{"id":1665,"date":"2026-06-06T17:47:31","date_gmt":"2026-06-06T17:47:31","guid":{"rendered":"https:\/\/cortexorigin.com\/?page_id=1665"},"modified":"2026-07-24T09:09:42","modified_gmt":"2026-07-24T09:09:42","slug":"cortex-idor","status":"publish","type":"page","link":"https:\/\/cortexorigin.com\/index.php\/cortex-idor\/","title":{"rendered":""},"content":{"rendered":"\n\n\nMenu ORIGIN\u2122<\/title>\n<style>\n@import url('https:\/\/fonts.googleapis.com\/css2?family=DM+Sans:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap');\n \nbody { margin: 0; padding: 0; background: #F4F0EB; font-family: 'DM Sans', sans-serif; min-height: 600px; }\n \n\/* Wrapper full-width \u2014 isolation stricte (all:initial) + 100vw, identique \u00e0 .cidor-page\n pour \u00e9chapper aux contraintes de largeur du th\u00e8me WordPress et garantir le bandeau jusqu'aux bords. *\/\n.menu-bar-wrapper {\n all: initial;\n display: block;\n box-sizing: border-box;\n width: 100vw;\n position: relative;\n left: calc(50% - 50vw);\n background: #0C1829;\n z-index: 9999;\n font-family: 'DM Sans', sans-serif;\n}\n \n.menu-bar {\n width: 100%;\n background: #0C1829;\n padding: 0 2rem;\n display: flex;\n align-items: center;\n justify-content: space-between;\n position: relative;\n z-index: 100;\n box-sizing: border-box;\n}\n.menu-logo {\n font-family: 'DM Sans', sans-serif; font-weight: 700; font-size: 0.95rem;\n color: #fff; padding: 1rem 0; letter-spacing: 0.03em; white-space: nowrap;\n}\n.menu-logo span { color: #C9A96E; }\n.menu-items { display: flex; align-items: center; gap: 0; }\n \n\/* \u2500\u2500 EAS \u00b7 EXPOSITION BUTTON (avec dropdown) \u2500\u2500 *\/\n.menu-eas-wrap {\n position: relative;\n display: flex;\n align-items: center;\n padding: 1rem 0;\n margin-right: 0.5rem;\n}\n.menu-eas {\n display: flex; align-items: center;\n padding: 0.45rem 1rem;\n background: rgba(201,169,110,0.12);\n border: 1px solid rgba(201,169,110,0.35);\n border-radius: 3px;\n font-family: 'JetBrains Mono', monospace;\n font-size: 0.65rem; font-weight: 500;\n letter-spacing: 0.08em; text-transform: uppercase;\n color: #C9A96E;\n text-decoration: none;\n transition: all 0.25s;\n white-space: nowrap;\n gap: 0.5rem;\n}\n.menu-eas::before {\n content: '\u25ce';\n font-size: 0.75rem;\n opacity: 0.7;\n}\n.menu-eas::after {\n content: '\u25be';\n margin-left: 0.4rem;\n font-size: 0.6rem;\n opacity: 0.55;\n}\n.menu-eas:hover {\n background: rgba(201,169,110,0.25);\n border-color: rgba(201,169,110,0.6);\n color: #fff;\n}\n.menu-eas-wrap:hover .menu-dropdown-eas { display: block; }\n.menu-dropdown-eas {\n display: none; position: absolute; top: 100%; left: 0;\n background: #0C1829; border: 1px solid rgba(74,144,217,0.15);\n border-top: 2px solid #C9A96E; border-radius: 0 0 4px 4px;\n min-width: 360px; padding: 0.8rem 0; z-index: 99999;\n box-shadow: 0 12px 40px rgba(0,0,0,0.4);\n}\n \n\/* \u2500\u2500 AETZU ARROW AI BUTTON \u2500\u2500 *\/\n.menu-aetzu {\n display: flex; align-items: center;\n padding: 0.45rem 1rem;\n background: rgba(201,169,110,0.12);\n border: 1px solid rgba(201,169,110,0.35);\n border-radius: 3px;\n font-family: 'JetBrains Mono', monospace;\n font-size: 0.65rem; font-weight: 500;\n letter-spacing: 0.08em; text-transform: uppercase;\n color: #C9A96E;\n text-decoration: none;\n transition: all 0.25s;\n white-space: nowrap;\n gap: 0.5rem;\n}\n.menu-aetzu::before {\n content: '\u2b21';\n font-size: 0.75rem;\n opacity: 0.7;\n}\n.menu-aetzu::after {\n content: '\u25be';\n margin-left: 0.4rem;\n font-size: 0.6rem;\n opacity: 0.55;\n}\n.menu-aetzu-wrap {\n position: relative;\n display: flex;\n align-items: center;\n padding: 1rem 0;\n margin-right: 0.5rem;\n}\n.menu-aetzu-wrap:hover .menu-dropdown-aetzu { display: block; }\n.menu-dropdown-aetzu {\n display: none; position: absolute; top: 100%; left: 0;\n background: #0C1829; border: 1px solid rgba(74,144,217,0.15);\n border-top: 2px solid #C9A96E; border-radius: 0 0 4px 4px;\n min-width: 360px; padding: 0.8rem 0; z-index: 99999;\n box-shadow: 0 12px 40px rgba(0,0,0,0.4);\n}\n.menu-aetzu:hover {\n background: rgba(201,169,110,0.25);\n border-color: rgba(201,169,110,0.6);\n color: #fff;\n}\n \n\/* \u2500\u2500 CORTEX WEB & API BUTTON \u2500\u2500 *\/\n.menu-webapi {\n display: flex; align-items: center;\n padding: 0.45rem 1rem;\n background: rgba(201,169,110,0.12);\n border: 1px solid rgba(201,169,110,0.35);\n border-radius: 3px;\n font-family: 'JetBrains Mono', monospace;\n font-size: 0.65rem; font-weight: 500;\n letter-spacing: 0.08em; text-transform: uppercase;\n color: #C9A96E;\n text-decoration: none;\n transition: all 0.25s;\n white-space: nowrap;\n gap: 0.5rem;\n}\n.menu-webapi::before {\n content: '\u25a3';\n font-size: 0.75rem;\n opacity: 0.7;\n}\n.menu-webapi::after {\n content: '\u25be';\n margin-left: 0.4rem;\n font-size: 0.6rem;\n opacity: 0.55;\n}\n.menu-webapi-wrap {\n position: relative;\n display: flex;\n align-items: center;\n padding: 1rem 0;\n margin-right: 0.5rem;\n}\n.menu-webapi-wrap:hover .menu-dropdown-webapi { display: block; }\n.menu-dropdown-webapi {\n display: none; position: absolute; top: 100%; left: 0;\n background: #0C1829; border: 1px solid rgba(74,144,217,0.15);\n border-top: 2px solid #C9A96E; border-radius: 0 0 4px 4px;\n min-width: 360px; padding: 0.8rem 0; z-index: 99999;\n box-shadow: 0 12px 40px rgba(0,0,0,0.4);\n}\n.menu-webapi:hover {\n background: rgba(201,169,110,0.25);\n border-color: rgba(201,169,110,0.6);\n color: #fff;\n}\n \n\/* \u2500\u2500 CORTEX APP\u00c2T & LEURRE BUTTON (avec dropdown \u2014 BAITS) \u2500\u2500 *\/\n.menu-appat-wrap {\n position: relative;\n display: flex;\n align-items: center;\n padding: 1rem 0;\n margin-right: 0.5rem;\n}\n.menu-appat {\n display: flex; align-items: center;\n padding: 0.45rem 1rem;\n background: rgba(201,169,110,0.12);\n border: 1px solid rgba(201,169,110,0.35);\n border-radius: 3px;\n font-family: 'JetBrains Mono', monospace;\n font-size: 0.65rem; font-weight: 500;\n letter-spacing: 0.08em; text-transform: uppercase;\n color: #C9A96E;\n text-decoration: none;\n transition: all 0.25s;\n white-space: nowrap;\n gap: 0.5rem;\n}\n.menu-appat::before {\n content: '\u2b22';\n font-size: 0.7rem;\n opacity: 0.7;\n}\n.menu-appat::after {\n content: '\u25be';\n margin-left: 0.4rem;\n font-size: 0.6rem;\n opacity: 0.55;\n}\n.menu-appat:hover {\n background: rgba(201,169,110,0.25);\n border-color: rgba(201,169,110,0.6);\n color: #fff;\n}\n.menu-appat-wrap:hover .menu-dropdown-appat { display: block; }\n.menu-dropdown-appat {\n display: none; position: absolute; top: 100%; left: 0;\n background: #0C1829; border: 1px solid rgba(74,144,217,0.15);\n border-top: 2px solid #C9A96E; border-radius: 0 0 4px 4px;\n min-width: 360px; padding: 0.8rem 0; z-index: 99999;\n box-shadow: 0 12px 40px rgba(0,0,0,0.4);\n}\n \n\/* \u2500\u2500 CORTEX NK BUTTON (avec dropdown) \u2500\u2500 *\/\n.menu-cortexnk-wrap {\n position: relative;\n display: flex;\n align-items: center;\n padding: 1rem 0;\n margin-right: 0.5rem;\n}\n.menu-cortexnk {\n display: flex; align-items: center;\n padding: 0.45rem 1rem;\n background: rgba(201,169,110,0.12);\n border: 1px solid rgba(201,169,110,0.35);\n border-radius: 3px;\n font-family: 'JetBrains Mono', monospace;\n font-size: 0.65rem; font-weight: 500;\n letter-spacing: 0.08em; text-transform: uppercase;\n color: #C9A96E;\n text-decoration: none;\n transition: all 0.25s;\n white-space: nowrap;\n gap: 0.5rem;\n}\n.menu-cortexnk::before {\n content: '\u25c6';\n font-size: 0.7rem;\n opacity: 0.7;\n}\n.menu-cortexnk::after {\n content: '\u25be';\n margin-left: 0.4rem;\n font-size: 0.6rem;\n opacity: 0.55;\n}\n.menu-cortexnk:hover {\n background: rgba(201,169,110,0.25);\n border-color: rgba(201,169,110,0.6);\n color: #fff;\n}\n.menu-cortexnk-wrap:hover .menu-dropdown-cortexnk { display: block; }\n.menu-dropdown-cortexnk {\n display: none; position: absolute; top: 100%; left: 0;\n background: #0C1829; border: 1px solid rgba(74,144,217,0.15);\n border-top: 2px solid #C9A96E; border-radius: 0 0 4px 4px;\n min-width: 360px; padding: 0.8rem 0; z-index: 99999;\n box-shadow: 0 12px 40px rgba(0,0,0,0.4);\n}\n \n\/* \u2500\u2500 BENCHMARK & V\u00c9RIFICATION BUTTON (m\u00e9ga-d\u00e9roulant