torusguard 1.3.4 → 1.3.6

package/.torusguard/runs/run-20260912-215731-audit/findings.md

@@ -0,0 +1,218 @@
+# TorusGuard Security Audit Findings: run-20260912-215731-audit
+- Target Root: `C:\Users\Admin\Desktop\TorusGuard`
+- Total Scored Findings: `15`
+- Identified Clusters: `7`
+- Generated At: `2026-09-12 21:57:31 IST`
+
+---
+## Summary of Findings
+
+### [Critical] TG-SEC-001 - Hardcoded Secret or API Key in Tracked Source
+- **Finding ID:** `TG-SEC-001-bb5e4b77`
+- **Location:** `examples/vulnerable-react-express/server/index.js:9`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded JWT signing secret
+```
+
+// TG-SEC-001: Hardcoded JWT secret
+const JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';
+
+// TG-PLATFORM-001: Wildcard CORS with credentials
+```
+
+### [Critical] TG-SEC-001 - Hardcoded Secret or API Key in Tracked Source
+- **Finding ID:** `TG-SEC-001-c393d596`
+- **Location:** `examples/vulnerable-react-express/server/index.js:18`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+
+const users = [
+  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },
+  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },
+];
+```
+
+### [Critical] TG-DB-002 - Privileged Database Credential in Browser Context
+- **Finding ID:** `TG-DB-002-d9bd69df`
+- **Location:** `demo/playground/vulnerable_nextjs/actions.ts:9`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-client-leak`
+- **Description:** Service role key or raw database connection string reference in frontend code
+```
+
+// Finding 1: TG-CLIENT-001 - Backend admin key exposed in client-accessible code
+export const SUPABASE_SERVICE_ROLE_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.demo_secret_token_1234567890";
+
+interface UserRecord {
+```
+
+### [Critical] TG-SSRF-004 - Unbounded Outbound Request Without Timeout
+- **Finding ID:** `TG-SSRF-004-d8472223`
+- **Location:** `examples/python/fastapi-vuln/main.py:9`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-ssrf`
+- **Description:** Python requests call without explicit timeout parameter
+```
+@app.get("/fetch")
+def fetch_url(url: str):
+    response = requests.get(url)
+    return {"status": response.status_code, "content": response.text}
+
+```
+
+### [High] TG-INPUT-003 - Unsafe Dynamic Code or HTML Execution
+- **Finding ID:** `TG-INPUT-003-fea9421e`
+- **Location:** `examples/vulnerable-react-express/client/src/App.jsx:53`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-injection`
+- **Description:** React dangerouslySetInnerHTML rendering raw unescaped HTML
+```
+
+      {/* TG-INPUT-003: Unsafe HTML rendering */}
+      <div dangerouslySetInnerHTML={{ __html: bio }} />
+
+      <button onClick={fetchUser}>Fetch user (IDOR demo)</button>
+```
+
+### [High] TG-PLATFORM-001 - Wildcard CORS With Credentials
+- **Finding ID:** `TG-PLATFORM-001-7dd35cb4`
+- **Location:** `examples/vulnerable-react-express/server/index.js:12`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Wildcard CORS origin configured in Express middleware
+```
+
+// TG-PLATFORM-001: Wildcard CORS with credentials
+app.use(cors({ origin: '*', credentials: true }));
+
+// TG-PLATFORM-004: No explicit JSON body size limit
+```
+
+### [High] TG-AUTH-003 - Missing Object-Level Authorization (IDOR)
+- **Finding ID:** `TG-AUTH-003-6a05e509`
+- **Location:** `examples/hardened-react-express/server/index.js:49`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** JWT verification missing explicit algorithms restriction parameter
+```
+  if (!token) return res.status(401).json({ error: 'Unauthorized' });
+  try {
+    req.user = jwt.verify(token, process.env.JWT_SECRET);
+    next();
+  } catch {
+```
+
+### [High] TG-INPUT-001 - Missing Server-Side Request Validation
+- **Finding ID:** `TG-INPUT-001-c7457f38`
+- **Location:** `examples/vulnerable-react-express/server/index.js:27`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-injection`
