{
  "source_doc": "docs/owasp-static-checklist.md",
  "generated_from": "docs/owasp-static-checklist.md",
  "checks": [
    {
      "id": "a01_role_escalation_checks",
      "title": "OWASP A01:2021 (Broken Access Control): Role Escalation Checks",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires authorization logic and role hierarchy analysis beyond regex patterns."
    },
    {
      "id": "a01_role_escalation_checks_verify_role_hierarchy_comparisons_in_auth_middleware_guards",
      "title": "OWASP A01:2021 (Broken Access Control): Role Escalation Checks - Verify Role Hierarchy Comparisons in Auth Middleware/guards",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs control-flow/authorization analysis, not regex patterns."
    },
    {
      "id": "a01_role_escalation_checks_flag_role_assignment_from_untrusted_request_fields",
      "title": "OWASP A01:2021 (Broken Access Control): Role Escalation Checks - Flag Role Assignment from Untrusted Request Fields",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires data-flow tracking from request to role."
    },
    {
      "id": "a01_unauthenticated_access",
      "title": "OWASP A01:2021 (Broken Access Control): Unauthenticated Access",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires route-to-auth mapping and sensitivity analysis."
    },
    {
      "id": "a01_unauthenticated_access_detect_routes_lacking_auth_middleware",
      "title": "OWASP A01:2021 (Broken Access Control): Unauthenticated Access - Detect Routes Lacking Auth Middleware",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs framework-specific routing analysis."
    },
    {
      "id": "a01_unauthenticated_access_public_endpoints_returning_sensitive_data",
      "title": "OWASP A01:2021 (Broken Access Control): Unauthenticated Access - Public Endpoints Returning Sensitive Data",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires semantic data classification."
    },
    {
      "id": "a01_horizontal_privilege_escalation",
      "title": "OWASP A01:2021 (Broken Access Control): Horizontal Privilege Escalation",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires ownership checks across read/update/delete flows."
    },
    {
      "id": "a01_horizontal_privilege_escalation_ensure_resource_owner_checks_on_crud_handlers",
      "title": "OWASP A01:2021 (Broken Access Control): Horizontal Privilege Escalation - Ensure Resource Owner Checks on CRUD Handlers",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs object ownership analysis."
    },
    {
      "id": "a01_horizontal_privilege_escalation_derive_user_tenant_from_auth_context_not_request",
      "title": "OWASP A01:2021 (Broken Access Control): Horizontal Privilege Escalation - Derive User/tenant from Auth Context (not Request)",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires data-flow analysis."
    },
    {
      "id": "a01_vertical_privilege_escalation",
      "title": "OWASP A01:2021 (Broken Access Control): Vertical Privilege Escalation",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires role/permission enforcement verification."
    },
    {
      "id": "a01_vertical_privilege_escalation_admin_only_actions_gated_by_role_checks",
      "title": "OWASP A01:2021 (Broken Access Control): Vertical Privilege Escalation - Admin-only Actions Gated by Role Checks",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs authorization analysis."
    },
    {
      "id": "a01_vertical_privilege_escalation_avoid_client_side_role_flags_for_auth_decisions",
      "title": "OWASP A01:2021 (Broken Access Control): Vertical Privilege Escalation - Avoid Client-side Role Flags for Auth Decisions",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires trust-boundary analysis."
    },
    {
      "id": "a01_forced_browsing",
      "title": "OWASP A01:2021 (Broken Access Control): Forced Browsing",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires route discovery and auth coverage validation."
    },
    {
      "id": "a01_forced_browsing_detect_unlinked_routes_or_legacy_endpoints_without_auth",
      "title": "OWASP A01:2021 (Broken Access Control): Forced Browsing - Detect Unlinked Routes or Legacy Endpoints Without Auth",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires endpoint inventory."
    },
    {
      "id": "a01_forced_browsing_direct_file_dir_access_in_static_handlers",
      "title": "OWASP A01:2021 (Broken Access Control): Forced Browsing - Direct File/dir Access in Static Handlers",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs server config/handler analysis."
    },
    {
      "id": "a01_idor_testing",
      "title": "OWASP A01:2021 (Broken Access Control): IDOR Testing",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires object reference checks and access control review."
    },
    {
      "id": "a01_idor_testing_object_ids_used_without_authz_guard",
      "title": "OWASP A01:2021 (Broken Access Control): IDOR Testing - Object IDs Used Without Authz Guard",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs ownership/permission checks."
    },
    {
      "id": "a01_idor_testing_sequential_ids_without_access_control",
      "title": "OWASP A01:2021 (Broken Access Control): IDOR Testing - Sequential IDs Without Access Control",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires flow and access validation."
    },
    {
      "id": "a01_url_manipulation",
      "title": "OWASP A01:2021 (Broken Access Control): URL Manipulation",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires validation of path/query parameters for auth decisions."
    },
    {
      "id": "a01_url_manipulation_validate_path_params_used_for_access_decisions",
      "title": "OWASP A01:2021 (Broken Access Control): URL Manipulation - Validate Path Params Used for Access Decisions",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs parameter validation logic."
    },
    {
      "id": "a01_url_manipulation_open_redirect_via_next_returnurl_parameters",
      "title": "OWASP A01:2021 (Broken Access Control): URL Manipulation - Open Redirect via Next/returnUrl Parameters",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Detect redirect/302 responses using user-controlled URL params without validation.",
      "patterns": [
        "redirect(req.query",
        "redirect(req.params",
        "redirect(request.query",
        "res.redirect(req.",
        "NextResponse.redirect(new URL(req.",
        "Location header set from user input"
      ],
      "examples": {
        "vulnerable": "const url = req.query.redirect; return NextResponse.redirect(url);",
        "safe": "const url = req.query.redirect; if (!isAllowedHost(url)) return NextResponse.json({error: 'invalid redirect'}, {status: 400}); return NextResponse.redirect(url);"
      }
    },
    {
      "id": "a01_access_bypass_via_headers_cookies",
      "title": "OWASP A01:2021 (Broken Access Control): Access Bypass via Headers/cookies",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires validation of trust boundaries for client-provided data."
    },
    {
      "id": "a01_access_bypass_via_headers_cookies_auth_based_on_client_headers",
      "title": "OWASP A01:2021 (Broken Access Control): Access Bypass via Headers/cookies - Auth Based on Client Headers",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs auth decision source analysis."
    },
    {
      "id": "a01_access_bypass_via_headers_cookies_debug_test_headers_enabling_access",
      "title": "OWASP A01:2021 (Broken Access Control): Access Bypass via Headers/cookies - Debug/test Headers Enabling Access",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires code path inspection."
    },
    {
      "id": "a01_multi_tenant_boundary_testing",
      "title": "OWASP A01:2021 (Broken Access Control): Multi-tenant Boundary Testing",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires tenant isolation checks across data access paths."
    },
    {
      "id": "a01_multi_tenant_boundary_testing_enforce_tenant_id_filters_on_queries",
      "title": "OWASP A01:2021 (Broken Access Control): Multi-tenant Boundary Testing - Enforce Tenant_id Filters on Queries",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs query and tenant context analysis."
    },
    {
      "id": "a01_multi_tenant_boundary_testing_tenant_id_not_accepted_from_request_body",
      "title": "OWASP A01:2021 (Broken Access Control): Multi-tenant Boundary Testing - Tenant_id not Accepted from Request Body",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A01",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires data-flow validation."
    },
    {
      "id": "a02_weak_tls_protocols_sslv2_sslv3_tls_1_0_1_1",
      "title": "OWASP A02:2021 (Cryptographic Failures): Weak TLS Protocols (SSLv2, SSLv3, TLS 1.0/1.1)",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A02",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires server TLS config inspection, not regex patterns."
    },
    {
      "id": "a02_weak_tls_protocols_min_tls_version_set_to_1_2_in_server_config",
      "title": "OWASP A02:2021 (Cryptographic Failures): Weak TLS Protocols - Min TLS Version Set to 1.2+ in Server Config",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A02",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs config parsing."
    },
    {
      "id": "a02_weak_tls_protocols_legacy_protocol_flags_disabled_nginx_apache_app",
      "title": "OWASP A02:2021 (Cryptographic Failures): Weak TLS Protocols - Legacy Protocol Flags Disabled (nginx/Apache/app)",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A02",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires config parsing."
    },
    {
      "id": "a02_weak_cipher_suites",
      "title": "OWASP A02:2021 (Cryptographic Failures): Weak Cipher Suites",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A02",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires cipher suite allowlist in config."
    },
    {
      "id": "a02_weak_cipher_suites_disallow_rc4_3des_null_ciphers",
      "title": "OWASP A02:2021 (Cryptographic Failures): Weak Cipher Suites - Disallow RC4/3DES/NULL Ciphers",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A02",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs TLS config inspection."
    },
    {
      "id": "a02_weak_cipher_suites_enforce_strong_cipher_ordering",
      "title": "OWASP A02:2021 (Cryptographic Failures): Weak Cipher Suites - Enforce Strong Cipher Ordering",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A02",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires config parsing."
    },
    {
      "id": "a02_missing_hsts",
      "title": "OWASP A02:2021 (Cryptographic Failures): Missing HSTS",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A02",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires response header configuration."
    },
    {
      "id": "a02_missing_hsts_strict_transport_security_header_set",
      "title": "OWASP A02:2021 (Cryptographic Failures): Missing HSTS - Strict-Transport-Security Header Set",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A02",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs header config analysis."
    },
    {
      "id": "a02_missing_hsts_hsts_max_age_and_includesubdomains_configured",
      "title": "OWASP A02:2021 (Cryptographic Failures): Missing HSTS - HSTS Max-age and IncludeSubDomains Configured",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A02",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs header config analysis."
    },
    {
      "id": "a02_mixed_content",
      "title": "OWASP A02:2021 (Cryptographic Failures): Mixed Content",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A02",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires HTML/template asset inspection."
    },
    {
      "id": "a02_mixed_content_http_asset_references_in_templates",
      "title": "OWASP A02:2021 (Cryptographic Failures): Mixed Content - http:// Asset References in Templates",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A02",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs static asset scan."
    },
    {
      "id": "a02_mixed_content_ws_or_insecure_mixed_protocols_in_frontend",
      "title": "OWASP A02:2021 (Cryptographic Failures): Mixed Content - Ws:// or Insecure Mixed Protocols in Frontend",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A02",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires frontend scan."
    },
    {
      "id": "a02_sensitive_data_over_http",
      "title": "OWASP A02:2021 (Cryptographic Failures): Sensitive Data Over HTTP",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A02",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires URL usage and deployment context."
    },
    {
      "id": "a02_sensitive_data_over_http_hardcoded_http_api_endpoints",
      "title": "OWASP A02:2021 (Cryptographic Failures): Sensitive Data Over HTTP - Hardcoded http:// API Endpoints",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A02",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs code/config scan."
    },
    {
      "id": "a02_sensitive_data_over_http_http_used_for_auth_token_exchange",
      "title": "OWASP A02:2021 (Cryptographic Failures): Sensitive Data Over HTTP - HTTP Used for Auth/token Exchange",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A02",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires protocol usage analysis."
    },
    {
      "id": "a02_weak_cookie_attributes",
      "title": "OWASP A02:2021 (Cryptographic Failures): Weak Cookie Attributes",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A02",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires Set-Cookie inspection."
    },
    {
      "id": "a02_weak_cookie_attributes_missing_secure_httponly_samesite",
      "title": "OWASP A02:2021 (Cryptographic Failures): Weak Cookie Attributes - Missing Secure/HttpOnly/SameSite",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A02",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs response/header config."
    },
    {
      "id": "a02_weak_cookie_attributes_session_cookies_without_secure_flag",
      "title": "OWASP A02:2021 (Cryptographic Failures): Weak Cookie Attributes - Session Cookies Without Secure Flag",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A02",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs cookie config analysis."
    },
    {
      "id": "a02_improper_key_lengths",
      "title": "OWASP A02:2021 (Cryptographic Failures): Improper Key Lengths",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A02",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires crypto key size inspection."
    },
    {
      "id": "a02_improper_key_lengths_rsa_2048_or_ec_256_keys",
      "title": "OWASP A02:2021 (Cryptographic Failures): Improper Key Lengths - RSA <2048 or EC <256 Keys",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A02",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs crypto config/usage analysis."
    },
    {
      "id": "a02_improper_key_lengths_weak_pbkdf_iterations_or_salt_sizes",
      "title": "OWASP A02:2021 (Cryptographic Failures): Improper Key Lengths - Weak PBKDF Iterations or Salt Sizes",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A02",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs crypto parameter analysis."
    },
    {
      "id": "a03_sql_injection",
      "title": "OWASP A03:2021 (Injection): SQL Injection",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "partial",
      "notes": "Regex detects some SQL string formatting/concatenation patterns only."
    },
    {
      "id": "a03_sql_injection_sql_string_formatting_format_f_string",
      "title": "OWASP A03:2021 (Injection): SQL Injection - SQL String Formatting (format/f-string)",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Covered by regex for SQL string formatting."
    },
    {
      "id": "a03_sql_injection_sql_concatenation_in_execute",
      "title": "OWASP A03:2021 (Injection): SQL Injection - SQL Concatenation in Execute()",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Covered by regex for SQL concatenation."
    },
    {
      "id": "a03_sql_injection_orm_raw_queries_with_untrusted_input",
      "title": "OWASP A03:2021 (Injection): SQL Injection - ORM Raw Queries with Untrusted Input",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires data-flow analysis into ORM raw APIs."
    },
    {
      "id": "a03_nosql_injection",
      "title": "OWASP A03:2021 (Injection): NoSQL Injection",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires query object analysis not in regex."
    },
    {
      "id": "a03_nosql_injection_mongodb_query_object_built_from_request_body",
      "title": "OWASP A03:2021 (Injection): NoSQL Injection - MongoDB Query Object Built from Request Body",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs data-flow and schema validation."
    },
    {
      "id": "a03_nosql_injection_use_of_where_with_user_input",
      "title": "OWASP A03:2021 (Injection): NoSQL Injection - Use of $where with User Input",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires AST/data-flow analysis."
    },
    {
      "id": "a03_command_injection",
      "title": "OWASP A03:2021 (Injection): Command Injection",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Doc",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Detect shell command execution with user input across all languages.",
      "patterns": [
        "child_process.exec(",
        "child_process.execSync(",
        "require('child_process')",
        "exec(`",
        "execSync(`",
        "spawn(",
        "spawnSync(",
        "os.system(",
        "os.popen(",
        "subprocess.Popen(",
        "subprocess.call(",
        "subprocess.run(",
        "shell=True",
        "Runtime.getRuntime().exec("
      ],
      "examples": {
        "vulnerable_js": "const { exec } = require('child_process'); exec(`convert ${req.query.format} output.pdf`);",
        "vulnerable_py": "os.system(f'convert {request.args[\"format\"]} output.pdf')",
        "safe_js": "const { execFile } = require('child_process'); execFile('convert', [allowedFormat, 'output.pdf']);"
      }
    },
    {
      "id": "a03_command_injection_subprocess_with_shell_true",
      "title": "OWASP A03:2021 (Injection): Command Injection - Subprocess with Shell=True",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Covered by regex for shell=True."
    },
    {
      "id": "a03_command_injection_os_system_os_popen_with_variable",
      "title": "OWASP A03:2021 (Injection): Command Injection - Os.system/os.popen with Variable",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Covered by regex for os.system/os.popen."
    },
    {
      "id": "a03_command_injection_command_constructed_from_user_input",
      "title": "OWASP A03:2021 (Injection): Command Injection - Command Constructed from User Input",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires taint tracking, not regex."
    },
    {
      "id": "a03_server_side_template_injection_ssti",
      "title": "OWASP A03:2021 (Injection): Server Side Template Injection (SSTI)",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires template engine usage analysis."
    },
    {
      "id": "a03_ssti_render_called_with_user_controlled_template_string",
      "title": "OWASP A03:2021 (Injection): SSTI - Render() Called with User-controlled Template String",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs data-flow into template APIs."
    },
    {
      "id": "a03_ssti_eval_like_template_features_enabled_with_untrusted_input",
      "title": "OWASP A03:2021 (Injection): SSTI - Eval-like Template Features Enabled with Untrusted Input",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires framework-specific analysis."
    },
    {
      "id": "a03_ldap_injection",
      "title": "OWASP A03:2021 (Injection): LDAP Injection",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires LDAP filter construction analysis."
    },
    {
      "id": "a03_ldap_injection_ldap_filter_string_concatenation",
      "title": "OWASP A03:2021 (Injection): LDAP Injection - LDAP Filter String Concatenation",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs AST/data-flow."
    },
    {
      "id": "a03_ldap_injection_unescaped_input_in_directory_search_filters",
      "title": "OWASP A03:2021 (Injection): LDAP Injection - Unescaped Input in Directory Search Filters",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires input handling analysis."
    },
    {
      "id": "a03_html_injection",
      "title": "OWASP A03:2021 (Injection): HTML Injection",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "partial",
      "notes": "Regex detects some DOM sinks only."
    },
    {
      "id": "a03_html_injection_innerhtml_assigned_from_variable",
      "title": "OWASP A03:2021 (Injection): HTML Injection - InnerHTML Assigned from Variable",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Covered by regex for innerHTML with variable."
    },
    {
      "id": "a03_html_injection_dangerouslysetinnerhtml_usage",
      "title": "OWASP A03:2021 (Injection): HTML Injection - DangerouslySetInnerHTML Usage",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Detect ALL uses of dangerouslySetInnerHTML in React/JSX, especially when rendering user-controlled data like product names, descriptions, comments, or any DB-sourced field.",
      "patterns": [
        "dangerouslySetInnerHTML",
        "__html:"
      ],
      "examples": {
        "vulnerable": "<div dangerouslySetInnerHTML={{__html: product.name}} />",
        "safe": "<div>{DOMPurify.sanitize(product.name)}</div>"
      }
    },
    {
      "id": "a03_html_injection_document_write_with_variable",
      "title": "OWASP A03:2021 (Injection): HTML Injection - Document.write with Variable",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Covered by regex for document.write with variable."
    },
    {
      "id": "a03_stored_reflected_dom_xss",
      "title": "OWASP A03:2021 (Injection): Stored/Reflected/DOM XSS",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "partial",
      "notes": "Regex only covers some DOM sinks."
    },
    {
      "id": "a03_xss_dom_sinks_innerhtml_document_write",
      "title": "OWASP A03:2021 (Injection): XSS - DOM Sinks (innerHTML/document.write)",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Covered by regex for DOM sinks."
    },
    {
      "id": "a03_xss_reflected_output_without_escaping",
      "title": "OWASP A03:2021 (Injection): XSS - Reflected Output Without Escaping",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires template/context-aware escaping analysis."
    },
    {
      "id": "a03_xss_stored_content_rendered_without_sanitization",
      "title": "OWASP A03:2021 (Injection): XSS - Stored Content Rendered Without Sanitization",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires data-flow from storage to render."
    },
    {
      "id": "a03_injection_on_headers",
      "title": "OWASP A03:2021 (Injection): Injection on Headers",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires header construction analysis."
    },
    {
      "id": "a03_injection_on_headers_response_headers_built_from_user_input",
      "title": "OWASP A03:2021 (Injection): Injection on Headers - Response Headers Built from User Input",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs data-flow analysis into headers."
    },
    {
      "id": "a03_injection_on_headers_request_headers_injected_into_downstream_calls",
      "title": "OWASP A03:2021 (Injection): Injection on Headers - Request Headers Injected Into Downstream Calls",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A03",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires request/response flow analysis."
    },
    {
      "id": "a04_missing_rate_limits",
      "title": "OWASP A04:2021 (Insecure Design): Missing Rate Limits",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A04",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires middleware/config analysis."
    },
    {
      "id": "a04_missing_rate_limits_no_rate_limiter_on_auth_endpoints",
      "title": "OWASP A04:2021 (Insecure Design): Missing Rate Limits - No Rate Limiter on Auth Endpoints",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A04",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs route/middleware mapping."
    },
    {
      "id": "a04_missing_rate_limits_no_per_ip_or_per_user_throttling_config",
      "title": "OWASP A04:2021 (Insecure Design): Missing Rate Limits - No Per-IP or Per-user Throttling Config",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A04",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires config inspection."
    },
    {
      "id": "a04_absent_account_lockout",
      "title": "OWASP A04:2021 (Insecure Design): Absent Account Lockout",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A04",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires auth flow and policy checks."
    },
    {
      "id": "a04_absent_account_lockout_login_attempts_not_tracked",
      "title": "OWASP A04:2021 (Insecure Design): Absent Account Lockout - Login Attempts not Tracked",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A04",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs state/DB usage analysis."
    },
    {
      "id": "a04_absent_account_lockout_no_exponential_backoff_or_lockout_policy",
      "title": "OWASP A04:2021 (Insecure Design): Absent Account Lockout - No Exponential Backoff or Lockout Policy",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A04",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires policy/config inspection."
    },
    {
      "id": "a04_weak_session_lifecycle",
      "title": "OWASP A04:2021 (Insecure Design): Weak Session Lifecycle",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A04",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires session management analysis."
    },
    {
      "id": "a04_weak_session_lifecycle_session_not_rotated_on_login_privilege_change",
      "title": "OWASP A04:2021 (Insecure Design): Weak Session Lifecycle - Session not Rotated on Login/privilege Change",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A04",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs auth/session flow analysis."
    },
    {
      "id": "a04_weak_session_lifecycle_session_ttl_not_enforced",
      "title": "OWASP A04:2021 (Insecure Design): Weak Session Lifecycle - Session TTL not Enforced",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A04",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires config/flow inspection."
    },
    {
      "id": "a04_password_reset_flow_flaws",
      "title": "OWASP A04:2021 (Insecure Design): Password Reset Flow Flaws",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A04",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires flow-specific logic checks."
    },
    {
      "id": "a04_password_reset_flow_flaws_reset_tokens_not_single_use",
      "title": "OWASP A04:2021 (Insecure Design): Password Reset Flow Flaws - Reset Tokens not Single-use",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A04",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires token lifecycle analysis."
    },
    {
      "id": "a04_password_reset_flow_flaws_reset_token_lacks_expiry_binding",
      "title": "OWASP A04:2021 (Insecure Design): Password Reset Flow Flaws - Reset Token Lacks Expiry/binding",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A04",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs token validation analysis."
    },
    {
      "id": "a04_no_defense_in_depth_mechanisms",
      "title": "OWASP A04:2021 (Insecure Design): No Defense-in-depth Mechanisms",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A04",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Architectural requirement beyond regex scanning."
    },
    {
      "id": "a04_no_defense_in_depth_critical_actions_lack_secondary_checks",
      "title": "OWASP A04:2021 (Insecure Design): No Defense-in-depth - Critical Actions Lack Secondary Checks",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A04",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires business logic analysis."
    },
    {
      "id": "a04_no_defense_in_depth_no_monitoring_on_privileged_actions",
      "title": "OWASP A04:2021 (Insecure Design): No Defense-in-depth - No Monitoring on Privileged Actions",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A04",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires operational design review."
    },
    {
      "id": "a05_directory_listing",
      "title": "OWASP A05:2021 (Security Misconfiguration): Directory Listing",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A05",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires server/static file config inspection."
    },
    {
      "id": "a05_directory_listing_web_server_autoindex_enabled",
      "title": "OWASP A05:2021 (Security Misconfiguration): Directory Listing - Web Server Autoindex Enabled",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A05",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs config parsing."
    },
    {
      "id": "a05_directory_listing_static_root_exposes_sensitive_dirs",
      "title": "OWASP A05:2021 (Security Misconfiguration): Directory Listing - Static Root Exposes Sensitive Dirs",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A05",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires path/config analysis."
    },
    {
      "id": "a05_unpatched_application_servers",
      "title": "OWASP A05:2021 (Security Misconfiguration): Unpatched Application Servers",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A05",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires version inventory + CVE data."
    },
    {
      "id": "a05_unpatched_servers_outdated_runtime_framework_versions_in_config",
      "title": "OWASP A05:2021 (Security Misconfiguration): Unpatched Servers - Outdated Runtime/framework Versions in Config",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A05",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs manifest/config parsing."
    },
    {
      "id": "a05_unpatched_servers_vulnerable_base_images_in_containers",
      "title": "OWASP A05:2021 (Security Misconfiguration): Unpatched Servers - Vulnerable Base Images in Containers",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A05",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires image metadata/CVE data."
    },
    {
      "id": "a05_debug_mode_enabled",
      "title": "OWASP A05:2021 (Security Misconfiguration): Debug Mode Enabled",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A05",
      "source": "Doc",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Regex detects DEBUG=True in code."
