verification-layer 0.25.3 → 0.27.0

package/dist/rule-catalog.json

@@ -0,0 +1,1491 @@
+{
+  "package": "verification-layer",
+  "version": "0.27.0",
+  "total": 143,
+  "counts": {
+    "phi-exposure": 29,
+    "encryption": 20,
+    "audit-logging": 8,
+    "access-control": 77,
+    "data-retention": 9
+  },
+  "rules": [
+    {
+      "id": "ssn-hardcoded",
+      "category": "phi-exposure",
+      "severity": "critical",
+      "title": "Potential SSN detected",
+      "description": "A pattern matching Social Security Number format was found in the code.",
+      "recommendation": "Remove hardcoded SSN. Use secure storage and encryption for sensitive identifiers.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "medical-record-number",
+      "category": "phi-exposure",
+      "severity": "high",
+      "title": "Medical Record Number exposure",
+      "description": "A hardcoded medical record number was detected.",
+      "recommendation": "Never hardcode MRNs. Fetch from secure, encrypted storage.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "dob-exposed",
+      "category": "phi-exposure",
+      "severity": "high",
+      "title": "Date of birth exposure",
+      "description": "Date of birth information may be hardcoded or improperly handled.",
+      "recommendation": "Encrypt DOB at rest and in transit. Apply minimum necessary principle.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "diagnosis-code",
+      "category": "phi-exposure",
+      "severity": "medium",
+      "title": "Diagnosis code in source",
+      "description": "ICD-10 diagnosis codes found in source code.",
+      "recommendation": "Load diagnosis codes from secure configuration, not source code.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "phi-in-url",
+      "category": "phi-exposure",
+      "severity": "high",
+      "title": "PHI identifier in URL pattern",
+      "description": "URL pattern suggests PHI may be exposed in URLs.",
+      "recommendation": "Never include PHI in URLs. Use opaque tokens or encrypted identifiers.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "patient-name-log",
+      "category": "phi-exposure",
+      "severity": "high",
+      "title": "Patient name in console output",
+      "description": "Patient names may be logged to console, exposing PHI.",
+      "recommendation": "Remove patient identifiers from logs. Use anonymized IDs for debugging.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "phi-console-log",
+      "category": "phi-exposure",
+      "severity": "high",
+      "title": "PHI data in console output",
+      "description": "Sensitive health information may be logged to console.",
+      "recommendation": "Never log PHI to console. Use structured logging with PHI redaction.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "phi-json-stringify-log",
+      "category": "phi-exposure",
+      "severity": "high",
+      "title": "Patient object serialized to console",
+      "description": "Patient objects are being serialized and logged, potentially exposing all PHI fields.",
+      "recommendation": "Create a sanitized version of patient objects for logging, excluding PHI fields.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "phi-template-log",
+      "category": "phi-exposure",
+      "severity": "high",
+      "title": "PHI in template literal log",
+      "description": "Template literal logging may expose PHI data.",
+      "recommendation": "Avoid interpolating PHI into log messages.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "phi-localstorage",
+      "category": "phi-exposure",
+      "severity": "critical",
+      "title": "PHI stored in localStorage",
+      "description": "PHI data is being stored in localStorage which is not encrypted and persists indefinitely.",
+      "recommendation": "Never store PHI in localStorage. Use encrypted server-side storage with proper access controls.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "phi-sessionstorage",
+      "category": "phi-exposure",
+      "severity": "high",
+      "title": "PHI stored in sessionStorage",
+      "description": "PHI data is being stored in sessionStorage which is not encrypted.",
+      "recommendation": "Avoid storing PHI in browser storage. Use secure, encrypted server-side sessions.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "phi-cookie-storage",
+      "category": "phi-exposure",
+      "severity": "critical",
+      "title": "PHI stored in cookies",
+      "description": "PHI data may be stored in browser cookies without encryption.",
+      "recommendation": "Never store PHI in cookies. Use encrypted server-side sessions with secure, httpOnly cookies for session IDs only.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "phi-indexeddb",
+      "category": "phi-exposure",
+      "severity": "high",
+      "title": "PHI potentially stored in IndexedDB",
+      "description": "PHI may be stored in IndexedDB which lacks built-in encryption.",
+      "recommendation": "If using IndexedDB for PHI, implement client-side encryption and proper key management.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "email-phi-context",
+      "category": "phi-exposure",
+      "severity": "medium",
+      "title": "Patient email handling detected",
+      "description": "Code handles patient email addresses which are PHI.",
+      "recommendation": "Ensure patient emails are encrypted and access is logged.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "phone-phi-context",
+      "category": "phi-exposure",
+      "severity": "medium",
+      "title": "Patient phone handling detected",
+      "description": "Code handles patient phone numbers which are PHI.",
+      "recommendation": "Ensure patient contact info is encrypted and access is logged.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "address-phi-context",
+      "category": "phi-exposure",
+      "severity": "medium",
+      "title": "Patient address handling detected",
+      "description": "Code handles patient addresses which are PHI.",
+      "recommendation": "Ensure patient addresses are encrypted and access is logged.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "phi-query-param",
+      "category": "phi-exposure",
+      "severity": "critical",
+      "title": "PHI in URL query parameter",
+      "description": "PHI identifiers are being passed as URL query parameters, which may be logged in server logs, browser history, and referrer headers.",
+      "recommendation": "Never pass PHI in URLs. Use POST requests with encrypted body or session-based lookups.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "phi-url-interpolation",
+      "category": "phi-exposure",
+      "severity": "critical",
+      "title": "PHI interpolated into URL",
+      "description": "PHI values are being interpolated into URLs, exposing sensitive data.",
+      "recommendation": "Use opaque tokens or encrypted references instead of PHI in URLs.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "phi-fetch-url",
+      "category": "phi-exposure",
+      "severity": "high",
+      "title": "PHI in fetch URL",
+      "description": "Fetch request URL contains PHI identifiers.",
+      "recommendation": "Pass PHI in request body with proper encryption, not in URLs.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "phi-header-set",
+      "category": "phi-exposure",
+      "severity": "critical",
+      "title": "PHI in HTTP header",
+      "description": "PHI data is being set in HTTP headers, which may be logged or cached.",
+      "recommendation": "Never transmit PHI in HTTP headers. Use encrypted request/response body.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "phi-header-object",
+      "category": "phi-exposure",
+      "severity": "critical",
+      "title": "PHI in headers object",
+      "description": "Headers object contains PHI-related fields.",
