{
  "schemaVersion": "1.0.0",
  "kind": "editorial-inspection-pack",
  "provenance": "editorial-guidance",
  "guideId": "patch-and-ci",
  "updatedAt": "2026-11-12",
  "catalogVersion": "0.11.0",
  "sourceRepository": "https://github.com/sakimyto/security-knowledge",
  "sourceLicense": "MIT",
  "catalogHash": "e99906d58134e7e0d33d994548277ae7814000d92c088aa5894c49b62ae60cca",
  "catalogReviewedAt": "2026-11-09",
  "execution": "read-only-by-default",
  "selectedRuleIds": ["SEC-001", "SEC-007"],
  "deferredRuleIds": [
    "SEC-002",
    "SEC-003",
    "SEC-004",
    "SEC-005",
    "SEC-006",
    "SEC-008",
    "SEC-009",
    "SEC-010",
    "SEC-011",
    "SEC-012",
    "SEC-013",
    "SEC-014",
    "SEC-015",
    "SEC-016"
  ],
  "outsideSelectionStatus": "unverified",
  "resultStatuses": ["finding", "no-finding", "not-applicable", "unverified"],
  "reportSchemaUrl": "https://sakimyto.com/security-data/report.schema.json",
  "reportExampleUrl": "https://sakimyto.com/security-data/report.example.json",
  "catalogDiscoveryUrl": "https://sakimyto.com/security-data/discovery.json",
  "distributionIndexUrl": "https://sakimyto.com/security-learning-data/index.json",
  "requiredRuleIndex": [
    {
      "id": "SEC-001",
      "hash": "efec3489e1663249a2aff75cdb7c25e82d9765acb2bdcfa31e8ee934f12ef626"
    },
    {
      "id": "SEC-002",
      "hash": "1398f1a8c28e4441472ef3a0952fde97c4ff19b5010178989f4ddd05b6a193dd"
    },
    {
      "id": "SEC-003",
      "hash": "00aa6c368be21452c79e662728102938d7d3896073e53de74ea5fc913250b808"
    },
    {
      "id": "SEC-004",
      "hash": "4c8742376f6fe13cb33908f282d1a6af6fd73ae0a13007f8013ca7042fd629b4"
    },
    {
      "id": "SEC-005",
      "hash": "695e2e119a1364887732e6ee90c1250d22063f1e6e0ec71746e80b7231ace15f"
    },
    {
      "id": "SEC-006",
      "hash": "a3cc524b847c5ec9223ea64ed01920283062fe3fcd0eaf2595bde44f951eed71"
    },
    {
      "id": "SEC-007",
      "hash": "154186523c183ea0ec0059b951eb9b35f0ac41557c28df13c071663be3aef6ee"
    },
    {
      "id": "SEC-008",
      "hash": "ab2bd7e87128a2ce571578558337ab8577fcda20f841171dba5b45d732ad2f03"
    },
    {
      "id": "SEC-009",
      "hash": "8b9d4f314306ca656f73c115c195d84dd803e8a58a53355ed03516b330b26cb2"
    },
    {
      "id": "SEC-010",
      "hash": "66b39f4eb8a0f334e98e9388e3f9dab27415e726c0862f0b6a4a4dd10e5e81df"
    },
    {
      "id": "SEC-011",
      "hash": "3ae198ddd5fa82a53bcbca648d3a9070b03e3cd5665387e69e50c6bb6d365cb3"
    },
    {
      "id": "SEC-012",
      "hash": "2da99baf28980f61385469445d6c000edb5434471a4a3500f1775ca78467824a"
    },
    {
      "id": "SEC-013",
      "hash": "630183526a6d030807db345f6214176c12ca911fb261bde3abebc1c355a21d98"
    },
    {
      "id": "SEC-014",
      "hash": "d9142da38fbe305f72d506a6d6c3c97f658fa446587dc9b27657622c880c1163"
    },
    {
      "id": "SEC-015",
      "hash": "1dfd83077658a79d47897d199f646eb9f69aa4d92c7646c57f2b82a715fde44c"
    },
    {
      "id": "SEC-016",
      "hash": "cce435bbacb6fef88c9e9d661222b081d8463e4f025448a7796cdcddd7548488"
    }
  ],
  "boundary": {
    "ja": "選択した2ルールだけを、許可された対象で読み取り点検します。残る14ルールは実行せず、既存の結果形式へunverifiedと範囲外の理由を残します。資料を読むだけで合格にせず、秘密の実値・変更・外部送信の権限は増やしません。",
    "en": "Inspect only the two selected rules in authorized scope, read-only. Leave the other fourteen unperformed and report them as unverified with an out-of-scope reason under the existing contract. Reading guidance is not a pass and grants no authority to expose secrets, modify systems, or send data."
