torusguard 1.3.4 → 1.3.6

package/.torusguard/runs/run-20260912-214813-audit/findings.json

@@ -0,0 +1,992 @@
+[
+  {
+    "finding_id": "TG-SEC-001-bb5e4b77",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded JWT signing secret",
+    "severity": "Critical",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 9,
+    "matched_text": "JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION'",
+    "snippet": "\n// TG-SEC-001: Hardcoded JWT secret\nconst JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';\n\n// TG-PLATFORM-001: Wildcard CORS with credentials",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 9,
+      "end_line": 9
+    },
+    "confidence_score": 80,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 80,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-001-c393d596",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded credential or API secret string",
+    "severity": "Critical",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 18,
+    "matched_text": "password: 'password123'",
+    "snippet": "\nconst users = [\n  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },\n  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },\n];",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 18,
+      "end_line": 18
+    },
+    "confidence_score": 80,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 80,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SSRF-002-8378a839",
+    "rule_id": "TG-SSRF-002",
+    "title": "Missing Internal Network Protection",
+    "description": "Hardcoded internal loopback or cloud metadata endpoint target",
+    "severity": "Critical",
+    "category": "ssrf",
+    "cluster": "cluster-ssrf",
+    "file_path": "core/clustering.py",
+    "line_number": 53,
+    "matched_text": "127.0.0.1",
+    "snippet": "        \"cluster_id\": \"cluster-ssrf-network\",\n        \"title\": \"Unvalidated Outbound HTTP Requests & Network Boundary Leakage\",\n        \"shared_remediation_path\": \"Validate destination URLs against strict allowlists and block internal IP ranges (127.0.0.1, 169.254.169.254).\",\n        \"shared_verification_plan\": \"Attempt outbound requests to loopback and link-local metadata endpoints.\"\n    },",
+    "is_test": false,
+    "target": {
+      "file_path": "core/clustering.py",
+      "start_line": 53,
+      "end_line": 53
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DB-002-d9bd69df",
+    "rule_id": "TG-DB-002",
+    "title": "Privileged Database Credential in Browser Context",
+    "description": "Service role key or raw database connection string reference in frontend code",
+    "severity": "Critical",
+    "category": "database",
+    "cluster": "cluster-client-leak",
+    "file_path": "demo/playground/vulnerable_nextjs/actions.ts",
+    "line_number": 9,
+    "matched_text": "SUPABASE_SERVICE_ROLE_KEY",
+    "snippet": "\n// Finding 1: TG-CLIENT-001 - Backend admin key exposed in client-accessible code\nexport const SUPABASE_SERVICE_ROLE_KEY = \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.demo_secret_token_1234567890\";\n\ninterface UserRecord {",
+    "is_test": false,
+    "target": {
+      "file_path": "demo/playground/vulnerable_nextjs/actions.ts",
+      "start_line": 9,
+      "end_line": 9
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SSRF-002-d08ed1ca",
+    "rule_id": "TG-SSRF-002",
+    "title": "Missing Internal Network Protection",
+    "description": "Hardcoded internal loopback or cloud metadata endpoint target",
+    "severity": "Critical",
+    "category": "ssrf",
+    "cluster": "cluster-ssrf",
+    "file_path": "examples/hardened-react-express/client/vite.config.js",
+    "line_number": 7,
+    "matched_text": "localhost",
+    "snippet": "  plugins: [react()],\n  build: { sourcemap: false },\n  server: { port: 5173, proxy: { '/api': 'http://localhost:3001' } },\n});",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/hardened-react-express/client/vite.config.js",
+      "start_line": 7,
+      "end_line": 7
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SSRF-002-a79cf464",
+    "rule_id": "TG-SSRF-002",
+    "title": "Missing Internal Network Protection",
+    "description": "Hardcoded internal loopback or cloud metadata endpoint target",
+    "severity": "Critical",
+    "category": "ssrf",
+    "cluster": "cluster-ssrf",
+    "file_path": "examples/hardened-react-express/server/index.js",
+    "line_number": 121,
+    "matched_text": "localhost",
+    "snippet": "});\n\nseed().then(() => app.listen(PORT, () => console.log(`Hardened demo http://localhost:${PORT}`)));",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/hardened-react-express/server/index.js",
