Project FORGE is engineered with a Security-First philosophy. Every autonomously generated codebase is audited against multi-vector static security scanners and dependency vulnerability databases before delivery.

                                [Project Specification]
                                           │
                                           ▼
                              [Security-Aware Prompts]
                     • Strict typed input validation
                     • Parameterized SQL bindings (no string concatenation)
                     • Stack trace shielding on error responses
                     • Secure defaults & least privilege access
                     • CSRF & Security Headers (CSP, X-Frame-Options)
                                           │
                                           ▼
                                [Generated Codebase]
                                           │
                                           ▼
                              [OutputSecurityScanner]
                     (Runs BEFORE standard verification battery)
                                           │
         ┌───────────────────┬─────────────┴─────────────┬───────────────────┐
         ▼                   ▼                           ▼                   ▼
  [Secrets Scan]      [Dangerous AST]             [Injection Checks]  [CVE Dependency Scan]
   • AWS / OpenAI      • eval() / exec()           • SQL f-strings     • Local CVE DB match
   • Private keys      • os.system()               • SQL concat        • requirements.txt
   • Database URIs     • shell=True                • DOM innerHTML     • package.json
   • Redacted logs     • pickle.loads()            • React dangerously • Auto-remediation
                                           │
                                           ▼
                              [Severity Gating Engine]
                     • CRITICAL / HIGH ──► Blocks Delivery & Triggers Re-Synthesis
                     • MEDIUM / LOW    ──► Documented in verification_manifest.json

• Patterns Detected: AWS access keys (AKIA...), OpenAI API keys (sk-...), Anthropic tokens, GitHub PATs, RSA/OpenSSH private keys, plaintext database connection URIs with passwords, and generic password assignments.
• Automatic Redaction: All evidence and log outputs automatically mask matched secrets with ***REDACTED*** to prevent accidental credential leakage in reports.

• Python AST Inspection:
  • eval() and exec(): Flagged as CRITICAL.
  • subprocess.*(..., shell=True): Flagged as CRITICAL.
  • os.system(...): Flagged as HIGH.
  • pickle.loads(...) on untrusted input: Flagged as HIGH.
  • yaml.load(...) without Loader=SafeLoader: Flagged as HIGH.
• JavaScript AST Inspection:
  • Dynamic eval(): Flagged as CRITICAL.
  • child_process.exec(): Flagged as HIGH.

• SQL Injection:
  • Detects f-strings in queries: cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")
  • Detects string concatenation in queries: cursor.execute("SELECT * FROM users WHERE name = '" + name + "'")
  • Detects string formatting % or .format() in SQL.
• Cross-Site Scripting (XSS):
  • Detects unescaped assignments to .innerHTML.
  • Detects React dangerouslySetInnerHTML usage.

• Knowledge Base: Embedded database mapping popular packages (urllib3, requests, flask, jinja2, pillow, pyyaml, cryptography, lodash, express, jsonwebtoken, axios) to published CVE IDs and safe patched versions.
• Auto-Remediation: The engine automatically updates requirements.txt / package.json to the secure patched version and produces verified lockfiles (requirements.lock, package-lock.json).

• Detects unauthenticated state-changing routes (POST, PUT, DELETE) in administrative/management controllers.
• Detects leaked stack traces (traceback.format_exc()) in client error responses.

• Insecure:

    API_KEY = "<REDACTED_SECRET_EXAMPLE>"

• Secure:

  import os
  API_KEY = os.getenv("FORGE_API_KEY", "")

• Insecure:

  cursor.execute(f"SELECT * FROM accounts WHERE username = '{username}'")

• Secure:

  cursor.execute("SELECT * FROM accounts WHERE username = ?", (username,))

• Insecure:

  result = eval(user_expression)

• Secure:

  import ast
  result = ast.literal_eval(user_expression)  # or json.loads()

• Insecure:

  document.getElementById("user-bio").innerHTML = userInput;

• Secure:

  document.getElementById("user-bio").textContent = userInput;

All security scan findings are included in verification_manifest.json:

{
  "name": "[CRITICAL] SQL Injection Pattern (f-string)",
  "category": "security",
  "status": "fail",
  "evidence": {
    "file": "app/db.py",
    "line": 42,
    "snippet": "cursor.execute(f\"SELECT * FROM users WHERE id = {user_id}\")",
    "description": "SQL query constructed via f-string interpolation rather than parameterized query."
  },
  "fix_suggestions": [
    "Use parameterized query placeholders (?, %s, or :param) with parameter bindings tuple."
  ]
}

Maintained by Project FORGE Engineering & Security Architecture.