torusguard 1.3.4 → 1.3.6

package/skills/torusguard/payload/rules/business-logic/TG-BIZ-004-unrestricted-sensitive-business-flow.md

@@ -1,37 +1,47 @@
 # TG-BIZ-004: Unrestricted Sensitive Business Flow
 
 ## Severity
-High by default. Raise to Critical when applicable.
+High. Critical administrative or high-impact actions lacking step-up authentication, secondary confirmation, or multi-person governance allow compromised sessions to inflict irreversible damage.
 
 ## Applies To
-- Relevant endpoints and services
+- Tenant Deletion, Role Escalation, API Key Rotation, Wire Transfers
+- Node.js, Python, Go, Java, C#
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+Session hijacking, CSRF, or brief workstation abandonment can allow attackers to execute destructive operations (such as purging an entire organization's database or transferring company funds) if the flow executes immediately on a single unconfirmed click.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- Destructive administrative endpoints (`/delete-organization`, `/transfer-ownership`) executing without recent password re-authentication, MFA step-up verification, or explicit confirmation tokens.
 
 ## Unsafe Example
 ```javascript
-// Unsafe code example
+// UNSAFE: Destructive deletion executing without password re-verification
+app.delete('/api/orgs/:id', authMiddleware, async (req, res) => {
+  await db.org.delete({ where: { id: req.params.id } });
+  res.json({ success: true });
+});
 ```
 
 ## Safe Example
 ```javascript
-// Safe code example
+// SAFE: Requiring password re-authentication before executing destructive action
+app.delete('/api/orgs/:id', authMiddleware, async (req, res) => {
+  const { confirmPassword } = req.body;
+  const isValid = await verifyPassword(req.user.id, confirmPassword);
+  if (!isValid) return res.status(403).json({ error: 'Invalid password confirmation' });
+  await db.org.delete({ where: { id: req.params.id } });
+  res.json({ success: true });
+});
 ```
 
-## Remediation
-1. Step one
-2. Step two
-
-## Verification
-- Test case 1
-- Test case 2
+## Ponytail Remediation Budget
+- Additions: <= 12 lines
+- Deletions: <= 2 lines
 
-## False Positives and Exceptions
-An exception requires documented review.
+## Remediation
+1. Enforce step-up authentication (password re-prompt or TOTP code) on high-risk endpoints.
+2. Implement two-stage confirmation (`DELETE` requires prior confirmation token).
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-AUTH-002`: Client-Only Authorization
+- `TG-RATE-003`: Unbounded Resource Consumption

package/skills/torusguard/payload/rules/cache/TG-CACHE-001-sensitive-response-publicly-cacheable.md

@@ -1,37 +1,45 @@
 # TG-CACHE-001: Sensitive Response Publicly Cacheable
 
 ## Severity
-High by default. Raise to Critical when applicable.
+High. Serving authenticated personal data, financial records, or credentials without private `Cache-Control` headers allows shared intermediary proxy servers and CDNs to cache and leak sensitive records to other users.
 
 ## Applies To
-- Relevant endpoints and services
+- Authenticated Endpoints, User Profiles, Billing Dashboards
+- Express, Next.js, FastAPI, Django, Flask, Rails, Spring
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+When endpoints returning PII omit cache control directives, shared corporate proxies or public edge CDNs may cache the response. Subsequent requests from other users on the same proxy can receive the cached personal data of the initial requester.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- Routes returning user profiles, tokens, or private data with `Cache-Control: public` or missing `Cache-Control` entirely.
 
 ## Unsafe Example
 ```javascript
-// Unsafe code example
+// UNSAFE: Missing cache control or explicitly public caching on private data
+app.get('/api/user/profile', authMiddleware, (req, res) => {
+  res.set('Cache-Control', 'public, max-age=3600');
+  res.json(req.user);
+});
 ```
 
 ## Safe Example
 ```javascript
-// Safe code example
+// SAFE: Explicit private no-store cache control on sensitive responses
+app.get('/api/user/profile', authMiddleware, (req, res) => {
+  res.set('Cache-Control', 'no-store, no-cache, must-revalidate, private');
+  res.set('Pragma', 'no-cache');
+  res.json(req.user);
+});
 ```
 
