torusguard 1.3.4 → 1.3.5

package/.torusguard/runs/run-20260912-214813-audit/findings.md

@@ -0,0 +1,422 @@
+# TorusGuard Security Audit Findings: run-20260912-214813-audit
+- Target Root: `C:\Users\Admin\Desktop\TorusGuard`
+- Total Scored Findings: `30`
+- Identified Clusters: `8`
+- Generated At: `2026-09-12 21:48:13 IST`
+
+---
+## Summary of Findings
+
+### [Critical] TG-SEC-001 - Hardcoded Secret or API Key in Tracked Source
+- **Finding ID:** `TG-SEC-001-bb5e4b77`
+- **Location:** `examples/vulnerable-react-express/server/index.js:9`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded JWT signing secret
+```
+
+// TG-SEC-001: Hardcoded JWT secret
+const JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';
+
+// TG-PLATFORM-001: Wildcard CORS with credentials
+```
+
+### [Critical] TG-SEC-001 - Hardcoded Secret or API Key in Tracked Source
+- **Finding ID:** `TG-SEC-001-c393d596`
+- **Location:** `examples/vulnerable-react-express/server/index.js:18`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+
+const users = [
+  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },
+  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },
+];
+```
+
+### [Critical] TG-SSRF-002 - Missing Internal Network Protection
+- **Finding ID:** `TG-SSRF-002-8378a839`
+- **Location:** `core/clustering.py:53`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Hardcoded internal loopback or cloud metadata endpoint target
+```
+        "cluster_id": "cluster-ssrf-network",
+        "title": "Unvalidated Outbound HTTP Requests & Network Boundary Leakage",
+        "shared_remediation_path": "Validate destination URLs against strict allowlists and block internal IP ranges (127.0.0.1, 169.254.169.254).",
+        "shared_verification_plan": "Attempt outbound requests to loopback and link-local metadata endpoints."
+    },
+```
+
+### [Critical] TG-DB-002 - Privileged Database Credential in Browser Context
+- **Finding ID:** `TG-DB-002-d9bd69df`
+- **Location:** `demo/playground/vulnerable_nextjs/actions.ts:9`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-client-leak`
+- **Description:** Service role key or raw database connection string reference in frontend code
+```
+
+// Finding 1: TG-CLIENT-001 - Backend admin key exposed in client-accessible code
+export const SUPABASE_SERVICE_ROLE_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.demo_secret_token_1234567890";
+
+interface UserRecord {
+```
+
+### [Critical] TG-SSRF-002 - Missing Internal Network Protection
+- **Finding ID:** `TG-SSRF-002-d08ed1ca`
+- **Location:** `examples/hardened-react-express/client/vite.config.js:7`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Hardcoded internal loopback or cloud metadata endpoint target
+```
+  plugins: [react()],
+  build: { sourcemap: false },
+  server: { port: 5173, proxy: { '/api': 'http://localhost:3001' } },
+});
+```
+
+### [Critical] TG-SSRF-002 - Missing Internal Network Protection
+- **Finding ID:** `TG-SSRF-002-a79cf464`
+- **Location:** `examples/hardened-react-express/server/index.js:121`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Hardcoded internal loopback or cloud metadata endpoint target
+```
+});
+
+seed().then(() => app.listen(PORT, () => console.log(`Hardened demo http://localhost:${PORT}`)));
+```
+
+### [Critical] TG-SSRF-004 - Unbounded Outbound Request Without Timeout
+- **Finding ID:** `TG-SSRF-004-dcf3f71e`
+- **Location:** `examples/python/fastapi-hardened/main.py:30`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Python requests call without explicit timeout parameter
+```
+    if not is_safe_url(url):
+        raise HTTPException(status_code=400, detail="Invalid destination address")
+    response = requests.get(url, timeout=5)
+    return {"status": response.status_code, "content": response.text}
+
+```
+
+### [Critical] TG-SSRF-004 - Unbounded Outbound Request Without Timeout
+- **Finding ID:** `TG-SSRF-004-d8472223`
+- **Location:** `examples/python/fastapi-vuln/main.py:9`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Python requests call without explicit timeout parameter
+```
+@app.get("/fetch")
+def fetch_url(url: str):
+    response = requests.get(url)
+    return {"status": response.status_code, "content": response.text}
+
+```
+
+### [Critical] TG-SSRF-002 - Missing Internal Network Protection
+- **Finding ID:** `TG-SSRF-002-3c5a7c3c`
+- **Location:** `examples/vulnerable-react-express/client/src/App.jsx:42`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Hardcoded internal loopback or cloud metadata endpoint target
+```
+    <div style={{ maxWidth: 560, margin: '2rem auto', fontFamily: 'sans-serif' }}>
+      <h1>Vulnerable Demo</h1>
+      <p style={{ color: 'crimson' }}>Intentionally insecure — localhost lab only</p>
+
+      <form onSubmit={login}>
+```
+
+### [Critical] TG-SSRF-002 - Missing Internal Network Protection
+- **Finding ID:** `TG-SSRF-002-13c81e3a`
+- **Location:** `examples/vulnerable-react-express/client/src/config.js:5`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Hardcoded internal loopback or cloud metadata endpoint target
+```
+  apiUrl: import.meta.env.VITE_API_URL,
+  // FAKE DEMO ONLY — never put real database URLs in client code
