torusguard 1.3.4 → 1.3.5

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-platform-002-17-876973/metadata.json

@@ -0,0 +1,17 @@
+{
+  "bundle_id": "bnd-tg-platform-002-17-876973",
+  "finding_id": "TG-PLATFORM-002-1f383dcf",
+  "rule_id": "TG-PLATFORM-002",
+  "title": "Missing Security Headers",
+  "target_file": "examples/hardened-react-express/server/index.js",
+  "line_number": 17,
+  "target_line": "const app = express();",
+  "replacement_line": "const helmet = require(\"helmet\");\nconst app = express();\napp.use(helmet());",
+  "what_is_wrong": "Express application initialized without helmet security headers middleware",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Injected helmet security headers middleware into Express application",
+  "proposed_diff": "--- a/examples/hardened-react-express/server/index.js\n+++ b/examples/hardened-react-express/server/index.js\n@@ -15,5 +15,5 @@\n }\n \n-const app = express();\n+const helmet = require(\"helmet\");\nconst app = express();\napp.use(helmet());\n const PORT = 3001;\n const isProd = process.env.NODE_ENV === 'production';\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "require('dotenv').config();\nconst express = require('express');\nconst helmet = require('helmet');\nconst cors = require('cors');\nconst cookieParser = require('cookie-parser');\nconst rateLimit = require('express-rate-limit');\nconst bcrypt = require('bcrypt');\nconst jwt = require('jsonwebtoken');\nconst crypto = require('crypto');\nconst { z } = require('zod');\n\nif (!process.env.JWT_SECRET) {\n  console.error('Missing JWT_SECRET');\n  process.exit(1);\n}\n\nconst helmet = require(\"helmet\");\nconst app = express();\napp.use(helmet());\nconst PORT = 3001;\nconst isProd = process.env.NODE_ENV === 'production';\n\napp.use(helmet());\napp.use(cors({ origin: process.env.CLIENT_ORIGIN, credentials: true }));\napp.use(express.json({ limit: '100kb' }));\napp.use(cookieParser());\n\nconst loginLimiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 5 });\nconst resetLimiter = rateLimit({ windowMs: 60 * 60 * 1000, max: 3 });\nconst publicWriteLimiter = rateLimit({ windowMs: 60 * 60 * 1000, max: 10 });\n\nconst users = [];\nconst resetTokens = new Map();\n\nasync function seed() {\n  if (users.length) return;\n  const hash = await bcrypt.hash('DemoPass123!', 12);\n  users.push({ id: '1', email: 'alice@demo.local', passwordHash: hash, name: 'Alice', role: 'user' });\n  users.push({ id: '2', email: 'bob@demo.local', passwordHash: hash, name: 'Bob', role: 'user' });\n}\n\nconst loginSchema = z.object({\n  email: z.string().email().max(255),\n  password: z.string().min(8).max(128),\n});\n\nfunction auth(req, res, next) {\n  const token = req.cookies.token;\n  if (!token) return res.status(401).json({ error: 'Unauthorized' });\n  try {\n    req.user = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] });\n    next();\n  } catch {\n    return res.status(401).json({ error: 'Unauthorized' });\n  }\n}\n\napp.post('/api/login', loginLimiter, async (req, res) => {\n  const parsed = loginSchema.safeParse(req.body);\n  if (!parsed.success) return res.status(400).json({ error: 'Invalid input' });\n  const { email, password } = parsed.data;\n  const user = users.find((u) => u.email === email);\n  if (!user || !(await bcrypt.compare(password, user.passwordHash))) {\n    return res.status(401).json({ error: 'Invalid email or password' });\n  }\n  const token = jwt.sign({ id: user.id, role: user.role }, process.env.JWT_SECRET, { expiresIn: '1h' });\n  res.cookie('token', token, {\n    httpOnly: true,\n    secure: isProd,\n    sameSite: 'lax',\n    maxAge: 3600000,\n  });\n  res.json({ message: 'Login successful' });\n});\n\napp.get('/api/users/me', auth, (req, res) => {\n  const user = users.find((u) => u.id === req.user.id);\n  if (!user) return res.status(404).json({ error: 'Not found' });\n  res.json({ id: user.id, email: user.email, name: user.name });\n});\n\napp.get('/api/search', auth, (req, res) => {\n  const q = String(req.query.q || '').slice(0, 100);\n  const results = users\n    .filter((u) => u.email.includes(q))\n    .slice(0, 20)\n    .map(({ id, email, name }) => ({ id, email, name }));\n  res.json({ results });\n});\n\nconst contactSchema = z.object({ message: z.string().min(1).max(2000) });\napp.post('/api/contact', publicWriteLimiter, (req, res) => {\n  const parsed = contactSchema.safeParse(req.body);\n  if (!parsed.success) return res.status(400).json({ error: 'Invalid input' });\n  res.json({ ok: true });\n});\n\napp.post('/api/ai', auth, publicWriteLimiter, (req, res) => {\n  const prompt = String(req.body.prompt || '').slice(0, 4000);\n  res.json({ reply: 'demo response', length: prompt.length });\n});\n\napp.post('/api/reset', resetLimiter, (req, res) => {\n  const email = String(req.body.email || '');\n  const user = users.find((u) => u.email === email);\n  if (user) {\n    const token = crypto.randomBytes(32).toString('hex');\n    resetTokens.set(token, { userId: user.id, expires: Date.now() + 900000 });\n  }\n  res.json({ message: 'If an account exists, a reset link was sent.' });\n});\n\napp.get('/api/admin/stats', auth, (req, res) => {\n  if (req.user.role !== 'admin') return res.status(403).json({ error: 'Forbidden' });\n  res.json({ users: users.length });\n});\n\napp.use((err, req, res, next) => {\n  console.error('Error', { message: err.message });\n  res.status(500).json({ error: isProd ? 'Internal server error' : err.message });\n});\n\nseed().then(() => app.listen(PORT, () => console.log(`Hardened demo http://localhost:${PORT}`)));"
+}