fusionn\u00e9) \u2500\u2500 *\/\n.menu-benchmark-wrap {\n position: relative;\n display: flex;\n align-items: center;\n padding: 1rem 0;\n margin-right: 0.5rem;\n}\n.menu-benchmark {\n display: flex; align-items: center;\n padding: 0.45rem 1rem;\n background: rgba(74,144,217,0.10);\n border: 1px solid rgba(74,144,217,0.30);\n border-radius: 3px;\n font-family: 'JetBrains Mono', monospace;\n font-size: 0.65rem; font-weight: 500;\n letter-spacing: 0.08em; text-transform: uppercase;\n color: rgba(184,212,240,0.85);\n text-decoration: none;\n transition: all 0.25s;\n white-space: nowrap;\n gap: 0.5rem;\n}\n.menu-benchmark::before {\n content: '\u25c8';\n font-size: 0.7rem;\n opacity: 0.65;\n}\n.menu-benchmark::after {\n content: '\u25be';\n margin-left: 0.4rem;\n font-size: 0.6rem;\n opacity: 0.55;\n}\n.menu-benchmark:hover {\n background: rgba(74,144,217,0.22);\n border-color: rgba(74,144,217,0.55);\n color: #fff;\n}\n.menu-benchmark-wrap:hover .mega-dropdown { display: block; }\n \n.menu-item {\n position: relative; padding: 1rem 1rem;\n font-size: 0.78rem; font-weight: 500; color: rgba(184,212,240,0.75);\n cursor: pointer; letter-spacing: 0.02em; transition: color 0.2s;\n white-space: nowrap;\n}\n.menu-item:hover { color: #fff; }\n.menu-item::after {\n content: '\u25be'; margin-left: 0.3rem; font-size: 0.6rem; opacity: 0.5;\n}\n.menu-item.no-drop::after { content: ''; }\n.menu-cta {\n font-family: 'JetBrains Mono', monospace; font-size: 0.65rem; font-weight: 500;\n letter-spacing: 0.08em; text-transform: uppercase;\n padding: 0.5rem 1.2rem; border-radius: 2px;\n background: rgba(201,169,110,0.15); color: #C9A96E; border: 1px solid rgba(201,169,110,0.3);\n cursor: pointer; transition: all 0.3s; white-space: nowrap;\n}\n.menu-cta:hover { background: rgba(201,169,110,0.25); color: #fff; }\n \n.menu-dropdown {\n display: none; position: absolute; top: 100%; left: 0;\n background: #0C1829; border: 1px solid rgba(74,144,217,0.15);\n border-top: 2px solid #C9A96E; border-radius: 0 0 4px 4px;\n min-width: 320px; padding: 0.8rem 0; z-index: 99999;\n box-shadow: 0 12px 40px rgba(0,0,0,0.4);\n}\n.menu-item:hover .menu-dropdown { display: block; }\n.menu-dropdown a {\n display: block; padding: 0.5rem 1.5rem; font-size: 0.8rem; color: rgba(184,212,240,0.6);\n text-decoration: none; transition: all 0.2s; line-height: 1.5;\n}\n.menu-dropdown a:hover { color: #fff; background: rgba(74,144,217,0.08); }\n.menu-dropdown .drop-label {\n font-family: 'JetBrains Mono', monospace; font-size: 0.58rem; font-weight: 600;\n letter-spacing: 0.15em; color: #C9A96E; text-transform: uppercase;\n padding: 0.6rem 1.5rem 0.3rem; display: block;\n}\n.menu-dropdown .drop-sep {\n border: none; border-top: 1px solid rgba(74,144,217,0.08);\n margin: 0.5rem 1.5rem;\n}\n \n.menu-dropdown a.drop-highlight {\n display: flex; align-items: center; justify-content: space-between;\n margin: 0.4rem 0.8rem 0.2rem;\n padding: 0.55rem 1rem;\n background: rgba(201,169,110,0.08);\n border: 1px solid rgba(201,169,110,0.2);\n border-radius: 3px;\n color: #C9A96E;\n font-weight: 600; font-size: 0.78rem;\n transition: all 0.2s;\n}\n.menu-dropdown a.drop-highlight:hover {\n background: rgba(201,169,110,0.18); color: #fff; border-color: rgba(201,169,110,0.45);\n}\n.drop-highlight-arrow { font-size: 0.65rem; opacity: 0.6; margin-left: 8px; }\n \n.menu-dropdown a.drop-sim {\n display: flex; align-items: center; justify-content: space-between;\n margin: 0.25rem 0.8rem;\n padding: 0.5rem 1rem;\n background: rgba(74,144,217,0.06);\n border: 1px solid rgba(74,144,217,0.18);\n border-radius: 3px;\n color: rgba(184,212,240,0.85);\n font-size: 0.78rem;\n transition: all 0.2s;\n}\n.menu-dropdown a.drop-sim:hover {\n background: rgba(74,144,217,0.14); color: #fff; border-color: rgba(74,144,217,0.4);\n}\n.drop-sim-icon { font-size: 0.7rem; opacity: 0.55; margin-left: 8px; }\n.mega-dropdown {\n display: none; position: absolute; top: 100%; left: auto; right: 0;\n background: #0C1829; border: 1px solid rgba(74,144,217,0.15);\n border-top: 2px solid #C9A96E; border-radius: 0 0 4px 4px;\n width: 680px; padding: 1.5rem; z-index: 99999;\n box-shadow: 0 12px 40px rgba(0,0,0,0.4);\n}\n.menu-item:hover .mega-dropdown { display: block; }\n.mega-cols { display: grid; grid-template-columns: 1fr 1fr; gap: 0 2rem; }\n.mega-col .drop-label { padding: 0 0 0.3rem; }\n.mega-col .drop-label {\n font-family: 'JetBrains Mono', monospace; font-size: 0.58rem; font-weight: 600;\n letter-spacing: 0.15em; color: #C9A96E; text-transform: uppercase;\n display: block;\n}\n.mega-col a {\n display: block; padding: 0.35rem 0; font-size: 0.78rem; color: rgba(184,212,240,0.6);\n text-decoration: none; transition: color 0.2s;\n}\n.mega-col a:hover { color: #fff; }\n.mega-col .drop-sep {\n border: none; border-top: 1px solid rgba(74,144,217,0.08);\n}\n.mega-col a.drop-highlight {\n margin: 0.5rem 0 0.2rem; padding: 0.5rem 0.8rem;\n background: rgba(201,169,110,0.08); border: 1px solid rgba(201,169,110,0.2);\n border-radius: 3px; color: #C9A96E; font-weight: 600;\n display: flex; align-items: center; justify-content: space-between;\n}\n.mega-col a.drop-highlight:hover {\n background: rgba(201,169,110,0.18); color: #fff; border-color: rgba(201,169,110,0.45);\n}\n.mega-col a.drop-sim {\n margin: 0.35rem 0; padding: 0.45rem 0.8rem;\n background: rgba(74,144,217,0.06); border: 1px solid rgba(74,144,217,0.18);\n border-radius: 3px; color: rgba(184,212,240,0.85);\n display: flex; align-items: center; justify-content: space-between;\n font-size: 0.78rem;\n}\n.mega-col a.drop-sim:hover {\n background: rgba(74,144,217,0.14); color: #fff; border-color: rgba(74,144,217,0.4);\n}\n\/* \u2500\u2500 BOUTON INVESTISSEURS (CTA primaire, dor\u00e9 plein) \u2500\u2500 *\/\n.menu-investor {\n font-family: 'JetBrains Mono', monospace; font-size: 0.65rem; font-weight: 600;\n letter-spacing: 0.08em; text-transform: uppercase;\n padding: 0.5rem 1.2rem; border-radius: 2px;\n background: #C9A96E; color: #0C1829; border: 1px solid #C9A96E;\n cursor: pointer; transition: all 0.3s; white-space: nowrap; margin-right: 0.6rem;\n text-decoration: none; display: inline-block;\n}\n.menu-investor:hover { background: #d9bd87; border-color: #d9bd87; }\n.preview-hint {\n text-align: center; color: #6b7280; font-family: 'JetBrains Mono', monospace;\n font-size: 0.7rem; padding: 3rem 1rem 1rem; letter-spacing: 0.05em;\n}\n.preview-hint strong { color: #C9A96E; }\n<\/style>\n \n \n \n<div class=\"menu-bar-wrapper\">\n<div class=\"menu-bar\">\n <div class=\"menu-logo\"><span>ORIGIN\u2122<\/span><\/div>\n <div class=\"menu-items\">\n \n <!-- EAS \u00b7 EXPOSITION (entr\u00e9e de premier niveau) -->\n <div class=\"menu-eas-wrap\">\n <a href=\"https:\/\/cortexorigin.com\/index.php\/easevolution\/\" class=\"menu-eas\">\n EAS \u00b7 EXPOSITION\n <\/a>\n <div class=\"menu-dropdown menu-dropdown-eas\">\n <span class=\"drop-label\">Plateforme CTEM<\/span>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/easevolution\/\" class=\"drop-highlight\">\n EAS \u00b7 Exposition externe et interne\n <span class=\"drop-highlight-arrow\">\u2197<\/span>\n <\/a>\n <hr class=\"drop-sep\">\n <span class=\"drop-label\">Ce que la plateforme mesure<\/span>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/easevolution\/#interne\" class=\"drop-sim\">\n P\u00e9rim\u00e8tre interne \u00b7 annuaire LDAP \/ AD\n <span class=\"drop-sim-icon\">\u2197<\/span>\n <\/a>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/easevolution\/#gouvernance\" class=\"drop-sim\">\n Gouvernance & trace de d\u00e9cision\n <span class=\"drop-sim-icon\">\u2197<\/span>\n <\/a>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/easevolution\/#concurrence\" class=\"drop-sim\">\n Paysage concurrentiel\n <span class=\"drop-sim-icon\">\u2197<\/span>\n <\/a>\n <hr class=\"drop-sep\">\n <a href=\"https:\/\/cortexorigin.com\/index.php\/easevolution\/#contact\" class=\"drop-highlight\">\n Demander une cartographie\n <span class=\"drop-highlight-arrow\">\u2197<\/span>\n <\/a>\n <\/div>\n <\/div>\n \n <!