+  demoDbUrl: 'postgresql://demo:FAKE_PASSWORD@localhost:5432/demo',
+};
+```
+
+### [Critical] TG-SSRF-002 - Missing Internal Network Protection
+- **Finding ID:** `TG-SSRF-002-b0f87c06`
+- **Location:** `examples/vulnerable-react-express/client/vite.config.js:10`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Hardcoded internal loopback or cloud metadata endpoint target
+```
+  server: {
+    port: 5173,
+    proxy: { '/api': 'http://localhost:3001' },
+  },
+});
+```
+
+### [Critical] TG-SSRF-002 - Missing Internal Network Protection
+- **Finding ID:** `TG-SSRF-002-ee77c629`
+- **Location:** `examples/vulnerable-react-express/server/index.js:82`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Hardcoded internal loopback or cloud metadata endpoint target
+```
+});
+
+app.listen(PORT, () => console.log(`Vulnerable demo server http://localhost:${PORT}`));
+```
+
+### [Critical] TG-SSRF-002 - Missing Internal Network Protection
+- **Finding ID:** `TG-SSRF-002-a0d1eac8`
+- **Location:** `skills/torusguard/payload/config/scope.json:4`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Hardcoded internal loopback or cloud metadata endpoint target
+```
+  "$schema": "../schemas/authorization.schema.json",
+  "authorization": {
+    "target": "localhost",
+    "owner_confirmed": false,
+    "scope_type": "source_code_only",
+```
+
+### [Critical] TG-DIFF-001 - Accidental Security Check Bypass in Patch Additions
+- **Finding ID:** `TG-DIFF-001-7db54483`
+- **Location:** `skills/torusguard/payload/scripts/rules_sync.py:180`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled TLS certificate verification (verify=False)
+```
+
+    if not bypass_guards:
+        bypass_rule = "4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, `@csrf_exempt`, or `bypass_auth=True`."
+    else:
+        bypass_rule = f"4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, or {', '.join(bypass_guards[:2])}."
+```
+
+### [Critical] TG-DIFF-001 - Accidental Security Check Bypass in Patch Additions
+- **Finding ID:** `TG-DIFF-001-77bc2f9b`
+- **Location:** `skills/torusguard/payload/scripts/rules_sync.py:157`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
+    if "go" in stack_lower:
+        sql_guards.append("`db.Query(..., args)` / GORM")
+        bypass_guards.append("`InsecureSkipVerify: true`")
+    if "rust" in stack_lower:
+        sql_guards.append("`sqlx::query!` / Diesel")
+```
+
+### [Critical] TG-DIFF-001 - Accidental Security Check Bypass in Patch Additions
+- **Finding ID:** `TG-DIFF-001-cb5ae7e9`
+- **Location:** `skills/torusguard/payload/scripts/rules_sync.py:172`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Node.js TLS rejectUnauthorized
+```
+    if "typescript" in stack_lower or "javascript" in stack_lower or "next" in stack_lower or "express" in stack_lower:
+        sql_guards.append("Prisma / Drizzle binders")
+        bypass_guards.append("`rejectUnauthorized: false`")
+
+    if not sql_guards:
+```
+
+### [Critical] TG-DIFF-001 - Accidental Security Check Bypass in Patch Additions
+- **Finding ID:** `TG-DIFF-001-0e4204af`
+- **Location:** `skills/torusguard/payload/scripts/rules_sync.py:169`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled PHP curl SSL verification
+```
+    if "php" in stack_lower:
+        sql_guards.append("PDO prepared statements / Eloquent")
+        bypass_guards.append("`CURLOPT_SSL_VERIFYPEER => false`")
+    if "typescript" in stack_lower or "javascript" in stack_lower or "next" in stack_lower or "express" in stack_lower:
+        sql_guards.append("Prisma / Drizzle binders")
+```
+
+### [High] TG-INPUT-003 - Unsafe Dynamic Code or HTML Execution
+- **Finding ID:** `TG-INPUT-003-fea9421e`
+- **Location:** `examples/vulnerable-react-express/client/src/App.jsx:53`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-injection`
+- **Description:** React dangerouslySetInnerHTML rendering raw unescaped HTML
+```
+
+      {/* TG-INPUT-003: Unsafe HTML rendering */}
+      <div dangerouslySetInnerHTML={{ __html: bio }} />
+
+      <button onClick={fetchUser}>Fetch user (IDOR demo)</button>
+```
+
+### [High] TG-PLATFORM-001 - Wildcard CORS With Credentials
+- **Finding ID:** `TG-PLATFORM-001-7dd35cb4`
+- **Location:** `examples/vulnerable-react-express/server/index.js:12`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Wildcard CORS origin configured in Express middleware
+```
+
+// TG-PLATFORM-001: Wildcard CORS with credentials
+app.use(cors({ origin: '*', credentials: true }));
+
+// TG-PLATFORM-004: No explicit JSON body size limit
+```
+
+### [High] TG-INPUT-001 - Missing Server-Side Request Validation
+- **Finding ID:** `TG-INPUT-001-c7457f38`
+- **Location:** `examples/vulnerable-react-express/server/index.js:27`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-injection`
+- **Description:** Destructuring unvalidated req.body without schema validation
+```
+// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)
+app.post('/api/login', (req, res) => {
+  const { email, password } = req.body;
+  console.log('Login attempt:', { email, password }); // TG-SEC-004
+  const user = users.find((u) => u.email === email && u.password === password);