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-platform-002-17-876973/minimal_patch_plan.md

@@ -0,0 +1,23 @@
+# Remediation Plan: bnd-tg-platform-002-17-876973
+- **Rule ID:** `TG-PLATFORM-002`
+- **Target File:** `examples/hardened-react-express/server/index.js:17`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Injected helmet security headers middleware into Express application
+
+## Unified Diff Preview
+```diff
+--- a/examples/hardened-react-express/server/index.js
++++ b/examples/hardened-react-express/server/index.js
+@@ -15,5 +15,5 @@
+ }
+ 
+-const app = express();
++const helmet = require("helmet");
+const app = express();
+app.use(helmet());
+ const PORT = 3001;
+ const isProd = process.env.NODE_ENV === 'production';
+
+```

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-platform-002-17-876973/patch.diff

@@ -0,0 +1,11 @@
+--- a/examples/hardened-react-express/server/index.js
++++ b/examples/hardened-react-express/server/index.js
+@@ -15,5 +15,5 @@
+ }
+ 
+-const app = express();
++const helmet = require("helmet");
+const app = express();
+app.use(helmet());
+ const PORT = 3001;
+ const isProd = process.env.NODE_ENV === 'production';

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-platform-002-5-40c794/metadata.json

@@ -0,0 +1,17 @@
+{
+  "bundle_id": "bnd-tg-platform-002-5-40c794",
+  "finding_id": "TG-PLATFORM-002-eef342ec",
+  "rule_id": "TG-PLATFORM-002",
+  "title": "Missing Security Headers",
+  "target_file": "examples/vulnerable-react-express/server/index.js",
+  "line_number": 5,
+  "target_line": "const app = express();",
+  "replacement_line": "const helmet = require(\"helmet\");\nconst app = express();\napp.use(helmet());",
+  "what_is_wrong": "Express application initialized without helmet security headers middleware",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Injected helmet security headers middleware into Express application",
+  "proposed_diff": "--- a/examples/vulnerable-react-express/server/index.js\n+++ b/examples/vulnerable-react-express/server/index.js\n@@ -3,5 +3,5 @@\n const jwt = require('jsonwebtoken');\n \n-const app = express();\n+const helmet = require(\"helmet\");\nconst app = express();\napp.use(helmet());\n const PORT = 3001;\n \n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "const express = require('express');\nconst cors = require('cors');\nconst jwt = require('jsonwebtoken');\n\nconst helmet = require(\"helmet\");\nconst app = express();\napp.use(helmet());\nconst PORT = 3001;\n\n// TG-SEC-001: Hardcoded JWT secret\nconst JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';\n\n// TG-PLATFORM-001: Wildcard CORS with credentials\napp.use(cors({ origin: '*', credentials: true }));\n\n// TG-PLATFORM-004: No explicit JSON body size limit\napp.use(express.json());\n\nconst users = [\n  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },\n  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },\n];\n\n// TG-RATE-001: No rate limit on login\n// TG-AUTH-001: Plaintext password comparison\n// TG-SEC-004: Logs sensitive data\n// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)\napp.post('/api/login', (req, res) => {\n  const { email, password } = req.body;\n  console.log('Login attempt:', { email, password }); // TG-SEC-004\n  const user = users.find((u) => u.email === email && u.password === password);\n  if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration\n  const token = jwt.sign({ id: user.id }, JWT_SECRET);\n  res.cookie('token', token);\n  res.json({ message: 'ok', token, user });\n});\n\n// TG-AUTH-003: IDOR \u2014 no ownership check\napp.get('/api/users/:id', (req, res) => {\n  const user = users.find((u) => u.id === req.params.id);\n  if (!user) return res.status(404).json({ error: 'Not found' });\n  res.json(user);\n});\n\n// TG-INPUT-002: SQL concatenation (simulated query string)\n// TG-RATE-003: Unbounded results\napp.get('/api/search', (req, res) => {\n  const q = req.query.q || '';\n  const fakeSql = `SELECT * FROM users WHERE email LIKE '%${q}%'`;\n  const results = users.filter((u) => u.email.includes(q));\n  res.json({ query: fakeSql, results });\n});\n\n// TG-INPUT-001: No validation\n// TG-RATE-002: Unlimited contact endpoint\napp.post('/api/contact', (req, res) => {\n  res.json({ received: req.body });\n});\n\n// TG-RATE-002: Unlimited AI endpoint\napp.post('/api/ai', (req, res) => {\n  res.json({ reply: 'demo', prompt: req.body.prompt });\n});\n\n// TG-INPUT-004: Unrestricted upload (stub)\napp.post('/api/upload', (req, res) => {\n  res.json({ saved: req.body.filename });\n});\n\n// TG-AUTH-005: Unsafe password reset\napp.post('/api/reset', (req, res) => {\n  const { email } = req.body;\n  const user = users.find((u) => u.email === email);\n  if (!user) return res.status(404).json({ error: 'Email not registered' }); // enumeration\n  const token = `reset-${user.id}-12345`; // predictable\n  res.json({ resetToken: token });\n});\n\napp.use((err, req, res, next) => {\n  // TG-PLATFORM-003: Stack trace exposed\n  res.status(500).json({ error: err.message, stack: err.stack });\n});\n\napp.listen(PORT, () => console.log(`Vulnerable demo server http://localhost:${PORT}`));"
+}

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-platform-002-5-40c794/minimal_patch_plan.md

@@ -0,0 +1,23 @@
+# Remediation Plan: bnd-tg-platform-002-5-40c794
+- **Rule ID:** `TG-PLATFORM-002`
+- **Target File:** `examples/vulnerable-react-express/server/index.js:5`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Injected helmet security headers middleware into Express application
+
+## Unified Diff Preview
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -3,5 +3,5 @@
+ const jwt = require('jsonwebtoken');
+ 
+-const app = express();
++const helmet = require("helmet");
+const app = express();
+app.use(helmet());
+ const PORT = 3001;
+ 
+
+```

