torusguard 1.3.5 → 1.4.0

package/.torusguard/runs/run-20260918-104236-audit/findings.md

@@ -0,0 +1,960 @@
+# TorusGuard Security Audit Findings: run-20260918-104236-audit
+- Target Root: `C:\Users\Admin\Desktop\TorusGuard`
+- Total Scored Findings: `68`
+- Identified Clusters: `9`
+- Generated At: `2026-09-18 10:42:36 IST`
+
+---
+## Summary of Findings
+
+### [Critical] TG-INPUT-002 - Raw SQL Concatenation
+- **Finding ID:** `TG-INPUT-002-f8cd11b9`
+- **Location:** `harness/runner.py:258`
+- **Confidence Score:** `84/100` (High Confidence)
+- **Cluster:** `cluster-injection`
+- **Description:** Python f-string interpolation in raw SQL query
+```
+            framework_pattern=FrameworkPattern(
+                framework="Django",
+                unsafe_snippet="User.objects.raw(f'SELECT * FROM users WHERE name = {name}')",
+                safe_snippet="User.objects.raw('SELECT * FROM users WHERE name = %s', [name])",
+            ),
+```
+
+### [Critical] TG-SEC-001 - Hardcoded Secret or API Key in Tracked Source
+- **Finding ID:** `TG-SEC-001-593d6437`
+- **Location:** `harness/runner.py:211`
+- **Confidence Score:** `81/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+            type=EvidenceType.SOURCE,
+            location="server/auth.py:42",
+            raw_snippet="SECRET_KEY = 'super_secret_jwt_key'",
+            rationale="Hardcoded secret credential.",
+            confidence_level=ConfidenceBand.CONFIRMED,
+```
+
+### [Critical] TG-SEC-001 - Hardcoded Secret or API Key in Tracked Source
+- **Finding ID:** `TG-SEC-001-e0a84cf3`
+- **Location:** `harness/runner.py:221`
+- **Confidence Score:** `81/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+    def test_sensitive_data_masking(self):
+        print("\n6. Testing Sensitive Secret & Token Masking...")
+        sample_secret = "API_KEY = 'sk_live_998877665544332211'"
+        masked = mask_sensitive_data(sample_secret)
+        self.log_test("Stripe Secret Key Redaction", "sk_live_***REDACTED***" in masked and "998877665544332211" not in masked)
+```
+
+### [Critical] TG-SEC-001 - Hardcoded Secret or API Key in Tracked Source
+- **Finding ID:** `TG-SEC-001-88c9bb29`
+- **Location:** `harness/runner.py:392`
+- **Confidence Score:** `81/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+            type=EvidenceType.SOURCE,
+            location="settings.py:10",
+            raw_snippet="DEBUG = True\nSECRET_KEY = 'sk_live_secret_key_12345'",
+            rationale="Production debug mode exposure and hardcoded secret.",
+            confidence_level=ConfidenceBand.CONFIRMED,
+```
+
+### [Critical] TG-SEC-001 - Hardcoded Secret or API Key in Tracked Source
+- **Finding ID:** `TG-SEC-001-c616aefd`
+- **Location:** `harness/validate_qa_v0_6_0.py:64`
+- **Confidence Score:** `77/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+            "tiny-repo": {
+                "vulnerable": {
+                    "app.py": 'DEBUG = True\nSECRET_KEY = "sk_live_1234567890"\n\ndef index():\n    return "Welcome"\n'
+                },
+                "hardened": {
+```
+
+### [Critical] TG-SEC-001 - Hardcoded Secret or API Key in Tracked Source
+- **Finding ID:** `TG-SEC-001-d5b3684f`
+- **Location:** `harness/validate_qa_v0_6_0.py:90`
+- **Confidence Score:** `77/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+                        "confidence_band": "Confirmed",
+                        "target": {"file_path": "app.py", "line_start": 2, "line_end": 2},
+                        "evidence": {"code_snippet": 'SECRET_KEY = "sk_live_1234567890"'},
+                        "what_is_wrong": "Hardcoded secret exposed in source code.",
+                        "what_should_change": "Load SECRET_KEY from environment variables.",
+```
+
+### [Critical] TG-SEC-001 - Hardcoded Secret or API Key in Tracked Source
+- **Finding ID:** `TG-SEC-001-54f1a02a`
+- **Location:** `harness/validate_v0_6_2_modern_stacks.py:341`
+- **Confidence Score:** `77/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+COPY . .
