Storage & Logs

# Storage / Object Storage / Logs Threat Model — Generator Prompt

A **copy-paste prompt** for customers. Paste the entire prompt below into an AI coding agent
(Claude Code, Cursor, Codex, …) opened at the root of **any project** that has the `securenow`
CLI installed and logged in. The agent will inventory the **data-at-rest** surface (object
storage / buckets, databases, backups, snapshots, volumes, AMIs) and the **log/telemetry
pipeline**, build an exhaustive **storage & logging** threat model mapped to **OWASP A01:2021
Broken Access Control** and **A09:2021 Security Logging & Monitoring Failures** (plus **API8 /
API9:2023**), audit the code/config for at-rest and logging flaws, and emit **two tracks of
SecureNow-branded deliverables — a Detection & Mitigation runbook and a Code Findings &
Recommendations audit, each as Markdown + self-contained HTML** — including the detection rules
to create (every one a **ready-to-copy** command unit), the mitigation commands to run, how to
test each one, the code/config-level findings (audited, **not** fixed), and which threats still
need the SecureNow team. Every rule, flag, event name, and SQL column is **grounded in the
SecureNow SDK actually installed in the repo** (Phase 0.5) — never guessed.

This is a **platform / cross-cutting** model. It owns the **at-rest** posture of stored objects
(bucket ACLs/policies, encryption, key layout, signed URLs, backups/dumps/snapshots) and the
**hygiene of logs/telemetry** (redaction, log injection/forging, retention, third-party
shipping, audit-trail completeness, sensitive-body capture). It is **not** a network/API model:
SecureNow sees **traffic** and **events**, so most of this domain is **cloud config + code
audit**, and SecureNow's native contribution is concentrated in two places — **telemetry
redaction** (it strips `Authorization`/`Cookie`/keys/PII before ingestion) and **detecting the
*traffic* that probes storage** (storage-IDOR key manipulation, bulk-object access). It
**defers**: the upload/serve ingest pipeline to
[../10-file-upload-download/](../10-file-upload-download/file-upload-download-threat-model-prompt.md),
PII classification & retention *policy* to
[../24-data-privacy-pii/](../24-data-privacy-pii/data-privacy-pii-threat-model-prompt.md), and IAM
scope on storage to
[../20-secrets-and-cloud-iam/](../20-secrets-and-cloud-iam/secrets-and-cloud-iam-threat-model-prompt.md).
Run those three too; together they cover the whole data-at-rest + access surface.

> SecureNow is fundamentally an **API / traffic** security layer (firewall, rate-limit,
> challenge, exploit-signature instant-block, ASN enrichment, forensics) **plus a telemetry
> pipeline that redacts secrets/PII**. For this domain that means **MEDIUM native coverage**:
> the **redaction posture** is native and the **storage-IDOR / bulk-access probing** is
> detectable in traffic, but bucket ACLs, encryption-at-rest, retention, and backup exposure are
> **cloud configuration** — SecureNow audits them and contains the *abuser at the edge*, while
> the **cloud/log-config fix is the primary remediation** on almost every row.

Requirements on the customer machine: `npm i -g securenow && securenow login` (admin auth +
app runtime connected). Everything else is discovered by the agent.

---

<!-- ════════════════ COPY EVERYTHING BELOW THIS LINE ════════════════ -->

# Generate a Storage & Logs Threat Model Report (SecureNow)

You are a senior application-security engineer specializing in cloud storage and logging
security. Produce an **exhaustive storage / object-storage / logs threat model for THIS
codebase and its cloud configuration**, organized along **OWASP A01:2021 Broken Access Control**
and **A09:2021 Security Logging & Monitoring Failures** (with **OWASP API8:2023 Security
Misconfiguration** and **API9:2023 Improper Inventory Management** where they apply), mapped to
**SecureNow** detections and mitigations, with a ready-to-run action plan **and** a
code/config-level audit of every at-rest and logging flaw you find. You write **four files** —
two tracks, each Markdown + self-contained HTML — into `threat/23-storage-and-logs/` (create the
folder if needed):

1. `storage-and-logs-detection-mitigation.md` — the **operational runbook**: what to run in
   SecureNow (rules to create, mitigations, tests, response runbooks).
2. `storage-and-logs-detection-mitigation.html` — the same runbook as a **self-contained** HTML
   page (inline CSS + JS, no network requests) with **copy buttons** on every command block.
3. `storage-and-logs-code-findings.md` — the **code/config audit**: at-rest and logging flaws in
   the codebase/IaC + recommended fixes (described, never applied).
4. `storage-and-logs-code-findings.html` — the same audit as a **self-contained** HTML page.

Both HTML files use the SecureNow branding skeletons at the end. The two tracks **cross-link**
each other (detection rows that need a config fix or instrumentation link to the code finding,
and each code finding links back to the detection/mitigation row it backs). Every detection rule
in the runbook is a **ready-to-copy** unit (SQL → save to `rules/<name>.sql` → full
`securenow alerts rules create …` → dry-run test), and every command, flag, event name, and SQL
column is grounded in the **installed** SecureNow SDK (Phase 0.5).

Work in the seven phases below (Phase 0, 0.5, 1–5), in order. **Never invent facts**: if something is not in the
codebase, the IaC, or not returned by a CLI command, say "not found" — do not guess. **Do not
modify application code, infrastructure, or bucket policies.** You are auditing: every fix
(code, IaC, bucket policy, log config) is *described in the report*, never applied.

**Scope discipline.** This model owns the **at-rest** posture of stored data (buckets, objects,
keys, signed URLs, encryption, backups/dumps/snapshots/volumes/AMIs) and the **log/telemetry
hygiene** (redaction, log injection/forging, retention, third-party shipping, audit-trail
coverage, sensitive-body capture). For these **adjacent** areas do **not** re-derive the deep
model — list them in a "Deferred to sibling models" subsection, link those reports, and only
model their storage-/log-observable symptoms here:

- **Upload/serve ingest pipeline** (MIME/content validation, virus scan, SVG/polyglot, the
  download serving path) → [../10-file-upload-download/](../10-file-upload-download/file-upload-download-threat-model-prompt.md).
- **PII classification, lawful basis, retention/erasure *policy*, DSAR** →
  [../24-data-privacy-pii/](../24-data-privacy-pii/data-privacy-pii-threat-model-prompt.md). (This
  model owns the *mechanical* log/at-rest exposure of PII; the policy lives there.)
- **IAM scope / least-privilege on the storage role, key management (KMS), credential
  rotation** → [../20-secrets-and-cloud-iam/](../20-secrets-and-cloud-iam/secrets-and-cloud-iam-threat-model-prompt.md).

---

## Phase 0 — Verify SecureNow tooling

Run and record (use `--json` where supported):

```bash
securenow doctor              # connectivity must be healthy
securenow whoami              # admin auth + runtime app
securenow status --json       # app key(s), environment, firewall state
securenow alerts rules --json # detection rules that already exist (incl. system signature rules)
securenow automation --json   # blocklist automations that already exist
securenow challenge list --json   # CAPTCHA / proof-of-work challenge rules
securenow env --json          # resolved SDK config (service name, endpoints, redaction posture)
```

If the CLI is missing or not logged in, **stop** and tell the user to run
`npm i -g securenow && securenow login`, then re-run this prompt. Capture the **app key**
(UUID) — every rule and command in the report must use it. If multiple apps exist, ask the user
which app this codebase maps to before continuing. Note the **firewall state**, the **resolved
service name** (it is the tenant key for log/trace queries), and — critically for this domain —
whether `securenow env --json` reports the **SDK redaction configuration** (which headers/keys/
body fields are stripped before ingestion). That redaction posture is half this model's native
coverage; record it verbatim.

---

## Phase 0.5 — Ground every rule & command in the INSTALLED SDK

Before writing any SQL or CLI, read the SecureNow SDK that is actually installed in this repo so
every alert rule and command is correct for THIS version — never guess flags, subcommands, event
names, or SQL columns:

```bash
cat node_modules/securenow/package.json    # installed SDK version (record it in both reports)
ls node_modules/securenow                  # exported modules: events, sessions, register, run, …
ls node_modules/securenow/dist 2>/dev/null # built entrypoints / bundled CLI
npx securenow --help                       # top-level commands available in this version
npx securenow alerts rules --help          # exact create flags: --name/--sql/--apps/--severity/--schedule/--nlp
npx securenow event --help                 # `event send` shape for synthetic tests
npx securenow ratelimit --help; npx securenow challenge --help
npx securenow blocklist --help; npx securenow automation --help; npx securenow trusted --help
```

If `node_modules/securenow` is absent, run `npm ls securenow`; if still missing, tell the user to
`npm i securenow` (or `npm i -g securenow`) and stop. EVERY command, flag, `track('…')` event
name, and SQL column you emit MUST be one the installed SDK/CLI actually exposes. If the installed
version lacks a capability this prompt references, emit the rule but annotate it
`# requires securenow >= <version>` instead of a broken command. Record the resolved version in
the appendix of BOTH reports.

In Phase 4 and Phase 5, treat `node_modules/securenow` + `--help` as the source of truth: the
`securenow/events` `track()` signatures, the `securenow alerts rules` SQL columns, and every
mitigation subcommand are discoverable there. Cross-check before emitting.