    },
    {
      "id": "a05_debug_mode_enabled_framework_debug_flags_in_config_files",
      "title": "OWASP A05:2021 (Security Misconfiguration): Debug Mode Enabled - Framework Debug Flags in Config Files",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A05",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires config parsing beyond regex."
    },
    {
      "id": "a05_debug_mode_enabled_verbose_stack_traces_enabled",
      "title": "OWASP A05:2021 (Security Misconfiguration): Debug Mode Enabled - Verbose Stack Traces Enabled",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A05",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs framework-specific settings analysis."
    },
    {
      "id": "a05_verbose_error_messages",
      "title": "OWASP A05:2021 (Security Misconfiguration): Verbose Error Messages",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A05",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires error handler analysis."
    },
    {
      "id": "a05_verbose_error_messages_stack_traces_returned_to_clients",
      "title": "OWASP A05:2021 (Security Misconfiguration): Verbose Error Messages - Stack Traces Returned to Clients",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A05",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs error handling analysis."
    },
    {
      "id": "a05_verbose_error_messages_exception_details_logged_to_client_responses",
      "title": "OWASP A05:2021 (Security Misconfiguration): Verbose Error Messages - Exception Details Logged to Client Responses",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A05",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires response construction analysis."
    },
    {
      "id": "a05_missing_security_headers",
      "title": "OWASP A05:2021 (Security Misconfiguration): Missing Security Headers",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A05",
      "source": "Doc",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Detect missing or weak security headers in config files. Check next.config.js/mjs, express helmet(), nginx configs.",
      "patterns": [
        "X-Powered-By",
        "poweredByHeader",
        "Content-Security-Policy",
        "script-src",
        "unsafe-inline",
        "unsafe-eval",
        "X-Frame-Options",
        "Strict-Transport-Security"
      ],
      "examples": {
        "vulnerable_nextjs": "const config = { poweredByHeader: true }; // or not setting it (defaults to true)",
        "vulnerable_csp": "Content-Security-Policy: script-src * 'unsafe-inline' 'unsafe-eval'",
        "safe_nextjs": "const config = { poweredByHeader: false, headers() { return [{ source: '/(.*)', headers: [{ key: 'X-Frame-Options', value: 'DENY' }] }]; } };"
      }
    },
    {
      "id": "a05_missing_security_headers_no_csp_hsts_x_frame_options",
      "title": "OWASP A05:2021 (Security Misconfiguration): Missing Security Headers - No CSP/HSTS/X-Frame-Options",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A05",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Detect weak CSP policies (script-src *, unsafe-inline, unsafe-eval), missing HSTS, missing X-Frame-Options in config files."
    },
    {
      "id": "a05_missing_security_headers_no_x_content_type_options_referrer_policy",
      "title": "OWASP A05:2021 (Security Misconfiguration): Missing Security Headers - No X-Content-Type-Options/Referrer-Policy",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A05",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires header config inspection."
    },
    {
      "id": "a05_unsafe_http_methods_trace_options_put_delete",
      "title": "OWASP A05:2021 (Security Misconfiguration): Unsafe HTTP Methods (TRACE, OPTIONS, PUT, DELETE)",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A05",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires server/router method config inspection."
    },
    {
      "id": "a05_unsafe_http_methods_trace_put_delete_enabled_without_auth",
      "title": "OWASP A05:2021 (Security Misconfiguration): Unsafe HTTP Methods - TRACE/PUT/DELETE Enabled Without Auth",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A05",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs routing analysis."
    },
    {
      "id": "a05_unsafe_http_methods_options_reveals_sensitive_routes",
      "title": "OWASP A05:2021 (Security Misconfiguration): Unsafe HTTP Methods - OPTIONS Reveals Sensitive Routes",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A05",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires runtime or config checks."
    },
    {
      "id": "a05_cors_misconfiguration",
      "title": "OWASP A05:2021 (Security Misconfiguration): CORS Misconfiguration",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A05",
      "source": "Doc",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Detect CORS misconfigurations in config files (next.config.js/mjs, express cors(), etc.).",
      "patterns": [
        "Access-Control-Allow-Origin",
        "origin: '*'",
        "origin: true",
        "allowedOrigins: ['*']",
        "cors({",
        "Access-Control-Allow-Credentials"
      ],
      "examples": {
        "vulnerable": "headers: [{ key: 'Access-Control-Allow-Origin', value: '*' }, { key: 'Access-Control-Allow-Credentials', value: 'true' }]",
        "safe": "headers: [{ key: 'Access-Control-Allow-Origin', value: 'https://myapp.com' }]"
      }
    },
    {
      "id": "a05_cors_misconfiguration_wildcard_origin_with_credentials",
      "title": "OWASP A05:2021 (Security Misconfiguration): CORS Misconfiguration - Wildcard Origin with Credentials",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A05",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Detect Access-Control-Allow-Origin: * combined with Access-Control-Allow-Credentials: true."
    },
    {
      "id": "a05_cors_misconfiguration_origin_reflection_without_allowlist",
      "title": "OWASP A05:2021 (Security Misconfiguration): CORS Misconfiguration - Origin Reflection Without Allowlist",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A05",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires config/runtime analysis."
    },
    {
      "id": "a06_js_library_fingerprinting",
      "title": "OWASP A06:2021 (Vulnerable and Outdated Components): JS Library Fingerprinting",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A06",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires dependency/bundle inspection."
    },
    {
      "id": "a06_js_library_fingerprinting_parse_package_json_lockfiles_for_versions",
      "title": "OWASP A06:2021 (Vulnerable and Outdated Components): JS Library Fingerprinting - Parse Package.json/lockfiles for Versions",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A06",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs manifest parsing."
    },
    {
      "id": "a06_js_library_fingerprinting_detect_versions_from_bundle_comments",
      "title": "OWASP A06:2021 (Vulnerable and Outdated Components): JS Library Fingerprinting - Detect Versions from Bundle Comments",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A06",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs bundle analysis."
    },
    {
      "id": "a06_package_version_detection",
      "title": "OWASP A06:2021 (Vulnerable and Outdated Components): Package Version Detection",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A06",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires manifest/lockfile parsing."
    },
    {
      "id": "a06_package_version_detection_parse_requirements_txt_go_mod_package_json",
      "title": "OWASP A06:2021 (Vulnerable and Outdated Components): Package Version Detection - Parse Requirements.txt/go.mod/package.json",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A06",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs file parsing beyond current scanner."
    },
    {
      "id": "a06_package_version_detection_parse_lockfiles_for_exact_versions",
      "title": "OWASP A06:2021 (Vulnerable and Outdated Components): Package Version Detection - Parse Lockfiles for Exact Versions",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A06",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs lockfile parsing."
    },
    {
      "id": "a06_cve_matching",
      "title": "OWASP A06:2021 (Vulnerable and Outdated Components): CVE Matching",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A06",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires external vulnerability database."
    },
    {
      "id": "a06_cve_matching_match_dependencies_to_cve_feeds",
      "title": "OWASP A06:2021 (Vulnerable and Outdated Components): CVE Matching - Match Dependencies to CVE Feeds",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A06",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs CVE data."
    },
    {
      "id": "a06_cve_matching_include_transitive_dependencies",
      "title": "OWASP A06:2021 (Vulnerable and Outdated Components): CVE Matching - Include Transitive Dependencies",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A06",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires SBOM and CVE DB."
    },
    {
      "id": "a06_known_vulnerable_dependencies",
      "title": "OWASP A06:2021 (Vulnerable and Outdated Components): Known Vulnerable Dependencies",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A06",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires denylist or CVE data."
    },
    {
      "id": "a06_known_vulnerable_dependencies_enforce_denylist_for_risky_packages",
      "title": "OWASP A06:2021 (Vulnerable and Outdated Components): Known Vulnerable Dependencies - Enforce Denylist for Risky Packages",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A06",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs policy + manifest parsing."
    },
    {
      "id": "a06_known_vulnerable_dependencies_flag_deprecated_out_of_support_libs",
      "title": "OWASP A06:2021 (Vulnerable and Outdated Components): Known Vulnerable Dependencies - Flag Deprecated/out-of-support Libs",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A06",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires version metadata."
    },
    {
      "id": "a06_sbom_based_vulnerability_mapping",
      "title": "OWASP A06:2021 (Vulnerable and Outdated Components): SBOM-based Vulnerability Mapping",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A06",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires SBOM generation + CVE matching."
    },
    {
      "id": "a06_sbom_mapping_generate_sbom_from_manifests",
      "title": "OWASP A06:2021 (Vulnerable and Outdated Components): SBOM Mapping - Generate SBOM from Manifests",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A06",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs SBOM tooling."
    },
    {
      "id": "a06_sbom_mapping_map_sbom_components_to_cve_feed",
      "title": "OWASP A06:2021 (Vulnerable and Outdated Components): SBOM Mapping - Map SBOM Components to CVE Feed",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A06",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires external CVE data."
    },
    {
      "id": "a07_brute_force_susceptibility",
      "title": "OWASP A07:2021 (Identification and Authentication Failures): Brute-force Susceptibility",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A07",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires auth flow and rate-limiting analysis."
    },
    {
      "id": "a07_brute_force_susceptibility_no_rate_limiting_on_login_endpoints",
      "title": "OWASP A07:2021 (Identification and Authentication Failures): Brute-force Susceptibility - No Rate Limiting on Login Endpoints",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A07",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs middleware/config analysis."
    },
    {
      "id": "a07_brute_force_susceptibility_no_lockout_backoff_policy",
      "title": "OWASP A07:2021 (Identification and Authentication Failures): Brute-force Susceptibility - No Lockout/backoff Policy",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A07",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires auth policy analysis."
    },
    {
      "id": "a07_session_fixation",
      "title": "OWASP A07:2021 (Identification and Authentication Failures): Session Fixation",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A07",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires session lifecycle analysis."
    },
    {
      "id": "a07_session_fixation_session_id_not_regenerated_on_login",
      "title": "OWASP A07:2021 (Identification and Authentication Failures): Session Fixation - Session ID not Regenerated on Login",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A07",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs session handling analysis."
    },
    {
      "id": "a07_session_fixation_session_id_accepted_from_url_params",
      "title": "OWASP A07:2021 (Identification and Authentication Failures): Session Fixation - Session ID Accepted from URL Params",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A07",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires request parsing analysis."
    },
    {
      "id": "a07_session_id_predictability",
      "title": "OWASP A07:2021 (Identification and Authentication Failures): Session ID Predictability",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A07",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires RNG/ID generation analysis."
    },
    {
      "id": "a07_session_id_predictability_non_cryptographic_rng_for_session_ids",
      "title": "OWASP A07:2021 (Identification and Authentication Failures): Session ID Predictability - Non-cryptographic RNG for Session IDs",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A07",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs code inspection."
    },
    {
      "id": "a07_session_id_predictability_sequential_or_timestamp_based_ids",
      "title": "OWASP A07:2021 (Identification and Authentication Failures): Session ID Predictability - Sequential or Timestamp-based IDs",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A07",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires ID generation analysis."
    },
    {
      "id": "a07_no_mfa",
      "title": "OWASP A07:2021 (Identification and Authentication Failures): No MFA",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A07",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires auth flow analysis."
    },
    {
      "id": "a07_no_mfa_mfa_step_missing_for_privileged_actions",
      "title": "OWASP A07:2021 (Identification and Authentication Failures): No MFA - MFA Step Missing for Privileged Actions",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A07",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs auth flow inspection."
    },
    {
      "id": "a07_no_mfa_mfa_flag_ignored_in_auth_pipeline",
      "title": "OWASP A07:2021 (Identification and Authentication Failures): No MFA - MFA Flag Ignored in Auth Pipeline",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A07",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires logic analysis."
    },
    {
      "id": "a07_weak_password_policy",
      "title": "OWASP A07:2021 (Identification and Authentication Failures): Weak Password Policy",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A07",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires policy/config analysis."
    },
    {
      "id": "a07_weak_password_policy_minimum_length_too_low",
      "title": "OWASP A07:2021 (Identification and Authentication Failures): Weak Password Policy - Minimum Length Too Low",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A07",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs policy inspection."
    },
    {
      "id": "a07_weak_password_policy_no_complexity_blacklist_checks",
      "title": "OWASP A07:2021 (Identification and Authentication Failures): Weak Password Policy - No Complexity/blacklist Checks",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A07",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires validation logic analysis."
    },
    {
      "id": "a07_insecure_remember_me_tokens",
      "title": "OWASP A07:2021 (Identification and Authentication Failures): Insecure Remember-me Tokens",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A07",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires token lifecycle analysis."
    },
    {
      "id": "a07_insecure_remember_me_tokens_long_lived_tokens_without_rotation",
      "title": "OWASP A07:2021 (Identification and Authentication Failures): Insecure Remember-me Tokens - Long-lived Tokens Without Rotation",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A07",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs token handling analysis."
    },
    {
      "id": "a07_insecure_remember_me_tokens_tokens_stored_or_logged_in_plaintext",
      "title": "OWASP A07:2021 (Identification and Authentication Failures): Insecure Remember-me Tokens - Tokens Stored or Logged in Plaintext",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A07",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires storage/logging analysis."
    },
    {
      "id": "a08_unsafe_deserialization",
      "title": "OWASP A08:2021 (Software and Data Integrity Failures): Unsafe Deserialization",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A08",
      "source": "Doc",
      "static_feasible": "yes",
      "current_support": "partial",
      "notes": "Regex covers some deserialization patterns only."
    },
    {
      "id": "a08_unsafe_deserialization_pickle_loads_usage",
      "title": "OWASP A08:2021 (Software and Data Integrity Failures): Unsafe Deserialization - Pickle.loads Usage",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A08",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Covered by regex for pickle."
    },
    {
      "id": "a08_unsafe_deserialization_yaml_load_unsafe_load_usage",
      "title": "OWASP A08:2021 (Software and Data Integrity Failures): Unsafe Deserialization - Yaml.load/unsafe_load Usage",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A08",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Covered by regex for unsafe YAML load."
    },
    {
      "id": "a08_unsafe_deserialization_marshal_loads_or_php_unserialize",
      "title": "OWASP A08:2021 (Software and Data Integrity Failures): Unsafe Deserialization - Marshal.loads or PHP Unserialize",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A08",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Covered by regex for marshal/unserialize."
    },
    {
      "id": "a08_unverified_dependencies",
      "title": "OWASP A08:2021 (Software and Data Integrity Failures): Unverified Dependencies",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A08",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires package signature/lockfile verification."
    },
    {
      "id": "a08_unverified_dependencies_no_checksum_verification_in_lockfiles",
      "title": "OWASP A08:2021 (Software and Data Integrity Failures): Unverified Dependencies - No Checksum Verification in Lockfiles",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A08",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs manifest/lockfile analysis."
    },
    {
      "id": "a08_unverified_dependencies_unsigned_artifacts_allowed_in_ci",
      "title": "OWASP A08:2021 (Software and Data Integrity Failures): Unverified Dependencies - Unsigned Artifacts Allowed in CI",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A08",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires pipeline config analysis."
    },
    {
      "id": "a08_integrity_of_delivered_js",
      "title": "OWASP A08:2021 (Software and Data Integrity Failures): Integrity of Delivered JS",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A08",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires frontend build/CDN analysis."
    },
    {
      "id": "a08_integrity_of_delivered_js_missing_sri_for_cdn_scripts",
      "title": "OWASP A08:2021 (Software and Data Integrity Failures): Integrity of Delivered JS - Missing SRI for CDN Scripts",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A08",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs HTML/template scan."
    },
    {
      "id": "a08_integrity_of_delivered_js_no_integrity_hash_checks_in_pipeline",
      "title": "OWASP A08:2021 (Software and Data Integrity Failures): Integrity of Delivered JS - No Integrity Hash Checks in Pipeline",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A08",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires build config analysis."
    },
    {
      "id": "a08_supply_chain_vulnerability_analysis",
      "title": "OWASP A08:2021 (Software and Data Integrity Failures): Supply Chain Vulnerability Analysis",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A08",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires dependency provenance/vuln data."
    },
    {
      "id": "a08_supply_chain_analysis_typosquatting_package_detection",
      "title": "OWASP A08:2021 (Software and Data Integrity Failures): Supply Chain Analysis - Typosquatting Package Detection",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A08",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs package metadata."
    },
    {
      "id": "a08_supply_chain_analysis_verify_publisher_signatures",
      "title": "OWASP A08:2021 (Software and Data Integrity Failures): Supply Chain Analysis - Verify Publisher Signatures",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A08",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires registry signature data."
    },
    {
      "id": "a09_missing_audit_logs",
      "title": "OWASP A09:2021 (Security Logging and Monitoring Failures): Missing Audit Logs",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A09",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires logging coverage analysis."
    },
    {
      "id": "a09_missing_audit_logs_auth_and_admin_actions_not_logged",
      "title": "OWASP A09:2021 (Security Logging and Monitoring Failures): Missing Audit Logs - Auth and Admin Actions not Logged",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A09",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs endpoint-to-logging mapping."
    },
    {
      "id": "a09_missing_audit_logs_critical_data_changes_not_logged",
      "title": "OWASP A09:2021 (Security Logging and Monitoring Failures): Missing Audit Logs - Critical Data Changes not Logged",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A09",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires data flow + logging review."
    },
    {
      "id": "a09_sensitive_data_in_logs",
      "title": "OWASP A09:2021 (Security Logging and Monitoring Failures): Sensitive Data in Logs",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A09",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires log content analysis."
    },
    {
      "id": "a09_sensitive_data_in_logs_logging_passwords_tokens",
      "title": "OWASP A09:2021 (Security Logging and Monitoring Failures): Sensitive Data in Logs - Logging Passwords/tokens",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A09",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs log statement analysis."
    },
    {
      "id": "a09_sensitive_data_in_logs_logging_full_request_bodies",
      "title": "OWASP A09:2021 (Security Logging and Monitoring Failures): Sensitive Data in Logs - Logging Full Request Bodies",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A09",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires log usage analysis."
    },
    {
      "id": "a10_url_fetch_endpoints",
      "title": "OWASP A10:2021 (Server-Side Request Forgery (SSRF)): URL-fetch Endpoints",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A10",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "partial",
      "notes": "Regex detects some dynamic URL usage only."
    },
    {
      "id": "a10_url_fetch_endpoints_dynamic_url_in_requests_get_post",
      "title": "OWASP A10:2021 (Server-Side Request Forgery (SSRF)): URL-fetch Endpoints - Dynamic URL in Requests.get/post",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A10",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Covered by regex for dynamic URL in requests."
    },
    {
      "id": "a10_url_fetch_endpoints_dynamic_url_in_urlopen",
      "title": "OWASP A10:2021 (Server-Side Request Forgery (SSRF)): URL-fetch Endpoints - Dynamic URL in Urlopen",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A10",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Covered by regex for urlopen dynamic URL."
    },
    {
      "id": "a10_url_fetch_endpoints_dynamic_url_in_js_fetch_axios",
      "title": "OWASP A10:2021 (Server-Side Request Forgery (SSRF)): URL-fetch Endpoints - Dynamic URL in JS Fetch/axios/got/http",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A10",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Detect server-side fetch(), axios(), got(), http.get() with user-controlled URLs in Node.js/JS.",
      "patterns": [
        "fetch(req.",
        "fetch(url",
        "fetch(sourceUrl",
        "axios.get(req.",
        "axios.get(url",
        "axios(url",
        "got(req.",
        "got(url",
        "http.get(req.",
        "http.get(url"
      ],
      "examples": {
        "vulnerable": "const sourceUrl = req.body.sourceUrl; const response = await fetch(sourceUrl);",
        "safe": "const sourceUrl = req.body.sourceUrl; if (!isAllowedUrl(sourceUrl)) return res.status(400).json({error: 'blocked'}); const response = await fetch(sourceUrl);"
      }
    },
    {
      "id": "a10_unsafe_webhooks",
      "title": "OWASP A10:2021 (Server-Side Request Forgery (SSRF)): Unsafe Webhooks",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A10",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires webhook target validation logic."
    },
    {
      "id": "a10_unsafe_webhooks_webhook_url_not_allowlisted",
      "title": "OWASP A10:2021 (Server-Side Request Forgery (SSRF)): Unsafe Webhooks - Webhook URL not Allowlisted",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A10",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs validation logic analysis."
    },
    {
      "id": "a10_unsafe_webhooks_missing_signature_verification",
      "title": "OWASP A10:2021 (Server-Side Request Forgery (SSRF)): Unsafe Webhooks - Missing Signature Verification",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A10",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires webhook auth checks."
    },
    {
      "id": "a10_internal_ip_probing_no_internal_ip_range_blocking",
      "title": "OWASP A10:2021 (Server-Side Request Forgery (SSRF)): Internal IP Probing - No Internal IP Range Blocking",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A10",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs URL validation logic."
    },
    {
      "id": "a10_internal_ip_probing_no_dns_ip_resolution_checks",
      "title": "OWASP A10:2021 (Server-Side Request Forgery (SSRF)): Internal IP Probing - No DNS/IP Resolution Checks",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A10",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires URL validation logic."
    },
    {
      "id": "a10_dns_rebinding_tests_no_dns_pinning_or_re_resolve_checks",
      "title": "OWASP A10:2021 (Server-Side Request Forgery (SSRF)): DNS Rebinding Tests - No DNS Pinning or Re-resolve Checks",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A10",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires URL validation logic."
    },
    {
      "id": "a10_dns_rebinding_tests_no_protection_against_hostname_to_ip_changes",
      "title": "OWASP A10:2021 (Server-Side Request Forgery (SSRF)): DNS Rebinding Tests - No Protection Against Hostname to IP Changes",
      "section": "OWASP Top 10 (A01-A10)",
      "owasp_category": "A10",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires runtime safeguards."
    },
    {
      "id": "api1_broken_object_level_authorization_bola",
      "title": "OWASP API1:2023 (Broken Object Level Authorization): Broken Object Level Authorization (BOLA)",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires object ownership and authz checks in handlers."
    },
    {
      "id": "api1_bola_object_id_in_path_used_without_ownership_check",
      "title": "OWASP API1:2023 (Broken Object Level Authorization): BOLA - Object ID in Path Used Without Ownership Check",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs data-flow + authz analysis."
    },
    {
      "id": "api1_bola_missing_tenant_filter_in_api_queries",
      "title": "OWASP API1:2023 (Broken Object Level Authorization): BOLA - Missing Tenant Filter in API Queries",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires query/context analysis."
    },
    {
      "id": "api2_broken_authentication",
      "title": "OWASP API2:2023 (Broken Authentication): Broken Authentication",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires authentication flow analysis."
    },
    {
      "id": "api2_broken_authentication_jwt_signature_validation_missing",
      "title": "OWASP API2:2023 (Broken Authentication): Broken Authentication - JWT Signature Validation Missing",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs auth middleware inspection."
    },
    {
      "id": "api2_broken_authentication_login_endpoints_lack_rate_limiting",
      "title": "OWASP API2:2023 (Broken Authentication): Broken Authentication - Login Endpoints Lack Rate Limiting",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires middleware/config analysis."
    },
    {
      "id": "api3_excessive_data_exposure",
      "title": "OWASP API3:2023 (Excessive Data Exposure): Excessive Data Exposure",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires response serialization analysis."
    },
    {
      "id": "api3_excessive_data_exposure_model_serialization_returns_all_fields",
      "title": "OWASP API3:2023 (Excessive Data Exposure): Excessive Data Exposure - Model Serialization Returns All Fields",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs serializer/schema inspection."
    },
    {
      "id": "api3_excessive_data_exposure_field_filtering_not_role_aware",
      "title": "OWASP API3:2023 (Excessive Data Exposure): Excessive Data Exposure - Field Filtering not Role-aware",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires authorization-to-serialization mapping."
    },
    {
      "id": "api4_lack_of_rate_limiting",
      "title": "OWASP API4:2023 (Lack of Resources and Rate Limiting): Lack of Rate Limiting",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires middleware/config analysis."
    },
    {
      "id": "api4_lack_of_rate_limiting_no_rate_limiter_on_api_routes",
      "title": "OWASP API4:2023 (Lack of Resources and Rate Limiting): Lack of Rate Limiting - No Rate Limiter on API Routes",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs route/middleware mapping."
    },
    {
      "id": "api4_lack_of_rate_limiting_missing_per_client_quotas",
      "title": "OWASP API4:2023 (Lack of Resources and Rate Limiting): Lack of Rate Limiting - Missing Per-client Quotas",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires config inspection."