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-platform-002-5-40c794/patch.diff

@@ -0,0 +1,11 @@
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -3,5 +3,5 @@
+ const jwt = require('jsonwebtoken');
+ 
+-const app = express();
++const helmet = require("helmet");
+const app = express();
+app.use(helmet());
+ const PORT = 3001;
+ 

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-rate-001-26-affcfa/metadata.json

@@ -0,0 +1,17 @@
+{
+  "bundle_id": "bnd-tg-rate-001-26-affcfa",
+  "finding_id": "TG-RATE-001-dcd0a3c7",
+  "rule_id": "TG-RATE-001",
+  "title": "Unlimited Authentication Endpoint",
+  "target_file": "examples/vulnerable-react-express/server/index.js",
+  "line_number": 26,
+  "target_line": "app.post('/api/login', (req, res) => {",
+  "replacement_line": "app.post('/api/login', authLimiter, (req, res) => {",
+  "what_is_wrong": "Authentication POST endpoint defined without rate-limiting middleware",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Injected authLimiter rate-limiting middleware to protect authentication endpoint from brute force",
+  "proposed_diff": "--- a/examples/vulnerable-react-express/server/index.js\n+++ b/examples/vulnerable-react-express/server/index.js\n@@ -24,5 +24,5 @@\n // TG-SEC-004: Logs sensitive data\n // TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)\n-app.post('/api/login', (req, res) => {\n+app.post('/api/login', authLimiter, (req, res) => {\n   const { email, password } = req.body;\n   console.log('Login attempt:', { email, password }); // TG-SEC-004\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "const express = require('express');\nconst cors = require('cors');\nconst jwt = require('jsonwebtoken');\n\nconst app = express();\nconst PORT = 3001;\n\n// TG-SEC-001: Hardcoded JWT secret\nconst JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';\n\n// TG-PLATFORM-001: Wildcard CORS with credentials\napp.use(cors({ origin: '*', credentials: true }));\n\n// TG-PLATFORM-004: No explicit JSON body size limit\napp.use(express.json());\n\nconst users = [\n  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },\n  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },\n];\n\n// TG-RATE-001: No rate limit on login\n// TG-AUTH-001: Plaintext password comparison\n// TG-SEC-004: Logs sensitive data\n// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)\napp.post('/api/login', authLimiter, (req, res) => {\n  const { email, password } = req.body;\n  console.log('Login attempt:', { email, password }); // TG-SEC-004\n  const user = users.find((u) => u.email === email && u.password === password);\n  if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration\n  const token = jwt.sign({ id: user.id }, JWT_SECRET);\n  res.cookie('token', token);\n  res.json({ message: 'ok', token, user });\n});\n\n// TG-AUTH-003: IDOR \u2014 no ownership check\napp.get('/api/users/:id', (req, res) => {\n  const user = users.find((u) => u.id === req.params.id);\n  if (!user) return res.status(404).json({ error: 'Not found' });\n  res.json(user);\n});\n\n// TG-INPUT-002: SQL concatenation (simulated query string)\n// TG-RATE-003: Unbounded results\napp.get('/api/search', (req, res) => {\n  const q = req.query.q || '';\n  const fakeSql = `SELECT * FROM users WHERE email LIKE '%${q}%'`;\n  const results = users.filter((u) => u.email.includes(q));\n  res.json({ query: fakeSql, results });\n});\n\n// TG-INPUT-001: No validation\n// TG-RATE-002: Unlimited contact endpoint\napp.post('/api/contact', (req, res) => {\n  res.json({ received: req.body });\n});\n\n// TG-RATE-002: Unlimited AI endpoint\napp.post('/api/ai', (req, res) => {\n  res.json({ reply: 'demo', prompt: req.body.prompt });\n});\n\n// TG-INPUT-004: Unrestricted upload (stub)\napp.post('/api/upload', (req, res) => {\n  res.json({ saved: req.body.filename });\n});\n\n// TG-AUTH-005: Unsafe password reset\napp.post('/api/reset', (req, res) => {\n  const { email } = req.body;\n  const user = users.find((u) => u.email === email);\n  if (!user) return res.status(404).json({ error: 'Email not registered' }); // enumeration\n  const token = `reset-${user.id}-12345`; // predictable\n  res.json({ resetToken: token });\n});\n\napp.use((err, req, res, next) => {\n  // TG-PLATFORM-003: Stack trace exposed\n  res.status(500).json({ error: err.message, stack: err.stack });\n});\n\napp.listen(PORT, () => console.log(`Vulnerable demo server http://localhost:${PORT}`));"
+}

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-rate-001-26-affcfa/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-rate-001-26-affcfa
+- **Rule ID:** `TG-RATE-001`
+- **Target File:** `examples/vulnerable-react-express/server/index.js:26`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Injected authLimiter rate-limiting middleware to protect authentication endpoint from brute force
+
+## Unified Diff Preview
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -24,5 +24,5 @@
+ // TG-SEC-004: Logs sensitive data
+ // TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)
+-app.post('/api/login', (req, res) => {
++app.post('/api/login', authLimiter, (req, res) => {
+   const { email, password } = req.body;
+   console.log('Login attempt:', { email, password }); // TG-SEC-004
+
+```

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-rate-001-26-affcfa/patch.diff

@@ -0,0 +1,9 @@
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -24,5 +24,5 @@
+ // TG-SEC-004: Logs sensitive data
+ // TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)
+-app.post('/api/login', (req, res) => {
++app.post('/api/login', authLimiter, (req, res) => {
+   const { email, password } = req.body;
+   console.log('Login attempt:', { email, password }); // TG-SEC-004