---

## Phase 1 — Inventory the surface (codebase + cloud config analysis)

Storage & logging security starts with knowing **where data sits and where it gets recorded**.
Document what is **actually configured**, not what is intended. Read IaC (Terraform/
CloudFormation/CDK/Pulumi/Bicep/Serverless), SDK calls (`@aws-sdk/client-s3`, `@google-cloud/
storage`, `@azure/storage-blob`, `minio`, `cloudinary`, …), and the logging/telemetry config.
Cover at minimum:

- **Object storage inventory** — every bucket/container and its provider (S3 / GCS / Azure Blob
  / R2 / Spaces / MinIO / Supabase Storage / Firebase Storage). For each: **public-access-block
  status**, **ACL** (private / public-read / public-write / authenticated-read),
  **bucket/IAM/resource policy**, **default encryption** (SSE-S3 / SSE-KMS / CMEK / none),
  **versioning**, **object-lock / WORM**, **lifecycle/expiry**, **logging (access logs)**, and
  whether it is **fronted by a CDN** or served direct. This catalog is a report deliverable.
- **Object key layout & tenancy** — how object keys are generated: random (UUID/ULID/hash) vs
  **predictable/sequential** (incrementing id, email, timestamp, filename-as-key). Is there a
  **per-tenant prefix** (`tenants/<tenantId>/…`) enforced on **read** and **write**? Can a key
  be **overwritten** in place (no versioning + predictable key = silent overwrite)? Note any
  place a client-supplied key/path reaches the storage SDK without a tenant-scoped prefix —
  that is a **storage-layer IDOR** sink.
- **Signed / pre-signed URL posture** — every place the app mints a signed URL (S3
  `getSignedUrl`/`createPresignedPost`, GCS `getSignedUrl`, Azure SAS, Cloudinary signed
  delivery): the **TTL/expiry**, the **scope** (single object vs prefix vs bucket; GET-only vs
  PUT/DELETE), whether the URL is **logged** (app logs, access logs, analytics, error trackers)
  or could land in a **Referer** header, and whether expiry is enforced server-side.
- **Encryption at rest** — bucket default encryption, DB/disk encryption (RDS/Aurora storage
  encryption, EBS encryption, disk-level), backup/dump encryption, KMS key ownership (who can
  decrypt). Note any unencrypted store. (KMS *policy* defers to ../20-secrets-and-cloud-iam/.)
- **Backups, DB dumps & exports** — where backups/snapshots/`pg_dump`/`mysqldump`/CSV-export/
  data-export jobs land: bucket/path, ACL, encryption, retention, and whether an export endpoint
  writes to a **public** or **predictable** location. Snapshot sharing settings (RDS/EBS
  snapshot "public" or shared-account).
- **Stale / orphaned data carriers** — old/unattached EBS volumes, manual snapshots, **public
  AMIs**, abandoned buckets, forgotten staging copies, deleted-but-not-purged versioned objects.
  (Inventory from IaC + any `aws`/`gcloud` config in the repo — do **not** run mutating cloud
  commands.)
- **Log/telemetry pipeline** — every sink the app writes to: stdout/stderr, file logs, the
  logger (`pino`/`winston`/`bunyan`/`console`), APM/error trackers (Sentry/Datadog/New Relic),
  the **SecureNow SDK telemetry**, and any shipping to third parties (Logtail/Logflare/
  Elasticsearch/CloudWatch/S3 log archive). For each: **what fields are written**, whether
  **request/response bodies, headers, query strings, or URLs** are captured, and whether a
  **redaction layer** runs before the sink.
- **Redaction posture (native SecureNow contribution)** — confirm what the SecureNow SDK / log
  pipeline strips before ingestion: `Authorization`, `Cookie`, `Set-Cookie`, `X-API-Key`, bearer
  tokens, API keys, **signed-URL query strings**, webhook secrets, payment tokens, emails, phone
  numbers, PII, and sensitive body fields. Cross-check against the app's own logger config.
  Record exactly which are redacted and which are **not** (each gap is a finding).
- **Audit-trail coverage** — is there an **append-only audit log** of security-sensitive
  actions (login, role change, permission grant, data export, object delete, key/secret access,
  admin action)? Where does it write, is it tamper-evident, is it separate from app logs? Absence
  is an A09 finding.
- **Log injection / forging surface** — any place **untrusted input** (user-agent, headers,
  request body, URL, error message) is written into a log line via string concatenation /
  template without neutralizing CR/LF (`\r\n`) or control characters. CRLF into a log line lets
  an attacker **forge** entries or break log parsing / detection.
- **Retention & third-party shipping** — log/object retention windows (excessive = larger
  breach blast radius), and any pipe that ships logs to a third party **without** a DPA, without
  encryption in transit, or without field-level redaction.
- **SecureNow instrumentation already present** — `securenow/register` / `securenow run` /
  `securenow init` (gives traffic spans automatically, with redaction), any `securenow/events`
  `track()` calls related to storage/logging, and whether the firewall is engaged.

Output of this phase = the report's **Storage & logging surface & inventory** section: the
**bucket catalog** (name / provider / ACL / policy / encryption / versioning / public-access-block
/ CDN), the **key-layout & tenancy table**, the **signed-URL posture table** (mint site / TTL /
scope / logged?), the **encryption-at-rest table**, the **backup/dump/export map**, the
**stale-carrier list** (orphaned volumes / snapshots / public AMIs), the **log-pipeline map**
(sink / fields captured / redaction), the **redaction status** (redacted vs not), the
**audit-trail coverage** statement, the **log-injection sink list**, the **retention &
third-party shipping** table, and a short paragraph naming the real data-at-rest + logging attack
surface for this stack.

---

## Phase 2 — Enumerate threats (exhaustive catalog)

Evaluate **every** threat below against the discovered surface. Each item is either **modeled**
(a row in the threat matrix) or **explicitly N/A** (one line in an "Out of scope" subsection with
the reason — e.g. "GCS items: N/A, S3-only" or "WORM/object-lock: N/A, not enabled and not
required"). Never silently drop an item. Add stack-specific threats you discover that are not
listed — this catalog is the floor, not the ceiling. Tag each modeled row with its **OWASP**
code (**A01** Broken Access Control / **A09** Logging Failures, and/or **API8** / **API9**, or
"—").

**A. Public / misconfigured object storage (OWASP A01 · API8)**
1. Public-read bucket/container exposing private objects to anonymous internet
2. Public-write (anonymous PutObject) bucket — defacement / malware staging / cost abuse
3. Misconfigured bucket policy / IAM resource policy (`Principal:"*"`, wildcard action, `aws:*`)
4. Misconfigured object ACL (`public-read`/`public-read-write`/`authenticated-read`) on private data
5. Public-access-block disabled / not enforced at account or bucket level
6. List-bucket permission to anonymous/any-authenticated (object enumeration via `?list-type`)
7. Static-website-hosting / public CDN origin exposing the raw bucket

**B. Object key, tenancy & overwrite (OWASP A01 · storage-layer IDOR)**
8. Predictable/sequential object keys (incrementing id, timestamp, email) → guess-and-fetch
9. Missing per-tenant prefix isolation — read path not scoped to caller's tenant (storage IDOR)
10. Missing per-tenant prefix isolation — write path lets a tenant write into another's prefix
11. Direct object overwrite — predictable key + no versioning → silent clobber / poisoning
12. Client-supplied key/path reaches the storage SDK unvalidated (`../`, absolute, cross-prefix)
13. Cross-tenant object access via id/key manipulation in a download/serve handler (storage IDOR)

**C. Signed / pre-signed URL abuse (OWASP A01 · API8)**
14. Over-broad signed URL scope (prefix/bucket-wide instead of single object; PUT/DELETE granted)
15. Long-lived signed URL (hours/days/no-expiry) — usable long after the session ends
16. Signed URL leaked into application logs / access logs / error tracker (then replayable)
17. Signed URL leaked via `Referer` header to a third party (image embeds, redirects)
18. No server-side revocation / expiry enforcement — leaked URL valid until natural expiry

**D. Encryption at rest & backups (OWASP A01 · API8)**
19. Unencrypted object storage at rest (no SSE/CMEK)
20. Unencrypted database / disk / volume at rest
21. Backups / DB dumps / exports written to an exposed (public/predictable) location
22. Backups / DB dumps / exports stored unencrypted
23. Snapshot / backup retention with weak access controls (shared-account / public snapshot)
24. Export endpoint writes sensitive data to a guessable/world-readable path

**E. Stale, orphaned & shared data carriers (OWASP A01 · API9)**
25. Orphaned/unattached volumes still carrying recoverable data
26. Stale manual snapshots retained indefinitely (forgotten copies of prod data)
27. Public AMI / shared machine image carrying baked-in data or secrets
28. Abandoned buckets / staging copies of prod data still reachable
29. Deleted-but-not-purged versioned objects / soft-deleted data recoverable by anyone with access

**F. Secrets / tokens / PII in logs (OWASP A09)**
30. Secrets / API keys / tokens written to application logs (no redaction)
31. Passwords / session cookies / Authorization headers written to logs
32. PII (emails, phone, names, addresses, card data) written to logs without redaction
33. Signed-URL query strings (with the signature) written to logs (replayable credential)
34. Full request/response bodies logged on error paths, including sensitive fields
35. Database query logs capturing parameter values containing secrets/PII

**G. Log injection, forging & detection evasion (OWASP A09)**
36. CRLF (`\r\n`) injection into log lines via untrusted input → forged/spoofed entries
37. Control-character / ANSI-escape injection corrupting log viewers or terminals
38. Log-forging to frame another user / hide an attacker's own actions
39. Log-based detection evasion — splitting/padding/poisoning entries so rules under-count
40. Log-line spoofing that breaks downstream parsers / SIEM ingestion (denial of analysis)

**H. Logging completeness & audit trail (OWASP A09)**
41. No audit trail for security-sensitive actions (login, role change, export, delete, key access)
42. Security events logged without enough context to investigate (no IP, user, resource, outcome)
43. Audit log not append-only / tamper-evident (attacker with app access can edit/delete entries)
44. Logs stored only locally / lost on instance termination (no durable, centralized sink)
45. Clocks/timestamps inconsistent or missing → unable to correlate an incident timeline

**I. Telemetry capturing sensitive data without redaction (OWASP A09 · API8)**
46. SecureNow SDK / telemetry capturing request/response bodies without redaction
47. Telemetry capturing `Authorization`/`Cookie`/`X-API-Key` headers without redaction
48. Telemetry capturing query strings containing tokens/signed-URL signatures/PII
49. Telemetry capturing customer-uploaded file/object URLs (re-derivable to private data)
50. APM/error tracker (non-SecureNow) capturing sensitive payloads with no scrubber

**J. Retention, residency & third-party shipping (OWASP A09 · API8)**
51. Excessive log retention (years) enlarging breach blast radius
52. Excessive object/version retention of data that should have expired
53. Logs shipped to a third party without a DPA / contractual control
54. Logs shipped to a third party without encryption in transit or field-level redaction
55. Cross-region/cross-border replication of logs/objects violating residency expectations

**K. Negative-space & observable abuse (what telemetry actually catches)**
56. Storage-IDOR probing in traffic — one IP requesting many distinct object keys/ids on a serve/download route, with elevated 403/404 (key guessing)
57. Bulk-object access / scraping — one IP/client pulling an anomalous count of objects or large aggregate response bytes (mass extraction)
58. Sequential object-id walk — monotonic key/id pattern across requests from one source (enumeration)
59. Spike of 403/404 on the object-serve route (public-bucket discovery / ACL probing)
60. Anomalous response sizes from the download route to a single client (bulk pull)
61. Access to a deprecated/legacy storage path or export endpoint surfacing in live traffic (inventory drift)

**L. Deferred — modeled in sibling models (reference, do not re-derive)**
62. Upload/serve **ingest** validation (MIME/content/virus/SVG/polyglot), the serving path → [../10-file-upload-download/](../10-file-upload-download/file-upload-download-threat-model-prompt.md)
63. PII **classification**, lawful basis, retention/erasure **policy**, DSAR → [../24-data-privacy-pii/](../24-data-privacy-pii/data-privacy-pii-threat-model-prompt.md)
64. IAM **scope / least-privilege** on the storage role, KMS key policy, credential rotation → [../20-secrets-and-cloud-iam/](../20-secrets-and-cloud-iam/secrets-and-cloud-iam-threat-model-prompt.md)

> For 62–64, add **one** matrix row each marked *"deferred — see linked model"*, and only note
> the storage-/log-observable symptom SecureNow adds here (e.g. download-route key probing for
> 62; PII-in-logs mechanical detection for 63; an over-broad storage role surfacing as anonymous
> public access for 64). The full detection/mitigation lives in the linked report.

