torusguard 1.3.4 → 1.3.5

package/.torusguard/scripts/term_ui.py

@@ -1,162 +1,162 @@
-#!/usr/bin/env python3
-"""
-TorusGuard Unified Terminal UI Engine (v1.3.3)
-Provides mathematically exact 75-column card formatting, ANSI-stripping,
-Unicode/emoji visual width calculation, and visual truncation with ellipsis.
-Pure Python 3.10+ standard library (zero external dependencies).
-"""
-
-import sys
-import os
-import re
-import unicodedata
-from typing import Optional
-
-# Ensure UTF-8 stdout/stderr on Windows consoles
-if sys.stdout and hasattr(sys.stdout, "reconfigure"):
-    try:
-        getattr(sys.stdout, "reconfigure")(encoding="utf-8", errors="replace")
-    except Exception:
-        pass
-if sys.stderr and hasattr(sys.stderr, "reconfigure"):
-    try:
-        getattr(sys.stderr, "reconfigure")(encoding="utf-8", errors="replace")
-    except Exception:
-        pass
-
-# ─── ANSI Colors & Styles ─────────────────────────────────────────────────────
-BOLD = "\033[1m"
-DIM = "\033[2m"
-RESET = "\033[0m"
-CYAN = "\033[36m"
-GREEN = "\033[32m"
-YELLOW = "\033[33m"
-WHITE = "\033[97m"
-GRAY = "\033[90m"
-RED = "\033[31m"
-MAGENTA = "\033[35m"
-BG_GREEN = "\033[42m"
-BG_CYAN = "\033[46m"
-
-ANSI_REGEX = re.compile(r'\x1b\[[0-9;]*m|\033\[[0-9;]*m')
-
-def strip_ansi(text: str) -> str:
-    """Remove all ANSI color and style escape sequences."""
-    return ANSI_REGEX.sub('', text)
-
-def get_visual_width(text: str) -> int:
-    """
-    Calculate the printable display width of a string in terminal columns.
-    Accounts for ANSI escapes, Unicode variation selectors, emojis, and fullwidth chars.
-    """
-    clean = strip_ansi(text)
-    width = 0
-    for ch in clean:
-        cp = ord(ch)
-        # Variation selectors (VS1-16, VS17-256) occupy 0 terminal columns
-        if (0xFE00 <= cp <= 0xFE0F) or (0xE0100 <= cp <= 0xE01EF):
-            continue
-        # Zero-width spaces, joiners, soft hyphens
-        if cp in (0x200B, 0x200C, 0x200D, 0x00AD):
-            continue
-        ea = unicodedata.east_asian_width(ch)
-        if ea in ('W', 'F'):
-            width += 2
-        elif cp >= 0x1F300: # Emojis and miscellaneous pictographs
-            width += 2
-        elif cp in (0x26A0, 0x2714, 0x2716, 0x2139): # ⚠, ✔, ✖, ℹ
-            width += 1
-        else:
-            width += 1
-    return width
-
-def truncate_visual(text: str, max_w: int = 67) -> str:
-    """Truncate text visually to max_w columns without breaking ANSI escape codes."""
-    if get_visual_width(text) <= max_w:
-        return text
-    out = []
-    curr_w = 0
-    in_ansi = False
-    ansi_buf = ''
-    for ch in text:
-        if ch in ('\033', '\x1b'):
-            in_ansi = True
-            ansi_buf = ch
-            continue
-        if in_ansi:
-            ansi_buf += ch
-            if ch == 'm':
-                in_ansi = False
-                out.append(ansi_buf)
-            continue
-        cp = ord(ch)
-        if (0xFE00 <= cp <= 0xFE0F) or (0xE0100 <= cp <= 0xE01EF) or cp in (0x200B, 0x200C, 0x200D, 0x00AD):
-            out.append(ch)
-            continue
-        ea = unicodedata.east_asian_width(ch)
-        cw = 2 if (ea in ('W', 'F') or cp >= 0x1F300) else 1
-        if curr_w + cw > max_w - 3:
-            out.append(RESET + '...')
-            curr_w += 3
-            break
-        out.append(ch)
-        curr_w += cw
-    out.append(RESET)
-    return ''.join(out)
-
-def format_box_line(content: str, width: int = 67, border: str = "│", border_color: str = CYAN) -> str:
-    """
-    Pad content so the card line is strictly 75 visual columns total width.
-    Layout: '  ' (2) + border (1) + '  ' (2) + content/pad (width=67) + '  ' (2) + border (1) = 75 cols.
-    """
-    trunc = truncate_visual(content, width)
-    vis = get_visual_width(trunc)
-    pad = " " * max(0, width - vis)
-    return f"  {border_color}{border}{RESET}  {trunc}{pad}  {border_color}{border}{RESET}"
-
-def card_border_top(title: str = "", border_color: str = CYAN, double: bool = False) -> str:
-    """Generate 75-column top border (single ┌ or double ╔) with optional title."""