    },
    {
      "id": "api5_broken_function_level_authorization",
      "title": "OWASP API5:2023 (Broken Function Level Authorization): Broken Function Level Authorization",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires permission checks per endpoint."
    },
    {
      "id": "api5_bfla_admin_endpoints_missing_role_checks",
      "title": "OWASP API5:2023 (Broken Function Level Authorization): BFLA - Admin Endpoints Missing Role Checks",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs endpoint authorization analysis."
    },
    {
      "id": "api5_bfla_function_level_permissions_not_enforced_in_handlers",
      "title": "OWASP API5:2023 (Broken Function Level Authorization): BFLA - Function-level Permissions not Enforced in Handlers",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires code logic inspection."
    },
    {
      "id": "api6_mass_assignment",
      "title": "OWASP API6:2023 (Mass Assignment): Mass Assignment",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires model binding analysis."
    },
    {
      "id": "api6_mass_assignment_request_body_bound_directly_to_orm_model",
      "title": "OWASP API6:2023 (Mass Assignment): Mass Assignment - Request Body Bound Directly to ORM Model",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs data binding analysis."
    },
    {
      "id": "api6_mass_assignment_missing_allowlist_for_writable_fields",
      "title": "OWASP API6:2023 (Mass Assignment): Mass Assignment - Missing Allowlist for Writable Fields",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires schema/DTO inspection."
    },
    {
      "id": "api7_security_misconfigurations",
      "title": "OWASP API7:2023 (Security Misconfiguration): Security Misconfigurations",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires API gateway/app config inspection."
    },
    {
      "id": "api7_security_misconfigurations_cors_wildcard_with_credentials",
      "title": "OWASP API7:2023 (Security Misconfiguration): Security Misconfigurations - CORS Wildcard with Credentials",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs CORS policy analysis."
    },
    {
      "id": "api7_security_misconfigurations_debug_verbose_errors_enabled",
      "title": "OWASP API7:2023 (Security Misconfiguration): Security Misconfigurations - Debug/verbose Errors Enabled",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires config/handler analysis."
    },
    {
      "id": "api8_injection",
      "title": "OWASP API8:2023 (Injection): Injection",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "partial",
      "notes": "Regex covers some SQL/command/DOM sinks only."
    },
    {
      "id": "api8_injection_sql_concatenation_in_api_handlers",
      "title": "OWASP API8:2023 (Injection): Injection - SQL Concatenation in API Handlers",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Covered by regex for SQL concatenation."
    },
    {
      "id": "api8_injection_shell_true_or_os_system_in_api_handlers",
      "title": "OWASP API8:2023 (Injection): Injection - Shell=True or Os.system in API Handlers",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Covered by regex for command injection patterns."
    },
    {
      "id": "api8_injection_nosql_queries_built_from_request_body",
      "title": "OWASP API8:2023 (Injection): Injection - NoSQL Queries Built from Request Body",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires data-flow analysis."
    },
    {
      "id": "api9_improper_asset_management",
      "title": "OWASP API9:2023 (Improper Assets Management): Improper Asset Management",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires endpoint inventory and versioning analysis."
    },
    {
      "id": "api9_improper_asset_management_undocumented_legacy_endpoints_deployed",
      "title": "OWASP API9:2023 (Improper Assets Management): Improper Asset Management - Undocumented/legacy Endpoints Deployed",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs route inventory vs spec comparison."
    },
    {
      "id": "api9_improper_asset_management_inconsistent_versioning_or_deprecation",
      "title": "OWASP API9:2023 (Improper Assets Management): Improper Asset Management - Inconsistent Versioning or Deprecation",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires API catalog analysis."
    },
    {
      "id": "api10_server_side_request_forgery",
      "title": "OWASP API10:2023 (Insufficient Logging and Monitoring): Server-Side Request Forgery",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "partial",
      "notes": "Regex detects some dynamic URL usage only."
    },
    {
      "id": "api10_ssrf_dynamic_url_in_requests_get_post",
      "title": "OWASP API10:2023 (Insufficient Logging and Monitoring): SSRF - Dynamic URL in Requests.get/post",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Covered by regex for dynamic URL in requests."
    },
    {
      "id": "api10_ssrf_user_controlled_url_used_in_downstream_http_client",
      "title": "OWASP API10:2023 (Insufficient Logging and Monitoring): SSRF - User-controlled URL Used in Downstream HTTP Client",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires taint tracking and allowlist checks."
    },
    {
      "id": "api_specific_jwt_token_analysis",
      "title": "API-specific: JWT Token Analysis",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires JWT validation logic inspection."
    },
    {
      "id": "jwt_analysis_alg_none_accepted",
      "title": "OWASP A02:2021 (Cryptographic Failures): JWT Analysis - Alg=none Accepted",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "A02",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Detect jwt.verify() or jwt.decode() calls that allow 'none' algorithm or don't restrict algorithms.",
      "patterns": [
        "algorithms: ['none'",
        "algorithms: [\"none\"",
        "algorithm: 'none'",
        "jwt.verify(token, secret)",
        "jwt.decode(",
        "algorithms: ['HS256', 'none'"
      ],
      "examples": {
        "vulnerable": "jwt.verify(token, secret, { algorithms: ['HS256', 'none'] })",
        "safe": "jwt.verify(token, secret, { algorithms: ['HS256'] })"
      }
    },
    {
      "id": "jwt_analysis_weak_hmac_key_length",
      "title": "JWT Analysis - Weak HMAC Key Length",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires key management analysis."
    },
    {
      "id": "jwt_analysis_missing_exp_nbf_validation",
      "title": "JWT Analysis - Missing Exp/nbf Validation",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires token validation analysis."
    },
    {
      "id": "jwt_analysis_issuer_audience_not_validated",
      "title": "JWT Analysis - Issuer/audience not Validated",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires token validation analysis."
    },
    {
      "id": "api_specific_oauth2_openid_connect_misconfigurations",
      "title": "API-specific: OAuth2/OpenID Connect Misconfigurations",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires OAuth/OIDC config analysis."
    },
    {
      "id": "oauth2_oidc_redirect_uri_wildcards",
      "title": "OAuth2/OIDC - Redirect URI Wildcards",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires client config inspection."
    },
    {
      "id": "oauth2_oidc_missing_pkce_for_public_clients",
      "title": "OAuth2/OIDC - Missing PKCE for Public Clients",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires flow configuration analysis."
    },
    {
      "id": "oauth2_oidc_implicit_flow_enabled_in_production",
      "title": "OAuth2/OIDC - Implicit Flow Enabled in Production",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires provider config analysis."
    },
    {
      "id": "api_specific_api_key_leakage_detection",
      "title": "API-specific: API Key Leakage Detection",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "yes",
      "current_support": "partial",
      "notes": "Regex detects some hardcoded key patterns only."
    },
    {
      "id": "api_key_leakage_hardcoded_api_key_literal_in_code",
      "title": "API Key Leakage - Hardcoded Api_key Literal in Code",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Covered by regex for hardcoded API key."
    },
    {
      "id": "api_key_leakage_keys_embedded_in_config_examples_docs",
      "title": "API Key Leakage - Keys Embedded in Config/examples/docs",
      "section": "API Security Testing (OWASP API Top 10 + API-specific checks)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires config/doc scanning."
    },
    {
      "id": "sast_hardcoded_secrets_detection",
      "title": "SAST: Hardcoded Secrets Detection",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "yes",
      "current_support": "partial",
      "notes": "Regex detects some hardcoded secret patterns only."
    },
    {
      "id": "hardcoded_secrets_password_literals_in_code",
      "title": "Hardcoded Secrets - Password Literals in Code",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Covered by regex for hardcoded password."
    },
    {
      "id": "hardcoded_secrets_api_secret_private_key_literals_in_code",
      "title": "Hardcoded Secrets - API/secret/private Key Literals in Code",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Covered by regex for hardcoded key patterns."
    },
    {
      "id": "hardcoded_secrets_secrets_in_config_examples_docs",
      "title": "Hardcoded Secrets - Secrets in Config/examples/docs",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires config/doc scanning."
    },
    {
      "id": "sast_dependency_vulnerability_scanning",
      "title": "SAST: Dependency Vulnerability Scanning",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires manifest/lockfile parsing and CVE data."
    },
    {
      "id": "dependency_scanning_parse_manifests_lockfiles_for_versions",
      "title": "Dependency Scanning - Parse Manifests/lockfiles for Versions",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Not implemented in scanner."
    },
    {
      "id": "dependency_scanning_match_versions_to_cve_feeds",
      "title": "Dependency Scanning - Match Versions to CVE Feeds",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires external data."
    },
    {
      "id": "sast_code_level_injection_detection",
      "title": "SAST: Code-level Injection Detection",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "partial",
      "notes": "Regex covers some SQL/command/DOM sinks only."
    },
    {
      "id": "code_injection_sql_concatenation_format_in_execute",
      "title": "Code Injection - SQL Concatenation/format in Execute()",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Covered by regex patterns."
    },
    {
      "id": "code_injection_shell_true_or_os_system_os_popen",
      "title": "Code Injection - Shell=True or Os.system/os.popen",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Covered by regex patterns."
    },
    {
      "id": "code_injection_template_injection_patterns",
      "title": "Code Injection - Template Injection Patterns",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires framework-specific analysis."
    },
    {
      "id": "sast_unsafe_crypto_usage",
      "title": "SAST: Unsafe Crypto Usage",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "partial",
      "notes": "Regex covers MD5/SHA1/DES only."
    },
    {
      "id": "unsafe_crypto_md5_sha1_usage",
      "title": "Unsafe Crypto - MD5/SHA1 Usage",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Covered by regex for MD5/SHA1."
    },
    {
      "id": "unsafe_crypto_des_cipher_usage",
      "title": "Unsafe Crypto - DES Cipher Usage",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Covered by regex for DES import."
    },
    {
      "id": "unsafe_crypto_weak_key_lengths_parameters",
      "title": "Unsafe Crypto - Weak Key Lengths/parameters",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires crypto parameter analysis."
    },
    {
      "id": "sast_dangerous_apis",
      "title": "SAST: Dangerous APIs",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "partial",
      "notes": "Regex covers some dangerous APIs only."
    },
    {
      "id": "dangerous_apis_eval_exec_with_variable",
      "title": "OWASP A03:2021 (Injection): Dangerous APIs - Eval/exec with Variable",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "A03",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Detect eval(), new Function(), exec() with user-controlled input in both client-side and server-side code.",
      "patterns": [
        "eval(",
        "new Function(",
        "exec(",
        "setTimeout(string",
        "setInterval(string"
      ],
      "examples": {
        "vulnerable_client": "const total = eval(quantity + '*' + price);",
        "vulnerable_server": "exec(userInput)",
        "safe": "const total = Number(quantity) * Number(price);"
      }
    },
    {
      "id": "dangerous_apis_os_system_os_popen_usage",
      "title": "Dangerous APIs - Os.system/os.popen Usage",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Covered by regex for os.system/os.popen."
    },
    {
      "id": "dangerous_apis_dynamic_code_loading_from_network",
      "title": "Dangerous APIs - Dynamic Code Loading from Network",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires data-flow and network analysis."
    },
    {
      "id": "sast_input_validation_mistakes",
      "title": "SAST: Input Validation Mistakes",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires validation logic analysis."
    },
    {
      "id": "input_validation_missing_allowlist_for_inputs",
      "title": "Input Validation - Missing Allowlist for Inputs",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs validation rule inspection."
    },
    {
      "id": "input_validation_direct_use_of_request_params_in_sinks",
      "title": "Input Validation - Direct Use of Request Params in Sinks",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires taint analysis."
    },
    {
      "id": "sast_broken_access_logic_in_code",
      "title": "SAST: Broken Access Logic in Code",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires authz logic analysis."
    },
    {
      "id": "broken_access_logic_missing_auth_checks_in_handlers",
      "title": "Broken Access Logic - Missing Auth Checks in Handlers",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs route/guard analysis."
    },
    {
      "id": "broken_access_logic_bypassable_authorization_branches",
      "title": "Broken Access Logic - Bypassable Authorization Branches",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires control-flow analysis."
    },
    {
      "id": "sast_static_taint_analysis",
      "title": "SAST: Static Taint Analysis",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires data-flow engine not present."
    },
    {
      "id": "static_taint_analysis_source_to_sink_mapping",
      "title": "Static Taint Analysis - Source to Sink Mapping",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires taint engine."
    },
    {
      "id": "static_taint_analysis_sanitization_validation_tracking",
      "title": "Static Taint Analysis - Sanitization/validation Tracking",
      "section": "SAST - Static Application Security Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires taint engine."
    },
    {
      "id": "cloud_iam_over_permissive_roles",
      "title": "Cloud IAM: Over-permissive Roles",
      "section": "Cloud Security Testing (AWS, GCP, Azure)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires IAM/IaC policy analysis."
    },
    {
      "id": "iam_over_permissive_wildcard_actions_resources_in_policies",
      "title": "IAM Over-permissive - Wildcard Actions/resources in Policies",
      "section": "Cloud Security Testing (AWS, GCP, Azure)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs IaC/policy parsing."
    },
    {
      "id": "iam_over_permissive_admin_privileges_granted_broadly",
      "title": "IAM Over-permissive - Admin Privileges Granted Broadly",
      "section": "Cloud Security Testing (AWS, GCP, Azure)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires policy analysis."
    },
    {
      "id": "cloud_iam_unrestricted_policies",
      "title": "Cloud IAM: Unrestricted Policies",
      "section": "Cloud Security Testing (AWS, GCP, Azure)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires IAM policy inspection."
    },
    {
      "id": "iam_unrestricted_principal_in_resource_policies",
      "title": "IAM Unrestricted - Principal \"*\" in Resource Policies",
      "section": "Cloud Security Testing (AWS, GCP, Azure)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires policy parsing."
    },
    {
      "id": "iam_unrestricted_no_condition_constraints",
      "title": "IAM Unrestricted - No Condition Constraints",
      "section": "Cloud Security Testing (AWS, GCP, Azure)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires policy analysis."
    },
    {
      "id": "cloud_storage_public_s3_buckets",
      "title": "Cloud Storage: Public S3 Buckets",
      "section": "Cloud Security Testing (AWS, GCP, Azure)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires IaC or cloud inventory analysis."
    },
    {
      "id": "public_s3_bucket_policy_allows_public_read_write",
      "title": "Public S3 - Bucket Policy Allows Public Read/write",
      "section": "Cloud Security Testing (AWS, GCP, Azure)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs policy parsing."
    },
    {
      "id": "public_s3_acl_grants_allusers_authenticatedusers",
      "title": "Public S3 - ACL Grants AllUsers/AuthenticatedUsers",
      "section": "Cloud Security Testing (AWS, GCP, Azure)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires ACL analysis."
    },
    {
      "id": "cloud_storage_public_gcp_storage",
      "title": "Cloud Storage: Public GCP Storage",
      "section": "Cloud Security Testing (AWS, GCP, Azure)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires IaC or cloud inventory analysis."
    },
    {
      "id": "public_gcp_storage_allusers_iam_binding",
      "title": "Public GCP Storage - AllUsers IAM Binding",
      "section": "Cloud Security Testing (AWS, GCP, Azure)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs policy parsing."
    },
    {
      "id": "public_gcp_storage_public_acls_on_buckets",
      "title": "Public GCP Storage - Public ACLs on Buckets",
      "section": "Cloud Security Testing (AWS, GCP, Azure)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires ACL analysis."
    },
    {
      "id": "cloud_storage_misconfigured_azure_blobs",
      "title": "Cloud Storage: Misconfigured Azure Blobs",
      "section": "Cloud Security Testing (AWS, GCP, Azure)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires IaC or cloud inventory analysis."
    },
    {
      "id": "azure_blobs_public_container_access_level",
      "title": "Azure Blobs - Public Container Access Level",
      "section": "Cloud Security Testing (AWS, GCP, Azure)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs policy/ACL analysis."
    },
    {
      "id": "azure_blobs_sas_tokens_overly_permissive",
      "title": "Azure Blobs - SAS Tokens Overly Permissive",
      "section": "Cloud Security Testing (AWS, GCP, Azure)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires config analysis."
    },
    {
      "id": "cloud_network_open_security_groups",
      "title": "Cloud Network: Open Security Groups",
      "section": "Cloud Security Testing (AWS, GCP, Azure)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires IaC/cloud security group analysis."
    },
    {
      "id": "open_security_groups_0_0_0_0_0_on_sensitive_ports",
      "title": "Open Security Groups - 0.0.0.0/0 on Sensitive Ports",
      "section": "Cloud Security Testing (AWS, GCP, Azure)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs IaC parsing."
    },
    {
      "id": "open_security_groups_wide_inbound_rules_without_justification",
      "title": "Open Security Groups - Wide Inbound Rules Without Justification",
      "section": "Cloud Security Testing (AWS, GCP, Azure)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires policy review."
    },
    {
      "id": "cloud_network_publicly_exposed_databases",
      "title": "Cloud Network: Publicly Exposed Databases",
      "section": "Cloud Security Testing (AWS, GCP, Azure)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires inventory and network rules."
    },
    {
      "id": "public_dbs_database_ports_open_to_internet",
      "title": "Public DBs - Database Ports Open to Internet",
      "section": "Cloud Security Testing (AWS, GCP, Azure)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs SG/firewall analysis."
    },
    {
      "id": "public_dbs_no_private_subnets_or_vpc_only_access",
      "title": "Public DBs - No Private Subnets or VPC-only Access",
      "section": "Cloud Security Testing (AWS, GCP, Azure)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires IaC analysis."
    },
    {
      "id": "cloud_metadata_attacks_imdsv1_misuse",
      "title": "Cloud metadata attacks: IMDSv1 Misuse",
      "section": "Cloud Security Testing (AWS, GCP, Azure)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires instance metadata configuration analysis."
    },
    {
      "id": "imdsv1_misuse_metadata_service_v1_enabled",
      "title": "IMDSv1 Misuse - Metadata Service V1 Enabled",
      "section": "Cloud Security Testing (AWS, GCP, Azure)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs cloud config analysis."
    },
    {
      "id": "imdsv1_misuse_no_hop_limit_or_token_enforcement",
      "title": "IMDSv1 Misuse - No Hop Limit or Token Enforcement",
      "section": "Cloud Security Testing (AWS, GCP, Azure)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires metadata config analysis."
    },
    {
      "id": "docker_insecure_base_images",
      "title": "Docker: Insecure Base Images",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires Dockerfile/image inventory + CVE data."
    },
    {
      "id": "insecure_base_images_outdated_or_vulnerable_base_image_tags",
      "title": "Insecure Base Images - Outdated or Vulnerable Base Image Tags",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs image/version analysis."
    },
    {
      "id": "insecure_base_images_unpinned_latest_tags",
      "title": "Insecure Base Images - Unpinned Latest Tags",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires Dockerfile analysis."
    },
    {
      "id": "docker_privileged_containers",
      "title": "Docker: Privileged Containers",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires Docker/K8s manifest analysis."
    },
    {
      "id": "privileged_containers_privileged_true_in_manifests",
      "title": "Privileged containers - privileged: True in Manifests",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs manifest parsing."
    },
    {
      "id": "privileged_containers_hostpath_or_hostnetwork_usage",
      "title": "Privileged Containers - HostPath or HostNetwork Usage",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires manifest inspection."
    },
    {
      "id": "docker_hardcoded_secrets_in_images",
      "title": "Docker: Hardcoded Secrets in Images",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires image or Dockerfile scan."
    },
    {
      "id": "secrets_in_images_secrets_baked_into_dockerfile_env",
      "title": "Secrets in Images - Secrets Baked Into Dockerfile ENV",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs Dockerfile analysis."
    },
    {
      "id": "secrets_in_images_credentials_in_image_layers",
      "title": "Secrets in Images - Credentials in Image Layers",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires image scanning."
    },
    {
      "id": "kubernetes_rbac_misconfigurations",
      "title": "Kubernetes: RBAC Misconfigurations",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires RBAC manifest analysis."
    },
    {
      "id": "rbac_misconfig_cluster_admin_bound_to_broad_subjects",
      "title": "RBAC Misconfig - Cluster-admin Bound to Broad Subjects",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs RBAC parsing."
    },
    {
      "id": "rbac_misconfig_wildcard_verbs_resources",
      "title": "RBAC Misconfig - Wildcard Verbs/resources",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires RBAC analysis."
    },
    {
      "id": "kubernetes_anonymous_api_access",
      "title": "Kubernetes: Anonymous API Access",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires API server config analysis."
    },
    {
      "id": "anonymous_api_access_anonymous_auth_enabled",
      "title": "Anonymous API Access - Anonymous-auth Enabled",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs cluster config analysis."
    },
    {
      "id": "anonymous_api_access_unauthenticated_access_to_metrics",
      "title": "Anonymous API Access - Unauthenticated Access to /metrics",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires cluster policy review."
    },
    {
      "id": "kubernetes_open_dashboards",
      "title": "Kubernetes: Open Dashboards",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires service exposure analysis."
    },
    {
      "id": "open_dashboards_dashboard_service_exposed_via_loadbalancer_nodeport",
      "title": "Open Dashboards - Dashboard Service Exposed via LoadBalancer/NodePort",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs service manifest analysis."
    },
    {
      "id": "open_dashboards_no_auth_on_dashboard_ingress",
      "title": "Open Dashboards - No Auth on Dashboard Ingress",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires ingress/auth analysis."
    },
    {
      "id": "kubernetes_insecure_pod_security_policies",
      "title": "Kubernetes: Insecure Pod Security Policies",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires PSP/PSA policy analysis."
    },
    {
      "id": "insecure_psp_allow_privileged_containers",
      "title": "Insecure PSP - Allow Privileged Containers",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs policy parsing."
    },
    {
      "id": "insecure_psp_allow_hostpath_hostnetwork_hostpid",
      "title": "Insecure PSP - Allow HostPath/hostNetwork/hostPID",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires policy analysis."
    },
    {
      "id": "ci_cd_credential_leakage",
      "title": "CI/CD: Credential Leakage",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires pipeline config/log analysis."
    },
    {
      "id": "ci_cd_credential_leakage_secrets_in_pipeline_logs",
      "title": "CI/CD Credential Leakage - Secrets in Pipeline Logs",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs log scanning."
    },
    {
      "id": "ci_cd_credential_leakage_secrets_in_ci_config_variables",
      "title": "CI/CD Credential Leakage - Secrets in CI Config Variables",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires config scanning."
    },
    {
      "id": "ci_cd_insecure_pipelines",
      "title": "CI/CD: Insecure Pipelines",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires pipeline policy analysis."
    },
    {
      "id": "insecure_pipelines_unsigned_artifacts_promoted",
      "title": "Insecure Pipelines - Unsigned Artifacts Promoted",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs pipeline policy analysis."
    },
    {
      "id": "insecure_pipelines_untrusted_code_running_with_secrets",
      "title": "Insecure Pipelines - Untrusted Code Running with Secrets",
      "section": "Container & DevOps Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires pipeline isolation analysis."
    },
    {
      "id": "auth_password_brute_force_detection",
      "title": "Auth: Password Brute-force Detection",
      "section": "Authentication & Authorization Security",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires auth flow and monitoring analysis."
    },
    {
      "id": "brute_force_detection_no_login_rate_limiting",
      "title": "Brute-force Detection - No Login Rate Limiting",
      "section": "Authentication & Authorization Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs middleware/config analysis."
    },
    {
      "id": "brute_force_detection_no_lockout_backoff_policy",
      "title": "Brute-force Detection - No Lockout/backoff Policy",
      "section": "Authentication & Authorization Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires policy analysis."
    },
    {
      "id": "auth_credential_stuffing_detection",
      "title": "Auth: Credential Stuffing Detection",
      "section": "Authentication & Authorization Security",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires monitoring and anomaly detection."
    },
    {
      "id": "credential_stuffing_lack_of_ip_device_anomaly_checks",
      "title": "Credential Stuffing - Lack of IP/device Anomaly Checks",
      "section": "Authentication & Authorization Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs analytics/monitoring review."
    },
    {
      "id": "credential_stuffing_no_bot_detection_or_mfa_triggers",
      "title": "Credential Stuffing - No Bot Detection or MFA Triggers",
      "section": "Authentication & Authorization Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires auth policy analysis."
    },
    {
      "id": "auth_weak_login_flows",
      "title": "Auth: Weak Login Flows",
      "section": "Authentication & Authorization Security",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires flow/security control analysis."
    },
    {
      "id": "weak_login_flows_missing_mfa_or_step_up_auth",
      "title": "Weak Login Flows - Missing MFA or Step-up Auth",
      "section": "Authentication & Authorization Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires auth flow inspection."