+      "recommendation": "Remove PHI from headers. Transmit sensitive data in encrypted request body only.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "phi-authorization-header",
+      "category": "phi-exposure",
+      "severity": "high",
+      "title": "Patient data in authorization context",
+      "description": "Patient identifiers may be exposed in authorization headers.",
+      "recommendation": "Use opaque session tokens for authorization, not patient identifiers.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "phi-email-body",
+      "category": "phi-exposure",
+      "severity": "high",
+      "title": "PHI in email content",
+      "description": "Patient data may be included in email body, which is typically unencrypted.",
+      "recommendation": "Avoid sending PHI via email. Use secure patient portals with authentication.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "phi-email-template",
+      "category": "phi-exposure",
+      "severity": "high",
+      "title": "PHI in email template",
+      "description": "Email templates may contain patient data placeholders.",
+      "recommendation": "Do not include PHI in email templates. Send secure links to authenticated portals instead.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "phi-email-subject",
+      "category": "phi-exposure",
+      "severity": "medium",
+      "title": "Potential PHI in email subject",
+      "description": "Email subject lines may contain patient-related information.",
+      "recommendation": "Keep email subjects generic. Never include patient names, diagnoses, or identifiers.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "phi-logger-unredacted",
+      "category": "phi-exposure",
+      "severity": "high",
+      "title": "PHI logged without redaction",
+      "description": "Patient data is being logged without apparent redaction or masking.",
+      "recommendation": "Implement PHI redaction in logging. Use structured logging with automatic PII masking.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "phi-log-file",
+      "category": "phi-exposure",
+      "severity": "high",
+      "title": "PHI written to log file",
+      "description": "Patient data may be written directly to log files.",
+      "recommendation": "Use structured logging with PHI redaction. Never write raw PHI to log files.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "phi-debug-output",
+      "category": "phi-exposure",
+      "severity": "medium",
+      "title": "Debug mode with patient data",
+      "description": "Debug mode enabled in code handling patient data may expose PHI.",
+      "recommendation": "Ensure debug logging excludes PHI or uses proper redaction.",
+      "source": "pattern",
+      "scanner": "phi"
+    },
+    {
+      "id": "skill-phi-hardcoded-ssn",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Hardcoded SSN in skill prompt",
+      "description": "Social Security Number found in skill definition",
+      "recommendation": "Never hardcode PHI in skill prompts. Use placeholders like {{patient_id}} instead.",
+      "hipaaReference": "§164.502(a) - PHI Use and Disclosure",
+      "source": "pattern",
+      "scanner": "skills"
+    },
+    {
+      "id": "skill-phi-patient-name",
+      "category": "access-control",
+      "severity": "high",
+      "title": "Patient name in example",
+      "description": "Real patient name appears in skill prompt example",
+      "recommendation": "Use fictional names (e.g., \"John Doe\") or template variables {{patient_name}}",
+      "hipaaReference": "§164.502(a) - PHI Use and Disclosure",
+      "source": "pattern",
+      "scanner": "skills"
+    },
+    {
+      "id": "skill-phi-dob",
+      "category": "access-control",
+      "severity": "high",
+      "title": "Date of birth in prompt",
+      "description": "Date of birth found in skill definition",
+      "recommendation": "Use template variable {{date_of_birth}} instead of actual dates",
+      "hipaaReference": "§164.502(a) - PHI Use and Disclosure",
+      "source": "pattern",
+      "scanner": "skills"
+    },
+    {
+      "id": "skill-phi-mrn",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Medical Record Number exposed",
+      "description": "Medical Record Number found in skill prompt",
+      "recommendation": "Never include real MRNs. Use {{medical_record_number}} placeholder.",
+      "hipaaReference": "§164.502(a) - PHI Use and Disclosure",
+      "source": "pattern",
+      "scanner": "skills"
+    },
+    {
+      "id": "skill-phi-diagnosis",
+      "category": "access-control",
+      "severity": "medium",
+      "title": "Diagnosis code in prompt",
+      "description": "ICD diagnosis code found in skill example",
+      "recommendation": "Use generic examples or template variables for diagnoses",
+      "hipaaReference": "§164.502(a) - PHI Use and Disclosure",
+      "source": "pattern",
+      "scanner": "skills"
+    },
+    {
+      "id": "skill-api-key-exposed",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "API key in skill configuration",
+      "description": "Hardcoded API key found in skill",
+      "recommendation": "Use environment variables: ${ANTHROPIC_API_KEY} or prompt user for keys",
+      "source": "pattern",
+      "scanner": "skills"
+    },
+    {
+      "id": "skill-aws-credentials",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "AWS credentials exposed",
+      "description": "AWS credentials found in skill definition",
+      "recommendation": "Never hardcode AWS credentials. Use IAM roles or environment variables.",
+      "source": "pattern",
+      "scanner": "skills"
+    },
+    {
+      "id": "skill-database-password",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Database password in connection string",
+      "description": "Database password exposed in connection string",
+      "recommendation": "Use environment variables: ${DB_PASSWORD} or credential manager",
+      "source": "pattern",
+      "scanner": "skills"
+    },
+    {
+      "id": "skill-bearer-token",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Bearer token hardcoded",
+      "description": "Bearer authentication token found in skill",
+      "recommendation": "Tokens should be fetched securely at runtime, not hardcoded",
+      "source": "pattern",
+      "scanner": "skills"
+    },
+    {
+      "id": "skill-private-key",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Private key in skill",
+      "description": "Private cryptographic key found in skill definition",
+      "recommendation": "Never include private keys. Use key management service.",
+      "source": "pattern",
+      "scanner": "skills"
+    },
+    {
+      "id": "skill-data-exfiltration",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Data exfiltration detected",
+      "description": "Potential data exfiltration via curl to external domain",
+      "recommendation": "Review external API calls. Healthcare data should not be sent to unknown endpoints.",
+      "hipaaReference": "§164.308(a)(4) - Access Controls",
+      "source": "pattern",
+      "scanner": "skills"
+    },
+    {
+      "id": "skill-reverse-shell",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Reverse shell attempt",
+      "description": "Reverse shell command detected - potential backdoor",
+      "recommendation": "REJECT THIS SKILL. This is a clear malicious pattern.",
+      "source": "pattern",
+      "scanner": "skills"
+    },
+    {
+      "id": "skill-atomic-stealer",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Atomic Stealer pattern",
+      "description": "Pattern matches known Atomic Stealer malware distribution",
+      "recommendation": "REJECT THIS SKILL. This matches malware signatures from Snyk analysis.",
+      "source": "pattern",
+      "scanner": "skills"
+    },
+    {
+      "id": "skill-credential-scraper",
+      "category": "access-control",