+```
+
+### [High] TG-RATE-001 - Unlimited Authentication Endpoint
+- **Finding ID:** `TG-RATE-001-dcd0a3c7`
+- **Location:** `examples/vulnerable-react-express/server/index.js:26`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-rate-limiting`
+- **Description:** Authentication POST endpoint defined without rate-limiting middleware
+```
+// TG-SEC-004: Logs sensitive data
+// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)
+app.post('/api/login', (req, res) => {
+  const { email, password } = req.body;
+  console.log('Login attempt:', { email, password }); // TG-SEC-004
+```
+
+### [High] TG-AUTH-004 - Insecure Session Cookie Configuration
+- **Finding ID:** `TG-AUTH-004-f60870ef`
+- **Location:** `skills/torusguard/payload/scripts/rules_sync.py:180`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Decorator disabling route-level authentication or CSRF protection
+```
+
+    if not bypass_guards:
+        bypass_rule = "4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, `@csrf_exempt`, or `bypass_auth=True`."
+    else:
+        bypass_rule = f"4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, or {', '.join(bypass_guards[:2])}."
+```
+
+### [High] TG-AUTH-004 - Insecure Session Cookie Configuration
+- **Finding ID:** `TG-AUTH-004-6b0c7ebf`
+- **Location:** `skills/torusguard/payload/scripts/rules_sync.py:166`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Attribute disabling ASP.NET authentication
+```
+    if "c#" in stack_lower or "dotnet" in stack_lower:
+        sql_guards.append("EF Core LINQ / `FromSqlInterpolated`")
+        bypass_guards.append("`[AllowAnonymous]`")
+    if "php" in stack_lower:
+        sql_guards.append("PDO prepared statements / Eloquent")
+```
+
+### [High] TG-AUTH-003 - Missing Object-Level Authorization (IDOR)
+- **Finding ID:** `TG-AUTH-003-6a05e509`
+- **Location:** `examples/hardened-react-express/server/index.js:49`
+- **Confidence Score:** `55/100` (Medium Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** JWT verification missing explicit algorithms restriction parameter
+```
+  if (!token) return res.status(401).json({ error: 'Unauthorized' });
+  try {
+    req.user = jwt.verify(token, process.env.JWT_SECRET);
+    next();
+  } catch {
+```
+
+### [Medium] TG-PLATFORM-002 - Missing Security Headers
+- **Finding ID:** `TG-PLATFORM-002-1f383dcf`
+- **Location:** `examples/hardened-react-express/server/index.js:17`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-platform`
+- **Description:** Express application initialized without helmet security headers middleware
+```
+}
+
+const app = express();
+const PORT = 3001;
+const isProd = process.env.NODE_ENV === 'production';
+```
+
+### [Medium] TG-SEC-004 - Sensitive Information in Logs
+- **Finding ID:** `TG-SEC-004-dbbc17f7`
+- **Location:** `examples/vulnerable-react-express/client/src/App.jsx:30`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Plaintext credential or token logged to output sink
+```
+    const data = await res.json();
+    // TG-CLIENT-002: Sensitive console logging
+    console.log('Login token:', data.token, 'config:', clientConfig);
+    setMessage(JSON.stringify(data));
+  }
+```
+
+### [Medium] TG-CLIENT-001 - Public Production Source Maps
+- **Finding ID:** `TG-CLIENT-001-1ba4789e`
+- **Location:** `examples/vulnerable-react-express/client/vite.config.js:7`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-client-leak`
+- **Description:** Build config emitting unminified source maps in production output
+```
+export default defineConfig({
+  plugins: [react()],
+  build: { sourcemap: true },
+  server: {
+    port: 5173,
+```
+
+### [Medium] TG-SEC-004 - Sensitive Information in Logs
+- **Finding ID:** `TG-SEC-004-08753da5`
+- **Location:** `examples/vulnerable-react-express/server/index.js:28`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Plaintext credential or token logged to output sink
+```
+app.post('/api/login', (req, res) => {
+  const { email, password } = req.body;
+  console.log('Login attempt:', { email, password }); // TG-SEC-004
+  const user = users.find((u) => u.email === email && u.password === password);
+  if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration
+```
+
+### [Medium] TG-RATE-002 - Unlimited Public Write Endpoint
+- **Finding ID:** `TG-RATE-002-d67d7c98`
+- **Location:** `examples/vulnerable-react-express/server/index.js:54`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-rate-limiting`
+- **Description:** Public submission endpoint defined without rate-limiting or captcha defense
+```
+// TG-INPUT-001: No validation
+// TG-RATE-002: Unlimited contact endpoint
+app.post('/api/contact', (req, res) => {
+  res.json({ received: req.body });
+});
+```
+
+### [Medium] TG-PLATFORM-002 - Missing Security Headers
+- **Finding ID:** `TG-PLATFORM-002-eef342ec`
+- **Location:** `examples/vulnerable-react-express/server/index.js:5`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-platform`
+- **Description:** Express application initialized without helmet security headers middleware
+```
+const jwt = require('jsonwebtoken');
+
+const app = express();
+const PORT = 3001;
+
+```