    },
    {
      "id": "weak_login_flows_password_reset_bypassable",
      "title": "Weak Login Flows - Password Reset Bypassable",
      "section": "Authentication & Authorization Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs flow validation analysis."
    },
    {
      "id": "auth_oauth_misconfigurations",
      "title": "Auth: OAuth Misconfigurations",
      "section": "Authentication & Authorization Security",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires OAuth client/provider config analysis."
    },
    {
      "id": "oauth_misconfig_redirect_uri_wildcards",
      "title": "OAuth Misconfig - Redirect URI Wildcards",
      "section": "Authentication & Authorization Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires OAuth config inspection."
    },
    {
      "id": "oauth_misconfig_missing_pkce_for_public_clients",
      "title": "OAuth Misconfig - Missing PKCE for Public Clients",
      "section": "Authentication & Authorization Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires OAuth config analysis."
    },
    {
      "id": "auth_jwt_weakness_tests",
      "title": "Auth: JWT Weakness Tests",
      "section": "Authentication & Authorization Security",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires JWT validation logic inspection."
    },
    {
      "id": "jwt_weakness_alg_none_allowed",
      "title": "OWASP A02:2021 (Cryptographic Failures): JWT Weakness - Alg None Allowed",
      "section": "Authentication & Authorization Security",
      "owasp_category": "A02",
      "source": "Doc",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Detect JWT verification that permits 'none' algorithm or omits algorithm restriction entirely.",
      "patterns": [
        "algorithms: ['none'",
        "algorithms: [\"none\"",
        "algorithm: 'none'",
        "algorithms: ['HS256', 'none'"
      ],
      "examples": {
        "vulnerable": "const decoded = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256', 'none'] });",
        "safe": "const decoded = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] });"
      }
    },
    {
      "id": "jwt_weakness_alg_none_allowed_reject_unsigned_tokens",
      "title": "JWT Weakness - Alg None Allowed - Reject Unsigned Tokens",
      "section": "Authentication & Authorization Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires token verification logic."
    },
    {
      "id": "jwt_weakness_weak_hmac_keys",
      "title": "JWT Weakness - Weak HMAC Keys",
      "section": "Authentication & Authorization Security",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires key management analysis."
    },
    {
      "id": "jwt_weakness_weak_hmac_keys_enforce_minimum_key_length_rotation",
      "title": "JWT Weakness - Weak HMAC Keys - Enforce Minimum Key Length/rotation",
      "section": "Authentication & Authorization Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires key policy analysis."
    },
    {
      "id": "jwt_weakness_expiry_issues",
      "title": "JWT Weakness - Expiry Issues",
      "section": "Authentication & Authorization Security",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires token validation analysis."
    },
    {
      "id": "jwt_weakness_expiry_issues_enforce_exp_nbf_iat_and_max_ttl",
      "title": "JWT Weakness - Expiry Issues - Enforce Exp/nbf/iat and Max TTL",
      "section": "Authentication & Authorization Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires token validation analysis."
    },
    {
      "id": "jwt_weakness_issuer_audience_not_validated",
      "title": "JWT Weakness - Issuer/audience not Validated",
      "section": "Authentication & Authorization Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires token validation analysis."
    },
    {
      "id": "jwt_weakness_kid_header_injection_path_traversal",
      "title": "JWT Weakness - Kid Header Injection/path Traversal",
      "section": "Authentication & Authorization Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires token validation analysis."
    },
    {
      "id": "session_samesite_httponly_secure_checks",
      "title": "Session: SameSite/HttpOnly/Secure Checks",
      "section": "Session Security",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires cookie configuration analysis."
    },
    {
      "id": "session_cookies_missing_secure_httponly_samesite_flags",
      "title": "Session Cookies - Missing Secure/HttpOnly/SameSite Flags",
      "section": "Session Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs header/config inspection."
    },
    {
      "id": "session_cookies_insecure_defaults_in_framework_config",
      "title": "Session Cookies - Insecure Defaults in Framework Config",
      "section": "Session Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires config analysis."
    },
    {
      "id": "session_session_fixation",
      "title": "Session: Session Fixation",
      "section": "Session Security",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires session lifecycle analysis."
    },
    {
      "id": "session_fixation_session_id_not_rotated_on_login",
      "title": "Session Fixation - Session ID not Rotated on Login",
      "section": "Session Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs auth/session flow analysis."
    },
    {
      "id": "session_fixation_session_id_accepted_from_url",
      "title": "Session Fixation - Session ID Accepted from URL",
      "section": "Session Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires request parsing analysis."
    },
    {
      "id": "session_session_hijacking",
      "title": "Session: Session Hijacking",
      "section": "Session Security",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires session security/control analysis."
    },
    {
      "id": "session_hijacking_missing_ip_ua_binding_or_alerts",
      "title": "Session Hijacking - Missing IP/UA Binding or Alerts",
      "section": "Session Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires monitoring logic analysis."
    },
    {
      "id": "session_hijacking_cookies_not_secure_httponly",
      "title": "Session Hijacking - Cookies not Secure/httponly",
      "section": "Session Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs cookie config analysis."
    },
    {
      "id": "session_token_replay_analysis",
      "title": "Session: Token Replay Analysis",
      "section": "Session Security",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires token lifecycle/nonce analysis."
    },
    {
      "id": "token_replay_long_lived_tokens_without_rotation",
      "title": "Token Replay - Long-lived Tokens Without Rotation",
      "section": "Session Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires token management analysis."
    },
    {
      "id": "token_replay_no_jti_nonce_tracking",
      "title": "Token Replay - No Jti/nonce Tracking",
      "section": "Session Security",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires token validation analysis."
    },
    {
      "id": "business_logic_abuse_flows",
      "title": "Business logic: Abuse Flows",
      "section": "Business Logic Testing",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires workflow and business rule analysis."
    },
    {
      "id": "abuse_flows_bypass_intended_workflow_steps",
      "title": "Abuse Flows - Bypass Intended Workflow Steps",
      "section": "Business Logic Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs state machine/flow analysis."
    },
    {
      "id": "abuse_flows_unexpected_state_transitions_allowed",
      "title": "Abuse Flows - Unexpected State Transitions Allowed",
      "section": "Business Logic Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires domain logic analysis."
    },
    {
      "id": "business_logic_discount_logic_manipulation",
      "title": "Business logic: Discount Logic Manipulation",
      "section": "Business Logic Testing",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires pricing/discount rule analysis."
    },
    {
      "id": "discount_manipulation_client_controlled_discount_fields",
      "title": "Discount Manipulation - Client-controlled Discount Fields",
      "section": "Business Logic Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs data-flow analysis."
    },
    {
      "id": "discount_manipulation_missing_server_side_validation",
      "title": "Discount Manipulation - Missing Server-side Validation",
      "section": "Business Logic Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires business rule inspection."
    },
    {
      "id": "business_logic_workflow_bypass",
      "title": "Business logic: Workflow Bypass",
      "section": "Business Logic Testing",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires step/order enforcement analysis."
    },
    {
      "id": "workflow_bypass_missing_step_validation",
      "title": "Workflow Bypass - Missing Step Validation",
      "section": "Business Logic Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs flow analysis."
    },
    {
      "id": "workflow_bypass_direct_access_to_later_stages",
      "title": "Workflow Bypass - Direct Access to Later Stages",
      "section": "Business Logic Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires route/flow inspection."
    },
    {
      "id": "business_logic_multi_step_approval_skipping",
      "title": "Business logic: Multi-step Approval Skipping",
      "section": "Business Logic Testing",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires approval workflow analysis."
    },
    {
      "id": "approval_skipping_approvals_not_enforced_in_code",
      "title": "Approval Skipping - Approvals not Enforced in Code",
      "section": "Business Logic Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs business rule inspection."
    },
    {
      "id": "approval_skipping_missing_role_checks_at_approval_steps",
      "title": "Approval Skipping - Missing Role Checks at Approval Steps",
      "section": "Business Logic Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires authz analysis."
    },
    {
      "id": "business_logic_race_condition_testing",
      "title": "Business logic: Race Condition Testing",
      "section": "Business Logic Testing",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires concurrency/transaction analysis."
    },
    {
      "id": "race_conditions_missing_transaction_isolation_locking",
      "title": "Race Conditions - Missing Transaction Isolation/locking",
      "section": "Business Logic Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs DB/transaction analysis."
    },
    {
      "id": "race_conditions_double_submit_endpoints_without_idempotency",
      "title": "Race Conditions - Double-submit Endpoints Without Idempotency",
      "section": "Business Logic Testing",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires idempotency checks."
    },
    {
      "id": "business_logic_note_hardest_area_to_automate",
      "title": "Business logic note: Hardest Area to Automate",
      "section": "Business Logic Testing",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Doc note; indicates partial inference via state machine/LLM."
    },
    {
      "id": "compliance_owasp_asvs",
      "title": "Compliance: OWASP ASVS",
      "section": "Compliance & Governance",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires mapping controls to code/config."
    },
    {
      "id": "owasp_asvs_map_requirements_to_implemented_controls",
      "title": "OWASP ASVS - Map Requirements to Implemented Controls",
      "section": "Compliance & Governance",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs control mapping."
    },
    {
      "id": "owasp_asvs_identify_gaps_in_auth_session_crypto_controls",
      "title": "OWASP ASVS - Identify Gaps in Auth/session/crypto Controls",
      "section": "Compliance & Governance",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires policy mapping."
    },
    {
      "id": "compliance_pci_dss_credit_card_handling",
      "title": "Compliance: PCI-DSS (credit Card Handling)",
      "section": "Compliance & Governance",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires data flow + storage analysis."
    },
    {
      "id": "pci_dss_detect_pan_storage_processing_locations",
      "title": "PCI-DSS - Detect PAN Storage/processing Locations",
      "section": "Compliance & Governance",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires data classification."
    },
    {
      "id": "pci_dss_validate_encryption_and_key_management",
      "title": "PCI-DSS - Validate Encryption and Key Management",
      "section": "Compliance & Governance",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs config/crypto analysis."
    },
    {
      "id": "compliance_hipaa_health_data",
      "title": "Compliance: HIPAA (health Data)",
      "section": "Compliance & Governance",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires PHI identification and policy mapping."
    },
    {
      "id": "hipaa_detect_phi_handling_in_data_flows",
      "title": "HIPAA - Detect PHI Handling in Data Flows",
      "section": "Compliance & Governance",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires data classification."
    },
    {
      "id": "hipaa_ensure_access_logging_for_phi",
      "title": "HIPAA - Ensure Access Logging for PHI",
      "section": "Compliance & Governance",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs logging analysis."
    },
    {
      "id": "compliance_gdpr_pii_leakage",
      "title": "Compliance: GDPR (PII Leakage)",
      "section": "Compliance & Governance",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires PII identification and policy mapping."
    },
    {
      "id": "gdpr_detect_pii_fields_and_processing_purposes",
      "title": "GDPR - Detect PII Fields and Processing Purposes",
      "section": "Compliance & Governance",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires data classification."
    },
    {
      "id": "gdpr_verify_data_retention_and_deletion_logic",
      "title": "GDPR - Verify Data Retention and Deletion Logic",
      "section": "Compliance & Governance",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires policy/code analysis."
    },
    {
      "id": "compliance_iso_27001_control_checks",
      "title": "Compliance: ISO 27001 Control Checks",
      "section": "Compliance & Governance",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires mapping controls to practices."
    },
    {
      "id": "iso_27001_identify_required_security_controls",
      "title": "ISO 27001 - Identify Required Security Controls",
      "section": "Compliance & Governance",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires governance mapping."
    },
    {
      "id": "iso_27001_verify_security_policies_in_code_config",
      "title": "ISO 27001 - Verify Security Policies in Code/config",
      "section": "Compliance & Governance",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs policy mapping."
    },
    {
      "id": "compliance_soc2_audit_preparation",
      "title": "Compliance: SOC2 Audit Preparation",
      "section": "Compliance & Governance",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires control evidence mapping."
    },
    {
      "id": "soc2_map_trust_criteria_to_controls",
      "title": "SOC2 - Map Trust Criteria to Controls",
      "section": "Compliance & Governance",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires governance analysis."
    },
    {
      "id": "soc2_collect_evidence_from_code_config_logs",
      "title": "SOC2 - Collect Evidence from Code/config/logs",
      "section": "Compliance & Governance",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires audit evidence pipeline."
    },
    {
      "id": "compliance_note_mapping_level_checks_can_be_automated",
      "title": "Compliance note: Mapping-level Checks Can Be Automated",
      "section": "Compliance & Governance",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Doc note; indicates scope for mapping automation."
    },
    {
      "id": "data_exposure_email_leakage",
      "title": "Data exposure: Email Leakage",
      "section": "Data Exposure & PII Leakage",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires log/response/data classification analysis."
    },
    {
      "id": "email_leakage_email_patterns_in_logs_or_responses",
      "title": "Email Leakage - Email Patterns in Logs or Responses",
      "section": "Data Exposure & PII Leakage",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires content scanning beyond regex rules."
    },
    {
      "id": "email_leakage_emails_embedded_in_frontend_bundles",
      "title": "Email Leakage - Emails Embedded in Frontend Bundles",
      "section": "Data Exposure & PII Leakage",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires bundle scanning."
    },
    {
      "id": "data_exposure_phone_number_leakage",
      "title": "Data exposure: Phone Number Leakage",
      "section": "Data Exposure & PII Leakage",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires log/response/data classification analysis."
    },
    {
      "id": "phone_leakage_phone_patterns_in_logs_or_responses",
      "title": "Phone Leakage - Phone Patterns in Logs or Responses",
      "section": "Data Exposure & PII Leakage",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires content scanning."
    },
    {
      "id": "phone_leakage_phone_numbers_in_frontend_bundles",
      "title": "Phone Leakage - Phone Numbers in Frontend Bundles",
      "section": "Data Exposure & PII Leakage",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires bundle scanning."
    },
    {
      "id": "data_exposure_sensitive_logs",
      "title": "Data exposure: Sensitive Logs",
      "section": "Data Exposure & PII Leakage",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires log statement analysis."
    },
    {
      "id": "sensitive_logs_passwords_tokens_logged",
      "title": "Sensitive Logs - Passwords/tokens Logged",
      "section": "Data Exposure & PII Leakage",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires log content analysis."
    },
    {
      "id": "sensitive_logs_full_request_bodies_logged",
      "title": "Sensitive Logs - Full Request Bodies Logged",
      "section": "Data Exposure & PII Leakage",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires log content analysis."
    },
    {
      "id": "data_exposure_debug_data_exposure",
      "title": "Data exposure: Debug Data Exposure",
      "section": "Data Exposure & PII Leakage",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires debug flag/handler analysis."
    },
    {
      "id": "debug_exposure_stack_traces_returned_to_clients",
      "title": "Debug Exposure - Stack Traces Returned to Clients",
      "section": "Data Exposure & PII Leakage",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires error handler analysis."
    },
    {
      "id": "debug_exposure_debug_endpoints_enabled",
      "title": "Debug Exposure - Debug Endpoints Enabled",
      "section": "Data Exposure & PII Leakage",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires route/config analysis."
    },
    {
      "id": "data_exposure_api_responses_leaking_internal_ids",
      "title": "Data exposure: API Responses Leaking Internal IDs",
      "section": "Data Exposure & PII Leakage",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires response schema analysis."
    },
    {
      "id": "api_response_leakage_expose_internal_ids_without_need",
      "title": "API Response Leakage - Expose Internal IDs Without Need",
      "section": "Data Exposure & PII Leakage",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs serializer/DTO inspection."
    },
    {
      "id": "api_response_leakage_expose_database_keys_or_secrets",
      "title": "API Response Leakage - Expose Database Keys or Secrets",
      "section": "Data Exposure & PII Leakage",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires data classification."
    },
    {
      "id": "data_exposure_js_bundles_leaking_secrets",
      "title": "Data exposure: JS Bundles Leaking Secrets",
      "section": "Data Exposure & PII Leakage",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires bundle/source map scanning."
    },
    {
      "id": "js_bundle_secrets_api_keys_embedded_in_js",
      "title": "JS Bundle Secrets - API Keys Embedded in JS",
      "section": "Data Exposure & PII Leakage",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires build output scanning."
    },
    {
      "id": "js_bundle_secrets_sensitive_endpoints_or_tokens_in_bundles",
      "title": "JS Bundle Secrets - Sensitive Endpoints or Tokens in Bundles",
      "section": "Data Exposure & PII Leakage",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires bundle scanning."
    },
    {
      "id": "performance_security_rate_limit_bypass",
      "title": "Performance+Security: Rate-limit Bypass",
      "section": "Performance + Security Hybrid",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires rate limiting design and runtime testing."
    },
    {
      "id": "rate_limit_bypass_missing_keying_on_user_ip_device",
      "title": "Rate-limit Bypass - Missing Keying on User/IP/device",
      "section": "Performance + Security Hybrid",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs policy/config analysis."
    },
    {
      "id": "rate_limit_bypass_multiple_endpoints_share_no_global_limits",
      "title": "Rate-limit Bypass - Multiple Endpoints Share No Global Limits",
      "section": "Performance + Security Hybrid",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires rate-limit design review."
    },
    {
      "id": "performance_security_expensive_operations_triggering_timeouts",
      "title": "Performance+Security: Expensive Operations Triggering Timeouts",
      "section": "Performance + Security Hybrid",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires code path cost analysis and runtime testing."
    },
    {
      "id": "expensive_ops_unbounded_queries_or_n_1_patterns",
      "title": "Expensive Ops - Unbounded Queries or N+1 Patterns",
      "section": "Performance + Security Hybrid",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires query/path analysis."
    },
    {
      "id": "expensive_ops_large_payload_processing_without_limits",
      "title": "Expensive Ops - Large Payload Processing Without Limits",
      "section": "Performance + Security Hybrid",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires input validation analysis."
    },
    {
      "id": "api_flood_resistance_rate_limits_and_circuit_breakers",
      "title": "API Flood Resistance - Rate Limits and Circuit Breakers",
      "section": "Performance + Security Hybrid",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires config/policy analysis."
    },
    {
      "id": "threat_modeling_attack_surface_mapping",
      "title": "Threat modeling: Attack Surface Mapping",
      "section": "Threat Modeling",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Can be inferred from routes/endpoints but requires modeling."
    },
    {
      "id": "attack_surface_mapping_enumerate_routes_endpoints_from_code",
      "title": "Attack Surface Mapping - Enumerate Routes/endpoints from Code",
      "section": "Threat Modeling",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires framework-specific route discovery."
    },
    {
      "id": "attack_surface_mapping_identify_externally_exposed_services",
      "title": "Attack Surface Mapping - Identify Externally Exposed Services",
      "section": "Threat Modeling",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires deployment/IaC analysis."
    },
    {
      "id": "threat_modeling_stride_analysis",
      "title": "Threat modeling: STRIDE Analysis",
      "section": "Threat Modeling",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires architectural/context modeling."
    },
    {
      "id": "stride_analysis_map_threats_to_components_data_flows",
      "title": "STRIDE Analysis - Map Threats to Components/data Flows",
      "section": "Threat Modeling",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs system modeling."
    },
    {
      "id": "stride_analysis_prioritize_threats_by_impact_likelihood",
      "title": "STRIDE Analysis - Prioritize Threats by Impact/likelihood",
      "section": "Threat Modeling",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires risk analysis."
    },
    {
      "id": "threat_modeling_data_flow_modelling",
      "title": "Threat modeling: Data Flow Modelling",
      "section": "Threat Modeling",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires data flow graphing."
    },
    {
      "id": "data_flow_modelling_identify_trust_boundaries",
      "title": "Data Flow Modelling - Identify Trust Boundaries",
      "section": "Threat Modeling",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs architecture modeling."
    },
    {
      "id": "data_flow_modelling_map_sensitive_data_paths",
      "title": "Data Flow Modelling - Map Sensitive Data Paths",
      "section": "Threat Modeling",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires data classification."
    },
    {
      "id": "threat_modeling_misuse_case_generation",
      "title": "Threat modeling: Misuse Case Generation",
      "section": "Threat Modeling",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires domain knowledge and modeling."
    },
    {
      "id": "misuse_cases_derive_abuse_cases_from_business_flows",
      "title": "Misuse Cases - Derive Abuse Cases from Business Flows",
      "section": "Threat Modeling",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs flow modeling."
    },
    {
      "id": "misuse_cases_identify_privilege_escalation_paths",
      "title": "Misuse Cases - Identify Privilege Escalation Paths",
      "section": "Threat Modeling",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires threat analysis."
    },
    {
      "id": "llm_assisted_threats_generate_threat_candidates_from_code_docs",
      "title": "LLM-assisted Threats - Generate Threat Candidates from Code/docs",
      "section": "Threat Modeling",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires LLM integration."
    },
    {
      "id": "threat_modeling_note_pairs_with_maeris",
      "title": "Threat modeling note: Pairs with Maeris",
      "section": "Threat Modeling",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Doc note; indicates strategic fit."
    },
    {
      "id": "summary_owasp_top_10",
      "title": "Summary: OWASP Top 10",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "partial",
      "notes": "Broad category; only some patterns covered by regex."
    },
    {
      "id": "owasp_top_10_map_findings_to_a01_a10_categories",
      "title": "OWASP Top 10 - Map Findings to A01-A10 Categories",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "partial",
      "notes": "Possible via rule mapping; partial scanner coverage."
    },
    {
      "id": "summary_owasp_api_top_10",
      "title": "Summary: OWASP API Top 10",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires API-specific authz/logic analysis."
    },
    {
      "id": "owasp_api_top_10_inventory_endpoints_vs_api_risks",
      "title": "OWASP API Top 10 - Inventory Endpoints vs API Risks",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs API inventory and policy analysis."
    },
    {
      "id": "summary_cve_detection",
      "title": "Summary: CVE Detection",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires dependency inventory and CVE feeds."
    },
    {
      "id": "cve_detection_match_dependency_versions_to_cve_db",
      "title": "CVE Detection - Match Dependency Versions to CVE DB",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires external data."
    },
    {
      "id": "summary_library_fingerprinting",
      "title": "Summary: Library Fingerprinting",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires dependency/bundle analysis."
    },
    {
      "id": "library_fingerprinting_parse_manifests_lockfiles_for_versions",
      "title": "Library Fingerprinting - Parse Manifests/lockfiles for Versions",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs parsing beyond current scanner."
    },
    {
      "id": "summary_tls_analysis",
      "title": "Summary: TLS Analysis",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires config or runtime TLS inspection."
    },
    {
      "id": "tls_analysis_verify_min_tls_version_and_ciphers",
      "title": "TLS Analysis - Verify Min TLS Version and Ciphers",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs config/runtime checks."
    },
    {
      "id": "summary_security_header_analysis",
      "title": "Summary: Security Header Analysis",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires header configuration inspection."
    },
    {
      "id": "security_headers_csp_hsts_x_frame_options_presence",
      "title": "Security Headers - CSP/HSTS/X-Frame-Options Presence",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs config/runtime checks."
    },
    {
      "id": "summary_cookie_session_security",
      "title": "Summary: Cookie/session Security",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires cookie config and session analysis."
    },
    {
      "id": "cookie_session_security_secure_httponly_samesite_flags",
      "title": "Cookie/session Security - Secure/HttpOnly/SameSite Flags",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs cookie inspection."
    },
    {
      "id": "summary_ssrf_testing",
      "title": "Summary: SSRF Testing",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "partial",
      "notes": "Regex catches some dynamic URL usage only."
    },
    {
      "id": "ssrf_testing_dynamic_url_in_http_client",
      "title": "SSRF Testing - Dynamic URL in HTTP Client",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "yes",
      "notes": "Covered by regex for dynamic URL in requests/urlopen."
    },
    {
      "id": "summary_csrf_detection",
      "title": "Summary: CSRF Detection",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires runtime request validation."
    },
    {
      "id": "csrf_detection_missing_csrf_token_validation",
      "title": "CSRF Detection - Missing CSRF Token Validation",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs framework-specific analysis."
    },
    {
      "id": "summary_xss_ssti_sqli_injections",
      "title": "Summary: XSS/SSTI/SQLi Injections",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "partial",
      "notes": "Regex covers some SQL/DOM patterns only."
    },
    {
      "id": "xss_ssti_sqli_sql_concatenation_and_dom_sinks",
      "title": "XSS/SSTI/SQLi - SQL Concatenation and DOM Sinks",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "yes",
      "notes": "Covered by regex patterns."