-    left = "╔" if double else "┌"
-    right = "╗" if double else "┐"
-    h = "═" if double else "─"
-    if title:
-        vis = get_visual_width(title)
-        rem = max(0, 68 - vis)
-        return f"  {border_color}{left}{h} {BOLD}{WHITE}{title}{RESET}{border_color} {h * rem}{right}{RESET}"
-    return f"  {border_color}{left}{h * 71}{right}{RESET}"
-
-def card_border_bottom(border_color: str = CYAN, double: bool = False) -> str:
-    """Generate 75-column bottom border (single └ or double ╚)."""
-    left = "╚" if double else "└"
-    right = "╝" if double else "┘"
-    h = "═" if double else "─"
-    return f"  {border_color}{left}{h * 71}{right}{RESET}"
-
-def card_divider(title: str = "", border_color: str = CYAN, double: bool = False) -> str:
-    """Generate 75-column divider (single ├ or double ╠) with optional title."""
-    left = "╠" if double else "├"
-    right = "╣" if double else "┤"
-    h = "═" if double else "─"
-    if title:
-        vis = get_visual_width(title)
-        rem = max(0, 68 - vis)
-        return f"  {border_color}{left}{h} {BOLD}{WHITE}{title}{RESET}{border_color} {h * rem}{right}{RESET}"
-    return f"  {border_color}{left}{h * 71}{right}{RESET}"
-
-def card_header(title: str, subtitle: str = "", version: str = "v1.3.4", border_color: str = CYAN) -> str:
-    """Generate standardized 75-column curved header box."""
-    top = f"  {border_color}╭{'─' * 71}╮{RESET}"
-    bottom = f"  {border_color}╰{'─' * 71}╯{RESET}"
-    empty = f"  {border_color}│{' ' * 71}│{RESET}"
-
-    # Calculate padding between title and version
-    title_vis = get_visual_width(title)
-    ver_vis = get_visual_width(version)
-    space_count = max(1, 67 - title_vis - ver_vis)
-    title_str = f"{BOLD}{WHITE}{title}{RESET}{' ' * space_count}{GRAY}{version}{RESET}"
-
-    lines = [top, empty, format_box_line(title_str, width=67, border_color=border_color)]
-    if subtitle:
-        lines.append(format_box_line(f"{DIM}{subtitle}{RESET}", width=67, border_color=border_color))
-    lines.extend([empty, bottom])
-    return "\n".join(lines)
+#!/usr/bin/env python3
+"""
+TorusGuard Unified Terminal UI Engine (v1.3.5)
+Provides mathematically exact 75-column card formatting, ANSI-stripping,
+Unicode/emoji visual width calculation, and visual truncation with ellipsis.
+Pure Python 3.10+ standard library (zero external dependencies).
+"""
+
+import sys
+import os
+import re
+import unicodedata
+from typing import Optional
+
+# Ensure UTF-8 stdout/stderr on Windows consoles
+if sys.stdout and hasattr(sys.stdout, "reconfigure"):
+    try:
+        getattr(sys.stdout, "reconfigure")(encoding="utf-8", errors="replace")
+    except Exception:
+        pass
+if sys.stderr and hasattr(sys.stderr, "reconfigure"):
+    try:
+        getattr(sys.stderr, "reconfigure")(encoding="utf-8", errors="replace")
+    except Exception:
+        pass
+
+# ─── ANSI Colors & Styles ─────────────────────────────────────────────────────
+BOLD = "\033[1m"
+DIM = "\033[2m"
+RESET = "\033[0m"
+CYAN = "\033[36m"
+GREEN = "\033[32m"
+YELLOW = "\033[33m"
+WHITE = "\033[97m"
+GRAY = "\033[90m"
+RED = "\033[31m"
+MAGENTA = "\033[35m"
+BG_GREEN = "\033[42m"
+BG_CYAN = "\033[46m"
+
+ANSI_REGEX = re.compile(r'\x1b\[[0-9;]*m|\033\[[0-9;]*m')
+
+def strip_ansi(text: str) -> str:
+    """Remove all ANSI color and style escape sequences."""
+    return ANSI_REGEX.sub('', text)
+
+def get_visual_width(text: str) -> int:
+    """
+    Calculate the printable display width of a string in terminal columns.
+    Accounts for ANSI escapes, Unicode variation selectors, emojis, and fullwidth chars.
+    """
+    clean = strip_ansi(text)
+    width = 0
+    for ch in clean:
+        cp = ord(ch)
+        # Variation selectors (VS1-16, VS17-256) occupy 0 terminal columns
+        if (0xFE00 <= cp <= 0xFE0F) or (0xE0100 <= cp <= 0xE01EF):
+            continue
+        # Zero-width spaces, joiners, soft hyphens
+        if cp in (0x200B, 0x200C, 0x200D, 0x00AD):
+            continue
+        ea = unicodedata.east_asian_width(ch)
+        if ea in ('W', 'F'):
+            width += 2