package/.torusguard/runs/run-20260912-214813-audit/manifest.json

@@ -0,0 +1,12 @@
+{
+  "run_id": "run-20260912-214813-audit",
+  "command": "audit",
+  "target_name": "TorusGuard",
+  "created_at": "2026-09-12 21:48:13 IST",
+  "created_at_iso": "2026-09-12T21:48:13.470732+05:30",
+  "status": "completed",
+  "torusguard_version": "1.3.0",
+  "findings_count": 30,
+  "confirmed_fixed_count": 0,
+  "regressed_count": 0
+}

package/.torusguard/runs/run-20260912-214813-audit/summary.md

@@ -0,0 +1,5 @@
+# TorusGuard Audit Summary: run-20260912-214813-audit
+- Scanned Scope: C:\Users\Admin\Desktop\TorusGuard
+- Total Findings: 30
+- Root-Cause Clusters: 8
+- Generated: 2026-09-12 21:48:13 IST

package/.torusguard/runs/run-20260912-215555-audit/bundles/bnd-tg-auth-003-49-7c96f3/metadata.json

@@ -0,0 +1,17 @@
+{
+  "bundle_id": "bnd-tg-auth-003-49-7c96f3",
+  "finding_id": "TG-AUTH-003-6a05e509",
+  "rule_id": "TG-AUTH-003",
+  "title": "Missing Object-Level Authorization (IDOR)",
+  "target_file": "examples/hardened-react-express/server/index.js",
+  "line_number": 49,
+  "target_line": "    req.user = jwt.verify(token, process.env.JWT_SECRET);",
+  "replacement_line": "    req.user = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] });",
+  "what_is_wrong": "JWT verification missing explicit algorithms restriction parameter",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Restricted JWT verification to explicit algorithm list ['HS256']",
+  "proposed_diff": "--- a/examples/hardened-react-express/server/index.js\n+++ b/examples/hardened-react-express/server/index.js\n@@ -47,5 +47,5 @@\n   if (!token) return res.status(401).json({ error: 'Unauthorized' });\n   try {\n-    req.user = jwt.verify(token, process.env.JWT_SECRET);\n+    req.user = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] });\n     next();\n   } catch {\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "require('dotenv').config();\nconst express = require('express');\nconst helmet = require('helmet');\nconst cors = require('cors');\nconst cookieParser = require('cookie-parser');\nconst rateLimit = require('express-rate-limit');\nconst bcrypt = require('bcrypt');\nconst jwt = require('jsonwebtoken');\nconst crypto = require('crypto');\nconst { z } = require('zod');\n\nif (!process.env.JWT_SECRET) {\n  console.error('Missing JWT_SECRET');\n  process.exit(1);\n}\n\nconst app = express();\nconst PORT = 3001;\nconst isProd = process.env.NODE_ENV === 'production';\n\napp.use(helmet());\napp.use(cors({ origin: process.env.CLIENT_ORIGIN, credentials: true }));\napp.use(express.json({ limit: '100kb' }));\napp.use(cookieParser());\n\nconst loginLimiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 5 });\nconst resetLimiter = rateLimit({ windowMs: 60 * 60 * 1000, max: 3 });\nconst publicWriteLimiter = rateLimit({ windowMs: 60 * 60 * 1000, max: 10 });\n\nconst users = [];\nconst resetTokens = new Map();\n\nasync function seed() {\n  if (users.length) return;\n  const hash = await bcrypt.hash('DemoPass123!', 12);\n  users.push({ id: '1', email: 'alice@demo.local', passwordHash: hash, name: 'Alice', role: 'user' });\n  users.push({ id: '2', email: 'bob@demo.local', passwordHash: hash, name: 'Bob', role: 'user' });\n}\n\nconst loginSchema = z.object({\n  email: z.string().email().max(255),\n  password: z.string().min(8).max(128),\n});\n\nfunction auth(req, res, next) {\n  const token = req.cookies.token;\n  if (!token) return res.status(401).json({ error: 'Unauthorized' });\n  try {\n    req.user = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] });\n    next();\n  } catch {\n    return res.status(401).json({ error: 'Unauthorized' });\n  }\n}\n\napp.post('/api/login', loginLimiter, async (req, res) => {\n  const parsed = loginSchema.safeParse(req.body);\n  if (!parsed.success) return res.status(400).json({ error: 'Invalid input' });\n  const { email, password } = parsed.data;\n  const user = users.find((u) => u.email === email);\n  if (!user || !