+      "start_line": 121,
+      "end_line": 121
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SSRF-004-dcf3f71e",
+    "rule_id": "TG-SSRF-004",
+    "title": "Unbounded Outbound Request Without Timeout",
+    "description": "Python requests call without explicit timeout parameter",
+    "severity": "Critical",
+    "category": "ssrf",
+    "cluster": "cluster-ssrf",
+    "file_path": "examples/python/fastapi-hardened/main.py",
+    "line_number": 30,
+    "matched_text": "requests.get(url, timeout=5)",
+    "snippet": "    if not is_safe_url(url):\n        raise HTTPException(status_code=400, detail=\"Invalid destination address\")\n    response = requests.get(url, timeout=5)\n    return {\"status\": response.status_code, \"content\": response.text}\n",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/python/fastapi-hardened/main.py",
+      "start_line": 30,
+      "end_line": 30
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SSRF-004-d8472223",
+    "rule_id": "TG-SSRF-004",
+    "title": "Unbounded Outbound Request Without Timeout",
+    "description": "Python requests call without explicit timeout parameter",
+    "severity": "Critical",
+    "category": "ssrf",
+    "cluster": "cluster-ssrf",
+    "file_path": "examples/python/fastapi-vuln/main.py",
+    "line_number": 9,
+    "matched_text": "requests.get(url)",
+    "snippet": "@app.get(\"/fetch\")\ndef fetch_url(url: str):\n    response = requests.get(url)\n    return {\"status\": response.status_code, \"content\": response.text}\n",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/python/fastapi-vuln/main.py",
+      "start_line": 9,
+      "end_line": 9
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SSRF-002-3c5a7c3c",
+    "rule_id": "TG-SSRF-002",
+    "title": "Missing Internal Network Protection",
+    "description": "Hardcoded internal loopback or cloud metadata endpoint target",
+    "severity": "Critical",
+    "category": "ssrf",
+    "cluster": "cluster-ssrf",
+    "file_path": "examples/vulnerable-react-express/client/src/App.jsx",
+    "line_number": 42,
+    "matched_text": "localhost",
+    "snippet": "    <div style={{ maxWidth: 560, margin: '2rem auto', fontFamily: 'sans-serif' }}>\n      <h1>Vulnerable Demo</h1>\n      <p style={{ color: 'crimson' }}>Intentionally insecure \u2014 localhost lab only</p>\n\n      <form onSubmit={login}>",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/client/src/App.jsx",
+      "start_line": 42,
+      "end_line": 42
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SSRF-002-13c81e3a",
+    "rule_id": "TG-SSRF-002",
+    "title": "Missing Internal Network Protection",
+    "description": "Hardcoded internal loopback or cloud metadata endpoint target",
+    "severity": "Critical",
+    "category": "ssrf",
+    "cluster": "cluster-ssrf",
+    "file_path": "examples/vulnerable-react-express/client/src/config.js",
+    "line_number": 5,
+    "matched_text": "localhost",
+    "snippet": "  apiUrl: import.meta.env.VITE_API_URL,\n  // FAKE DEMO ONLY \u2014 never put real database URLs in client code\n  demoDbUrl: 'postgresql://demo:FAKE_PASSWORD@localhost:5432/demo',\n};",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/client/src/config.js",
+      "start_line": 5,
+      "end_line": 5
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SSRF-002-b0f87c06",
+    "rule_id": "TG-SSRF-002",
+    "title": "Missing Internal Network Protection",
+    "description": "Hardcoded internal loopback or cloud metadata endpoint target",
+    "severity": "Critical",
+    "category": "ssrf",
+    "cluster": "cluster-ssrf",
+    "file_path": "examples/vulnerable-react-express/client/vite.config.js",
+    "line_number": 10,
+    "matched_text": "localhost",
+    "snippet": "  server: {\n    port: 5173,\n    proxy: { '/api': 'http://localhost:3001' },\n  },\n});",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/client/vite.config.js",
+      "start_line": 10,
+      "end_line": 10
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SSRF-002-ee77c629",
+    "rule_id": "TG-SSRF-002",
+    "title": "Missing Internal Network Protection",
+    "description": "Hardcoded internal loopback or cloud metadata endpoint target",
+    "severity": "Critical",
+    "category": "ssrf",
+    "cluster": "cluster-ssrf",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 82,
+    "matched_text": "localhost",
+    "snippet": "});\n\napp.listen(PORT, () => console.log(`Vulnerable demo server http://localhost:${PORT}`));",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 82,
+      "end_line": 82
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SSRF-002-a0d1eac8",
+    "rule_id": "TG-SSRF-002",