  },
  "guide": {
    "id": "patch-and-ci",
    "title": {
      "ja": "更新したつもり、を確かめる",
      "en": "Check what was actually deployed"
    },
    "lead": {
      "ja": "稼働する版と、配備までに動く外部コードをつなげて読みます。",
      "en": "Connect the running version with the external code executed on its way to deployment."
    },
    "situation": {
      "ja": "依存関係は更新したのに、稼働版やCIの接続範囲が分からないとき。",
      "en": "Use this when source updates, running versions, and pipeline access are tracked separately."
    },
    "goal": {
      "ja": "どの成果物が、どの権限の工程を通って、どこへ出たかを説明できる状態にします。",
      "en": "Build an account of which artifact passed through which privileged steps and where it was deployed."
    },
    "ruleIds": ["SEC-001", "SEC-007"],
    "incidentIds": ["equifax-2017", "codecov-2021"],
    "termIds": ["asset", "secret", "tool-permission"],
    "sourceIds": ["ci", "secrets"],
    "steps": [
      {
        "title": {
          "ja": "稼働する実体を探す",
          "en": "Identify the running artifact"
        },
        "action": {
          "ja": "配備記録から環境と成果物を特定し、ソース上の依存関係と分けて記録します。",
          "en": "Identify the environment and artifact from deployment records, separately from source dependency declarations."
        },
        "evidence": {
          "ja": "環境、版、成果物の識別子、参照した配備記録。",
          "en": "Environment, version, artifact identity, and the deployment record inspected."
        }
      },
      {
        "title": {
          "ja": "外部コードの通り道を見る",
          "en": "Trace external code"
        },
        "action": {
          "ja": "Actionやスクリプトの取得元と固定する版を読み、渡す権限・接続先を工程ごとに並べます。",
          "en": "Read external action or script origins and pinned revisions, then map per-step permissions and destinations."
        },
        "evidence": {
          "ja": "外部コードと、その工程が利用できる権限の対応表。",
          "en": "A mapping from external code to permissions available in its step."
        }
      },
      {
        "title": {
          "ja": "対象版と未確認を残す",
          "en": "Record version coverage"
        },
        "action": {
          "ja": "提供元の対象版と実体を照合し、稼働版を取得できない資産は未確認へ分けます。",
          "en": "Compare observed versions with vendor advisories; keep assets without an observed running version unverified."
        },
        "evidence": {
          "ja": "照合した対象と、照合できなかった対象・理由。",
          "en": "Compared assets, unverified assets, and reasons."
        }
      }
    ],
    "limits": [
      {
        "ja": "ソースやlockfileの差分だけを、稼働環境の修正完了にしません。",
        "en": "Do not treat source or lockfile changes as proof of a patched deployment."
      },
      {
        "ja": "点検のために外部スクリプトを実行したり、CIの権限を広げたりしません。",
        "en": "Do not execute external scripts or expand pipeline permissions for this review."
      }
    ],
    "takeaway": {
      "ja": "「版が新しい」と「その版が本番で動いている」を分けて確認します。",
      "en": "Separate having an updated version from knowing that it is running in the reviewed environment."
    }
  },
  "rules": [
    {
      "rule": {
        "id": "SEC-001",
        "version": "1.1.1",
        "updatedAt": "2026-11-09",
        "title": {
          "ja": "修正対象と稼働バージョンを照合する",
          "en": "Reconcile advisories with deployed versions"
        },
        "summary": {
          "ja": "依存パッケージや自前運用の製品を使う環境。ソースのlockfileだけでなく、実際に配布・稼働するものが対象です。",
          "en": "Environments using dependencies or self-hosted products; include deployed artifacts, not only lockfiles."
