{
  "schemaVersion": "1.0.0",
  "kind": "editorial-inspection-pack",
  "provenance": "editorial-guidance",
  "guideId": "exposure-and-retention",
  "updatedAt": "2026-11-12",
  "catalogVersion": "0.11.0",
  "sourceRepository": "https://github.com/sakimyto/security-knowledge",
  "sourceLicense": "MIT",
  "catalogHash": "e99906d58134e7e0d33d994548277ae7814000d92c088aa5894c49b62ae60cca",
  "catalogReviewedAt": "2026-11-09",
  "execution": "read-only-by-default",
  "selectedRuleIds": ["SEC-006", "SEC-012"],
  "deferredRuleIds": [
    "SEC-001",
    "SEC-002",
    "SEC-003",
    "SEC-004",
    "SEC-005",
    "SEC-007",
    "SEC-008",
    "SEC-009",
    "SEC-010",
    "SEC-011",
    "SEC-013",
    "SEC-014",
    "SEC-015",
    "SEC-016"
  ],
  "outsideSelectionStatus": "unverified",
  "resultStatuses": ["finding", "no-finding", "not-applicable", "unverified"],
  "reportSchemaUrl": "https://sakimyto.com/security-data/report.schema.json",
  "reportExampleUrl": "https://sakimyto.com/security-data/report.example.json",
  "catalogDiscoveryUrl": "https://sakimyto.com/security-data/discovery.json",
  "distributionIndexUrl": "https://sakimyto.com/security-learning-data/index.json",
  "requiredRuleIndex": [
    {
      "id": "SEC-001",
      "hash": "efec3489e1663249a2aff75cdb7c25e82d9765acb2bdcfa31e8ee934f12ef626"
    },
    {
      "id": "SEC-002",
      "hash": "1398f1a8c28e4441472ef3a0952fde97c4ff19b5010178989f4ddd05b6a193dd"
    },
    {
      "id": "SEC-003",
      "hash": "00aa6c368be21452c79e662728102938d7d3896073e53de74ea5fc913250b808"
    },
    {
      "id": "SEC-004",
      "hash": "4c8742376f6fe13cb33908f282d1a6af6fd73ae0a13007f8013ca7042fd629b4"
    },
    {
      "id": "SEC-005",
      "hash": "695e2e119a1364887732e6ee90c1250d22063f1e6e0ec71746e80b7231ace15f"
    },
    {
      "id": "SEC-006",
      "hash": "a3cc524b847c5ec9223ea64ed01920283062fe3fcd0eaf2595bde44f951eed71"
    },
    {
      "id": "SEC-007",
      "hash": "154186523c183ea0ec0059b951eb9b35f0ac41557c28df13c071663be3aef6ee"
    },
    {
      "id": "SEC-008",
      "hash": "ab2bd7e87128a2ce571578558337ab8577fcda20f841171dba5b45d732ad2f03"
    },
    {
      "id": "SEC-009",
      "hash": "8b9d4f314306ca656f73c115c195d84dd803e8a58a53355ed03516b330b26cb2"
    },
    {
      "id": "SEC-010",
      "hash": "66b39f4eb8a0f334e98e9388e3f9dab27415e726c0862f0b6a4a4dd10e5e81df"
    },
    {
      "id": "SEC-011",
      "hash": "3ae198ddd5fa82a53bcbca648d3a9070b03e3cd5665387e69e50c6bb6d365cb3"
    },
    {
      "id": "SEC-012",
      "hash": "2da99baf28980f61385469445d6c000edb5434471a4a3500f1775ca78467824a"
    },
    {
      "id": "SEC-013",
      "hash": "630183526a6d030807db345f6214176c12ca911fb261bde3abebc1c355a21d98"
    },
    {
      "id": "SEC-014",
      "hash": "d9142da38fbe305f72d506a6d6c3c97f658fa446587dc9b27657622c880c1163"
    },
    {
      "id": "SEC-015",
      "hash": "1dfd83077658a79d47897d199f646eb9f69aa4d92c7646c57f2b82a715fde44c"
    },
    {
      "id": "SEC-016",
      "hash": "cce435bbacb6fef88c9e9d661222b081d8463e4f025448a7796cdcddd7548488"
    }
  ],
  "boundary": {
    "ja": "選択した2ルールだけを、許可された対象で読み取り点検します。残る14ルールは実行せず、既存の結果形式へunverifiedと範囲外の理由を残します。資料を読むだけで合格にせず、秘密の実値・変更・外部送信の権限は増やしません。",
    "en": "Inspect only the two selected rules in authorized scope, read-only. Leave the other fourteen unperformed and report them as unverified with an out-of-scope reason under the existing contract. Reading guidance is not a pass and grants no authority to expose secrets, modify systems, or send data."