> Items 1–61 are mostly **A01 Broken Access Control** (public/IDOR/signed-URL/backup-exposure)
> and **A09 Logging Failures** (secrets-in-logs, log injection, audit gaps, telemetry capture),
> with **API8 Misconfiguration** (encryption/ACL/headers) and **API9 Inventory** (stale carriers,
> deprecated paths). Tag each row accordingly. Each must be either a matrix row or an explicit
> N/A line with a reason — do not silently drop any item.

---

## Phase 3 — Audit the code & config (findings only — do not fix)

For **each** modeled threat that maps to real code/IaC/config, locate the responsible source and
record a **finding** for the report's "Code & config findings" section. A finding is:

- **Location** — `file:line` (clickable): the IaC resource block, the bucket policy JSON, the
  storage-SDK call site, the signed-URL mint site, the logger config, or the log-write line.
- **Pattern** — quote the 1–8 relevant lines. State the missing control precisely (e.g.
  `acl = "public-read"` on a private bucket; `block_public_acls = false`; bucket policy with
  `"Principal": "*"`; `getSignedUrl(..., { expiresIn: 604800 })` (7-day URL); `logger.info(\`auth \${req.headers.authorization}\`)`; object key built as `\`${userId}/${req.query.file}\`` with no tenant check and no `../` rejection; `server_side_encryption_configuration` absent; `logger.info(userInput)` with no CRLF stripping).
- **Why exploitable** — the concrete action an attacker takes and what they achieve (anonymous
  GET of a private object; guessing key `tenants/123/invoice-1001.pdf` → another tenant's
  invoice; replaying a leaked signed URL; reading a token from the access log; forging a log line
  to hide a delete).
- **Severity** — critical / high / medium / low (impact × reachability; public-read PII bucket =
  critical; missing audit trail = high; excessive retention = medium).
- **Recommended fix (described, not applied)** — the specific change, **as the primary fix**:
  e.g. "enable account + bucket public-access-block and set ACL `private`"; "replace the wildcard
  bucket policy with a scoped principal and explicit actions"; "generate object keys from a
  random UUID and enforce a `tenants/<tenantId>/` prefix on both read and write; reject
  client-supplied `../`/absolute paths"; "drop signed-URL TTL to ≤5 min, scope to a single object
  GET, and never log the signed URL"; "enable SSE-KMS / CMEK default encryption"; "write
  backups/dumps to a private, encrypted bucket with object-lock and a short lifecycle"; "delete
  orphaned volumes/snapshots and de-publicize the AMI"; "add a redaction layer that strips
  `Authorization`/`Cookie`/keys/PII and signed-URL query strings before any sink"; "neutralize
  CR/LF and control chars before writing untrusted input to a log line (or use structured
  logging with separate fields)"; "add an append-only, tamper-evident audit log for sensitive
  actions". Reference the secure pattern, not a code diff. **You must not edit the codebase,
  IaC, or any bucket policy.**

If a control exists and is correct (public-access-block on, private ACLs, SSE-KMS default,
random keys with tenant prefix, short-scoped signed URLs, a redaction layer, an append-only audit
log), note it as a **strength** — the posture must be honest. Absence of a control where the
surface exists is itself a finding ("no redaction layer anywhere"; "no audit trail").

Look specifically for:

**Bucket / ACL / policy flaws** — `acl = "public-read"`/`"public-read-write"`;
`block_public_acls`/`block_public_policy`/`ignore_public_acls`/`restrict_public_buckets` set to
`false` or absent; bucket policies with `"Principal": "*"`, `"Action": "s3:*"`, or a wildcard
resource; GCS `allUsers`/`allAuthenticatedUsers` IAM bindings; Azure container public-access
`blob`/`container`; static-website-hosting on a data bucket. *Recommended fixes must mention*
public-access-block, private ACLs, scoped principals/actions, and removing public website hosting.

**Object-key / tenancy / overwrite flaws** — keys built from user input, sequential ids,
emails, or original filenames; no `tenants/<tenantId>/` prefix enforced on read **and** write;
client-supplied path reaching the SDK without `../`/absolute rejection; versioning off on a
bucket where overwrite matters; download/serve handlers that fetch by a client-supplied key/id
without authorizing the caller against that object's tenant. *Recommended fixes must mention*
random keys, enforced tenant prefixes on both paths, path-traversal rejection, object versioning,
and per-object authorization in the serve handler.

**Signed-URL flaws** — long `expiresIn`/SAS validity; prefix- or bucket-scoped signatures;
PUT/DELETE granted where GET suffices; the signed URL written to logs/analytics/error trackers;
no `referrerPolicy`/no-referrer on pages embedding signed URLs. *Recommended fixes must mention*
short TTLs, single-object minimal-verb scope, never logging the URL/signature, and
`Referrer-Policy: no-referrer`.

**Encryption / backup flaws** — `server_side_encryption_configuration` absent; `storage_encrypted
= false` (RDS); `encrypted = false` (EBS); backups/dumps/exports written unencrypted or to a
public/predictable path; snapshots shared with `all`/another account. *Recommended fixes must
mention* SSE-KMS/CMEK default encryption, encrypted RDS/EBS, private encrypted backup buckets
with object-lock, and de-sharing snapshots.

**Logging / redaction flaws** — `logger.*`/`console.*`/error-handler lines that interpolate
`req.headers`, `req.body`, `req.query`, `authorization`, `cookie`, tokens, or signed URLs;
no redaction/scrubber on the logger, the APM/error tracker, or the SecureNow SDK; full-body
logging on error paths; DB query logging with parameter values. *Recommended fixes must mention*
a central redaction layer (denylist of `Authorization`/`Cookie`/`Set-Cookie`/`X-API-Key`/tokens/
PII/signed-URL query strings), structured logging with explicit allowlisted fields, and
disabling body/param logging on sensitive routes.

**Log-injection flaws** — untrusted input written into a log line via concatenation/template
without stripping `\r`/`\n`/control characters; non-structured logging that lets a `\n` start a
forged line. *Recommended fixes must mention* CR/LF + control-char neutralization, structured
(JSON) logging with separate fields, and encoding untrusted values.

**Audit-trail / completeness flaws** — no append-only log of security-sensitive actions; events
logged without IP/user/resource/outcome; audit entries editable by app-level access; logs only
local (lost on terminate). *Recommended fixes must mention* a separate append-only/tamper-evident
audit sink, mandatory context fields, and durable centralized log shipping.

**Stale-carrier / inventory flaws** — orphaned volumes, indefinitely retained manual snapshots,
public/shared AMIs, abandoned buckets, deleted-but-not-purged versions. *Recommended fixes must
mention* lifecycle expiry, snapshot retention limits, de-publicizing AMIs, and deleting
abandoned carriers. (Inventory from IaC/config — **do not run mutating cloud commands**.)

---

## Phase 4 — Map every modeled threat to SecureNow detection + mitigation

Classify each threat with exactly one coverage badge. **Be honest:** this domain is mostly
cloud-config + code audit, so most rows are 🟡 (SecureNow contains the abuser / audits + the
**cloud-or-log-config fix is primary**) or 🔴, with a 🟢 cluster only on the **traffic-observable
probing** rules and the **native telemetry-redaction** posture.

- 🟢 **COVERED** — detectable + mitigable with SecureNow today on telemetry already flowing.
  Lands here: **storage-IDOR / bulk-object probing in traffic** (catalog K), 403/404 spikes on
  the serve route, sequential-id walks, anomalous response sizes, deprecated-path access, **and**
  the **native SDK telemetry redaction** of `Authorization`/`Cookie`/keys/PII/signed-URL query
  strings (a control SecureNow *applies*, not just detects).
- 🟡 **PARTIAL** — works after the customer adds instrumentation (`track('storage.*')` /
  `track('log.*')` events for app-internal rejections), **or** SecureNow can only *contain the
  abuser at the edge* (rate-limit / challenge / block the probing IP) while the **real fix is a
  bucket policy / ACL / encryption / signed-URL / redaction / audit-log change**. Pair the
  edge-containment **with** the cloud/log-config fix on every such row.
- 🔴 **GAP** — SecureNow cannot detect or mitigate this today (e.g. a public bucket nobody has
  probed yet, an unencrypted backup, a missing audit trail, excessive retention — these emit no
  traffic and no event). **Still include it**: give the cloud/log-config fix, then add the line
  *"Requires SecureNow team — contact your SecureNow account contact (or in-dashboard support)
  to request support for this threat."* Collect all gaps in the report's "Known gaps & SecureNow
  feature requests" section.