    },
    {
      "id": "summary_path_traversal",
      "title": "Summary: Path Traversal",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires path usage and file access analysis."
    },
    {
      "id": "path_traversal_or_encoded_traversal_in_file_ops",
      "title": "Path Traversal - ../ or Encoded Traversal in File Ops",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs data-flow analysis."
    },
    {
      "id": "summary_file_upload_vulnerabilities",
      "title": "Summary: File Upload Vulnerabilities",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires upload handling analysis."
    },
    {
      "id": "file_upload_vulns_missing_content_type_extension_validation",
      "title": "File Upload Vulns - Missing Content-type/extension Validation",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs handler analysis."
    },
    {
      "id": "summary_directory_traversal",
      "title": "Summary: Directory Traversal",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires path handling analysis."
    },
    {
      "id": "directory_traversal_unsanitized_path_joins",
      "title": "Directory Traversal - Unsanitized Path Joins",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs data-flow analysis."
    },
    {
      "id": "summary_access_control_testing",
      "title": "Summary: Access Control Testing",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires authz logic analysis."
    },
    {
      "id": "access_control_testing_missing_auth_guards_on_endpoints",
      "title": "Access Control Testing - Missing Auth Guards on Endpoints",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs route/middleware analysis."
    },
    {
      "id": "summary_broken_auth_testing",
      "title": "Summary: Broken Auth Testing",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires auth flow analysis."
    },
    {
      "id": "broken_auth_testing_weak_password_mfa_policies",
      "title": "Broken Auth Testing - Weak Password/MFA Policies",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs policy inspection."
    },
    {
      "id": "summary_api_auth_token_testing",
      "title": "Summary: API Auth/token Testing",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires API auth flow analysis."
    },
    {
      "id": "api_auth_token_testing_jwt_validation_and_scopes",
      "title": "API Auth/token Testing - JWT Validation and Scopes",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs auth middleware analysis."
    },
    {
      "id": "summary_cloud_security_checks",
      "title": "Summary: Cloud Security Checks",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires IaC/cloud config analysis."
    },
    {
      "id": "cloud_security_checks_iam_storage_network_policies",
      "title": "Cloud Security Checks - IAM/storage/network Policies",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs IaC parsing."
    },
    {
      "id": "summary_container_k8s_security",
      "title": "Summary: Container/K8s Security",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires Docker/K8s manifest analysis."
    },
    {
      "id": "container_k8s_security_privileged_and_rbac_checks",
      "title": "Container/K8s Security - Privileged and RBAC Checks",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs manifest parsing."
    },
    {
      "id": "summary_code_scanning_sast",
      "title": "Summary: Code Scanning (SAST)",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "yes",
      "current_support": "partial",
      "notes": "Static scans possible; regex covers limited patterns."
    },
    {
      "id": "code_scanning_regex_detection_of_dangerous_apis",
      "title": "Code Scanning - Regex Detection of Dangerous APIs",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "yes",
      "current_support": "partial",
      "notes": "Current scanner supports limited patterns."
    },
    {
      "id": "summary_dep_vulnerability_scanning",
      "title": "Summary: Dep Vulnerability Scanning",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires manifest parsing + CVE data."
    },
    {
      "id": "dep_scanning_lockfile_version_cve_mapping",
      "title": "Dep Scanning - Lockfile Version + CVE Mapping",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires external data."
    },
    {
      "id": "summary_threat_modeling",
      "title": "Summary: Threat Modeling",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires architecture/context modeling."
    },
    {
      "id": "threat_modeling_attack_surface_and_data_flow_mapping",
      "title": "Threat Modeling - Attack Surface and Data Flow Mapping",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs system modeling."
    },
    {
      "id": "summary_business_logic_pentesting",
      "title": "Summary: Business Logic Pentesting",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires workflow/domain analysis."
    },
    {
      "id": "business_logic_pentesting_abuse_flow_modeling",
      "title": "Business Logic Pentesting - Abuse Flow Modeling",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs domain logic analysis."
    },
    {
      "id": "summary_compliance_scans_pci_gdpr_iso",
      "title": "Summary: Compliance Scans (PCI, GDPR, ISO)",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires policy and data classification."
    },
    {
      "id": "compliance_scans_map_controls_to_code_config",
      "title": "Compliance Scans - Map Controls to Code/config",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs governance mapping."
    },
    {
      "id": "summary_pii_detection",
      "title": "Summary: PII Detection",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires data classification and scanning."
    },
    {
      "id": "pii_detection_regex_detection_of_pii_in_logs_responses",
      "title": "PII Detection - Regex Detection of PII in Logs/responses",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs content scanning."
    },
    {
      "id": "summary_data_exposure_scan",
      "title": "Summary: Data Exposure Scan",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires response/log/config analysis."
    },
    {
      "id": "data_exposure_scan_sensitive_fields_in_responses",
      "title": "Data Exposure Scan - Sensitive Fields in Responses",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs schema/serializer analysis."
    },
    {
      "id": "summary_rate_limiting_brute_force_detection",
      "title": "Summary: Rate Limiting + Brute Force Detection",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Doc",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Requires auth and rate-limit analysis."
    },
    {
      "id": "rate_limit_brute_force_missing_throttling_on_auth",
      "title": "Rate Limit/brute Force - Missing Throttling on Auth",
      "section": "Summary Master List (Flat)",
      "owasp_category": "",
      "source": "Inferred",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Needs middleware analysis."
    },
    {
      "id": "gigw_plaintext_secrets",
      "title": "GIGW: Hardcoded passwords, tokens, or API keys in source",
      "section": "GIGW Code Security",
      "owasp_category": "A02",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "Look for plain-text secrets in .env committed to VCS, config/*.php, PHP class properties, or inline strings. Flag any password, token, API key, or DB credential hardcoded outside of environment variable references. GIGW Section 1A: No plain text passwords in config files, source code, or databases."
    },
    {
      "id": "gigw_error_handling",
      "title": "GIGW: Error handling must not expose source code or stack traces",
      "section": "GIGW Code Security",
      "owasp_category": "A05",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "Check APP_DEBUG=true in .env (must be false in production), missing custom error pages (resources/views/errors/), bare dd(), var_dump(), print_r() calls left in non-dev code, exception handlers that return raw stack traces in JSON responses. GIGW Section 1A: Custom error pages for all exceptions; never expose source code in error messages."
    },
    {
      "id": "gigw_secure_cookies",
      "title": "GIGW: Cookies must have Secure and HttpOnly flags",
      "section": "GIGW Code Security",
      "owasp_category": "A02",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "Check config/session.php — 'secure' must be true, 'http_only' must be true, 'same_site' must be 'lax' or 'strict'. Also check any setcookie() or cookie() calls missing these flags. GIGW Section 1A: Secure and HTTP-only cookies required."
    },
    {
      "id": "gigw_input_validation",
      "title": "GIGW: User input must be validated on both client and server side",
      "section": "GIGW Code Security",
      "owasp_category": "A03",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "Look for controller methods that use $request->input() or $_GET/$_POST without corresponding $request->validate() or FormRequest class. Client-side: Blade forms should have HTML5 validation attributes (required, pattern, type=email etc.). GIGW Section 1A: Sanitize user input at client AND server side; both syntactical and semantic validation."
    },
    {
      "id": "gigw_password_hashing",
      "title": "GIGW: Passwords must use salted hash — never plain text or weak hash",
      "section": "GIGW Code Security",
      "owasp_category": "A02",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "Flag md5(), sha1(), sha256() used directly on password values — these are weak for password storage. Passwords must use Hash::make(), bcrypt(), or password_hash() with PASSWORD_BCRYPT/PASSWORD_ARGON2I. Also check DB migrations — password columns should never be VARCHAR without evidence of hashing. GIGW Section 1A: All passwords encrypted with salted hash."
    },
    {
      "id": "gigw_password_policy",
      "title": "GIGW: Strong password policy must be enforced in code",
      "section": "GIGW Code Security",
      "owasp_category": "A07",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "Check Laravel validation rules for password fields — must include min:8 at minimum; ideally use Password::min(8)->mixedCase()->numbers()->symbols(). Flag password rules that only check 'min:6' or have no complexity requirements. GIGW Section 1A: Strong password policies required."
    },
    {
      "id": "gigw_password_recovery",
      "title": "GIGW: Password recovery mechanism must be secure",
      "section": "GIGW Code Security",
      "owasp_category": "A07",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "Check password reset flow: reset tokens must expire (config/auth.php passwords.users.expire), tokens must be one-time use (deleted after use), reset emails must not include plain-text passwords. Flag any route that emails a plain password or uses predictable reset tokens. GIGW Section 1A: Secure password recovery mechanisms."
    },
    {
      "id": "gigw_mfa_support",
      "title": "GIGW: Multi-factor authentication must be implemented for sensitive routes",
      "section": "GIGW Code Security",
      "owasp_category": "A07",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Look for MFA/2FA middleware (e.g., EnsureTwoFactorEnabled, 'verified' middleware from Fortify/Jetstream). Flag admin routes, account management routes, and sensitive data routes that lack any MFA check. Check if a TOTP library (google2fa, pragmarx/google2fa) is present. GIGW Section 1A: Multi-factor authentication (MFA) required."
    },
    {
      "id": "gigw_rbac_implementation",
      "title": "GIGW: Role-based access control with least privilege must be enforced",
      "section": "GIGW Code Security",
      "owasp_category": "A01",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Check that routes have appropriate middleware (auth, role:admin, can:permission). Look for Gate::define, Policy classes, and authorize() calls in controllers. Flag controller methods that perform sensitive operations without any RBAC check. Flag routes accessible to all authenticated users that should be admin-only. GIGW Section 1A: Role-based access control (RBAC) and principle of least privilege."
    },
    {
      "id": "gigw_session_management",
      "title": "GIGW: Session must expire, invalidate on logout, and regenerate on login",
      "section": "GIGW Code Security",
      "owasp_category": "A07",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "Check config/session.php: lifetime should be reasonable (not 0/unlimited), expire_on_close should be considered. Logout handler must call Auth::logout(), $request->session()->invalidate(), $request->session()->regenerateToken(). Login handler must call $request->session()->regenerate(). GIGW Section 1A: Session management — no active concurrent sessions on web server."
    },
    {
      "id": "gigw_https_enforcement",
      "title": "GIGW: HTTPS must be enforced and HSTS header must be set",
      "section": "GIGW Code Security",
      "owasp_category": "A05",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "Check for HTTP to HTTPS redirect middleware (RedirectIfNotHttps, TrustProxies, FORCE_HTTPS env). Check for Strict-Transport-Security header in middleware or web server config. Flag APP_URL starting with http:// instead of https://. GIGW Section 2: Enforce HTTPS with HSTS; disable HTTP."
    },
    {
      "id": "gigw_tls_configuration",
      "title": "GIGW: Weak TLS ciphers and protocols must be disabled",
      "section": "GIGW Code Security",
      "owasp_category": "A02",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Check .htaccess for SSLProtocol directives — SSLv2, SSLv3, TLSv1, TLSv1.1 must be excluded. Check nginx.conf for ssl_protocols — must only include TLSv1.2 TLSv1.3. Flag SSLCipherSuite or ssl_ciphers including 3DES, RC4, NULL, EXPORT ciphers. GIGW Section 2: Disable weak ciphers (SSLv2, SSLv3, 3DES, RC4, TLS v1.0, v1.1)."
    },
    {
      "id": "gigw_directory_traversal",
      "title": "GIGW: Path traversal must be prevented and directory listing disabled",
      "section": "GIGW Code Security",
      "owasp_category": "A01",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "Flag file_get_contents(), readfile(), include(), require() calls that use user-controlled input without path sanitization. Check .htaccess for 'Options -Indexes' to disable directory listing. Look for missing realpath() or basename() normalization before file path operations. GIGW Section 1A: Directory traversal disabled; redirect unauthorized path access to error pages."
    },
    {
      "id": "gigw_third_party_https",
      "title": "GIGW: All third-party API communications must use encrypted channels",
      "section": "GIGW Code Security",
      "owasp_category": "A02",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "Check Http:: (Laravel HTTP client), Guzzle, and curl calls — flag any using http:// instead of https://. Check CURLOPT_SSL_VERIFYPEER or CURLOPT_SSL_VERIFYHOST set to false (disables TLS verification). GIGW Section 1A: All 3rd party API communications via encrypted channels."
    },
    {
      "id": "gigw_logging_implementation",
      "title": "GIGW: Comprehensive audit logging must be present with no sensitive data logged",
      "section": "GIGW Code Security",
      "owasp_category": "A09",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Check Log:: calls — flag if passwords, tokens, or full request bodies containing credentials are logged. Verify that auth events (login, logout, failed login) are logged. Check config/logging.php for appropriate log channel and retention. Flag absence of logging around sensitive operations (role changes, data exports, admin actions). GIGW Section 1A: Implement comprehensive logging; periodic audit of web logs."
    },
    {
      "id": "gigw_db_credentials",
      "title": "GIGW: Database credentials must not be hardcoded in source",
      "section": "GIGW Code Security",
      "owasp_category": "A02",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "Check config/database.php and any PHP files — DB host, username, password, connection strings must reference env() or config() not hardcoded strings. Flag DB_PASSWORD in .env only if the file is committed to VCS (.gitignore should exclude .env). GIGW Section 1B: Secure database credentials; no hardcoded DB passwords."
    },
    {
      "id": "gigw_captcha_login",
      "title": "GIGW: CAPTCHA must be present on login and sensitive form pages",
      "section": "GIGW Code Security",
      "owasp_category": "A07",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Check login, registration, password reset, and contact Blade views for CAPTCHA integration (Google reCAPTCHA, hCaptcha, or custom). Look for captcha validation in controller methods or FormRequest classes. Flag login/public forms with no bot protection. GIGW Section 1A: CAPTCHA on login pages."
    },
    {
      "id": "gigw_rate_limiting",
      "title": "GIGW: Rate limiting must be applied to authentication and sensitive endpoints",
      "section": "GIGW Code Security",
      "owasp_category": "A07",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "Check routes/web.php and routes/api.php — login, password reset, OTP, and sensitive API routes must use throttle: middleware. Check RateLimiter definitions in App\\Providers\\RouteServiceProvider. Flag routes that accept credentials or perform sensitive actions with no throttle middleware. GIGW Section 1A: Strong password policies and brute force prevention."
    },
    {
      "id": "gigw_wcag_alt_text",
      "title": "GIGW WCAG 1.1.1: Images must have meaningful alt text",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates: flag <img> tags missing the alt attribute entirely. Flag <img> with empty alt='' only if the image appears to convey information (not purely decorative). Flag <img> where alt text is a filename (e.g., alt='image1.jpg') or generic ('image', 'photo'). GIGW 3.0 / WCAG 2.1 criterion 1.1.1."
    },
    {
      "id": "gigw_wcag_form_labels",
      "title": "GIGW WCAG 1.3.1 / 3.3.2: Form inputs must have associated visible labels",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates: flag <input>, <select>, <textarea> without a <label for='id'> matching their id, or without aria-label / aria-labelledby. Placeholder text alone does not count as a label. Flag Laravel form components that render inputs without label bindings. GIGW 3.0 / WCAG 2.1 criteria 1.3.1 and 3.3.2."
    },
    {
      "id": "gigw_wcag_html_lang",
      "title": "GIGW WCAG 3.1.1: HTML element must declare the page language",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "Check the main Blade layout file — the <html> element must have a lang attribute (e.g., lang='en' or lang='hi'). Flag <html> without lang, or with lang='' (empty). For Government of India sites, Hindi content pages must use lang='hi'. GIGW 3.0 / WCAG 2.1 criterion 3.1.1."
    },
    {
      "id": "gigw_wcag_language_parts",
      "title": "GIGW WCAG 3.1.2: Language changes within content must be marked with lang attribute",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In Blade templates: when Hindi, regional, or foreign language text appears inline within an English-language page, the wrapping element must have lang='hi' (or appropriate BCP 47 code). Flag blocks of Devanagari script or Hindi words embedded without a lang attribute change. GIGW 3.0 / WCAG 2.1 criterion 3.1.2."
    },
    {
      "id": "gigw_wcag_link_purpose",
      "title": "GIGW WCAG 2.4.4: Links must have descriptive text that identifies their destination",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates: flag <a> elements whose visible text is 'click here', 'here', 'read more', 'more', 'link', 'this', or similar non-descriptive phrases. Links must describe their destination or purpose. Icon-only links must have aria-label. GIGW 3.0 / WCAG 2.1 criterion 2.4.4."
    },
    {
      "id": "gigw_wcag_page_title",
      "title": "GIGW WCAG 2.4.2: Every page must have a unique, descriptive title",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "Check Blade layout files for <title> tag. Flag layouts using generic titles like 'Home', 'Page', or the site name alone. Child views should use @section('title') to provide page-specific titles. Government of India pages must include the department/ministry name. Flag @yield('title') that is never populated in child views. GIGW 3.0 / WCAG 2.1 criterion 2.4.2."
    },
    {
      "id": "gigw_wcag_heading_structure",
      "title": "GIGW WCAG 2.4.6: Headings must use proper H1-H6 hierarchy",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates: flag pages with multiple <h1> elements (should have exactly one). Flag skipped heading levels (e.g., h1 followed directly by h3). Flag heading tags used purely for visual styling rather than document structure. Headings must describe the topic of the following content. GIGW 3.0 / WCAG 2.1 criterion 2.4.6."
    },
    {
      "id": "gigw_wcag_aria_roles",
      "title": "GIGW WCAG 4.1.2: Interactive elements must have ARIA name, role, and state",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates: flag <div> or <span> elements used as buttons/controls without role='button' and aria-label. Flag custom dropdown/accordion/modal components lacking aria-expanded, aria-controls, aria-haspopup. Flag icon buttons (e.g., SVG with no text) without aria-label. Use semantic HTML (<button>, <a>) wherever possible instead of div-with-onclick. GIGW 3.0 / WCAG 2.1 criterion 4.1.2."
    },
    {
      "id": "gigw_wcag_focus_visible",
      "title": "GIGW WCAG 2.4.7: Keyboard focus indicator must be visible",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In CSS files: flag rules like 'outline: none', 'outline: 0', or 'outline: transparent' applied to :focus pseudo-class on interactive elements (a, button, input, select, textarea) without a replacement custom focus indicator. Removing the browser's default focus ring without providing an alternative violates this criterion. GIGW 3.0 / WCAG 2.1 criterion 2.4.7."
    },
    {
      "id": "gigw_wcag_autoplay_media",
      "title": "GIGW WCAG 1.4.2: Auto-playing audio or video must provide pause/stop controls",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates: flag <video autoplay> or <audio autoplay> elements that do not also have the controls attribute or an adjacent visible pause/stop button. Auto-playing media longer than 3 seconds without user control is a WCAG violation. GIGW 3.0 / WCAG 2.1 criterion 1.4.2."
    },
    {
      "id": "gigw_wcag_video_captions",
      "title": "GIGW WCAG 1.2.1 / 1.2.2: Video content must have captions or a text transcript",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates: flag <video> elements without a <track kind='captions'> or <track kind='subtitles'> child element. Also flag embedded YouTube/Vimeo iframes where no accompanying transcript link is present. GIGW 3.0 / WCAG 2.1 criteria 1.2.1 and 1.2.2."
    },
    {
      "id": "gigw_wcag_color_only",
      "title": "GIGW WCAG 1.4.1: Color must not be the only visual means of conveying information",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In Blade templates and CSS: flag required field indicators that use only a red CSS class with no asterisk (*) or text label. Flag status/alert elements (error, success, warning) that rely solely on background-color class names without an icon, text prefix, or aria-label distinguishing them. GIGW 3.0 / WCAG 2.1 criterion 1.4.1."
    },
    {
      "id": "gigw_wcag_error_text",
      "title": "GIGW WCAG 3.3.1: Form validation errors must be described in text, not only by color or icon",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates: flag @error / validation error display blocks that only apply a CSS class (e.g., 'is-invalid') to the input without rendering the actual error message text. Error messages must be visible text next to or associated with the errored field. Flag missing aria-describedby linking input to its error message. GIGW 3.0 / WCAG 2.1 criterion 3.3.1."
    },
    {
      "id": "gigw_wcag_error_suggestion",
      "title": "GIGW WCAG 3.3.3: Error messages must suggest how to correct the input",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In Blade templates and Laravel validation messages: flag generic error messages like 'Invalid input', 'Error', or 'Field required' without explaining the expected format. Good examples: 'Email must be in format name@domain.com', 'Password must be at least 8 characters'. Check lang/en/validation.php for overly terse messages. GIGW 3.0 / WCAG 2.1 criterion 3.3.3."
    },
    {
      "id": "gigw_wcag_autocomplete",
      "title": "GIGW WCAG 1.3.5: Personal data form fields must use autocomplete attributes",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates: flag <input> fields collecting personal information (name, email, phone, address, date of birth, ID numbers) without the autocomplete attribute. Expected values: autocomplete='name', 'email', 'tel', 'street-address', 'bday', etc. This enables browser autofill and assistive technology. GIGW 3.0 / WCAG 2.1 criterion 1.3.5."
    },
    {
      "id": "gigw_wcag_skip_navigation",
      "title": "GIGW WCAG 2.4.1: Skip-to-content navigation link must be present",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "Check the main Blade layout file — it must contain a skip link as the first focusable element: <a href='#main-content' class='sr-only focus:not-sr-only'>Skip to main content</a>. The target element must exist with id='main-content'. Flag layouts with no skip link mechanism. GIGW 3.0 / WCAG 2.1 criterion 2.4.1."
    },
    {
      "id": "gigw_wcag_iframe_title",
      "title": "GIGW WCAG 4.1.2: iframes must have a descriptive title attribute",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates: flag all <iframe> elements missing the title attribute or with a generic title ('iframe', 'frame', empty string). The title must describe the embedded content (e.g., title='Google Maps showing court location', title='YouTube video: Court proceedings overview'). GIGW 3.0 / WCAG 2.1 criterion 4.1.2."
    },
    {
      "id": "gigw_wcag_table_headers",
      "title": "GIGW WCAG 1.3.1: Data tables must have proper header cells with scope",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates: flag <table> elements used for tabular data without <thead> and <th> elements. <th> cells should have scope='col' (for column headers) or scope='row' (for row headers). Flag tables where <td> is used for headers, or tables with no column headings at all. Do not flag layout tables (though layout tables themselves are a separate accessibility concern). GIGW 3.0 / WCAG 2.1 criterion 1.3.1."
    },
    {
      "id": "gigw_wcag_status_messages",
      "title": "GIGW WCAG 4.1.3: Status and error messages must use ARIA live regions",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates: flag flash message containers, toast notifications, and inline form success/error messages that do not have aria-live='polite' (for non-urgent) or aria-live='assertive' (for urgent/errors), or role='status' / role='alert'. These allow screen readers to announce dynamic content without requiring focus. GIGW 3.0 / WCAG 2.1 criterion 4.1.3."
    },
    {
      "id": "gigw_wcag_keyboard_trap",
      "title": "GIGW WCAG 2.1.2: Keyboard focus must not be trapped inside any component",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In Blade templates and JavaScript: flag modal dialogs, dropdown menus, and custom widgets that do not implement keyboard escape (Escape key closes) or provide an explicit close button reachable by Tab. Check JS event listeners on modals for keydown Escape handling. Modals should trap focus within themselves while open but allow Escape to close. GIGW 3.0 / WCAG 2.1 criterion 2.1.2."
    },
    {
      "id": "gigw_wcag_responsive",
      "title": "GIGW WCAG 1.4.10: Content must be responsive and reflow without horizontal scrolling at 320px",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "Check Blade layout files for <meta name='viewport' content='width=device-width, initial-scale=1'>. Flag viewport meta with user-scalable=no or maximum-scale=1 which prevents pinch-zoom. In CSS: flag fixed-width containers wider than 320px that would cause horizontal scroll. GIGW 3.0 / WCAG 2.1 criterion 1.4.10 (Reflow)."
    },
    {
      "id": "gigw_wcag_text_resize",
      "title": "GIGW WCAG 1.4.4: Text must resize to 200% without loss of content or functionality",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In CSS files: flag font-size declarations using px units for body text (prefer rem or em). Flag fixed-height containers (height: 40px) that would clip text when browser zoom is used. Text containers should use min-height instead of height when they contain user-facing text content. GIGW 3.0 / WCAG 2.1 criterion 1.4.4."
    },
    {
      "id": "gigw_wcag_audio_description",
      "title": "GIGW WCAG 1.2.3 / 1.2.5: Pre-recorded video must have an audio description track",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates: flag <video> elements that lack a <track kind='descriptions'> child element. Audio descriptions narrate visual-only information (actions, scene changes, on-screen text) for blind/low-vision users. Also flag embedded YouTube iframes with no accompanying text description of the video's visual content. GIGW 3.0 / WCAG 2.1 criteria 1.2.3 and 1.2.5."