-## Remediation
-1. Step one
-2. Step two
-
-## Verification
-- Test case 1
-- Test case 2
+## Ponytail Remediation Budget
+- Additions: <= 4 lines
+- Deletions: <= 2 lines
 
-## False Positives and Exceptions
-An exception requires documented review.
+## Remediation
+1. Inject global middleware setting `Cache-Control: no-store, private` on all authenticated API responses.
+2. Verify reverse proxies and CDNs do not cache responses containing `Authorization` or `Cookie` headers.
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-CACHE-002`: Missing User Cache Isolation
+- `TG-PLATFORM-002`: Missing Security Headers

package/skills/torusguard/payload/rules/cache/TG-CACHE-002-missing-user-cache-isolation.md

@@ -1,37 +1,51 @@
 # TG-CACHE-002: Missing User Cache Isolation
 
 ## Severity
-High by default. Raise to Critical when applicable.
+High. Storing per-user computed assets or database query results in shared application memory caches (Redis, Memcached) without tenant or user ID scoping leads to cross-user data leakage.
 
 ## Applies To
-- Relevant endpoints and services
+- Application Caching Layers (Redis, Memcached, LRU Caches)
+- Node.js, Python, Go, Java
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+If cache keys are formed using generic keys (e.g., `cache:dashboard_summary`) rather than tenant-qualified keys (`cache:tenant_{tid}:user_{uid}:dashboard_summary`), the first user to query the dashboard caches their data, and all subsequent users receive that cached data.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- Cache get/set calls where the cache key lacks user or tenant identifier variables.
 
 ## Unsafe Example
-```javascript
-// Unsafe code example
+```python
+# UNSAFE: Generic cache key shared across all users
+@app.get("/api/dashboard")
+def get_dashboard(user: User = Depends(get_current_user)):
+    data = cache.get("dashboard_data")
+    if not data:
+        data = generate_dashboard(user.id)
+        cache.set("dashboard_data", data, expire=300)
+    return data
 ```
 
 ## Safe Example
-```javascript
-// Safe code example
+```python
+# SAFE: Fully isolated cache key scoped by tenant and user
+@app.get("/api/dashboard")
+def get_dashboard(user: User = Depends(get_current_user)):
+    cache_key = f"dashboard:tenant_{user.tenant_id}:user_{user.id}"
+    data = cache.get(cache_key)
+    if not data:
+        data = generate_dashboard(user.id)
+        cache.set(cache_key, data, expire=300)
+    return data
 ```
 
-## Remediation
-1. Step one
-2. Step two
-
-## Verification
-- Test case 1
-- Test case 2
+## Ponytail Remediation Budget
+- Additions: <= 6 lines
+- Deletions: <= 3 lines
 
-## False Positives and Exceptions
-An exception requires documented review.
+## Remediation
+1. Always prefix cache keys with organizational and user identifiers.
+2. Clear tenant cache keys immediately upon logout or permissions change.
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-DB-004`: Missing Multi-Tenant Query Isolation
+- `TG-CACHE-001`: Sensitive Response Publicly Cacheable

package/skills/torusguard/payload/rules/cache/TG-CACHE-003-sensitive-data-in-url.md

@@ -1,37 +1,44 @@
-# TG-CACHE-003: Sensitive Data in URL
+# TG-CACHE-003: Sensitive Data in URL Query Parameters
 
 ## Severity
-High by default. Raise to Critical when applicable.
+Medium. Passing API keys, session tokens, passwords, or PII in URL query parameters causes secrets to be persisted in browser histories, web server access logs, and HTTP `Referer` headers.
 
 ## Applies To
-- Relevant endpoints and services
+- Authentication Flows, Invitation Links, Reset Handlers
+- Frontend JS, Express, Django, FastAPI, Go, PHP
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+URLs are routinely logged in plaintext by reverse proxies, load balancers, CDN providers, and browser histories. If tokens are in query strings (`/login?token=xyz`), any external asset loaded on the page receives the token in the `Referer` header.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- Query parameter patterns matching `api_key=`, `token=`, `secret=`, or `password=` in GET routes.
 