-- AETZU ARROW AI (avec dropdown) -->\n <div class=\"menu-aetzu-wrap\">\n <a href=\"https:\/\/cortexorigin.com\/index.php\/aetzu-arrow-ai\/\" class=\"menu-aetzu\">\n AETZU ARROW AI\u2122\n <\/a>\n <div class=\"menu-dropdown menu-dropdown-aetzu\">\n <span class=\"drop-label\">AETZU ARROW AI<\/span>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/aetzu-arrow-ai\/\" class=\"drop-sim\">\n AETZU ARROW AI\u2122 \u00b7 D\u00e9fense active\n <span class=\"drop-sim-icon\">\u2197<\/span>\n <\/a>\n <hr class=\"drop-sep\">\n <span class=\"drop-label\">Analyse strat\u00e9gique<\/span>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/marche-et-positionnement-2\/\" class=\"drop-highlight\">\n March\u00e9 et positionnement\n <span class=\"drop-highlight-arrow\">\u2197<\/span>\n <\/a>\n <\/div>\n <\/div>\n \n <!-- WEB & API (avec dropdown) -->\n <div class=\"menu-webapi-wrap\">\n <a href=\"https:\/\/cortexorigin.com\/index.php\/cortex-idor\/\" class=\"menu-webapi\">\n WEB & API\n <\/a>\n <div class=\"menu-dropdown menu-dropdown-webapi\">\n <span class=\"drop-label\">Web & API<\/span>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/cortex-idor\/\" class=\"drop-sim\">\n IDOR \u00b7 Passerelle d’autorisation\n <span class=\"drop-sim-icon\">\u2197<\/span>\n <\/a>\n <hr class=\"drop-sep\">\n <span class=\"drop-label\">Analyse strat\u00e9gique<\/span>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/1689-2\/\" class=\"drop-highlight\">\n March\u00e9 et positionnement\n <span class=\"drop-highlight-arrow\">\u2197<\/span>\n <\/a>\n <\/div>\n <\/div>\n \n <!-- APP\u00c2T & LEURRE (avec dropdown \u2014 BAITS) -->\n <div class=\"menu-appat-wrap\">\n <a href=\"https:\/\/cortexorigin.com\/index.php\/appat-leurre-lanterne\/\" class=\"menu-appat\">\n APP\u00c2T & LEURRE\n <\/a>\n <div class=\"menu-dropdown menu-dropdown-appat\">\n <span class=\"drop-label\">Famille App\u00e2t & Leurre<\/span>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/appat-leurre-lanterne\/\" class=\"drop-sim\">\n App\u00e2t & Leurre \u00b7 Vue d’ensemble\n <span class=\"drop-sim-icon\">\u2197<\/span>\n <\/a>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/baist\/\" class=\"drop-highlight\">\n BAITS \u00b7 D\u00e9ception active\n <span class=\"drop-highlight-arrow\">\u2197<\/span>\n <\/a>\n <hr class=\"drop-sep\">\n <span class=\"drop-label\">Analyse strat\u00e9gique<\/span>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/marche-positionnement\/\" class=\"drop-sim\">\n March\u00e9 & positionnement\n <span class=\"drop-sim-icon\">\u2197<\/span>\n <\/a>\n <\/div>\n <\/div>\n \n <!-- NK (avec dropdown) -->\n <div class=\"menu-cortexnk-wrap\">\n <a href=\"https:\/\/cortexorigin.com\/index.php\/cortex-nk\/\" class=\"menu-cortexnk\">\n NOYAU NK\n <\/a>\n <div class=\"menu-dropdown menu-dropdown-cortexnk\">\n <span class=\"drop-label\">Famille NK<\/span>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/cortex-nk\/\" class=\"drop-sim\">\n NK \u00b7 Micronoyau souverain\n <span class=\"drop-sim-icon\">\u2197<\/span>\n <\/a>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/cortex-nk-3d\/\" class=\"drop-highlight\">\n NK 3D \u00b7 Cybers\u00e9curit\u00e9 active\n <span class=\"drop-highlight-arrow\">\u2197<\/span>\n <\/a>\n <hr class=\"drop-sep\">\n <span class=\"drop-label\">Secure Boot<\/span>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/cortex-nk-secure-boot\/\" class=\"drop-sim\">\n Secure Boot S1-S10 \u00b7 Module natif\n <span class=\"drop-sim-icon\">\u2197<\/span>\n <\/a>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/secure-boot-tf-a-post-quantique\/\" class=\"drop-highlight\">\n Secure Boot TF-A \u00b7 Post-Quantique\n <span class=\"drop-highlight-arrow\">\u2197<\/span>\n <\/a>\n <hr class=\"drop-sep\">\n <span class=\"drop-label\">Analyse strat\u00e9gique<\/span>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/marche-et-positionnement\/\" class=\"drop-sim\">\n March\u00e9 & positionnement\n <span class=\"drop-sim-icon\">\u2197<\/span>\n <\/a>\n <\/div>\n <\/div>\n \n <!-- BENCHMARK & V\u00c9RIFICATION (m\u00e9ga-d\u00e9roulant fusionn\u00e9) -->\n <div class=\"menu-benchmark-wrap\">\n <a href=\"https:\/\/cortexorigin.com\/index.php\/mttd-benchmark-v2-0-aetzu-arrow-ai\/\" class=\"menu-benchmark\">\n Benchmark\n <\/a>\n <div class=\"mega-dropdown\">\n <div class=\"mega-cols\">\n \n <div class=\"mega-col\">\n <span class=\"drop-label\">D\u00e9monstration<\/span>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/demonstration-cortex-nk-2\/\" class=\"drop-highlight\">\n D\u00c9MONSTRATION NK\n <span class=\"drop-highlight-arrow\">\u2197<\/span>\n <\/a>\n <hr class=\"drop-sep\" style=\"margin:0.8rem 0 0.5rem\">\n <span class=\"drop-label\">Capacit\u00e9s mesur\u00e9es<\/span>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/cryptographie\/\">Cryptographie<\/a>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/secure-boot\/\">Secure Boot<\/a>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/auto-containment-2\/\">Auto-Containment<\/a>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/audit-log-immuable\/\">Audit Log Immuable<\/a>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/attestation-et-orchestration-post-quantique\/\">Mesh v1<\/a>\n <hr class=\"drop-sep\" style=\"margin:0.8rem 0 0.5rem\">\n <span class=\"drop-label\">Tableaux de bord<\/span>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/mttd-benchmark-v2-0-aetzu-arrow-ai\/\" class=\"drop-highlight\">\n MTTD Benchmark v2.0\n <span class=\"drop-highlight-arrow\">\u2197<\/span>\n <\/a>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/1043-2\/\" class=\"drop-highlight\">\n Evaluation Dashboard\n <span class=\"drop-highlight-arrow\">\u2197<\/span>\n <\/a>\n <\/div>\n \n <div class=\"mega-col\">\n <span class=\"drop-label\">CFVL \u2014 Laboratoire formel<\/span>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/689-2\/\">CFVL \u2014 Page principale<\/a>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/841-2\/\">Journal R&D<\/a>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/833-2\/\">Publications & \u00e9valuations<\/a>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/827-2\/\">M\u00e9thodologie<\/a>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/rapport-mttd-mttb\/\">Rapport MTTD \/ MTTB<\/a>\n <hr class=\"drop-sep\" style=\"margin:0.8rem 0 0.5rem\">\n <span class=\"drop-label\">Simulations interactives<\/span>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/test\/\" class=\"drop-sim\">\n Simulations Attaque\n <span class=\"drop-sim-icon\">\u26a1<\/span>\n <\/a>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/simulation\/\" class=\"drop-sim\">\n Sch\u00e9ma & Simulations\n <span class=\"drop-sim-icon\">\u25ce<\/span>\n <\/a>\n <hr class=\"drop-sep\" style=\"margin:0.8rem 0 0.5rem\">\n <span class=\"drop-label\">Recherche<\/span>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/604-2\/\">AGI Exp\u00e9rimental<\/a>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/cortex-origin-2\/\">MVP<\/a>\n <a href=\"https:\/\/cortexorigin.com\/index.php\/814-2\/\">IA expliqu\u00e9e simplement<\/a>\n <\/div>\n \n <\/div>\n <\/div>\n <\/div>\n \n <!-- INVESTISSEURS -->\n <a href=\"https:\/\/cortexorigin.com\/index.php\/investisseurs-partenaires-strategiques\/\" class=\"menu-investor\">Investisseurs<\/a>\n \n <!-- CTA -->\n <a href=\"mailto:press@cortexorigin.com\" style=\"text-decoration:none\">\n <div class=\"menu-cta\">Contact<\/div>\n <\/a>\n \n <\/div>\n<\/div>\n<\/div>\n\n\n\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>IDOR\u2122 \u2014 Pr\u00e9sentation<\/title>\n<style>\n\/* ============================================================\n IDOR\u2122 \u2014 page de pr\u00e9sentation\n Charte ORIGIN\u2122 : navy \/ or \/ cr\u00e8me \u00b7 serif + mono\n Tout est scop\u00e9 sous .cidor-page pour cohabiter avec WordPress.\n ============================================================ *\/\n \n.cidor-page{\n \/* isolation + full-bleed STRICTEMENT identiques au wrapper NK .cr6-wrap qui fonctionne :\n all:initial neutralise les styles h\u00e9rit\u00e9s du th\u00e8me WordPress (largeurs\/marges\/contraintes). *\/\n all:initial;\n display:block;\n box-sizing:border-box;\n --navy-deep:#13223F;\n --navy:#1B2A4A;\n --blue:#1C5A9E;\n --green:#2E7A4D;\n --gold:#B68A2E;\n --teal:#3F8A8A;\n --grey-id:#8A8A90;\n --gold-soft:#EFE3C6;\n --blue-soft:#DCE6F2;\n --cream:#F2EFE8;\n --panel:#E9E6DF;\n --card:#FFFFFF;\n --border:#D6D1C5;\n --muted:#6B6B70;\n --ink:#2A2A2E;\n \n --serif:Georgia,'Times New Roman',serif;\n --mono:'SF Mono',ui-monospace,'Roboto Mono',Menlo,Consolas,monospace;\n \n background:var(--cream);\n color:var(--ink);\n font-family:var(--serif);\n -webkit-font-smoothing:antialiased;\n line-height:1.45;\n \n \/* full-bleed : pleine largeur \u00e9cran, sort de la colonne de contenu WordPress.