        },
        "category": "known-vulnerability",
        "surfaces": ["dependencies", "web-app"],
        "applicability": {
          "ja": "依存パッケージや自前運用の製品を使う環境。ソースのlockfileだけでなく、実際に配布・稼働するものが対象です。",
          "en": "Environments using dependencies or self-hosted products; include deployed artifacts, not only lockfiles."
        },
        "targets": [
          {
            "ja": "lockfile・パッケージ定義・SBOM",
            "en": "Lockfiles, package manifests, SBOMs"
          },
          {
            "ja": "製品台帳・コンテナのダイジェスト・稼働バージョン",
            "en": "Product inventory, image digests, running versions"
          }
        ],
        "checks": [
          {
            "ja": "OSV・開発元の最新アドバイザリとバージョンを照合し、影響条件と根拠を記録する。",
            "en": "Match versions against OSV and current vendor advisories; record affected conditions and evidence."
          },
          {
            "ja": "悪用が確認されたものと外部から到達可能なものを優先し、更新が本番に反映されたか確認する。",
            "en": "Prioritize active exploitation and reachable assets; verify deployment of updates."
          }
        ],
        "remediation": [
          {
            "ja": "互換性を確認して更新し、すぐ更新できない場合は開発元の回避策と公開範囲の制限を検討する。",
            "en": "Test and update; if immediate updating is unavailable, assess vendor mitigations and exposure restrictions."
          }
        ],
        "completionEvidence": [
          {
            "ja": "稼働バージョン・対象アドバイザリ・適用した更新・必要な動作確認の結果を残す。",
            "en": "Record the running version, advisory, deployed fix, and relevant validation results."
          }
        ],
        "limitations": [
          {
            "ja": "このDBにCVEがないことは安全の証拠になりません。閉じた製品の内部実装や実際の侵害は別途調査が必要です。",
            "en": "Absence from this dataset is not evidence of safety. Closed-source internals and actual compromise require separate investigation."
          }
        ],
        "incidentIds": [
          "applynow-bi-2026",
          "axios-npm-2026",
          "dandm-vpn-ransomware-2026",
          "digital-agency-gss-2026",
          "education-software-dormant-2026",
          "equifax-2017",
          "forticloud-sso-2026",
          "gmo-infoq-2026",
          "gyazo-2026",
          "inkrevolution-payment-2025",
          "kaga-solnet-2026",
          "kddi-isp-2026",
          "leanbody-metabase-2026",
          "logicvein-2025",
          "media4u-account-list-2026",
          "metabase-2026",
          "moveit-2023",
          "mrmax-2026",
          "nidek-website-2026",
          "nishiyama-2026",
          "openai-huggingface-eval-2026",
          "osaka-recruitment-vendor-2026",
          "ozmall-2026",
          "pickleballone-plugin-2026",
          "postman-shai-hulud-2025",
          "prontest-cloud-2026",
          "react2shell-2025",
          "rust-arrayref-2026",
          "saga-hirakawaya-payment-2026",
          "skyticket-business-system-2026",
          "trivy-supply-chain-2026",
          "voising-bi-2026",
          "white-essence-2026",
          "zurich-zdash-2026",
          "amadeus-breach-2026",
          "binance-breach-2026",
          "iwai-cosmo-tradeworks-2026",
          "nec-contractor-breach-2026",
          "onamae-desktop-cloud-2026",
          "sourcenext-breach-2026",
          "idcf-ransomware-2026"
        ],
        "references": [
          {
            "title": "OSV API",
            "url": "https://google.github.io/osv.dev/api/"
          },
          {
            "title": "CISA KEV",
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
          }
        ],
        "execution": "read-only-by-default",
        "provenance": "editorial-guidance"
      },
      "example": {
        "ruleId": "SEC-001",
        "scenario": {
          "ja": "ソースは更新したものの、本番へ同じ版が出ているか分からないWebサービス。",
          "en": "A web service has updated source dependencies, but its deployed version is uncertain."
