feat: seed remaining empty frameworks onto the Security Map

docs/data/security-map/README.md

@@ -121,10 +121,12 @@ The first seed is `proposed` on purpose.
 ## Follow-up
 
 1. Run `pnpm run coverage:security-map` and treat the lists as the work queue.
-2. Map one framework per PR (`feat/security-map-<framework>`). Steward review for security semantics.
-   Wallet Security, Physical Security (duress), Treasury Operations, DPRK IT Workers, Encryption,
-   Privacy, and Safe Harbor are seeded. Eligibility checklist and on-chain adoption walkthrough
-   stay unmapped. No Nomad incident node without a sourced evidence PR.
+2. Map one framework per PR (`feat/security-map-<framework>`) unless the remaining empty list
+   is small enough to seed together. Steward review for security semantics. Current seed covers
+   Wallet, Physical (duress), Treasury, DPRK IT Workers, Encryption, Privacy, Safe Harbor, AI
+   Security, ENS, Guides, SSDLC, Threat Modeling, and Vulnerability Disclosure. Product-level
+   guide pages, AI browsers/exfil, ENS cross-chain, and sourced incidents stay unmapped.
+
 
 
 

docs/data/security-map/edges/ai-security.json

@@ -0,0 +1,69 @@
+{
+  "edges": [
+    {
+      "source": "component-ai-agent",
+      "target": "component-developer-devices",
+      "type": "depends-on"
+    },
+    {
+      "source": "component-ai-agent",
+      "target": "surface-agent-tool-path",
+      "type": "exposes"
+    },
+    {
+      "source": "threat-prompt-injection",
+      "target": "surface-agent-tool-path",
+      "type": "targets"
+    },
+    {
+      "source": "threat-prompt-injection",
+      "target": "asset-secrets-credentials",
+      "type": "targets"
+    },
+    {
+      "source": "threat-prompt-injection",
+      "target": "asset-user-funds",
+      "type": "targets"
+    },
+    {
+      "source": "control-prompt-input-constraint",
+      "target": "threat-prompt-injection",
+      "type": "mitigates"
+    },
+    {
+      "source": "control-execution-path-enforcement",
+      "target": "threat-prompt-injection",
+      "type": "mitigates"
+    },
+    {
+      "source": "control-execution-path-enforcement",
+      "target": "surface-agent-tool-path",
+      "type": "protects"
+    },
+    {
+      "source": "control-prompt-input-constraint",
+      "target": "component-ai-agent",
+      "type": "protects"
+    },
+    {
+      "source": "control-prompt-input-constraint",
+      "target": "guidance-prompt-injection",
+      "type": "documented-by"
+    },
+    {
+      "source": "control-execution-path-enforcement",
+      "target": "guidance-execution-path",
+      "type": "documented-by"
+    },
+    {
+      "source": "threat-prompt-injection",
+      "target": "guidance-prompt-injection",
+      "type": "documented-by"
+    },
+    {
+      "source": "component-ai-agent",
+      "target": "guidance-ai-security",
+      "type": "documented-by"
+    }
+  ]
+}

docs/data/security-map/edges/ens.json

@@ -0,0 +1,89 @@
+{
+  "edges": [
+    {
+      "source": "component-frontend",
+      "target": "surface-ens-resolution",
+      "type": "exposes"
+    },
+    {
+      "source": "component-rpc-endpoints",
+      "target": "surface-ens-resolution",
+      "type": "exposes"
+    },
+    {
+      "source": "threat-spoofed-ens-resolution",
+      "target": "surface-ens-resolution",
+      "type": "targets"
+    },
+    {
+      "source": "threat-spoofed-ens-resolution",
+      "target": "asset-user-funds",
+      "type": "targets"
+    },
+    {
+      "source": "threat-misdirected-transfer",
+      "target": "surface-ens-resolution",
+      "type": "targets"
+    },
+    {
+      "source": "control-l1-ens-resolution",
+      "target": "threat-spoofed-ens-resolution",
+      "type": "mitigates"
+    },
+    {
+      "source": "control-ensip15-normalization",
+      "target": "threat-spoofed-ens-resolution",
+      "type": "mitigates"
+    },
+    {
+      "source": "control-l1-ens-resolution",
+      "target": "threat-misdirected-transfer",
+      "type": "mitigates"
+    },
+    {
+      "source": "control-simulate-before-sign",
+      "target": "threat-spoofed-ens-resolution",
+      "type": "mitigates"
+    },
+    {
+      "source": "control-l1-ens-resolution",
+      "target": "surface-ens-resolution",
+      "type": "protects"
+    },
+    {
+      "source": "control-ensip15-normalization",
+      "target": "surface-ens-resolution",
+      "type": "protects"
+    },
+    {
+      "source": "control-l1-ens-resolution",
+      "target": "asset-user-funds",
+      "type": "protects"
+    },
+    {
+      "source": "control-l1-ens-resolution",
+      "target": "guidance-ens-integrity",
+      "type": "documented-by"
+    },
+    {
+      "source": "control-ensip15-normalization",
+      "target": "guidance-ens-normalization",
+      "type": "documented-by"
+    },
+    {
+      "source": "threat-spoofed-ens-resolution",
+      "target": "guidance-ens-integrity",
+      "type": "documented-by"
+    },
+    {
+      "source": "component-frontend",
+      "target": "guidance-ens",
+      "type": "documented-by"
+    },
+    {
+      "source": "control-simulate-before-sign",
+      "target": "guidance-ens-integrity",
+      "type": "documented-by"
+    }
+  ]
+}