+# Running as root user & hardcoding secrets
+ENV DATABASE_PASSWORD="secret_in_docker"
+CMD ["python", "main.py"]
+""", encoding="utf-8")
+```
+
+### [Critical] TG-SEC-001 - Hardcoded Secret or API Key in Tracked Source
+- **Finding ID:** `TG-SEC-001-676f776e`
+- **Location:** `harness/validate_v0_6_2_modern_stacks.py:356`
+- **Confidence Score:** `77/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+            "confidence_band": "Confirmed",
+            "target": {"file_path": "Dockerfile", "line_start": 5, "line_end": 5},
+            "evidence": {"code_snippet": 'ENV DATABASE_PASSWORD="secret_in_docker"'},
+            "what_is_wrong": "Secret baked into immutable container image layer.",
+            "what_should_change": "Inject secrets at runtime or use BuildKit --mount=type=secret.",
+```
+
+### [Critical] TG-SEC-001 - Hardcoded Secret or API Key in Tracked Source
+- **Finding ID:** `TG-SEC-001-58f70e46`
+- **Location:** `harness/validate_v0_6_2_modern_stacks.py:362`
+- **Confidence Score:** `77/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
++++ b/Dockerfile
+@@ -5,1 +5,2 @@
+-ENV DATABASE_PASSWORD="secret_in_docker"
++USER appuser
+""",
+```
+
+### [Critical] TG-INPUT-002 - Raw SQL Concatenation
+- **Finding ID:** `TG-INPUT-002-02f8e274`
+- **Location:** `harness/engine/fixture_manager.py:128`
+- **Confidence Score:** `74/100` (High Confidence)
+- **Cluster:** `cluster-injection`
+- **Description:** Python f-string interpolation in raw SQL query
+```
+                vulnerable_variant=FixtureVariant(
+                    relative_path="examples/python/sqlalchemy-vuln",
+                    code_pattern="session.execute(f'SELECT * FROM items WHERE name LIKE {q}')",
+                    expected_findings_count=4,
+                ),
+```
+
+### [Critical] TG-SEC-001 - Hardcoded Secret or API Key in Tracked Source
+- **Finding ID:** `TG-SEC-001-7c852ff3`
+- **Location:** `harness/master_validation.py:257`
+- **Confidence Score:** `74/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+        self.log("Redaction", "JWT Token Redaction", "Bearer ***REDACTED_JWT***" in masked_jwt and "doNotLeakSignature" not in masked_jwt)
+
+        masked_pwd = mask_sensitive_data("DB_PASSWORD = 'super_secret_database_password_123'")
+        self.log("Redaction", "Password Variable Redaction", "***REDACTED***" in masked_pwd and "super_secret_database_password_123" not in masked_pwd)
+
+```
+
+### [Critical] TG-SEC-001 - Hardcoded Secret or API Key in Tracked Source
+- **Finding ID:** `TG-SEC-001-02761dbb`
+- **Location:** `harness/master_validation.py:460`
+- **Confidence Score:** `74/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+
+    def _create_sample_finding(self, rule_id: str, target_path: str, secret_test: bool = False) -> Finding:
+        raw_code = "STRIPE_API_KEY = 'sk_live_998877665544332211'\nAuthorization = 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.doNotLeakSignature'" if secret_test else f"# Logic for {rule_id}\nrole = request.headers.get('X-User-Role')"
+
+        ev = Evidence(
+```
+
+### [Critical] TG-DB-004 - Missing Tenant Query Isolation in Multi-Tenant Models
+- **Finding ID:** `TG-DB-004-e8cc000a`
+- **Location:** `harness/runner.py:505`
+- **Confidence Score:** `74/100` (High Confidence)
+- **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+
+            # 2. Stable Finding Identity
+            code_a = "def view():\n    return Item.objects.get(id=id)"
+            code_b = "# Shifted comment\ndef view():\n    return Item.objects.get(id=id)"
+            fp1 = IdentityEngine.generate_identity("TG-DB-004", "views.py", code_a, sink_signature="Item.objects.get")
+```
+
+### [Critical] TG-DB-004 - Missing Tenant Query Isolation in Multi-Tenant Models
+- **Finding ID:** `TG-DB-004-89b581f9`
+- **Location:** `harness/runner.py:506`
+- **Confidence Score:** `74/100` (High Confidence)
+- **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+            # 2. Stable Finding Identity
+            code_a = "def view():\n    return Item.objects.get(id=id)"
+            code_b = "# Shifted comment\ndef view():\n    return Item.objects.get(id=id)"
+            fp1 = IdentityEngine.generate_identity("TG-DB-004", "views.py", code_a, sink_signature="Item.objects.get")
+            fp2 = IdentityEngine.generate_identity("TG-DB-004", "views.py", code_b, sink_signature="Item.objects.get")
+```
+
+### [Critical] TG-SEC-001 - Hardcoded Secret or API Key in Tracked Source
+- **Finding ID:** `TG-SEC-001-3a2b5eca`
+- **Location:** `harness/validate_e2e.py:355`
+- **Confidence Score:** `74/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+
+    def _create_sample_finding(self, rule_id: str, target_path: str, secret_test: bool = False) -> Finding:
+        raw_code = "API_KEY = 'sk_live_998877665544332211'\nAuthorization = 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.doNotLeakSignature'" if secret_test else f"# Unsafe logic for {rule_id}\nrole = request.headers.get('X-User-Role')"
+        
+        ev = Evidence(
+```
+
+### [Critical] TG-DB-002 - Privileged Database Credential in Browser Context
+- **Finding ID:** `TG-DB-002-08d11e50`
+- **Location:** `harness/validate_v0_9_2_diff_and_monorepo.py:134`
+- **Confidence Score:** `74/100` (High Confidence)