> **Be honest about what is edge-detectable vs a config fix.** SecureNow sees **traffic** and
> **events** and redacts its own telemetry; it contains actors via firewall / rate-limit /
> challenge / block / signature instant-block. It **cannot** see a bucket's ACL, an
> unencrypted volume, a 7-day signed URL, or a missing audit trail — those are **cloud/code
> config**. SecureNow detects the *abuse that traffic reveals* (the key-guessing probe, the bulk
> pull, the 403/404 storm against the serve route) and contains the source, but the missing
> control is the primary fix. **Pair the edge control with the cloud/log fix on every such row.**
> A flaw that emits no traffic and no event is 🔴 until the app emits the event in Phase 3's
> recommended fix.

Use **only** the SecureNow building blocks below. Never invent CLI flags, event names, or SQL
columns.

> **Ready-to-copy command unit (required for every detection rule).** Each detection you emit —
> in Phase 4 and in the Detection & Mitigation report — is a **complete, copyable unit**, never a
> fragment. For each rule emit, in order: (1) the **SQL** in its own fenced block, ending with a
> `-- rules/<name>.sql` comment header; (2) a line **saving it** to `rules/<name>.sql`; (3) the
> full `securenow alerts rules create …` command referencing `--sql @rules/<name>.sql`; (4) the
> `securenow alerts rules test <RULE_ID> --mode dry_run --wait` dry-run. The exact flags must
> match `securenow alerts rules --help` from Phase 0.5 (`--name`/`--sql`/`--apps`/`--severity`/
> `--schedule`/`--nlp`). Save each rule's SQL to `rules/<name>.sql` so `--sql @rules/<name>.sql`
> resolves. Keep all existing conventions below — the **correct tenant-scope column per table**,
> the `client_ip` coalesce, the `ts_bucket_start` + `kind = 2` guards, `HAVING ip != ''`, the
> **SDK / log-pipeline redaction posture** as the native control, the **storage-IDOR /
> bulk-access traffic detection** as the 🟢 cluster, and the **cloud-storage / log-config fix as
> the primary remediation** on config-rooted rows. Note any pre-existing or system rule (from
> Phase 0) instead of duplicating it.

### 4a. Instrumentation (what storage/log detections feed on)

Once the app runs under `securenow run` / `securenow/register` / `securenow init`, **HTTP
traffic is captured automatically and redacted** — status codes (incl. **403** and **404**),
methods, paths, client IPs, response sizes. **The storage-probing rules in catalog K need no
events** — they read the serve/download route's spans directly.

> **Native redaction is the headline native control here.** Confirm via `securenow env --json`
> that the SDK strips `Authorization`, `Cookie`, `Set-Cookie`, `X-API-Key`, bearer tokens, API
> keys, **signed-URL query strings**, and PII before ingestion. This is what keeps SecureNow's
> own telemetry from becoming a new copy of the "secrets in logs" problem (catalog F/I). If the
> env output shows a field is **not** redacted, that is a high-severity finding *and* a config
> change (extend the SDK redaction denylist), not a SecureNow-team gap.

Add `securenow/events` `track()` only for app-internal signals traffic can't see (never throws):

```js
const { track } = require('securenow/events');

// The app's own storage authorization rejected a cross-tenant / cross-prefix object access:
track('storage.access.denied', { userId, ip, attributes: { route: '/api/files/:id', reason: 'cross_tenant|cross_prefix|not_owner|path_traversal', object_key_hash: '<hash>' } });

// A signed URL was minted (feeds scope/volume detection — do NOT include the signature):
track('storage.signedurl.issued', { userId, ip, attributes: { route: '/api/files/:id/url', scope: 'object|prefix|bucket', verb: 'GET|PUT|DELETE', ttl_seconds: '300' } });

// A bulk export / dump / download-all job ran (feeds abuse-rate detection):
track('storage.bulk.export', { userId, ip, attributes: { route: '/api/export', object_count: '500', flow: 'export|backup|download_all' } });

// The redaction layer dropped a sensitive field before a log/telemetry sink (high-signal hygiene):
track('log.redaction.applied', { ip, attributes: { sink: 'app_log|telemetry|error_tracker', field: 'authorization|cookie|api_key|signed_url|pii', count: '1' } });

// Untrusted input with CR/LF / control chars was sanitized before a log write (log-injection attempt):
track('log.injection.blocked', { ip, attributes: { route: '/api/example', field: 'user_agent|header|body|url', reason: 'crlf|control_char' } });

// A security-sensitive action was recorded to the audit trail (feeds audit-completeness checks):
track('audit.event', { userId, ip, attributes: { action: 'login|role_change|export|object_delete|key_access|admin_action', resource_id_hash: '<hash>', outcome: 'success|failure' } });

// A deprecated/legacy storage or export path was hit (API9 inventory drift):
track('storage.deprecated.called', { ip, attributes: { route: '/v1/export', superseded_by: '/v2/export' } });
```

> Hash or omit any PII or credential before it becomes an attribute value — **never put a raw
> object key, signed URL, signature, token, or email in an attribute** (hash it). The
> instrumentation must not become a new leak path; this is the same discipline the Phase 1
> redaction check enforces.

Recommended storage/log event taxonomy — rules match these **exact strings**:

| Event | Emit when |
|---|---|
| `storage.access.denied` | the app's storage authz rejects a cross-tenant / cross-prefix / traversal object access |
| `storage.signedurl.issued` | a signed/pre-signed URL is minted (scope + TTL recorded; never the signature) |
| `storage.bulk.export` | a bulk export / dump / download-all flow executes |
| `log.redaction.applied` | the redaction layer strips a sensitive field before a sink |
| `log.injection.blocked` | CR/LF or control chars in untrusted input are neutralized before a log write |
| `audit.event` | a security-sensitive action is written to the audit trail |
| `storage.deprecated.called` | a deprecated storage/export endpoint or version is invoked |

Custom `attributes` become queryable as `attributes_string['<key>']` (e.g.
`attributes_string['reason']`, `attributes_string['scope']`). Ingest enriches every IP with
**ASN/org** (`client.asn`, `client.as_org`) — enabling datacenter-origin / scraper detection
with no extra code.

### 4b. Detection rules — SQL conventions

Two query shapes. Both **must** keep the tenant scope and **must** select an `ip` column (per-IP
aggregation is what remediation/auto-block keys on). **The tenant-scope column differs by table**
— using the wrong one fails with `UNKNOWN_IDENTIFIER`:

- **logs/events** (`signoz_logs.distributed_logs_v2`) → `resources_string['service.name'] IN (__USER_APP_KEYS__)`
- **traces/HTTP** (`signoz_traces.distributed_signoz_index_v3`) → `` `resource_string_service$$name` IN (__USER_APP_KEYS__) ``

When grouping by `ip`, add `HAVING ip != '' AND …` so rows with no client IP don't aggregate into
an empty-key bucket. Traffic columns proven available: `response_status_code`, `kind` (server
span = 2), `ts_bucket_start`, `attributes_string['http.target']`, the `client_ip` coalesce below.
Confirm any other column (`http.method`, response size) with a `--mode dry_run` before relying on
it; OTEL SDK versions vary.

**Traffic-based — storage-IDOR / object-key probing on the serve route (many distinct keys + 403/404):**

```sql
WITH coalesce(nullIf(attributes_string['http.client_ip'], ''), nullIf(attributes_string['net.peer.ip'], ''), nullIf(attributes_string['network.peer.address'], '')) AS client_ip
SELECT client_ip AS ip,
       uniqExact(attributes_string['http.target']) AS distinct_objects,
       countIf(response_status_code IN ('403','404')) AS denied
FROM signoz_traces.distributed_signoz_index_v3
WHERE `resource_string_service$$name` IN (__USER_APP_KEYS__)
  AND timestamp >= now64(9) - INTERVAL 10 MINUTE
  AND ts_bucket_start >= toUInt64(toUnixTimestamp(now() - INTERVAL 10 MINUTE)) - 1800
  AND kind = 2
  AND (attributes_string['http.target'] LIKE '/api/files/%' OR attributes_string['http.target'] LIKE '%/download%' OR attributes_string['http.target'] LIKE '%/objects/%')
GROUP BY ip
HAVING ip != '' AND distinct_objects >= 40 AND denied >= 20
```

**Traffic-based — bulk-object access / scraping (anomalous object count from one client):**

```sql
WITH coalesce(nullIf(attributes_string['http.client_ip'], ''), nullIf(attributes_string['net.peer.ip'], ''), nullIf(attributes_string['network.peer.address'], '')) AS client_ip
SELECT client_ip AS ip,
       count() AS object_requests,
       uniqExact(attributes_string['http.target']) AS distinct_objects
FROM signoz_traces.distributed_signoz_index_v3
WHERE `resource_string_service$$name` IN (__USER_APP_KEYS__)
  AND timestamp >= now64(9) - INTERVAL 15 MINUTE
  AND ts_bucket_start >= toUInt64(toUnixTimestamp(now() - INTERVAL 15 MINUTE)) - 1800
  AND kind = 2
  AND (attributes_string['http.target'] LIKE '/api/files/%' OR attributes_string['http.target'] LIKE '%/download%' OR attributes_string['http.target'] LIKE '%/objects/%')
GROUP BY ip
HAVING ip != '' AND object_requests >= 500
```

**Traffic-based — 403/404 storm on the object-serve route (public-bucket / ACL discovery probing):**

```sql
WITH coalesce(nullIf(attributes_string['http.client_ip'], ''), nullIf(attributes_string['net.peer.ip'], ''), nullIf(attributes_string['network.peer.address'], '')) AS client_ip
SELECT client_ip AS ip,
       countIf(response_status_code IN ('403','404')) AS denied,
       count() AS total
FROM signoz_traces.distributed_signoz_index_v3
WHERE `resource_string_service$$name` IN (__USER_APP_KEYS__)
  AND timestamp >= now64(9) - INTERVAL 10 MINUTE
  AND ts_bucket_start >= toUInt64(toUnixTimestamp(now() - INTERVAL 10 MINUTE)) - 1800
  AND kind = 2
  AND (attributes_string['http.target'] LIKE '/api/files/%' OR attributes_string['http.target'] LIKE '%/download%' OR attributes_string['http.target'] LIKE '%/objects/%')
GROUP BY ip
HAVING ip != '' AND denied >= 60
```