+        elif cp >= 0x1F300: # Emojis and miscellaneous pictographs
+            width += 2
+        elif cp in (0x26A0, 0x2714, 0x2716, 0x2139): # ⚠, ✔, ✖, ℹ
+            width += 1
+        else:
+            width += 1
+    return width
+
+def truncate_visual(text: str, max_w: int = 67) -> str:
+    """Truncate text visually to max_w columns without breaking ANSI escape codes."""
+    if get_visual_width(text) <= max_w:
+        return text
+    out = []
+    curr_w = 0
+    in_ansi = False
+    ansi_buf = ''
+    for ch in text:
+        if ch in ('\033', '\x1b'):
+            in_ansi = True
+            ansi_buf = ch
+            continue
+        if in_ansi:
+            ansi_buf += ch
+            if ch == 'm':
+                in_ansi = False
+                out.append(ansi_buf)
+            continue
+        cp = ord(ch)
+        if (0xFE00 <= cp <= 0xFE0F) or (0xE0100 <= cp <= 0xE01EF) or cp in (0x200B, 0x200C, 0x200D, 0x00AD):
+            out.append(ch)
+            continue
+        ea = unicodedata.east_asian_width(ch)
+        cw = 2 if (ea in ('W', 'F') or cp >= 0x1F300) else 1
+        if curr_w + cw > max_w - 3:
+            out.append(RESET + '...')
+            curr_w += 3
+            break
+        out.append(ch)
+        curr_w += cw
+    out.append(RESET)
+    return ''.join(out)
+
+def format_box_line(content: str, width: int = 67, border: str = "│", border_color: str = CYAN) -> str:
+    """
+    Pad content so the card line is strictly 75 visual columns total width.
+    Layout: '  ' (2) + border (1) + '  ' (2) + content/pad (width=67) + '  ' (2) + border (1) = 75 cols.
+    """
+    trunc = truncate_visual(content, width)
+    vis = get_visual_width(trunc)
+    pad = " " * max(0, width - vis)
+    return f"  {border_color}{border}{RESET}  {trunc}{pad}  {border_color}{border}{RESET}"
+
+def card_border_top(title: str = "", border_color: str = CYAN, double: bool = False) -> str:
+    """Generate 75-column top border (single ┌ or double ╔) with optional title."""
+    left = "╔" if double else "┌"
+    right = "╗" if double else "┐"
+    h = "═" if double else "─"
+    if title:
+        vis = get_visual_width(title)
+        rem = max(0, 68 - vis)
+        return f"  {border_color}{left}{h} {BOLD}{WHITE}{title}{RESET}{border_color} {h * rem}{right}{RESET}"
+    return f"  {border_color}{left}{h * 71}{right}{RESET}"
+
+def card_border_bottom(border_color: str = CYAN, double: bool = False) -> str:
+    """Generate 75-column bottom border (single └ or double ╚)."""
+    left = "╚" if double else "└"
+    right = "╝" if double else "┘"
+    h = "═" if double else "─"
+    return f"  {border_color}{left}{h * 71}{right}{RESET}"
+
+def card_divider(title: str = "", border_color: str = CYAN, double: bool = False) -> str:
+    """Generate 75-column divider (single ├ or double ╠) with optional title."""
+    left = "╠" if double else "├"
+    right = "╣" if double else "┤"
+    h = "═" if double else "─"
+    if title:
+        vis = get_visual_width(title)
+        rem = max(0, 68 - vis)
+        return f"  {border_color}{left}{h} {BOLD}{WHITE}{title}{RESET}{border_color} {h * rem}{right}{RESET}"
+    return f"  {border_color}{left}{h * 71}{right}{RESET}"
+
+def card_header(title: str, subtitle: str = "", version: str = "v1.3.4", border_color: str = CYAN) -> str:
+    """Generate standardized 75-column curved header box."""
+    top = f"  {border_color}╭{'─' * 71}╮{RESET}"
+    bottom = f"  {border_color}╰{'─' * 71}╯{RESET}"
+    empty = f"  {border_color}│{' ' * 71}│{RESET}"
+
+    # Calculate padding between title and version
+    title_vis = get_visual_width(title)
+    ver_vis = get_visual_width(version)
+    space_count = max(1, 67 - title_vis - ver_vis)
+    title_str = f"{BOLD}{WHITE}{title}{RESET}{' ' * space_count}{GRAY}{version}{RESET}"
+
+    lines = [top, empty, format_box_line(title_str, width=67, border_color=border_color)]
+    if subtitle:
+        lines.append(format_box_line(f"{DIM}{subtitle}{RESET}", width=67, border_color=border_color))
+    lines.extend([empty, bottom])
+    return "\n".join(lines)