  },
  "guide": {
    "id": "exposure-and-retention",
    "title": {
      "ja": "公開範囲と、残り続けるデータを見る",
      "en": "Review exposure and data that remains"
    },
    "lead": {
      "ja": "保存先の設定と、用途を終えた環境・コピーの扱いを一緒に確かめます。",
      "en": "Review storage exposure together with the handling of retired environments and data copies."
    },
    "situation": {
      "ja": "共有設定や試験用データが複数の環境・委託先に分かれているとき。",
      "en": "Use this when sharing settings and test data are spread across environments or contractors."
    },
    "goal": {
      "ja": "誰に何を公開するかと、残す必要があるデータの範囲を分けて記録します。",
      "en": "Distinguish intended exposure from the scope of data that still needs to be retained."
    },
    "ruleIds": ["SEC-006", "SEC-012"],
    "incidentIds": ["fukuoka-editable-application-2026", "awabank-test-environment-2026"],
    "termIds": ["asset", "secret", "audit-log"],
    "sourceIds": ["attack-surface", "logging"],
    "steps": [
      {
        "title": {
          "ja": "対象と担当者を揃える",
          "en": "Map assets to owners"
        },
        "action": {
          "ja": "保存先・用途・公開する相手を一覧にし、管理者が分からない対象を分けます。",
          "en": "List stores, purposes, and intended recipients, separating assets without a known owner."
        },
        "evidence": {
          "ja": "対象、管理者、利用目的、確認日。",
          "en": "Asset, owner, purpose, and review date."
        }
      },
      {
        "title": {
          "ja": "設定と意図を比べる",
          "en": "Compare settings with intent"
        },
        "action": {
          "ja": "利用者・組織・匿名に許す操作を読み、意図した公開範囲と対応付けます。",
          "en": "Review operations allowed to users, organizations, and anonymous callers against the intended audience."
        },
        "evidence": {
          "ja": "設定の参照箇所と、意図した共有範囲。",
          "en": "Configuration references and intended sharing boundaries."
        }
      },
      {
        "title": {
          "ja": "残るコピーを追う",
          "en": "Trace retained copies"
        },
        "action": {
          "ja": "試験用や廃止済み環境の台帳と停止・削除の記録を比べ、未確認のコピーを残します。",
          "en": "Compare test and retired-environment inventories with shutdown or deletion records, keeping unknown copies visible."
        },
        "evidence": {
          "ja": "保持する対象、廃止を確認した対象、未確認の保存先。",
          "en": "Retained assets, verified retirements, and unverified stores."
        }
      }
    ],
    "limits": [
      {
        "ja": "この点検のために公開範囲を変えたり、データを削除したりしません。",
        "en": "Do not change exposure or delete data during this review."
      },
      {
        "ja": "保持期間の妥当性や、委託先を含む全コピーの消去は別途確認が必要です。",
        "en": "Retention appropriateness and removal of every copy, including contractor copies, need separate verification."
      }
    ],
    "takeaway": {
      "ja": "公開してよいかと、保存し続けてよいかを、一つの設定で済ませないようにします。",
      "en": "Treat intended exposure and justified retention as separate decisions."