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-rate-002-54-0b38d2/metadata.json

@@ -0,0 +1,17 @@
+{
+  "bundle_id": "bnd-tg-rate-002-54-0b38d2",
+  "finding_id": "TG-RATE-002-d67d7c98",
+  "rule_id": "TG-RATE-002",
+  "title": "Unlimited Public Write Endpoint",
+  "target_file": "examples/vulnerable-react-express/server/index.js",
+  "line_number": 54,
+  "target_line": "app.post('/api/contact', (req, res) => {",
+  "replacement_line": "app.post('/api/contact', writeLimiter, (req, res) => {",
+  "what_is_wrong": "Public submission endpoint defined without rate-limiting or captcha defense",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Injected writeLimiter rate-limiting middleware to public write endpoint",
+  "proposed_diff": "--- a/examples/vulnerable-react-express/server/index.js\n+++ b/examples/vulnerable-react-express/server/index.js\n@@ -52,5 +52,5 @@\n // TG-INPUT-001: No validation\n // TG-RATE-002: Unlimited contact endpoint\n-app.post('/api/contact', (req, res) => {\n+app.post('/api/contact', writeLimiter, (req, res) => {\n   res.json({ received: req.body });\n });\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "const express = require('express');\nconst cors = require('cors');\nconst jwt = require('jsonwebtoken');\n\nconst app = express();\nconst PORT = 3001;\n\n// TG-SEC-001: Hardcoded JWT secret\nconst JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';\n\n// TG-PLATFORM-001: Wildcard CORS with credentials\napp.use(cors({ origin: '*', credentials: true }));\n\n// TG-PLATFORM-004: No explicit JSON body size limit\napp.use(express.json());\n\nconst users = [\n  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },\n  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },\n];\n\n// TG-RATE-001: No rate limit on login\n// TG-AUTH-001: Plaintext password comparison\n// TG-SEC-004: Logs sensitive data\n// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)\napp.post('/api/login', (req, res) => {\n  const { email, password } = req.body;\n  console.log('Login attempt:', { email, password }); // TG-SEC-004\n  const user = users.find((u) => u.email === email && u.password === password);\n  if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration\n  const token = jwt.sign({ id: user.id }, JWT_SECRET);\n  res.cookie('token', token);\n  res.json({ message: 'ok', token, user });\n});\n\n// TG-AUTH-003: IDOR \u2014 no ownership check\napp.get('/api/users/:id', (req, res) => {\n  const user = users.find((u) => u.id === req.params.id);\n  if (!user) return res.status(404).json({ error: 'Not found' });\n  res.json(user);\n});\n\n// TG-INPUT-002: SQL concatenation (simulated query string)\n// TG-RATE-003: Unbounded results\napp.get('/api/search', (req, res) => {\n  const q = req.query.q || '';\n  const fakeSql = `SELECT * FROM users WHERE email LIKE '%${q}%'`;\n  const results = users.filter((u) => u.email.includes(q));\n  res.json({ query: fakeSql, results });\n});\n\n// TG-INPUT-001: No validation\n// TG-RATE-002: Unlimited contact endpoint\napp.post('/api/contact', writeLimiter, (req, res) => {\n  res.json({ received: req.body });\n});\n\n// TG-RATE-002: Unlimited AI endpoint\napp.post('/api/ai', (req, res) => {\n  res.json({ reply: 'demo', prompt: req.body.prompt });\n});\n\n// TG-INPUT-004: Unrestricted upload (stub)\napp.post('/api/upload', (req, res) => {\n  res.json({ saved: req.body.filename });\n});\n\n// TG-AUTH-005: Unsafe password reset\napp.post('/api/reset', (req, res) => {\n  const { email } = req.body;\n  const user = users.find((u) => u.email === email);\n  if (!user) return res.status(404).json({ error: 'Email not registered' }); // enumeration\n  const token = `reset-${user.id}-12345`; // predictable\n  res.json({ resetToken: token });\n});\n\napp.use((err, req, res, next) => {\n  // TG-PLATFORM-003: Stack trace exposed\n  res.status(500).json({ error: err.message, stack: err.stack });\n});\n\napp.listen(PORT, () => console.log(`Vulnerable demo server http://localhost:${PORT}`));"
+}

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-rate-002-54-0b38d2/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-rate-002-54-0b38d2
+- **Rule ID:** `TG-RATE-002`
+- **Target File:** `examples/vulnerable-react-express/server/index.js:54`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Injected writeLimiter rate-limiting middleware to public write endpoint
+
+## Unified Diff Preview
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -52,5 +52,5 @@
+ // TG-INPUT-001: No validation
+ // TG-RATE-002: Unlimited contact endpoint
+-app.post('/api/contact', (req, res) => {
++app.post('/api/contact', writeLimiter, (req, res) => {
+   res.json({ received: req.body });
+ });
+
+```

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-rate-002-54-0b38d2/patch.diff

@@ -0,0 +1,9 @@
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -52,5 +52,5 @@
+ // TG-INPUT-001: No validation
+ // TG-RATE-002: Unlimited contact endpoint
+-app.post('/api/contact', (req, res) => {
++app.post('/api/contact', writeLimiter, (req, res) => {
+   res.json({ received: req.body });
+ });

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-sec-001-18-a3c1e8/metadata.json

