[
  {
    "id": "SVC-IMMICH-001",
    "payload": "/api/assets/../../admin/config",
    "tags": ["asset", "traversal", "admin-access", "quick", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "Asset path traversal to admin config endpoint",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/assets/"
  },
  {
    "id": "SVC-IMMICH-002",
    "payload": "/api/assets/..%2f..%2fuser%2fme",
    "tags": ["asset", "traversal", "encoded", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Asset path traversal with URL encoding to user endpoint",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/assets/"
  },
  {
    "id": "SVC-IMMICH-003",
    "payload": "/api/assets/../../../etc/passwd",
    "tags": ["asset", "traversal", "file-read", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "Asset path traversal attempting system file read",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/assets/"
  },
  {
    "id": "SVC-IMMICH-004",
    "payload": "/api/assets/test%00.jpg",
    "tags": ["asset", "null-byte", "quick", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Asset ID with null byte injection",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/assets/"
  },
  {
    "id": "SVC-IMMICH-005",
    "payload": "/api/assets/../albums/shared",
    "tags": ["asset", "traversal", "idor", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Asset traversal to shared albums (IDOR)",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/assets/"
  },
  {
    "id": "SVC-IMMICH-006",
    "payload": "/api/assets",
    "method": "DELETE",
    "body": "{\"ids\":[\"*\"]}",
    "tags": ["bulk", "injection", "data-destruction", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "Bulk delete with wildcard injection",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/assets"
  },
  {
    "id": "SVC-IMMICH-007",
    "payload": "/api/assets",
    "method": "DELETE",
    "body": "{\"ids\":[\"1 OR 1=1\"]}",
    "tags": ["bulk", "sqli", "data-destruction", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "Bulk delete with SQL injection in ID array",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/assets"
  },
  {
    "id": "SVC-IMMICH-008",
    "payload": "/api/assets",
    "method": "PUT",
    "body": "{\"ids\":[\"../../admin/assets\"]}",
    "tags": ["bulk", "traversal", "privilege-escalation", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "Bulk update with path traversal in ID array",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/assets"
  },
  {
    "id": "SVC-IMMICH-009",
    "payload": "/api/assets",
    "method": "POST",
    "body": "{\"ids\":[\"1\",\"2\",\"3\",\"...\"], \"repeat\": 10000}",
    "tags": ["bulk", "dos", "resource-exhaustion", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Bulk operation with excessive ID count (DoS)",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/assets"
  },
  {
    "id": "SVC-IMMICH-010",
    "payload": "/api/assets",
    "method": "PUT",
    "body": "{\"ids\":[\"%00null\",\"../user2\"]}",
    "tags": ["bulk", "null-byte", "traversal", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Bulk update with null byte and traversal in IDs",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/assets"
  },
  {
    "id": "SVC-IMMICH-011",
    "payload": "/api/assets/1/metadata",
    "method": "PUT",
    "body": "{\"exifData\":{\"UserComment\":\"<script>alert(1)</script>\"}}",
    "tags": ["metadata", "xss", "stored", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Metadata injection with XSS in EXIF field",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/assets/{id}/metadata"
  },
  {
    "id": "SVC-IMMICH-012",
    "payload": "/api/assets/1/metadata",
    "method": "PUT",
    "body": "{\"exifData\":{\"GPSLatitude\":\"../../config\"}}",
    "tags": ["metadata", "traversal", "injection", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Metadata injection with path traversal in GPS field",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/assets/{id}/metadata"
  },
  {
    "id": "SVC-IMMICH-013",
    "payload": "/api/assets/1/metadata",
    "method": "PUT",
    "body": "{\"customKey\":\"' OR '1'='1\"}",
    "tags": ["metadata", "sqli", "injection", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "Metadata injection with SQL injection in custom key",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/assets/{id}/metadata"
  },
  {
    "id": "SVC-IMMICH-014",
    "payload": "/api/assets/1/metadata",
    "method": "PUT",
    "body": "{\"description\":\"{{constructor.constructor('return process.env')()}}\"}",
    "tags": ["metadata", "ssti", "info-disclosure", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Metadata injection with SSTI attempting env leak",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/assets/{id}/metadata"
  },
  {
    "id": "SVC-IMMICH-015",
    "payload": "/api/assets/1/metadata",
    "method": "PUT",
    "body": "{\"tags\":[\"$where\",\"this.password\"]}",
    "tags": ["metadata", "nosqli", "injection", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "Metadata injection with NoSQL injection in tags",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/assets/{id}/metadata"
  },
  {
    "id": "SVC-IMMICH-016",
    "payload": "/api/devices",
    "tags": ["device", "enumeration", "info-disclosure", "quick", "medium"],
    "expected_block": false,
    "severity_hint": "Medium",
    "notes": "Device enumeration (should require auth)",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/devices"
  },
  {
    "id": "SVC-IMMICH-017",
    "payload": "/api/devices/1",
    "tags": ["device", "idor", "info-disclosure", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Device access via sequential ID (IDOR)",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/devices/{id}"
  },
  {
    "id": "SVC-IMMICH-018",
    "payload": "/api/devices/../admin/devices",