+      "severity": "high",
+      "title": "Credential scraping detected",
+      "description": "Commands that search for credential files",
+      "recommendation": "Verify legitimacy. Skills should not scrape credential files.",
+      "source": "pattern",
+      "scanner": "skills"
+    },
+    {
+      "id": "skill-obfuscated-command",
+      "category": "access-control",
+      "severity": "high",
+      "title": "Obfuscated command execution",
+      "description": "Command substitution or eval - common in malware",
+      "recommendation": "Review carefully. Obfuscation often hides malicious intent.",
+      "source": "pattern",
+      "scanner": "skills"
+    },
+    {
+      "id": "skill-http-phi-transmission",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "PHI transmitted over HTTP",
+      "description": "Skill transmits PHI over unencrypted HTTP",
+      "recommendation": "Use HTTPS for all PHI transmission. HTTP violates HIPAA encryption requirements.",
+      "hipaaReference": "§164.312(e)(1) - Transmission Security",
+      "source": "pattern",
+      "scanner": "skills"
+    },
+    {
+      "id": "skill-no-audit-logging",
+      "category": "access-control",
+      "severity": "high",
+      "title": "PHI access without audit logging",
+      "description": "Skill accesses PHI database without audit logging",
+      "recommendation": "Add audit logging: auditLog.record({ action, userId, resourceId })",
+      "hipaaReference": "§164.308(a)(1)(ii)(D) - Audit Controls",
+      "source": "pattern",
+      "scanner": "skills"
+    },
+    {
+      "id": "skill-phi-in-logs",
+      "category": "access-control",
+      "severity": "high",
+      "title": "PHI logged to console/files",
+      "description": "Skill logs PHI to console or log files",
+      "recommendation": "Never log PHI. Use redacted logging: logger.info({ patientId: \"***\" })",
+      "hipaaReference": "§164.502(a) - PHI Use and Disclosure",
+      "source": "pattern",
+      "scanner": "skills"
+    },
+    {
+      "id": "skill-phi-in-url",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "PHI in URL parameters",
+      "description": "Skill passes PHI in URL query parameters",
+      "recommendation": "Use POST with encrypted body. URLs are logged by proxies/servers.",
+      "hipaaReference": "§164.312(e)(1) - Transmission Security",
+      "source": "pattern",
+      "scanner": "skills"
+    },
+    {
+      "id": "skill-no-encryption",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Missing encryption for PHI storage",
+      "description": "Skill stores PHI in browser storage without encryption",
+      "recommendation": "Use encrypted storage or server-side session storage only.",
+      "hipaaReference": "§164.312(a)(2)(iv) - Encryption",
+      "source": "pattern",
+      "scanner": "skills"
+    },
+    {
+      "id": "HIPAA-MFA-001",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Missing Multi-Factor Authentication for PHI Access",
+      "description": "Endpoints accessing PHI must enforce MFA. All auth configs must require multi-factor authentication.",
+      "hipaaReference": "45 CFR §164.312(a)(2)(i) - Access Control (Required)",
+      "source": "pattern",
+      "scanner": "hipaa2026"
+    },
+    {
+      "id": "HIPAA-ENC-REST-001",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "ePHI Stored Without Encryption at Rest",
+      "description": "All ePHI must be encrypted at rest using AES-256 or stronger.",
+      "hipaaReference": "45 CFR §164.312(a)(2)(iv) - Encryption (Required)",
+      "source": "pattern",
+      "scanner": "hipaa2026"
+    },
+    {
+      "id": "HIPAA-SESSION-001",
+      "category": "access-control",
+      "severity": "high",
+      "title": "Missing Automatic Session Timeout",
+      "description": "PHI access sessions must auto-expire within 15 minutes of inactivity.",
+      "hipaaReference": "45 CFR §164.312(a)(2)(iii) - Session Control (Required)",
+      "source": "pattern",
+      "scanner": "hipaa2026"
+    },
+    {
+      "id": "HIPAA-REVOKE-001",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Missing Immediate Access Revocation",
+      "description": "User deactivation must immediately invalidate all sessions and tokens.",
+      "hipaaReference": "45 CFR §164.308(a)(3)(ii)(C) - Termination Procedures (Required)",
+      "source": "pattern",
+      "scanner": "hipaa2026"
+    },
+    {
+      "id": "HIPAA-BREACH-001",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Missing Breach Notification Mechanism",
+      "description": "Must have automated breach detection and notification within 24 hours.",
+      "hipaaReference": "45 CFR §164.308(a)(6)(ii) - Security Incident Procedures (Required)",
+      "source": "pattern",
+      "scanner": "hipaa2026"
+    },
+    {
+      "id": "HIPAA-SEGMENT-001",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Missing Network Segmentation for PHI",
+      "description": "PHI services must be network-segmented with restricted CORS and firewall rules.",
+      "hipaaReference": "45 CFR §164.312(e)(1) - Transmission Security (Required)",
+      "source": "pattern",
+      "scanner": "hipaa2026"
+    },
+    {
+      "id": "HIPAA-ASSET-001",
+      "category": "access-control",
+      "severity": "high",
+      "title": "Generate ePHI Technology Asset Inventory",
+      "description": "Automatic inventory of all systems processing, storing, or transmitting ePHI.",
+      "hipaaReference": "45 CFR §164.308(a)(1)(ii)(A) - Risk Analysis (Required)",
+      "source": "pattern",
+      "scanner": "hipaa2026"
+    },
+    {
+      "id": "HIPAA-FLOW-001",
+      "category": "access-control",
+      "severity": "high",
+      "title": "Generate ePHI Flow Map",
+      "description": "Automatic mapping of PHI data flow through system (input → processing → storage → output).",
+      "hipaaReference": "45 CFR §164.308(a)(1)(ii)(A) - Risk Analysis (Required)",
+      "source": "pattern",
+      "scanner": "hipaa2026"
+    },
+    {
+      "id": "HIPAA-PENTEST-001",
+      "category": "access-control",
+      "severity": "high",
+      "title": "Missing Vulnerability Scanning Configuration",
+      "description": "Must have automated vulnerability scanning (Dependabot, Snyk, Trivy) in CI/CD.",
+      "hipaaReference": "45 CFR §164.308(a)(8) - Evaluation (Required)",
+      "source": "pattern",
+      "scanner": "hipaa2026"
+    },
+    {
+      "id": "RATE-001",
+      "category": "access-control",
+      "severity": "high",
+      "title": "Authentication Routes Without Rate Limiting",
+      "description": "Authentication route (/login, /signin, /auth, /register, /signup, /password-reset, /forgot-password) defined without rate limiting middleware (rateLimit, rateLimiter, throttle, slowDown, @upstash/ratelimit). Vulnerable to brute force attacks.",
+      "recommendation": "Add rate limiting middleware to authentication routes. Example: const limiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 5 }); app.post(\"/login\", limiter, loginHandler). Prevent brute force attacks on auth endpoints.",
+      "hipaaReference": "45 CFR §164.312(a)(1) - Access Control",
+      "source": "pattern",
+      "scanner": "api-security"
+    },
+    {
+      "id": "CORS-001",
+      "category": "access-control",
+      "severity": "high",
+      "title": "Open CORS Configuration (origin: \"*\")",
+      "description": "CORS configured with origin: \"*\" or Access-Control-Allow-Origin: *. PHI endpoints must restrict access to trusted domains only. Exposes API to cross-origin attacks from any domain.",
+      "recommendation": "Restrict CORS to trusted domains. Example: cors({ origin: [\"https://app.example.com\", \"https://admin.example.com\"] }) or use environment variables: cors({ origin: process.env.ALLOWED_ORIGINS.split(\",\") }). Never use origin: \"*\" for PHI endpoints.",
+      "hipaaReference": "45 CFR §164.312(e)(1) - Transmission Security",