        },
        "firstCheck": {
          "ja": "直近の配備記録と、配備した成果物の識別情報を読み比べます。",
          "en": "Compare the latest deployment record with the identity of the artifact actually deployed."
        },
        "lookAt": [
          {
            "ja": "対象製品・依存関係の一覧と担当者。",
            "en": "The product and dependency inventory, with an owner."
          },
          {
            "ja": "配備した成果物の版・識別子・作成元。",
            "en": "The deployed artifact version, identity, and source revision."
          },
          {
            "ja": "提供元の対象版と修正情報。",
            "en": "The vendor’s affected-version and fix information."
          }
        ],
        "evidence": {
          "ja": "どの環境のどの版を、どの公表情報と比べたかを記録します。",
          "en": "Record the environment, observed version, and advisory used for the comparison."
        },
        "limit": {
          "ja": "lockfileの更新だけで、稼働中の製品まで修正済みとは判断しません。",
          "en": "An updated lockfile does not establish that the running product is patched."
        },
        "sourceIds": ["ci"]
      }
    },
    {
      "rule": {
        "id": "SEC-007",
        "version": "1.1.0",
        "updatedAt": "2026-10-09",
        "title": {
          "ja": "CIで実行する外部コードと権限を確認する",
          "en": "Inspect external CI code and permissions"
        },
        "summary": {
          "ja": "外部Action・Orb・スクリプト・ビルドツールを実行するCI。",
          "en": "CI executing external actions, orbs, scripts, or build tools."
        },
        "category": "supply-chain",
        "surfaces": ["ci"],
        "applicability": {
          "ja": "外部Action・Orb・スクリプト・ビルドツールを実行するCI。",
          "en": "CI executing external actions, orbs, scripts, or build tools."
        },
        "targets": [
          {
            "ja": "CIワークフロー・取得URL・Actionの参照",
            "en": "CI workflows, download URLs, action references"
          },
          {
            "ja": "ジョブの権限・渡す秘密の種類・信頼境界",
            "en": "Job permissions, secret types, trust boundaries"
          },
          {
            "ja": "依存パッケージのlockfile・固定インストール・公開用ジョブ",
            "en": "Dependency lockfiles, frozen installation, and publishing jobs"
          }
        ],
        "checks": [
          {
            "ja": "変更可能なタグやリモートスクリプトの直接実行を確認し、固定・署名・信頼できる検証手段を調べる。",
            "en": "Inspect mutable references and direct remote-script execution; assess pinning, signatures, and trusted verification."
          },
          {
            "ja": "外部コードを動かすステップに不要な秘密や書込み権限が渡らないか確認する。",
            "en": "Check whether external-code steps receive unnecessary secrets or write permissions."
          },
          {
            "ja": "lockfileが保存され、CIが固定インストールを使うか確認する。依存パッケージのインストール中に、別のパッケージの公開用トークンを取得できないか点検する。",
            "en": "Check committed lockfiles and frozen installs, and whether dependency installation can access tokens that publish other packages."
          }
        ],
        "remediation": [
          {
            "ja": "検証した参照を固定し、更新はレビューする。秘密が必要な処理と不要な処理を分離する。",
            "en": "Pin reviewed references and review updates; separate jobs by secret requirements."
          }
        ],
        "completionEvidence": [
          {
            "ja": "固定した参照と検証根拠、権限を絞ったCIの成功結果を残す。",
            "en": "Record pinned references, verification evidence, and successful execution under narrowed permissions."
          }
        ],
        "limitations": [
          {
            "ja": "固定だけでは固定先が安全だと証明できません。同じ侵害元から取ったチェックサムだけに依存しません。",
            "en": "Pinning does not prove code is safe. A checksum from the same compromised source is insufficient."