@@ -0,0 +1,17 @@
+{
+  "bundle_id": "bnd-tg-sec-001-18-a3c1e8",
+  "finding_id": "TG-SEC-001-c393d596",
+  "rule_id": "TG-SEC-001",
+  "title": "Hardcoded Secret or API Key in Tracked Source",
+  "target_file": "examples/vulnerable-react-express/server/index.js",
+  "line_number": 18,
+  "target_line": "  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },",
+  "replacement_line": "  { id: '1', email: 'alice@demo.local', password: process.env.DEMO_USER_PASSWORD || \"REDACTED_PASSWORD\", name: 'Alice' },",
+  "what_is_wrong": "Hardcoded credential or API secret string",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Replaced hardcoded password with environment variable process.env.DEMO_USER_PASSWORD",
+  "proposed_diff": "--- a/examples/vulnerable-react-express/server/index.js\n+++ b/examples/vulnerable-react-express/server/index.js\n@@ -16,5 +16,5 @@\n \n const users = [\n-  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },\n+  { id: '1', email: 'alice@demo.local', password: process.env.DEMO_USER_PASSWORD || \"REDACTED_PASSWORD\", name: 'Alice' },\n   { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },\n ];\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "const express = require('express');\nconst cors = require('cors');\nconst jwt = require('jsonwebtoken');\n\nconst app = express();\nconst PORT = 3001;\n\n// TG-SEC-001: Hardcoded JWT secret\nconst JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';\n\n// TG-PLATFORM-001: Wildcard CORS with credentials\napp.use(cors({ origin: '*', credentials: true }));\n\n// TG-PLATFORM-004: No explicit JSON body size limit\napp.use(express.json());\n\nconst users = [\n  { id: '1', email: 'alice@demo.local', password: process.env.DEMO_USER_PASSWORD || \"REDACTED_PASSWORD\", name: 'Alice' },\n  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },\n];\n\n// TG-RATE-001: No rate limit on login\n// TG-AUTH-001: Plaintext password comparison\n// TG-SEC-004: Logs sensitive data\n// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)\napp.post('/api/login', (req, res) => {\n  const { email, password } = req.body;\n  console.log('Login attempt:', { email, password }); // TG-SEC-004\n  const user = users.find((u) => u.email === email && u.password === password);\n  if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration\n  const token = jwt.sign({ id: user.id }, JWT_SECRET);\n  res.cookie('token', token);\n  res.json({ message: 'ok', token, user });\n});\n\n// TG-AUTH-003: IDOR \u2014 no ownership check\napp.get('/api/users/:id', (req, res) => {\n  const user = users.find((u) => u.id === req.params.id);\n  if (!user) return res.status(404).json({ error: 'Not found' });\n  res.json(user);\n});\n\n// TG-INPUT-002: SQL concatenation (simulated query string)\n// TG-RATE-003: Unbounded results\napp.get('/api/search', (req, res) => {\n  const q = req.query.q || '';\n  const fakeSql = `SELECT * FROM users WHERE email LIKE '%${q}%'`;\n  const results = users.filter((u) => u.email.includes(q));\n  res.json({ query: fakeSql, results });\n});\n\n// TG-INPUT-001: No validation\n// TG-RATE-002: Unlimited contact endpoint\napp.post('/api/contact', (req, res) => {\n  res.json({ received: req.body });\n});\n\n// TG-RATE-002: Unlimited AI endpoint\napp.post('/api/ai', (req, res) => {\n  res.json({ reply: 'demo', prompt: req.body.prompt });\n});\n\n// TG-INPUT-004: Unrestricted upload (stub)\napp.post('/api/upload', (req, res) => {\n  res.json({ saved: req.body.filename });\n});\n\n// TG-AUTH-005: Unsafe password reset\napp.post('/api/reset', (req, res) => {\n  const { email } = req.body;\n  const user = users.find((u) => u.email === email);\n  if (!user) return res.status(404).json({ error: 'Email not registered' }); // enumeration\n  const token = `reset-${user.id}-12345`; // predictable\n  res.json({ resetToken: token });\n});\n\napp.use((err, req, res, next) => {\n  // TG-PLATFORM-003: Stack trace exposed\n  res.status(500).json({ error: err.message, stack: err.stack });\n});\n\napp.listen(PORT, () => console.log(`Vulnerable demo server http://localhost:${PORT}`));"
+}

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-sec-001-18-a3c1e8/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-sec-001-18-a3c1e8
+- **Rule ID:** `TG-SEC-001`
+- **Target File:** `examples/vulnerable-react-express/server/index.js:18`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Replaced hardcoded password with environment variable process.env.DEMO_USER_PASSWORD
+
+## Unified Diff Preview
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -16,5 +16,5 @@
+ 
+ const users = [
+-  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },
++  { id: '1', email: 'alice@demo.local', password: process.env.DEMO_USER_PASSWORD || "REDACTED_PASSWORD", name: 'Alice' },
+   { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },
+ ];
+
+```

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-sec-001-18-a3c1e8/patch.diff

@@ -0,0 +1,9 @@
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -16,5 +16,5 @@
+ 
+ const users = [
+-  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },
++  { id: '1', email: 'alice@demo.local', password: process.env.DEMO_USER_PASSWORD || "REDACTED_PASSWORD", name: 'Alice' },
+   { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },
+ ];

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-sec-001-9-e22e50/metadata.json