    "tags": ["device", "traversal", "admin-access", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "Device traversal to admin devices endpoint",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/devices"
  },
  {
    "id": "SVC-IMMICH-019",
    "payload": "/api/devices/test%2f..%2fadmin",
    "tags": ["device", "traversal", "encoded", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Device enumeration with URL-encoded traversal",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/devices/{id}"
  },
  {
    "id": "SVC-IMMICH-020",
    "payload": "/api/devices/00000000-0000-0000-0000-000000000001",
    "tags": ["device", "enumeration", "predictable-id", "medium"],
    "expected_block": false,
    "severity_hint": "Medium",
    "notes": "Device access via predictable UUID",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/devices/{id}"
  },
  {
    "id": "SVC-IMMICH-021",
    "payload": "/api/face",
    "method": "PUT",
    "body": "{\"id\":\"../../admin/face\",\"data\":\"malicious_vector\"}",
    "tags": ["ml", "poisoning", "traversal", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "Face data poisoning with path traversal in ID",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/face"
  },
  {
    "id": "SVC-IMMICH-022",
    "payload": "/api/face",
    "method": "PUT",
    "body": "{\"id\":\"<img src=x onerror=alert(1)>\",\"embedding\":[0.1,0.2]}",
    "tags": ["ml", "xss", "stored", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Face data poisoning with XSS in face ID",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/face"
  },
  {
    "id": "SVC-IMMICH-023",
    "payload": "/api/face",
    "method": "PUT",
    "body": "{\"personId\":\"../../../user-admin/person-1\",\"faceId\":\"1\"}",
    "tags": ["ml", "traversal", "privilege-escalation", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "Face person reassignment with path traversal",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/face"
  },
  {
    "id": "SVC-IMMICH-024",
    "payload": "/api/face",
    "method": "POST",
    "body": "{\"embedding\":[999,999,999], \"personId\":\"admin\"}",
    "tags": ["ml", "poisoning", "cross-user", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Face embedding poisoning targeting admin user",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/face"
  },
  {
    "id": "SVC-IMMICH-025",
    "payload": "/api/face",
    "method": "PUT",
    "body": "{\"data\":{\"name\":\"{{7*7}}\",\"embedding\":[1,2,3]}}",
    "tags": ["ml", "ssti", "injection", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Face data with SSTI in name field",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/face"
  },
  {
    "id": "SVC-IMMICH-026",
    "payload": "/api/people/1/reassign",
    "method": "POST",
    "body": "{\"targetPersonId\":\"../../admin-person\"}",
    "tags": ["person", "traversal", "face-hijacking", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "Person reassignment with admin face hijacking",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/people/{id}/reassign"
  },
  {
    "id": "SVC-IMMICH-027",
    "payload": "/api/people/1/merge",
    "method": "POST",
    "body": "{\"ids\":[\"../admin/person-1\",\"2\"]}",
    "tags": ["person", "traversal", "privilege-escalation", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "Person merge with path traversal in face ID",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/people/{id}/merge"
  },
  {
    "id": "SVC-IMMICH-028",
    "payload": "/api/people/reassign",
    "method": "POST",
    "body": "{\"faceId\":\"1\",\"personId\":\"admin\"}",
    "tags": ["person", "unauthorized", "face-hijacking", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Unauthorized person reassignment to admin",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/people/reassign"
  },
  {
    "id": "SVC-IMMICH-029",
    "payload": "/api/search/metadata?query=' OR '1'='1",
    "tags": ["search", "sqli", "quick", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "Search with SQL injection in query",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/search/metadata"
  },
  {
    "id": "SVC-IMMICH-030",
    "payload": "/api/search/metadata?query=../../config",
    "tags": ["search", "traversal", "info-disclosure", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Search with path traversal in query",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/search/metadata"
  },
  {
    "id": "SVC-IMMICH-031",
    "payload": "/api/search/smart?query=<script>alert(1)</script>",
    "tags": ["search", "xss", "reflected", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Smart search with reflected XSS",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/search/smart"
  },
  {
    "id": "SVC-IMMICH-032",
    "payload": "/api/search/person?name=*)(&(userPassword=*)",
    "tags": ["search", "ldapi", "injection", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "Person search with LDAP injection",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/search/person"
  },
  {
    "id": "SVC-IMMICH-033",
    "payload": "/api/oauth/callback?code=malicious&state=../../admin/login",
    "tags": ["oauth", "callback-manipulation", "quick", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "OAuth callback with traversal in state parameter",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/oauth/callback"
  },
  {
    "id": "SVC-IMMICH-034",
    "payload": "/api/oauth/authorize?redirect_uri=https://evil.com",
    "tags": ["oauth", "open-redirect", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "OAuth authorize with open redirect",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/oauth/authorize"
  },
  {
    "id": "SVC-IMMICH-035",
    "payload": "/api/oauth/mobile/redirect?url=javascript:alert(1)",
    "tags": ["oauth", "xss", "javascript-protocol", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "OAuth mobile redirect with javascript: protocol",
    "category": "Service-Specific",
    "service": "immich",
    "endpoint": "/api/oauth/mobile/redirect"
  }
]