+    "title": "Missing Internal Network Protection",
+    "description": "Hardcoded internal loopback or cloud metadata endpoint target",
+    "severity": "Critical",
+    "category": "ssrf",
+    "cluster": "cluster-ssrf",
+    "file_path": "skills/torusguard/payload/config/scope.json",
+    "line_number": 4,
+    "matched_text": "localhost",
+    "snippet": "  \"$schema\": \"../schemas/authorization.schema.json\",\n  \"authorization\": {\n    \"target\": \"localhost\",\n    \"owner_confirmed\": false,\n    \"scope_type\": \"source_code_only\",",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/config/scope.json",
+      "start_line": 4,
+      "end_line": 4
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-7db54483",
+    "rule_id": "TG-DIFF-001",
+    "title": "Accidental Security Check Bypass in Patch Additions",
+    "description": "Disabled TLS certificate verification (verify=False)",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+    "line_number": 180,
+    "matched_text": "verify=False",
+    "snippet": "\n    if not bypass_guards:\n        bypass_rule = \"4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, `@csrf_exempt`, or `bypass_auth=True`.\"\n    else:\n        bypass_rule = f\"4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, or {', '.join(bypass_guards[:2])}.\"",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+      "start_line": 180,
+      "end_line": 180
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-77bc2f9b",
+    "rule_id": "TG-DIFF-001",
+    "title": "Accidental Security Check Bypass in Patch Additions",
+    "description": "Disabled Go TLS certificate verification (InsecureSkipVerify: true)",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+    "line_number": 157,
+    "matched_text": "InsecureSkipVerify: true",
+    "snippet": "    if \"go\" in stack_lower:\n        sql_guards.append(\"`db.Query(..., args)` / GORM\")\n        bypass_guards.append(\"`InsecureSkipVerify: true`\")\n    if \"rust\" in stack_lower:\n        sql_guards.append(\"`sqlx::query!` / Diesel\")",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+      "start_line": 157,
+      "end_line": 157
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-cb5ae7e9",
+    "rule_id": "TG-DIFF-001",
+    "title": "Accidental Security Check Bypass in Patch Additions",
+    "description": "Disabled Node.js TLS rejectUnauthorized",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+    "line_number": 172,
+    "matched_text": "rejectUnauthorized: false",
+    "snippet": "    if \"typescript\" in stack_lower or \"javascript\" in stack_lower or \"next\" in stack_lower or \"express\" in stack_lower:\n        sql_guards.append(\"Prisma / Drizzle binders\")\n        bypass_guards.append(\"`rejectUnauthorized: false`\")\n\n    if not sql_guards:",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+      "start_line": 172,
+      "end_line": 172
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DIFF-001-0e4204af",
+    "rule_id": "TG-DIFF-001",
+    "title": "Accidental Security Check Bypass in Patch Additions",
+    "description": "Disabled PHP curl SSL verification",
+    "severity": "Critical",
+    "category": "transport",
+    "cluster": "cluster-transport-security",
+    "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+    "line_number": 169,
+    "matched_text": "CURLOPT_SSL_VERIFYPEER => false",
+    "snippet": "    if \"php\" in stack_lower:\n        sql_guards.append(\"PDO prepared statements / Eloquent\")\n        bypass_guards.append(\"`CURLOPT_SSL_VERIFYPEER => false`\")\n    if \"typescript\" in stack_lower or \"javascript\" in stack_lower or \"next\" in stack_lower or \"express\" in stack_lower:\n        sql_guards.append(\"Prisma / Drizzle binders\")",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+      "start_line": 169,
+      "end_line": 169
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-INPUT-003-fea9421e",
+    "rule_id": "TG-INPUT-003",
+    "title": "Unsafe Dynamic Code or HTML Execution",
+    "description": "React dangerouslySetInnerHTML rendering raw unescaped HTML",
+    "severity": "High",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "examples/vulnerable-react-express/client/src/App.jsx",
+    "line_number": 53,
+    "matched_text": "dangerouslySetInnerHTML=",
+    "snippet": "\n      {/* TG-INPUT-003: Unsafe HTML rendering */}\n      <div dangerouslySetInnerHTML={{ __html: bio }} />\n\n      <button onClick={fetchUser}>Fetch user (IDOR demo)</button>",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/client/src/App.jsx",
+      "start_line": 53,
+      "end_line": 53
+    },