\n Technique identique \u00e0 la page NK : largeur absolue 100vw + recentrage, plus robuste que les marges n\u00e9gatives. *\/\n width:100vw;\n position:relative;\n left:calc(50% - 50vw);\n}\n.cidor-page *{box-sizing:border-box;margin:0;padding:0;}\n \n\/* ---------- en-t\u00eate ---------- *\/\n.cidor-page .cidor-header{\n display:flex;align-items:stretch;\n background:var(--navy-deep);color:#fff;\n border-bottom:3px solid var(--gold);\n}\n.cidor-page .cidor-brand{padding:22px 34px;border-right:1px solid rgba(255,255,255,.12);}\n.cidor-page .cidor-brand .b1{font-family:var(--mono);font-size:11px;letter-spacing:.22em;color:#9DB0CC;}\n.cidor-page .cidor-brand .b2{font-family:var(--mono);font-size:16px;font-weight:700;letter-spacing:.12em;color:#fff;margin-top:4px;}\n.cidor-page .cidor-ref{\n flex:1;display:flex;align-items:center;padding:0 34px;\n font-family:var(--mono);font-size:11px;letter-spacing:.18em;color:#8FA1BD;\n}\n.cidor-page .cidor-tab{\n display:flex;align-items:center;padding:0 34px;\n background:var(--gold);color:var(--navy-deep);\n font-family:var(--mono);font-size:12px;font-weight:700;letter-spacing:.14em;\n}\n \n\/* ---------- hero ---------- *\/\n.cidor-page .cidor-hero{\n display:grid;grid-template-columns:1.35fr 1fr;gap:0;\n}\n.cidor-page .cidor-hero-left{padding:54px 44px 46px;}\n.cidor-page .cidor-hero-right{background:var(--panel);padding:54px 40px;display:flex;align-items:center;}\n \n.cidor-page .cidor-overline{\n font-family:var(--mono);font-size:11.5px;letter-spacing:.24em;color:var(--blue);\n display:flex;align-items:center;gap:14px;margin-bottom:22px;\n}\n.cidor-page .cidor-overline::before{content:\"\";width:34px;height:2px;background:var(--gold);display:inline-block;}\n \n.cidor-page h1.cidor-title{font-family:var(--serif);font-weight:700;color:var(--navy);font-size:60px;line-height:1.02;letter-spacing:-.01em;}\n.cidor-page h1.cidor-title .it{display:block;font-style:italic;font-weight:400;color:var(--blue);margin-top:4px;}\n.cidor-page h1.cidor-title .cidor-kick{display:block;font-size:24px;line-height:1.2;font-weight:700;font-style:normal;color:var(--navy);letter-spacing:0;margin-bottom:6px;}\n@media (max-width:640px){.cidor-page h1.cidor-title .cidor-kick{font-size:18px;}}\n \n.cidor-page .cidor-sub{font-family:var(--mono);font-size:13px;color:var(--muted);margin-top:26px;line-height:1.9;}\n.cidor-page .cidor-sub span{color:var(--navy);}\n \n\/* badges *\/\n.cidor-page .cidor-badges{display:flex;flex-wrap:wrap;gap:10px;margin-top:30px;}\n.cidor-page .cidor-badge{\n font-family:var(--mono);font-size:11px;letter-spacing:.1em;\n padding:8px 13px;border:1px solid var(--border);color:var(--navy);background:#fff;\n}\n.cidor-page .cidor-badge.blue{background:var(--blue-soft);border-color:#BBcDE6;}\n.cidor-page .cidor-badge.gold{background:var(--gold-soft);border-color:#E0CFA4;}\n.cidor-page .cidor-badge.grey{background:#E4E2DC;color:#5C5C61;}\n \n\/* grille KPI *\/\n.cidor-page .cidor-kpi{width:100%;border:1px solid var(--border);background:#fff;display:grid;grid-template-columns:1fr 1fr;}\n.cidor-page .cidor-cell{padding:22px 22px 20px;border-right:1px solid var(--border);border-bottom:1px solid var(--border);position:relative;}\n.cidor-page .cidor-cell:nth-child(2n){border-right:none;}\n.cidor-page .cidor-cell:nth-last-child(-n+2){border-bottom:none;}\n.cidor-page .cidor-cell::before{content:\"\";position:absolute;left:0;top:18px;bottom:18px;width:3px;background:var(--accent,var(--navy));}\n.cidor-page .cidor-cell .v{font-family:var(--mono);font-weight:700;font-size:30px;color:var(--accent,var(--navy));letter-spacing:-.01em;line-height:1;}\n.cidor-page .cidor-cell .l{font-family:var(--mono);font-size:10.5px;letter-spacing:.12em;color:var(--muted);margin-top:10px;line-height:1.5;}\n.cidor-page .a-blue{--accent:var(--blue);}\n.cidor-page .a-green{--accent:var(--green);}\n.cidor-page .a-gold{--accent:var(--gold);}\n.cidor-page .a-navy{--accent:var(--navy);}\n \n.cidor-page .cidor-pending{\n font-family:var(--mono);font-size:11px;letter-spacing:.06em;color:var(--muted);\n margin-top:16px;line-height:1.7;\n}\n.cidor-page .cidor-pending b{color:var(--gold);font-weight:700;}\n \n\/* ---------- barre de section ---------- *\/\n.cidor-page .cidor-divider{\n background:var(--navy-deep);color:#fff;display:flex;align-items:center;gap:24px;\n padding:13px 34px;font-family:var(--mono);font-size:12px;letter-spacing:.2em;\n}\n.cidor-page .cidor-divider .num{color:#6E81A0;}\n.cidor-page .cidor-divider .line{flex:1;height:1px;background:rgba(255,255,255,.18);}\n.cidor-page .cidor-divider .lbl{color:#C7D2E2;}\n \n\/* ---------- sections ---------- *\/\n.cidor-page .cidor-sec{padding:46px 44px;}\n.cidor-page h2.cidor-h2{font-family:var(--serif);font-weight:700;color:var(--navy);font-size:34px;line-height:1.08;margin-bottom:8px;}\n.cidor-page h2.cidor-h2 .it{font-style:italic;color:var(--blue);font-weight:400;}\n.cidor-page .cidor-lead{font-family:var(--mono);font-size:12.5px;color:var(--muted);line-height:1.8;max-width:760px;margin-bottom:30px;}\n \n\/* flow observe -> enforce *\/\n.cidor-page .cidor-flow{display:grid;grid-template-columns:repeat(4,1fr);gap:0;border:1px solid var(--border);background:#fff;}\n.cidor-page .cidor-step{padding:24px 22px;border-right:1px solid var(--border);}\n.cidor-page .cidor-step:last-child{border-right:none;}\n.cidor-page .cidor-step .n{font-family:var(--mono);font-weight:700;font-size:13px;color:var(--gold);letter-spacing:.1em;}\n.cidor-page .cidor-step .t{font-family:var(--serif);font-weight:700;font-size:19px;color:var(--navy);margin:8px 0 8px;}\n.cidor-page .cidor-step .d{font-family:var(--mono);font-size:11.5px;color:var(--muted);line-height:1.65;}\n \n.cidor-page .cidor-mech{\n font-family:var(--mono);font-size:12.5px;color:var(--navy);line-height:1.8;\n margin-top:22px;padding:18px 22px;background:#fff;border-left:3px solid var(--blue);border-top:1px solid var(--border);border-bottom:1px solid var(--border);border-right:1px solid var(--border);\n}\n.cidor-page .cidor-mech b{color:var(--blue);}\n \n\/* code inline *\/\n.cidor-page code{font-family:var(--mono);font-size:.9em;background:#EDEAE1;padding:1px 6px;color:var(--navy);}\n \n\/* deux colonnes (probl\u00e8me) *\/\n.cidor-page .cidor-twocol{display:grid;grid-template-columns:1fr 1fr;border:1px solid var(--border);background:#fff;}\n.cidor-page .cidor-box{padding:22px 24px;border-right:1px solid var(--border);}\n.cidor-page .cidor-box:last-child{border-right:none;}\n.cidor-page .cidor-box-h{font-family:var(--mono);font-weight:700;font-size:12px;letter-spacing:.08em;color:var(--navy);text-transform:uppercase;}\n.cidor-page .cidor-box-b{font-family:var(--serif);font-size:15px;color:var(--ink);margin-top:9px;line-height:1.5;}\n \n\/* sch\u00e9ma de branchement *\/\n.cidor-page .cidor-diagram{display:flex;align-items:stretch;flex-wrap:nowrap;}\n.cidor-page .cidor-node{flex:1;border:1px solid var(--border);background:#fff;padding:22px 18px;text-align:center;display:flex;flex-direction:column;justify-content:center;}\n.cidor-page .cidor-node.gw{background:var(--navy-deep);border-color:var(--navy-deep);}\n.cidor-page .cidor-node.gw .nh{color:#fff;}\n.cidor-page .cidor-node.gw .nb{color:#9DB0CC;}\n.cidor-page .cidor-node .nh{font-family:var(--serif);font-weight:700;font-size:18px;color:var(--navy);}\n.cidor-page .cidor-node .nb{font-family:var(--mono);font-size:10.5px;letter-spacing:.05em;color:var(--muted);margin-top:7px;line-height:1.5;}\n.cidor-page .cidor-arrow{display:flex;flex-direction:column;align-items:center;justify-content:center;padding:0 14px;min-width:92px;}\n.cidor-page .cidor-arrow::before{content:\"\\2192\";font-size:24px;color:var(--gold);font-family:var(--mono);line-height:1;}\n.cidor-page .cidor-arrow