{"nodes": [{"id": "todo_claude_todo_09_security_hardening", "label": "09 \u2014 Security Hardening", "file_type": "document", "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "source_url": null, "captured_at": null, "author": null, "contributor": null}, {"id": "todo_claude_todo_09_security_hardening_a_unauth_endpoints", "label": "\u00a7A Unauthenticated admin/data endpoints", "file_type": "document", "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "source_url": null, "captured_at": null, "author": null, "contributor": null}, {"id": "todo_claude_todo_09_security_hardening_a1_raw_results", "label": "A1 raw-results data exfiltration", "file_type": "document", "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "source_url": null, "captured_at": null, "author": null, "contributor": null}, {"id": "todo_claude_todo_09_security_hardening_a2_populate", "label": "A2 unauth populate / DoS amplification", "file_type": "document", "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "source_url": null, "captured_at": null, "author": null, "contributor": null}, {"id": "todo_claude_todo_09_security_hardening_a3_service_account", "label": "A3 unauth service-account token minting", "file_type": "document", "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "source_url": null, "captured_at": null, "author": null, "contributor": null}, {"id": "todo_claude_todo_09_security_hardening_b_rate_limiting", "label": "\u00a7B Auth-endpoint rate limiting and input caps", "file_type": "document", "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "source_url": null, "captured_at": null, "author": null, "contributor": null}, {"id": "todo_claude_todo_09_security_hardening_c_eval_csp", "label": "\u00a7C Persisted-state eval \u2192 RCE, no CSP", "file_type": "document", "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "source_url": null, "captured_at": null, "author": null, "contributor": null}, {"id": "todo_claude_todo_09_security_hardening_d_date_parse", "label": "\u00a7D Date.parse reviver corrupts strings", "file_type": "document", "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "source_url": null, "captured_at": null, "author": null, "contributor": null}], "edges": [{"source": "todo_claude_todo_09_security_hardening", "target": "todo_claude_todo_09_security_hardening_a_unauth_endpoints", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 1.0, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "todo_claude_todo_09_security_hardening_a_unauth_endpoints", "target": "todo_claude_todo_09_security_hardening_a1_raw_results", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 1.0, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "todo_claude_todo_09_security_hardening_a_unauth_endpoints", "target": "todo_claude_todo_09_security_hardening_a2_populate", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 1.0, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "todo_claude_todo_09_security_hardening_a_unauth_endpoints", "target": "todo_claude_todo_09_security_hardening_a3_service_account", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 1.0, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "todo_claude_todo_09_security_hardening", "target": "todo_claude_todo_09_security_hardening_b_rate_limiting", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 1.0, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "todo_claude_todo_09_security_hardening", "target": "todo_claude_todo_09_security_hardening_c_eval_csp", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 1.0, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "todo_claude_todo_09_security_hardening", "target": "todo_claude_todo_09_security_hardening_d_date_parse", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 1.0, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "todo_claude_todo_09_security_hardening", "target": "fundamentals", "relation": "cites", "confidence": "EXTRACTED", "confidence_score": 1.0, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "todo_claude_todo_09_security_hardening", "target": "decisions", "relation": "cites", "confidence": "EXTRACTED", "confidence_score": 1.0, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "todo_claude_todo_09_security_hardening_a1_raw_results", "target": "remix_app_routes_api_v1_mongodb_raw_results__raw_results", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 1.0, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "todo_claude_todo_09_security_hardening_a1_raw_results", "target": "remix_app_api_utils_things_things_visibilityqueryfor", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 0.9, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "todo_claude_todo_09_security_hardening_a1_raw_results", "target": "remix_app_api_utils_things_things_createpost", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 0.9, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "remix_app_api_utils_things_things_createpost", "target": "remix_app_api_utils_things_things_visibilityqueryfor", "relation": "shares_data_with", "confidence": "INFERRED", "confidence_score": 0.6, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 0.8}, {"source": "todo_claude_todo_09_security_hardening_a2_populate", "target": "remix_app_routes_api_v1_mongodb_populate__populate", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 1.0, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "remix_app_routes_api_v1_mongodb_populate__populate", "target": "remix_app_scripts_mongodb_setup", "relation": "calls", "confidence": "EXTRACTED", "confidence_score": 0.9, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "todo_claude_todo_09_security_hardening_a3_service_account", "target": "remix_app_routes_api_v1_auth_service_account__service_account", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 