    }
  },
  "rules": [
    {
      "rule": {
        "id": "SEC-006",
        "version": "1.1.2",
        "updatedAt": "2026-11-09",
        "title": {
          "ja": "稼働環境の公開範囲を確認する",
          "en": "Inspect deployed exposure boundaries"
        },
        "summary": {
          "ja": "クラウド・データ基盤・管理画面・ファイル転送を持つ環境。委託先が管理する資産も対象です。",
          "en": "Cloud, data platforms, administration, and file transfer, including delegated assets."
        },
        "category": "configuration",
        "surfaces": ["cloud", "data-store", "web-app"],
        "applicability": {
          "ja": "クラウド・データ基盤・管理画面・ファイル転送を持つ環境。委託先が管理する資産も対象です。",
          "en": "Cloud, data platforms, administration, and file transfer, including delegated assets."
        },
        "targets": [
          {
            "ja": "IaC・実環境の公開設定・ネットワークポリシー",
            "en": "IaC, deployed visibility, network policies"
          },
          {
            "ja": "管理画面・データ保存先・委託先の資産一覧",
            "en": "Admin interfaces, data storage, delegated asset inventory"
          }
        ],
        "checks": [
          {
            "ja": "意図した公開先と実際の設定を照合し、匿名アクセスや広い接続元許可を確認する。",
            "en": "Compare intended exposure with deployed settings; inspect anonymous access and broad network permissions."
          },
          {
            "ja": "許可された資産だけで、データを取得せずに拒否を確認する。実環境へアクセスできなければ未確認とする。",
            "en": "Test rejection only on authorized assets without retrieving data. Without live access, mark deployed state unverified."
          }
        ],
        "remediation": [
          {
            "ja": "公開が不要な経路を制限し、設定変更を検知する監査と責任者を用意する。",
            "en": "Restrict unnecessary exposure; establish drift detection and ownership."
          }
        ],
        "completionEvidence": [
          {
            "ja": "実環境の設定証拠と、想定外の接続元を拒否する確認結果を残す。",
            "en": "Record deployed configuration and rejection of unintended access sources."
          }
        ],
        "limitations": [
          {
            "ja": "IaCだけの確認では実環境の手動変更を見つけられません。公開サイトの存在自体を欠陥とは判断しません。",
            "en": "IaC alone misses manual drift. A deliberately public service is not inherently a defect."
          }
        ],
        "incidentIds": [
          "anthropic-cyber-evals-2026",
          "anthropic-unintended-model-actions-2026",
          "arcadia-raiden-2026",
          "asahi-pharma-digital-2026",
          "awabank-test-environment-2026",
          "campfire-2026",
          "chibagin-shoten-2026",
          "cmic-ra-connect-2026",
          "daiichi-life-hr-2026",
          "daiki-suisan-2026",
          "digital-agency-gss-2026",
          "education-software-dormant-2026",
          "epark-peakmanager-2026",
          "eplus-refund-2026",
          "forticloud-sso-2026",
          "france-refrigeration-2026",
          "fukuoka-editable-application-2026",
          "fuso-cloud-storage-2026",
          "gyazo-2026",
          "hana-bank-2026",
          "his-thailand-2025",
          "idcf-ransomware-2026",
          "istyle-transfer-exposure-2026",
          "jaea-jrr3-files-2026",
          "kamogawa-form-exposure-2026",
          "kb-kookmin-2026",
          "kddi-isp-2026",
          "komatsu-user-directory-exposure-2026",
          "kwansei-external-sns-2026",
          "kyoto-kyotv-exposure-2026",
          "medley-atlink-2026",
          "metabase-2026",
          "mie-school-form-exposure-2026",
          "moveit-2023",
          "mrmax-2026",
          "nichii-backup-exposure-2026",
          "nidek-website-2026",
          "nishiyama-2026",
          "openai-huggingface-eval-2026",
          "prontest-cloud-2026",
          "react2shell-2025",
          "rizap-ai-data-handling-2026",
          "sakura-billing-2026",
          "sakura-hosting-2026",
          "scala-iask-2026",
          "seiho-contract-lookup-2026",
          "shizuoka-form-exposure-2026",
          "skyticket-bus-2026",
          "snowflake-unc5537-2024",
          "temairazu-2026",
          "times-car-2026",
          "toyota-cloud-2023",
          "unit42-ai-assisted-2026",
          "voising-bi-2026",
          "yakiniku-king-2026",
          "yamato-pay-later-2026",
          "amadeus-breach-2026",
          "binance-breach-2026",
          "iwai-cosmo-tradeworks-2026",
          "nec-contractor-breach-2026",
          "onamae-desktop-cloud-2026",
          "sourcenext-breach-2026"
        ],
        "references": [],
        "execution": "read-only-by-default",
        "provenance": "editorial-guidance"
      },
      "example": {
        "ruleId": "SEC-006",
        "scenario": {
          "ja": "ファイル共有、管理画面、委託先の保存先が複数の管理者に分かれている環境。",
          "en": "File sharing, administrative interfaces, and contractor-managed storage have different owners."