+      "source": "pattern",
+      "scanner": "api-security"
+    },
+    {
+      "id": "API-001",
+      "category": "access-control",
+      "severity": "high",
+      "title": "PHI Data in URL Query Parameters",
+      "description": "PHI data (ssn, dob, patient_name, patientName, diagnosis, medication, mrn, health_record) passed as URL query parameters (?ssn=, &dob=). URLs are logged by servers, proxies, and browsers, exposing PHI in logs.",
+      "recommendation": "Never pass PHI in URL query parameters. Use POST request body instead. Example: Instead of GET /api/patient?ssn=123-45-6789, use POST /api/patient with body: { ssn: \"123-45-6789\" }. URLs are logged in server logs, proxy logs, and browser history.",
+      "hipaaReference": "45 CFR §164.312(a)(1) - Access Control",
+      "source": "pattern",
+      "scanner": "api-security"
+    },
+    {
+      "id": "CONFIG-001",
+      "category": "audit-logging",
+      "severity": "high",
+      "title": "Debug/Verbose Mode Without Environment Gate",
+      "description": "Debug or verbose mode enabled (debug:true, DEBUG:true, verbose:true, devTools:true) without NODE_ENV environment gate. May expose sensitive information in production.",
+      "recommendation": "Gate debug/verbose modes with environment checks. Example: debug: process.env.NODE_ENV === \"development\", or use environment variables: debug: process.env.DEBUG === \"true\". Never hardcode debug:true in production config.",
+      "hipaaReference": "NPRM Configuration Management",
+      "source": "pattern",
+      "scanner": "configuration"
+    },
+    {
+      "id": "CONFIG-002",
+      "category": "audit-logging",
+      "severity": "medium",
+      "title": "Web Server Without Security Headers Middleware",
+      "description": "Web server created (express(), createServer, new Hono, new Elysia) without helmet() or security headers middleware (CSP, X-Frame-Options, X-Content-Type-Options). Missing security headers expose app to XSS, clickjacking, and MIME sniffing attacks.",
+      "recommendation": "Add helmet middleware for Express: app.use(helmet()), or set security headers manually: res.setHeader(\"X-Frame-Options\", \"DENY\"); res.setHeader(\"X-Content-Type-Options\", \"nosniff\"); res.setHeader(\"Content-Security-Policy\", \"default-src 'self'\"). Use helmet for comprehensive security headers.",
+      "hipaaReference": "NPRM Configuration Management",
+      "source": "pattern",
+      "scanner": "configuration"
+    },
+    {
+      "id": "CONFIG-003",
+      "category": "audit-logging",
+      "severity": "low",
+      "title": "Test Framework Imports in Production Code",
+      "description": "Test framework imports (jest, vitest, mocha, chai, faker, cypress) found in production code (non-test files). Test frameworks should only be imported in test files (*.test.*, *.spec.*).",
+      "recommendation": "Remove test framework imports from production code. Test frameworks should only be imported in test files (*.test.ts, *.spec.js, etc.). Move test utilities to separate test helper files.",
+      "hipaaReference": "NPRM Configuration Management",
+      "source": "pattern",
+      "scanner": "configuration"
+    },
+    {
+      "id": "MFA-001",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Authentication Configuration Without MFA Enabled",
+      "description": "Auth provider configuration (NextAuth, Clerk, Auth0, Supabase) does not have MFA/2FA/TOTP enabled",
+      "recommendation": "Enable MFA in your auth provider configuration. For NextAuth: add adapter with MFA support. For Clerk: enable MFA in dashboard. For Auth0: enable MFA in tenant settings. For Supabase: enable MFA in auth settings.",
+      "hipaaReference": "NPRM §164.312(d) - Person or Entity Authentication",
+      "source": "pattern",
+      "scanner": "authentication"
+    },
+    {
+      "id": "MFA-002",
+      "category": "access-control",
+      "severity": "high",
+      "title": "Login Flow Without Second Factor Authentication",
+      "description": "Login/sign-in flow authenticates with only email and password without requiring second factor verification",
+      "recommendation": "Add second factor verification to login flow. After successful password authentication, require MFA token/TOTP code before granting access. Example: if (user.mfaEnabled && !mfaToken) return { error: \"MFA required\" }",
+      "hipaaReference": "NPRM §164.312(d) - Person or Entity Authentication",
+      "source": "pattern",
+      "scanner": "authentication"
+    },
+    {
+      "id": "MFA-003",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "MFA Bypass Detected in Code",
+      "description": "Code explicitly bypasses, skips, or disables MFA requirements",
+      "recommendation": "Remove MFA bypass code. MFA should be mandatory for all users accessing PHI. If testing is needed, use proper test isolation instead of disabling MFA in production code.",
+      "hipaaReference": "NPRM §164.312(d) - Person or Entity Authentication",
+      "source": "pattern",
+      "scanner": "authentication"
+    },
+    {
+      "id": "ERROR-001",
+      "category": "audit-logging",
+      "severity": "high",
+      "title": "Unsanitized Error Details Sent to User",
+      "description": "Response sends error.stack or error.message directly to user without sanitization, potentially exposing sensitive system information",
+      "recommendation": "Never send error.stack or error.message directly to users. Use generic error messages for production. Example: res.status(500).json({ error: \"An error occurred\" }). Log detailed errors server-side only.",
+      "hipaaReference": "45 CFR §164.312(b) - Audit Controls",
+      "source": "pattern",
+      "scanner": "errors"
+    },
+    {
+      "id": "ERROR-002",
+      "category": "audit-logging",
+      "severity": "critical",
+      "title": "PHI Data in Error Logs or Thrown Errors",
+      "description": "Protected Health Information (patient, ssn, dob, mrn, diagnosis, medication, healthRecord) exposed in console logs, logger, or thrown errors",
+      "recommendation": "Never log PHI in error messages. Redact sensitive data before logging. Example: logger.error(\"Error processing patient\", { patientId: redact(patient.id) }). Use patient IDs only, never full PHI.",
+      "hipaaReference": "45 CFR §164.312(c) - Integrity Controls",
+      "source": "pattern",
+      "scanner": "errors"
+    },
+    {
+      "id": "BACKUP-001",
+      "category": "data-retention",
+      "severity": "medium",
+      "title": "Database Without Backup Configuration",
+      "description": "Database usage detected (supabase, prisma, mongoose, drizzle, typeorm, sequelize, knex) without backup/snapshot/replicate configuration references in project. Advisory: Full verification requires infrastructure inspection.",
+      "recommendation": "Configure automated database backups. Examples: Enable Supabase automatic backups, configure Prisma backup scripts, set up MongoDB Atlas continuous backups, or use pg_dump/mongodump in CI/CD. Document backup schedule and retention policy.",
+      "hipaaReference": "45 CFR §164.308(a)(7)(ii)(A) - Data Backup Plan",
+      "source": "pattern",
+      "scanner": "operational"
+    },
+    {
+      "id": "RETENTION-001",
+      "category": "data-retention",
+      "severity": "medium",
+      "title": "PHI Records Created Without Retention Fields",
+      "description": "PHI record creation (insert/create/save/upsert on patient/health/medical/clinical tables) without retention fields (expiresAt, ttl, retainUntil, retentionPeriod, deleteAfter). HIPAA requires minimum necessary retention periods.",
+      "recommendation": "Add retention fields to PHI record creation. Example: { ...patientData, expiresAt: new Date(Date.now() + 7 * 365 * 24 * 60 * 60 * 1000) } or { ...data, retentionPeriod: \"7years\", deleteAfter: calculateDeleteDate() }. Define retention policy based on record type and regulatory requirements.",