package/.torusguard/snapshots/run-20260912-215731-audit/demo/playground/vulnerable_nextjs/actions.ts.bak

@@ -0,0 +1,24 @@
+/**
+ * TorusGuard Playground: Vulnerable Next.js Server Action Fixture
+ * Contains 2 intentional security findings for demonstration purposes:
+ *   - TG-CLIENT-001 (Leaked Service Role Key)
+ *   - TG-AUTH-003 (Unauthenticated Server Action Mutation)
+ */
+
+// Finding 1: TG-CLIENT-001 - Backend admin key exposed in client-accessible code
+export const SUPABASE_SERVICE_ROLE_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.demo_secret_token_1234567890";
+
+interface UserRecord {
+  id: string;
+  role: string;
+}
+
+// Finding 2: TG-AUTH-003 - Server Action performing state change without session check
+export async function updateUserRole(userId: string, newRole: string): Promise<{ success: boolean }> {
+  "use server";
+
+  // VULNERABLE: Lacks auth session check e.g. const session = await auth(); if (!session?.user?.isAdmin) throw ...
+  console.log(`[VULNERABLE] Updating user ${userId} to role ${newRole} without authentication check`);
+  
+  return { success: true };
+}

package/.torusguard/snapshots/run-20260912-215731-audit/examples/hardened-react-express/server/index.js.bak