+- **Cluster:** `cluster-client-leak`
+- **Description:** Service role key or raw database connection string reference in frontend code
+```
+    assert nextjs_file.is_file(), "Missing actions.ts in vulnerable_nextjs"
+    nx_code = nextjs_file.read_text(encoding="utf-8")
+    assert "TG-CLIENT-001" in nx_code and "SUPABASE_SERVICE_ROLE_KEY" in nx_code
+    assert "TG-AUTH-003" in nx_code and "use server" in nx_code
+    print("  [PASS] vulnerable_nextjs fixture contains TG-CLIENT-001 and TG-AUTH-003 sinks")
+```
+
+### [Critical] TG-INPUT-002 - Raw SQL Concatenation
+- **Finding ID:** `TG-INPUT-002-8f877a5f`
+- **Location:** `harness/validate_v1_1_0_advanced_memory.py:107`
+- **Confidence Score:** `74/100` (High Confidence)
+- **Cluster:** `cluster-injection`
+- **Description:** Python f-string interpolation in raw SQL query
+```
+        memory_engine.ensure_memory_structure(root_dir=test_root)
+
+        valid_before = "cursor.execute(f'SELECT * FROM users WHERE id = {uid}')"
+        valid_after = "cursor.execute('SELECT * FROM users WHERE id = %s', (uid,))"
+        valid_diff = "- cursor.execute(f'SELECT * FROM users WHERE id = {uid}')\n+ cursor.execute('SELECT * FROM users WHERE id = %s', (uid,))"
+```
+
+### [Critical] TG-INPUT-002 - Raw SQL Concatenation
+- **Finding ID:** `TG-INPUT-002-266bcaa1`
+- **Location:** `harness/validate_v1_1_0_advanced_memory.py:109`
+- **Confidence Score:** `74/100` (High Confidence)
+- **Cluster:** `cluster-injection`
+- **Description:** Python f-string interpolation in raw SQL query
+```
+        valid_before = "cursor.execute(f'SELECT * FROM users WHERE id = {uid}')"
+        valid_after = "cursor.execute('SELECT * FROM users WHERE id = %s', (uid,))"
+        valid_diff = "- cursor.execute(f'SELECT * FROM users WHERE id = {uid}')\n+ cursor.execute('SELECT * FROM users WHERE id = %s', (uid,))"
+
+        recipe = memory_engine.record_golden_recipe(
+```
+
+### [Critical] TG-DB-002 - Privileged Database Credential in Browser Context
+- **Finding ID:** `TG-DB-002-14cf4139`
+- **Location:** `harness/validate_v0_7_0_runtime.py:129`
+- **Confidence Score:** `71/100` (High Confidence)
+- **Cluster:** `cluster-client-leak`
+- **Description:** Service role key or raw database connection string reference in frontend code
+```
+            self.send_header("Content-Type", "application/json")
+            self.end_headers()
+            self.wfile.write(b'{"DEBUG": true, "DATABASE_URL": "sqlite:////app/db.sqlite3"}')
+
+        elif url_path == "/api/files/download":
+```
+
+### [Critical] TG-DB-002 - Privileged Database Credential in Browser Context
+- **Finding ID:** `TG-DB-002-b53ad22c`
+- **Location:** `harness/validate_v0_7_0_runtime.py:423`
+- **Confidence Score:** `71/100` (High Confidence)
+- **Cluster:** `cluster-client-leak`
+- **Description:** Service role key or raw database connection string reference in frontend code
+```
+
+        # 6. Exposed debug config -> Runtime Confirmed
+        r6 = ExploitChecker.check_debug_exposure(val, "fnd-6", "c-4", f"{self.base_url}/debug/env", "DATABASE_URL")
+        self.log_test("Phase 3", "Exposed Debug Configuration Confirmed", r6.status == ExploitabilityStatus.RUNTIME_CONFIRMED.value)
+
+```
+
+### [Critical] TG-DIFF-001 - Accidental Security Check Bypass in Patch Additions
+- **Finding ID:** `TG-DIFF-001-04571685`
+- **Location:** `harness/evaluate_portfolio_polyglot.py:74`
+- **Confidence Score:** `69/100` (Medium Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled TLS certificate verification (verify=False)
+```
+        "expected_orm": "SQLAlchemy",
+        "ecosystem": "Python",
+        "test_bypass": ("python", "verify=False", "auth_bypass"),
+        "test_tenant": ("python", "tenant_id"),
+    },
+```
+
+### [Critical] TG-DIFF-001 - Accidental Security Check Bypass in Patch Additions
+- **Finding ID:** `TG-DIFF-001-8b55ac4b`
+- **Location:** `harness/evaluate_portfolio_polyglot.py:151`
+- **Confidence Score:** `69/100` (Medium Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
+        "expected_orm": "GORM",
+        "ecosystem": "Go",
+        "test_bypass": ("go", "InsecureSkipVerify: true", "tls_bypass"),
+        "test_tenant": ("go", '.Where("tenant_id = ?", tenantID)'),
+    },
+```
+
+### [Critical] TG-DIFF-001 - Accidental Security Check Bypass in Patch Additions
+- **Finding ID:** `TG-DIFF-001-cf8d252d`
+- **Location:** `harness/evaluate_portfolio_polyglot.py:162`
+- **Confidence Score:** `69/100` (Medium Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
+        "expected_orm": "SQLx",
+        "ecosystem": "Go",
+        "test_bypass": ("go", "tls.Config{InsecureSkipVerify: true}", "tls_bypass"),
+        "test_tenant": ("go", '.Where("org_id = ?", orgID)'),
+    },
+```
+
+### [Critical] TG-DIFF-001 - Accidental Security Check Bypass in Patch Additions
+- **Finding ID:** `TG-DIFF-001-3543946e`
+- **Location:** `harness/evaluate_portfolio_polyglot.py:173`
+- **Confidence Score:** `69/100` (Medium Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
+        "expected_orm": None,
+        "ecosystem": "Go",
+        "test_bypass": ("go", "InsecureSkipVerify: true", "tls_bypass"),
+        "test_tenant": ("go", '.Where("tenant_id = ?", tid)'),
+    },
+```
+