    },
    {
      "id": "gigw_wcag_orientation",
      "title": "GIGW WCAG 1.3.4: Content must not lock to a single screen orientation",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade layout files: flag <meta name='viewport'> containing 'user-scalable=no' or 'maximum-scale=1' as these block orientation changes and pinch-zoom. In CSS: flag @media orientation rules that hide or completely block core page content rather than adapting layout. Exception: apps where a fixed orientation is essential (e.g., a piano keyboard). GIGW 3.0 / WCAG 2.1 criterion 1.3.4."
    },
    {
      "id": "gigw_wcag_images_of_text",
      "title": "GIGW WCAG 1.4.5: Real text must be used instead of images of text",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates: flag <img> elements whose alt text is a full sentence or paragraph — this signals the image is carrying text content that should be real HTML text instead. Flag banners, notices, or headings rendered as images containing readable text. Especially important for Hindi/regional language content that is often embedded as images. Exception: logos and brand names. GIGW 3.0 / WCAG 2.1 criterion 1.4.5."
    },
    {
      "id": "gigw_wcag_text_spacing",
      "title": "GIGW WCAG 1.4.12: Content must remain usable when users override text spacing",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In CSS files: flag letter-spacing, word-spacing, or line-height set in px units (prefer unitless multipliers or em/rem). Flag !important on these properties which prevents user accessibility overrides. Content must remain functional when: line-height is 1.5x font size, paragraph spacing is 2x font size, letter spacing is 0.12x font size, word spacing is 0.16x font size. GIGW 3.0 / WCAG 2.1 criterion 1.4.12."
    },
    {
      "id": "gigw_wcag_character_shortcuts",
      "title": "GIGW WCAG 2.1.4: Single-character keyboard shortcuts must be remappable or disableable",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates and HTML: flag elements using the accesskey attribute with a single character (e.g., accesskey='s') without a mechanism to turn it off or remap it. In JavaScript: flag single-character keydown/keyup listeners (e.g., key === 'f') that trigger actions without checking for Ctrl/Alt/Meta modifiers — these conflict with screen reader keyboard shortcuts. GIGW 3.0 / WCAG 2.1 criterion 2.1.4."
    },
    {
      "id": "gigw_wcag_multiple_ways",
      "title": "GIGW WCAG 2.4.5: Multiple ways must be provided to locate pages within the site",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade layout files: check that at least two of the following exist — a search form/input, a sitemap link, a table of contents, or a hierarchical navigation menu. Flag layouts where neither a search box nor a sitemap link appears in the header or footer. Government sites must allow users to find information through multiple navigation paths. GIGW 3.0 / WCAG 2.1 criterion 2.4.5."
    },
    {
      "id": "gigw_wcag_label_in_name",
      "title": "GIGW WCAG 2.5.3: Accessible name must contain the visible label text of the control",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates: flag elements where aria-label or aria-labelledby provides a name that does not include the element's visible text. Example: a button with visible text 'Submit' and aria-label='Send form data' — the aria-label must contain 'Submit'. This enables speech control users who speak the visible label to activate controls. Flag icon buttons where aria-label contradicts adjacent visible text. GIGW 3.0 / WCAG 2.1 criterion 2.5.3."
    },
    {
      "id": "gigw_wcag_error_prevention",
      "title": "GIGW WCAG 3.3.4: Critical form submissions must be reversible, checked, or confirmed",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In Blade templates and controllers: flag forms submitting legal, financial, or personal data (payment, application, registration, document submission forms) without a confirmation/review step before final submit, a success page with undo option, or client-side validation with a review summary. Look for multi-step form patterns — absence of a review step before final submission is a finding. GIGW 3.0 / WCAG 2.1 criterion 3.3.4."
    },
    {
      "id": "gigw_wcag_parsing",
      "title": "GIGW WCAG 4.1.1: HTML must be valid — no duplicate IDs, unclosed tags, or improper nesting",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates: flag duplicate id= attribute values within the same template or layout (e.g., two elements sharing id='submit-btn'). Flag self-closing block elements (e.g., <div/>). Flag obvious unclosed tags. Duplicate IDs break ARIA relationships (aria-labelledby, aria-describedby) causing screen readers to target the wrong element. GIGW 3.0 / WCAG 2.1 criterion 4.1.1."
    },
    {
      "id": "gigw_quality_govt_emblem",
      "title": "GIGW Quality 1: Government emblem/logo must be displayed prominently on the homepage",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade layout header files: check for an <img> referencing the Government of India emblem or court seal (filenames containing 'emblem', 'logo', 'ashoka', 'satyamev', 'seal', or similar). Flag layouts where no government emblem image is present in the header. For High Court sites also check for the court seal. Must appear in correct ratio and colour per GoI visual identity standards. GIGW 3.0 Quality checkpoint 1."
    },
    {
      "id": "gigw_quality_ownership_info",
      "title": "GIGW Quality 2: Owning ministry or department name must be clearly shown on the homepage",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade layout header/footer files: check for visible text identifying the owning body — ministry name, department name, or court name (e.g., 'High Court of Rajasthan', 'Government of India', 'Ministry of...'). Flag layouts with no ownership attribution. GIGW mandates every government website must clearly identify its operating authority. GIGW 3.0 Quality checkpoint 2."
    },
    {
      "id": "gigw_quality_last_updated",
      "title": "GIGW Quality 5: A last updated or last reviewed date must be shown on the homepage",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In Blade homepage/layout views: look for text containing 'Last Updated', 'Last Reviewed', 'Updated on', 'As on', or a dynamic date variable rendered in the footer or content area. Flag homepages with no date mechanism. Check if a Laravel controller or config provides a site-last-updated date to the view. GIGW 3.0 Quality checkpoint 5."
    },
    {
      "id": "gigw_quality_download_metadata",
      "title": "GIGW Quality 6: Downloadable file links must show title, file size, and format",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates: flag <a href='...pdf'>, <a href='...doc'>, <a href='...xls'> links where the link text does not mention the file format and approximate size. Correct example: 'Annual Report 2023 (PDF, 2.4 MB)'. Incorrect: 'Download', 'Click here', or a bare filename. File format and size help users decide before downloading, which is especially important on slow/metered mobile connections. GIGW 3.0 Quality checkpoint 6."
    },
    {
      "id": "gigw_quality_about_us",
      "title": "GIGW Quality 9: An About Us section must be present and linked from navigation",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade layout/nav files: check for a navigation or footer link with text 'About', 'About Us', 'About the Court', 'Parichay', 'Hum Kaun Hain', or equivalent. Check routes/web.php for an '/about' route. Flag sites where no About Us page or route exists. The section must describe the organisation, its mandate, and key officials. GIGW 3.0 Quality checkpoint 9."
    },
    {
      "id": "gigw_quality_contact_us",
      "title": "GIGW Quality 10: A Contact Us page must be linked from the homepage navigation",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade layout/nav files: check for a navigation or footer link with text 'Contact', 'Contact Us', 'Sampark Karein', or equivalent. Check routes/web.php for a '/contact' route. Flag sites with no contact page or contact link in navigation. The Contact Us page must include address, phone, email, and responsible functionary details. GIGW 3.0 Quality checkpoint 10."
    },
    {
      "id": "gigw_quality_help_section",
      "title": "GIGW Quality 14: A Help or FAQ section must be linked from all pages",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In the main Blade layout file (used sitewide): check the header or footer for a Help link with text 'Help', 'FAQs', 'Sahayata', 'User Guide', or 'How to Use'. Check routes/web.php for a '/help' or '/faq' route. Flag layouts where no help or FAQ link appears in the sitewide header/footer. GIGW 3.0 Quality checkpoint 14."
    },
    {
      "id": "gigw_quality_national_portal",
      "title": "GIGW Quality 12: A link to the National Portal of India (india.gov.in) must be present",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade layout footer/header files: check for an <a href> containing 'india.gov.in'. The link must open in a new tab (target='_blank'). Flag layouts with no National Portal link. This is a mandatory requirement for all Government of India and state government websites. GIGW 3.0 Quality checkpoint 12."
    },
    {
      "id": "gigw_quality_domain",
      "title": "GIGW Quality 21: Website domain must be registered under nic.in or gov.in",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Check APP_URL in .env and config/app.php — the domain must end in .nic.in, .gov.in, .court.gov.in, or eligible variants (edu.in, res.in, ac.in for institutions). Flag APP_URL using commercial TLDs (.com, .in, .org, .net) which are not permitted for official Indian government websites. GIGW 3.0 Quality checkpoint 21."
    },
    {
      "id": "gigw_quality_social_media",
      "title": "GIGW Quality 24: Official social media platform links must be present on the website",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade layout footer/header files: check for links to official social media accounts (Twitter/X, Facebook, YouTube, Instagram, Koo). Flag sites with no social media links. Social media links must point to official government accounts — flag links to personal or unofficial accounts. Links should open in a new tab (target='_blank') and have descriptive aria-label. GIGW 3.0 Quality checkpoint 24."
    },
    {
      "id": "gigw_lifecycle_policy_pages",
      "title": "GIGW Lifecycle 3: Required policy pages must be present and linked in the footer",
      "section": "GIGW Lifecycle Management",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade layout footer: check for links to all required policy pages — Privacy Policy, Terms & Conditions, Copyright Policy, Hyperlinking Policy, Accessibility Statement, and Website Policies. Check routes/web.php for corresponding routes. Flag any missing required policy link. These pages must be approved by the Web Information Manager (WIM). GIGW 3.0 Lifecycle checkpoint 3."
    },
    {
      "id": "gigw_lifecycle_language_selector",
      "title": "GIGW Lifecycle 10: Bilingual support with a prominent language selector must be present",
      "section": "GIGW Lifecycle Management",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade layout header files: check for a language toggle or selector allowing switching between English and Hindi (and any other regional language). Look for a <select> with language options, or navigation links like 'हिन्दी' / 'English'. Flag layouts with no language selector. Also verify <meta charset='UTF-8'> is set in the layout head for Unicode support. GIGW 3.0 Lifecycle checkpoint 10."
    },
    {
      "id": "gigw_lifecycle_no_broken_links",
      "title": "GIGW Lifecycle 7: No broken or empty placeholder links should be present",
      "section": "GIGW Lifecycle Management",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates: flag <a href='#'> used as a real navigation link (not a scroll-to anchor), <a href=''> with empty href, and bare <a> tags with no href used as navigation. Also flag href='javascript:void(0)' used for page navigation rather than functional JS triggers. These represent dead navigation paths that frustrate users and fail GIGW compliance. GIGW 3.0 Lifecycle checkpoint 7."
    },
    {
      "id": "gigw_lifecycle_no_under_construction",
      "title": "GIGW Lifecycle 8: No under construction or coming soon placeholder pages",
      "section": "GIGW Lifecycle Management",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates and route files: flag views or route responses containing text like 'Under Construction', 'Coming Soon', 'Page Under Development', 'Work in Progress', 'Content will be added soon', or similar placeholder messages. Check routes/web.php for routes returning stub views. All linked pages must have actual content. GIGW 3.0 Lifecycle checkpoint 8."
    },
    {
      "id": "gigw_lifecycle_accessible_documents",
      "title": "GIGW Lifecycle 9: Documents must be in HTML or accessible digital formats, not scanned images",
      "section": "GIGW Lifecycle Management",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In Blade templates: flag download links where filenames suggest scanned documents (e.g., 'scan_', 'scanned_', 'img_', 'photo_' prefixes). Government documents must be text-based HTML or searchable PDFs — not image-only PDFs which are inaccessible to screen readers. Also flag bare .doc/.docx links where an HTML or accessible PDF alternative should be provided alongside. GIGW 3.0 Lifecycle checkpoint 9."
    },
    {
      "id": "gigw_quality_feedback_mechanism",
      "title": "GIGW Quality 5: Feedback mechanism with auto-acknowledgment must be present",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "Check routes/web.php for a /feedback or /contact route accepting POST requests. In the controller: verify a FormRequest or mail/notification dispatch is called on submission. Check Blade templates for a feedback form with fields for name, email, and message. Flag sites with no feedback form or where the form handler has no backend mail/notification processing (no Mail::send, Notification::send, or event dispatch). Auto-acknowledgment means the submitter receives a confirmation email. GIGW 3.0 Quality checkpoint 5."
    },
    {
      "id": "gigw_quality_sitemap",
      "title": "GIGW Quality 12: Sitemap must be present — HTML for users and XML for search engines",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "Check routes/web.php for a /sitemap.xml route or a static public/sitemap.xml file. Check for an HTML sitemap page commonly linked in the footer as 'Sitemap' or 'Site Map'. Flag sites with no XML sitemap at /sitemap.xml and no HTML sitemap linked from footer. Look for sitemap-generating packages in composer.json (spatie/laravel-sitemap or similar). XML sitemap must list all public page URLs. GIGW 3.0 Quality checkpoint 12."
    },
    {
      "id": "gigw_quality_site_search",
      "title": "GIGW Quality 13: Internal site search must be present on all pages",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade layout files (layouts/app.blade.php, partials/header.blade.php): look for a <form> with method='get' and action pointing to a search route, or a search input with role='search', id/name containing 'search', or aria-label='Search'. Check routes/web.php for a /search route. Flag layouts missing any search input in the header or navigation area. GIGW 3.0 Quality checkpoint 13."
    },
    {
      "id": "gigw_quality_seo_metadata",
      "title": "GIGW Quality 14: Pages must have SEO metadata — description and Open Graph tags",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade layouts and page views: check for <meta name='description' content='...'> with non-empty, non-generic content. Check for Open Graph tags: og:title, og:description, og:url. Flag layouts where meta description is missing entirely or contains only placeholder text. Check if @section('meta') or @stack('meta') is used in the layout to allow per-page overrides. Flag pages where <title> is generic (e.g., just the site name with no page-specific text). GIGW 3.0 Quality checkpoint 14."
    },
    {
      "id": "gigw_quality_breadcrumb",
      "title": "GIGW Quality 15: Breadcrumb navigation must be present on all inner pages",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates for inner/detail pages (not the homepage): look for breadcrumb markup — <nav aria-label='breadcrumb'>, <ol class='breadcrumb'>, or a ul/ol with the class or id 'breadcrumb'. Check for breadcrumb packages in composer.json (diglactic/laravel-breadcrumbs, tabuna/breadcrumbs). Flag inner page templates with no breadcrumb navigation at all — breadcrumbs help users orient themselves and are required by GIGW. GIGW 3.0 Quality checkpoint 15."
    },
    {
      "id": "gigw_quality_content_expiry",
      "title": "GIGW Quality 6: Time-sensitive content must have expiry dates and be auto-archived",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In database migrations for notices, tenders, circulars, and announcements: check for an expires_at, valid_until, or expiry_date timestamp column. In controllers or model scopes: verify listing queries filter by expiry (where('expires_at', '>', now()) or a scope like active()). In Blade templates for tender/notice listings: check for visible expiry date display. Flag content models with no expiry mechanism where all content is shown indefinitely. GIGW 3.0 Quality checkpoint 6."
    },
    {
      "id": "gigw_quality_source_citation",
      "title": "GIGW Quality 7: Reproduced content must cite source — title, owner, and publication year",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In Blade templates where external documents, reports, or publications are displayed or linked: check for attribution text near the content (e.g., 'Source:', 'Courtesy:', 'Published by:', or a citation block). Flag download links to externally authored reports or publications with no accompanying source/owner/year citation. GIGW mandates that reproduced content always credits the original author, owning organisation, and publication year. GIGW 3.0 Quality checkpoint 7."
    },
    {
      "id": "gigw_quality_download_file_safety",
      "title": "GIGW Quality 8: Downloadable files must be scanned for malware before publishing",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In file upload controllers and storage service classes: check for virus or malware scanning integration (e.g., ClamAV via league/flysystem-clamav, a cloud AV API call, or a custom scanner step after upload). Flag upload handlers that move files directly to disk or cloud storage with no intermediate malware scan step. Look for 'antivirus', 'clamav', 'virus', or 'malware' references in composer.json or service classes. GIGW 3.0 Quality checkpoint 8."
    },
    {
      "id": "gigw_quality_print_friendly",
      "title": "GIGW Quality 16: Pages must be print-friendly with A4-compatible layout",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In public CSS files or <style> blocks in Blade layouts: check for @media print { } rules that define print-specific layout. Flag sites with no @media print stylesheet. Print styles should hide navigation bars, sidebars, footers, and ads (display:none), and preserve the main content area with appropriate margins. GIGW mandates A4-compatible print layouts so citizens can print government content reliably. GIGW 3.0 Quality checkpoint 16."
    },
    {
      "id": "gigw_quality_responsive_design",
      "title": "GIGW Quality 17: Website must be responsive and render correctly across all device resolutions",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade layouts: check for <meta name='viewport' content='width=device-width, initial-scale=1'> in <head>. In CSS: flag hardcoded fixed-pixel widths above 900px on main container elements without media query overrides. Verify the project uses Bootstrap, Tailwind, or custom responsive CSS with breakpoints. Check for a mobile hamburger menu or collapsible navigation for small screens. Flag sites missing the viewport meta tag entirely — this is the most common cause of non-responsive rendering. GIGW 3.0 Quality checkpoint 17."
    },
    {
      "id": "gigw_quality_unicode_support",
      "title": "GIGW Quality 18: Website must support Unicode and render multilingual content correctly",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade layout <head>: verify <meta charset='UTF-8'> is present. Check database migrations for VARCHAR/TEXT columns storing Hindi or regional language content — should use utf8mb4 charset in MySQL migrations. In config/database.php: charset should be 'utf8mb4' and collation 'utf8mb4_unicode_ci'. Flag charset declarations other than UTF-8/utf8mb4. Flag pages where Hindi content may have encoding issues (garbled characters or question marks). GIGW 3.0 Quality checkpoint 18."
    },
    {
      "id": "gigw_quality_functionary_details",
      "title": "GIGW Quality 3: Contact Us and About Us must include named functionary with designation",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In the About Us and Contact Us Blade views: check for presence of named officials with their designation (e.g., 'Secretary', 'Director', 'Webmaster', 'Nodal Officer'). Flag generic contact pages with only a generic contact form and no named responsible person. The page must include at minimum: functionary name, designation, phone number or email. GIGW requires that citizens can identify a real accountable person, not just a generic helpdesk. GIGW 3.0 Quality checkpoint 3."
    },
    {
      "id": "gigw_quality_accessibility_statement",
      "title": "GIGW Quality 19: An accessibility conformance statement must be published and linked",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade footer: check for a link to an Accessibility Statement page. The statement must declare WCAG 2.1 Level AA conformance status, list any known limitations, provide a contact for reporting accessibility issues, and include the date of last review. Check routes/web.php for /accessibility or /accessibility-statement route. Flag sites with no accessibility statement link in the footer. This is mandatory under GIGW 3.0 and the Rights of Persons with Disabilities Act 2016. GIGW 3.0 Quality checkpoint 19."
    },
    {
      "id": "gigw_quality_screen_reader_link",
      "title": "GIGW Quality 20: A link to free screen reader software must be present on the homepage",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade homepage or layout header: check for a link to a free screen reader download — commonly NVDA (nvaccess.org) or the government-recommended screen reader. This link typically appears in the accessibility toolbar at the top of the page alongside text size controls and high-contrast toggles. Flag homepages with no screen reader software link. GIGW mandates providing assistive technology access links to help users with visual impairments. GIGW 3.0 Quality checkpoint 20."
    },
    {
      "id": "gigw_quality_stqc_certification",
      "title": "GIGW Quality 25: STQC Certified Quality Website badge must be displayed",
      "section": "GIGW Quality",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade layout footer or header: check for a link or image referencing the STQC Certified Quality Website (CQW) certificate or badge. The badge typically links to stqcertifications.gov.in for verification. Flag government websites with no STQC CQW badge — this certification is mandatory for fully GIGW-compliant government websites and must be renewed annually. GIGW 3.0 Quality checkpoint 25."
    },
    {
      "id": "gigw_wcag_color_contrast",
      "title": "GIGW WCAG 1.4.3: Text must meet minimum color contrast ratio of 4.5:1",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In CSS files and Blade inline styles: flag foreground/background color combinations that are likely to fail the 4.5:1 contrast ratio requirement. Look for light grey text on white backgrounds (e.g., color:#999, color:#aaa, color:#bbb, color:#ccc on white or near-white backgrounds). Flag muted text used for hints, captions, or placeholder labels. Also check high-contrast mode toggle — sites should offer an accessible high-contrast theme. This is WCAG 2.1 criterion 1.4.3 — one of the most frequently failed accessibility checks on government sites. GIGW 3.0 / WCAG 2.1."
    },
    {
      "id": "gigw_wcag_sensory_characteristics",
      "title": "GIGW WCAG 1.3.3: Instructions must not rely solely on shape, size, color, or position",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In Blade templates: flag instruction or help text that references only a visual characteristic without including the element's name or label. Examples to flag: 'Click the round button', 'See the red field on the right', 'Use the icon below', 'The button at the top'. Instructions must include the accessible name or label of the element (e.g., 'Click the Submit button' not 'Click the green button'). WCAG 2.1 criterion 1.3.3. GIGW 3.0."
    },
    {
      "id": "gigw_wcag_timing_adjustable",
      "title": "GIGW WCAG 2.2.1: Session timeouts must warn users and allow extension",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In config/session.php and JavaScript files: check for session timeout warning mechanisms. If 'lifetime' in config/session.php is 30 minutes or less, verify there is a timeout warning modal or prompt in Blade/JS that fires before the session expires and offers to extend it. Flag multi-step forms or long-running processes (document upload, application forms) where a silent session timeout could cause data loss with no warning. WCAG 2.1 criterion 2.2.1. GIGW 3.0."
    },
    {
      "id": "gigw_wcag_pause_stop_hide",
      "title": "GIGW WCAG 2.2.2: Moving or auto-updating content must have pause, stop, or hide controls",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates: flag carousels, sliders, news tickers, announcement marquees, and auto-rotating image banners that have no visible pause or stop button. Check Bootstrap carousel components using data-ride='carousel' or data-bs-ride='carousel' with no accompanying pause control. Flag <marquee> elements (deprecated but common on older government sites). Flag JavaScript setInterval-driven animations with no stop mechanism. Any content that moves or updates automatically for more than 5 seconds must provide a user control to pause or stop it. WCAG 2.1 criterion 2.2.2. GIGW 3.0."
    },
    {
      "id": "gigw_wcag_three_flashes",
      "title": "GIGW WCAG 2.3.1: No content should flash more than three times per second",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In Blade templates and public JavaScript: flag animations or CSS @keyframes that produce rapid blinking or flashing effects. Look for CSS animation-duration values under 333ms combined with alternate or reverse animation direction. Flag JavaScript setInterval calls with intervals below 333ms driving visual toggle effects. Flag <blink> tags (deprecated but still found on legacy government portals). Rapidly flashing content can trigger seizures in users with photosensitive epilepsy. WCAG 2.1 criterion 2.3.1. GIGW 3.0."
    },
    {
      "id": "gigw_wcag_focus_order",
      "title": "GIGW WCAG 2.4.3: Keyboard tab order must follow a logical reading sequence",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates: flag elements with positive tabindex attribute values (tabindex='1', tabindex='2', tabindex='3', etc.). Positive tabindex values override natural DOM tab order and are a common source of confusing keyboard navigation — screen reader users will jump unpredictably around the page. Only tabindex='0' (to make non-interactive elements focusable) and tabindex='-1' (to exclude elements from tab order) should be used. Natural DOM source order should determine the logical focus sequence. WCAG 2.1 criterion 2.4.3. GIGW 3.0."
    },
    {
      "id": "gigw_wcag_descriptive_headings",
      "title": "GIGW WCAG 2.4.6: Headings and labels must be descriptive and meaningful",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In Blade templates: flag headings that are generic or non-descriptive — e.g., <h2>Section</h2>, <h3>Details</h3>, <h4>Information</h4>, <h2>More</h2>. Headings must describe the topic or purpose of the section that follows. Also flag <label> text that only says 'Enter here', 'Input', or duplicates the placeholder attribute without being independently meaningful. Descriptive headings enable screen reader users to navigate page structure efficiently. WCAG 2.1 criterion 2.4.6. GIGW 3.0."