@@ -0,0 +1,121 @@
+require('dotenv').config();
+const express = require('express');
+const helmet = require('helmet');
+const cors = require('cors');
+const cookieParser = require('cookie-parser');
+const rateLimit = require('express-rate-limit');
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+const crypto = require('crypto');
+const { z } = require('zod');
+
+if (!process.env.JWT_SECRET) {
+  console.error('Missing JWT_SECRET');
+  process.exit(1);
+}
+
+const app = express();
+const PORT = 3001;
+const isProd = process.env.NODE_ENV === 'production';
+
+app.use(helmet());
+app.use(cors({ origin: process.env.CLIENT_ORIGIN, credentials: true }));
+app.use(express.json({ limit: '100kb' }));
+app.use(cookieParser());
+
+const loginLimiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 5 });
+const resetLimiter = rateLimit({ windowMs: 60 * 60 * 1000, max: 3 });
+const publicWriteLimiter = rateLimit({ windowMs: 60 * 60 * 1000, max: 10 });
+
+const users = [];
+const resetTokens = new Map();
+
+async function seed() {
+  if (users.length) return;
+  const hash = await bcrypt.hash('DemoPass123!', 12);
+  users.push({ id: '1', email: 'alice@demo.local', passwordHash: hash, name: 'Alice', role: 'user' });
+  users.push({ id: '2', email: 'bob@demo.local', passwordHash: hash, name: 'Bob', role: 'user' });
+}
+
+const loginSchema = z.object({
+  email: z.string().email().max(255),
+  password: z.string().min(8).max(128),
+});
+
+function auth(req, res, next) {
+  const token = req.cookies.token;
+  if (!token) return res.status(401).json({ error: 'Unauthorized' });
+  try {
+    req.user = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] });
+    next();
+  } catch {
+    return res.status(401).json({ error: 'Unauthorized' });
+  }
+}
+
+app.post('/api/login', loginLimiter, async (req, res) => {
+  const parsed = loginSchema.safeParse(req.body);
+  if (!parsed.success) return res.status(400).json({ error: 'Invalid input' });
+  const { email, password } = parsed.data;
+  const user = users.find((u) => u.email === email);
+  if (!user || !(await bcrypt.compare(password, user.passwordHash))) {
+    return res.status(401).json({ error: 'Invalid email or password' });
+  }
+  const token = jwt.sign({ id: user.id, role: user.role }, process.env.JWT_SECRET, { expiresIn: '1h' });
+  res.cookie('token', token, {
+    httpOnly: true,
+    secure: isProd,
+    sameSite: 'lax',
+    maxAge: 3600000,
+  });
+  res.json({ message: 'Login successful' });
+});
+
+app.get('/api/users/me', auth, (req, res) => {
+  const user = users.find((u) => u.id === req.user.id);
+  if (!user) return res.status(404).json({ error: 'Not found' });
+  res.json({ id: user.id, email: user.email, name: user.name });
+});
+
+app.get('/api/search', auth, (req, res) => {
+  const q = String(req.query.q || '').slice(0, 100);
+  const results = users
+    .filter((u) => u.email.includes(q))
+    .slice(0, 20)
+    .map(({ id, email, name }) => ({ id, email, name }));
+  res.json({ results });
+});
+
+const contactSchema = z.object({ message: z.string().min(1).max(2000) });
+app.post('/api/contact', publicWriteLimiter, (req, res) => {
+  const parsed = contactSchema.safeParse(req.body);
+  if (!parsed.success) return res.status(400).json({ error: 'Invalid input' });
+  res.json({ ok: true });
+});
+
+app.post('/api/ai', auth, publicWriteLimiter, (req, res) => {
+  const prompt = String(req.body.prompt || '').slice(0, 4000);
+  res.json({ reply: 'demo response', length: prompt.length });
+});
+
+app.post('/api/reset', resetLimiter, (req, res) => {
+  const email = String(req.body.email || '');
+  const user = users.find((u) => u.email === email);
+  if (user) {
+    const token = crypto.randomBytes(32).toString('hex');
+    resetTokens.set(token, { userId: user.id, expires: Date.now() + 900000 });
+  }
+  res.json({ message: 'If an account exists, a reset link was sent.' });
+});
+
+app.get('/api/admin/stats', auth, (req, res) => {
+  if (req.user.role !== 'admin') return res.status(403).json({ error: 'Forbidden' });
+  res.json({ users: users.length });
+});
+
+app.use((err, req, res, next) => {
+  console.error('Error', { message: err.message });
+  res.status(500).json({ error: isProd ? 'Internal server error' : err.message });
+});
+
+seed().then(() => app.listen(PORT, () => console.log(`Hardened demo http://localhost:${PORT}`)));