+- **Description:** Destructuring unvalidated req.body without schema validation
+```
+// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)
+app.post('/api/login', (req, res) => {
+  const { email, password } = req.body;
+  console.log('Login attempt:', { email, password }); // TG-SEC-004
+  const user = users.find((u) => u.email === email && u.password === password);
+```
+
+### [High] TG-RATE-001 - Unlimited Authentication Endpoint
+- **Finding ID:** `TG-RATE-001-dcd0a3c7`
+- **Location:** `examples/vulnerable-react-express/server/index.js:26`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-rate-limiting`
+- **Description:** Authentication POST endpoint defined without rate-limiting middleware
+```
+// TG-SEC-004: Logs sensitive data
+// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)
+app.post('/api/login', (req, res) => {
+  const { email, password } = req.body;
+  console.log('Login attempt:', { email, password }); // TG-SEC-004
+```
+
+### [Medium] TG-PLATFORM-002 - Missing Security Headers
+- **Finding ID:** `TG-PLATFORM-002-1f383dcf`
+- **Location:** `examples/hardened-react-express/server/index.js:17`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-platform`
+- **Description:** Express application initialized without helmet security headers middleware
+```
+}
+
+const app = express();
+const PORT = 3001;
+const isProd = process.env.NODE_ENV === 'production';
+```
+
+### [Medium] TG-SEC-004 - Sensitive Information in Logs
+- **Finding ID:** `TG-SEC-004-dbbc17f7`
+- **Location:** `examples/vulnerable-react-express/client/src/App.jsx:30`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Plaintext credential or token logged to output sink
+```
+    const data = await res.json();
+    // TG-CLIENT-002: Sensitive console logging
+    console.log('Login token:', data.token, 'config:', clientConfig);
+    setMessage(JSON.stringify(data));
+  }
+```
+
+### [Medium] TG-CLIENT-001 - Public Production Source Maps
+- **Finding ID:** `TG-CLIENT-001-1ba4789e`
+- **Location:** `examples/vulnerable-react-express/client/vite.config.js:7`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-client-leak`
+- **Description:** Build config emitting unminified source maps in production output
+```
+export default defineConfig({
+  plugins: [react()],
+  build: { sourcemap: true },
+  server: {
+    port: 5173,
+```
+
+### [Medium] TG-SEC-004 - Sensitive Information in Logs
+- **Finding ID:** `TG-SEC-004-08753da5`
+- **Location:** `examples/vulnerable-react-express/server/index.js:28`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Plaintext credential or token logged to output sink
+```
+app.post('/api/login', (req, res) => {
+  const { email, password } = req.body;
+  console.log('Login attempt:', { email, password }); // TG-SEC-004
+  const user = users.find((u) => u.email === email && u.password === password);
+  if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration
+```
+
+### [Medium] TG-RATE-002 - Unlimited Public Write Endpoint
+- **Finding ID:** `TG-RATE-002-d67d7c98`
+- **Location:** `examples/vulnerable-react-express/server/index.js:54`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-rate-limiting`
+- **Description:** Public submission endpoint defined without rate-limiting or captcha defense
+```
+// TG-INPUT-001: No validation
+// TG-RATE-002: Unlimited contact endpoint
+app.post('/api/contact', (req, res) => {
+  res.json({ received: req.body });
+});
+```
+
+### [Medium] TG-PLATFORM-002 - Missing Security Headers
+- **Finding ID:** `TG-PLATFORM-002-eef342ec`
+- **Location:** `examples/vulnerable-react-express/server/index.js:5`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-platform`
+- **Description:** Express application initialized without helmet security headers middleware
+```
+const jwt = require('jsonwebtoken');
+
+const app = express();
+const PORT = 3001;
+
+```