+      "hipaaReference": "45 CFR §164.316(b)(2)(i) - Retention Period",
+      "source": "pattern",
+      "scanner": "operational"
+    },
+    {
+      "id": "API-002",
+      "category": "data-retention",
+      "severity": "low",
+      "title": "JSON Body Parser Without Size Limit",
+      "description": "express.json() or bodyParser.json() configured without limit option. Unlimited body size can lead to DoS attacks via large payload submissions.",
+      "recommendation": "Configure body size limits. Example: app.use(express.json({ limit: \"10mb\" })) or bodyParser.json({ limit: \"1mb\" }). Set limit based on expected payload size. Typical values: 1mb for APIs, 10mb for file uploads.",
+      "hipaaReference": "45 CFR §164.308(a)(1)(ii)(D) - System Security",
+      "source": "pattern",
+      "scanner": "operational"
+    },
+    {
+      "id": "CRED-001",
+      "category": "encryption",
+      "severity": "critical",
+      "title": "Weak Password Hashing Algorithm Detected",
+      "description": "Using MD5, SHA1, or SHA256 for password hashing instead of secure algorithms like bcrypt, argon2, or scrypt",
+      "recommendation": "Use bcrypt, argon2, or scrypt for password hashing. Example: await bcrypt.hash(password, 10) or await argon2.hash(password). Never use MD5, SHA1, or simple SHA256 for passwords.",
+      "hipaaReference": "45 CFR §164.312(d) - Person or Entity Authentication",
+      "source": "pattern",
+      "scanner": "credentials"
+    },
+    {
+      "id": "CRED-002",
+      "category": "encryption",
+      "severity": "critical",
+      "title": "Hardcoded Credentials Detected",
+      "description": "Credentials (password, apiKey, secret, token, connectionString) hardcoded as string literals instead of using environment variables",
+      "recommendation": "Move credentials to environment variables. Use process.env.PASSWORD or a secure secrets manager. Never commit credentials to source control. Add credentials to .gitignore.",
+      "hipaaReference": "45 CFR §164.312(a)(2)(i) - Unique User Identification",
+      "source": "pattern",
+      "scanner": "credentials"
+    },
+    {
+      "id": "CRED-003",
+      "category": "encryption",
+      "severity": "critical",
+      "title": "Secrets Exposed to Client via NEXT_PUBLIC_ Prefix",
+      "description": "Sensitive credentials exposed to client-side code using NEXT_PUBLIC_ environment variable prefix",
+      "recommendation": "Remove NEXT_PUBLIC_ prefix from sensitive variables. Use server-side environment variables (without NEXT_PUBLIC_) and access them in API routes or getServerSideProps. Only use NEXT_PUBLIC_ for truly public values like API endpoints or publishable keys.",
+      "hipaaReference": "45 CFR §164.312(a)(2)(i) - Unique User Identification",
+      "source": "pattern",
+      "scanner": "credentials"
+    },
+    {
+      "id": "RBAC-001",
+      "category": "access-control",
+      "severity": "high",
+      "title": "PHI Data Access Without Role/Permission Verification",
+      "description": "Database query accessing PHI data (patient, health, medical, diagnosis, treatment, prescription) without role or permission verification",
+      "recommendation": "Add role/permission verification before accessing PHI data. Example: if (!hasPermission(user, \"read:patients\")) throw new Error(\"Unauthorized\"). Implement RBAC middleware to verify user roles before database queries.",
+      "hipaaReference": "45 CFR §164.312(a)(1) - Access Control",
+      "source": "pattern",
+      "scanner": "rbac"
+    },
+    {
+      "id": "RBAC-002",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Service Role Key or Admin Default in Client Code",
+      "description": "Privileged service_role key exposed in client-side code, isAdmin set to true as default, or conditions that always grant admin access",
+      "recommendation": "Remove service_role keys from client-side code - these should only exist in server-side API routes. Never default isAdmin to true. Implement proper role assignment based on authenticated user data from secure backend.",
+      "hipaaReference": "45 CFR §164.312(a)(1) - Access Control",
+      "source": "pattern",
+      "scanner": "rbac"
+    },
+    {
+      "id": "RBAC-003",
+      "category": "access-control",
+      "severity": "medium",
+      "title": "SELECT * on PHI Tables Violates Minimum Necessary Principle",
+      "description": "Query uses SELECT * or .select(\"*\") on tables containing PHI, retrieving more data than necessary in violation of HIPAA minimum necessary principle",
+      "recommendation": "Select only the minimum necessary fields required for the operation. Example: Instead of SELECT * FROM patients, use SELECT id, name, dob FROM patients. For ORMs: .select(\"id, name, dob\") or use field projections.",
+      "hipaaReference": "45 CFR §164.502(b) - Minimum Necessary Requirement",
+      "source": "pattern",
+      "scanner": "rbac"
+    },
+    {
+      "id": "SANITIZE-001",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Unsanitized User Input in Database Operations",
+      "description": "User input from req.body, req.params, or req.query used directly in database operations (insert, update, query, sql, where) without validation (zod, yup, joi, validate, sanitize, parse)",
+      "recommendation": "Always validate and sanitize user input before database operations. Use validation libraries like Zod, Yup, or Joi. Example: const validated = schema.parse(req.body); await db.insert(validated). Never use raw req.body/params/query directly in database operations.",
+      "hipaaReference": "NPRM Anti-malware",
+      "source": "pattern",
+      "scanner": "sanitization"
+    },
+    {
+      "id": "SANITIZE-002",
+      "category": "access-control",
+      "severity": "high",
+      "title": "Insecure File Upload Configuration",
+      "description": "File upload configuration (multer, formidable, busboy) missing fileFilter, limits, or MIME type validation",
+      "recommendation": "Configure file upload middleware with proper validation. Example: multer({ fileFilter: (req, file, cb) => { if (allowedMimes.includes(file.mimetype)) cb(null, true); else cb(new Error(\"Invalid file type\")); }, limits: { fileSize: 5 * 1024 * 1024 } }). Always validate file type, size, and extension.",
+      "hipaaReference": "NPRM Anti-malware",
+      "source": "pattern",
+      "scanner": "sanitization"
+    },
+    {
+      "id": "REVOKE-001",
+      "category": "access-control",
+      "severity": "high",
+      "title": "JWT Without Server-Side Revocation Mechanism",
+      "description": "JWT token generation (jwt.sign, jsonwebtoken, jose) without server-side revocation mechanism (revoke, blacklist, allowlist, tokenStore, invalidate, denylist). HIPAA NPRM requires ability to revoke access within 1 hour.",
+      "recommendation": "Implement server-side token revocation mechanism. Store active tokens in Redis/database with TTL, or maintain a blacklist of revoked tokens. Example: await redis.set(`token:${userId}`, token, \"EX\", 3600); await redis.del(`token:${userId}`) to revoke. HIPAA requires ability to revoke access within 1 hour.",
+      "hipaaReference": "NPRM §164.308(a)(3)(ii)(C) - Access Revocation",
+      "source": "pattern",
+      "scanner": "revocation"
+    },
+    {
+      "id": "REVOKE-002",
+      "category": "access-control",
+      "severity": "medium",
+      "title": "Excessive Token Expiration Time",
+      "description": "JWT token with excessive expiration time. Access tokens should expire within 24 hours (expiresIn: \"24h\" or less). Refresh tokens should not exceed 7 days for sensitive data.",
+      "recommendation": "Use short-lived access tokens (≤ 24 hours): expiresIn: \"1h\" or expiresIn: \"15m\". For longer sessions, implement refresh token rotation. Example: accessToken with expiresIn: \"1h\", refreshToken with expiresIn: \"7d\". Reduce attack window if token is compromised.",
