<?php

/**
 * Risk Matrix — KiyoHR (post-remediation)
 */

return [
    'critical' => [],
    'high' => [],
    'medium' => [
        [
            'id' => 'SEC-011',
            'title' => 'Email verification not enforced',
            'owner' => 'Product',
            'mitigation' => 'Lead OTP + admin provisioning; add MustVerifyEmail later',
        ],
        [
            'id' => 'SEC-013',
            'title' => 'Virus scan is no-op by default',
            'owner' => 'Ops',
            'mitigation' => 'Bind ClamAV implementation to VirusScanner contract',
        ],
        [
            'id' => 'SEC-014',
            'title' => 'Some web FK validations lack company scope',
            'owner' => 'Engineering',
            'mitigation' => 'Continue Rule::exists()->where(company_id) sweep',
        ],
    ],
    'low' => [
        [
            'id' => 'SEC-012',
            'title' => 'Unused spatie/laravel-permission',
            'owner' => 'Engineering',
        ],
        [
            'id' => 'SEC-015',
            'title' => 'API unversioned',
            'owner' => 'Engineering',
        ],
    ],
];