+### [Critical] TG-DIFF-001 - Accidental Security Check Bypass in Patch Additions
+- **Finding ID:** `TG-DIFF-001-efffaad0`
+- **Location:** `harness/evaluate_portfolio_polyglot.py:349`
+- **Confidence Score:** `69/100` (Medium Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
+        "expected_orm": None,
+        "ecosystem": "Polyglot Fleet",
+        "test_bypass": ("go", "InsecureSkipVerify: true", "tls_bypass"),
+        "test_tenant": ("go", '.Where("tenant_id = ?", tid)'),
+    },
+```
+
+### [Critical] TG-DIFF-001 - Accidental Security Check Bypass in Patch Additions
+- **Finding ID:** `TG-DIFF-001-91bd06b8`
+- **Location:** `harness/evaluate_portfolio_polyglot.py:129`
+- **Confidence Score:** `69/100` (Medium Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Node.js TLS rejectUnauthorized
+```
+        "expected_orm": "Mongoose",
+        "ecosystem": "JavaScript",
+        "test_bypass": ("javascript", "rejectUnauthorized: false", "tls_bypass"),
+        "test_tenant": ("javascript", "author: req.user.id"),
+    },
+```
+
+### [Critical] TG-DIFF-001 - Accidental Security Check Bypass in Patch Additions
+- **Finding ID:** `TG-DIFF-001-cb245735`
+- **Location:** `harness/evaluate_portfolio_polyglot.py:261`
+- **Confidence Score:** `69/100` (Medium Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled PHP curl SSL verification
+```
+        "expected_orm": "Eloquent",
+        "ecosystem": "PHP",
+        "test_bypass": ("php", "CURLOPT_SSL_VERIFYPEER => false", "tls_bypass"),
+        "test_tenant": ("php", 'where("tenant_id", $tenantId)'),
+    },
+```
+
+### [Critical] TG-DIFF-001 - Accidental Security Check Bypass in Patch Additions
+- **Finding ID:** `TG-DIFF-001-6667680a`
+- **Location:** `harness/validate_v0_9_2_diff_and_monorepo.py:60`
+- **Confidence Score:** `69/100` (Medium Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled TLS certificate verification (verify=False)
+```
+ def authenticate_user(token):
++    # TODO: bypass auth check for debugging
++    verify = False
+     return True
+"""
+```
+
+### [Critical] TG-DIFF-001 - Accidental Security Check Bypass in Patch Additions
+- **Finding ID:** `TG-DIFF-001-00b3b8ca`
+- **Location:** `harness/validate_v0_9_2_diff_and_monorepo.py:67`
+- **Confidence Score:** `69/100` (Medium Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled TLS certificate verification (verify=False)
+```
+    rule_ids = [v["rule_id"] for v in res_bypass["violations"]]
+    assert "TG-DIFF-001" in rule_ids, "TG-DIFF-001 bypass not caught"
+    print(f"  [PASS] TG-DIFF-001: Caught bypass comments and verify=False ({res_bypass['total_violations']} violations)")
+
+    mock_key = "sk" + "_live_" + "99887766554433221100aabbccdd"
+```
+
+### [Critical] TG-DIFF-001 - Accidental Security Check Bypass in Patch Additions
+- **Finding ID:** `TG-DIFF-001-f209dec6`
+- **Location:** `harness/validate_v1_3_0_polyglot.py:16`
+- **Confidence Score:** `69/100` (Medium Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
+   - File extension census fallback (no manifest)
+2. Polyglot Diff Guard bypass detection across:
+   - Go (InsecureSkipVerify: true)
+   - Java (csrf().disable())
+   - C# ([AllowAnonymous])
+```
+
+### [Critical] TG-DIFF-001 - Accidental Security Check Bypass in Patch Additions
+- **Finding ID:** `TG-DIFF-001-d9adecdb`
+- **Location:** `harness/validate_v1_3_0_polyglot.py:182`
+- **Confidence Score:** `69/100` (Medium Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
++++ b/client.go
+@@ -10,3 +10,4 @@
++	tr := &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}
+"""
+        viol_go = diff_guard.check_diff_content(diff_go, "client.go")
+```
+
+### [Critical] TG-DIFF-001 - Accidental Security Check Bypass in Patch Additions
+- **Finding ID:** `TG-DIFF-001-ddbf5cf0`
+- **Location:** `harness/validate_v1_3_0_polyglot.py:19`
+- **Confidence Score:** `69/100` (Medium Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled PHP curl SSL verification
+```
+   - Java (csrf().disable())
+   - C# ([AllowAnonymous])
+   - PHP (CURLOPT_SSL_VERIFYPEER => false)
+   - Rust (unsafe { ... })
+3. Polyglot Tenant Scoping Patterns across GORM, LINQ, and Prisma
+```
+
+### [Critical] TG-DIFF-001 - Accidental Security Check Bypass in Patch Additions
+- **Finding ID:** `TG-DIFF-001-2b3eb6b7`
+- **Location:** `harness/validate_v1_3_0_polyglot.py:215`
+- **Confidence Score:** `69/100` (Medium Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled PHP curl SSL verification
+```
++++ b/api.php
+@@ -5,3 +5,4 @@
++    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
+"""
+        viol_php = diff_guard.check_diff_content(diff_php, "api.php")
+```
+
+### [Critical] TG-DB-004 - Missing Tenant Query Isolation in Multi-Tenant Models
+- **Finding ID:** `TG-DB-004-e33fd263`
+- **Location:** `harness/validate_v0_6_3_hardening.py:119`
+- **Confidence Score:** `67/100` (Medium Confidence)
+- **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+        snippet_v1 = """def process_invoice(req, inv_id):
+    # Retrieve invoice
+    inv = Invoice.objects.get(id=inv_id)
+    return inv
+"""
+```
+
+### [Critical] TG-DB-004 - Missing Tenant Query Isolation in Multi-Tenant Models
+- **Finding ID:** `TG-DB-004-ff3f7499`
+- **Location:** `harness/validate_v0_6_3_hardening.py:127`
+- **Confidence Score:** `67/100` (Medium Confidence)