 ## Unsafe Example
 ```javascript
-// Unsafe code example
+// UNSAFE: Accepting credentials or tokens in URL query string
+app.get('/api/auth/callback', (req, res) => {
+  const { apiKey, password } = req.query;
+  authenticate(apiKey, password);
+});
 ```
 
 ## Safe Example
 ```javascript
-// Safe code example
+// SAFE: Passing credentials in Authorization header or POST request body
+app.post('/api/auth/token', (req, res) => {
+  const { apiKey, password } = req.body;
+  authenticate(apiKey, password);
+});
 ```
 
-## Remediation
-1. Step one
-2. Step two
-
-## Verification
-- Test case 1
-- Test case 2
+## Ponytail Remediation Budget
+- Additions: <= 6 lines
+- Deletions: <= 3 lines
 
-## False Positives and Exceptions
-An exception requires documented review.
+## Remediation
+1. Migrate authentication parameters to `Authorization: Bearer` headers or JSON request bodies via POST.
+2. Strip sensitive query parameters from URLs using history replace state before page render.
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-SEC-001`: Hardcoded Secret or API Key in Tracked Source
+- `TG-SEC-004`: Sensitive Information in Logs

package/skills/torusguard/payload/rules/csrf/TG-CSRF-001-missing-csrf-protection.md

@@ -1,37 +1,50 @@
 # TG-CSRF-001: Missing CSRF Protection
 
 ## Severity
-High by default. Raise to Critical when applicable.
+Critical. State-changing endpoints (POST, PUT, DELETE, PATCH) that rely on ambient credentials (cookies, basic auth) without CSRF tokens or SameSite cookie protection allow malicious third-party websites to execute actions on behalf of authenticated users.
 
 ## Applies To
-- Relevant endpoints and services
+- Traditional Form Submissions, Cookie-Authenticated REST APIs
+- Express (csurf), Django, Flask (Flask-WTF), Rails, Spring Security, ASP.NET Core
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+If a banking or SaaS application authenticates requests solely via browser cookies, a user visiting a malicious site can be tricked into submitting unauthorized form requests that the browser will automatically authenticate with the user's cookies.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- State-changing route handlers lacking CSRF middleware, CSRF tokens in headers, or explicit SameSite cookie configurations.
+- Explicit disabling of CSRF protection (e.g. `@csrf_exempt`, `csrf().disable()`).
 
 ## Unsafe Example
-```javascript
-// Unsafe code example
+```python
+# UNSAFE: Disabling CSRF protection on state-changing endpoint
+from django.views.decorators.csrf import csrf_exempt
+
+@csrf_exempt
+def update_email(request):
+    request.user.email = request.POST.get("email")
+    request.user.save()
 ```
 
 ## Safe Example
-```javascript
-// Safe code example
+```python
+# SAFE: Enforcing CSRF token verification
+from django.views.decorators.csrf import csrf_protect
+
+@csrf_protect
+def update_email(request):
+    request.user.email = request.POST.get("email")
+    request.user.save()
 ```
 
-## Remediation
-1. Step one
-2. Step two
-
-## Verification
-- Test case 1
-- Test case 2
+## Ponytail Remediation Budget
+- Additions: <= 4 lines
+- Deletions: <= 2 lines
 
-## False Positives and Exceptions
-An exception requires documented review.
+## Remediation
+1. Never disable framework CSRF protection with `@csrf_exempt` or `csrf().disable()`.
+2. Configure session cookies with `SameSite: 'Lax'` or `'Strict'`.
+3. For single-page applications, validate custom headers (e.g. `X-Requested-With`, `X-CSRF-Token`).
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-AUTH-004`: Insecure Session Cookie Configuration
+- `TG-PLATFORM-001`: Wildcard CORS With Credentials

package/skills/torusguard/payload/rules/csrf/TG-CSRF-002-unsafe-credentialed-cross-origin-request.md

@@ -1,37 +1,48 @@
-# TG-CSRF-002: Unsafe Credentialed Cross-Origin Request
+# TG-CSRF-002: Unsafe Credentialed Cross-Origin Requests
 
 ## Severity
-High by default. Raise to Critical when applicable.
+Critical. Enabling credentialed cross-origin access (`credentials: true` / `Access-Control-Allow-Credentials: true`) combined with dynamic reflection of incoming `Origin` headers allows any untrusted domain to read authenticated responses.
 