+      "hipaaReference": "NPRM §164.308(a)(3)(ii)(C) - Access Revocation",
+      "source": "pattern",
+      "scanner": "revocation"
+    },
+    {
+      "id": "select-star",
+      "category": "access-control",
+      "severity": "medium",
+      "title": "SELECT * on sensitive table",
+      "description": "Using SELECT * may retrieve more PHI than necessary.",
+      "recommendation": "Select only required columns to minimize PHI exposure (minimum necessary).",
+      "source": "pattern",
+      "scanner": "access"
+    },
+    {
+      "id": "hardcoded-admin",
+      "category": "access-control",
+      "severity": "high",
+      "title": "Hardcoded admin role",
+      "description": "Hardcoded administrative role assignment detected.",
+      "recommendation": "Use role-based access control (RBAC) with proper authentication.",
+      "source": "pattern",
+      "scanner": "access"
+    },
+    {
+      "id": "auth-bypass",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Potential authentication bypass",
+      "description": "Code pattern suggests authentication may be bypassed.",
+      "recommendation": "Remove any authentication bypass mechanisms in production code.",
+      "source": "pattern",
+      "scanner": "access"
+    },
+    {
+      "id": "admin-flag",
+      "category": "access-control",
+      "severity": "medium",
+      "title": "Hardcoded admin flag",
+      "description": "Admin privileges set via hardcoded flag.",
+      "recommendation": "Determine admin status through secure authentication flow.",
+      "source": "pattern",
+      "scanner": "access"
+    },
+    {
+      "id": "public-password",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Password field with public visibility",
+      "description": "Password field may have public accessibility.",
+      "recommendation": "Password fields should be private and never exposed.",
+      "source": "pattern",
+      "scanner": "access"
+    },
+    {
+      "id": "cors-wildcard",
+      "category": "access-control",
+      "severity": "high",
+      "title": "CORS wildcard origin",
+      "description": "CORS configured to allow all origins.",
+      "recommendation": "Restrict CORS to specific trusted domains for PHI-handling endpoints.",
+      "source": "pattern",
+      "scanner": "access"
+    },
+    {
+      "id": "no-session-expiry",
+      "category": "access-control",
+      "severity": "high",
+      "title": "Session without expiration",
+      "description": "Session configured without expiration.",
+      "recommendation": "Implement automatic session timeout for PHI access (HIPAA recommends 15 min idle).",
+      "source": "pattern",
+      "scanner": "access"
+    },
+    {
+      "id": "short-retention",
+      "category": "data-retention",
+      "severity": "high",
+      "title": "PHI retention period may be too short",
+      "description": "Data deletion configured with period shorter than HIPAA requirements.",
+      "recommendation": "HIPAA requires PHI retention for 6 years from creation or last effective date.",
+      "source": "pattern",
+      "scanner": "retention"
+    },
+    {
+      "id": "unlogged-delete",
+      "category": "data-retention",
+      "severity": "medium",
+      "title": "Data deletion without apparent logging",
+      "description": "Data deletion operation without visible audit logging.",
+      "recommendation": "Log all PHI deletions with timestamp, user, and record identifiers.",
+      "source": "pattern",
+      "scanner": "retention"
+    },
+    {
+      "id": "bulk-delete",
+      "category": "data-retention",
+      "severity": "critical",
+      "title": "Bulk data deletion operation",
+      "description": "Bulk deletion (TRUNCATE/DROP) could delete PHI without proper retention.",
+      "recommendation": "Implement soft-delete with retention periods before permanent deletion.",
+      "source": "pattern",
+      "scanner": "retention"
+    },
+    {
+      "id": "backup-disabled",
+      "category": "data-retention",
+      "severity": "high",
+      "title": "Backup may be disabled",
+      "description": "Code pattern suggests backups might be disabled.",
+      "recommendation": "Maintain encrypted backups with proper retention for disaster recovery.",
+      "source": "pattern",
+      "scanner": "retention"
+    },
+    {
+      "id": "phi-cache",
+      "category": "data-retention",
+      "severity": "medium",
+      "title": "PHI caching detected",
+      "description": "Patient data may be cached, requiring retention policy consideration.",
+      "recommendation": "Ensure cached PHI has appropriate TTL and is encrypted at rest.",
+      "source": "pattern",
+      "scanner": "retention"
+    },
+    {
+      "id": "hardcoded-password",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Hardcoded password detected",
+      "description": "A password appears to be hardcoded in the source code.",
+      "recommendation": "Use environment variables or a secrets manager for credentials. Never commit passwords to source control.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "hardcoded-pwd",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Hardcoded password (pwd) detected",
+      "description": "A password appears to be hardcoded using \"pwd\" variable.",
+      "recommendation": "Use environment variables or a secrets manager for credentials.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "hardcoded-secret",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Hardcoded secret detected",
+      "description": "A secret value appears to be hardcoded in the source code.",
+      "recommendation": "Use environment variables or a secrets manager for secrets.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "credentials-object",
+      "category": "access-control",
+      "severity": "high",
+      "title": "Credentials object with password",
+      "description": "A credentials object containing password field was detected.",
+      "recommendation": "Load credentials from secure configuration, not source code.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "api-key-exposed",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "API key exposed in source",
+      "description": "An API key appears to be hardcoded in the source code.",
+      "recommendation": "Use environment variables for API keys. Add to .gitignore and use .env files.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "apikey-exposed",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "API key (apikey) exposed in source",
+      "description": "An API key appears to be hardcoded.",
+      "recommendation": "Use environment variables for API keys.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "stripe-key-exposed",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Stripe API key exposed",
+      "description": "A Stripe API key pattern was detected in the source code.",
+      "recommendation": "Never commit Stripe keys. Use environment variables and restrict key permissions.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "aws-key-exposed",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "AWS Access Key exposed",
+      "description": "An AWS Access Key ID pattern was detected.",
+      "recommendation": "Rotate this key immediately. Use IAM roles or environment variables instead.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "bearer-token-exposed",
+      "category": "access-control",
+      "severity": "high",
+      "title": "Bearer token in source",
+      "description": "A bearer token appears to be hardcoded.",
+      "recommendation": "Tokens should be fetched at runtime, not hardcoded.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "auth-token-exposed",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Auth token exposed in source",