+- **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+        snippet_v2 = """def process_invoice(req, inv_id):
+    # Retrieve invoice
+    inv = Invoice.objects.get(id=inv_id)
+    return inv
+"""
+```
+
+### [Critical] TG-DB-004 - Missing Tenant Query Isolation in Multi-Tenant Models
+- **Finding ID:** `TG-DB-004-a7c00c05`
+- **Location:** `harness/validate_v0_6_3_hardening.py:135`
+- **Confidence Score:** `67/100` (Medium Confidence)
+- **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+        snippet_v3 = """def process_invoice(req, inv_id):
+    # Different comment text here
+    inv = Invoice.objects.get(id=inv_id)   
+    return inv
+"""
+```
+
+### [Critical] TG-DB-004 - Missing Tenant Query Isolation in Multi-Tenant Models
+- **Finding ID:** `TG-DB-004-8b6c1463`
+- **Location:** `harness/validate_v0_6_3_hardening.py:171`
+- **Confidence Score:** `67/100` (Medium Confidence)
+- **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+                "confidence_band": "Confirmed",
+                "target": {"file_path": "apps/billing/views.py", "line_start": 12, "line_end": 14},
+                "evidence": {"code_snippet": "Invoice.objects.get(id=inv_id)"},
+                "cluster_id": "cluster-tenant-isolation",
+                "recheck_status": "Confirmed Fixed",
+```
+
+### [Critical] TG-DB-004 - Missing Tenant Query Isolation in Multi-Tenant Models
+- **Finding ID:** `TG-DB-004-9a2f13c7`
+- **Location:** `harness/validate_v0_6_1_scale.py:115`
+- **Confidence Score:** `64/100` (Medium Confidence)
+- **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+                "severity": "High",
+                "target": {"file_path": "apps/django_core/billing/views.py", "line_start": 42, "line_end": 42},
+                "evidence": {"code_snippet": "Invoice.objects.get(id=inv_id)"},
+            },
+            # FastAPI Microservice
+```
+
+### [Critical] TG-DB-004 - Missing Tenant Query Isolation in Multi-Tenant Models
+- **Finding ID:** `TG-DB-004-a932f5b8`
+- **Location:** `harness/validate_v0_6_1_scale.py:193`
+- **Confidence Score:** `64/100` (Medium Confidence)
+- **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+                "confidence_band": "Confirmed",
+                "target": {"file_path": f"services/api/module_{i % 15}/views.py", "line_start": 10 + i, "line_end": 12 + i},
+                "evidence": {"code_snippet": f"Model_{i}.objects.get(id=id)"},
+            })
+
+```
+
+### [Critical] TG-DB-004 - Missing Tenant Query Isolation in Multi-Tenant Models
+- **Finding ID:** `TG-DB-004-14a2d74f`
+- **Location:** `harness/validate_v1_0_0_memory.py:265`
+- **Confidence Score:** `64/100` (Medium Confidence)
+- **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+-    return Bill.objects.filter(id=id, tenant=tenant)
++def get_bill(id):
++    return Bill.objects.get(id=id)
+"""
+        res_reg = diff_guard.audit_diff(regression_diff, check_memory=True, root_dir=test_root)
+```
+
+### [Critical] TG-SUPPLY-004 - Unpinned CI Action
+- **Finding ID:** `TG-SUPPLY-004-e52415c0`
+- **Location:** `harness/validate_v0_6_2_modern_stacks.py:383`
+- **Confidence Score:** `47/100` (Needs Review)
+- **Cluster:** `cluster-supply-chain`
+- **Description:** GitHub Action referenced by mutable tag instead of immutable commit SHA
+```
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - run: make test
+""", encoding="utf-8")
+```
+
+### [Critical] TG-SUPPLY-004 - Unpinned CI Action
+- **Finding ID:** `TG-SUPPLY-004-b9d15743`
+- **Location:** `harness/validate_v0_6_2_modern_stacks.py:404`
+- **Confidence Score:** `47/100` (Needs Review)
+- **Cluster:** `cluster-supply-chain`
+- **Description:** GitHub Action referenced by mutable tag instead of immutable commit SHA
+```
++++ b/.github/workflows/ci.yml
+@@ -6,1 +6,1 @@
+-      - uses: actions/checkout@v2
++      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+""",
+```
+
+### [Critical] TG-SUPPLY-004 - Unpinned CI Action
+- **Finding ID:** `TG-SUPPLY-004-9240a873`
+- **Location:** `harness/validate_v0_6_3_hardening.py:251`
+- **Confidence Score:** `44/100` (Needs Review)
+- **Cluster:** `cluster-supply-chain`
+- **Description:** GitHub Action referenced by mutable tag instead of immutable commit SHA
+```
++++ b/.github/workflows/deploy.yml
+@@ -5,1 +5,2 @@
+-      - uses: actions/checkout@v2
++      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
++        with: { persist-credentials: false }
+```
+
+### [High] TG-AUTH-004 - Insecure Session Cookie Configuration
+- **Finding ID:** `TG-AUTH-004-33adb2d9`
+- **Location:** `harness/evaluate_portfolio_polyglot.py:107`
+- **Confidence Score:** `66/100` (Medium Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Session cookie secure flag disabled in Django settings
+```
+        "expected_orm": "SQLAlchemy",
+        "ecosystem": "Python",
+        "test_bypass": ("python", "SESSION_COOKIE_SECURE = False", "auth_bypass"),
+        "test_tenant": ("python", "tenant_id"),
+    },
+```
+
+### [High] TG-AUTH-004 - Insecure Session Cookie Configuration
+- **Finding ID:** `TG-AUTH-004-56b1c90f`
+- **Location:** `harness/evaluate_portfolio_polyglot.py:96`
+- **Confidence Score:** `66/100` (Medium Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Decorator disabling route-level authentication or CSRF protection