    },
    {
      "id": "gigw_wcag_pointer_gestures",
      "title": "GIGW WCAG 2.5.1: Multi-point or path-based gestures must have a single-pointer alternative",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In JavaScript files: flag touch event handlers that require multi-touch gestures (pinch-to-zoom, spread, two-finger rotate) or path-based gestures (swipe-only navigation, drag-only file upload) without providing an equivalent button or single-click alternative. Look for gesturestart, gesturechange event listeners, or touch handlers implementing swipe-only gallery navigation. All functionality triggered by complex gestures must also be achievable with a single pointer (click/tap). WCAG 2.1 criterion 2.5.1. GIGW 3.0."
    },
    {
      "id": "gigw_wcag_pointer_cancellation",
      "title": "GIGW WCAG 2.5.2: Irreversible actions must not be triggered on pointer down-event",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In JavaScript files: flag event listeners using mousedown or touchstart (rather than click/mouseup) to trigger irreversible actions such as form submission, payment confirmation, file deletion, or data export. The mousedown/touchstart fires before the user can cancel by moving the pointer away — click fires only when the pointer is released on the same element, allowing cancellation. Flag patterns like element.addEventListener('mousedown', submitForm) or element.addEventListener('touchstart', deleteRecord). WCAG 2.1 criterion 2.5.2. GIGW 3.0."
    },
    {
      "id": "gigw_wcag_motion_actuation",
      "title": "GIGW WCAG 2.5.4: Device-motion triggered functionality must have a UI control alternative",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In JavaScript files: flag use of DeviceMotionEvent or DeviceOrientationEvent listeners that trigger application functionality (e.g., shaking to refresh content, tilting to scroll, gyroscope-based navigation). Such motion-triggered actions must also be achievable through a standard on-screen UI control (button, link, or toggle). Additionally, verify that motion-triggered functionality can be disabled — users with motor disabilities or those with devices mounted on wheelchairs cannot intentionally shake the device. WCAG 2.1 criterion 2.5.4. GIGW 3.0."
    },
    {
      "id": "gigw_wcag_on_focus",
      "title": "GIGW WCAG 3.2.1: Focusing an element must not automatically trigger a context change",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates and JavaScript: flag onfocus event handlers that cause navigation, form submission, popup launch, or major layout changes. Look for: onfocus='location.href=...', onfocus='this.form.submit()', $('input').on('focus', function() { window.open(...) }), or <select> dropdowns with onchange='window.location=this.value' (also covers 3.2.2). Focusing an element (by tab or click) should only move the visual focus indicator — it must not trigger any automatic action. WCAG 2.1 criterion 3.2.1. GIGW 3.0."
    },
    {
      "id": "gigw_wcag_on_input",
      "title": "GIGW WCAG 3.2.2: Changing a field value must not automatically submit or navigate",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates: flag <select> or <input type='radio'> or <input type='checkbox'> elements with onchange='this.form.submit()' or JavaScript that auto-submits a form when a dropdown selection changes. Flag auto-redirect on dropdown selection (e.g., language selectors that redirect without a Go button, department selectors that navigate immediately). Users must be able to change a field value and review it before triggering the action — a Submit/Go button must be present. WCAG 2.1 criterion 3.2.2. GIGW 3.0."
    },
    {
      "id": "gigw_wcag_consistent_navigation",
      "title": "GIGW WCAG 3.2.3: Navigation menus must appear in the same order across all pages",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates: verify that the primary navigation is defined in a shared layout file (layouts/app.blade.php or partials/header.blade.php) and included consistently across all pages via @extends and @include. Flag pages that override or reorder navigation items in their individual templates rather than using the shared layout component. Check that header, search bar, and breadcrumb appear in the same position across different page types (homepage, listing page, detail page). WCAG 2.1 criterion 3.2.3. GIGW 3.0."
    },
    {
      "id": "gigw_wcag_consistent_identification",
      "title": "GIGW WCAG 3.2.4: Components with the same function must be identified consistently across pages",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In Blade components and templates: flag the same functional action labeled differently on different pages — e.g., a download button labeled 'Download' on one page but 'Save' or 'Get' on another for the same action type. Flag search inputs with different placeholder text or ARIA labels across pages. Flag the same icon (magnifying glass, printer, download arrow) assigned different aria-labels on different pages. Consistent labelling allows screen reader users to predict functionality across pages. WCAG 2.1 criterion 3.2.4. GIGW 3.0."
    },
    {
      "id": "gigw_lifecycle_content_review_policy",
      "title": "GIGW Lifecycle 1: A content review and audit policy must be implemented in the CMS",
      "section": "GIGW Lifecycle Management",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Look for evidence of a content review workflow in the codebase: a review_status, reviewed_at, or approved_by field in CMS-related database migrations. Check for admin panel features implementing content approval workflow (e.g., a draft/pending/published state machine on content models). Check for scheduled artisan commands that audit or flag stale content. Flag CMS implementations where all content is published immediately with no review or approval step — government content requires editorial oversight before going live. GIGW 3.0 Lifecycle checkpoint 1."
    },
    {
      "id": "gigw_lifecycle_archival_policy",
      "title": "GIGW Lifecycle 2: An archival policy for expired content must be implemented",
      "section": "GIGW Lifecycle Management",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In database migrations and Eloquent model classes: check for an archived_at column, is_archived boolean flag, or a soft-delete (SoftDeletes trait) pattern on content models (notices, tenders, circulars, news). Check for scheduled artisan commands or cron jobs that auto-archive content past its expiry date. Content must be archived — not deleted — so it remains accessible for historical and RTI compliance purposes. Flag content models with no archive or expiry mechanism. GIGW 3.0 Lifecycle checkpoint 2."
    },
    {
      "id": "gigw_lifecycle_wim_nomination",
      "title": "GIGW Lifecycle 4: A Website Information Manager (WIM) must be designated and contactable",
      "section": "GIGW Lifecycle Management",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Check the About Us, Contact Us, or footer Blade templates for a named Website Information Manager (WIM) or Webmaster listing with name, designation, and contact email. Look for admin user roles in the database or config that designate a WIM. Flag sites with no named person formally responsible for the website — GIGW 3.0 mandates that every government website must have a designated WIM who is accountable for content quality, accessibility, and lifecycle compliance. GIGW 3.0 Lifecycle checkpoint 4."
    },
    {
      "id": "gigw_lifecycle_govt_platform_integration",
      "title": "GIGW Lifecycle 5: Integration with national eGovernance platforms must be provided where applicable",
      "section": "GIGW Lifecycle Management",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Check composer.json and service class files for integration references to national eGov platforms: DigiLocker (digilocker.gov.in API) for document verification, UMANG for mobile service delivery, MyGov for citizen engagement, or Aadhaar-based authentication via UIDAI API. Check routes/web.php or API route files for /digilocker, /umang, /aadhaar-auth, or /mygov endpoints. For government websites handling citizen services or document issuance, at least one national platform integration is expected. GIGW 3.0 Lifecycle checkpoint 5."
    },
    {
      "id": "gigw_lifecycle_cert_in_clearance",
      "title": "GIGW Lifecycle 6: Website must obtain CERT-In Safe-to-Host cybersecurity clearance",
      "section": "GIGW Lifecycle Management",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Check footer and homepage Blade templates for a CERT-In safe-to-host badge or clearance reference. Look for a security audit or clearance document linked from the site. Check docs/ or README for references to VAPT reports, CERT-In audits, or safe-to-host letters. Government websites in India must obtain a Safe-to-Host certificate from CERT-In (under MeitY) before going live and after major changes. Flag sites with no evidence of any cybersecurity clearance. GIGW 3.0 Lifecycle checkpoint 6."
    },
    {
      "id": "gigw_security_headers",
      "title": "GIGW: HTTP security response headers must be set — CSP, X-Frame-Options, and MIME type protection",
      "section": "GIGW Code Security",
      "owasp_category": "A05",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "Check middleware files (app/Http/Middleware/), .htaccess, nginx.conf, and web server config for security response headers. Required headers: Content-Security-Policy (CSP), X-Frame-Options (must be DENY or SAMEORIGIN), X-Content-Type-Options (must be nosniff), Referrer-Policy (no-referrer or strict-origin-when-cross-origin), Permissions-Policy. Flag sites with none of these headers configured. In Laravel: look for a custom security headers middleware or a package like bepsvpt/secure-headers in composer.json. GIGW 3.0 Security / CERT-In advisory."
    },
    {
      "id": "gigw_csp_strict",
      "title": "GIGW: Content Security Policy must restrict unsafe-inline scripts and unsafe-eval",
      "section": "GIGW Code Security",
      "owasp_category": "A05",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In security headers middleware, .htaccess, or nginx config: check the Content-Security-Policy header value. Flag if CSP is missing entirely. Flag if script-src contains 'unsafe-inline' without a nonce or hash-based override — this defeats XSS protection. Flag if script-src contains 'unsafe-eval' — permits eval() and related dangerous functions. A strict CSP must use nonces (@csrf equivalent for scripts) or restrict script-src to trusted CDN domains. Check Blade templates for inline <script> blocks that would necessitate 'unsafe-inline'. GIGW 3.0 Security / CERT-In."
    },
    {
      "id": "gigw_xframe_clickjacking",
      "title": "GIGW: X-Frame-Options or CSP frame-ancestors must prevent clickjacking",
      "section": "GIGW Code Security",
      "owasp_category": "A05",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "Check HTTP response headers set in middleware or web server config: X-Frame-Options must be set to DENY (preferred for government sites) or SAMEORIGIN. Alternatively, Content-Security-Policy must include frame-ancestors 'none' or frame-ancestors 'self'. Flag sites where neither X-Frame-Options nor frame-ancestors is configured — without this, the site can be embedded in a malicious iframe to trick users into clicking on hidden government actions (clickjacking). Check .htaccess for Header set X-Frame-Options or nginx add_header X-Frame-Options. GIGW 3.0 Security / OWASP A05."
    },
    {
      "id": "gigw_vapt_evidence",
      "title": "GIGW: Evidence of Vulnerability Assessment and Penetration Testing (VAPT) must be present",
      "section": "GIGW Code Security",
      "owasp_category": "A05",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Look for VAPT-related references in the codebase and documentation: security audit report files in docs/, a security.txt file at /.well-known/security.txt listing a responsible disclosure or CERT-In contact, a penetration test report reference in README, or a vulnerability disclosure policy page. Flag government websites with no evidence of VAPT having been conducted — CERT-In mandates that government websites undergo VAPT before going live and periodically thereafter (at least annually). GIGW 3.0 Security."
    },
    {
      "id": "gigw_cert_in_incident_reporting",
      "title": "GIGW: Cyber incident reporting mechanism and CERT-In security contact must be configured",
      "section": "GIGW Code Security",
      "owasp_category": "A09",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Check for a /.well-known/security.txt file listing a security contact email and CERT-In reporting link. Look for a /security-policy or /report-vulnerability route in routes/web.php. Check if the site has a dedicated security contact listed in the footer or About page. CERT-In mandates that government websites report cybersecurity incidents within 6 hours of detection — having a documented incident reporting contact and process is required. Flag sites with no security.txt, no security contact, and no incident response reference. GIGW 3.0 Security / CERT-In Directions 2022."
    },
    {
      "id": "gigw_mandate_rti",
      "title": "GIGW Mandate: RTI (Right to Information) section must be present and linked from navigation",
      "section": "GIGW Government Mandates",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade navigation and footer: check for a link to an RTI section or page. The RTI page must include: name and contact details of the Central/State Public Information Officer (CPIO/SPIO), First Appellate Authority details, RTI application procedure and fees, and Section 4 proactive disclosures (organisational structure, functions, budget, schemes, etc.). Check routes/web.php for /rti route. Flag any government website with no RTI section — this is a legal obligation under the Right to Information Act 2005 for all public authorities. GIGW Government Mandate / RTI Act 2005."
    },
    {
      "id": "gigw_mandate_grievance_redressal",
      "title": "GIGW Mandate: Public grievance redressal mechanism must be present and operational",
      "section": "GIGW Government Mandates",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade navigation or footer: check for a Grievance Redressal or Public Grievance link. Look for integration with CPGRAMS (cpgrams.gov.in) via an embedded link or iframe. Alternatively, a dedicated /grievance route with a complaint submission form, a unique tracking ID system per grievance, defined resolution timelines, and a status check feature. Flag government websites with no grievance mechanism — mandated by DoPT (Department of Personnel and Training) for all central government websites. State government bodies must have a state-level equivalent. GIGW Government Mandate / DoPT Directive."
    },
    {
      "id": "gigw_mandate_citizen_charter",
      "title": "GIGW Mandate: Citizen Charter must be published for service-delivering government bodies",
      "section": "GIGW Government Mandates",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade navigation or dedicated section: check for a Citizen Charter link. The document must specify: services offered by the department, service delivery timelines and standards, responsible officer for each service, and grievance redressal mechanism. Check routes/web.php for /citizen-charter route. Flag government departments or ministries with no Citizen Charter — mandated by DARPG (Department of Administrative Reforms and Public Grievances) for all public service-delivering bodies. GIGW Government Mandate / DARPG directive."
    },
    {
      "id": "gigw_mandate_disclaimer",
      "title": "GIGW Mandate: Disclaimer page must be present and linked from the footer",
      "section": "GIGW Government Mandates",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade footer layout: check for a Disclaimer link separate from the Privacy Policy and Terms of Use. The disclaimer page must state the government's limitations of liability for website content accuracy, availability, and external links. Check routes/web.php for /disclaimer route. Flag government websites with no disclaimer page linked from footer. The disclaimer protects the government organisation from legal liability while informing citizens of content limitations. GIGW 3.0 Lifecycle checkpoint 3 / Government Mandate."
    },
    {
      "id": "gigw_mandate_copyright",
      "title": "GIGW Mandate: Government copyright notice must be present on all pages",
      "section": "GIGW Government Mandates",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade layout footer: check for copyright text attributing website content to the Government of India or the relevant Ministry/Department (e.g., '© Ministry of Law and Justice | Government of India' or '© Rajasthan High Court, All Rights Reserved'). Flag sites with no copyright notice in the footer, or with a generic copyright notice that does not name the government authority. The copyright notice must include the current year or year range. GIGW 3.0 Government Mandate."
    },
    {
      "id": "gigw_mandate_hyperlinking_policy",
      "title": "GIGW Mandate: Hyperlinking policy must be published and linked from footer",
      "section": "GIGW Government Mandates",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade footer: check for a Hyperlinking Policy link. The policy must explain: conditions for third-party websites linking to the government site, a disclaimer for external links from the government site (the government does not endorse linked external sites), and the process for requesting permission to link to the site. Check routes/web.php for /hyperlinking-policy route. Flag government websites with no hyperlinking policy linked from footer. GIGW 3.0 Lifecycle checkpoint 3 / Government Mandate."
    },
    {
      "id": "gigw_mandate_terms_of_use",
      "title": "GIGW Mandate: Terms of Use must be published and linked — separate from Privacy Policy",
      "section": "GIGW Government Mandates",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade footer: check for a Terms of Use or Terms and Conditions link — this must be a separate page from the Privacy Policy. The Terms of Use must cover: acceptable use of the website, reproduction and reuse of government content (typically licensed under NGOAL — National Government Open Access License), and user obligations and prohibited uses. Check routes/web.php for /terms-of-use or /terms route. Flag government sites with no Terms of Use page, or where Terms and Privacy Policy are combined into a single page. GIGW 3.0 Lifecycle checkpoint 3."
    },
    {
      "id": "gigw_mandate_annual_reports",
      "title": "GIGW Mandate: Annual reports and official publications must be accessible and linked",
      "section": "GIGW Government Mandates",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In Blade navigation or a dedicated Publications/Reports section: check for links to Annual Reports. Verify that linked PDF files are not image-only scanned documents (check filename patterns like 'scan_annual_report.pdf'). Annual reports must be text-based, searchable PDFs to be accessible under GIGW. Check that at least the three most recent annual reports are available. Flag Ministry or Department websites with no Annual Report section — proactive disclosure of annual reports is required under RTI Section 4 and GIGW Quality guidelines. GIGW Government Mandate / RTI Act 2005 Section 4."
    },
    {
      "id": "gigw_wcag_audio_only_transcript",
      "title": "GIGW WCAG 1.2.1: Audio-only and video-only prerecorded content must have a text alternative",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In Blade templates: flag <audio> elements or links to .mp3/.wav/.ogg audio files that have no accompanying transcript link or inline text alternative. Flag standalone audio announcements, speeches, or press briefings published without a text transcript. For video-only content (silent video): flag <video> elements with no text description of what the video conveys visually. Government portals commonly publish audio announcements and ceremony recordings — all must have text alternatives for deaf and hard-of-hearing users. WCAG 2.1 criterion 1.2.1. GIGW 3.0."
    },
    {
      "id": "gigw_wcag_live_captions",
      "title": "GIGW WCAG 1.2.4: Live audio or video streams must have real-time captions",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In Blade templates: flag embedded live streaming players (YouTube Live embeds, JW Player, or custom HLS players) that have no indication of live caption support. Look for live webcast, live press conference, or virtual hearing embed sections. Check if the player has caption/subtitle controls enabled. Flag live stream embeds where captions are not mentioned or enabled. Government press conferences, budget sessions, and public hearings streamed live must provide real-time captions for accessibility. WCAG 2.1 criterion 1.2.4. GIGW 3.0."
    },
    {
      "id": "gigw_wcag_meaningful_sequence",
      "title": "GIGW WCAG 1.3.2: Reading and navigation sequence must be meaningful without CSS",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In Blade templates: flag layouts where the DOM source order does not match the visual reading order. Common failures: navigation placed at the bottom of the DOM but visually floated to the top; sidebar content placed before main content in the DOM; CSS-only column reordering using float or flexbox order property that inverts source order. Screen readers follow DOM order — if DOM order differs from visual order, the reading experience becomes illogical. Flag use of CSS order property or negative margins that cause significant visual vs. DOM sequence mismatch. WCAG 2.1 criterion 1.3.2. GIGW 3.0."
    },
    {
      "id": "gigw_wcag_audio_control",
      "title": "GIGW WCAG 1.4.2: Auto-playing audio must provide a stop, pause, or mute control",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade templates: flag <audio autoplay> or <audio> elements with JavaScript autoplay triggers that have no visible stop, pause, or volume/mute control within the first 3 seconds of the page. Also flag background music or ambient audio set to autoplay via JavaScript (new Audio().play()) without an accessible mute control. Auto-playing audio conflicts with screen readers — users relying on a screen reader cannot hear it over background audio. Flag any audio that begins playing automatically on page load without a user control. WCAG 2.1 criterion 1.4.2. GIGW 3.0."
    },
    {
      "id": "gigw_wcag_keyboard_accessible",
      "title": "GIGW WCAG 2.1.1: All page functionality must be operable by keyboard alone",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In Blade templates and JavaScript: flag interactive elements that rely exclusively on mouse events with no keyboard equivalent. Look for onclick handlers on non-focusable elements (div, span, li) without a corresponding keydown/keypress handler or tabindex='0' and role attribute. Flag drag-and-drop file upload areas with no button-based alternative. Flag custom dropdown menus, date pickers, and sliders that have no keyboard interaction handling (arrow keys, Enter, Escape). All functionality available by mouse must also be achievable by keyboard navigation alone. WCAG 2.1 criterion 2.1.1. GIGW 3.0."
    },
    {
      "id": "gigw_wcag_non_text_contrast",
      "title": "GIGW WCAG 1.4.11: UI components and graphical objects must meet 3:1 contrast ratio",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In CSS files: flag form input borders, button outlines, icon strokes, and focus ring colors that are likely below a 3:1 contrast ratio against their adjacent background. Common failures: light grey form borders (#ccc, #ddd) on white backgrounds, thin grey button outlines, or icon-only controls in light grey on white. The 3:1 ratio applies to the visual presentation of UI components (not text — that uses 4.5:1 under 1.4.3). Also flag focus indicator rings that are too thin or low contrast to be visible. WCAG 2.1 criterion 1.4.11. GIGW 3.0."
    },
    {
      "id": "gigw_wcag_hover_focus_content",
      "title": "GIGW WCAG 1.4.13: Tooltip and popover content must be dismissible, hoverable, and persistent",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In Blade templates and JavaScript: flag tooltip or popover implementations that disappear when the user moves the pointer over the tooltip content itself (not hoverable). Flag tooltips that cannot be dismissed without moving focus (no Escape key handler to close the tooltip). Flag tooltips that auto-dismiss after a short timeout while the user is still reading. Bootstrap tooltips and popovers must have keyboard dismiss support (Escape). Custom tooltip implementations must: (1) remain visible when pointer moves from trigger to tooltip, (2) be dismissible via Escape key, (3) persist until dismissed or trigger loses focus. WCAG 2.1 criterion 1.4.13. GIGW 3.0."
    },
    {
      "id": "gigw_accessibility_toolbar",
      "title": "GIGW: Accessibility toolbar with text-size controls and high-contrast toggle must be present",
      "section": "GIGW Accessibility (WCAG 2.1)",
      "owasp_category": "",
      "source": "GIGW",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Blade layout header: check for an accessibility toolbar or widget at the top of every page providing: (1) Text size controls — typically A- (decrease), A (reset), A+ (increase) buttons that adjust base font size via JavaScript; (2) High-contrast mode toggle — switches to a high-contrast CSS theme (dark background, bright text) for users with low vision. This toolbar is a GIGW-specific mandatory requirement for all Indian government websites beyond what WCAG requires. Flag layouts with no accessibility toolbar in the header. Also check for a skip-to-accessibility-options link if the toolbar is not the first focusable element. GIGW 3.0 Quality / Accessibility mandate."
    },
    {
      "id": "wcag21_alt_text",
      "title": "WCAG 1.1.1: Images and icons must have meaningful text alternatives",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In JSX/TSX (React/Next.js): flag <img> tags missing the alt prop, or with alt='' on non-decorative images, or with alt containing a filename or generic text ('image', 'photo', 'icon'). Flag icon-only <button> elements missing aria-label or aria-labelledby. In SVG: flag <svg> elements used as meaningful graphics without a <title> element or aria-label. In Vue SFCs: flag <img> without :alt or alt binding. In Angular templates: flag <img> without [attr.alt] or alt. Decorative images must use alt='' (empty string) and role='presentation'. WCAG 2.1 criterion 1.1.1."
    },
    {
      "id": "wcag21_form_labels",
      "title": "WCAG 1.3.1 / 3.3.2: Every form input must have a programmatically associated label",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In JSX/TSX: flag <input>, <select>, <textarea> elements without an associated <label htmlFor=...> matching the input's id, or without aria-label, or without aria-labelledby pointing to a visible label element. Placeholder text alone does not satisfy labelling — flag inputs relying solely on placeholder. In React component libraries: check form primitives for aria-label pass-through. In Vue: flag <input> without a bound label or aria-label. In Angular: check Reactive Forms controls for associated label elements. WCAG 2.1 criteria 1.3.1 and 3.3.2."
    },
    {
      "id": "wcag21_page_title",
      "title": "WCAG 2.4.2: Every page must have a unique, descriptive document title",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In React/Next.js: check for <Head><title> usage from next/head, or react-helmet/react-helmet-async — flag pages missing a <title> update or using the same generic title across routes. In Vue/Nuxt: check vue-meta or useHead() usage. In Angular: check for Title service injection and setTitle() calls per route. In single-page apps: flag applications where document.title is never updated on route changes — screen reader users rely on title announcements to confirm navigation. WCAG 2.1 criterion 2.4.2."
    },
    {
      "id": "wcag21_heading_structure",
      "title": "WCAG 1.3.1 / 2.4.6: Heading levels must form a logical hierarchy without skipping",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In JSX/TSX, Vue templates, Angular templates: flag heading level skips — jumping from h1 to h3 without an h2, or from h2 to h4. Flag pages with multiple <h1> elements (each page should have exactly one h1 representing the main page topic). Flag headings used purely for visual sizing (using h4 because it looks smaller) rather than semantic hierarchy. Flag component libraries using div or span where h2/h3 semantics are needed. WCAG 2.1 criteria 1.3.1 and 2.4.6."
    },
    {
      "id": "wcag21_link_purpose",
      "title": "WCAG 2.4.4: Links must have descriptive accessible names that convey their destination",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In JSX/TSX, Vue, Angular templates: flag <a> or <Link> elements with generic link text — 'click here', 'read more', 'learn more', 'here', 'link', 'more'. Flag icon-only links (e.g., an arrow or external link icon with no text) missing aria-label. Flag links whose accessible name is only a URL string. When multiple links share the same visible text but point to different destinations (e.g., multiple 'View details' links in a list), each must have a unique aria-label distinguishing the target. WCAG 2.1 criterion 2.4.4."