        },
        "firstCheck": {
          "ja": "資産一覧と公開設定の記録を比べ、管理者が不明な対象を分けます。",
          "en": "Compare the asset inventory with exposure settings and separate assets without a known owner."
        },
        "lookAt": [
          {
            "ja": "入口となるURL・保存先・担当者の一覧。",
            "en": "The inventory of entry URLs, stores, and owners."
          },
          {
            "ja": "利用者・組織・匿名に許す操作。",
            "en": "Operations allowed to users, organizations, and anonymous callers."
          },
          {
            "ja": "委託先を含む設定の確認日と参照箇所。",
            "en": "Setting review dates and references, including contractor assets."
          }
        ],
        "evidence": {
          "ja": "どの対象のどの設定を読んだかと、未確認の対象を残します。",
          "en": "Record the settings actually reviewed and the assets still unverified."
        },
        "limit": {
          "ja": "設定資料の確認だけで、外部からの全到達経路を検証したとは扱いません。",
          "en": "A configuration review does not verify every externally reachable path."
        },
        "sourceIds": ["attack-surface"]
      }
    },
    {
      "rule": {
        "id": "SEC-012",
        "version": "1.1.1",
        "updatedAt": "2026-10-19",
        "title": {
          "ja": "非本番環境と保存データの廃止期限を確認する",
          "en": "Inspect nonproduction and data retirement deadlines"
        },
        "summary": {
          "ja": "クラウドやDBに顧客データ、本人確認書類、初期認証情報、テスト用コピーを保存する環境に適用します。",
          "en": "Applies to cloud or database environments holding customer data, identity documents, initial credentials, or test copies."
        },
        "category": "configuration",
        "surfaces": ["cloud", "data-store"],
        "applicability": {
          "ja": "クラウドやDBに顧客データ、本人確認書類、初期認証情報、テスト用コピーを保存する環境に適用します。",
          "en": "Applies to cloud or database environments holding customer data, identity documents, initial credentials, or test copies."
        },
        "targets": [
          {
            "ja": "開発・検証・BI・バックアップのデータコピー、退会者と登録未完了者の保存データ。",
            "en": "Development, test, BI, and backup copies, including former-member and incomplete-applicant data."
          },
          {
            "ja": "環境とデータの責任者、用途、アクセス権、保持期限、廃止・消去の記録。",
            "en": "Owners, purpose, privileges, retention deadlines, and retirement or deletion records."
          }
        ],
        "checks": [
          {
            "ja": "資産一覧と実環境を照合し、用途を終えた環境と期限超過のデータを探す。",
            "en": "Compare inventory and runtime assets for obsolete environments and overdue data."
          },
          {
            "ja": "本番データをテストへ持ち込む必要性と匿名化・最小化、外部公開と認証の設定を確認する。",
            "en": "Inspect the need for production data in tests, anonymization and minimization, exposure, and authentication."
          },
          {
            "ja": "保持・消去の運用がDB本体だけでなく、コピー・復元・検索・バックアップにどう適用されるか確認する。",
            "en": "Inspect how retention and deletion apply to copies, restoration, search, and backups as well as the live database."