(await bcrypt.compare(password, user.passwordHash))) {\n    return res.status(401).json({ error: 'Invalid email or password' });\n  }\n  const token = jwt.sign({ id: user.id, role: user.role }, process.env.JWT_SECRET, { expiresIn: '1h' });\n  res.cookie('token', token, {\n    httpOnly: true,\n    secure: isProd,\n    sameSite: 'lax',\n    maxAge: 3600000,\n  });\n  res.json({ message: 'Login successful' });\n});\n\napp.get('/api/users/me', auth, (req, res) => {\n  const user = users.find((u) => u.id === req.user.id);\n  if (!user) return res.status(404).json({ error: 'Not found' });\n  res.json({ id: user.id, email: user.email, name: user.name });\n});\n\napp.get('/api/search', auth, (req, res) => {\n  const q = String(req.query.q || '').slice(0, 100);\n  const results = users\n    .filter((u) => u.email.includes(q))\n    .slice(0, 20)\n    .map(({ id, email, name }) => ({ id, email, name }));\n  res.json({ results });\n});\n\nconst contactSchema = z.object({ message: z.string().min(1).max(2000) });\napp.post('/api/contact', publicWriteLimiter, (req, res) => {\n  const parsed = contactSchema.safeParse(req.body);\n  if (!parsed.success) return res.status(400).json({ error: 'Invalid input' });\n  res.json({ ok: true });\n});\n\napp.post('/api/ai', auth, publicWriteLimiter, (req, res) => {\n  const prompt = String(req.body.prompt || '').slice(0, 4000);\n  res.json({ reply: 'demo response', length: prompt.length });\n});\n\napp.post('/api/reset', resetLimiter, (req, res) => {\n  const email = String(req.body.email || '');\n  const user = users.find((u) => u.email === email);\n  if (user) {\n    const token = crypto.randomBytes(32).toString('hex');\n    resetTokens.set(token, { userId: user.id, expires: Date.now() + 900000 });\n  }\n  res.json({ message: 'If an account exists, a reset link was sent.' });\n});\n\napp.get('/api/admin/stats', auth, (req, res) => {\n  if (req.user.role !== 'admin') return res.status(403).json({ error: 'Forbidden' });\n  res.json({ users: users.length });\n});\n\napp.use((err, req, res, next) => {\n  console.error('Error', { message: err.message });\n  res.status(500).json({ error: isProd ? 'Internal server error' : err.message });\n});\n\nseed().then(() => app.listen(PORT, () => console.log(`Hardened demo http://localhost:${PORT}`)));"
+}

package/.torusguard/runs/run-20260912-215555-audit/bundles/bnd-tg-auth-003-49-7c96f3/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-auth-003-49-7c96f3
+- **Rule ID:** `TG-AUTH-003`
+- **Target File:** `examples/hardened-react-express/server/index.js:49`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Restricted JWT verification to explicit algorithm list ['HS256']
+
+## Unified Diff Preview
+```diff
+--- a/examples/hardened-react-express/server/index.js
++++ b/examples/hardened-react-express/server/index.js
+@@ -47,5 +47,5 @@
+   if (!token) return res.status(401).json({ error: 'Unauthorized' });
+   try {
+-    req.user = jwt.verify(token, process.env.JWT_SECRET);
++    req.user = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] });
+     next();
+   } catch {
+
+```

package/.torusguard/runs/run-20260912-215555-audit/bundles/bnd-tg-auth-003-49-7c96f3/patch.diff

@@ -0,0 +1,9 @@
+--- a/examples/hardened-react-express/server/index.js
++++ b/examples/hardened-react-express/server/index.js
+@@ -47,5 +47,5 @@
+   if (!token) return res.status(401).json({ error: 'Unauthorized' });
+   try {
+-    req.user = jwt.verify(token, process.env.JWT_SECRET);
++    req.user = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] });
+     next();
+   } catch {

package/.torusguard/runs/run-20260912-215555-audit/bundles/bnd-tg-input-003-53-d167b4/metadata.json