    },
    {
      "id": "wcag21_color_contrast",
      "title": "WCAG 1.4.3: Normal text must meet 4.5:1 contrast ratio; large text must meet 3:1",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In CSS/SCSS/Tailwind/styled-components/CSS Modules: flag foreground color values on light or dark backgrounds that are likely to fail contrast thresholds. Common failures: muted text (text-gray-400 on white in Tailwind, color:#999 on white), disabled-state text with insufficient contrast, placeholder text styled with opacity <0.7. Flag light-on-light or dark-on-dark colour combinations in theme tokens. For Tailwind: flag text-gray-300, text-gray-400, text-gray-500 on white or bg-white. For CSS-in-JS: flag color values in the #aaa–#ccc range on white backgrounds. WCAG 2.1 criterion 1.4.3."
    },
    {
      "id": "wcag21_non_text_contrast",
      "title": "WCAG 1.4.11: UI components and graphical objects must meet 3:1 contrast ratio",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In CSS/SCSS/Tailwind/design tokens: flag button border colours, form input borders, icon stroke colours, and focus ring colours that are likely below 3:1 contrast ratio against adjacent backgrounds. Common failures: light grey input borders (border-gray-200, border:#ddd) on white backgrounds; icon-only actions using light grey icons; focus rings using a thin browser-default outline without enhancement. In Tailwind: flag ring-gray-200, border-gray-200, text-gray-300 on white for interactive components. WCAG 2.1 criterion 1.4.11."
    },
    {
      "id": "wcag21_focus_visible",
      "title": "WCAG 2.4.7: Keyboard focus indicator must be visually apparent on all interactive elements",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In CSS/SCSS/Tailwind: flag global or component-level CSS rules that remove focus outlines — outline: none, outline: 0, or :focus { outline: none } without a custom visible focus replacement. In Tailwind: flag focus:outline-none without an accompanying focus:ring-* class providing a visible alternative. In styled-components or CSS modules: flag &:focus { outline: none } applied to buttons, links, or inputs. Any custom component must show a clear focus indicator when keyboard-navigated — box-shadow, outline, or border change are all acceptable if visible. WCAG 2.1 criterion 2.4.7."
    },
    {
      "id": "wcag21_keyboard_accessible",
      "title": "WCAG 2.1.1: All functionality must be operable by keyboard without requiring a mouse",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In JSX/TSX, Vue, Angular: flag interactive elements using onClick on non-focusable HTML (div, span, li, td) without a corresponding onKeyDown/onKeyPress handler and a tabIndex={0} or role attribute. Flag drag-and-drop-only file upload zones without a button alternative. Flag custom dropdown menus, carousels, tabs, and accordions that do not implement keyboard patterns — arrow key navigation for menus (role='menu'), Enter/Space for activation, Escape to close. Flag touch-only swipe gestures with no keyboard equivalent. WCAG 2.1 criterion 2.1.1."
    },
    {
      "id": "wcag21_keyboard_trap",
      "title": "WCAG 2.1.2: Keyboard focus must never be trapped inside a component without an exit path",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In JSX/TSX, Vue, Angular: check modal and dialog components — when a modal is open, focus must be constrained inside it (intentional trap) but must be releasable via Escape key or a visible Close button. Flag modals that trap focus with no Escape handler and no close button. Also flag non-modal components (dropdowns, date pickers, rich text editors) that capture Tab key and do not allow tabbing away. Look for focus-trap libraries (focus-trap, @radix-ui/react-dialog, headlessui) used correctly vs. custom implementations missing the Escape release. WCAG 2.1 criterion 2.1.2."
    },
    {
      "id": "wcag21_skip_navigation",
      "title": "WCAG 2.4.1: A skip-to-main-content link must be provided as the first focusable element",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In the root layout component (layout.tsx, App.vue, app.component.html): check for a skip navigation link as the first focusable element — an <a href='#main-content'> or similar that jumps past the navigation. The link may be visually hidden until focused (common pattern: sr-only class that becomes visible on :focus). Flag apps with no skip link — keyboard users must tab through the entire navigation on every page load without one. Verify the target element (id='main-content' or role='main') exists. WCAG 2.1 criterion 2.4.1."
    },
    {
      "id": "wcag21_focus_order",
      "title": "WCAG 2.4.3: Tab order must follow a logical reading sequence",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In JSX/TSX, Vue, Angular: flag elements with positive tabIndex values (tabIndex={1}, tabIndex={2}, tabIndex='3'). Positive tabindex overrides natural DOM order and causes unpredictable focus sequences — screen reader and keyboard users will jump around the page unexpectedly. Only tabIndex={0} (make element focusable in DOM order) and tabIndex={-1} (programmatically focusable only) are appropriate. Also flag CSS that visually reorders content using flexbox order or grid placement significantly diverging from DOM order. WCAG 2.1 criterion 2.4.3."
    },
    {
      "id": "wcag21_aria_roles",
      "title": "WCAG 4.1.2: Interactive elements must have appropriate ARIA name, role, and state",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In JSX/TSX, Vue, Angular: flag custom interactive components built from non-semantic elements (div, span) without appropriate ARIA role, aria-label/aria-labelledby, and state attributes. Flag custom toggle buttons missing role='button' and aria-pressed. Flag custom checkboxes/radios missing role='checkbox'/'radio' and aria-checked. Flag custom accordions missing role='button' and aria-expanded on the trigger. Flag tabs without role='tablist', role='tab', and aria-selected. Flag comboboxes without role='combobox', aria-expanded, aria-haspopup, and aria-controls linking to the option list. WCAG 2.1 criterion 4.1.2."
    },
    {
      "id": "wcag21_status_messages",
      "title": "WCAG 4.1.3: Dynamic status and error messages must use ARIA live regions",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In JSX/TSX, Vue, Angular: flag dynamically injected success/error/loading messages that lack aria-live='polite' or aria-live='assertive' on their container. Common SaaS patterns requiring live regions: form validation error summaries, API response notifications, search result counts updating as user types, shopping cart updates, and progress indicators. Flag toast notification containers without role='status' or aria-live. Flag error messages appearing after AJAX calls without live region announcement. WCAG 2.1 criterion 4.1.3."
    },
    {
      "id": "wcag21_color_only",
      "title": "WCAG 1.4.1: Information must not be conveyed by colour alone",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In JSX/TSX, Vue, Angular: flag status indicators, badges, and alerts that use only a colour class to convey state — e.g., a green/red dot with no text label or icon, a chart legend with colour swatches and no pattern/shape differentiation, required form fields marked only with a red border but no asterisk or 'required' label. Flag error states indicated solely by a red border on inputs with no accompanying error text. Colour changes must always be accompanied by text, icon, pattern, or shape to convey the same information. WCAG 2.1 criterion 1.4.1."
    },
    {
      "id": "wcag21_error_identification",
      "title": "WCAG 3.3.1 / 3.3.3: Form errors must be identified in text and suggest corrections",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In JSX/TSX, Vue, Angular: flag form validation error messages that: (1) appear only as a red border with no descriptive text, (2) display only a generic message like 'Invalid' with no explanation of what is wrong or how to fix it, (3) are not associated with the specific input via aria-describedby pointing to the error element id. Each error message must: identify the field in error, describe what is wrong, and suggest a correction where possible (e.g., 'Email must be in format name@example.com'). WCAG 2.1 criteria 3.3.1 and 3.3.3."
    },
    {
      "id": "wcag21_autocomplete",
      "title": "WCAG 1.3.5: Personal data inputs must declare their purpose via autocomplete attribute",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In JSX/TSX, Vue, Angular: flag <input> fields collecting personal information that are missing an autocomplete attribute. Required autocomplete values for common fields: name='name' autoComplete='name', email autoComplete='email', phone autoComplete='tel', address autoComplete='street-address', postal code autoComplete='postal-code', credit card autoComplete='cc-number', username autoComplete='username', new-password autoComplete='new-password', current-password autoComplete='current-password'. Flag login forms missing autoComplete='username' and autoComplete='current-password'. WCAG 2.1 criterion 1.3.5."
    },
    {
      "id": "wcag21_pause_stop_hide",
      "title": "WCAG 2.2.2: Auto-playing or moving content must have pause, stop, or hide controls",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In JSX/TSX, Vue, Angular: flag carousel/slider components (Swiper, react-slick, Splide) configured with autoplay=true and no visible pause button rendered. Flag animated number counters, stock tickers, or live data feeds that update continuously with no stop control. Flag CSS animations using animation-iteration-count: infinite on visible content (not purely decorative) with no pause mechanism. Flag video components set to autoPlay without controls or a custom play/pause button. Any content that moves automatically for longer than 5 seconds must be pausable by the user. WCAG 2.1 criterion 2.2.2."
    },
    {
      "id": "wcag21_table_accessibility",
      "title": "WCAG 1.3.1: Data tables must use proper headers and caption for screen reader navigation",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In JSX/TSX, Vue, Angular: flag <table> elements used for tabular data that are missing <th> header cells (using <td> for all cells), or where <th> elements are missing scope='col' or scope='row' attributes. Flag tables without a <caption> or aria-label describing the table purpose. Flag complex tables (with merged cells spanning multiple rows/columns) without id/headers attribute associations. Flag layout tables (used for visual alignment, not data) that are missing role='presentation' — these should be converted to CSS layouts. WCAG 2.1 criterion 1.3.1."
    },
    {
      "id": "wcag21_iframe_title",
      "title": "WCAG 4.1.2: Iframes must have a descriptive title attribute",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In JSX/TSX, Vue, Angular: flag <iframe> elements missing the title attribute or with a generic title value ('iframe', 'frame', 'embed'). The title must describe the content of the embedded document — e.g., title='Payment processing - Stripe', title='Google Maps showing office location', title='YouTube video: Product demo'. Flag embedded maps, payment widgets, chat widgets, and video players missing descriptive titles. Screen reader users navigate by frame title to understand what each embedded region contains. WCAG 2.1 criterion 4.1.2."
    },
    {
      "id": "wcag21_html_lang",
      "title": "WCAG 3.1.1: HTML element must declare the page language",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In Next.js: check pages/_document.tsx or app/layout.tsx for lang attribute on <html> — must be set (e.g., lang='en', lang='hi', lang='fr'). In Nuxt/Vue: check nuxt.config.ts htmlAttrs.lang or the root <html lang=...> declaration. In Angular: check index.html for <html lang=...>. In CRA React: check public/index.html for <html lang=...>. Flag applications where lang is missing entirely or set to an empty string. The lang attribute enables screen readers to apply correct pronunciation rules for the page language. WCAG 2.1 criterion 3.1.1."
    },
    {
      "id": "wcag21_text_resize",
      "title": "WCAG 1.4.4: Content must remain readable and functional when text is resized to 200%",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In CSS/SCSS/Tailwind: flag font sizes defined in px units for body text and UI text — these do not scale when the user changes their browser's base font size. Body and paragraph text must use rem or em units to respect user font size preferences. Flag fixed-height containers (height: 40px on text-containing divs) that will clip overflowing text when font size increases. In Tailwind: prefer text-base (1rem), text-lg (1.125rem) etc. over text-[14px] for user-scalable text. Fixed px is acceptable for decorative elements, borders, and spacing but not for text or text containers. WCAG 2.1 criterion 1.4.4."
    },
    {
      "id": "wcag21_responsive_reflow",
      "title": "WCAG 1.4.10: Content must reflow to a single column at 320px without horizontal scrolling",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In CSS/SCSS/Tailwind: check for <meta name='viewport'> in the HTML head — must be present with width=device-width. Flag fixed-width containers with pixel values above 320px on wrapper or layout elements that have no responsive override at small breakpoints. In Tailwind: flag w-[500px], w-96, max-w-none on full-page containers without sm: or md: prefixed responsive variants. Flag data tables without overflow-x-auto or a responsive wrapper that would force horizontal scrolling on small screens. WCAG 2.1 criterion 1.4.10."
    },
    {
      "id": "wcag21_orientation",
      "title": "WCAG 1.3.4: Content must not lock to a single screen orientation",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In CSS and JavaScript: flag CSS media queries using orientation: landscape or orientation: portrait to display: none major content blocks — if content is hidden in one orientation with no alternative, that is a failure. Flag JavaScript that reads screen.orientation and blocks rendering or shows an error in a particular orientation. In React Native Web or Capacitor-wrapped apps: flag orientation lock settings that force portrait or landscape. Users with mounted devices (wheelchair users with tablets fixed in a position) cannot rotate their device. WCAG 2.1 criterion 1.3.4."
    },
    {
      "id": "wcag21_parsing",
      "title": "WCAG 4.1.1: HTML must be valid — no duplicate IDs, proper nesting, complete tags",
      "section": "Accessibility (WCAG 2.1 AA)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In JSX/TSX, Vue, Angular: flag duplicate id attribute values within the same component or page template — duplicate IDs break ARIA relationships (aria-labelledby, aria-describedby, aria-controls all reference IDs). Flag improper element nesting: <p> containing <div>, <a> nested inside another <a>, <button> inside <button>, <li> outside <ul>/<ol>. Flag unclosed JSX/HTML tags. In React: id values generated dynamically in mapped lists must include the item's unique key to avoid duplicates. Use useId() hook (React 18+) or a library like uuid for ARIA relationship IDs. WCAG 2.1 criterion 4.1.1."
    },
    {
      "id": "wcag22_focus_appearance",
      "title": "WCAG 2.4.11: Focus indicator must meet minimum size and contrast requirements",
      "section": "Accessibility (WCAG 2.2)",
      "owasp_category": "",
      "source": "WCAG 2.2",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In CSS/SCSS/Tailwind: check :focus-visible styles on interactive elements. The focus indicator must: (1) have an area at least as large as a 2px perimeter of the unfocused element, and (2) have a contrast ratio of at least 3:1 between focused and unfocused states. Flag thin 1px outline focus rings without sufficient contrast (e.g., outline: 1px solid #999 on a white background). Flag focus indicators using opacity reduction rather than colour change. In Tailwind: ensure focus-visible:ring-2 focus-visible:ring-offset-2 with a visible ring colour. WCAG 2.2 criterion 2.4.11."
    },
    {
      "id": "wcag22_dragging_alternative",
      "title": "WCAG 2.5.7: Drag-and-drop actions must have a single-pointer alternative",
      "section": "Accessibility (WCAG 2.2)",
      "owasp_category": "",
      "source": "WCAG 2.2",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In JSX/TSX, Vue, Angular: flag drag-and-drop implementations (react-dnd, @dnd-kit/core, Vue Draggable, Angular CDK DragDrop) that have no single-click or keyboard-based alternative to accomplish the same task. Examples requiring alternatives: kanban board card reordering (provide 'Move to...' button menu), file reordering in a list (provide up/down arrow buttons), split-pane resizing (provide a numeric input or preset size buttons). The alternative does not need to be identical — just achievable without dragging. WCAG 2.2 criterion 2.5.7."
    },
    {
      "id": "wcag22_target_size",
      "title": "WCAG 2.5.8: Interactive targets must be at least 24×24 CSS pixels",
      "section": "Accessibility (WCAG 2.2)",
      "owasp_category": "",
      "source": "WCAG 2.2",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In CSS/SCSS/Tailwind: flag clickable elements (buttons, links, checkboxes, radio buttons, icon triggers) with explicit width or height below 24px. Common failures: icon-only action buttons styled as inline text (no padding), small close/dismiss icons (12px or 16px icons with no clickable padding), checkboxes or radio inputs with browser-default 13px sizing and no custom enlargement. In Tailwind: flag h-4 w-4 (16px) or h-5 w-5 (20px) without compensating padding (p-1 or p-2) on buttons. Targets below 24×24 must have sufficient spacing so the total click area (including offset to nearest target) meets requirements. WCAG 2.2 criterion 2.5.8."
    },
    {
      "id": "wcag22_consistent_help",
      "title": "WCAG 3.2.6: Help mechanisms must appear in the same location across all pages",
      "section": "Accessibility (WCAG 2.2)",
      "owasp_category": "",
      "source": "WCAG 2.2",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In the root layout or shell component: check that any help mechanism — live chat widget, help centre link, support phone number, FAQ link, contact us link — appears in the same position across all pages. Flag applications where a help button appears in the top-right on some pages but bottom-right on others, or is entirely absent on certain routes. The help mechanism must be in the shared layout component (not page-specific). Flag SaaS dashboards where chat widgets are conditionally hidden on certain pages. WCAG 2.2 criterion 3.2.6."
    },
    {
      "id": "wcag22_redundant_entry",
      "title": "WCAG 3.3.7: Users must not be required to re-enter information provided earlier in the session",
      "section": "Accessibility (WCAG 2.2)",
      "owasp_category": "",
      "source": "WCAG 2.2",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In multi-step form flows, checkout wizards, and registration sequences: flag steps that ask the user to re-enter information they already provided in an earlier step of the same session — e.g., billing address re-entered after a shipping address form, email confirmation field asking users to type their email twice, username re-entry after registration. Information should be auto-populated from session/store state, or the user must have the ability to select from previously provided data. Flag React multi-step form components where state is not persisted between steps. WCAG 2.2 criterion 3.3.7."
    },
    {
      "id": "wcag22_accessible_auth",
      "title": "WCAG 3.3.8: Authentication must not require solving a cognitive test without an alternative",
      "section": "Accessibility (WCAG 2.2)",
      "owasp_category": "",
      "source": "WCAG 2.2",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In login and authentication components: flag CAPTCHA implementations that require solving a visual puzzle, identifying objects in images, or solving math problems — with no accessible alternative (audio CAPTCHA, email/SMS OTP, or bypass for authenticated sessions). Flag custom 'prove you are human' challenges (drag slider to position, click on animals) with no accessible alternative. Standard image-based reCAPTCHA v2 without an audio alternative fails this criterion. reCAPTCHA v3 (invisible, score-based) or OTP-based verification are compliant alternatives. WCAG 2.2 criterion 3.3.8."
    },
    {
      "id": "saas_a11y_modal_dialog",
      "title": "SaaS A11y: Modal dialogs must implement full ARIA dialog pattern with focus management",
      "section": "Accessibility (SaaS Patterns)",
      "owasp_category": "",
      "source": "WAI-ARIA 1.2",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In JSX/TSX, Vue, Angular: check modal/dialog components for the complete ARIA dialog pattern: (1) role='dialog' or role='alertdialog' on the modal container, (2) aria-modal='true' to prevent virtual cursor from leaving the dialog, (3) aria-labelledby pointing to the dialog title element, (4) focus moves to the first focusable element or the dialog itself on open, (5) focus is trapped inside while open, (6) Escape key closes the dialog, (7) focus returns to the trigger element on close. Flag modal implementations using Radix UI, Headless UI, or custom solutions missing any of these. Flag modals using display:none toggling without managing focus. WAI-ARIA Dialog Pattern."
    },
    {
      "id": "saas_a11y_toast_notifications",
      "title": "SaaS A11y: Toast and snackbar notifications must be announced to screen readers",
      "section": "Accessibility (SaaS Patterns)",
      "owasp_category": "",
      "source": "WAI-ARIA 1.2",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In JSX/TSX, Vue, Angular: check toast/snackbar notification components (react-hot-toast, react-toastify, sonner, vue-toastification). The toast container must have aria-live='polite' for success/info messages or aria-live='assertive' for critical errors/alerts. Flag toast containers missing both aria-live and role='status'/role='alert'. Flag notifications that only appear visually with no screen reader announcement. Check that dismissible toasts have a visually accessible close button with aria-label='Dismiss notification'. Flag auto-dismissing toasts with durations shorter than 5 seconds — users need time to read and act. WAI-ARIA Live Region Pattern."
    },
    {
      "id": "saas_a11y_data_table",
      "title": "SaaS A11y: Interactive data tables must be fully keyboard navigable with accessible controls",
      "section": "Accessibility (SaaS Patterns)",
      "owasp_category": "",
      "source": "WAI-ARIA 1.2",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In JSX/TSX, Vue, Angular: check data table components (TanStack Table, AG Grid, Vuetify DataTable, Angular Material Table) for: (1) sortable column headers — must be <th> with role='button' or <button> inside, keyboard activatable with Enter/Space, and aria-sort='ascending'/'descending'/'none', (2) row selection — checkboxes must have accessible labels identifying the row, (3) pagination controls — previous/next buttons must have aria-label, current page announced via aria-current or aria-label, (4) row actions — action buttons/menus inside rows must have aria-labels identifying the row they act on (e.g., 'Delete John Smith'). WAI-ARIA Grid / Table Pattern."
    },
    {
      "id": "saas_a11y_infinite_scroll",
      "title": "SaaS A11y: Infinite scroll must have a keyboard-accessible load-more alternative",
      "section": "Accessibility (SaaS Patterns)",
      "owasp_category": "",
      "source": "WAI-ARIA 1.2",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In JSX/TSX, Vue, Angular: flag infinite scroll implementations (react-infinite-scroll-component, vue-infinite-loading, IntersectionObserver-based loading) that load content only on scroll with no keyboard-accessible alternative. A 'Load more' button must be available for keyboard users who cannot trigger scroll-based loading. The button must be in the tab order after the last loaded item. Flag implementations where newly loaded content is appended to the DOM without moving focus or announcing the new content count to screen readers (e.g., via aria-live='polite' announcing '10 more items loaded, 30 total'). WAI-ARIA Pattern."
    },
    {
      "id": "saas_a11y_combobox",
      "title": "SaaS A11y: Autocomplete and combobox widgets must follow the ARIA combobox pattern",
      "section": "Accessibility (SaaS Patterns)",
      "owasp_category": "",
      "source": "WAI-ARIA 1.2",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "In JSX/TSX, Vue, Angular: check autocomplete/typeahead/combobox components (Downshift, React Select, Headless UI Combobox, Vue Multiselect, Angular Material Autocomplete) for the ARIA combobox pattern: (1) role='combobox' on the input, (2) aria-expanded='true'/'false' reflecting dropdown state, (3) aria-haspopup='listbox', (4) aria-controls pointing to the listbox id, (5) role='listbox' on the options container, (6) role='option' on each option with aria-selected, (7) arrow keys navigate options, Enter selects, Escape collapses. Flag custom combobox implementations missing these ARIA attributes. WAI-ARIA Combobox Pattern 1.2."
    },
    {
      "id": "saas_a11y_date_picker",
      "title": "SaaS A11y: Date pickers must be keyboard operable or provide a text input fallback",
      "section": "Accessibility (SaaS Patterns)",
      "owasp_category": "",
      "source": "WAI-ARIA 1.2",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "In JSX/TSX, Vue, Angular: check date picker components (react-datepicker, @mui/x-date-pickers, Flatpickr, v-calendar, Angular Material Datepicker) for keyboard support: arrow keys to navigate dates, Enter to select, Escape to close. Flag date pickers with no accessible text input alternative — the calendar popup must be supplemented by a typed date input (type='date' or a formatted text input) for users who cannot operate the calendar widget. Flag date pickers missing aria-label on the calendar grid, navigation buttons (previous/next month), and individual date cells. WAI-ARIA Date Picker Dialog Pattern."
    },
    {
      "id": "saas_a11y_axe_integration",
      "title": "SaaS A11y: Automated accessibility testing must be integrated into the development workflow",
      "section": "Accessibility (SaaS Patterns)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "yes",
      "current_support": "no",
      "notes": "Check package.json devDependencies for automated accessibility testing tools: axe-core, @axe-core/react, jest-axe, @axe-core/playwright, @axe-core/cypress, pa11y, pa11y-ci, or eslint-plugin-jsx-a11y. Flag projects with no accessibility linting or testing tool present. eslint-plugin-jsx-a11y catches common issues at authoring time. jest-axe or @axe-core/playwright catch runtime violations in component and integration tests. Also check for Lighthouse CI configuration (lighthouserc.js) with accessibility assertions. The absence of any automated accessibility tool indicates no structured accessibility testing practice. WCAG 2.1 / ATAG 2.0."
    },
    {
      "id": "saas_a11y_vpat",
      "title": "SaaS A11y: Accessibility Conformance Report (VPAT/ACR) must be published for enterprise procurement",
      "section": "Accessibility (SaaS Patterns)",
      "owasp_category": "",
      "source": "WCAG 2.1",
      "static_feasible": "partial",
      "current_support": "no",
      "notes": "Check the codebase for a VPAT (Voluntary Product Accessibility Template) or ACR (Accessibility Conformance Report) document — typically stored as docs/VPAT.md, docs/accessibility-conformance-report.pdf, or linked from the public README. Check the public website routes for an /accessibility or /vpat page. Enterprise buyers (government agencies, large corporations) require a VPAT/ACR before purchasing SaaS products. The document must declare conformance level (Supports, Partially Supports, Does Not Support, Not Applicable) for each WCAG 2.1 AA success criterion. Flag SaaS products targeting enterprise or government markets with no VPAT documentation. WCAG 2.1 / Section 508 / EN 301 549."
    }
  ]
}