**Traffic-based — deprecated / legacy storage or export path access (API9 inventory drift):**

```sql
WITH coalesce(nullIf(attributes_string['http.client_ip'], ''), nullIf(attributes_string['net.peer.ip'], ''), nullIf(attributes_string['network.peer.address'], '')) AS client_ip
SELECT client_ip AS ip,
       count() AS hits,
       uniqExact(attributes_string['http.target']) AS paths
FROM signoz_traces.distributed_signoz_index_v3
WHERE `resource_string_service$$name` IN (__USER_APP_KEYS__)
  AND timestamp >= now64(9) - INTERVAL 30 MINUTE
  AND ts_bucket_start >= toUInt64(toUnixTimestamp(now() - INTERVAL 30 MINUTE)) - 1800
  AND kind = 2
  AND (attributes_string['http.target'] LIKE '/v1/export%' OR attributes_string['http.target'] LIKE '%/backup%' OR attributes_string['http.target'] LIKE '%/dump%')
GROUP BY ip
HAVING ip != '' AND hits >= 1
```

**Events-based — app storage-authz denials (cross-tenant / traversal object access; query the logs table):**

```sql
SELECT
  attributes_string['http.client_ip'] AS ip,
  attributes_string['reason']         AS reason,
  attributes_string['route']          AS route,
  count() AS denials
FROM signoz_logs.distributed_logs_v2
WHERE resources_string['service.name'] IN (__USER_APP_KEYS__)
  AND attributes_string['event.type'] = 'storage.access.denied'
  AND timestamp >= now() - INTERVAL 15 MINUTE
GROUP BY ip, reason, route
HAVING ip != '' AND denials >= 10
```

**Events-based — log-injection attempts blocked (CRLF/control chars in untrusted input):**

```sql
SELECT
  attributes_string['http.client_ip'] AS ip,
  attributes_string['field']          AS field,
  attributes_string['reason']         AS reason,
  count() AS attempts
FROM signoz_logs.distributed_logs_v2
WHERE resources_string['service.name'] IN (__USER_APP_KEYS__)
  AND attributes_string['event.type'] = 'log.injection.blocked'
  AND timestamp >= now() - INTERVAL 30 MINUTE
GROUP BY ip, field, reason
HAVING ip != '' AND attempts >= 5
```

**Events-based — bulk-export abuse (one client running repeated large exports):**

```sql
SELECT
  attributes_string['http.client_ip'] AS ip,
  attributes_string['flow']           AS flow,
  count() AS exports
FROM signoz_logs.distributed_logs_v2
WHERE resources_string['service.name'] IN (__USER_APP_KEYS__)
  AND attributes_string['event.type'] = 'storage.bulk.export'
  AND timestamp >= now() - INTERVAL 30 MINUTE
GROUP BY ip, flow
HAVING ip != '' AND exports >= 5
```

The other storage/log events follow the **same shape** — swap the `event.type` filter and the
threshold: `storage.signedurl.issued` (≥1 with `scope='bucket'` or `verb='DELETE'` → over-broad
mint, notify-only), `storage.deprecated.called` (≥1 → inventory drift), `audit.event` (use to
**confirm coverage** of sensitive actions, not to block), `log.redaction.applied` (≥1 →
hygiene-working signal, notify-only / dashboard panel).

> **Encryption / ACL / backup / retention / stale-carrier threats have no traffic and no event**
> — they are **config-audit findings** (Phase 3), not detection rules. Do not author SQL that
> pretends to detect a bucket ACL; mark those rows 🔴 (or 🟡 if a probe would reveal them) and
> point at the cloud-config fix. **There is no system signature rule for storage** — the
> exploit-signature `instant.block` rules (SQLi/XSS/RCE) apply only if a payload-borne attack
> reaches the serve route; reference them for catalog-K injection-shaped probes, do not author
> duplicate pattern SQL.

Useful attributes/columns: `event.type`, `http.client_ip`, `http.target`,
`response_status_code`, `kind`, `client.asn`, `client.as_org`, and your storage/log attributes
(`route`, `reason`, `scope`, `verb`, `flow`, `field`, `sink`, `action`).

Create + validate each rule as the **ready-to-copy unit** (SQL → save → create → dry-run). Save
the SQL first so `--sql @rules/<name>.sql` resolves, then create, then dry-run before it runs
live:

```sql
-- rules/storage-idor-probing.sql
WITH coalesce(nullIf(attributes_string['http.client_ip'], ''), nullIf(attributes_string['net.peer.ip'], ''), nullIf(attributes_string['network.peer.address'], '')) AS client_ip
SELECT client_ip AS ip,
       uniqExact(attributes_string['http.target']) AS distinct_objects,
       countIf(response_status_code IN ('403','404')) AS denied
FROM signoz_traces.distributed_signoz_index_v3
WHERE `resource_string_service$$name` IN (__USER_APP_KEYS__)
  AND timestamp >= now64(9) - INTERVAL 10 MINUTE
  AND ts_bucket_start >= toUInt64(toUnixTimestamp(now() - INTERVAL 10 MINUTE)) - 1800
  AND kind = 2
  AND (attributes_string['http.target'] LIKE '/api/files/%' OR attributes_string['http.target'] LIKE '%/download%' OR attributes_string['http.target'] LIKE '%/objects/%')
GROUP BY ip
HAVING ip != '' AND distinct_objects >= 40 AND denied >= 20
```

```bash
# save the SQL, then create the rule from it, then dry-run before it goes live:
securenow alerts rules create \
  --name "Storage: object-key probing (storage-IDOR)" \
  --sql @rules/storage-idor-probing.sql \
  --apps <APP_KEY> \
  --severity high \
  --schedule "*/5 * * * *" \
  --nlp "single IP requesting 40+ distinct object keys with 20+ 403/404 in 10 minutes on the serve route"

securenow alerts rules test <RULE_ID> --mode dry_run --wait   # validate before it runs live
```

Repeat this four-step unit for every rule above — the bulk-object-access, 403/404-storm,
deprecated-path, and each events-based rule each get their own `rules/<name>.sql` + create +
dry-run. The flags must match `securenow alerts rules --help` from Phase 0.5.

#### Test mode for false-positive-prone rules

Alert rules have a lifecycle **mode**: `test` = **detect-only, NO mitigation** vs `prod` = full
(mitigation / auto-action armed) — plus a **status** (`Active | Disabled | Paused`). Manage with:

```bash
securenow alerts rules update <RULE_ID> --mode test     # detect-only: fires notifications, takes NO action
# …observe real traffic for several days; tune the threshold; add securenow fp exclusions for any FPs…
securenow alerts rules update <RULE_ID> --mode prod      # promote: arm the mitigation / auto-action
securenow alerts rules update <RULE_ID> --status Paused  # or --enable / --disable / --pause shortcuts
```

**Rule of thumb:** any detection that can **false-positive** — heuristic thresholds (object-key
probing / bulk-pull / scrape / 403-404-storm / enumeration counts), broad patterns, anomaly /
volume rules, anything tuned to YOUR traffic — must ship in **`--mode test` first**. Run it
detect-only for **3–7 days of real traffic**, review what it flags, raise/lower the threshold and
add `securenow fp` exclusions for legitimate hits (e.g. an internal backup/export worker, a
partner batch sync), then `--mode prod` to arm mitigation. Only **high-precision** rules
(exploit-signature SQLi/XSS/RCE matches on the serve route, exact-match IoCs, known-bad ASN hits)
may go straight to `prod`. In the report, **tag each rule `test-first` or `prod-ready`** and say
why. (`securenow alerts rules test <id> --mode dry_run --wait` is the separate one-off *query*
validation — run it before either.)

For THIS domain almost every storage/log detection is threshold-tuned (object-key probing,
bulk-object access, 403/404 storm, storage-authz denials, log-injection, bulk-export) and is
therefore **`test-first`**; the only `prod-ready` rows are payload-borne probes caught by the
exploit-signature `instant.block` rules. Tag every rule you emit `test-first` or `prod-ready`.

### 4c. Mitigation commands (the only allowed remediation surface)

For storage/log abuse, SecureNow **contains the actor at the edge**; the **cloud-storage / log
config fix removes the underlying weakness**. The cloud/log fix is the **primary** remediation on
almost every row — always pair them. Once a threat is confirmed, **choose the narrowest effective
mitigation(s) from ALL of the toolbox below** and combine them (e.g. rate-limit the serve route +
block the worst enumerator IP + challenge a NAT egress). Re-check every command/flag against the
installed SDK in Phase 0.5 (`securenow <cmd> --help`); annotate `# requires securenow >= <ver>` if
absent. Scope by **app / env / route / method / IP / duration** to avoid hitting real users (an
internal backup/export worker, a partner batch sync).