          }
        ],
        "remediation": [
          {
            "ja": "所有者と合意した保持方針に合わせて、不要な環境を廃止しデータを最小化する。削除は承認範囲と復旧要件に従う。",
            "en": "Retire unnecessary environments and minimize data under an owner-approved retention policy; deletion follows authority and recovery requirements."
          },
          {
            "ja": "環境作成時に責任者・期限・アクセス制限を必須にし、期限超過を検知する。",
            "en": "Require ownership, deadlines, and access restrictions at environment creation; detect overdue assets."
          }
        ],
        "completionEvidence": [
          {
            "ja": "環境リビジョンに対応する資産・保持期限の一覧と、対象を明記した消去・匿名化の記録。",
            "en": "Revision-linked asset and retention inventory with scoped deletion or anonymization records."
          },
          {
            "ja": "本番コピー、退会者、未完了申込者、バックアップへの適用を確認した結果。",
            "en": "Evidence covering production copies, former members, incomplete applicants, and backups."
          }
        ],
        "limitations": [
          {
            "ja": "法令や契約上の保持要件はこのDBで判断できません。必要なデータを独断で削除しません。",
            "en": "This catalog does not determine legal or contractual retention requirements; do not delete required data without authority."
          },
          {
            "ja": "設定や期限の定義だけでは消去の実施を証明できません。実施記録がない範囲は未確認です。",
            "en": "Defined settings or deadlines alone do not prove deletion; absent execution evidence remains unverified."
          }
        ],
        "incidentIds": [
          "2rinkan-api-2026",
          "aflac-japan-2026",
          "ainokaze-reservations-2026",
          "applynow-bi-2026",
          "asahi-pharma-digital-2026",
          "awabank-test-environment-2026",
          "charm-2026",
          "chiba-biodiversity-2026",
          "chibagin-shoten-2026",
          "chubu-business-credentials-2026",
          "cmic-ra-connect-2026",
          "coop-yamaguchi-2026",
          "corona-cloud-2026",
          "cota-2026",
          "daiichi-life-hr-2026",
          "daiki-suisan-2026",
          "dandm-vpn-ransomware-2026",
          "discord-support-vendor-2025",
          "education-software-dormant-2026",
          "epark-peakmanager-2026",
          "eplus-refund-2026",
          "estore-shopserve-2026",
          "expo-subcontractor-mail-2026",
          "fines-reservations-2026",
          "five-foxes-2026",
          "fujita-personal-pc-scam-2026",
          "fuso-cloud-storage-2026",
          "gex-ransomware-2026",
          "gpoint-2026",
          "gyazo-2026",
          "his-thailand-2025",
          "ichimasa-mail-2026",
          "ieej-mail-2026",
          "innovation-github-2026",
          "istyle-transfer-exposure-2026",
          "jaea-jrr3-files-2026",
          "jogmec-directory-2026",
          "jst-mail-2026",
          "k9natural-2026",
          "kaga-solnet-2026",
          "kwansei-external-sns-2026",
          "kyorin-remote-pc-2026",
          "leanbody-metabase-2026",
          "legoland-amadeus-2026",
          "logicvein-2025",
          "media4u-account-list-2026",
          "mediaplex-2026",
          "mitsui-fudosan-directory-2026",
          "miyamoto-munashi-orders-2026",
          "murauchi-2026",
          "nice-mail-2026",
          "nichii-backup-exposure-2026",
          "nichirei-2026",
          "nidek-website-2026",
          "nihontelenet-ransomware-2026",
          "nikkei-workspace-2026",
          "nostrum-smartspi-2026",
          "omic-support-scam-2026",
          "openai-mixpanel-2025",
          "osaka-recruitment-vendor-2026",
          "ota-cultural-pc-scam-2026",
          "ozmall-2026",
          "rakuten-books-pc-2026",
          "rakuten-drive-2026",
          "rizap-ai-data-handling-2026",
          "ryomo-systems-2026",
          "sakura-billing-2026",
          "scala-iask-2026",
          "seicomart-app-2026",
          "skyticket-business-system-2026",
          "skyticket-server-2026",
          "temairazu-2026",
          "times-car-2026",
          "tokyometro-metpo-mail-2026",
          "trunk-mail-2026",
          "visualarts-cloud-credentials-2026",
          "voising-bi-2026",
          "white-essence-2026",
          "yakiniku-king-2026",
          "yellowhat-booking-2026",
          "zurich-zdash-2026"
        ],
        "references": [
          {
            "title": "阿波銀行の調査結果",
            "url": "https://www.awabank.co.jp/kojin/benri/awagin_app/news/2026/news20260603a/index.html"
          },
          {
            "title": "タイムズカー第3報",
            "url": "https://share.timescar.jp/news/2026/0929/1816.html"
          }
        ],
        "execution": "read-only-by-default",
        "provenance": "editorial-guidance"
      },
      "example": {
        "ruleId": "SEC-012",
        "scenario": {
          "ja": "試験用コピーや使わなくなった環境が、元の目的を終えた後も残っている構成。",
          "en": "Test copies and retired environments may remain after their original purpose ends."