+      "description": "An authentication token appears to be hardcoded.",
+      "recommendation": "Use secure token management. Never commit tokens to source control.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "private-key-exposed",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Private key exposed in source",
+      "description": "A private key appears to be embedded in source code.",
+      "recommendation": "Never commit private keys. Use secure key management services.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "mongodb-uri-credentials",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "MongoDB URI with credentials",
+      "description": "A MongoDB connection string with embedded credentials was detected.",
+      "recommendation": "Use environment variables for database connection strings.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "postgres-uri-credentials",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "PostgreSQL URI with credentials",
+      "description": "A PostgreSQL connection string with embedded credentials was detected.",
+      "recommendation": "Use environment variables for database connection strings.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "mysql-uri-credentials",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "MySQL URI with credentials",
+      "description": "A MySQL connection string with embedded credentials was detected.",
+      "recommendation": "Use environment variables for database connection strings.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "innerhtml-unsanitized",
+      "category": "access-control",
+      "severity": "high",
+      "title": "Unsanitized innerHTML assignment",
+      "description": "Direct innerHTML assignment without sanitization can lead to XSS vulnerabilities.",
+      "recommendation": "Use textContent for text, or sanitize HTML with DOMPurify before innerHTML assignment.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "dangerous-innerhtml-react",
+      "category": "access-control",
+      "severity": "high",
+      "title": "dangerouslySetInnerHTML usage",
+      "description": "Using dangerouslySetInnerHTML can expose the application to XSS attacks.",
+      "recommendation": "Sanitize content with DOMPurify before using dangerouslySetInnerHTML.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "eval-usage",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "eval() usage detected",
+      "description": "Using eval() can execute arbitrary code and is a security risk.",
+      "recommendation": "Avoid eval(). Use safer alternatives like JSON.parse() for data parsing.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "function-constructor",
+      "category": "access-control",
+      "severity": "high",
+      "title": "Function constructor usage",
+      "description": "The Function constructor can execute arbitrary code like eval().",
+      "recommendation": "Avoid dynamic code execution. Use predefined functions instead.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "document-write",
+      "category": "access-control",
+      "severity": "medium",
+      "title": "document.write usage",
+      "description": "document.write can be exploited for XSS and blocks page rendering.",
+      "recommendation": "Use DOM manipulation methods (appendChild, insertAdjacentHTML) instead.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "sql-string-concat",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "SQL query string concatenation",
+      "description": "Building SQL queries with string concatenation is vulnerable to SQL injection.",
+      "recommendation": "Use parameterized queries or prepared statements. Never concatenate user input into SQL.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "sql-template-literal",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "SQL query with template literal interpolation",
+      "description": "Interpolating variables directly into SQL queries enables SQL injection.",
+      "recommendation": "Use parameterized queries. Pass variables as parameters, not interpolated strings.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "query-template-injection",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Database query with template interpolation",
+      "description": "Template literal interpolation in database queries can lead to injection attacks.",
+      "recommendation": "Use parameterized queries: query(\"SELECT * FROM users WHERE id = $1\", [userId])",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "execute-string-concat",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "SQL execute with string concatenation",
+      "description": "Concatenating strings in SQL execute statements enables injection.",
+      "recommendation": "Use parameterized queries instead of string concatenation.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "raw-query-injection",
+      "category": "access-control",
+      "severity": "critical",
+      "title": "Raw SQL query with interpolation",
+      "description": "Raw SQL queries with interpolated values are vulnerable to injection.",
+      "recommendation": "Even with raw queries, use parameter binding for user-supplied values.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "cookie-no-httponly",
+      "category": "access-control",
+      "severity": "high",
+      "title": "Cookie without httpOnly flag",
+      "description": "Cookies without httpOnly can be accessed by JavaScript, enabling XSS attacks.",
+      "recommendation": "Add httpOnly: true and secure: true to all cookies, especially session cookies.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "cookie-config-insecure",
+      "category": "access-control",
+      "severity": "high",
+      "title": "Cookie configuration missing security flags",
+      "description": "Cookie configuration is missing httpOnly and/or secure flags.",
+      "recommendation": "Always set httpOnly: true, secure: true for cookies handling sensitive data.",
+      "source": "pattern",
+      "scanner": "security"
+    },
+    {
+      "id": "audit-no-framework",
+      "category": "audit-logging",
+      "severity": "high",
+      "title": "No audit logging framework detected",
+      "description": "No recognized logging framework found in dependencies.",
+      "recommendation": "Implement structured audit logging using winston, pino, or similar.",
+      "hipaaReference": "§164.312(b)",
+      "source": "pattern",
+      "scanner": "audit"
+    },
+    {
+      "id": "audit-unlogged-action",
+      "category": "audit-logging",
+      "severity": "medium",
+      "title": "PHI operation may lack audit logging",
+      "description": "A create, update, delete, read, or auth operation on PHI-related data was found without apparent audit logging in the same file.",
+      "recommendation": "Log all PHI operations with timestamp, user ID, and action details.",
+      "hipaaReference": "§164.312(b)",
+      "source": "pattern",
+      "scanner": "audit"
+    },
+    {
+      "id": "enc-md5",
+      "category": "encryption",
+      "severity": "high",
+      "title": "MD5 hash function",
+      "description": "MD5 hash function is not suitable for protecting PHI.",
+      "recommendation": "Use AES-256-GCM for encryption and SHA-256 or stronger for hashing.",
+      "hipaaReference": "§164.312(a)(2)(iv), §164.312(e)(2)(ii)",
+      "source": "pattern",
+      "scanner": "encryption"
+    },
+    {
+      "id": "enc-sha1",
+      "category": "encryption",
+      "severity": "medium",
+      "title": "SHA1 hash function",
+      "description": "SHA1 hash function is not suitable for protecting PHI.",
+      "recommendation": "Use AES-256-GCM for encryption and SHA-256 or stronger for hashing.",
+      "hipaaReference": "§164.312(a)(2)(iv), §164.312(e)(2)(ii)",
+      "source": "pattern",