@@ -0,0 +1,17 @@
+{
+  "bundle_id": "bnd-tg-sec-001-9-e22e50",
+  "finding_id": "TG-SEC-001-bb5e4b77",
+  "rule_id": "TG-SEC-001",
+  "title": "Hardcoded Secret or API Key in Tracked Source",
+  "target_file": "examples/vulnerable-react-express/server/index.js",
+  "line_number": 9,
+  "target_line": "const JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';",
+  "replacement_line": "const JWT_SECRET = process.env.JWT_SECRET || \"\";",
+  "what_is_wrong": "Hardcoded JWT signing secret",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Migrated hardcoded JWT secret to environment variable process.env.JWT_SECRET",
+  "proposed_diff": "--- a/examples/vulnerable-react-express/server/index.js\n+++ b/examples/vulnerable-react-express/server/index.js\n@@ -7,5 +7,5 @@\n \n // TG-SEC-001: Hardcoded JWT secret\n-const JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';\n+const JWT_SECRET = process.env.JWT_SECRET || \"\";\n \n // TG-PLATFORM-001: Wildcard CORS with credentials\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "const express = require('express');\nconst cors = require('cors');\nconst jwt = require('jsonwebtoken');\n\nconst app = express();\nconst PORT = 3001;\n\n// TG-SEC-001: Hardcoded JWT secret\nconst JWT_SECRET = process.env.JWT_SECRET || \"\";\n\n// TG-PLATFORM-001: Wildcard CORS with credentials\napp.use(cors({ origin: '*', credentials: true }));\n\n// TG-PLATFORM-004: No explicit JSON body size limit\napp.use(express.json());\n\nconst users = [\n  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },\n  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },\n];\n\n// TG-RATE-001: No rate limit on login\n// TG-AUTH-001: Plaintext password comparison\n// TG-SEC-004: Logs sensitive data\n// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)\napp.post('/api/login', (req, res) => {\n  const { email, password } = req.body;\n  console.log('Login attempt:', { email, password }); // TG-SEC-004\n  const user = users.find((u) => u.email === email && u.password === password);\n  if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration\n  const token = jwt.sign({ id: user.id }, JWT_SECRET);\n  res.cookie('token', token);\n  res.json({ message: 'ok', token, user });\n});\n\n// TG-AUTH-003: IDOR \u2014 no ownership check\napp.get('/api/users/:id', (req, res) => {\n  const user = users.find((u) => u.id === req.params.id);\n  if (!user) return res.status(404).json({ error: 'Not found' });\n  res.json(user);\n});\n\n// TG-INPUT-002: SQL concatenation (simulated query string)\n// TG-RATE-003: Unbounded results\napp.get('/api/search', (req, res) => {\n  const q = req.query.q || '';\n  const fakeSql = `SELECT * FROM users WHERE email LIKE '%${q}%'`;\n  const results = users.filter((u) => u.email.includes(q));\n  res.json({ query: fakeSql, results });\n});\n\n// TG-INPUT-001: No validation\n// TG-RATE-002: Unlimited contact endpoint\napp.post('/api/contact', (req, res) => {\n  res.json({ received: req.body });\n});\n\n// TG-RATE-002: Unlimited AI endpoint\napp.post('/api/ai', (req, res) => {\n  res.json({ reply: 'demo', prompt: req.body.prompt });\n});\n\n// TG-INPUT-004: Unrestricted upload (stub)\napp.post('/api/upload', (req, res) => {\n  res.json({ saved: req.body.filename });\n});\n\n// TG-AUTH-005: Unsafe password reset\napp.post('/api/reset', (req, res) => {\n  const { email } = req.body;\n  const user = users.find((u) => u.email === email);\n  if (!user) return res.status(404).json({ error: 'Email not registered' }); // enumeration\n  const token = `reset-${user.id}-12345`; // predictable\n  res.json({ resetToken: token });\n});\n\napp.use((err, req, res, next) => {\n  // TG-PLATFORM-003: Stack trace exposed\n  res.status(500).json({ error: err.message, stack: err.stack });\n});\n\napp.listen(PORT, () => console.log(`Vulnerable demo server http://localhost:${PORT}`));"
+}

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-sec-001-9-e22e50/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-sec-001-9-e22e50
+- **Rule ID:** `TG-SEC-001`
+- **Target File:** `examples/vulnerable-react-express/server/index.js:9`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Migrated hardcoded JWT secret to environment variable process.env.JWT_SECRET
+
+## Unified Diff Preview
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -7,5 +7,5 @@
+ 
+ // TG-SEC-001: Hardcoded JWT secret
+-const JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';
++const JWT_SECRET = process.env.JWT_SECRET || "";
+ 
+ // TG-PLATFORM-001: Wildcard CORS with credentials
+
+```

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-sec-001-9-e22e50/patch.diff

@@ -0,0 +1,9 @@
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -7,5 +7,5 @@
+ 
+ // TG-SEC-001: Hardcoded JWT secret
+-const JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';
++const JWT_SECRET = process.env.JWT_SECRET || "";
+ 
+ // TG-PLATFORM-001: Wildcard CORS with credentials

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-sec-004-28-a1a0a1/metadata.json