docs/data/security-map/edges/guides.json

@@ -0,0 +1,29 @@
+{
+  "edges": [
+    {
+      "source": "control-phishing-resistant-mfa",
+      "target": "guidance-hardware-security-keys",
+      "type": "documented-by"
+    },
+    {
+      "source": "control-phishing-resistant-mfa",
+      "target": "guidance-account-management",
+      "type": "documented-by"
+    },
+    {
+      "source": "component-identity-accounts",
+      "target": "guidance-guides",
+      "type": "documented-by"
+    },
+    {
+      "source": "component-identity-accounts",
+      "target": "guidance-account-management",
+      "type": "documented-by"
+    },
+    {
+      "source": "component-community-channels",
+      "target": "guidance-account-management",
+      "type": "documented-by"
+    }
+  ]
+}

docs/data/security-map/edges/ssdlc.json

@@ -0,0 +1,49 @@
+{
+  "edges": [
+    {
+      "source": "control-peer-code-review",
+      "target": "threat-supply-chain-compromise",
+      "type": "mitigates"
+    },
+    {
+      "source": "control-peer-code-review",
+      "target": "threat-smart-contract-exploits",
+      "type": "mitigates"
+    },
+    {
+      "source": "control-peer-code-review",
+      "target": "asset-source-code",
+      "type": "protects"
+    },
+    {
+      "source": "control-peer-code-review",
+      "target": "guidance-code-reviews",
+      "type": "documented-by"
+    },
+    {
+      "source": "control-branch-protection",
+      "target": "guidance-secure-repos",
+      "type": "documented-by"
+    },
+    {
+      "source": "control-secure-sdlc-testing",
+      "target": "guidance-ssdlc",
+      "type": "documented-by"
+    },
+    {
+      "source": "control-secure-sdlc-testing",
+      "target": "guidance-secure-coding",
+      "type": "documented-by"
+    },
+    {
+      "source": "control-external-security-review",
+      "target": "guidance-ssdlc",
+      "type": "documented-by"
+    },
+    {
+      "source": "component-ci-cd",
+      "target": "guidance-secure-repos",
+      "type": "documented-by"
+    }
+  ]
+}

docs/data/security-map/edges/threat-modeling.json

@@ -0,0 +1,59 @@
+{
+  "edges": [
+    {
+      "source": "threat-stale-threat-model",
+      "target": "surface-contract-upgrade-path",
+      "type": "targets"
+    },
+    {
+      "source": "threat-stale-threat-model",
+      "target": "asset-source-code",
+      "type": "targets"
+    },
+    {
+      "source": "threat-stale-threat-model",
+      "target": "asset-user-funds",
+      "type": "targets"
+    },
+    {
+      "source": "control-living-threat-model",
+      "target": "threat-stale-threat-model",
+      "type": "mitigates"
+    },
+    {
+      "source": "control-living-threat-model",
+      "target": "threat-smart-contract-exploits",
+      "type": "mitigates"
+    },
+    {
+      "source": "control-living-threat-model",
+      "target": "asset-source-code",
+      "type": "protects"
+    },
+    {
+      "source": "control-living-threat-model",
+      "target": "guidance-threat-modeling",
+      "type": "documented-by"
+    },
+    {
+      "source": "control-living-threat-model",
+      "target": "guidance-create-maintain-threat-models",
+      "type": "documented-by"
+    },
+    {
+      "source": "control-living-threat-model",
+      "target": "guidance-identify-mitigate-threats",
+      "type": "documented-by"
+    },
+    {
+      "source": "control-living-threat-model",
+      "target": "guidance-ssdlc-threat-design",
+      "type": "documented-by"
+    },
+    {
+      "source": "threat-stale-threat-model",
+      "target": "guidance-create-maintain-threat-models",
+      "type": "documented-by"
+    }
+  ]
+}

docs/data/security-map/edges/vulnerability-disclosure.json

@@ -0,0 +1,74 @@
+{
+  "edges": [
+    {
+      "source": "component-smart-contracts",
+      "target": "surface-researcher-inbound",
+      "type": "exposes"
+    },
+    {
+      "source": "threat-uncontactable-disclosure",
+      "target": "surface-researcher-inbound",
+      "type": "targets"
+    },
+    {
+      "source": "threat-uncontactable-disclosure",
+      "target": "asset-source-code",
+      "type": "targets"
+    },
+    {
+      "source": "threat-uncontactable-disclosure",
+      "target": "asset-user-funds",
+      "type": "targets"
+    },
+    {
+      "source": "control-published-security-contact",
+      "target": "threat-uncontactable-disclosure",
+      "type": "mitigates"
+    },
+    {
+      "source": "control-bug-bounty-program",
+      "target": "threat-uncontactable-disclosure",
+      "type": "mitigates"
+    },
+    {
+      "source": "control-published-security-contact",
+      "target": "surface-researcher-inbound",
+      "type": "protects"
+    },
+    {
+      "source": "control-bug-bounty-program",
+      "target": "asset-user-funds",
+      "type": "protects"
+    },
+    {
+      "source": "control-published-security-contact",
+      "target": "guidance-security-contact",
+      "type": "documented-by"
+    },
+    {
+      "source": "control-bug-bounty-program",
+      "target": "guidance-bug-bounties",
+      "type": "documented-by"
+    },
+    {
+      "source": "threat-uncontactable-disclosure",
+      "target": "guidance-vulnerability-disclosure",
+      "type": "documented-by"
+    },
+    {
+      "source": "control-safe-harbor-adoption",
+      "target": "guidance-vulnerability-disclosure",
+      "type": "documented-by"
+    },
+    {
+      "source": "control-published-security-contact",
+      "target": "guidance-safe-harbor-scope",
+      "type": "documented-by"
+    },
+    {
+      "source": "control-external-security-review",
+      "target": "guidance-bug-bounties",
+      "type": "documented-by"
+    }
+  ]
+}