 ## Applies To
-- Relevant endpoints and services
+- CORS Middleware Configurations
+- Express (cors), FastAPI, Flask-CORS, Django-cors-headers, Spring Security
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+When a server blindly reflects the `Origin` header while allowing credentials, any malicious site visited by an authenticated user can make cross-origin requests and read private user data, completely circumventing the Same-Origin Policy.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- CORS configurations reflecting `req.headers.origin` directly when `credentials: true` is enabled.
 
 ## Unsafe Example
 ```javascript
-// Unsafe code example
+// UNSAFE: Blindly reflecting any origin with credentials enabled
+app.use(cors({
+  origin: (origin, callback) => callback(null, true),
+  credentials: true
+}));
 ```
 
 ## Safe Example
 ```javascript
-// Safe code example
+// SAFE: Strictly validating origin against an explicit environment allowlist
+const allowedOrigins = (process.env.ALLOWED_ORIGINS || 'https://app.example.com').split(',');
+app.use(cors({
+  origin: (origin, callback) => {
+    if (!origin || allowedOrigins.includes(origin)) return callback(null, true);
+    callback(new Error('Blocked by CORS'));
+  },
+  credentials: true
+}));
 ```
 
-## Remediation
-1. Step one
-2. Step two
-
-## Verification
-- Test case 1
-- Test case 2
+## Ponytail Remediation Budget
+- Additions: <= 8 lines
+- Deletions: <= 4 lines
 
-## False Positives and Exceptions
-An exception requires documented review.
+## Remediation
+1. Restrict CORS origins to a static, verified allowlist stored in environment variables.
+2. Never reflect untrusted `req.headers.origin` when credentials are permitted.
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-PLATFORM-001`: Wildcard CORS With Credentials
+- `TG-CSRF-001`: Missing CSRF Protection

package/skills/torusguard/payload/rules/graphql/TG-GQL-002-resolver-missing-authorization.md

@@ -1,37 +1,53 @@
-# TG-GQL-002: Resolver Missing Authorization
+# TG-GQL-002: GraphQL Resolver Missing Authorization
 
 ## Severity
-High by default. Raise to Critical when applicable.
+High. Exposing GraphQL mutation or query resolvers without granular user ownership or role authorization checks allows authenticated users to query or mutate records belonging to other tenants.
 
 ## Applies To
-- Relevant endpoints and services
+- GraphQL Servers (Apollo Server, Yoga, Pothos, Graphene)
+- Node.js, Python, Go, Java
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+In GraphQL, nested queries allow clients to traverse relationships (e.g. `user { organization { members { invoices } } }`). If individual field resolvers fail to assert ownership, users can traverse schema graphs to access unauthorized tenant resources.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- GraphQL resolver functions querying database entities directly by `args.id` without checking `context.user` or filtering by `context.tenantId`.
 
 ## Unsafe Example
 ```javascript
-// Unsafe code example
+// UNSAFE: Querying invoice directly by ID without checking user or tenant
+const resolvers = {
+  Query: {
+    invoice: async (_, { id }) => {
+      return await db.invoice.findUnique({ where: { id } });
+    }
+  }
+};
 ```
 
 ## Safe Example
 ```javascript
-// Safe code example
+// SAFE: Scoping query by tenant and authenticated user context
+const resolvers = {
+  Query: {
+    invoice: async (_, { id }, context) => {
+      if (!context.user) throw new Error('Unauthorized');
+      return await db.invoice.findFirst({
+        where: { id, tenantId: context.user.tenantId }
+      });
+    }
+  }
+};
 ```
 
-## Remediation
-1. Step one
-2. Step two
-
-## Verification
-- Test case 1
-- Test case 2
+## Ponytail Remediation Budget
+- Additions: <= 8 lines
+- Deletions: <= 2 lines
 
-## False Positives and Exceptions
-An exception requires documented review.
+## Remediation
+1. Enforce shield/guard middleware or resolver-level ownership checks on all query and mutation fields.
+2. Pass authenticated `context` to all database queries and enforce `tenantId` constraints.
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-DB-004`: Missing Multi-Tenant Query Isolation
+- `TG-AUTH-003`: Missing Object-Level Authorization (IDOR)

package/skills/torusguard/payload/rules/graphql/TG-GQL-003-unbounded-graphql-pagination-or-batching.md

@@ -1,37 +1,52 @@
 # TG-GQL-003: Unbounded GraphQL Pagination or Batching
 
 ## Severity
-High by default. Raise to Critical when applicable.
+Medium. Permitting unbounded `first`, `limit`, or batching queries in GraphQL enables resource exhaustion and Denial of Service (DoS).
 