| # | Mitigation | Command (ready-to-copy) | Use / scope |
|---|---|---|---|
| 1 | **Free firewall (network)** | `securenow firewall enable --app <APP_KEY> --env production` · `securenow run --firewall-only` · test `securenow firewall test-ip <ip> --path /x --method GET` | 500k+ known-bad IPs, hourly refresh; drop scanners/scrapers before the serve route. No app change. |
| 2 | **Exploit-signature instant block** | enable the `instant` config on the system SQLi/XSS/RCE signature rules (dashboard / MCP `securenow_alert_rule_instant_update`); custom rule → create with `--execution-mode instant` | synchronous ~2.6s block of the matching request (payload-borne probe / path-traversal payload / injection-shaped key on the serve route). Don't duplicate pattern SQL. |
| 3 | **IP block — global** | `securenow blocklist add <ip> --app <APP_KEY> --env production --reason "..."` | confirmed-malicious enumerator / scraper, all routes. |
| 4 | **IP block — scoped to route (+ method)** | `securenow blocklist add <ip> --route /api/files* --mode prefix --method ALL --app <APP_KEY> --env production --reason "..."` (`--mode exact\|prefix\|regex`, `--method GET\|POST\|…\|ALL`) | block an IP only on the serve/download/export path; least collateral. |
| 5 | **IP block — temporary / time-boxed** | `securenow blocklist add <ip> --duration 24h --reason "..."` (`30m`,`24h`,`7d`) · reverse `securenow blocklist unblock <id> --reason "..."` | auto-expiring containment of an enumerator; audit-preserving unblock. |
| 6 | **Rate limit — per IP** | `securenow ratelimit add <ip> --limit 100 --window 1m --duration 24h --reason "..."` | throttle one abusive client (object-key probing, bulk pull) across the app. |
| 7 | **Rate limit — per route (all clients, per-IP budget)** | `securenow ratelimit add --route /api/files --mode prefix --method GET --limit 60 --window 1m --key-by ip` | cap the expensive/abusable serve or export endpoint for everyone, budgeted per IP. |
| 8 | **Rate limit — per route + IP** | `securenow ratelimit add <ip> --route /api/export --mode exact --method POST --limit 5 --window 1m --duration 24h` · NL `securenow ratelimit from-text "rate limit /api/export to 5/min for 24h" --yes` · test `securenow ratelimit test <ip> --path /api/files --method GET` | precise throttle of one client on the serve/export route. |
| 9 | **CAPTCHA / proof-of-work challenge** | `securenow challenge add --route /api/files --difficulty 16 --clearance 30m` (route-wide) **or** `securenow challenge add <ip> --route /api/files --difficulty 18 --clearance 30m` · test `securenow challenge test <ip> --path /api/files --method GET` | bot scraping / object-key enumeration from **shared / NAT / CGNAT** egress — a human passes once, a key-walking script can't. Prefer over a hard block when real users share the IP. |
| 10 | **Auto-block (risk-scored)** | `securenow automation defaults --yes` (≥95→7d, 90–94→72h, 85–89→24h) · custom `securenow automation create --conditions '[...]' --actions '[...]'` · preview `securenow automation dry-run <id>` | hands-off blocking by risk score; actions include block / rate_limit / requireCaptcha. |
| 11 | **Session revocation** | `securenow revoke …` (SDK `securenow/sessions` `guard()` / `isRevoked()`) | if an enumerator is an authenticated session abusing signed-URL minting / bulk export — kill the session, not the IP. |
| 12 | **Trusted IP (suppress)** | `securenow trusted add <ip> --label "Backup job / partner sync / monitor"` | stop false positives from known-good infra (internal backup/export workers, partner batch sync) — suppresses detection **and** mitigation. NOT deny-by-default. |
| 13 | **Allowlist (deny-by-default)** | `securenow allowlist add <ip> --label "..." --reason "..."` ⚠️ once any entry exists, ONLY listed IPs reach the app | lockdown of an internal-only admin/export surface. Never for a public serve route. |
| 14 | **False-positive exclusion** | `securenow fp create --conditions '[...]' --rule-scope this_rule --reason "..."` · `securenow fp mark <notification-id> <ip> --rule-scope this_rule` · preview `securenow fp dry-run --conditions '[...]'` | keep a noisy probing/bulk-export rule quiet (legitimate exporter, internal job) without weakening it. |
| 15 | **Cloud-storage / log-config / code fix (primary for root cause)** | *described in the Code-Findings report, never auto-applied* | the actual fix: enable public-access-block + private ACLs, scope the bucket policy, enforce tenant-prefix isolation, randomize keys, shorten signed-URL TTL & scope, enable SSE-KMS/CMEK, encrypt backups, add the redaction layer, neutralize CRLF before log writes, add the append-only audit trail, set retention/lifecycle. SecureNow contains the *abuser*; the fix removes the *flaw*. |

**Choosing per threat** — by **confidence**: exploit-signature/exact IoC on the serve route →
instant-block or block; probable scraper/enumerator on shared egress → **challenge**; noisy /
legit-mixed storage traffic (object-key probing, bulk pull, 403-404 storm, bulk-export) →
**rate-limit (test-mode first)**; an authenticated session abusing export/signed-URL minting →
**revoke**; known-good backup/partner noise → **trusted / fp**. By **blast radius**: always scope
to the narrowest `route`/`method`/`IP`/`duration` that stops the abuse; on NAT/CGNAT/shared IPs
prefer challenge/rate-limit over a hard block (a block nukes legitimate users, a challenge lets
humans through and stops the key-walking script). **Crucially for THIS domain, storage-IDOR
probing and bulk-access are *traffic-detectable* and can be rate-limited / challenged / blocked at
the edge (rows 1–14), but the underlying bucket ACL / policy / encryption / signed-URL-scope /
redaction / audit-trail weakness is a cloud-config / code fix (row 15) — pair the edge control
with the cloud/log fix on every config-rooted row (catalog A–J); SecureNow contains the abuser,
the fix removes the flaw.** Recommend **notify-only** (no auto action) for false-positive-prone
signals (legitimate bulk exporters, internal backup/replication jobs, analytics crawlers) with the
runbook command the human runs after confirming.

### 4d. Testing every detection and mitigation

Only test against apps/environments the user owns; prefer `--env local`/staging. For synthetic
source IPs use TEST-NET ranges (`192.0.2.0/24`, `198.51.100.0/24`, `203.0.113.0/24`).

```bash
# Synthetic storage-authz denials — exercise the events-based storage-IDOR rule end to end:
for i in $(seq 1 12); do
  securenow event send storage.access.denied --ip 203.0.113.50 \
    --attrs route=/api/files/:id,reason=cross_tenant,object_key_hash=abc123,test=true
done

# Synthetic log-injection attempt:
for i in $(seq 1 6); do
  securenow event send log.injection.blocked --ip 203.0.113.50 \
    --attrs route=/api/comment,field=user_agent,reason=crlf,test=true
done

# Synthetic bulk-export abuse:
for i in $(seq 1 6); do
  securenow event send storage.bulk.export --ip 203.0.113.51 \
    --attrs route=/api/export,flow=download_all,object_count=500,test=true
done

# Validate a rule query without waiting for the schedule:
securenow alerts rules test <RULE_ID> --mode dry_run --wait

# Traffic-based rules (object-key probing / bulk pull / 403-404 storm) — generate spans, then check pipeline:
securenow test-span "threat-model.storage.smoke"
securenow forensics "requests and 403/404 by IP on /api/files in the last hour" --env production

# Mitigation verification:
securenow ratelimit test 203.0.113.50 --path /api/files --method GET
securenow challenge test 203.0.113.50 --path /api/files --method GET
securenow firewall test-ip 203.0.113.50 --app <APP_KEY> --env production

# Redaction verification (the native control) — confirm sensitive fields are stripped:
securenow env --json     # inspect the resolved redaction denylist (Authorization/Cookie/keys/signed-url/PII)
securenow forensics "recent requests to /api/files showing captured headers" --env production
#   then confirm no Authorization/Cookie/signed-URL signature appears in the captured telemetry.

# Confirm + clean up:
securenow notifications list --limit 10
securenow blocklist list      # then: securenow blocklist unblock <id> --reason "threat-model test"
securenow challenge list      # then: securenow challenge remove <id>
```

Every 🟢/🟡 threat row in the report must have a concrete test recipe (commands + expected
outcome: which rule fires, which notification appears, what the mitigation does). For
config-audit (🔴) rows with no event, the "test" is the **verification step** (e.g. "confirm
public-access-block ON", "confirm `securenow env` redacts `Authorization`") — state it explicitly.

---

## Phase 5 — Write the FOUR deliverables (two tracks)

Write **four files** into `threat/23-storage-and-logs/` — two tracks, each Markdown + HTML:

1. `storage-and-logs-detection-mitigation.md` + `.html` — the **operational runbook** (what to
   run in SecureNow). Sections in §5a.
2. `storage-and-logs-code-findings.md` + `.html` — the **code/config audit** (issues + fixes,
   described not applied). Sections in §5b.

The two tracks **cross-link**: the gaps/instrumentation/config-fix rows in the detection report
link to the relevant code finding, and each code finding links back to the detection/mitigation
row it backs. Both HTML files are **self-contained** (inline CSS + the copy `<script>`, no
network) and use the skeletons in §5c, with every command/SQL block wrapped in a `.cmd` so it
gets a working **Copy** button.