          }
        ],
        "incidentIds": [
          "anthropic-cyber-evals-2026",
          "axios-npm-2026",
          "codecov-2021",
          "innovation-github-2026",
          "postman-shai-hulud-2025",
          "rust-arrayref-2026",
          "trivy-supply-chain-2026",
          "unit42-ai-assisted-2026"
        ],
        "references": [],
        "execution": "read-only-by-default",
        "provenance": "editorial-guidance"
      },
      "example": {
        "ruleId": "SEC-007",
        "scenario": {
          "ja": "外部Actionやスクリプトを動かすCIから、本番へ配備できる環境。",
          "en": "A pipeline executes external actions or scripts and can deploy to production."
        },
        "firstCheck": {
          "ja": "実行元の定義と、各工程へ渡す権限を読み取りで対応付けます。",
          "en": "Map the execution definitions to the permissions supplied to each step."
        },
        "lookAt": [
          {
            "ja": "外部コードの取得元と固定する版。",
            "en": "External code origins and pinned revisions."
          },
          {
            "ja": "工程ごとのトークン権限と接続先。",
            "en": "Per-step token permissions and destinations."
          },
          {
            "ja": "外部変更を実行する条件と配備の承認境界。",
            "en": "Conditions for running external changes and the deployment approval boundary."
          }
        ],
        "evidence": {
          "ja": "実行する外部コード、到達できる資産、承認が必要な操作の対応表を残します。",
          "en": "Record the relationship between external code, reachable assets, and approval-gated actions."
        },
        "limit": {
          "ja": "この点検のために未知の外部スクリプトを実行したり、権限を増やしたりしません。",
          "en": "Do not execute unknown external scripts or increase privileges to perform this review."
        },
        "sourceIds": ["ci"]
      }
    }
  ],
  "referenceIncidents": [
    {
      "id": "equifax-2017",
      "title": {
        "ja": "Equifax：未修正のApache Strutsから侵入",
        "en": "Equifax: unpatched Apache Struts"
      },
      "organization": "Equifax",
      "summary": {
        "ja": "既知のApache Struts脆弱性がオンライン異議申立てサイトで悪用され、個人情報が流出しました。更新指示があっても、適用の確認が必要だった事例です。",
        "en": "A known Apache Struts vulnerability in the online dispute portal enabled theft of personal information. Patch instructions needed verification of actual deployment."
      },
      "occurredAt": "2017-05-13",
      "disclosedAt": "2017-09-07",
      "reviewedAt": "2026-10-02",
      "outcome": "confirmed-breach",
      "categories": ["known-vulnerability"],
      "cves": ["CVE-2017-5638"],
      "claims": [
        {
          "topic": "entry",
          "text": {
            "ja": "Apache StrutsのCVE-2017-5638が侵入に使われました。",
            "en": "CVE-2017-5638 in Apache Struts was the entry vector."
          },
          "status": "confirmed",
          "sourceIds": ["s1"],
          "locator": "Attack vector"
        },
        {
          "topic": "control",
          "text": {
            "ja": "脆弱性は組織に通知されていましたが、対象のサイトに修正が適用されていませんでした。",
            "en": "The organization had been notified, but the affected portal remained unpatched."
          },
          "status": "confirmed",
          "sourceIds": ["s2"],
          "locator": "GAO-18-559, p. 15: Identification"
        }
      ],
      "timeline": [
        {
          "date": "2017-07-29",
          "text": {
            "ja": "不審なネットワーク通信を検出。",
            "en": "Suspicious network traffic detected."
          },
          "sourceIds": ["s1"]
        },
        {
          "date": "2017-09-07",
          "text": {
            "ja": "事故を公表。",
            "en": "Breach disclosed."
          },
          "sourceIds": ["s1"]
        }
      ],
      "reportedActions": [
        {
          "topic": "containment",
          "text": {
            "ja": "対象のWebアプリケーションを停止し、調査と対策を実施しました。",
            "en": "The affected web application was taken offline for investigation and mitigation."
          },
          "status": "confirmed",
          "sourceIds": ["s1"],
          "locator": "本文 / Main text"
        }
      ],
      "prevention": {
        "classification": "patch-available",
        "assessment": {
          "ja": "事前に知られていた脆弱性です。更新の通知から実際の稼働バージョン確認までを一つの点検として扱います。",
          "en": "The vulnerability was known beforehand. Track patch notification through verification of the running version."