span{font-family:var(--mono);font-size:9.5px;letter-spacing:.06em;color:var(--muted);margin-top:5px;text-transform:uppercase;}\n.cidor-page .cidor-diagram-cap{font-family:var(--mono);font-size:11.5px;color:var(--muted);margin-top:14px;line-height:1.7;}\n \n\/* modes de d\u00e9ploiement *\/\n.cidor-page .cidor-modes{display:grid;grid-template-columns:repeat(3,1fr);border:1px solid var(--border);background:#fff;margin-top:30px;}\n.cidor-page .cidor-mode{padding:20px 22px;border-right:1px solid var(--border);}\n.cidor-page .cidor-mode:last-child{border-right:none;}\n.cidor-page .cidor-mode .mh{font-family:var(--serif);font-weight:700;font-size:17px;color:var(--navy);}\n.cidor-page .cidor-mode .mb{font-family:var(--mono);font-size:11.5px;color:var(--muted);margin-top:8px;line-height:1.6;}\n \n\/* pr\u00e9requis *\/\n.cidor-page .cidor-prereq{display:flex;flex-wrap:wrap;align-items:center;gap:12px;margin-top:30px;font-family:var(--mono);font-size:11.5px;color:var(--navy);}\n.cidor-page .cidor-prereq .ph{font-weight:700;letter-spacing:.1em;color:var(--gold);text-transform:uppercase;}\n.cidor-page .cidor-prereq span:not(.ph){border:1px solid var(--border);background:#fff;padding:7px 12px;}\n \n\/* pipeline interne *\/\n.cidor-page .cidor-prow-label{font-family:var(--mono);font-size:11px;letter-spacing:.1em;color:var(--gold);text-transform:uppercase;margin:18px 0 8px;}\n.cidor-page .cidor-pipe{display:flex;flex-wrap:wrap;gap:10px;}\n.cidor-page .cidor-pstep{flex:1 1 150px;border:1px solid var(--border);border-left:4px solid var(--navy);background:#fff;padding:15px 16px;}\n.cidor-page .cidor-pstep .pn{font-family:var(--mono);font-weight:700;font-size:11px;color:var(--muted);}\n.cidor-page .cidor-pstep .ph{font-family:var(--serif);font-weight:700;font-size:15px;color:var(--navy);margin-top:3px;line-height:1.2;}\n.cidor-page .cidor-pstep .pd{font-family:var(--mono);font-size:10px;color:var(--muted);margin-top:6px;line-height:1.5;}\n.cidor-page .c-id{border-left-color:var(--grey-id);}\n.cidor-page .c-tok{border-left-color:var(--gold);}\n.cidor-page .c-auth{border-left-color:var(--navy);}\n.cidor-page .c-det{border-left-color:var(--teal);}\n.cidor-page .cidor-pivot{font-family:var(--mono);font-size:12px;letter-spacing:.04em;color:var(--navy);background:#EEF1F6;border:1px solid #C9D2E0;padding:11px 16px;margin:14px 0;text-align:center;}\n.cidor-page .cidor-pivot b{font-family:var(--serif);}\n.cidor-page .cidor-async{font-family:var(--mono);font-size:11.5px;color:var(--muted);background:#fff;border:1px solid var(--border);border-left:4px solid var(--teal);padding:13px 18px;margin-top:18px;line-height:1.6;}\n.cidor-page .cidor-async b{color:var(--navy);}\n \n\/* bandeau fuzzing (stat visible) *\/\n.cidor-page .cidor-fuzz{display:flex;align-items:stretch;border:1px solid var(--border);border-left:4px solid var(--teal);background:#fff;margin-top:6px;}\n.cidor-page .cidor-fuzz .fv{font-family:var(--mono);font-weight:700;font-size:32px;color:var(--navy);padding:20px 26px;border-right:1px solid var(--border);display:flex;align-items:center;}\n.cidor-page .cidor-fuzz .ft{font-family:var(--mono);font-size:11.5px;color:var(--muted);padding:20px 24px;flex:1;line-height:1.6;display:flex;align-items:center;}\n.cidor-page .cidor-fuzz .ft b{color:var(--navy);}\n.cidor-page .cidor-fuzz .fz{font-family:var(--mono);font-weight:700;font-size:20px;color:var(--green);padding:20px 26px;border-left:1px solid var(--border);white-space:nowrap;display:flex;align-items:center;}\n.cidor-page .cidor-legend{display:flex;flex-wrap:wrap;gap:18px;margin-top:18px;font-family:var(--mono);font-size:11px;color:var(--muted);}\n.cidor-page .cidor-legend i{display:inline-block;width:11px;height:11px;margin-right:7px;vertical-align:middle;}\n.cidor-page .lg-tok{background:var(--gold);}\n.cidor-page .lg-auth{background:var(--navy);}\n.cidor-page .lg-det{background:var(--teal);}\n.cidor-page .lg-id{background:var(--grey-id);}\n.cidor-page .cidor-node.data{background:#EAF0EF;}\n \n\/* installation \u00e0 distance *\/\n.cidor-page .cidor-install{display:flex;align-items:stretch;border:1px solid var(--border);border-left:4px solid var(--gold);background:#fff;margin-top:30px;}\n.cidor-page .cidor-install .ist{padding:22px 30px;border-right:1px solid var(--border);background:#FBF6EC;display:flex;flex-direction:column;justify-content:center;text-align:center;min-width:160px;}\n.cidor-page .cidor-install .ist .iv{font-family:var(--mono);font-weight:700;font-size:36px;color:var(--gold);line-height:1;}\n.cidor-page .cidor-install .ist .il{font-family:var(--mono);font-size:10px;letter-spacing:.12em;color:var(--muted);margin-top:9px;text-transform:uppercase;}\n.cidor-page .cidor-install .ib{padding:20px 26px;}\n.cidor-page .cidor-install .ib .ih{font-family:var(--serif);font-weight:700;font-size:18px;color:var(--navy);}\n.cidor-page .cidor-install .ib .ip{font-family:var(--mono);font-size:11.5px;color:var(--muted);line-height:1.65;margin-top:9px;}\n.cidor-page .cidor-install .ib .ip b{color:var(--navy);}\n.cidor-page .cidor-install .ib .ic{font-family:var(--mono);font-size:10.5px;color:#9A8B68;font-style:italic;margin-top:10px;line-height:1.55;}\n \n\/* avant \/ apr\u00e8s \u2014 tokenisation *\/\n.cidor-page .cidor-ba{display:grid;grid-template-columns:1fr 1fr;border:1px solid var(--border);background:#fff;}\n.cidor-page .cidor-ba .col{padding:24px 26px;}\n.cidor-page .cidor-ba .avant{border-left:4px solid var(--grey-id);border-right:1px solid var(--border);}\n.cidor-page .cidor-ba .apres{border-left:4px solid var(--gold);}\n.cidor-page .cidor-ba .bl{font-family:var(--mono);font-size:11px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted);margin-bottom:14px;}\n.cidor-page .cidor-ba .apres .bl{color:var(--gold);font-weight:700;}\n.cidor-page .cidor-ba code{display:inline-block;font-family:var(--mono);font-size:14px;background:#EDEAE1;padding:8px 12px;color:var(--navy);}\n.cidor-page .cidor-ba .bd{font-family:var(--mono);font-size:11px;color:var(--muted);margin-top:14px;line-height:1.6;}\n \n\/* tableau comparatif (vs concurrence) *\/\n.cidor-page .cidor-cmp-wrap{overflow-x:auto;margin-top:6px;}\n.cidor-page .cidor-cmp{width:100%;min-width:660px;border-collapse:collapse;border:1px solid var(--border);background:#fff;font-family:var(--mono);font-size:12px;}\n.cidor-page .cidor-cmp th,.cidor-page .cidor-cmp td{border:1px solid var(--border);padding:12px 14px;text-align:center;}\n.cidor-page .cidor-cmp thead th{background:var(--cream);color:var(--navy);font-weight:700;letter-spacing:.03em;font-size:11px;}\n.cidor-page .cidor-cmp thead th.cx{background:var(--navy-deep);color:var(--gold);}\n.cidor-page .cidor-cmp tbody th{text-align:left;font-weight:400;color:var(--ink);background:#FBFAF7;font-family:var(--serif);font-size:13px;line-height:1.3;}\n.cidor-page .cidor-cmp td.cx{background:#F4F1E9;}\n.cidor-page .cidor-yes{color:var(--green);font-weight:700;font-size:15px;}\n.cidor-page .cidor-no{color:#B4564B;font-size:15px;}\n.cidor-page .cidor-part{color:var(--gold);font-weight:700;font-size:15px;}\n.cidor-page .cidor-cmp-note{font-family:var(--mono);font-size:10.5px;color:var(--muted);margin-top:14px;line-height:1.7;font-style:italic;}\n.cidor-page .cidor-cmp-note b{color:var(--navy);font-style:normal;}\n.cidor-page .cov{display:inline-block;font-family:var(--mono);font-size:9px;font-weight:700;letter-spacing:.04em;padding:3px 7px;border-radius:3px;border:1px solid;white-space:nowrap;text-transform:uppercase;}\n.cidor-page .cov.ok{background:var(--gold-soft);color:#6E5414;border-color:#E0CFA4;}\n.cidor-page .cov.part{background:var(--blue-soft);color:#184E86;border-color:#BBCDE6;}\n.cidor-page .cov.no{background:#E4E2DC;color:#5C5C61;border-color:#D2CEC6;}\n.cidor-page .cidor-repere{margin-top:30px;border:1px solid var(--border);border-left:3px solid var(--gold);background:#FBFAF7;padding:20px 22px;}\n.cidor-page .cidor-repere-h{font-family:var(--mono);font-size:11px;font-weight:700;letter-spacing:.06em;text-transform:uppercase;color:var(--navy);margin-bottom:12px;}\n.cidor-page .cidor-repere ul{list-style:none;margin:0;padding:0;}\n.cidor-page .cidor-repere li{font-family:var(--serif);font-size:13.5px;line-height:1.55;color:var(--ink);padding:9px 