package/.torusguard/runs/run-20260912-215731-audit/manifest.json

@@ -0,0 +1,14 @@
+{
+  "run_id": "run-20260912-215731-audit",
+  "command": "audit",
+  "target_name": "TorusGuard",
+  "created_at": "2026-09-12 21:57:31 IST",
+  "created_at_iso": "2026-09-12T21:57:31.350864+05:30",
+  "status": "recheck_completed",
+  "torusguard_version": "1.3.0",
+  "findings_count": 15,
+  "confirmed_fixed_count": 12,
+  "regressed_count": 0,
+  "remediation_bundles_count": 14,
+  "remediated": 14
+}

package/.torusguard/runs/run-20260912-215731-audit/recheck.md

@@ -0,0 +1,76 @@
+# TorusGuard Differential Recheck Report
+**Run ID:** `run-20260912-215731-audit`  
+**Timestamp:** `2026-09-12 22:00:17 IST`  
+
+---
+## Recheck Transition Catalog
+
+### [TG-CLIENT-001] Public Production Source Maps
+- **File:** `examples/vulnerable-react-express/client/vite.config.js`
+- **Outcome:** `Confirmed Fixed`
+- **Verification Timestamp:** 2026-09-12 22:00:17 IST
+
+### [TG-DB-002] Privileged Database Credential in Browser Context
+- **File:** `demo/playground/vulnerable_nextjs/actions.ts`
+- **Outcome:** `Unresolved`
+- **Verification Timestamp:** 2026-09-12 22:00:17 IST
+
+### [TG-INPUT-001] Missing Server-Side Request Validation
+- **File:** `examples/vulnerable-react-express/server/index.js`
+- **Outcome:** `Unresolved`
+- **Verification Timestamp:** 2026-09-12 22:00:17 IST
+
+### [TG-INPUT-003] Unsafe Dynamic Code or HTML Execution
+- **File:** `examples/vulnerable-react-express/client/src/App.jsx`
+- **Outcome:** `Confirmed Fixed`
+- **Verification Timestamp:** 2026-09-12 22:00:17 IST
+
+### [TG-PLATFORM-001] Wildcard CORS With Credentials
+- **File:** `examples/vulnerable-react-express/server/index.js`
+- **Outcome:** `Confirmed Fixed`
+- **Verification Timestamp:** 2026-09-12 22:00:17 IST
+
+### [TG-PLATFORM-002] Missing Security Headers
+- **File:** `examples/hardened-react-express/server/index.js`
+- **Outcome:** `Confirmed Fixed`
+- **Verification Timestamp:** 2026-09-12 22:00:17 IST
+
+### [TG-PLATFORM-002] Missing Security Headers
+- **File:** `examples/vulnerable-react-express/server/index.js`
+- **Outcome:** `Confirmed Fixed`
+- **Verification Timestamp:** 2026-09-12 22:00:17 IST
+
+### [TG-RATE-001] Unlimited Authentication Endpoint
+- **File:** `examples/vulnerable-react-express/server/index.js`
+- **Outcome:** `Confirmed Fixed`
+- **Verification Timestamp:** 2026-09-12 22:00:17 IST
+
+### [TG-RATE-002] Unlimited Public Write Endpoint
+- **File:** `examples/vulnerable-react-express/server/index.js`
+- **Outcome:** `Confirmed Fixed`
+- **Verification Timestamp:** 2026-09-12 22:00:17 IST
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **File:** `examples/vulnerable-react-express/server/index.js`
+- **Outcome:** `Confirmed Fixed`
+- **Verification Timestamp:** 2026-09-12 22:00:17 IST
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **File:** `examples/vulnerable-react-express/server/index.js`
+- **Outcome:** `Confirmed Fixed`
+- **Verification Timestamp:** 2026-09-12 22:00:17 IST
+
+### [TG-SEC-004] Sensitive Information in Logs
+- **File:** `examples/vulnerable-react-express/server/index.js`
+- **Outcome:** `Confirmed Fixed`
+- **Verification Timestamp:** 2026-09-12 22:00:17 IST
+
+### [TG-SEC-004] Sensitive Information in Logs
+- **File:** `examples/vulnerable-react-express/client/src/App.jsx`
+- **Outcome:** `Confirmed Fixed`
+- **Verification Timestamp:** 2026-09-12 22:00:17 IST
+
+### [TG-SSRF-004] Unbounded Outbound Request Without Timeout
+- **File:** `examples/python/fastapi-vuln/main.py`
+- **Outcome:** `Confirmed Fixed`
+- **Verification Timestamp:** 2026-09-12 22:00:17 IST