+    "confidence_score": 80,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 80,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-PLATFORM-001-7dd35cb4",
+    "rule_id": "TG-PLATFORM-001",
+    "title": "Wildcard CORS With Credentials",
+    "description": "Wildcard CORS origin configured in Express middleware",
+    "severity": "High",
+    "category": "platform",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 12,
+    "matched_text": "cors({ origin: '*'",
+    "snippet": "\n// TG-PLATFORM-001: Wildcard CORS with credentials\napp.use(cors({ origin: '*', credentials: true }));\n\n// TG-PLATFORM-004: No explicit JSON body size limit",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 12,
+      "end_line": 12
+    },
+    "confidence_score": 80,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 80,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-INPUT-001-c7457f38",
+    "rule_id": "TG-INPUT-001",
+    "title": "Missing Server-Side Request Validation",
+    "description": "Destructuring unvalidated req.body without schema validation",
+    "severity": "High",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 27,
+    "matched_text": "const { email, password } = req.body;",
+    "snippet": "// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)\napp.post('/api/login', (req, res) => {\n  const { email, password } = req.body;\n  console.log('Login attempt:', { email, password }); // TG-SEC-004\n  const user = users.find((u) => u.email === email && u.password === password);",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 27,
+      "end_line": 27
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-RATE-001-dcd0a3c7",
+    "rule_id": "TG-RATE-001",
+    "title": "Unlimited Authentication Endpoint",
+    "description": "Authentication POST endpoint defined without rate-limiting middleware",
+    "severity": "High",
+    "category": "rate",
+    "cluster": "cluster-rate-limiting",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 26,
+    "matched_text": "app.post('/api/login', (",
+    "snippet": "// TG-SEC-004: Logs sensitive data\n// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)\napp.post('/api/login', (req, res) => {\n  const { email, password } = req.body;\n  console.log('Login attempt:', { email, password }); // TG-SEC-004",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 26,
+      "end_line": 26
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-AUTH-004-f60870ef",
+    "rule_id": "TG-AUTH-004",
+    "title": "Insecure Session Cookie Configuration",
+    "description": "Decorator disabling route-level authentication or CSRF protection",
+    "severity": "High",
+    "category": "auth",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+    "line_number": 180,
+    "matched_text": "@csrf_exempt",
+    "snippet": "\n    if not bypass_guards:\n        bypass_rule = \"4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, `@csrf_exempt`, or `bypass_auth=True`.\"\n    else:\n        bypass_rule = f\"4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, or {', '.join(bypass_guards[:2])}.\"",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+      "start_line": 180,
+      "end_line": 180
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-AUTH-004-6b0c7ebf",
+    "rule_id": "TG-AUTH-004",
+    "title": "Insecure Session Cookie Configuration",
+    "description": "Attribute disabling ASP.NET authentication",
+    "severity": "High",
+    "category": "auth",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+    "line_number": 166,
+    "matched_text": "[AllowAnonymous]",
+    "snippet": "    if \"c#\" in stack_lower or \"dotnet\" in stack_lower:\n        sql_guards.append(\"EF Core LINQ / `FromSqlInterpolated`\")\n        bypass_guards.append(\"`[AllowAnonymous]`\")\n    if \"php\" in stack_lower:\n        sql_guards.append(\"PDO prepared statements / Eloquent\")",
+    "is_test": false,
+    "target": {
+      "file_path": "skills/torusguard/payload/scripts/rules_sync.py",
+      "start_line": 166,
+      "end_line": 166
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-AUTH-003-6a05e509",
+    "rule_id": "TG-AUTH-003",
+    "title": "Missing Object-Level Authorization (IDOR)",
+    "description": "JWT verification missing explicit algorithms restriction parameter",
+    "severity": "High",
+    "category": "auth",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "examples/hardened-react-express/server/index.js",
+    "line_number": 49,
+    "matched_text": "jwt.verify(token, process.env.JWT_SECRET)",
+    "snippet": "  if (!token) return res.status(401).json({ error: 'Unauthorized' });\n  try {\n    req.user = jwt.verify(token, process.env.JWT_SECRET);\n    next();\n  } catch {",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/hardened-react-express/server/index.js",