+```
+        "expected_orm": "Django ORM",
+        "ecosystem": "Python",
+        "test_bypass": ("python", "@csrf_exempt", "auth_bypass"),
+        "test_tenant": ("python", "tenant"),
+    },
+```
+
+### [High] TG-AUTH-004 - Insecure Session Cookie Configuration
+- **Finding ID:** `TG-AUTH-004-4a33f7e7`
+- **Location:** `harness/evaluate_portfolio_polyglot.py:239`
+- **Confidence Score:** `66/100` (Medium Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Attribute disabling ASP.NET authentication
+```
+        "expected_orm": "Entity Framework Core",
+        "ecosystem": "C#",
+        "test_bypass": ("csharp", "[AllowAnonymous]", "auth_bypass"),
+        "test_tenant": ("csharp", ".Where(x => x.TenantId == tenantId)"),
+    },
+```
+
+### [High] TG-AUTH-004 - Insecure Session Cookie Configuration
+- **Finding ID:** `TG-AUTH-004-95eb27cd`
+- **Location:** `harness/evaluate_portfolio_polyglot.py:876`
+- **Confidence Score:** `66/100` (Medium Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Attribute disabling ASP.NET authentication
+```
+| **4. 5-Factor Confidence Scorer** | 100% | Applied objective $0–100$ scoring with memory modifiers and false positive deductions. |
+| **5. Adaptive Security Memory Engine** | 100% | Isolated memory workspace successfully recorded events and verified context cards $\le 2,000$ tokens. |
+| **6. Polyglot Diff Guard** | 100% | Intercepted Go `InsecureSkipVerify`, Java `csrf().disable()`, C# `[AllowAnonymous]`, PHP `CURLOPT_SSL_VERIFYPEER`, Rust `unsafe {`, and tenant stripping. |
+| **7. Governed Remediation (Ponytail)** | 100% | Enforced patch churn limits ($\le 35$ additions, $\le 25$ deletions) and pre-apply snapshot generation. |
+| **8. Visual HTML Dashboard** | 100% | Generated self-contained, air-gapped dark-mode visual report with SVG circular gauge. |
+```
+
+### [High] TG-AUTH-004 - Insecure Session Cookie Configuration
+- **Finding ID:** `TG-AUTH-004-e838c41c`
+- **Location:** `harness/validate_v1_3_0_polyglot.py:18`
+- **Confidence Score:** `66/100` (Medium Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Attribute disabling ASP.NET authentication
+```
+   - Go (InsecureSkipVerify: true)
+   - Java (csrf().disable())
+   - C# ([AllowAnonymous])
+   - PHP (CURLOPT_SSL_VERIFYPEER => false)
+   - Rust (unsafe { ... })
+```
+
+### [High] TG-AUTH-004 - Insecure Session Cookie Configuration
+- **Finding ID:** `TG-AUTH-004-5c78d750`
+- **Location:** `harness/validate_v1_3_0_polyglot.py:204`
+- **Confidence Score:** `66/100` (Medium Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Attribute disabling ASP.NET authentication
+```
++++ b/UsersController.cs
+@@ -15,3 +15,4 @@
++    [AllowAnonymous]
++    public IActionResult GetFinancialData() {
+"""
+```
+
+### [High] TG-AUTH-004 - Insecure Session Cookie Configuration
+- **Finding ID:** `TG-AUTH-004-0d028be7`
+- **Location:** `harness/validate_v1_3_0_polyglot.py:208`
+- **Confidence Score:** `66/100` (Medium Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Attribute disabling ASP.NET authentication
+```
+"""
+        viol_cs = diff_guard.check_diff_content(diff_cs, "UsersController.cs")
+        assert len(viol_cs) >= 1, "Failed to catch C# [AllowAnonymous]"
+        print("  [PASS] Caught C# ASP.NET [AllowAnonymous] bypass")
+
+```
+
+### [High] TG-AUTH-004 - Insecure Session Cookie Configuration
+- **Finding ID:** `TG-AUTH-004-3ae1d9c1`
+- **Location:** `harness/validate_v1_3_0_polyglot.py:209`
+- **Confidence Score:** `66/100` (Medium Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Attribute disabling ASP.NET authentication
+```
+        viol_cs = diff_guard.check_diff_content(diff_cs, "UsersController.cs")
+        assert len(viol_cs) >= 1, "Failed to catch C# [AllowAnonymous]"
+        print("  [PASS] Caught C# ASP.NET [AllowAnonymous] bypass")
+
+        # PHP CURLOPT_SSL_VERIFYPEER bypass
+```
+
+### [High] TG-AUTH-004 - Insecure Session Cookie Configuration
+- **Finding ID:** `TG-AUTH-004-ea07db54`
+- **Location:** `harness/validate_v1_3_0_polyglot.py:193`
+- **Confidence Score:** `66/100` (Medium Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Spring Security CSRF protection explicitly disabled
+```
++++ b/SecurityConfig.java
+@@ -20,3 +20,4 @@
++    http.csrf().disable();
+"""
+        viol_java = diff_guard.check_diff_content(diff_java, "SecurityConfig.java")
+```
+
+### [High] TG-RATE-001 - Unlimited Authentication Endpoint
+- **Finding ID:** `TG-RATE-001-758a7750`
+- **Location:** `harness/runner.py:575`
+- **Confidence Score:** `65/100` (Medium Confidence)
+- **Cluster:** `cluster-rate-limiting`
+- **Description:** Authentication POST endpoint defined without rate-limiting middleware
+```
+                "line_number": 25,
+                "description": "Unprotected auth route lacking rate limiting.",
+                "snippet": "app.post('/login', async (req, res) => {})",
+                "confidence_score": 85,
+                "confidence_band": "High Confidence"
+```
+
+### [High] TG-DIFF-003 - Unintentional Removal of Tenant Filter in Patch Deletions
+- **Finding ID:** `TG-DIFF-003-3d00a189`
+- **Location:** `harness/validate_v0_6_2_modern_stacks.py:262`
+- **Confidence Score:** `54/100` (Medium Confidence)
