torusguard 1.3.4 → 1.3.6

package/.torusguard/runs/run-20260912-215731-audit/diff_summary.md

@@ -0,0 +1,186 @@
+# TorusGuard Applied Patch Summary: run-20260912-215731-audit
+
+## Applied: `[TG-CLIENT-001]` on `examples/vulnerable-react-express/client/vite.config.js:7`
+```diff
+--- a/examples/vulnerable-react-express/client/vite.config.js
++++ b/examples/vulnerable-react-express/client/vite.config.js
+@@ -5,5 +5,5 @@
+ export default defineConfig({
+   plugins: [react()],
+-  build: { sourcemap: true },
++  build: { sourcemap: false },
+   server: {
+     port: 5173,
+```
+
+## Applied: `[TG-DB-002]` on `demo/playground/vulnerable_nextjs/actions.ts:9`
+```diff
+--- a/demo/playground/vulnerable_nextjs/actions.ts
++++ b/demo/playground/vulnerable_nextjs/actions.ts
+@@ -7,5 +7,5 @@
+ 
+ // Finding 1: TG-CLIENT-001 - Backend admin key exposed in client-accessible code
+-export const SUPABASE_SERVICE_ROLE_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.demo_secret_token_1234567890";
++export const SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY || "";
+ 
+ interface UserRecord {
+```
+
+## Applied: `[TG-INPUT-001]` on `examples/vulnerable-react-express/server/index.js:27`
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -25,5 +25,5 @@
+ // TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)
+ app.post('/api/login', (req, res) => {
+-  const { email, password } = req.body;
++  if (!req.body || typeof req.body !== "object") return res.status(400).json({ error: "Invalid payload" });
+  const { email, password } = req.body;
+   console.log('Login attempt:', { email, password }); // TG-SEC-004
+   const user = users.find((u) => u.email === email && u.password === password);
+```
+
+## Applied: `[TG-INPUT-003]` on `examples/vulnerable-react-express/client/src/App.jsx:53`
+```diff
+--- a/examples/vulnerable-react-express/client/src/App.jsx
++++ b/examples/vulnerable-react-express/client/src/App.jsx
+@@ -51,5 +51,5 @@
+ 
+       {/* TG-INPUT-003: Unsafe HTML rendering */}
+-      <div dangerouslySetInnerHTML={{ __html: bio }} />
++      <div>{bio}</div>
+ 
+       <button onClick={fetchUser}>Fetch user (IDOR demo)</button>
+```
+
+## Applied: `[TG-PLATFORM-001]` on `examples/vulnerable-react-express/server/index.js:12`
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -10,5 +10,5 @@
+ 
+ // TG-PLATFORM-001: Wildcard CORS with credentials
+-app.use(cors({ origin: '*', credentials: true }));
++app.use(cors({ origin: process.env.ALLOWED_ORIGIN || 'http://localhost:5173', credentials: true }));
+ 
+ // TG-PLATFORM-004: No explicit JSON body size limit
+```
+
+## Applied: `[TG-PLATFORM-002]` on `examples/hardened-react-express/server/index.js:17`
+```diff
+--- a/examples/hardened-react-express/server/index.js
++++ b/examples/hardened-react-express/server/index.js
+@@ -15,5 +15,5 @@
+ }
+ 
+-const app = express();
++const helmet = require("helmet");
+const app = express();
+app.use(helmet());
+ const PORT = 3001;
+ const isProd = process.env.NODE_ENV === 'production';
+```
+
+## Applied: `[TG-PLATFORM-002]` on `examples/vulnerable-react-express/server/index.js:5`
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -3,5 +3,5 @@
+ const jwt = require('jsonwebtoken');
+ 
+-const app = express();
++const helmet = require("helmet");
+const app = express();
+app.use(helmet());
+ const PORT = 3001;
+```
+
+## Applied: `[TG-RATE-001]` on `examples/vulnerable-react-express/server/index.js:26`
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -24,5 +24,5 @@
+ // TG-SEC-004: Logs sensitive data
+ // TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)
+-app.post('/api/login', (req, res) => {
++app.post('/api/login', authLimiter, (req, res) => {
+   const { email, password } = req.body;
+   console.log('Login attempt:', { email, password }); // TG-SEC-004
+```
+
+## Applied: `[TG-RATE-002]` on `examples/vulnerable-react-express/server/index.js:54`
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -52,5 +52,5 @@
+ // TG-INPUT-001: No validation
+ // TG-RATE-002: Unlimited contact endpoint
+-app.post('/api/contact', (req, res) => {
++app.post('/api/contact', writeLimiter, (req, res) => {
+   res.json({ received: req.body });
+ });
+```
+
+## Applied: `[TG-SEC-001]` on `examples/vulnerable-react-express/server/index.js:18`
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -16,5 +16,5 @@
+ 
+ const users = [
+-  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },
++  { id: '1', email: 'alice@demo.local', password: process.env.DEMO_USER_PASSWORD || "REDACTED_PASSWORD", name: 'Alice' },
+   { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },
+ ];
+```
+
+## Applied: `[TG-SEC-001]` on `examples/vulnerable-react-express/server/index.js:9`
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -7,5 +7,5 @@
+ 
+ // TG-SEC-001: Hardcoded JWT secret
+-const JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';
++const JWT_SECRET = process.env.JWT_SECRET || "";
+ 
+ // TG-PLATFORM-001: Wildcard CORS with credentials
+```
+
+## Applied: `[TG-SEC-004]` on `examples/vulnerable-react-express/server/index.js:28`
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -26,5 +26,5 @@
+ app.post('/api/login', (req, res) => {
+   const { email, password } = req.body;
+-  console.log('Login attempt:', { email, password }); // TG-SEC-004
++  // Security: Sensitive credential log removed per TG-SEC-004
+   const user = users.find((u) => u.email === email && u.password === password);
+   if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration
+```
+
+## Applied: `[TG-SEC-004]` on `examples/vulnerable-react-express/client/src/App.jsx:30`
+```diff
+--- a/examples/vulnerable-react-express/client/src/App.jsx
++++ b/examples/vulnerable-react-express/client/src/App.jsx
+@@ -28,5 +28,5 @@
+     const data = await res.json();
+     // TG-CLIENT-002: Sensitive console logging
+-    console.log('Login token:', data.token, 'config:', clientConfig);
++    // Security: Sensitive credential log removed per TG-SEC-004
+     setMessage(JSON.stringify(data));
+   }
+```
+
+## Applied: `[TG-SSRF-004]` on `examples/python/fastapi-vuln/main.py:9`
+```diff
+--- a/examples/python/fastapi-vuln/main.py
++++ b/examples/python/fastapi-vuln/main.py
+@@ -7,5 +7,5 @@
+ @app.get("/fetch")
+ def fetch_url(url: str):
+-    response = requests.get(url)
++    response = requests.get(url, timeout=10)
+     return {"status": response.status_code, "content": response.text}
+```

package/.torusguard/runs/run-20260912-215731-audit/findings.json

@@ -0,0 +1,497 @@
+[
+  {
+    "finding_id": "TG-SEC-001-bb5e4b77",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded JWT signing secret",
+    "severity": "Critical",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 9,
+    "matched_text": "JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION'",
+    "snippet": "\n// TG-SEC-001: Hardcoded JWT secret\nconst JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';\n\n// TG-PLATFORM-001: Wildcard CORS with credentials",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 9,
+      "end_line": 9
+    },
+    "confidence_score": 80,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 80,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-001-c393d596",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded credential or API secret string",
+    "severity": "Critical",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 18,
+    "matched_text": "password: 'password123'",
+    "snippet": "\nconst users = [\n  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },\n  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },\n];",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 18,
+      "end_line": 18
+    },
+    "confidence_score": 80,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 80,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DB-002-d9bd69df",
+    "rule_id": "TG-DB-002",
+    "title": "Privileged Database Credential in Browser Context",
+    "description": "Service role key or raw database connection string reference in frontend code",
+    "severity": "Critical",
+    "category": "database",
+    "cluster": "cluster-client-leak",
+    "file_path": "demo/playground/vulnerable_nextjs/actions.ts",
+    "line_number": 9,
+    "matched_text": "SUPABASE_SERVICE_ROLE_KEY",
+    "snippet": "\n// Finding 1: TG-CLIENT-001 - Backend admin key exposed in client-accessible code\nexport const SUPABASE_SERVICE_ROLE_KEY = \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.demo_secret_token_1234567890\";\n\ninterface UserRecord {",
+    "is_test": false,
+    "target": {
+      "file_path": "demo/playground/vulnerable_nextjs/actions.ts",
+      "start_line": 9,
+      "end_line": 9
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SSRF-004-d8472223",
+    "rule_id": "TG-SSRF-004",
+    "title": "Unbounded Outbound Request Without Timeout",
+    "description": "Python requests call without explicit timeout parameter",