@@ -0,0 +1,17 @@
+{
+  "bundle_id": "bnd-tg-sec-004-28-a1a0a1",
+  "finding_id": "TG-SEC-004-08753da5",
+  "rule_id": "TG-SEC-004",
+  "title": "Sensitive Information in Logs",
+  "target_file": "examples/vulnerable-react-express/server/index.js",
+  "line_number": 28,
+  "target_line": "  console.log('Login attempt:', { email, password }); // TG-SEC-004",
+  "replacement_line": "  // Security: Sensitive credential log removed per TG-SEC-004",
+  "what_is_wrong": "Plaintext credential or token logged to output sink",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Redacted console logging of sensitive token or credential",
+  "proposed_diff": "--- a/examples/vulnerable-react-express/server/index.js\n+++ b/examples/vulnerable-react-express/server/index.js\n@@ -26,5 +26,5 @@\n app.post('/api/login', (req, res) => {\n   const { email, password } = req.body;\n-  console.log('Login attempt:', { email, password }); // TG-SEC-004\n+  // Security: Sensitive credential log removed per TG-SEC-004\n   const user = users.find((u) => u.email === email && u.password === password);\n   if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "const express = require('express');\nconst cors = require('cors');\nconst jwt = require('jsonwebtoken');\n\nconst app = express();\nconst PORT = 3001;\n\n// TG-SEC-001: Hardcoded JWT secret\nconst JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';\n\n// TG-PLATFORM-001: Wildcard CORS with credentials\napp.use(cors({ origin: '*', credentials: true }));\n\n// TG-PLATFORM-004: No explicit JSON body size limit\napp.use(express.json());\n\nconst users = [\n  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },\n  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },\n];\n\n// TG-RATE-001: No rate limit on login\n// TG-AUTH-001: Plaintext password comparison\n// TG-SEC-004: Logs sensitive data\n// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)\napp.post('/api/login', (req, res) => {\n  const { email, password } = req.body;\n  // Security: Sensitive credential log removed per TG-SEC-004\n  const user = users.find((u) => u.email === email && u.password === password);\n  if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration\n  const token = jwt.sign({ id: user.id }, JWT_SECRET);\n  res.cookie('token', token);\n  res.json({ message: 'ok', token, user });\n});\n\n// TG-AUTH-003: IDOR \u2014 no ownership check\napp.get('/api/users/:id', (req, res) => {\n  const user = users.find((u) => u.id === req.params.id);\n  if (!user) return res.status(404).json({ error: 'Not found' });\n  res.json(user);\n});\n\n// TG-INPUT-002: SQL concatenation (simulated query string)\n// TG-RATE-003: Unbounded results\napp.get('/api/search', (req, res) => {\n  const q = req.query.q || '';\n  const fakeSql = `SELECT * FROM users WHERE email LIKE '%${q}%'`;\n  const results = users.filter((u) => u.email.includes(q));\n  res.json({ query: fakeSql, results });\n});\n\n// TG-INPUT-001: No validation\n// TG-RATE-002: Unlimited contact endpoint\napp.post('/api/contact', (req, res) => {\n  res.json({ received: req.body });\n});\n\n// TG-RATE-002: Unlimited AI endpoint\napp.post('/api/ai', (req, res) => {\n  res.json({ reply: 'demo', prompt: req.body.prompt });\n});\n\n// TG-INPUT-004: Unrestricted upload (stub)\napp.post('/api/upload', (req, res) => {\n  res.json({ saved: req.body.filename });\n});\n\n// TG-AUTH-005: Unsafe password reset\napp.post('/api/reset', (req, res) => {\n  const { email } = req.body;\n  const user = users.find((u) => u.email === email);\n  if (!user) return res.status(404).json({ error: 'Email not registered' }); // enumeration\n  const token = `reset-${user.id}-12345`; // predictable\n  res.json({ resetToken: token });\n});\n\napp.use((err, req, res, next) => {\n  // TG-PLATFORM-003: Stack trace exposed\n  res.status(500).json({ error: err.message, stack: err.stack });\n});\n\napp.listen(PORT, () => console.log(`Vulnerable demo server http://localhost:${PORT}`));"
+}

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-sec-004-28-a1a0a1/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-sec-004-28-a1a0a1
+- **Rule ID:** `TG-SEC-004`
+- **Target File:** `examples/vulnerable-react-express/server/index.js:28`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Redacted console logging of sensitive token or credential
+
+## Unified Diff Preview
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -26,5 +26,5 @@
+ app.post('/api/login', (req, res) => {
+   const { email, password } = req.body;
+-  console.log('Login attempt:', { email, password }); // TG-SEC-004
++  // Security: Sensitive credential log removed per TG-SEC-004
+   const user = users.find((u) => u.email === email && u.password === password);
+   if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration
+
+```

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-sec-004-28-a1a0a1/patch.diff

@@ -0,0 +1,9 @@
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -26,5 +26,5 @@
+ app.post('/api/login', (req, res) => {
+   const { email, password } = req.body;
+-  console.log('Login attempt:', { email, password }); // TG-SEC-004
++  // Security: Sensitive credential log removed per TG-SEC-004
+   const user = users.find((u) => u.email === email && u.password === password);
+   if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-sec-004-30-00569e/metadata.json

@@ -0,0 +1,17 @@
+{
+  "bundle_id": "bnd-tg-sec-004-30-00569e",
+  "finding_id": "TG-SEC-004-dbbc17f7",
+  "rule_id": "TG-SEC-004",
+  "title": "Sensitive Information in Logs",
+  "target_file": "examples/vulnerable-react-express/client/src/App.jsx",
+  "line_number": 30,
+  "target_line": "    console.log('Login token:', data.token, 'config:', clientConfig);",
+  "replacement_line": "    // Security: Sensitive credential log removed per TG-SEC-004",
+  "what_is_wrong": "Plaintext credential or token logged to output sink",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Redacted console logging of sensitive token or credential",
+  "proposed_diff": "--- a/examples/vulnerable-react-express/client/src/App.jsx\n+++ b/examples/vulnerable-react-express/client/src/App.jsx\n@@ -28,5 +28,5 @@\n     const data = await res.json();\n     // TG-CLIENT-002: Sensitive console logging\n-    console.log('Login token:', data.token, 'config:', clientConfig);\n+    // Security: Sensitive credential log removed per TG-SEC-004\n     setMessage(JSON.stringify(data));\n   }\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "import { useState } from 'react';\nimport { clientConfig } from './config';\n\n// TG-DB-001: SQL query construction in frontend (never do this)\nfunction buildSearchQuery(email) {\n  return `SELECT id, email FROM users WHERE email LIKE '%${email}%'`;\n}\n\n// TG-DB-003: Documented anti-pattern \u2014 Prisma must never run in browser\n// import { PrismaClient } from '@prisma/client'; // FORBIDDEN in client\n\nexport default function App() {\n  const [email, setEmail] = useState('');\n  const [password, setPassword] = useState('');\n  const [bio, setBio] = useState('<img src=x onerror=alert(1)>');\n  const [userId, setUserId] = useState('1');\n  const [isAdmin] = useState(localStorage.getItem('role') === 'admin'); // TG-AUTH-002\n  const [message, setMessage] = useState('');\n\n  async function login(e) {\n    e.preventDefault();\n    const res = await fetch('/api/login', {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      credentials: 'include',\n      body: JSON.stringify({ email, password }),\n    });\n    const data = await res.json();\n    // TG-CLIENT-002: Sensitive console logging\n    // Security: Sensitive credential log removed per TG-SEC-004\n    setMessage(JSON.stringify(data));\n  }\n\n  async function fetchUser() {\n    const res = await fetch(`/api/users/${userId}`);\n    setMessage(await res.text());\n  }\n\n  return (\n    <div style={{ maxWidth: 560, margin: '2rem auto', fontFamily: 'sans-serif' }}>\n      <h1>Vulnerable Demo</h1>\n      <p style={{ color: 'crimson' }}>Intentionally insecure \u2014 localhost lab only</p>\n\n      <form onSubmit={login}>\n        <input value={email} onChange={(e) => setEmail(e.target.value)} placeholder=\"email\" />\n        <input value={password} onChange={(e) => setPassword(e.target.value)} placeholder=\"password\" type=\"password\" />\n        <button type=\"submit\">Login</button>\n      </form>\n\n      <p>Frontend SQL preview: {buildSearchQuery(email)}</p>\n\n      {/* TG-INPUT-003: Unsafe HTML rendering */}\n      <div dangerouslySetInnerHTML={{ __html: bio }} />\n\n      <button onClick={fetchUser}>Fetch user (IDOR demo)</button>\n\n      {/* TG-AUTH-002: Client-only admin gate */}\n      {isAdmin && <section><h2>Admin Panel</h2><p>Visible if localStorage role=admin \u2014 not real security</p></section>}\n\n      {message && <pre>{message}</pre>}\n    </div>\n  );\n}"
+}