        },
        "firstCheck": {
          "ja": "対象、利用目的、管理者、廃止予定を値なしの台帳で比べます。",
          "en": "Compare the target, purpose, owner, and retirement plan in a non-secret inventory."
        },
        "lookAt": [
          {
            "ja": "本番以外にあるデータと保存先。",
            "en": "Data and stores outside production."
          },
          {
            "ja": "利用目的・保持方針・廃止の担当者。",
            "en": "Purpose, retention policy, and retirement owner."
          },
          {
            "ja": "削除や停止の記録と、残るコピーの範囲。",
            "en": "Deletion or shutdown records and the scope of remaining copies."
          }
        ],
        "evidence": {
          "ja": "残っている対象と、廃止を確認できた対象を分け、参照した記録を残します。",
          "en": "Separate retained assets from verified retirement and cite the reviewed records."
        },
        "limit": {
          "ja": "この点検でデータを削除しません。保持期間の妥当性や、全コピーの消去は別途確認が必要です。",
          "en": "Do not delete data during review. Retention appropriateness and removal of every copy require separate verification."
        },
        "sourceIds": ["attack-surface"]
      }
    }
  ],
  "referenceIncidents": [
    {
      "id": "fukuoka-editable-application-2026",
      "organization": "福岡県",
      "title": {
        "ja": "福岡県：情報の公開範囲・権限の問題",
        "en": "福岡県: data exposure and authorization boundaries"
      },
      "summary": {
        "ja": "申請様式を閲覧専用にすべきところ、オンライン編集・保存できる設定で公開し、入力情報が残りました。 24法人の役員183人の情報が閲覧可能になりました。実際の閲覧件数は不明です。",
        "en": "An application file was published with editing and saving enabled instead of read-only access, retaining applicants’ information. Information about 183 officers from 24 organizations was accessible; actual view counts are unknown."
      },
      "occurredAt": "2026-08-21",
      "disclosedAt": "2026-09-29",
      "reviewedAt": "2026-10-09",
      "outcome": "exposure-only",
      "categories": ["configuration"],
      "cves": [],
      "claims": [
        {
          "topic": "entry",
          "text": {
            "ja": "申請様式を閲覧専用にすべきところ、オンライン編集・保存できる設定で公開し、入力情報が残りました。",
            "en": "An application file was published with editing and saving enabled instead of read-only access, retaining applicants’ information."
          },
          "status": "confirmed",
          "sourceIds": ["s1"],
          "locator": "§§1-5"
        },
        {
          "topic": "impact",
          "text": {
            "ja": "24法人の役員183人の情報が閲覧可能になりました。実際の閲覧件数は不明です。",
            "en": "Information about 183 officers from 24 organizations was accessible; actual view counts are unknown."