+      "scanner": "encryption"
+    },
+    {
+      "id": "enc-des",
+      "category": "encryption",
+      "severity": "critical",
+      "title": "DES encryption",
+      "description": "DES encryption is not suitable for protecting PHI.",
+      "recommendation": "Use AES-256-GCM for encryption and SHA-256 or stronger for hashing.",
+      "hipaaReference": "§164.312(a)(2)(iv), §164.312(e)(2)(ii)",
+      "source": "pattern",
+      "scanner": "encryption"
+    },
+    {
+      "id": "enc-rc4",
+      "category": "encryption",
+      "severity": "critical",
+      "title": "RC4 encryption",
+      "description": "RC4 encryption is not suitable for protecting PHI.",
+      "recommendation": "Use AES-256-GCM for encryption and SHA-256 or stronger for hashing.",
+      "hipaaReference": "§164.312(a)(2)(iv), §164.312(e)(2)(ii)",
+      "source": "pattern",
+      "scanner": "encryption"
+    },
+    {
+      "id": "enc-deprecated-cipher",
+      "category": "encryption",
+      "severity": "high",
+      "title": "Deprecated cipher method",
+      "description": "Deprecated cipher method is not suitable for protecting PHI.",
+      "recommendation": "Use AES-256-GCM for encryption and SHA-256 or stronger for hashing.",
+      "hipaaReference": "§164.312(a)(2)(iv), §164.312(e)(2)(ii)",
+      "source": "pattern",
+      "scanner": "encryption"
+    },
+    {
+      "id": "enc-ecb-mode",
+      "category": "encryption",
+      "severity": "high",
+      "title": "ECB mode encryption",
+      "description": "ECB mode encryption is not suitable for protecting PHI.",
+      "recommendation": "Use AES-256-GCM for encryption and SHA-256 or stronger for hashing.",
+      "hipaaReference": "§164.312(a)(2)(iv), §164.312(e)(2)(ii)",
+      "source": "pattern",
+      "scanner": "encryption"
+    },
+    {
+      "id": "enc-http-url",
+      "category": "encryption",
+      "severity": "high",
+      "title": "Unencrypted HTTP URL",
+      "description": "Unencrypted HTTP URL may expose PHI in transit or at rest.",
+      "recommendation": "Enforce TLS 1.2+ for PHI in transit and encrypt PHI (including backups) at rest.",
+      "hipaaReference": "§164.312(e)(1)",
+      "source": "pattern",
+      "scanner": "encryption"
+    },
+    {
+      "id": "enc-ssl-disabled",
+      "category": "encryption",
+      "severity": "critical",
+      "title": "SSL disabled",
+      "description": "SSL disabled may expose PHI in transit or at rest.",
+      "recommendation": "Enforce TLS 1.2+ for PHI in transit and encrypt PHI (including backups) at rest.",
+      "hipaaReference": "§164.312(e)(1)",
+      "source": "pattern",
+      "scanner": "encryption"
+    },
+    {
+      "id": "enc-ssl-verify-disabled",
+      "category": "encryption",
+      "severity": "critical",
+      "title": "SSL verification disabled",
+      "description": "SSL verification disabled may expose PHI in transit or at rest.",
+      "recommendation": "Enforce TLS 1.2+ for PHI in transit and encrypt PHI (including backups) at rest.",
+      "hipaaReference": "§164.312(e)(1)",
+      "source": "pattern",
+      "scanner": "encryption"
+    },
+    {
+      "id": "enc-tls-cert-validation-disabled",
+      "category": "encryption",
+      "severity": "critical",
+      "title": "TLS certificate validation disabled",
+      "description": "TLS certificate validation disabled may expose PHI in transit or at rest.",
+      "recommendation": "Enforce TLS 1.2+ for PHI in transit and encrypt PHI (including backups) at rest.",
+      "hipaaReference": "§164.312(e)(1)",
+      "source": "pattern",
+      "scanner": "encryption"
+    },
+    {
+      "id": "enc-backup-encryption-disabled",
+      "category": "encryption",
+      "severity": "critical",
+      "title": "Backup encryption disabled",
+      "description": "Backup encryption disabled may expose PHI in transit or at rest.",
+      "recommendation": "Enforce TLS 1.2+ for PHI in transit and encrypt PHI (including backups) at rest.",
+      "hipaaReference": "§164.312(e)(1)",
+      "source": "pattern",
+      "scanner": "encryption"
+    },
+    {
+      "id": "enc-db-backup-no-ssl",
+      "category": "encryption",
+      "severity": "high",
+      "title": "Database backup without SSL",
+      "description": "Database backup without SSL may expose PHI in transit or at rest.",
+      "recommendation": "Enforce TLS 1.2+ for PHI in transit and encrypt PHI (including backups) at rest.",
+      "hipaaReference": "§164.312(e)(1)",
+      "source": "pattern",
+      "scanner": "encryption"
+    },
+    {
+      "id": "enc-backup-file-unencrypted",
+      "category": "encryption",
+      "severity": "high",
+      "title": "Unencrypted backup file format",
+      "description": "Unencrypted backup file format may expose PHI in transit or at rest.",
+      "recommendation": "Enforce TLS 1.2+ for PHI in transit and encrypt PHI (including backups) at rest.",
+      "hipaaReference": "§164.312(e)(1)",
+      "source": "pattern",
+      "scanner": "encryption"
+    },
+    {
+      "id": "enc-phi-backup-unencrypted",
+      "category": "encryption",
+      "severity": "critical",
+      "title": "PHI backup without encryption",
+      "description": "PHI backup without encryption may expose PHI in transit or at rest.",
+      "recommendation": "Enforce TLS 1.2+ for PHI in transit and encrypt PHI (including backups) at rest.",
+      "hipaaReference": "§164.312(e)(1)",
+      "source": "pattern",
+      "scanner": "encryption"
+    },
+    {
+      "id": "enc-s3-backup-no-sse",
+      "category": "encryption",
+      "severity": "high",
+      "title": "S3 backup without server-side encryption",
+      "description": "S3 backup without server-side encryption may expose PHI in transit or at rest.",
+      "recommendation": "Enforce TLS 1.2+ for PHI in transit and encrypt PHI (including backups) at rest.",
+      "hipaaReference": "§164.312(e)(1)",
+      "source": "pattern",
+      "scanner": "encryption"
+    },
+    {
+      "id": "enc-backup-storage-unencrypted",
+      "category": "encryption",
+      "severity": "medium",
+      "title": "Backup storage without encryption specified",
+      "description": "Backup storage without encryption specified may expose PHI in transit or at rest.",
+      "recommendation": "Enforce TLS 1.2+ for PHI in transit and encrypt PHI (including backups) at rest.",
+      "hipaaReference": "§164.312(e)(1)",
+      "source": "pattern",
+      "scanner": "encryption"
+    },
+    {
+      "id": "HIPAA-PHI-003",
+      "category": "phi-exposure",
+      "severity": "info",
+      "title": "Minimum Necessary Access",
+      "description": "Minimum Necessary Access",
+      "source": "ai",
+      "scanner": "ai"
+    },
+    {
+      "id": "HIPAA-SEC-001",
+      "category": "encryption",
+      "severity": "info",
+      "title": "PHI Encryption",
+      "description": "PHI Encryption",
+      "source": "ai",
+      "scanner": "ai"
+    },
+    {
+      "id": "HIPAA-ACCESS-001",
+      "category": "access-control",
+      "severity": "info",
+      "title": "Role-Based Access Control",
+      "description": "Role-Based Access Control",
+      "source": "ai",
+      "scanner": "ai"
+    },
+    {
+      "id": "HIPAA-AUDIT-001",
+      "category": "audit-logging",
+      "severity": "info",
+      "title": "Audit Logging",
+      "description": "Audit Logging",
+      "source": "ai",
+      "scanner": "ai"
+    },
+    {
+      "id": "HIPAA-RETENTION-001",
+      "category": "data-retention",
+      "severity": "info",
+      "title": "Data Retention",
+      "description": "Data Retention",
+      "source": "ai",
+      "scanner": "ai"
+    },
+    {
+      "id": "HIPAA-AUTH-001",
+      "category": "access-control",
+      "severity": "info",
+      "title": "Session Management",
+      "description": "Session Management",
+      "source": "ai",
+      "scanner": "ai"
+    }
+  ]
+}