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-sec-004-30-00569e/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-sec-004-30-00569e
+- **Rule ID:** `TG-SEC-004`
+- **Target File:** `examples/vulnerable-react-express/client/src/App.jsx:30`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Redacted console logging of sensitive token or credential
+
+## Unified Diff Preview
+```diff
+--- a/examples/vulnerable-react-express/client/src/App.jsx
++++ b/examples/vulnerable-react-express/client/src/App.jsx
+@@ -28,5 +28,5 @@
+     const data = await res.json();
+     // TG-CLIENT-002: Sensitive console logging
+-    console.log('Login token:', data.token, 'config:', clientConfig);
++    // Security: Sensitive credential log removed per TG-SEC-004
+     setMessage(JSON.stringify(data));
+   }
+
+```

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-sec-004-30-00569e/patch.diff

@@ -0,0 +1,9 @@
+--- a/examples/vulnerable-react-express/client/src/App.jsx
++++ b/examples/vulnerable-react-express/client/src/App.jsx
+@@ -28,5 +28,5 @@
+     const data = await res.json();
+     // TG-CLIENT-002: Sensitive console logging
+-    console.log('Login token:', data.token, 'config:', clientConfig);
++    // Security: Sensitive credential log removed per TG-SEC-004
+     setMessage(JSON.stringify(data));
+   }

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-ssrf-004-9-9803ad/metadata.json

@@ -0,0 +1,17 @@
+{
+  "bundle_id": "bnd-tg-ssrf-004-9-9803ad",
+  "finding_id": "TG-SSRF-004-d8472223",
+  "rule_id": "TG-SSRF-004",
+  "title": "Unbounded Outbound Request Without Timeout",
+  "target_file": "examples/python/fastapi-vuln/main.py",
+  "line_number": 9,
+  "target_line": "    response = requests.get(url)",
+  "replacement_line": "    response = requests.get(url, timeout=10)",
+  "what_is_wrong": "Python requests call without explicit timeout parameter",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Injected explicit 10-second request timeout to prevent resource exhaustion",
+  "proposed_diff": "--- a/examples/python/fastapi-vuln/main.py\n+++ b/examples/python/fastapi-vuln/main.py\n@@ -7,5 +7,5 @@\n @app.get(\"/fetch\")\n def fetch_url(url: str):\n-    response = requests.get(url)\n+    response = requests.get(url, timeout=10)\n     return {\"status\": response.status_code, \"content\": response.text}\n \n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "from fastapi import FastAPI\nimport requests\n\napp = FastAPI()\n\n# \u274c TG-SSRF-001: Unvalidated outbound URL fetching\n@app.get(\"/fetch\")\ndef fetch_url(url: str):\n    response = requests.get(url, timeout=10)\n    return {\"status\": response.status_code, \"content\": response.text}\n\n# \u274c TG-WEBHOOK-001: Unverified webhook payload\n@app.post(\"/webhook\")\ndef receive_webhook(payload: dict):\n    return {\"status\": \"success\", \"data\": payload}\n\n# \u274c TG-AUTH-006: Unfiltered dict mass assignment\n@app.post(\"/update_profile\")\ndef update_profile(user_id: int, updates: dict):\n    return {\"status\": \"updated\", \"user_id\": user_id, \"updates\": updates}"
+}

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-ssrf-004-9-9803ad/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-ssrf-004-9-9803ad
+- **Rule ID:** `TG-SSRF-004`
+- **Target File:** `examples/python/fastapi-vuln/main.py:9`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Injected explicit 10-second request timeout to prevent resource exhaustion
+
+## Unified Diff Preview
+```diff
+--- a/examples/python/fastapi-vuln/main.py
++++ b/examples/python/fastapi-vuln/main.py
+@@ -7,5 +7,5 @@
+ @app.get("/fetch")
+ def fetch_url(url: str):
+-    response = requests.get(url)
++    response = requests.get(url, timeout=10)
+     return {"status": response.status_code, "content": response.text}
+ 
+
+```

package/.torusguard/runs/run-20260912-215731-audit/bundles/bnd-tg-ssrf-004-9-9803ad/patch.diff

@@ -0,0 +1,9 @@
+--- a/examples/python/fastapi-vuln/main.py
++++ b/examples/python/fastapi-vuln/main.py
+@@ -7,5 +7,5 @@
+ @app.get("/fetch")
+ def fetch_url(url: str):
+-    response = requests.get(url)
++    response = requests.get(url, timeout=10)
+     return {"status": response.status_code, "content": response.text}
+