          },
          "status": "confirmed",
          "sourceIds": ["s1"],
          "locator": "§§1-5"
        }
      ],
      "timeline": [
        {
          "date": "2026-08-21",
          "text": {
            "ja": "公表資料が示す事象発生日。",
            "en": "Event date reported by the source."
          },
          "sourceIds": ["s1"]
        },
        {
          "date": "2026-09-29",
          "text": {
            "ja": "公表資料で確認できる開示日。",
            "en": "Disclosure date established by the reviewed notice."
          },
          "sourceIds": ["s1"]
        }
      ],
      "reportedActions": [
        {
          "topic": "response",
          "text": {
            "ja": "ファイルを削除して対象法人へ通知しました。公開前の権限確認を複数人で行う手順を導入します。",
            "en": "The file was removed and organizations notified; multi-person permission checks before publication are planned."
          },
          "status": "confirmed",
          "sourceIds": ["s1"],
          "locator": "§§1-5"
        }
      ],
      "prevention": {
        "classification": "operational-control",
        "assessment": {
          "ja": "公表された設定・権限・運用上の問題に対応する点検です。適用条件を確認し、変更後の挙動と証拠を残します。",
          "en": "Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation."
        },
        "sourceIds": ["s1"]
      },
      "ai": {
        "status": "unknown",
        "assessment": {
          "ja": "確認した公表資料からは、攻撃者によるAI利用を判断できません。",
          "en": "The reviewed disclosures do not establish attacker use of AI."
        }
      },
      "unknowns": [
        {
          "ja": "第三者による閲覧件数は不明です。",
          "en": "The notice does not establish all entry, timing and extraction details; unresolved claims remain unknown."
        }
      ],
      "sources": [
        {
          "id": "s1",
          "title": "福岡県：事故に関する公表資料",
          "url": "https://www.pref.fukuoka.lg.jp/press-release/nkojinjyouhou.html",
          "publisher": "福岡県",
          "kind": "government",
          "publishedAt": null,
          "reviewedAt": "2026-10-09"
        }
      ],
      "ruleIds": ["SEC-006", "SEC-008", "SEC-009"]
    },
    {
      "id": "awabank-test-environment-2026",
      "organization": "阿波銀行",
      "title": {
        "ja": "阿波銀行：残存したテスト環境から情報が流出",
        "en": "Awabank: leakage from a retained test environment"
      },
      "summary": {
        "ja": "廃止・データ消去が必要だったテスト環境が、AI高度化の検証用として残っていました。ID・パスワードによる不正アクセスを受け、顧客・株主の情報が流出したと公表しています。",
        "en": "A test environment due for retirement and data deletion remained for AI-related verification. Credential-based unauthorized access led to reported customer and shareholder data leakage."
      },
      "occurredAt": null,
      "disclosedAt": "2026-04-03",
      "reviewedAt": "2026-10-02",
      "outcome": "confirmed-breach",
      "categories": ["credentials", "configuration"],
      "cves": [],
      "claims": [
        {
          "topic": "entry",
          "text": {
            "ja": "外部からテスト環境へID・パスワードを用いた不正アクセスがありました。",
            "en": "External unauthorized access used an ID and password against the test environment."
          },
          "status": "confirmed",
          "sourceIds": ["s1"],
          "locator": "原因"
        },
        {
          "topic": "control",
          "text": {
            "ja": "開発後の環境廃止・データ消去が行われず、アクセス制御も不十分だったと報告しました。",
            "en": "The bank reported missing post-development retirement and data deletion, and insufficient access controls."
          },
          "status": "confirmed",
          "sourceIds": ["s1"],
          "locator": "原因 / 再発防止策"
        }
      ],
      "timeline": [
        {
          "date": "2026-04-03",
          "text": {
            "ja": "この事案を公表。",
            "en": "Incident disclosed."
          },
          "sourceIds": ["s1"]
        }
      ],
      "reportedActions": [
        {
          "topic": "planned-response",
          "text": {
            "ja": "警察の調査後の環境廃止と、システム管理・アクセス制御の見直しを予定すると公表しました。",
            "en": "The bank announced planned retirement after police investigation and reviews of system management and access controls."