+- **Cluster:** `cluster-tenant-isolation`
+- **Description:** Removal of tenant isolation boundary in patch deletion
+```
++++ b/queries.py
+@@ -7,1 +7,1 @@
+-    stmt = select(Account).where(Account.id == account_id)
++    stmt = select(Account).where(Account.id == account_id, Account.tenant_id == tenant_id)
+""",
+```
+
+### [High] TG-INPUT-005 - Unsafe Template Rendering & Disabled Autoescaping
+- **Finding ID:** `TG-INPUT-005-7f81ea7f`
+- **Location:** `harness/validate_qa_v0_6_0.py:177`
+- **Confidence Score:** `52/100` (Medium Confidence)
+- **Cluster:** `cluster-injection`
+- **Description:** Flask render_template_string rendering untrusted input
+```
+            "flask-app": {
+                "vulnerable": {
+                    "app.py": 'from flask import Flask, request, render_template_string\nimport os\n\napp = Flask(__name__)\n\n@app.route("/greet")\ndef greet():\n    name = request.args.get("name", "Guest")\n    # SSTI: Unescaped string formatting in template\n    return render_template_string(f"Hello {name}")\n\n@app.route("/upload", methods=["POST"])\ndef upload():\n    f = request.files["file"]\n    # Path Traversal in filename\n    f.save(os.path.join("/var/uploads", f.filename))\n    return "Saved"\n'
+                },
+                "hardened": {
+```
+
+### [High] TG-INPUT-005 - Unsafe Template Rendering & Disabled Autoescaping
+- **Finding ID:** `TG-INPUT-005-d5aaebe0`
+- **Location:** `harness/validate_qa_v0_6_0.py:190`
+- **Confidence Score:** `52/100` (Medium Confidence)
+- **Cluster:** `cluster-injection`
+- **Description:** Flask render_template_string rendering untrusted input
+```
+                        "confidence_band": "Confirmed",
+                        "target": {"file_path": "app.py", "line_start": 10, "line_end": 10},
+                        "evidence": {"code_snippet": 'return render_template_string(f"Hello {name}")'},
+                        "what_is_wrong": "User input formatted directly into template string.",
+                        "what_should_change": "Render static template file with contextual autoescaping.",
+```
+
+### [High] TG-INPUT-005 - Unsafe Template Rendering & Disabled Autoescaping
+- **Finding ID:** `TG-INPUT-005-e0ffb03b`
+- **Location:** `harness/validate_qa_v0_6_0.py:193`
+- **Confidence Score:** `52/100` (Medium Confidence)
+- **Cluster:** `cluster-injection`
+- **Description:** Flask render_template_string rendering untrusted input
+```
+                        "what_is_wrong": "User input formatted directly into template string.",
+                        "what_should_change": "Render static template file with contextual autoescaping.",
+                        "proposed_diff": "--- a/app.py\n+++ b/app.py\n@@ -10,1 +10,1 @@\n-return render_template_string(f\"Hello {name}\")\n+return render_template(\"greet.html\", name=name)\n",
+                        "verification_steps": "Send name={{7*7}} and verify output contains literal {{7*7}} instead of 49.",
+                    },
+```
+
+### [High] TG-INPUT-005 - Unsafe Template Rendering & Disabled Autoescaping
+- **Finding ID:** `TG-INPUT-005-0d595acd`
+- **Location:** `harness/master_validation.py:314`
+- **Confidence Score:** `49/100` (Needs Review)
+- **Cluster:** `cluster-injection`
+- **Description:** Flask render_template_string rendering untrusted input
+```
+                "severity": SeverityLevel.HIGH,
+                "path": "rules/TG-INPUT-005-unsafe-template-rendering-and-escaping.md",
+                "vuln_sample": "return render_template_string(f'<h1>Hello {name}</h1>')",
+                "hard_sample": "return render_template('hello.html', name=name)",
+                "remediation": "Pass inputs as context variables in autoescaped template files or use Django's format_html() to safely construct HTML wrappers.",
+```
+
+### [High] TG-INPUT-005 - Unsafe Template Rendering & Disabled Autoescaping
+- **Finding ID:** `TG-INPUT-005-d7ef73f1`
+- **Location:** `harness/validate_e2e.py:457`
+- **Confidence Score:** `49/100` (Needs Review)
+- **Cluster:** `cluster-injection`
+- **Description:** Flask render_template_string rendering untrusted input
+```
+            "",
+            "- **`TG-AUTH-008` (Untrusted Role/Tenant Header Injection):** Verified detection on client headers (`X-User-Role`, `X-Tenant-ID`) and verified FastAPI/DRF JWT token extraction remediations.",
+            "- **`TG-INPUT-005` (Unsafe Template Rendering & Disabled Autoescaping):** Verified detection on `mark_safe()`, `| safe`, and `render_template_string()`; verified Jinja2 context variable autoescaping and `format_html()` remediations.",
+            "- **`TG-INPUT-006` (Path Traversal & Unsafe Upload Storage):** Verified detection on `os.path.join(UPLOAD_DIR, filename)`; verified `secure_filename()` + UUID storage remediations.",
+            "- **`TG-DB-004` (Missing Tenant Query Isolation):** Verified detection on unscoped primary key queries; verified SQLAlchemy composite tenant filters and DRF ViewSet `get_queryset()` tenant isolation.",
+```
+
+### [High] TG-INPUT-005 - Unsafe Template Rendering & Disabled Autoescaping
+- **Finding ID:** `TG-INPUT-005-95cb57ba`
+- **Location:** `harness/engine/fixture_manager.py:176`
+- **Confidence Score:** `46/100` (Needs Review)