0;border-bottom:1px solid #ECE8DF;}\n.cidor-page .cidor-repere li:last-child{border-bottom:none;}\n.cidor-page .cidor-repere li b{color:var(--navy);}\n.cidor-page .cidor-repere .src{display:inline-block;font-family:var(--mono);font-size:9.5px;color:var(--muted);text-transform:uppercase;letter-spacing:.03em;margin-left:4px;}\n.cidor-page .cidor-repere-note{font-family:var(--mono);font-size:10.5px;color:var(--muted);font-style:italic;line-height:1.7;margin-top:14px;}\n.cidor-page .cidor-repere-note b{color:var(--navy);font-style:normal;}\n.cidor-page .cidor-stat-hero{margin:28px 0 6px;background:var(--navy-deep);padding:30px 34px;border-radius:3px;display:flex;align-items:center;gap:30px;}\n.cidor-page .cidor-stat-hero .big{font-family:var(--mono);font-size:62px;font-weight:700;color:var(--gold);line-height:.95;letter-spacing:-.02em;flex:none;}\n.cidor-page .cidor-stat-hero .txt{font-family:var(--serif);font-size:17.5px;line-height:1.45;color:#E4E1D9;}\n.cidor-page .cidor-stat-hero .txt b{color:#fff;}\n.cidor-page .cidor-stat-hero .txt .src{display:block;font-family:var(--mono);font-size:10px;color:#9BA4B5;text-transform:uppercase;letter-spacing:.04em;margin-top:11px;}\n@media (max-width:640px){.cidor-page .cidor-stat-hero{flex-direction:column;gap:14px;text-align:center;padding:24px;}.cidor-page .cidor-stat-hero .big{font-size:52px;}}\n \n\/* bandeau CTA *\/\n.cidor-page .cidor-cta{background:var(--navy-deep);border-top:3px solid var(--gold);padding:48px 44px;display:flex;align-items:center;justify-content:space-between;flex-wrap:wrap;gap:26px;}\n.cidor-page .cidor-cta .ct{font-family:var(--serif);font-weight:700;font-size:28px;color:#fff;line-height:1.25;max-width:640px;}\n.cidor-page .cidor-cta .ct .it{font-style:italic;color:var(--gold);}\n.cidor-page .cidor-cta .cs{font-family:var(--mono);font-size:11.5px;font-weight:400;color:#9DB0CC;margin-top:10px;letter-spacing:.03em;line-height:1.6;}\n.cidor-page .cidor-cta .cb{font-family:var(--mono);font-size:12px;letter-spacing:.08em;background:var(--gold);color:var(--navy-deep);padding:15px 26px;text-decoration:none;font-weight:700;white-space:nowrap;}\n \n\/* propri\u00e9t\u00e9s prouv\u00e9es *\/\n.cidor-page .cidor-props{display:grid;grid-template-columns:1fr 1fr;gap:0;border:1px solid var(--border);background:#fff;}\n.cidor-page .cidor-prop{padding:20px 22px;border-right:1px solid var(--border);border-bottom:1px solid var(--border);}\n.cidor-page .cidor-prop:nth-child(2n){border-right:none;}\n.cidor-page .cidor-prop:nth-last-child(-n+2){border-bottom:none;}\n.cidor-page .cidor-prop-wide{grid-column:1 \/ -1;border-right:none;border-bottom:none;}\n.cidor-page .cidor-prop .pt{font-family:var(--mono);font-weight:700;font-size:12px;letter-spacing:.08em;color:var(--green);}\n.cidor-page .cidor-prop .pt::before{content:\"\\2713 \";}\n.cidor-page .cidor-prop .pd{font-family:var(--serif);font-size:15px;color:var(--ink);margin-top:7px;line-height:1.45;}\n \n\/* encadr\u00e9 honn\u00eate *\/\n.cidor-page .cidor-honest{\n margin-top:30px;background:#FBF6EC;border:1px solid #E3D6B6;border-left:4px solid var(--gold);\n padding:24px 26px;\n}\n.cidor-page .cidor-honest .ht{font-family:var(--mono);font-weight:700;font-size:12px;letter-spacing:.12em;color:var(--gold);text-transform:uppercase;}\n.cidor-page .cidor-honest ul{list-style:none;margin-top:14px;}\n.cidor-page .cidor-honest li{font-family:var(--mono);font-size:12px;color:var(--ink);line-height:1.5;padding:6px 0 6px 20px;position:relative;}\n.cidor-page .cidor-honest li::before{content:\"\\2014\";position:absolute;left:0;color:var(--muted);}\n \n\/* footer *\/\n.cidor-page .cidor-footer{\n background:var(--navy-deep);color:#9DB0CC;font-family:var(--mono);font-size:11px;letter-spacing:.1em;\n padding:22px 34px;display:flex;justify-content:space-between;flex-wrap:wrap;gap:12px;border-top:3px solid var(--gold);\n}\n.cidor-page .cidor-footer b{color:#fff;}\n \n\/* anim d'apparition (sobre) *\/\n.cidor-page .reveal{opacity:0;transform:translateY(10px);animation:cidorIn .7s ease forwards;}\n.cidor-page .d1{animation-delay:.05s;}.cidor-page .d2{animation-delay:.13s;}\n.cidor-page .d3{animation-delay:.21s;}.cidor-page .d4{animation-delay:.29s;}\n@keyframes cidorIn{to{opacity:1;transform:none;}}\n@media (prefers-reduced-motion:reduce){.cidor-page .reveal{animation:none;opacity:1;transform:none;}}\n \n\/* responsive *\/\n@media (max-width:880px){\n .cidor-page .cidor-hero{grid-template-columns:1fr;}\n .cidor-page h1.cidor-title{font-size:44px;}\n .cidor-page .cidor-flow,.cidor-page .cidor-props{grid-template-columns:1fr;}\n .cidor-page .cidor-step{border-right:none;border-bottom:1px solid var(--border);}\n .cidor-page .cidor-prop{border-right:none;}\n .cidor-page .cidor-ref{display:none;}\n .cidor-page .cidor-twocol{grid-template-columns:1fr;}\n .cidor-page .cidor-box{border-right:none;border-bottom:1px solid var(--border);}\n .cidor-page .cidor-box:last-child{border-bottom:none;}\n .cidor-page .cidor-diagram{flex-direction:column;}\n .cidor-page .cidor-arrow{flex-direction:row;gap:8px;padding:10px 0;min-width:0;}\n .cidor-page .cidor-arrow::before{content:\"\\2193\";}\n .cidor-page .cidor-modes{grid-template-columns:1fr;}\n .cidor-page .cidor-mode{border-right:none;border-bottom:1px solid var(--border);}\n .cidor-page .cidor-mode:last-child{border-bottom:none;}\n .cidor-page .cidor-install{flex-direction:column;}\n .cidor-page .cidor-install .ist{border-right:none;border-bottom:1px solid var(--border);}\n .cidor-page .cidor-ba{grid-template-columns:1fr;}\n .cidor-page .cidor-ba .avant{border-right:none;border-bottom:1px solid var(--border);}\n .cidor-page .cidor-cta{flex-direction:column;align-items:flex-start;}\n .cidor-page .cidor-cta .ct{font-size:23px;}\n .cidor-page .cidor-fuzz{flex-direction:column;}\n .cidor-page .cidor-fuzz .fv,.cidor-page .cidor-fuzz .ft{border-right:none;border-bottom:1px solid var(--border);}\n .cidor-page .cidor-fuzz .fz{border-left:none;}\n}\n<\/style>\n \n \n<div class=\"cidor-page\">\n \n <!-- en-t\u00eate -->\n <header class=\"cidor-header\">\n <div class=\"cidor-brand\">\n <div class=\"b1\">CORTEX AI\u2122 SAS<\/div>\n <div class=\"b2\">CORTEX ORIGIN\u2122<\/div>\n <\/div>\n <div class=\"cidor-ref\">CFVL-IDOR-PRES-001 V0.2 \u00b7 JUIN 2026 \u00b7 RUST \u00b7 166 TESTS VERTS<\/div>\n <div class=\"cidor-tab\">CORTEX IDOR\u2122<\/div>\n <\/header>\n \n <!-- hero -->\n <section class=\"cidor-hero\">\n <div class=\"cidor-hero-left\">\n <div class=\"cidor-overline reveal d1\">PRODUIT D\u00c9FENSIF \u2014 PASSERELLE D’AUTORISATION EN COUPURE<\/div>\n <h1 class=\"cidor-title reveal d1\"><span class=\"cidor-kick\">L’AUTORISATION PAR CONSTRUCTION \u00b7 ANTI-IDOR \/ BOLA<\/span><span class=\"it\">CORTEX IDOR\u2122<\/span><\/h1>\n <div class=\"cidor-sub reveal d2\">\n Passerelle <span>bolt-on<\/span> en coupure \u2014 <span>sans modification de l’application<\/span><br>\n Jeton de capacit\u00e9 <span>li\u00e9 au mandant<\/span> \u00b7 owner-check \u00b7 pr\u00e9-autorisation <span>fail-closed<\/span><br>\n Pile d’<span>autorisation<\/span> : objet (BOLA) \u00b7 fonction (BFLA) \u00b7 champ \u00b7 d\u00e9bit \u2014 <span>toutes fail-closed<\/span><br>\n Audit <span>tamper-evident<\/span> + ancrage externe \u00b7 plan admin s\u00e9par\u00e9 \u00b7 TLS \u00b7 JWKS\n <\/div>\n <div class=\"cidor-badges reveal d3\">\n <span class=\"cidor-badge blue\">CIBLE OWASP #1 \u2014 WEB & API<\/span>\n <span class=\"cidor-badge blue\">CONTR\u00d4LE COMPENSATOIRE<\/span>\n <span class=\"cidor-badge blue\">BOLT-ON \u00b7 SANS MODIF APP<\/span>\n <span class=\"cidor-badge gold\">OBSERVE \u2192 ENFORCE<\/span>\n <span class=\"cidor-badge gold\">ANTI-PLACEBO \u00b7 MUTATION-PROUV\u00c9<\/span>\n <span class=\"cidor-badge grey\">FAIL-CLOSED PAR D\u00c9FAUT<\/span>\n <span class=\"cidor-badge grey\">CSPN EN TRAJECTOIRE<\/span>\n <span class=\"cidor-badge grey\">FRANCE DEEPTECH<\/span>\n <\/div>\n <\/div>\n \n <div class=\"cidor-hero-right\">\n <div style=\"width:100%\">\n <div class=\"cidor-kpi reveal d2\">\n <div class=\"cidor-cell a-blue\"><div class=\"v\">166<\/div><div class=\"l\">TESTS VERTS<\/div><\/div>\n <div class=\"cidor-cell a-green\"><div class=\"v\">0<\/div><div class=\"l\">MODIFICATION DE L’APP<\/div><\/div>\n <div class=\"cidor-cell a-green\"><div class=\"v\">14<\/div><div class=\"l\">PROPRI\u00c9T\u00c9S MUTATION-PROUV\u00c9ES<\/div><\/div>\n <div class=\"cidor-cell a-navy\"><div class=\"v\">17<\/div><div class=\"l\">MODULES<\/div><\/div>\n <div class=\"cidor-cell a-gold\"><div class=\"v\">AEAD<\/div><div class=\"l\">JETON LI\u00c9 AU MANDANT<\/div><\/div>\n <div class=\"cidor-cell a-navy\"><div class=\"v\">CWE-639<\/div><div class=\"l\">IDOR \/ BOLA \u2014 C\u0152UR<\/div><\/div>\n <\/div>\n <div class=\"cidor-pending reveal d4\">\n <b>En cours<\/b> \u2014 latence : pilote \u00b7 pentest tiers & CSPN : trajectoire\n <\/div>\n <\/div>\n <\/div>\n <\/section>\n \n <!