@@ -0,0 +1,17 @@
+{
+  "bundle_id": "bnd-tg-input-003-53-d167b4",
+  "finding_id": "TG-INPUT-003-fea9421e",
+  "rule_id": "TG-INPUT-003",
+  "title": "Unsafe Dynamic Code or HTML Execution",
+  "target_file": "examples/vulnerable-react-express/client/src/App.jsx",
+  "line_number": 53,
+  "target_line": "      <div dangerouslySetInnerHTML={{ __html: bio }} />",
+  "replacement_line": "      <div>{bio}</div>",
+  "what_is_wrong": "React dangerouslySetInnerHTML rendering raw unescaped HTML",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Replaced raw dangerouslySetInnerHTML injection with safe React text interpolation",
+  "proposed_diff": "--- a/examples/vulnerable-react-express/client/src/App.jsx\n+++ b/examples/vulnerable-react-express/client/src/App.jsx\n@@ -51,5 +51,5 @@\n \n       {/* TG-INPUT-003: Unsafe HTML rendering */}\n-      <div dangerouslySetInnerHTML={{ __html: bio }} />\n+      <div>{bio}</div>\n \n       <button onClick={fetchUser}>Fetch user (IDOR demo)</button>\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "import { useState } from 'react';\nimport { clientConfig } from './config';\n\n// TG-DB-001: SQL query construction in frontend (never do this)\nfunction buildSearchQuery(email) {\n  return `SELECT id, email FROM users WHERE email LIKE '%${email}%'`;\n}\n\n// TG-DB-003: Documented anti-pattern \u2014 Prisma must never run in browser\n// import { PrismaClient } from '@prisma/client'; // FORBIDDEN in client\n\nexport default function App() {\n  const [email, setEmail] = useState('');\n  const [password, setPassword] = useState('');\n  const [bio, setBio] = useState('<img src=x onerror=alert(1)>');\n  const [userId, setUserId] = useState('1');\n  const [isAdmin] = useState(localStorage.getItem('role') === 'admin'); // TG-AUTH-002\n  const [message, setMessage] = useState('');\n\n  async function login(e) {\n    e.preventDefault();\n    const res = await fetch('/api/login', {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      credentials: 'include',\n      body: JSON.stringify({ email, password }),\n    });\n    const data = await res.json();\n    // TG-CLIENT-002: Sensitive console logging\n    console.log('Login token:', data.token, 'config:', clientConfig);\n    setMessage(JSON.stringify(data));\n  }\n\n  async function fetchUser() {\n    const res = await fetch(`/api/users/${userId}`);\n    setMessage(await res.text());\n  }\n\n  return (\n    <div style={{ maxWidth: 560, margin: '2rem auto', fontFamily: 'sans-serif' }}>\n      <h1>Vulnerable Demo</h1>\n      <p style={{ color: 'crimson' }}>Intentionally insecure \u2014 localhost lab only</p>\n\n      <form onSubmit={login}>\n        <input value={email} onChange={(e) => setEmail(e.target.value)} placeholder=\"email\" />\n        <input value={password} onChange={(e) => setPassword(e.target.value)} placeholder=\"password\" type=\"password\" />\n        <button type=\"submit\">Login</button>\n      </form>\n\n      <p>Frontend SQL preview: {buildSearchQuery(email)}</p>\n\n      {/* TG-INPUT-003: Unsafe HTML rendering */}\n      <div>{bio}</div>\n\n      <button onClick={fetchUser}>Fetch user (IDOR demo)</button>\n\n      {/* TG-AUTH-002: Client-only admin gate */}\n      {isAdmin && <section><h2>Admin Panel</h2><p>Visible if localStorage role=admin \u2014 not real security</p></section>}\n\n      {message && <pre>{message}</pre>}\n    </div>\n  );\n}"
+}

package/.torusguard/runs/run-20260912-215555-audit/bundles/bnd-tg-input-003-53-d167b4/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-input-003-53-d167b4
+- **Rule ID:** `TG-INPUT-003`
+- **Target File:** `examples/vulnerable-react-express/client/src/App.jsx:53`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Replaced raw dangerouslySetInnerHTML injection with safe React text interpolation
+
+## Unified Diff Preview
+```diff
+--- a/examples/vulnerable-react-express/client/src/App.jsx
++++ b/examples/vulnerable-react-express/client/src/App.jsx
+@@ -51,5 +51,5 @@
+ 
+       {/* TG-INPUT-003: Unsafe HTML rendering */}
+-      <div dangerouslySetInnerHTML={{ __html: bio }} />
++      <div>{bio}</div>
+ 
+       <button onClick={fetchUser}>Fetch user (IDOR demo)</button>
+
+```

package/.torusguard/runs/run-20260912-215555-audit/bundles/bnd-tg-input-003-53-d167b4/patch.diff

@@ -0,0 +1,9 @@
+--- a/examples/vulnerable-react-express/client/src/App.jsx
++++ b/examples/vulnerable-react-express/client/src/App.jsx
+@@ -51,5 +51,5 @@
+ 
+       {/* TG-INPUT-003: Unsafe HTML rendering */}
+-      <div dangerouslySetInnerHTML={{ __html: bio }} />
++      <div>{bio}</div>
+ 
+       <button onClick={fetchUser}>Fetch user (IDOR demo)</button>

package/.torusguard/runs/run-20260912-215555-audit/bundles/bnd-tg-platform-001-12-cf8156/metadata.json