### 5a. Detection & Mitigation report — sections (both `.md` and `.html`), in order

1. **Executive summary** — stats line (N threats modeled · N covered · N partial · N gaps ·
   N rules to create · N mitigations), top 3 detectable storage/logging risks for this stack,
   installed `securenow` version + app key + firewall state, and a one-line OWASP note (A01 / A09
   owned here; API8/API9 where applicable; what is deferred to the file-upload / data-privacy /
   secrets-IAM models).
2. **SDK & environment** — installed SDK version (from `node_modules/securenow`, Phase 0.5), app
   key(s), environment, firewall state, existing rules/automations/challenge rules (from Phase 0),
   and the **resolved redaction denylist** (`securenow env`). There is **no system signature rule
   for storage** — note that the exploit-signature `instant.block` rules (SQLi/XSS/RCE) apply only
   to payload-borne probes on the serve route.
3. **Threat → Detection → Mitigation matrix** — one row per modeled threat:
   `# | Threat | OWASP | Coverage 🟢/🟡/🔴 | Detection (rule name or "—") | Signal (threshold+window) | Schedule | Sev | Mode (test-first/prod-ready) | Mitigation`.
   Severity ∈ {critical, high, medium, low}. Each row's **Mitigation** cell must name
   **specific, scoped** mitigation(s) chosen from the §6/4c toolbox (firewall · instant-block ·
   block [global / route / method / temporary] · rate-limit [IP / route / IP+route] · challenge ·
   auto-block · revoke · trusted · allowlist · fp · cloud-storage/log-config fix) with the route /
   method / IP / duration scope — never a generic "block the IP." Each row that creates a rule
   carries a **`test-first` or `prod-ready`** tag in the Mode column (almost every storage/log
   threshold rule is `test-first`; only payload-borne `instant.block` rows are `prod-ready`).
   Include the deferred rows (62–64) pointing to the sibling models, then the "Out of scope" N/A
   list. Config-rooted rows link their **cloud-storage/log-config fix** to the matching code
   finding in the code-findings report.
4. **Detection rules to create** — each as the **ready-to-copy unit** from Phase 4 (SQL →
   save to `rules/<name>.sql` → full `securenow alerts rules create …` → `--mode dry_run` test).
   **Mark each rule `test-first` or `prod-ready`** and, for every `test-first` rule, include the
   `--mode test` → observe (3–7 days) → tune threshold + add `securenow fp` → `--mode prod`
   promotion step (the `securenow alerts rules update <RULE_ID> --mode prod` command). Almost
   every storage/log threshold rule (object-key probing, bulk pull, 403-404 storm, storage-authz
   denials, log-injection, bulk-export) is `test-first`; only payload-borne `instant.block` rows
   are `prod-ready`. Note rules that already exist (Phase 0) instead of duplicating them. State
   plainly that **config-audit threats (ACL/encryption/backup/retention/stale-carrier) have no
   rule** — they live in the code-findings report. Catalog-K injection-shaped probes reference the
   exploit-signature `instant.block` rules, **not** duplicate pattern SQL.
5. **Instrumentation the detections need** — only the `track('storage.*')` / `track('log.*')` /
   `track('audit.event')` events the rules above consume, each as a copyable snippet; point to the
   code-findings report for *where* (file:line) to add them.
6. **Mitigation mechanisms** — render the **full §6/4c 15-row mitigation toolbox table**
   (firewall · exploit-signature instant-block · block [global / route / method / temporary] ·
   rate-limit [IP / route / IP+route] · challenge · auto-block · revoke · trusted · allowlist · fp ·
   **cloud-storage + log-config fix**) and the "Choosing per threat" guidance, then a per-threat
   ready-to-copy mitigation command + reversibility. Make explicit that the **cloud/log-config fix
   is primary** for catalog A–J and the SecureNow control is containment of the abuser at the edge.
7. **Action plan (copy-paste, ordered)** — ① engage the firewall, ② **verify/extend the SDK
   redaction denylist** (`securenow env`), ③ add the storage/log event instrumentation where
   traffic is blind, ④ create the traffic + event rules — **FP-prone rules created in `--mode
   test`** (detect-only, no mitigation), high-precision `instant.block` rows straight to `prod`,
   ⑤ enable automations / challenge rules, ⑥ test, ⑦ verify in dashboard, ⑧ **promote the
   test-first rules to `--mode prod` after the observation window** — an explicit
   "promote after N days (3–7 days of real traffic, threshold tuned, `securenow fp` added)" step
   running `securenow alerts rules update <RULE_ID> --mode prod`, ⑨ schedule the cloud/log-config-fix
   work (from the code-findings report — bucket policies, encryption, signed-URL scope, audit trail,
   retention). Real commands only, `<APP_KEY>` already substituted.
8. **Testing & validation** — per-threat test recipes (Phase 4d): `securenow event send …` /
   `test-span` / dry-run + expected outcome + cleanup (TEST-NET IPs 192.0.2/198.51.100/203.0.113),
   incl. the verification step for config-audit rows ("confirm public-access-block ON", "confirm
   `securenow env` redacts `Authorization`").
9. **Response runbooks** — for each notification type (object-key probing / bulk pull / 403-404
   storm / storage-authz denials / log-injection / bulk-export): how to confirm a true positive,
   the exact command to respond (rate-limit / challenge / block, copyable), the exact command to
   reverse, **and** the cloud/log-config follow-up (link to the code finding).
10. **Known gaps & SecureNow feature requests** — every 🔴 threat: why it's not coverable today
    (no traffic/event — pure config), the interim cloud/log-config fix (link to the code finding),
    and the "contact the SecureNow team" line.
11. **Appendix** — resolved SDK/CLI version (Phase 0.5), app key, environment, firewall state,
    redaction denylist resolved, rule IDs created, date, link to the code-findings report.

### 5b. Code Findings & Recommendations report — sections (both `.md` and `.html`), in order

State at the top: *"Findings only — no application code, IaC, or bucket policy was modified."*

1. **Executive summary** — findings by severity (critical / high / medium / low), top 3 code/config
   risks for this stack, one-paragraph posture verdict.
2. **Storage & logging surface & inventory** — the Phase 1 inventory: bucket catalog +
   key-layout/tenancy table + signed-URL posture table + encryption-at-rest table +
   backup/dump/export map + stale-carrier list + log-pipeline map + redaction status + audit-trail
   coverage + log-injection sinks + retention/third-party shipping + tenancy note.
3. **Threat catalog** — the exhaustive Phase 2 catalog (A–L), grouped, each row tagged
   OWASP/CWE and marked **modeled** or explicit **N/A** with the reason. Include the deferred
   items (62–64) pointing to the sibling models.
4. **Code & config findings (audit)** — the Phase 3 findings: a table
   `# | Location (file:line) | Threat | OWASP/CWE | Sev | Issue | Recommended fix`, each with the
   quoted 1–8 line snippet (bucket policy / ACL / IaC / signed-URL mint / logger line) and the
   described fix (**never applied**).
5. **Strengths** — controls already present and correct (public-access-block on, private ACLs,
   SSE-KMS default, random keys with tenant prefix, short-scoped signed URLs, a redaction layer,
   an append-only audit log) — the posture must be honest.
6. **App / config fixes (primary remediation)** — the bucket-policy / ACL / encryption /
   signed-URL / redaction / audit-log / retention changes that remove the root cause (described,
   not applied), each linked to the detection-report row it backs.
7. **Instrumentation recommendations** — the `track('storage.*')` / `track('log.*')` /
   `track('audit.event')` calls to add and the exact **file:line** to add them, so the detection
   rules light up. Hash/omit any object key, signed URL, signature, token, or email before it
   becomes an attribute.
8. **Appendix** — files reviewed, resolved SDK version (Phase 0.5), date, link to the
   detection-mitigation report.

### 5c. Self-contained HTML skeletons (offline; inline CSS + copy JS; no network)

Both HTML files share this `<head>` (SecureNow brand tokens + copy-button styles) and the copy
`<script>` at the end of `<body>`. Change only the `<title>`, the sidebar subtitle, the header,
and the section content per track. Wrap **every** command/SQL block as a `.cmd` (so it gets a
Copy button). Stats numbers must equal the matrix/findings row counts.

```html
<!DOCTYPE html>
<html lang="en"><head>
<meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title><!-- "Detection & Mitigation — Storage & Logs — SecureNow" OR "Code Findings — Storage & Logs — SecureNow" --></title>
<style>
  :root{--bg:#0f1419;--panel:#161c24;--panel2:#1b2330;--border:#26303d;--txt:#dbe3ec;--muted:#8b97a7;
    --accent:#3ea6ff;--accent2:#16c79a;--crit:#ff5c6c;--high:#ff9f43;--med:#f7c948;--low:#8b97a7;
    --ok:#16c79a;--info:#3ea6ff;--rev:#b388ff;}
  *{box-sizing:border-box}html{scroll-behavior:smooth}
  body{margin:0;background:var(--bg);color:var(--txt);font:15px/1.6 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif}
  a{color:var(--accent);text-decoration:none}
  code{background:#0b0f14;border:1px solid var(--border);border-radius:5px;padding:.08em .4em;font:13px/1.4 ui-monospace,"SF Mono",Menlo,Consolas,monospace;color:#9fe0c0}
  .wrap{display:grid;grid-template-columns:240px 1fr;max-width:1280px;margin:0 auto}
  nav{position:sticky;top:0;align-self:start;height:100vh;overflow:auto;padding:28px 18px;border-right:1px solid var(--border);background:var(--panel)}
  nav .brand{font-weight:700;font-size:15px;letter-spacing:.3px}nav .brand span{color:var(--accent)}
  nav .sub{color:var(--muted);font-size:12px;margin-bottom:22px}
  nav a{display:block;color:var(--muted);padding:7px 10px;border-radius:7px;font-size:13.5px}
  nav a:hover{background:var(--panel2);color:var(--txt)}
  main{padding:36px 40px 80px;min-width:0}
  header.top h1{margin:0 0 6px;font-size:26px}header.top p{margin:0;color:var(--muted)}
  .pill{display:inline-block;font-size:11px;font-weight:600;padding:3px 9px;border-radius:999px;border:1px solid var(--border);color:var(--muted);background:var(--panel)}
  .stats{display:grid;grid-template-columns:repeat(5,1fr);gap:14px;margin:26px 0 34px}
  .stat{background:var(--panel);border:1px solid var(--border);border-radius:12px;padding:16px 18px}
  .stat .n{font-size:26px;font-weight:700}.stat .l{color:var(--muted);font-size:12.5px;margin-top:2px}
  section{margin:0 0 40px}
  h2{font-size:18px;margin:0 0 14px;padding-bottom:8px;border-bottom:1px solid var(--border)}
  h2 .num{color:var(--accent);font-weight:700;margin-right:8px}
  table{width:100%;border-collapse:collapse;font-size:13.5px;background:var(--panel);border:1px solid var(--border);border-radius:12px;overflow:hidden}
  th,td{text-align:left;padding:11px 13px;border-bottom:1px solid var(--border);vertical-align:top}
  th{background:var(--panel2);color:var(--muted);font-weight:600;font-size:12px;text-transform:uppercase;letter-spacing:.4px}
  tr:last-child td{border-bottom:none}tr:hover td{background:#19212c}
  .rid{font:12px ui-monospace,Menlo,Consolas,monospace;color:#7fd1ff;white-space:nowrap}
  .b{display:inline-block;font-size:11px;font-weight:700;padding:2px 8px;border-radius:6px;white-space:nowrap}
  .b.crit{background:rgba(255,92,108,.15);color:var(--crit);border:1px solid rgba(255,92,108,.35)}
  .b.high{background:rgba(255,159,67,.13);color:var(--high);border:1px solid rgba(255,159,67,.32)}
  .b.med{background:rgba(247,201,72,.13);color:var(--med);border:1px solid rgba(247,201,72,.32)}
  .b.low{background:rgba(139,151,167,.13);color:var(--low);border:1px solid rgba(139,151,167,.32)}
  .c{display:inline-block;font-size:11px;font-weight:700;padding:2px 8px;border-radius:6px;white-space:nowrap}
  .c.cov{background:rgba(22,199,154,.13);color:var(--ok);border:1px solid rgba(22,199,154,.35)}
  .c.part{background:rgba(247,201,72,.13);color:var(--med);border:1px solid rgba(247,201,72,.32)}
  .c.gap{background:rgba(255,92,108,.15);color:var(--crit);border:1px solid rgba(255,92,108,.35)}
  .owasp,.cwe{display:inline-block;font:11px ui-monospace,Menlo,Consolas,monospace;color:var(--accent);border:1px solid rgba(62,166,255,.3);border-radius:6px;padding:1px 6px;white-space:nowrap}
  .cwe{color:var(--rev);border-color:rgba(179,136,255,.3)}
  .m{display:inline-block;font-size:11px;font-weight:600;padding:2px 8px;border-radius:6px;border:1px solid var(--border)}
  .m.block{color:var(--crit);border-color:rgba(255,92,108,.35)}.m.rate{color:var(--info);border-color:rgba(62,166,255,.35)}
  .m.challenge{color:var(--accent2);border-color:rgba(22,199,154,.35)}.m.firewall{color:var(--ok);border-color:rgba(22,199,154,.35)}
  .m.signature{color:var(--crit);border-color:rgba(255,92,108,.35)}.m.notify{color:var(--muted)}.m.appfix{color:var(--high);border-color:rgba(255,159,67,.35)}
  .card{background:var(--panel);border:1px solid var(--border);border-radius:12px;padding:18px 20px}
  .grid2{display:grid;grid-template-columns:1fr 1fr;gap:16px}
  pre{background:#0b0f14;border:1px solid var(--border);border-radius:10px;padding:14px 16px;overflow:auto;font:13px ui-monospace,Menlo,Consolas,monospace;color:#cfe8da;margin:0}
  .cmd{position:relative;margin:10px 0}
  .copy{position:absolute;top:8px;right:8px;font:11px ui-monospace,Menlo,Consolas,monospace;color:var(--muted);background:var(--panel2);border:1px solid var(--border);border-radius:6px;padding:3px 9px;cursor:pointer}
  .copy:hover{color:var(--txt);border-color:var(--accent)}.copy.done{color:var(--ok);border-color:var(--ok)}
  .flow{display:flex;flex-wrap:wrap;align-items:center;gap:8px;margin:6px 0 14px}
  .flow .step{background:var(--panel2);border:1px solid var(--border);border-radius:9px;padding:8px 12px;font-size:13px}.flow .arr{color:var(--accent);font-weight:700}
  .note{border-left:3px solid var(--high);background:rgba(255,159,67,.06);padding:10px 14px;border-radius:0 8px 8px 0;color:#e7d3bd;font-size:13.5px;margin:10px 0}
  footer{color:var(--muted);font-size:12px;border-top:1px solid var(--border);padding-top:18px;margin-top:30px}
  @media(max-width:880px){.wrap{grid-template-columns:1fr}nav{display:none}.stats,.grid2{grid-template-columns:1fr 1fr}main{padding:24px 18px}}
</style></head>
<body>
<div class="wrap">
  <nav>
    <div class="brand">Secure<span>Now</span></div>
    <div class="sub"><!-- "Detection & Mitigation · Storage & Logs" OR "Code Findings · Storage & Logs" --></div>
    <!-- one <a href="#…"> per section of THIS track -->
  </nav>
  <main>
    <header class="top"><h1><!-- report title for this track --></h1>
      <p><code><!-- app name / domain --></code> · <span class="pill">securenow <!-- installed version --></span></p></header>
    <div class="stats"><!-- 5 .stat cards; numbers MUST equal the table/finding counts --></div>
    <!-- <section id="…"> blocks mirroring the Markdown sections of THIS track (5a or 5b) -->
    <footer>Generated by the SecureNow storage &amp; logs threat-model prompt · <!-- date --> · securenow <!-- version --> · app <code><!-- APP_KEY --></code></footer>
  </main>
</div>
<script>
document.querySelectorAll('.copy').forEach(function(b){b.addEventListener('click',function(){
  var pre=b.parentElement.querySelector('pre'); if(!pre)return; var t=pre.innerText;
  function done(){b.textContent='Copied';b.classList.add('done');setTimeout(function(){b.textContent='Copy';b.classList.remove('done');},1500);}
  function fb(){var ta=document.createElement('textarea');ta.value=t;ta.style.position='fixed';ta.style.opacity='0';document.body.appendChild(ta);ta.focus();ta.select();try{document.execCommand('copy');}catch(e){}document.body.removeChild(ta);done();}
  if(navigator.clipboard&&navigator.clipboard.writeText){navigator.clipboard.writeText(t).then(done,fb);}else{fb();}
});});
</script>
</body></html>
```