package/.torusguard/runs/run-20260912-215731-audit/remediation.md

@@ -0,0 +1,234 @@
+# TorusGuard Governed Remediation Catalog
+**Run ID:** `run-20260912-215731-audit`  
+**Generated:** `2026-09-12 22:00:07 IST`  
+**Candidate Bundles Formulated:** `14`  
+
+---
+## Formulated Candidate Patches
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Target:** `examples/vulnerable-react-express/server/index.js:9` | **Bundle ID:** `bnd-tg-sec-001-9-e22e50`
+- **Strategy:** Migrated hardcoded JWT secret to environment variable process.env.JWT_SECRET
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -7,5 +7,5 @@
+ 
+ // TG-SEC-001: Hardcoded JWT secret
+-const JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';
++const JWT_SECRET = process.env.JWT_SECRET || "";
+ 
+ // TG-PLATFORM-001: Wildcard CORS with credentials
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Target:** `examples/vulnerable-react-express/server/index.js:18` | **Bundle ID:** `bnd-tg-sec-001-18-a3c1e8`
+- **Strategy:** Replaced hardcoded password with environment variable process.env.DEMO_USER_PASSWORD
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -16,5 +16,5 @@
+ 
+ const users = [
+-  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },
++  { id: '1', email: 'alice@demo.local', password: process.env.DEMO_USER_PASSWORD || "REDACTED_PASSWORD", name: 'Alice' },
+   { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },
+ ];
+```
+
+### [TG-DB-002] Privileged Database Credential in Browser Context
+- **Target:** `demo/playground/vulnerable_nextjs/actions.ts:9` | **Bundle ID:** `bnd-tg-db-002-9-5f7850`
+- **Strategy:** Replaced hardcoded privileged database credential with process.env.SUPABASE_SERVICE_ROLE_KEY
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/demo/playground/vulnerable_nextjs/actions.ts
++++ b/demo/playground/vulnerable_nextjs/actions.ts
+@@ -7,5 +7,5 @@
+ 
+ // Finding 1: TG-CLIENT-001 - Backend admin key exposed in client-accessible code
+-export const SUPABASE_SERVICE_ROLE_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.demo_secret_token_1234567890";
++export const SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY || "";
+ 
+ interface UserRecord {
+```
+
+### [TG-SSRF-004] Unbounded Outbound Request Without Timeout
+- **Target:** `examples/python/fastapi-vuln/main.py:9` | **Bundle ID:** `bnd-tg-ssrf-004-9-9803ad`
+- **Strategy:** Injected explicit 10-second request timeout to prevent resource exhaustion
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/examples/python/fastapi-vuln/main.py
++++ b/examples/python/fastapi-vuln/main.py
+@@ -7,5 +7,5 @@
+ @app.get("/fetch")
+ def fetch_url(url: str):
+-    response = requests.get(url)
++    response = requests.get(url, timeout=10)
+     return {"status": response.status_code, "content": response.text}
+```
+
+### [TG-INPUT-003] Unsafe Dynamic Code or HTML Execution
+- **Target:** `examples/vulnerable-react-express/client/src/App.jsx:53` | **Bundle ID:** `bnd-tg-input-003-53-d167b4`
+- **Strategy:** Replaced raw dangerouslySetInnerHTML injection with safe React text interpolation
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/examples/vulnerable-react-express/client/src/App.jsx
++++ b/examples/vulnerable-react-express/client/src/App.jsx
+@@ -51,5 +51,5 @@
+ 
+       {/* TG-INPUT-003: Unsafe HTML rendering */}
+-      <div dangerouslySetInnerHTML={{ __html: bio }} />
++      <div>{bio}</div>
+ 
+       <button onClick={fetchUser}>Fetch user (IDOR demo)</button>
+```
+
+### [TG-PLATFORM-001] Wildcard CORS With Credentials
+- **Target:** `examples/vulnerable-react-express/server/index.js:12` | **Bundle ID:** `bnd-tg-platform-001-12-cf8156`
+- **Strategy:** Constrained wildcard CORS origin to process.env.ALLOWED_ORIGIN with secure fallback
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -10,5 +10,5 @@
+ 
+ // TG-PLATFORM-001: Wildcard CORS with credentials
+-app.use(cors({ origin: '*', credentials: true }));
++app.use(cors({ origin: process.env.ALLOWED_ORIGIN || 'http://localhost:5173', credentials: true }));
+ 
+ // TG-PLATFORM-004: No explicit JSON body size limit
+```
+
+### [TG-INPUT-001] Missing Server-Side Request Validation
+- **Target:** `examples/vulnerable-react-express/server/index.js:27` | **Bundle ID:** `bnd-tg-input-001-27-2486f1`
+- **Strategy:** Added defensive request body payload validation before destructuring
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -25,5 +25,5 @@
+ // TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)
+ app.post('/api/login', (req, res) => {
+-  const { email, password } = req.body;