@@ -0,0 +1,17 @@
+{
+  "bundle_id": "bnd-tg-platform-001-12-cf8156",
+  "finding_id": "TG-PLATFORM-001-7dd35cb4",
+  "rule_id": "TG-PLATFORM-001",
+  "title": "Wildcard CORS With Credentials",
+  "target_file": "examples/vulnerable-react-express/server/index.js",
+  "line_number": 12,
+  "target_line": "app.use(cors({ origin: '*', credentials: true }));",
+  "replacement_line": "app.use(cors({ origin: process.env.ALLOWED_ORIGIN || 'http://localhost:5173', credentials: true }));",
+  "what_is_wrong": "Wildcard CORS origin configured in Express middleware",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Constrained wildcard CORS origin to process.env.ALLOWED_ORIGIN with secure fallback",
+  "proposed_diff": "--- a/examples/vulnerable-react-express/server/index.js\n+++ b/examples/vulnerable-react-express/server/index.js\n@@ -10,5 +10,5 @@\n \n // TG-PLATFORM-001: Wildcard CORS with credentials\n-app.use(cors({ origin: '*', credentials: true }));\n+app.use(cors({ origin: process.env.ALLOWED_ORIGIN || 'http://localhost:5173', credentials: true }));\n \n // TG-PLATFORM-004: No explicit JSON body size limit\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "const express = require('express');\nconst cors = require('cors');\nconst jwt = require('jsonwebtoken');\n\nconst app = express();\nconst PORT = 3001;\n\n// TG-SEC-001: Hardcoded JWT secret\nconst JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';\n\n// TG-PLATFORM-001: Wildcard CORS with credentials\napp.use(cors({ origin: process.env.ALLOWED_ORIGIN || 'http://localhost:5173', credentials: true }));\n\n// TG-PLATFORM-004: No explicit JSON body size limit\napp.use(express.json());\n\nconst users = [\n  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },\n  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },\n];\n\n// TG-RATE-001: No rate limit on login\n// TG-AUTH-001: Plaintext password comparison\n// TG-SEC-004: Logs sensitive data\n// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)\napp.post('/api/login', (req, res) => {\n  const { email, password } = req.body;\n  console.log('Login attempt:', { email, password }); // TG-SEC-004\n  const user = users.find((u) => u.email === email && u.password === password);\n  if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration\n  const token = jwt.sign({ id: user.id }, JWT_SECRET);\n  res.cookie('token', token);\n  res.json({ message: 'ok', token, user });\n});\n\n// TG-AUTH-003: IDOR \u2014 no ownership check\napp.get('/api/users/:id', (req, res) => {\n  const user = users.find((u) => u.id === req.params.id);\n  if (!user) return res.status(404).json({ error: 'Not found' });\n  res.json(user);\n});\n\n// TG-INPUT-002: SQL concatenation (simulated query string)\n// TG-RATE-003: Unbounded results\napp.get('/api/search', (req, res) => {\n  const q = req.query.q || '';\n  const fakeSql = `SELECT * FROM users WHERE email LIKE '%${q}%'`;\n  const results = users.filter((u) => u.email.includes(q));\n  res.json({ query: fakeSql, results });\n});\n\n// TG-INPUT-001: No validation\n// TG-RATE-002: Unlimited contact endpoint\napp.post('/api/contact', (req, res) => {\n  res.json({ received: req.body });\n});\n\n// TG-RATE-002: Unlimited AI endpoint\napp.post('/api/ai', (req, res) => {\n  res.json({ reply: 'demo', prompt: req.body.prompt });\n});\n\n// TG-INPUT-004: Unrestricted upload (stub)\napp.post('/api/upload', (req, res) => {\n  res.json({ saved: req.body.filename });\n});\n\n// TG-AUTH-005: Unsafe password reset\napp.post('/api/reset', (req, res) => {\n  const { email } = req.body;\n  const user = users.find((u) => u.email === email);\n  if (!user) return res.status(404).json({ error: 'Email not registered' }); // enumeration\n  const token = `reset-${user.id}-12345`; // predictable\n  res.json({ resetToken: token });\n});\n\napp.use((err, req, res, next) => {\n  // TG-PLATFORM-003: Stack trace exposed\n  res.status(500).json({ error: err.message, stack: err.stack });\n});\n\napp.listen(PORT, () => console.log(`Vulnerable demo server http://localhost:${PORT}`));"
+}

package/.torusguard/runs/run-20260912-215555-audit/bundles/bnd-tg-platform-001-12-cf8156/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-platform-001-12-cf8156
+- **Rule ID:** `TG-PLATFORM-001`
+- **Target File:** `examples/vulnerable-react-express/server/index.js:12`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Constrained wildcard CORS origin to process.env.ALLOWED_ORIGIN with secure fallback
+
+## Unified Diff Preview
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -10,5 +10,5 @@
+ 
+ // TG-PLATFORM-001: Wildcard CORS with credentials
+-app.use(cors({ origin: '*', credentials: true }));
++app.use(cors({ origin: process.env.ALLOWED_ORIGIN || 'http://localhost:5173', credentials: true }));
+ 
+ // TG-PLATFORM-004: No explicit JSON body size limit
+
+```

package/.torusguard/runs/run-20260912-215555-audit/bundles/bnd-tg-platform-001-12-cf8156/patch.diff