+      "start_line": 49,
+      "end_line": 49
+    },
+    "confidence_score": 55,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 0,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 55,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-PLATFORM-002-1f383dcf",
+    "rule_id": "TG-PLATFORM-002",
+    "title": "Missing Security Headers",
+    "description": "Express application initialized without helmet security headers middleware",
+    "severity": "Medium",
+    "category": "platform",
+    "cluster": "cluster-platform",
+    "file_path": "examples/hardened-react-express/server/index.js",
+    "line_number": 17,
+    "matched_text": "const app = express();",
+    "snippet": "}\n\nconst app = express();\nconst PORT = 3001;\nconst isProd = process.env.NODE_ENV === 'production';",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/hardened-react-express/server/index.js",
+      "start_line": 17,
+      "end_line": 17
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-004-dbbc17f7",
+    "rule_id": "TG-SEC-004",
+    "title": "Sensitive Information in Logs",
+    "description": "Plaintext credential or token logged to output sink",
+    "severity": "Medium",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "examples/vulnerable-react-express/client/src/App.jsx",
+    "line_number": 30,
+    "matched_text": "console.log('Login token:', data.token, 'config:', clientConfig)",
+    "snippet": "    const data = await res.json();\n    // TG-CLIENT-002: Sensitive console logging\n    console.log('Login token:', data.token, 'config:', clientConfig);\n    setMessage(JSON.stringify(data));\n  }",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/client/src/App.jsx",
+      "start_line": 30,
+      "end_line": 30
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-CLIENT-001-1ba4789e",
+    "rule_id": "TG-CLIENT-001",
+    "title": "Public Production Source Maps",
+    "description": "Build config emitting unminified source maps in production output",
+    "severity": "Medium",
+    "category": "client",
+    "cluster": "cluster-client-leak",
+    "file_path": "examples/vulnerable-react-express/client/vite.config.js",
+    "line_number": 7,
+    "matched_text": "sourcemap: true",
+    "snippet": "export default defineConfig({\n  plugins: [react()],\n  build: { sourcemap: true },\n  server: {\n    port: 5173,",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/client/vite.config.js",
+      "start_line": 7,
+      "end_line": 7
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-004-08753da5",
+    "rule_id": "TG-SEC-004",
+    "title": "Sensitive Information in Logs",
+    "description": "Plaintext credential or token logged to output sink",
+    "severity": "Medium",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 28,
+    "matched_text": "console.log('Login attempt:', { email, password })",
+    "snippet": "app.post('/api/login', (req, res) => {\n  const { email, password } = req.body;\n  console.log('Login attempt:', { email, password }); // TG-SEC-004\n  const user = users.find((u) => u.email === email && u.password === password);\n  if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 28,
+      "end_line": 28
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-RATE-002-d67d7c98",
+    "rule_id": "TG-RATE-002",
+    "title": "Unlimited Public Write Endpoint",
+    "description": "Public submission endpoint defined without rate-limiting or captcha defense",
+    "severity": "Medium",
+    "category": "rate",
+    "cluster": "cluster-rate-limiting",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 54,
+    "matched_text": "app.post('/api/contact', (",
+    "snippet": "// TG-INPUT-001: No validation\n// TG-RATE-002: Unlimited contact endpoint\napp.post('/api/contact', (req, res) => {\n  res.json({ received: req.body });\n});",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 54,
+      "end_line": 54
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-PLATFORM-002-eef342ec",
+    "rule_id": "TG-PLATFORM-002",
+    "title": "Missing Security Headers",
+    "description": "Express application initialized without helmet security headers middleware",
+    "severity": "Medium",
+    "category": "platform",
+    "cluster": "cluster-platform",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 5,
+    "matched_text": "const app = express();",
+    "snippet": "const jwt = require('jsonwebtoken');\n\nconst app = express();\nconst PORT = 3001;\n",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 5,
+      "end_line": 5
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  }
+]