('/api/search', (req, res) => {\n  const q = req.query.q || '';\n  const fakeSql = `SELECT * FROM users WHERE email LIKE '%${q}%'`;\n  const results = users.filter((u) => u.email.includes(q));\n  res.json({ query: fakeSql, results });\n});\n\n// TG-INPUT-001: No validation\n// TG-RATE-002: Unlimited contact endpoint\napp.post('/api/contact', (req, res) => {\n  res.json({ received: req.body });\n});\n\n// TG-RATE-002: Unlimited AI endpoint\napp.post('/api/ai', (req, res) => {\n  res.json({ reply: 'demo', prompt: req.body.prompt });\n});\n\n// TG-INPUT-004: Unrestricted upload (stub)\napp.post('/api/upload', (req, res) => {\n  res.json({ saved: req.body.filename });\n});\n\n// TG-AUTH-005: Unsafe password reset\napp.post('/api/reset', (req, res) => {\n  const { email } = req.body;\n  const user = users.find((u) => u.email === email);\n  if (!user) return res.status(404).json({ error: 'Email not registered' }); // enumeration\n  const token = `reset-${user.id}-12345`; // predictable\n  res.json({ resetToken: token });\n});\n\napp.use((err, req, res, next) => {\n  // TG-PLATFORM-003: Stack trace exposed\n  res.status(500).json({ error: err.message, stack: err.stack });\n});\n\napp.listen(PORT, () => console.log(`Vulnerable demo server http://localhost:${PORT}`));"
+}

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-platform-001-12-cf8156/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-platform-001-12-cf8156
+- **Rule ID:** `TG-PLATFORM-001`
+- **Target File:** `examples/vulnerable-react-express/server/index.js:12`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Constrained wildcard CORS origin to process.env.ALLOWED_ORIGIN with secure fallback
+
+## Unified Diff Preview
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -10,5 +10,5 @@
+ 
+ // TG-PLATFORM-001: Wildcard CORS with credentials
+-app.use(cors({ origin: '*', credentials: true }));
++app.use(cors({ origin: process.env.ALLOWED_ORIGIN || 'http://localhost:5173', credentials: true }));
+ 
+ // TG-PLATFORM-004: No explicit JSON body size limit
+
+```

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-platform-001-12-cf8156/patch.diff

@@ -0,0 +1,9 @@
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -10,5 +10,5 @@
+ 
+ // TG-PLATFORM-001: Wildcard CORS with credentials
+-app.use(cors({ origin: '*', credentials: true }));
++app.use(cors({ origin: process.env.ALLOWED_ORIGIN || 'http://localhost:5173', credentials: true }));
+ 
+ // TG-PLATFORM-004: No explicit JSON body size limit