**Track A — Detection & Mitigation** uses the title `Storage & Logs — Detection & Mitigation`,
sidebar subtitle `Detection & Mitigation · Storage & Logs`, the 5a sections, and 5 stat cards
(threats modeled · covered · partial · gaps · rules to create). **Track B — Code Findings** uses
the title `Storage & Logs — Code Findings`, sidebar subtitle `Code Findings · Storage & Logs`,
the 5b sections, and 5 stat cards (findings: critical · high · medium · low · strengths).

Every SQL/command block in the **Detection & Mitigation** HTML uses the copyable wrapper:

```html
<div class="cmd"><button class="copy" type="button">Copy</button><pre>securenow alerts rules create \
  --name "Storage: object-key probing (storage-IDOR)" --sql @rules/&lt;name&gt;.sql \
  --apps &lt;APP_KEY&gt; --severity high --schedule "*/5 * * * *" --nlp "..."</pre></div>
```

Badge usage: severity → `<span class="b crit|high|med|low">`; coverage →
`<span class="c cov|part|gap">COVERED|PARTIAL|GAP</span>`; OWASP tag →
`<span class="owasp">A01</span>` / `<span class="owasp">A09</span>` / `<span class="owasp">API8</span>`;
CWE → `<span class="cwe">CWE-532</span>`; mitigation type →
`<span class="m firewall|signature|rate|challenge|block|notify|appfix">` (use `appfix` for the
cloud-storage / log-config fix); rule IDs → `<span class="rid">`. The Code-Findings HTML may omit
copy buttons on prose, but still wraps any example/fix command in `.cmd`. Stats numbers must equal
the matrix/findings row counts.

---

## Quality bar (the report is rejected if any of these fail)

- **Phase 0.5 ran:** the resolved installed `securenow` version appears in both reports' appendix,
  and no command/flag/event/SQL column is emitted that the installed SDK/CLI does not expose (else
  it is annotated `# requires securenow >= <version>`).
- **Every detection rule is a complete copyable unit** — SQL → save to `rules/<name>.sql` → full
  `securenow alerts rules create …` → `--mode dry_run` test — with flags matching
  `securenow alerts rules --help` from Phase 0.5.
- **Four** files are written to `threat/23-storage-and-logs/` (detection-mitigation .md+.html,
  code-findings .md+.html); the two tracks **cross-link**; both HTML files are self-contained
  (inline CSS/JS, no network) and **every command block in the detection HTML has a working Copy
  button** (`.cmd` wrapper + the copy `<script>`).
- The split is honest: SecureNow-runnable detections/mitigations live in the **Detection &
  Mitigation** report; code/IaC/config changes live in the **Code Findings** report; nothing
  security-relevant is dropped.
- Every catalog item A1–K61 is either a matrix row or an explicit N/A line; each modeled row
  carries its OWASP tag (**A01** / **A09** / **API8** / **API9**, or "—").
- The deferred items (62–64) are **deferred** to the file-upload / data-privacy / secrets-IAM
  models (rows present, linked by **numbered path**, not re-derived) — this model does not
  duplicate the ingest pipeline, the PII policy, or IAM least-privilege.
- Every matrix row has a concrete signal (threshold + window) **or** an explicit "config-audit
  finding" marker, plus severity and mitigation — no "monitor for suspicious activity" filler.
- Every code/config finding in section 4 has a `file:line`, the quoted snippet (bucket policy /
  ACL / IaC / signed-URL mint / logger line), and a described fix — and **no application code,
  IaC, or bucket policy was modified** (this is an audit).
- Every detection SQL keeps `__USER_APP_KEYS__` scoping with the **correct table column**
  (`resources_string['service.name']` for logs/events vs `` `resource_string_service$$name` ``
  for traces) and selects an `ip` column; traffic queries keep the `client_ip` coalesce, the
  `ts_bucket_start` + `kind = 2` guards, and `HAVING ip != ''`.
- The **native telemetry-redaction posture** is verified (`securenow env`) and reported: which of
  `Authorization`/`Cookie`/`Set-Cookie`/`X-API-Key`/tokens/keys/**signed-URL query strings**/PII
  are stripped, with any gap raised as a finding **and** a redaction-config change (not a
  SecureNow-team gap).
- **Storage-IDOR probing and bulk-object access are modeled as traffic-detectable** rules
  (catalog K), with the cloud-storage / log-config fix paired on every config-rooted row.
- Detection vs. fix is honest: where SecureNow can only contain the actor at the edge, the row
  pairs the control with the **cloud-storage / log-config fix as primary**.
- Config-audit threats with no traffic/event (ACL, encryption, backup exposure, retention, stale
  carriers, missing audit trail) are marked 🔴 (or 🟡 if probe-revealable), **never** given a
  fake detection SQL.
- Only commands, flags, events, and SQL columns from this prompt's building blocks appear
  (including `securenow challenge …`, `firewall`, `securenow env`, and the `storage.*` /
  `log.*` / `audit.event` events).
- Every 🔴 gap appears in the gaps section with an interim cloud/log-config fix **and** the
  "contact the SecureNow team" line.
- The action plan runs top-to-bottom with `<APP_KEY>` substituted in, and includes the
  **verify-redaction** step before the rule creation.
- Both HTML files are self-contained (no CDN, no fonts, no network) and their stats cards match
  the table/findings counts; the detection HTML's Copy buttons work offline.
- All **four** files are written to `threat/23-storage-and-logs/` (detection-mitigation .md+.html,
  code-findings .md+.html) and a one-line summary — per-track file paths, threat counts,
  rules-to-create count, code findings by severity, gaps, resolved SDK version, OWASP coverage —
  is printed back to the user.
- The Detection report's mitigation section presents the **full toolbox** (§6/4c: firewall ·
  instant-block · block [global / route / method / temporary] · rate-limit [IP / route / IP+route] ·
  challenge · auto-block · revoke · trusted · allowlist · fp · cloud-storage/log-config fix), and
  **each modeled threat's matrix row selects specific, scoped mitigation(s) from it** — never a
  generic "block the IP."
- **Every false-positive-prone rule is tagged `test-first`** and carries the `--mode test` →
  observe (3–7 days) → `--mode prod` promotion workflow; only high-precision rules (payload-borne
  `instant.block` rows) are `prod-ready`. The action plan creates the test-first rules in `--mode
  test` and has an explicit "promote after N days" step.

<!-- ════════════════ END OF PROMPT ════════════════ -->