        },
        "sourceIds": ["s1", "s2"]
      },
      "ai": {
        "status": "unknown",
        "assessment": {
          "ja": "参照した一次情報に、攻撃でAIを利用したことを裏付ける記述はありません。AI不使用を意味しません。",
          "en": "The cited primary sources do not establish AI involvement. This does not establish that AI was absent."
        }
      },
      "unknowns": [
        {
          "ja": "この要約だけでは、当時の全資産の状態や担当者ごとの判断は評価できません。",
          "en": "This summary cannot assess every asset or individual decision at the time."
        }
      ],
      "sources": [
        {
          "id": "s1",
          "title": "Equifax Releases Details on Cybersecurity Incident",
          "url": "https://investor.equifax.com/news-events/press-releases/detail/237/equifax-releases-details-on-cybersecurity-incident",
          "publisher": "Equifax",
          "kind": "organization",
          "publishedAt": "2017-09-15",
          "reviewedAt": "2026-10-02"
        },
        {
          "id": "s2",
          "title": "Data Protection: Actions Taken in Response to the 2017 Breach",
          "url": "https://www.gao.gov/assets/gao-18-559.pdf",
          "publisher": "U.S. GAO",
          "kind": "government",
          "publishedAt": "2018-08-30",
          "reviewedAt": "2026-10-02"
        }
      ],
      "ruleIds": ["SEC-001"]
    },
    {
      "id": "codecov-2021",
      "title": {
        "ja": "Codecov：イメージ内の鍵からCIスクリプトを改ざん",
        "en": "Codecov: leaked image credential and CI script tampering"
      },
      "organization": "Codecov",
      "summary": {
        "ja": "公開Dockerイメージの中間レイヤーにあった鍵が悪用され、Bash Uploaderが改ざんされました。実行した利用者のCI環境変数などが外部へ送信される攻撃でした。",
        "en": "A credential in a public Docker image layer enabled tampering with the Bash Uploader. The modified script exported CI environment information from affected users."
      },
      "occurredAt": "2021-01-31",
      "disclosedAt": "2021-04-15",
      "reviewedAt": "2026-10-02",
      "outcome": "confirmed-breach",
      "categories": ["credentials", "supply-chain"],
      "cves": [],
      "claims": [
        {
          "topic": "entry",
          "text": {
            "ja": "公開Dockerイメージの中間レイヤーから、配布物を書き換えられるHMAC鍵が取得されました。",
            "en": "An HMAC key extracted from an intermediate image layer allowed modification of the distributed uploader."
          },
          "status": "confirmed",
          "sourceIds": ["s2"],
          "locator": "Root Cause"
        },
        {
          "topic": "impact",
          "text": {
            "ja": "改ざんされたUploaderは環境変数とGitリモート情報を外部へ送信しました。",
            "en": "The modified uploader transmitted environment variables and Git remote information."
          },
          "status": "confirmed",
          "sourceIds": ["s1"],
          "locator": "About the Event"
        }
      ],
      "timeline": [
        {
          "date": "2021-01-31",
          "text": {
            "ja": "改ざんが始まった時期。",
            "en": "Beginning of observed script modifications."
          },
          "sourceIds": ["s1"]
        },
        {
          "date": "2021-04-01",
          "text": {
            "ja": "利用者のチェックサム検査を契機に発覚。",
            "en": "Detected after a customer checksum check."
          },
          "sourceIds": ["s2"]
        },
        {
          "date": "2021-04-15",
          "text": {
            "ja": "事故と利用者向けの対応を公表。",
            "en": "Disclosure and customer response guidance published."
          },
          "sourceIds": ["s1"]
        }
      ],
      "reportedActions": [
        {
          "topic": "recovery",
          "text": {
            "ja": "鍵の失効・更新と、公開イメージのビルド方法の変更を実施しました。",
            "en": "Credentials were revoked and rotated; public image build practices were changed."