+- **Cluster:** `cluster-injection`
+- **Description:** Flask render_template_string rendering untrusted input
+```
+                vulnerable_variant=FixtureVariant(
+                    relative_path="examples/python/flask-vuln",
+                    code_pattern="render_template_string(f'<h1>Hello {name}</h1>')",
+                    expected_findings_count=1,
+                ),
+```
+
+### [Medium] TG-PLATFORM-003 - Production Stack Trace Exposure
+- **Finding ID:** `TG-PLATFORM-003-69f083d6`
+- **Location:** `harness/runner.py:392`
+- **Confidence Score:** `56/100` (Medium Confidence)
+- **Cluster:** `cluster-platform`
+- **Description:** Django DEBUG mode enabled in configuration
+```
+            type=EvidenceType.SOURCE,
+            location="settings.py:10",
+            raw_snippet="DEBUG = True\nSECRET_KEY = 'sk_live_secret_key_12345'",
+            rationale="Production debug mode exposure and hardcoded secret.",
+            confidence_level=ConfidenceBand.CONFIRMED,
+```
+
+### [Medium] TG-PLATFORM-003 - Production Stack Trace Exposure
+- **Finding ID:** `TG-PLATFORM-003-6f253f06`
+- **Location:** `harness/runner.py:405`
+- **Confidence Score:** `56/100` (Medium Confidence)
+- **Cluster:** `cluster-platform`
+- **Description:** Django DEBUG mode enabled in configuration
+```
+        prov = ProvenanceChain(
+            discovery_module="rules/TG-PLATFORM-003-production-stack-trace-exposure.md",
+            triggering_input="DEBUG = True assignment in settings.py",
+            evidence_collected=["settings.py:10"],
+            decision_path=["Loaded Django settings", "Found DEBUG enabled"],
+```
+
+### [Medium] TG-PLATFORM-003 - Production Stack Trace Exposure
+- **Finding ID:** `TG-PLATFORM-003-fbe8ec66`
+- **Location:** `harness/runner.py:416`
+- **Confidence Score:** `56/100` (Medium Confidence)
+- **Cluster:** `cluster-platform`
+- **Description:** Django DEBUG mode enabled in configuration
+```
+            framework_pattern=FrameworkPattern(
+                framework="Django",
+                unsafe_snippet="DEBUG = True",
+                safe_snippet="DEBUG = False",
+            ),
+```
+
+### [Medium] TG-PLATFORM-003 - Production Stack Trace Exposure
+- **Finding ID:** `TG-PLATFORM-003-153d982f`
+- **Location:** `harness/validate_qa_v0_6_0.py:64`
+- **Confidence Score:** `52/100` (Medium Confidence)
+- **Cluster:** `cluster-platform`
+- **Description:** Django DEBUG mode enabled in configuration
+```
+            "tiny-repo": {
+                "vulnerable": {
+                    "app.py": 'DEBUG = True\nSECRET_KEY = "sk_live_1234567890"\n\ndef index():\n    return "Welcome"\n'
+                },
+                "hardened": {
+```
+
+### [Medium] TG-PLATFORM-003 - Production Stack Trace Exposure
+- **Finding ID:** `TG-PLATFORM-003-21644311`
+- **Location:** `harness/validate_qa_v0_6_0.py:77`
+- **Confidence Score:** `52/100` (Medium Confidence)
+- **Cluster:** `cluster-platform`
+- **Description:** Django DEBUG mode enabled in configuration
+```
+                        "confidence_band": "Confirmed",
+                        "target": {"file_path": "app.py", "line_start": 1, "line_end": 1},
+                        "evidence": {"code_snippet": "DEBUG = True"},
+                        "what_is_wrong": "DEBUG is statically enabled.",
+                        "what_should_change": "Load DEBUG from environment variables.",
+```
+
+### [Medium] TG-PLATFORM-003 - Production Stack Trace Exposure
+- **Finding ID:** `TG-PLATFORM-003-21b8a588`
+- **Location:** `harness/validate_qa_v0_6_0.py:80`
+- **Confidence Score:** `52/100` (Medium Confidence)
+- **Cluster:** `cluster-platform`
+- **Description:** Django DEBUG mode enabled in configuration
+```
+                        "what_is_wrong": "DEBUG is statically enabled.",
+                        "what_should_change": "Load DEBUG from environment variables.",
+                        "proposed_diff": "--- a/app.py\n+++ b/app.py\n@@ -1,1 +1,2 @@\n-DEBUG = True\n+import os\n+DEBUG = os.getenv('DEBUG', 'False').lower() == 'true'\n",
+                        "verification_steps": "Check DEBUG setting resolution in production.",
+                    },
+```
+
+### [Low] TG-DB-004 - Missing Tenant Query Isolation in Multi-Tenant Models
+- **Finding ID:** `TG-DB-004-6a739666`
+- **Location:** `tests/test_v0_6_0_governed_remediation.py:79`
+- **Confidence Score:** `24/100` (Needs Review)
+- **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+        def get_invoice(request, invoice_id):
+            # Fetch invoice directly without tenant filter
+            invoice = Invoice.objects.get(id=invoice_id)
+            return JsonResponse({"id": invoice.id})
+        """
+```
+
+### [Low] TG-DB-004 - Missing Tenant Query Isolation in Multi-Tenant Models
+- **Finding ID:** `TG-DB-004-fe2c60e3`
+- **Location:** `tests/test_v0_6_0_governed_remediation.py:86`
+- **Confidence Score:** `24/100` (Needs Review)
+- **Cluster:** `cluster-tenant-isolation`
+- **Description:** Django ORM .get(id=...) query lacking explicit tenant scope filter
+```
+        # Lines shifted down by 10 lines
+        def get_invoice(request, invoice_id):
+            invoice = Invoice.objects.get(id=invoice_id)
+            return JsonResponse({"id": invoice.id})
+        """
+```