1.0, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "remix_app_routes_api_v1_auth_service_account__service_account", "target": "remix_app_api_utils_auth_serviceaccounts_provisionserviceaccount", "relation": "calls", "confidence": "EXTRACTED", "confidence_score": 1.0, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "remix_app_api_utils_auth_serviceaccounts_provisionserviceaccount", "target": "remix_app_api_utils_auth_jwt_signjwt", "relation": "calls", "confidence": "EXTRACTED", "confidence_score": 0.95, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "remix_app_api_utils_auth_serviceaccounts_provisionserviceaccount", "target": "remix_app_api_utils_auth_sessions_createsession", "relation": "calls", "confidence": "EXTRACTED", "confidence_score": 0.95, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "remix_app_api_utils_auth_getcurrentuser", "target": "remix_app_api_utils_auth_serviceaccounts_provisionserviceaccount", "relation": "shares_data_with", "confidence": "INFERRED", "confidence_score": 0.6, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 0.7}, {"source": "remix_server_routes_api_catchall", "target": "remix_app_routes_api_v1_mongodb_raw_results__raw_results", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 0.9, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "remix_server_routes_api_catchall", "target": "remix_app_routes_api_v1_mongodb_populate__populate", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 0.9, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "remix_server_routes_api_catchall", "target": "remix_app_routes_api_v1_auth_service_account__service_account", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 0.9, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "todo_claude_todo_09_security_hardening_b_rate_limiting", "target": "remix_app_api_utils_ratelimit_enforceratelimit", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 0.95, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "todo_claude_todo_09_security_hardening_b_rate_limiting", "target": "remix_app_api_utils_auth_loginuser", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 1.0, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "todo_claude_todo_09_security_hardening_b_rate_limiting", "target": "remix_app_api_http_readjsonbody", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 0.9, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "todo_claude_todo_09_security_hardening_c_eval_csp", "target": "remix_app_providers_thingtimeprovider", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 1.0, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "todo_claude_todo_09_security_hardening_d_date_parse", "target": "remix_app_providers_thingtimeprovider", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 1.0, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "todo_claude_todo_09_security_hardening_c_eval_csp", "target": "todo_claude_todo_09_security_hardening_d_date_parse", "relation": "conceptually_related_to", "confidence": "EXTRACTED", "confidence_score": 0.9, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "todo_claude_todo_09_security_hardening", "target": "remix_app_providers_thingtimepersistcodec", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 1.0, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "todo_claude_todo_09_security_hardening", "target": "remix_app_providers_thingtimepersistcodec_test", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 1.0, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "remix_app_providers_thingtimepersistcodec_test", "target": "remix_app_providers_thingtimepersistcodec", "relation": "references", "confidence": "INFERRED", "confidence_score": 0.85, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}, {"source": "remix_app_providers_thingtimeprovider", "target": "remix_app_providers_thingtimepersistcodec", "relation": "references", "confidence": "INFERRED", "confidence_score": 0.8, "source_file": "TODO/claude-todo/09-security-hardening.md", "source_location": null, "weight": 1.0}], "hyperedges": [{"id": "unauth_endpoint_lockdown_flow", "label": "Unauthenticated admin/data endpoint lockdown (\u00a7A)", "nodes": ["todo_claude_todo_09_security_hardening_a_unauth_endpoints", "remix_app_routes_api_v1_mongodb_raw_results__raw_results", "remix_app_routes_api_v1_mongodb_populate__populate", "remix_app_routes_api_v1_auth_service_account__service_account", "remix_server_routes_api_catchall", "remix_app_api_utils_ratelimit_enforceratelimit"], "relation": "participate_in", "confidence": "EXTRACTED", "confidence_score": 0.9, "source_file": "TODO/claude-todo/09-security-hardening.md"}, {"id": "service_account_token_minting_flow", "label": "Non-expiring service-account token minting flow", "nodes": ["remix_app_routes_api_v1_auth_service_account__service_account", "remix_app_api_utils_auth_serviceaccounts_provisionserviceaccount", "remix_app_api_utils_auth_jwt_signjwt", "remix_app_api_utils_auth_sessions_createsession", "remix_app_api_utils_auth_getcurrentuser"], "relation": "form", "confidence": "EXTRACTED", "confidence_score": 0.85, "source_file": "TODO/claude-todo/09-security-hardening.md"}, {"id": "persisted_state_eval_csp_remediation", "label": "Persisted-state eval removal + CSP remediation (\u00a7C/\u00a7D, PR #99)", "nodes": ["todo_claude_todo_09_security_hardening_c_eval_csp", "todo_claude_todo_09_security_hardening_d_date_parse", "remix_app_providers_thingtimeprovider", "remix_app_providers_thingtimepersistcodec", "remix_app_providers_thingtimepersistcodec_test", "remix_index_tt_boot_script", "remix_changelog_pr99_eval_csp"], "relation": "participate_in", "confidence": "EXTRACTED", "confidence_score": 0.88, "source_file": "TODO/claude-todo/09-security-hardening.md"}]}