++  if (!req.body || typeof req.body !== "object") return res.status(400).json({ error: "Invalid payload" });
+  const { email, password } = req.body;
+   console.log('Login attempt:', { email, password }); // TG-SEC-004
+   const user = users.find((u) => u.email === email && u.password === password);
+```
+
+### [TG-RATE-001] Unlimited Authentication Endpoint
+- **Target:** `examples/vulnerable-react-express/server/index.js:26` | **Bundle ID:** `bnd-tg-rate-001-26-affcfa`
+- **Strategy:** Injected authLimiter rate-limiting middleware to protect authentication endpoint from brute force
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -24,5 +24,5 @@
+ // TG-SEC-004: Logs sensitive data
+ // TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)
+-app.post('/api/login', (req, res) => {
++app.post('/api/login', authLimiter, (req, res) => {
+   const { email, password } = req.body;
+   console.log('Login attempt:', { email, password }); // TG-SEC-004
+```
+
+### [TG-PLATFORM-002] Missing Security Headers
+- **Target:** `examples/hardened-react-express/server/index.js:17` | **Bundle ID:** `bnd-tg-platform-002-17-876973`
+- **Strategy:** Injected helmet security headers middleware into Express application
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/examples/hardened-react-express/server/index.js
++++ b/examples/hardened-react-express/server/index.js
+@@ -15,5 +15,5 @@
+ }
+ 
+-const app = express();
++const helmet = require("helmet");
+const app = express();
+app.use(helmet());
+ const PORT = 3001;
+ const isProd = process.env.NODE_ENV === 'production';
+```
+
+### [TG-SEC-004] Sensitive Information in Logs
+- **Target:** `examples/vulnerable-react-express/client/src/App.jsx:30` | **Bundle ID:** `bnd-tg-sec-004-30-00569e`
+- **Strategy:** Redacted console logging of sensitive token or credential
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/examples/vulnerable-react-express/client/src/App.jsx
++++ b/examples/vulnerable-react-express/client/src/App.jsx
+@@ -28,5 +28,5 @@
+     const data = await res.json();
+     // TG-CLIENT-002: Sensitive console logging
+-    console.log('Login token:', data.token, 'config:', clientConfig);
++    // Security: Sensitive credential log removed per TG-SEC-004
+     setMessage(JSON.stringify(data));
+   }
+```
+
+### [TG-CLIENT-001] Public Production Source Maps
+- **Target:** `examples/vulnerable-react-express/client/vite.config.js:7` | **Bundle ID:** `bnd-tg-client-001-7-587129`
+- **Strategy:** Disabled public production source map emission
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/examples/vulnerable-react-express/client/vite.config.js
++++ b/examples/vulnerable-react-express/client/vite.config.js
+@@ -5,5 +5,5 @@
+ export default defineConfig({
+   plugins: [react()],
+-  build: { sourcemap: true },
++  build: { sourcemap: false },
+   server: {
+     port: 5173,
+```
+
+### [TG-SEC-004] Sensitive Information in Logs
+- **Target:** `examples/vulnerable-react-express/server/index.js:28` | **Bundle ID:** `bnd-tg-sec-004-28-a1a0a1`
+- **Strategy:** Redacted console logging of sensitive token or credential
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -26,5 +26,5 @@
+ app.post('/api/login', (req, res) => {
+   const { email, password } = req.body;
+-  console.log('Login attempt:', { email, password }); // TG-SEC-004
++  // Security: Sensitive credential log removed per TG-SEC-004
+   const user = users.find((u) => u.email === email && u.password === password);
+   if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration
+```
+
+### [TG-RATE-002] Unlimited Public Write Endpoint
+- **Target:** `examples/vulnerable-react-express/server/index.js:54` | **Bundle ID:** `bnd-tg-rate-002-54-0b38d2`
+- **Strategy:** Injected writeLimiter rate-limiting middleware to public write endpoint
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -52,5 +52,5 @@
+ // TG-INPUT-001: No validation
+ // TG-RATE-002: Unlimited contact endpoint
+-app.post('/api/contact', (req, res) => {
++app.post('/api/contact', writeLimiter, (req, res) => {
+   res.json({ received: req.body });
+ });
+```
+
+### [TG-PLATFORM-002] Missing Security Headers
+- **Target:** `examples/vulnerable-react-express/server/index.js:5` | **Bundle ID:** `bnd-tg-platform-002-5-40c794`
+- **Strategy:** Injected helmet security headers middleware into Express application
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -3,5 +3,5 @@
+ const jwt = require('jsonwebtoken');
+ 
+-const app = express();
++const helmet = require("helmet");
+const app = express();
+app.use(helmet());
+ const PORT = 3001;
+```