          },
          "status": "confirmed",
          "sourceIds": ["s2"],
          "locator": "Recovery"
        }
      ],
      "prevention": {
        "classification": "operational-control",
        "assessment": {
          "ja": "鍵を最終イメージのファイルから消すだけでは、中間レイヤーに残る場合があります。配布物全体とCIの実行権限を点検します。",
          "en": "Deleting a secret from the final filesystem can leave it in layers. Inspect distributed artifacts and CI execution permissions."
        },
        "sourceIds": ["s1", "s2"]
      },
      "ai": {
        "status": "unknown",
        "assessment": {
          "ja": "参照した一次情報に、攻撃でAIを利用したことを裏付ける記述はありません。AI不使用を意味しません。",
          "en": "The cited primary sources do not establish AI involvement. This does not establish that AI was absent."
        }
      },
      "unknowns": [
        {
          "ja": "利用者ごとの漏洩範囲は、当時のCI環境と実行履歴に依存します。",
          "en": "Customer exposure depends on the CI environment and execution history."
        }
      ],
      "sources": [
        {
          "id": "s1",
          "title": "Bash Uploader Security Update",
          "url": "https://about.codecov.io/security-update/",
          "publisher": "Codecov",
          "kind": "organization",
          "publishedAt": "2021-04-15",
          "reviewedAt": "2026-10-02"
        },
        {
          "id": "s2",
          "title": "Post-Mortem / Root Cause Analysis (April 2021)",
          "url": "https://about.codecov.io/apr-2021-post-mortem/",
          "publisher": "Codecov",
          "kind": "organization",
          "publishedAt": null,
          "reviewedAt": "2026-10-02"
        }
      ],
      "ruleIds": ["SEC-004", "SEC-005", "SEC-007"]
    }
  ],
  "terms": [
    {
      "id": "asset",
      "name": {
        "ja": "守る対象",
        "en": "Asset"
      },
      "meaning": {
        "ja": "サービス、保存先、管理アカウントなど、点検の対象になるもの。持ち主と用途を一緒に記録します。",
        "en": "A service, store, or administrative identity included in the review. Record its owner and purpose as well as its name."
      },
      "question": {
        "ja": "どの環境の、誰が管理する対象を見ていますか。",
        "en": "Which environment and owner does this asset belong to?"
      },
      "ruleId": "SEC-006",
      "sourceId": "attack-surface"
    },
    {
      "id": "secret",
      "name": {
        "ja": "秘密情報",
        "en": "Secret"
      },
      "meaning": {
        "ja": "APIキーや認証用トークンなど、持つことで操作や接続ができる値。点検記録には実値を残しません。",
        "en": "A value granting access, such as an API key or authentication token. Review records should identify it without containing the value."
      },
      "question": {
        "ja": "値を開かずに、用途・対象・管理者を特定できますか。",
        "en": "Can you identify its purpose, target, and owner without opening its value?"
      },
      "ruleId": "SEC-004",
      "sourceId": "secrets"
    },
    {
      "id": "tool-permission",
      "name": {
        "ja": "ツールの実行権限",
        "en": "Tool permission"
      },
      "meaning": {
        "ja": "AIやCIが使うツールに許された接続先・対象・操作。文章中の依頼だけで権限を増やさないようにします。",
        "en": "The destinations, resources, and operations a tool is authorized to use. Text encountered by an AI or pipeline must not grant extra authority."
      },
      "question": {
        "ja": "実行する側でも、対象と操作が許可範囲に入るか確かめますか。",
        "en": "Does the execution component check that the target and operation are authorized?"
      },
      "ruleId": "SEC-011",
      "sourceId": "ai-agent"
    }
  ],
  "sources": [
    {
      "id": "ci",
      "title": "CI/CD Security Cheat Sheet",
      "publisher": "OWASP",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/CI_CD_Security_Cheat_Sheet.html",
      "locator": "Pipeline and Execution Environment; Least Privilege; Managing Third-Party Code",
      "reviewedAt": "2026-11-12"
    },
    {
      "id": "secrets",
      "title": "Secrets Management Cheat Sheet",
      "publisher": "OWASP",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html",
      "locator": "2.7 Secret Lifecycle; 2.7.3 Revocation",
      "reviewedAt": "2026-11-12"
    }
  ]
}