+    "severity": "Critical",
+    "category": "ssrf",
+    "cluster": "cluster-ssrf",
+    "file_path": "examples/python/fastapi-vuln/main.py",
+    "line_number": 9,
+    "matched_text": "requests.get(url)",
+    "snippet": "@app.get(\"/fetch\")\ndef fetch_url(url: str):\n    response = requests.get(url)\n    return {\"status\": response.status_code, \"content\": response.text}\n",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/python/fastapi-vuln/main.py",
+      "start_line": 9,
+      "end_line": 9
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-INPUT-003-fea9421e",
+    "rule_id": "TG-INPUT-003",
+    "title": "Unsafe Dynamic Code or HTML Execution",
+    "description": "React dangerouslySetInnerHTML rendering raw unescaped HTML",
+    "severity": "High",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "examples/vulnerable-react-express/client/src/App.jsx",
+    "line_number": 53,
+    "matched_text": "dangerouslySetInnerHTML=",
+    "snippet": "\n      {/* TG-INPUT-003: Unsafe HTML rendering */}\n      <div dangerouslySetInnerHTML={{ __html: bio }} />\n\n      <button onClick={fetchUser}>Fetch user (IDOR demo)</button>",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/client/src/App.jsx",
+      "start_line": 53,
+      "end_line": 53
+    },
+    "confidence_score": 80,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 80,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-PLATFORM-001-7dd35cb4",
+    "rule_id": "TG-PLATFORM-001",
+    "title": "Wildcard CORS With Credentials",
+    "description": "Wildcard CORS origin configured in Express middleware",
+    "severity": "High",
+    "category": "platform",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 12,
+    "matched_text": "cors({ origin: '*'",
+    "snippet": "\n// TG-PLATFORM-001: Wildcard CORS with credentials\napp.use(cors({ origin: '*', credentials: true }));\n\n// TG-PLATFORM-004: No explicit JSON body size limit",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 12,
+      "end_line": 12
+    },
+    "confidence_score": 80,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 80,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-AUTH-003-6a05e509",
+    "rule_id": "TG-AUTH-003",
+    "title": "Missing Object-Level Authorization (IDOR)",
+    "description": "JWT verification missing explicit algorithms restriction parameter",
+    "severity": "High",
+    "category": "auth",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "examples/hardened-react-express/server/index.js",
+    "line_number": 49,
+    "matched_text": "jwt.verify(token, process.env.JWT_SECRET)",
+    "snippet": "  if (!token) return res.status(401).json({ error: 'Unauthorized' });\n  try {\n    req.user = jwt.verify(token, process.env.JWT_SECRET);\n    next();\n  } catch {",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/hardened-react-express/server/index.js",
+      "start_line": 49,
+      "end_line": 49
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-INPUT-001-c7457f38",
+    "rule_id": "TG-INPUT-001",
+    "title": "Missing Server-Side Request Validation",
+    "description": "Destructuring unvalidated req.body without schema validation",
+    "severity": "High",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 27,
+    "matched_text": "const { email, password } = req.body;",
+    "snippet": "// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)\napp.post('/api/login', (req, res) => {\n  const { email, password } = req.body;\n  console.log('Login attempt:', { email, password }); // TG-SEC-004\n  const user = users.find((u) => u.email === email && u.password === password);",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 27,
+      "end_line": 27
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-RATE-001-dcd0a3c7",
+    "rule_id": "TG-RATE-001",
+    "title": "Unlimited Authentication Endpoint",
+    "description": "Authentication POST endpoint defined without rate-limiting middleware",
+    "severity": "High",
+    "category": "rate",
+    "cluster": "cluster-rate-limiting",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 26,
+    "matched_text": "app.post('/api/login', (",
+    "snippet": "// TG-SEC-004: Logs sensitive data\n// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)\napp.post('/api/login', (req, res) => {\n  const { email, password } = req.body;\n  console.log('Login attempt:', { email, password }); // TG-SEC-004",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 26,