package/.torusguard/runs/run-20260912-215731-audit/summary.md

@@ -0,0 +1,5 @@
+# TorusGuard Audit Summary: run-20260912-215731-audit
+- Scanned Scope: C:\Users\Admin\Desktop\TorusGuard
+- Total Findings: 15
+- Root-Cause Clusters: 7
+- Generated: 2026-09-12 21:57:31 IST

package/.torusguard/runs/run-20260912-220134-audit/findings.json

@@ -0,0 +1,68 @@
+[
+  {
+    "finding_id": "TG-SEC-002-d6272a02",
+    "rule_id": "TG-SEC-002",
+    "title": "Public Client Environment Variable Secret Exposure",
+    "description": "Client-exposed environment variable containing secret naming pattern",
+    "severity": "Critical",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "demo/playground/vulnerable_nextjs/actions.ts",
+    "line_number": 9,
+    "matched_text": "NEXT_PUBLIC_SUPABASE_ANON_KEY",
+    "snippet": "\n// Finding 1: TG-CLIENT-001 - Backend admin key SUPABASE_SERVICE_ROLE_KEY must not be exposed in client-accessible code\nexport const SUPABASE_ANON_KEY = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY || \"\";\n\ninterface UserRecord {",
+    "is_test": false,
+    "target": {
+      "file_path": "demo/playground/vulnerable_nextjs/actions.ts",
+      "start_line": 9,
+      "end_line": 9
+    },
+    "confidence_score": 55,
+    "confidence_band": "Medium Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 0,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 55,
+      "classification_band": "Medium Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-INPUT-001-dbe9cc30",
+    "rule_id": "TG-INPUT-001",
+    "title": "Missing Server-Side Request Validation",
+    "description": "Destructuring unvalidated req.body without schema validation",
+    "severity": "High",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 77,
+    "matched_text": "const { email } = req.body;",
+    "snippet": "// TG-AUTH-005: Unsafe password reset\napp.post('/api/reset', (req, res) => {\n  const { email } = req.body;\n  const user = users.find((u) => u.email === email);\n  if (!user) return res.status(404).json({ error: 'Email not registered' }); // enumeration",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 77,
+      "end_line": 77
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  }
+]

package/.torusguard/runs/run-20260912-220134-audit/findings.md

@@ -0,0 +1,36 @@
+# TorusGuard Security Audit Findings: run-20260912-220134-audit
+- Target Root: `C:\Users\Admin\Desktop\TorusGuard`
+- Total Scored Findings: `2`
+- Identified Clusters: `2`
+- Generated At: `2026-09-12 22:01:34 IST`
+
+---
+## Summary of Findings
+
+### [Critical] TG-SEC-002 - Public Client Environment Variable Secret Exposure
+- **Finding ID:** `TG-SEC-002-d6272a02`
+- **Location:** `demo/playground/vulnerable_nextjs/actions.ts:9`
+- **Confidence Score:** `55/100` (Medium Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Client-exposed environment variable containing secret naming pattern
+```
+
+// Finding 1: TG-CLIENT-001 - Backend admin key SUPABASE_SERVICE_ROLE_KEY must not be exposed in client-accessible code
+export const SUPABASE_ANON_KEY = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY || "";
+
+interface UserRecord {
+```
+
+### [High] TG-INPUT-001 - Missing Server-Side Request Validation
+- **Finding ID:** `TG-INPUT-001-dbe9cc30`
+- **Location:** `examples/vulnerable-react-express/server/index.js:77`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-injection`
+- **Description:** Destructuring unvalidated req.body without schema validation
+```
+// TG-AUTH-005: Unsafe password reset
+app.post('/api/reset', (req, res) => {
+  const { email } = req.body;
+  const user = users.find((u) => u.email === email);
+  if (!user) return res.status(404).json({ error: 'Email not registered' }); // enumeration
+```

package/.torusguard/runs/run-20260912-220134-audit/manifest.json

@@ -0,0 +1,12 @@
+{
+  "run_id": "run-20260912-220134-audit",
+  "command": "audit",
+  "target_name": "TorusGuard",
+  "created_at": "2026-09-12 22:01:34 IST",
+  "created_at_iso": "2026-09-12T22:01:34.272429+05:30",
+  "status": "completed",
+  "torusguard_version": "1.3.0",
+  "findings_count": 2,
+  "confirmed_fixed_count": 0,
+  "regressed_count": 0
+}

package/.torusguard/runs/run-20260912-220134-audit/summary.md

@@ -0,0 +1,5 @@
+# TorusGuard Audit Summary: run-20260912-220134-audit
+- Scanned Scope: C:\Users\Admin\Desktop\TorusGuard
+- Total Findings: 2
+- Root-Cause Clusters: 2
+- Generated: 2026-09-12 22:01:34 IST

package/.torusguard/runs/run-20260912-220200-audit/findings.json

@@ -0,0 +1 @@
+[]