package/.torusguard/snapshots/run-20260912-215731-audit/examples/python/fastapi-vuln/main.py.bak

@@ -0,0 +1,20 @@
+from fastapi import FastAPI
+import requests
+
+app = FastAPI()
+
+# ❌ TG-SSRF-001: Unvalidated outbound URL fetching
+@app.get("/fetch")
+def fetch_url(url: str):
+    response = requests.get(url)
+    return {"status": response.status_code, "content": response.text}
+
+# ❌ TG-WEBHOOK-001: Unverified webhook payload
+@app.post("/webhook")
+def receive_webhook(payload: dict):
+    return {"status": "success", "data": payload}
+
+# ❌ TG-AUTH-006: Unfiltered dict mass assignment
+@app.post("/update_profile")
+def update_profile(user_id: int, updates: dict):
+    return {"status": "updated", "user_id": user_id, "updates": updates}

package/.torusguard/snapshots/run-20260912-215731-audit/examples/vulnerable-react-express/client/src/App.jsx.bak

@@ -0,0 +1,63 @@
+import { useState } from 'react';
+import { clientConfig } from './config';
+
+// TG-DB-001: SQL query construction in frontend (never do this)
+function buildSearchQuery(email) {
+  return `SELECT id, email FROM users WHERE email LIKE '%${email}%'`;
+}
+
+// TG-DB-003: Documented anti-pattern — Prisma must never run in browser
+// import { PrismaClient } from '@prisma/client'; // FORBIDDEN in client
+
+export default function App() {
+  const [email, setEmail] = useState('');
+  const [password, setPassword] = useState('');
+  const [bio, setBio] = useState('<img src=x onerror=alert(1)>');
+  const [userId, setUserId] = useState('1');
+  const [isAdmin] = useState(localStorage.getItem('role') === 'admin'); // TG-AUTH-002
+  const [message, setMessage] = useState('');
+
+  async function login(e) {
+    e.preventDefault();
+    const res = await fetch('/api/login', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      credentials: 'include',
+      body: JSON.stringify({ email, password }),
+    });
+    const data = await res.json();
+    // TG-CLIENT-002: Sensitive console logging
+    console.log('Login token:', data.token, 'config:', clientConfig);
+    setMessage(JSON.stringify(data));
+  }
+
+  async function fetchUser() {
+    const res = await fetch(`/api/users/${userId}`);
+    setMessage(await res.text());
+  }
+
+  return (
+    <div style={{ maxWidth: 560, margin: '2rem auto', fontFamily: 'sans-serif' }}>
+      <h1>Vulnerable Demo</h1>
+      <p style={{ color: 'crimson' }}>Intentionally insecure — localhost lab only</p>
+
+      <form onSubmit={login}>
+        <input value={email} onChange={(e) => setEmail(e.target.value)} placeholder="email" />
+        <input value={password} onChange={(e) => setPassword(e.target.value)} placeholder="password" type="password" />
+        <button type="submit">Login</button>
+      </form>
+
+      <p>Frontend SQL preview: {buildSearchQuery(email)}</p>
+
+      {/* TG-INPUT-003: Unsafe HTML rendering */}
+      <div dangerouslySetInnerHTML={{ __html: bio }} />
+
+      <button onClick={fetchUser}>Fetch user (IDOR demo)</button>
+
+      {/* TG-AUTH-002: Client-only admin gate */}
+      {isAdmin && <section><h2>Admin Panel</h2><p>Visible if localStorage role=admin — not real security</p></section>}
+
+      {message && <pre>{message}</pre>}
+    </div>
+  );
+}

package/.torusguard/snapshots/run-20260912-215731-audit/examples/vulnerable-react-express/client/vite.config.js.bak