 ## Applies To
-- Relevant endpoints and services
+- Apollo Server, GraphQL Yoga, Graphene
+- Node.js, Python, Go
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+Clients can request `users(first: 1000000)` or send a batched array of 500 queries in a single HTTP request, forcing the server to exhaust memory and database connection pools.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- Resolvers accepting integer `first` / `limit` arguments without enforcing a maximum cap (e.g. `Math.min(limit, 100)`).
 
 ## Unsafe Example
 ```javascript
-// Unsafe code example
+// UNSAFE: Directly passing client-controlled limit to database
+const resolvers = {
+  Query: {
+    users: async (_, { limit = 50 }) => {
+      return await db.user.findMany({ take: limit }); // Attacker passes limit: 500000
+    }
+  }
+};
 ```
 
 ## Safe Example
 ```javascript
-// Safe code example
+// SAFE: Enforcing strict maximum upper bound on pagination
+const MAX_LIMIT = 100;
+const resolvers = {
+  Query: {
+    users: async (_, { limit = 20 }) => {
+      const safeLimit = Math.min(Math.max(1, limit), MAX_LIMIT);
+      return await db.user.findMany({ take: safeLimit });
+    }
+  }
+};
 ```
 
-## Remediation
-1. Step one
-2. Step two
-
-## Verification
-- Test case 1
-- Test case 2
+## Ponytail Remediation Budget
+- Additions: <= 5 lines
+- Deletions: <= 2 lines
 
-## False Positives and Exceptions
-An exception requires documented review.
+## Remediation
+1. Enforce maximum limit boundaries on all pagination arguments.
+2. Disable batched HTTP query execution unless explicitly required.
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-RATE-003`: Unbounded Resource Consumption
+- `TG-GQL-001`: Missing Query Depth Limits

package/skills/torusguard/payload/rules/graphql/TG-GQL-004-unnecessary-production-introspection.md

@@ -1,37 +1,46 @@
 # TG-GQL-004: Unnecessary Production Introspection
 
 ## Severity
-High by default. Raise to Critical when applicable.
+Medium. Enabling GraphQL schema introspection in production environments reveals full schema types, queries, mutations, and deprecated fields to external attackers.
 
 ## Applies To
-- Relevant endpoints and services
+- GraphQL Servers (Apollo, Yoga, Mercurius, Helix)
+- Production Node.js, Python, Go deployments
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+While introspection powers developer tools like Apollo Studio and GraphiQL, in production it provides attackers with an automated blueprint of the internal API surface, administrative fields, and hidden parameters.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- GraphQL server initialization setting `introspection: true` or failing to disable introspection when `NODE_ENV === 'production'`.
 
 ## Unsafe Example
 ```javascript
-// Unsafe code example
+// UNSAFE: Introspection unconditionally enabled
+const server = new ApolloServer({
+  typeDefs,
+  resolvers,
+  introspection: true
+});
 ```
 
 ## Safe Example
 ```javascript
-// Safe code example
+// SAFE: Introspection restricted to non-production environments
+const server = new ApolloServer({
+  typeDefs,
+  resolvers,
+  introspection: process.env.NODE_ENV !== 'production'
+});
 ```
 
-## Remediation
-1. Step one
-2. Step two
-
-## Verification
-- Test case 1
-- Test case 2
+## Ponytail Remediation Budget
+- Additions: <= 2 lines
+- Deletions: <= 2 lines
 
-## False Positives and Exceptions
-An exception requires documented review.
+## Remediation
+1. Bind `introspection` to environment checks (`process.env.NODE_ENV !== 'production'`).
+2. Disable GraphQL Playground and Apollo Sandbox in production.
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-PLATFORM-003`: Production Stack Trace Exposure
+- `TG-CLIENT-001`: Public Production Source Maps