+      "end_line": 26
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-PLATFORM-002-1f383dcf",
+    "rule_id": "TG-PLATFORM-002",
+    "title": "Missing Security Headers",
+    "description": "Express application initialized without helmet security headers middleware",
+    "severity": "Medium",
+    "category": "platform",
+    "cluster": "cluster-platform",
+    "file_path": "examples/hardened-react-express/server/index.js",
+    "line_number": 17,
+    "matched_text": "const app = express();",
+    "snippet": "}\n\nconst app = express();\nconst PORT = 3001;\nconst isProd = process.env.NODE_ENV === 'production';",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/hardened-react-express/server/index.js",
+      "start_line": 17,
+      "end_line": 17
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-004-dbbc17f7",
+    "rule_id": "TG-SEC-004",
+    "title": "Sensitive Information in Logs",
+    "description": "Plaintext credential or token logged to output sink",
+    "severity": "Medium",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "examples/vulnerable-react-express/client/src/App.jsx",
+    "line_number": 30,
+    "matched_text": "console.log('Login token:', data.token, 'config:', clientConfig)",
+    "snippet": "    const data = await res.json();\n    // TG-CLIENT-002: Sensitive console logging\n    console.log('Login token:', data.token, 'config:', clientConfig);\n    setMessage(JSON.stringify(data));\n  }",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/client/src/App.jsx",
+      "start_line": 30,
+      "end_line": 30
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-CLIENT-001-1ba4789e",
+    "rule_id": "TG-CLIENT-001",
+    "title": "Public Production Source Maps",
+    "description": "Build config emitting unminified source maps in production output",
+    "severity": "Medium",
+    "category": "client",
+    "cluster": "cluster-client-leak",
+    "file_path": "examples/vulnerable-react-express/client/vite.config.js",
+    "line_number": 7,
+    "matched_text": "sourcemap: true",
+    "snippet": "export default defineConfig({\n  plugins: [react()],\n  build: { sourcemap: true },\n  server: {\n    port: 5173,",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/client/vite.config.js",
+      "start_line": 7,
+      "end_line": 7
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-004-08753da5",
+    "rule_id": "TG-SEC-004",
+    "title": "Sensitive Information in Logs",
+    "description": "Plaintext credential or token logged to output sink",
+    "severity": "Medium",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 28,
+    "matched_text": "console.log('Login attempt:', { email, password })",
+    "snippet": "app.post('/api/login', (req, res) => {\n  const { email, password } = req.body;\n  console.log('Login attempt:', { email, password }); // TG-SEC-004\n  const user = users.find((u) => u.email === email && u.password === password);\n  if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 28,
+      "end_line": 28
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-RATE-002-d67d7c98",
+    "rule_id": "TG-RATE-002",
+    "title": "Unlimited Public Write Endpoint",
+    "description": "Public submission endpoint defined without rate-limiting or captcha defense",
+    "severity": "Medium",
+    "category": "rate",
+    "cluster": "cluster-rate-limiting",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 54,
+    "matched_text": "app.post('/api/contact', (",
+    "snippet": "// TG-INPUT-001: No validation\n// TG-RATE-002: Unlimited contact endpoint\napp.post('/api/contact', (req, res) => {\n  res.json({ received: req.body });\n});",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 54,
+      "end_line": 54
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-PLATFORM-002-eef342ec",
+    "rule_id": "TG-PLATFORM-002",
+    "title": "Missing Security Headers",
+    "description": "Express application initialized without helmet security headers middleware",
+    "severity": "Medium",
+    "category": "platform",
+    "cluster": "cluster-platform",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 5,
+    "matched_text": "const app = express();",
+    "snippet": "const jwt = require('jsonwebtoken');\n\nconst app = express();\nconst PORT = 3001;\n",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 5,
+      "end_line": 5
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  }
+]