-- section 01 : \u00e0 quoi \u00e7a sert -->\n <div class=\"cidor-divider\"><span class=\"num\">01<\/span><span class=\"line\"><\/span><span class=\"lbl\">\u00c0 QUOI \u00c7A SERT \u2014 IDOR \/ BOLA<\/span><span class=\"line\"><\/span><\/div>\n <section class=\"cidor-sec\">\n <h2 class=\"cidor-h2\">Le probl\u00e8me : <span class=\"it\">on change l’identifiant, on lit les donn\u00e9es d’un autre<\/span><\/h2>\n <p class=\"cidor-lead\">Une faille IDOR\/BOLA, c’est une application qui sert un objet parce qu’on en donne le nom \u2014 sans v\u00e9rifier que l’utilisateur a le droit de le voir. Un utilisateur connect\u00e9 modifie un identifiant dans l’URL (<code>\/api\/factures\/12345<\/code> \u2192 <code>12346<\/code>) et acc\u00e8de aux donn\u00e9es d’autrui. C’est la <b>faille n\u00b01 du top OWASP API<\/b>, et la cause directe de plusieurs fuites massives r\u00e9centes.<\/p>\n <div class=\"cidor-twocol\">\n <div class=\"cidor-box\">\n <div class=\"cidor-box-h\">Invisible aux d\u00e9fenses classiques<\/div>\n <div class=\"cidor-box-b\">Le trafic est authentifi\u00e9 et l\u00e9gitime en apparence. Ni le WAF, ni l’EDR, ni le 2FA ne le voient : ils prot\u00e8gent l’<i>authentification<\/i>, pas l’<i>autorisation<\/i>. C’est une faille de logique, pas une signature.<\/div>\n <\/div>\n <div class=\"cidor-box\">\n <div class=\"cidor-box-h\">Le sc\u00e9nario type<\/div>\n <div class=\"cidor-box-b\">Identifiants vol\u00e9s \u2192 connexion l\u00e9gitime \u2192 l’identifiant de ressource est un compteur \u2192 incr\u00e9ment automatis\u00e9 sur des dizaines de milliers de requ\u00eates \u2192 exfiltration massive. Aucun malware.<\/div>\n <\/div>\n <\/div>\n <div class=\"cidor-mech\">\n Ce que fait CORTEX IDOR : il se pose <b>devant<\/b> votre application et remplace chaque identifiant d’objet par un <b>jeton opaque li\u00e9 \u00e0 l’utilisateur<\/b> \u2014 l’\u00e9num\u00e9ration devient impossible par construction \u2014 puis v\u00e9rifie, objet par objet, que l’utilisateur a bien le droit d’y acc\u00e9der. <b>Sans modifier votre code.<\/b>\n <\/div>\n <\/section>\n \n <!-- section 02 : le march\u00e9 -->\n <div class=\"cidor-divider\"><span class=\"num\">02<\/span><span class=\"line\"><\/span><span class=\"lbl\">LE MARCH\u00c9 \u2014 LA CAT\u00c9GORIE N\u00b01, PARTOUT<\/span><span class=\"line\"><\/span><\/div>\n <section class=\"cidor-sec\">\n <h2 class=\"cidor-h2\">Pas une niche : <span class=\"it\">la faiblesse n\u00b01 des applications, et des API<\/span><\/h2>\n <p class=\"cidor-lead\">Toute organisation expose des API. Or leur principale faiblesse n’est pas une signature exotique \u2014 c’est le <b>contr\u00f4le d’acc\u00e8s cass\u00e9<\/b>, et sa forme la plus courante est le BOLA \/ IDOR. CORTEX IDOR cible exactement cette cat\u00e9gorie : une faiblesse <b>structurelle et quasi universelle<\/b>, pas une niche technique.<\/p>\n \n <div class=\"cidor-stat-hero\">\n <div class=\"big\">95 %<\/div>\n <div class=\"txt\"><b>des attaques d’API proviennent de sessions authentifi\u00e9es.<\/b> L’angle mort n’est pas l’authentification \u2014 c’est l’<b>autorisation<\/b>. L’attaquant est d\u00e9j\u00e0 connect\u00e9, avec un jeton valide ; ni le WAF, ni le 2FA, ni l’IdP ne voient rien. C’est pr\u00e9cis\u00e9ment la couche o\u00f9 agit CORTEX IDOR.<span class=\"src\">CybelAngel \u2014 API Threat Report 2025<\/span><\/div>\n <\/div>\n \n <div class=\"cidor-kpi\">\n <div class=\"cidor-cell a-navy\"><div class=\"v\">N\u00b01<\/div><div class=\"l\">OWASP TOP 10 : 2025 \u2014 BROKEN ACCESS CONTROL (INCHANG\u00c9 DEPUIS 2021)<\/div><\/div>\n <div class=\"cidor-cell a-blue\"><div class=\"v\">100%<\/div><div class=\"l\">DES APPLICATIONS TEST\u00c9ES PR\u00c9SENTENT UNE FORME DE CONTR\u00d4LE D’ACC\u00c8S CASS\u00c9 \u2014 OWASP 2025<\/div><\/div>\n <div class=\"cidor-cell a-navy\"><div class=\"v\">N\u00b01<\/div><div class=\"l\">OWASP API SECURITY TOP 10 \u2014 BOLA, EN T\u00caTE DEPUIS 2019<\/div><\/div>\n <div class=\"cidor-cell a-gold\"><div class=\"v\">~40%<\/div><div class=\"l\">DES ATTAQUES D’API SERAIENT DU BOLA \u2014 ESTIMATION SECTEUR<\/div><\/div>\n <\/div>\n \n <div class=\"cidor-mech\" style=\"margin-top:26px;\">\n La logique tient en quatre maillons : <b>toutes les entreprises ont des API<\/b> \u2192 leur principale faiblesse est le <b>contr\u00f4le d’acc\u00e8s<\/b> \u2192 sa manifestation n\u00b01 est le <b>BOLA \/ IDOR<\/b> (l’OWASP assimile explicitement les deux) \u2192 <b>CORTEX IDOR enforce pr\u00e9cis\u00e9ment ce contr\u00f4le, en coupure<\/b>. Tu n’adresses pas 1 % du march\u00e9 cyber : tu adresses la famille de d\u00e9fauts class\u00e9e n\u00b01 par l’OWASP, c\u00f4t\u00e9 web <i>comme<\/i> c\u00f4t\u00e9 API.\n <\/div>\n \n <p class=\"cidor-lead\" style=\"margin-top:32px;margin-bottom:18px;\">Pour situer cette tranche dans le <b>paysage complet<\/b> : voici les <b>dix<\/b> risques de l’OWASP API Security Top 10 : 2023, avec la couverture exacte de CORTEX IDOR \u2014 <i>y compris ce qu’il ne couvre pas<\/i>.<\/p>\n <div class=\"cidor-cmp-wrap\">\n <table class=\"cidor-cmp\" style=\"min-width:780px;\">\n <thead>\n <tr><th style=\"text-align:left;\">Risque \u2014 OWASP API Security Top 10 : 2023<\/th><th>CWE<\/th><th>Couverture<\/th><th class=\"cx\">Garde \/ m\u00e9canisme CORTEX IDOR<\/th><\/tr>\n <\/thead>\n <tbody>\n <tr><th>API1 \u2014 Broken Object Level Authorization (BOLA \/ IDOR) \u2014 <b>#1<\/b><\/th><td>CWE-639<\/td><td><span class=\"cov ok\">Couvert<\/span><\/td><td class=\"cx\">jeton capability + owner-check, objet par objet<\/td><\/tr>\n <tr><th>API2 \u2014 Broken Authentication<\/th><td>CWE-287 \/ 306 \/ 798<\/td><td><span class=\"cov part\">Partiel<\/span><\/td><td class=\"cx\">exige & v\u00e9rifie le mandant (JWT HS256\/RS256 s\u00e9par\u00e9s, JWKS) \u2014 n’est pas un IdP<\/td><\/tr>\n <tr><th>API3 \u2014 Broken Object Property Level Authorization (BOPLA)<\/th><td>CWE-915 \/ 200<\/td><td><span class=\"cov ok\">Couvert<\/span><\/td><td class=\"cx\">allowlist de corps + masquage r\u00e9ponse + autorisation de champ par mandant<\/td><\/tr>\n <tr><th>API4 \u2014 Unrestricted Resource Consumption<\/th><td>CWE-770 \/ 400<\/td><td><span class=\"cov ok\">Couvert<\/span><\/td><td class=\"cx\">rate-limit par mandant (token bucket), 429 + Retry-After<\/td><\/tr>\n <tr><th>API5 \u2014 Broken Function Level Authorization (BFLA)<\/th><td>CWE-862<\/td><td><span class=\"cov ok\">Couvert<\/span><\/td><td class=\"cx\">scopes OAuth2 requis, fail-closed<\/td><\/tr>\n <tr><th>API6 \u2014 Unrestricted Access to Sensitive Business Flows<\/th><td>CWE-799<\/td><td><span class=\"cov part\">Partiel<\/span><\/td><td class=\"cx\">rate-limit + d\u00e9tection att\u00e9nuent l’abus \u00e0 l’\u00e9chelle, pas une d\u00e9fense anti-bot d\u00e9di\u00e9e<\/td><\/tr>\n <tr><th>API7 \u2014 Server-Side Request Forgery (SSRF)<\/th><td>CWE-918<\/td><td><span class=\"cov no\">Hors p\u00e9rim\u00e8tre<\/span><\/td><td class=\"cx\">non revendiqu\u00e9 \u2014 d\u00e9tection contournable (assum\u00e9, voir encadr\u00e9)<\/td><\/tr>\n <tr><th>API8 \u2014 Security Misconfiguration<\/th><td>CWE-16<\/td><td><span class=\"cov no\">Hors p\u00e9rim\u00e8tre<\/span><\/td><td class=\"cx\">fail-closed & TLS internes, mais pas un scanner de configuration<\/td><\/tr>\n <tr><th>API9 \u2014 Improper Inventory Management<\/th><td>\u2014<\/td><td><span class=\"cov part\">Partiel<\/span><\/td><td class=\"cx\">le mode d\u00e9couverte inventorie les routes observ\u00e9es<\/td><\/tr>\n <tr><th>API10 \u2014 Unsafe Consumption of APIs<\/th><td>CWE-20<\/td><td><span class=\"cov no\">Hors p\u00e9rim\u00e8tre<\/span><\/td><td class=\"cx\">concerne les API tierces consomm\u00e9es, hors d’une passerelle en coupure<\/td><\/tr>\n <\/tbody>\n <\/table>\n <\/div>\n <div class=\"cidor-cmp-note\"><b>Lecture honn\u00eate.