@@ -0,0 +1,12 @@
+import { defineConfig } from 'vite';
+import react from '@vitejs/plugin-react';
+
+// TG-CLIENT-001: Public production source maps enabled
+export default defineConfig({
+  plugins: [react()],
+  build: { sourcemap: true },
+  server: {
+    port: 5173,
+    proxy: { '/api': 'http://localhost:3001' },
+  },
+});

package/.torusguard/snapshots/run-20260912-215731-audit/examples/vulnerable-react-express/server/index.js.bak

@@ -0,0 +1,82 @@
+const express = require('express');
+const cors = require('cors');
+const jwt = require('jsonwebtoken');
+
+const app = express();
+const PORT = 3001;
+
+// TG-SEC-001: Hardcoded JWT secret
+const JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';
+
+// TG-PLATFORM-001: Wildcard CORS with credentials
+app.use(cors({ origin: '*', credentials: true }));
+
+// TG-PLATFORM-004: No explicit JSON body size limit
+app.use(express.json());
+
+const users = [
+  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },
+  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },
+];
+
+// TG-RATE-001: No rate limit on login
+// TG-AUTH-001: Plaintext password comparison
+// TG-SEC-004: Logs sensitive data
+// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)
+app.post('/api/login', (req, res) => {
+  const { email, password } = req.body;
+  console.log('Login attempt:', { email, password }); // TG-SEC-004
+  const user = users.find((u) => u.email === email && u.password === password);
+  if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration
+  const token = jwt.sign({ id: user.id }, JWT_SECRET);
+  res.cookie('token', token);
+  res.json({ message: 'ok', token, user });
+});
+
+// TG-AUTH-003: IDOR — no ownership check
+app.get('/api/users/:id', (req, res) => {
+  const user = users.find((u) => u.id === req.params.id);
+  if (!user) return res.status(404).json({ error: 'Not found' });
+  res.json(user);
+});
+
+// TG-INPUT-002: SQL concatenation (simulated query string)
+// TG-RATE-003: Unbounded results
+app.get('/api/search', (req, res) => {
+  const q = req.query.q || '';
+  const fakeSql = `SELECT * FROM users WHERE email LIKE '%${q}%'`;
+  const results = users.filter((u) => u.email.includes(q));
+  res.json({ query: fakeSql, results });
+});
+
+// TG-INPUT-001: No validation
+// TG-RATE-002: Unlimited contact endpoint
+app.post('/api/contact', (req, res) => {
+  res.json({ received: req.body });
+});
+
+// TG-RATE-002: Unlimited AI endpoint
+app.post('/api/ai', (req, res) => {
+  res.json({ reply: 'demo', prompt: req.body.prompt });
+});
+
+// TG-INPUT-004: Unrestricted upload (stub)
+app.post('/api/upload', (req, res) => {
+  res.json({ saved: req.body.filename });
+});
+
+// TG-AUTH-005: Unsafe password reset
+app.post('/api/reset', (req, res) => {
+  const { email } = req.body;
+  const user = users.find((u) => u.email === email);
+  if (!user) return res.status(404).json({ error: 'Email not registered' }); // enumeration
+  const token = `reset-${user.id}-12345`; // predictable
+  res.json({ resetToken: token });
+});
+
+app.use((err, req, res, next) => {
+  // TG-PLATFORM-003: Stack trace exposed
+  res.status(500).json({ error: err.message, stack: err.stack });
+});
+
+app.listen(PORT, () => console.log(`Vulnerable demo server http://localhost:${PORT}`));