          },
          "status": "confirmed",
          "sourceIds": ["s1"],
          "locator": "再発防止策"
        }
      ],
      "prevention": {
        "classification": "operational-control",
        "assessment": {
          "ja": "非本番環境の実データ、公開範囲、責任者、廃止期限と消去の証拠を点検します。",
          "en": "Inspect real data in nonproduction, exposure, ownership, retirement deadlines, and deletion evidence."
        },
        "sourceIds": ["s1"]
      },
      "ai": {
        "status": "unknown",
        "assessment": {
          "ja": "AIは環境を残した業務目的として記載されています。攻撃者のAI利用を示す根拠ではありません。",
          "en": "AI is mentioned as a business reason for retaining the environment, not evidence of attacker AI use."
        }
      },
      "unknowns": [
        {
          "ja": "認証情報の入手経路と、非本番環境を残した判断の詳細は不明です。",
          "en": "Credential acquisition and detailed decisions behind retaining the environment are unknown."
        }
      ],
      "sources": [
        {
          "id": "s1",
          "reviewedAt": "2026-10-02",
          "title": "情報流出に関する調査結果および再発防止策について",
          "url": "https://www.awabank.co.jp/kojin/benri/awagin_app/news/2026/news20260603a/index.html",
          "publisher": "阿波銀行",
          "publishedAt": "2026-06-03",
          "kind": "organization"
        }
      ],
      "ruleIds": ["SEC-002", "SEC-005", "SEC-006", "SEC-009", "SEC-012"]
    }
  ],
  "terms": [
    {
      "id": "asset",
      "name": {
        "ja": "守る対象",
        "en": "Asset"
      },
      "meaning": {
        "ja": "サービス、保存先、管理アカウントなど、点検の対象になるもの。持ち主と用途を一緒に記録します。",
        "en": "A service, store, or administrative identity included in the review. Record its owner and purpose as well as its name."
      },
      "question": {
        "ja": "どの環境の、誰が管理する対象を見ていますか。",
        "en": "Which environment and owner does this asset belong to?"
      },
      "ruleId": "SEC-006",
      "sourceId": "attack-surface"
    },
    {
      "id": "secret",
      "name": {
        "ja": "秘密情報",
        "en": "Secret"
      },
      "meaning": {
        "ja": "APIキーや認証用トークンなど、持つことで操作や接続ができる値。点検記録には実値を残しません。",
        "en": "A value granting access, such as an API key or authentication token. Review records should identify it without containing the value."
      },
      "question": {
        "ja": "値を開かずに、用途・対象・管理者を特定できますか。",
        "en": "Can you identify its purpose, target, and owner without opening its value?"
      },
      "ruleId": "SEC-004",
      "sourceId": "secrets"
    },
    {
      "id": "audit-log",
      "name": {
        "ja": "操作を追う記録",
        "en": "Audit log"
      },
      "meaning": {
        "ja": "誰が、いつ、何を対象に、どの操作をしたかを追う記録。秘密の値や不要な個人情報は含めません。",
        "en": "A record tracing the actor, time, target, and action. Exclude secret values and unnecessary personal information."
      },
      "question": {
        "ja": "操作の流れを追えますか。記録自体の閲覧範囲も決めていますか。",
        "en": "Can you reconstruct the action, and is access to the record controlled?"
      },
      "ruleId": "SEC-009",
      "sourceId": "logging"
    }
  ],
  "sources": [
    {
      "id": "attack-surface",
      "title": "Attack Surface Analysis Cheat Sheet",
      "publisher": "OWASP",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Attack_Surface_Analysis_Cheat_Sheet.html",
      "locator": "Defining the Attack Surface; Identifying and Mapping the Attack Surface",
      "reviewedAt": "2026-11-12"
    },
    {
      "id": "logging",
      "title": "Logging Cheat Sheet",
      "publisher": "OWASP",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html",
      "locator": "Which events to log; Event attributes; Data to exclude",
      "reviewedAt": "2026-11-12"
    }
  ]
}