@@ -0,0 +1,9 @@
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -10,5 +10,5 @@
+ 
+ // TG-PLATFORM-001: Wildcard CORS with credentials
+-app.use(cors({ origin: '*', credentials: true }));
++app.use(cors({ origin: process.env.ALLOWED_ORIGIN || 'http://localhost:5173', credentials: true }));
+ 
+ // TG-PLATFORM-004: No explicit JSON body size limit

package/.torusguard/runs/run-20260912-215555-audit/bundles/bnd-tg-rate-001-26-affcfa/metadata.json

@@ -0,0 +1,17 @@
+{
+  "bundle_id": "bnd-tg-rate-001-26-affcfa",
+  "finding_id": "TG-RATE-001-dcd0a3c7",
+  "rule_id": "TG-RATE-001",
+  "title": "Unlimited Authentication Endpoint",
+  "target_file": "examples/vulnerable-react-express/server/index.js",
+  "line_number": 26,
+  "target_line": "app.post('/api/login', (req, res) => {",
+  "replacement_line": "app.post('/api/login', authLimiter, (req, res) => {",
+  "what_is_wrong": "Authentication POST endpoint defined without rate-limiting middleware",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Injected authLimiter rate-limiting middleware to protect authentication endpoint from brute force",
+  "proposed_diff": "--- a/examples/vulnerable-react-express/server/index.js\n+++ b/examples/vulnerable-react-express/server/index.js\n@@ -24,5 +24,5 @@\n // TG-SEC-004: Logs sensitive data\n // TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)\n-app.post('/api/login', (req, res) => {\n+app.post('/api/login', authLimiter, (req, res) => {\n   const { email, password } = req.body;\n   console.log('Login attempt:', { email, password }); // TG-SEC-004\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "const express = require('express');\nconst cors = require('cors');\nconst jwt = require('jsonwebtoken');\n\nconst app = express();\nconst PORT = 3001;\n\n// TG-SEC-001: Hardcoded JWT secret\nconst JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';\n\n// TG-PLATFORM-001: Wildcard CORS with credentials\napp.use(cors({ origin: '*', credentials: true }));\n\n// TG-PLATFORM-004: No explicit JSON body size limit\napp.use(express.json());\n\nconst users = [\n  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },\n  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },\n];\n\n// TG-RATE-001: No rate limit on login\n// TG-AUTH-001: Plaintext password comparison\n// TG-SEC-004: Logs sensitive data\n// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)\napp.post('/api/login', authLimiter, (req, res) => {\n  const { email, password } = req.body;\n  console.log('Login attempt:', { email, password }); // TG-SEC-004\n  const user = users.find((u) => u.email === email && u.password === password);\n  if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration\n  const token = jwt.sign({ id: user.id }, JWT_SECRET);\n  res.cookie('token', token);\n  res.json({ message: 'ok', token, user });\n});\n\n// TG-AUTH-003: IDOR \u2014 no ownership check\napp.get('/api/users/:id', (req, res) => {\n  const user = users.find((u) => u.id === req.params.id);\n  if (!user) return res.status(404).json({ error: 'Not found' });\n  res.json(user);\n});\n\n// TG-INPUT-002: SQL concatenation (simulated query string)\n// TG-RATE-003: Unbounded results\napp.get('/api/search', (req, res) => {\n  const q = req.query.q || '';\n  const fakeSql = `SELECT * FROM users WHERE email LIKE '%${q}%'`;\n  const results = users.filter((u) => u.email.includes(q));\n  res.json({ query: fakeSql, results });\n});\n\n// TG-INPUT-001: No validation\n// TG-RATE-002: Unlimited contact endpoint\napp.post('/api/contact', (req, res) => {\n  res.json({ received: req.body });\n});\n\n// TG-RATE-002: Unlimited AI endpoint\napp.post('/api/ai', (req, res) => {\n  res.json({ reply: 'demo', prompt: req.body.prompt });\n});\n\n// TG-INPUT-004: Unrestricted upload (stub)\napp.post('/api/upload', (req, res) => {\n  res.json({ saved: req.body.filename });\n});\n\n// TG-AUTH-005: Unsafe password reset\napp.post('/api/reset', (req, res) => {\n  const { email } = req.body;\n  const user = users.find((u) => u.email === email);\n  if (!user) return res.status(404).json({ error: 'Email not registered' }); // enumeration\n  const token = `reset-${user.id}-12345`; // predictable\n  res.json({ resetToken: token });\n});\n\napp.use((err, req, res, next) => {\n  // TG-PLATFORM-003: Stack trace exposed\n  res.status(500).json({ error: err.message, stack: err.stack });\n});\n\napp.listen(PORT, () => console.log(`Vulnerable demo server http://localhost:${PORT}`));"
+}