<\/b> Le classement (\u00ab n\u00b01 \u00bb) et la pr\u00e9valence (\u00ab 100 % des applications test\u00e9es \u00bb) sont des donn\u00e9es <b>OWASP \u2014 Top 10 : 2025 et API Security Top 10 : 2023<\/b>. Le \u00ab ~40 % des attaques d’API \u00bb est une <b>estimation du secteur<\/b>, pas un chiffre OWASP. Pr\u00e9valence \u2260 part des attaques : le d\u00e9faut est <b>extr\u00eamement r\u00e9pandu<\/b>, donc le march\u00e9 adressable l’est aussi \u2014 sans pour autant affirmer que la majorit\u00e9 des attaques sont des IDOR. <b>Et le p\u00e9rim\u00e8tre est assum\u00e9 :<\/b> CORTEX IDOR est une passerelle d’<b>autorisation<\/b>. Elle couvre le cluster autorisation de l’OWASP API Top 10 (API1, API3, API4, API5) ; elle ne traite <b>pas<\/b> l’injection (SQLi \/ XSS \u2014 hors liste API), la s\u00fbret\u00e9 m\u00e9moire ni la cha\u00eene d’approvisionnement logicielle, qui rel\u00e8vent d’autres outils (WAF, SAST, SCA). Ce p\u00e9rim\u00e8tre net est un <b>choix de positionnement, pas une lacune<\/b>.<\/div>\n \n <div class=\"cidor-repere\">\n <div class=\"cidor-repere-h\">Rep\u00e8res 2025 \u2014 ce que dit la donn\u00e9e r\u00e9cente<\/div>\n <ul>\n <li><b>52 %<\/b> des fuites d’API divulgu\u00e9es en 2025 sont imput\u00e9es \u00e0 une authentification cass\u00e9e ; <b>27 %<\/b> \u00e0 une consommation d’API tierces non s\u00fbre. <span class=\"src\">Wallarm \u2014 API ThreatStats (60 incidents)<\/span><\/li>\n <li><b>N\u00b01<\/b> \u2014 le BOLA \/ IDOR reste en t\u00eate de l’OWASP API Security Top 10 <b>depuis 2019<\/b>, et le contr\u00f4le d’acc\u00e8s est la <b>premi\u00e8re cause racine<\/b> des fuites d’API. <span class=\"src\">OWASP 2023 \u00b7 Gartner 2025<\/span><\/li>\n <\/ul>\n <div class=\"cidor-repere-note\">Ces chiffres mesurent des choses <b>diff\u00e9rentes<\/b> \u2014 pr\u00e9valence dans les applications, volume d’attaques, causes de fuites : c’est pourquoi aucun \u00ab % d’attaques \u00bb unique par cat\u00e9gorie n’est honn\u00eatement publiable, et nous n’en inventons pas. Le fil conducteur, lui, est constant : les d\u00e9fauts d’<b>autorisation et d’authentification<\/b> dominent, et la quasi-totalit\u00e9 des attaques transitent par des sessions l\u00e9gitimes \u2014 l\u00e0 o\u00f9 ni le WAF ni le 2FA ne voient rien, et o\u00f9 CORTEX IDOR agit.<\/div>\n <\/div>\n <\/section>\n \n <!-- section 03 : le c\u0153ur \u2014 tokenisation -->\n <div class=\"cidor-divider\"><span class=\"num\">03<\/span><span class=\"line\"><\/span><span class=\"lbl\">LE C\u0152UR \u2014 TOKENISATION PAR CAPABILITY<\/span><span class=\"line\"><\/span><\/div>\n <section class=\"cidor-sec\">\n <h2 class=\"cidor-h2\">L’identifiant n’est plus <span class=\"it\">une cible<\/span><\/h2>\n <p class=\"cidor-lead\">Le m\u00e9canisme central : la passerelle r\u00e9\u00e9crit <b>chaque identifiant d’objet<\/b> expos\u00e9 au client en un jeton opaque, chiffr\u00e9 et authentifi\u00e9, li\u00e9 \u00e0 l’utilisateur. Le client ne manipule plus jamais d’identifiant r\u00e9el ni de compteur s\u00e9quentiel.<\/p>\n \n <div class=\"cidor-ba\">\n <div class=\"col avant\">\n <div class=\"bl\">Avant<\/div>\n <code>\/api\/factures\/12345<\/code>\n <div class=\"bd\">compteur s\u00e9quentiel \u2014 \u00e9num\u00e9rable, r\u00e9utilisable par n’importe qui<\/div>\n <\/div>\n <div class=\"col apres\">\n <div class=\"bl\">Avec CORTEX IDOR<\/div>\n <code>\/api\/factures\/cidor_9fA3kZ\u2026<\/code>\n <div class=\"bd\">jeton opaque, li\u00e9 \u00e0 l’utilisateur \u2014 ni \u00e9num\u00e9rable, ni transf\u00e9rable<\/div>\n <\/div>\n <\/div>\n \n <div class=\"cidor-twocol\" style=\"margin-top:14px;\">\n <div class=\"cidor-box\">\n <div class=\"cidor-box-h\">En sortie (r\u00e9ponse)<\/div>\n <div class=\"cidor-box-b\">Le client ne voit plus jamais d’identifiant r\u00e9el ni de compteur. Il n’y a tout simplement plus rien \u00e0 incr\u00e9menter.<\/div>\n <\/div>\n <div class=\"cidor-box\">\n <div class=\"cidor-box-h\">En entr\u00e9e (requ\u00eate)<\/div>\n <div class=\"cidor-box-b\">La passerelle v\u00e9rifie que le jeton a bien \u00e9t\u00e9 \u00e9mis pour cet utilisateur. Le jeton de A rejou\u00e9 par B est rejet\u00e9 \u00e0 l’ouverture.<\/div>\n <\/div>\n <\/div>\n \n <div class=\"cidor-mech\">\n Le jeton encode <b>{ identifiant r\u00e9el \u00b7 utilisateur \u00b7 type \u00b7 expiration }<\/b>, scell\u00e9 en chiffrement authentifi\u00e9 (AEAD, XChaCha20-Poly1305). On ne peut donc ni le forger, ni l’incr\u00e9menter, ni rejouer celui d’un autre \u2014 <b>l’\u00e9num\u00e9ration est neutralis\u00e9e par construction<\/b>, pas seulement d\u00e9tect\u00e9e. Et \u00e7a fonctionne sans que la passerelle ait \u00e0 conna\u00eetre le mod\u00e8le de propri\u00e9t\u00e9 de l’application : le jeton <i>est<\/i> la capacit\u00e9. C’est le mod\u00e8le de s\u00e9curit\u00e9 par capacit\u00e9s, transpos\u00e9 \u00e0 HTTP \u2014 au c\u0153ur de l’expertise CORTEX.\n <\/div>\n <\/section>\n \n <!-- section 04 : comment \u00e7a se branche -->\n <div class=\"cidor-divider\"><span class=\"num\">04<\/span><span class=\"line\"><\/span><span class=\"lbl\">COMMENT \u00c7A SE BRANCHE \u2014 SANS MODIF DE CODE<\/span><span class=\"line\"><\/span><\/div>\n <section class=\"cidor-sec\">\n <h2 class=\"cidor-h2\">Dans le chemin de la requ\u00eate, <span class=\"it\">en coupure devant votre app<\/span><\/h2>\n <p class=\"cidor-lead\">Vous reroutez le trafic vers la passerelle ; elle traite chaque requ\u00eate puis la transmet \u00e0 votre application inchang\u00e9e. R\u00e9versible et progressif.<\/p>\n \n <div class=\"cidor-diagram\">\n <div class=\"cidor-node user\"><div class=\"nh\">Utilisateur<\/div><div class=\"nb\">navigateur \u00b7 app \u00b7 client API<\/div><\/div>\n <div class=\"cidor-arrow\"><span>TLS<\/span><\/div>\n <div class=\"cidor-node gw\"><div class=\"nh\">CORTEX IDOR\u2122<\/div><div class=\"nb\">d\u00e9tok \u00b7 owner-check \u00b7 audit \u00b7 d\u00e9tection<\/div><\/div>\n <div class=\"cidor-arrow\"><span>requ\u00eate valid\u00e9e<\/span><\/div>\n <div class=\"cidor-node app\"><div class=\"nh\">Votre API \/ App<\/div><div class=\"nb\">inchang\u00e9e \u00b7 z\u00e9ro modif de code<\/div><\/div>\n <div class=\"cidor-arrow\"><span>acc\u00e8s objet<\/span><\/div>\n <div class=\"cidor-node data\"><div class=\"nh\">Donn\u00e9es<\/div><div class=\"nb\">base \u00b7 stockage<\/div><\/div>\n <\/div>\n <div class=\"cidor-diagram-cap\">La passerelle est dans le flux : rien ne contourne le contr\u00f4le, l’application n’est pas touch\u00e9e \u2014 et passerelle, app et donn\u00e9es restent sur votre infrastructure (mode souverain possible).<\/div>\n \n <div class=\"cidor-modes\">\n <div class=\"cidor-mode\"><div class=\"mh\">Reverse-proxy<\/div><div class=\"mb\">Le plus courant. Reroutage DNS ou amont du load-balancer.<\/div><\/div>\n <div class=\"cidor-mode\"><div class=\"mh\">Sidecar Kubernetes<\/div><div class=\"mb\">Un proxy par pod ou par service, dans le mesh.<\/div><\/div>\n <div class=\"cidor-mode\"><div class=\"mh\">Souverain \/ d\u00e9connect\u00e9<\/div><div class=\"mb\">Plan de contr\u00f4le local, aucune t\u00e9l\u00e9m\u00e9trie externe.<\/div><\/div>\n <\/div>\n \n <div class=\"cidor-install\">\n <div class=\"ist\"><div class=\"iv\">< 1 h<\/div><div class=\"il\">Mode observation<\/div><\/div>\n <div class=\"ib\">\n <div class=\"ih\">Install\u00e9 \u00e0 distance, sur votre propre serveur<\/div>\n <div class=\"ip\">CORTEX d\u00e9ploie l’image conteneur sign\u00e9e <b>\u00e0 distance, directement sur votre serveur \u2014 dans votre data center, sur votre infrastructure<\/b>. Vos donn\u00e9es ne quittent jamais vos murs. La passerelle est ensuite ins\u00e9r\u00e9e dans le flux. En mode observation, elle laisse passer 100 % du trafic et observe seulement. L’enforcement vient ensuite : <b>c’est l’op\u00e9rateur qui active chaque route<\/b>, apr\u00e8s revue des suggestions \u2014 jamais automatiquement.<\/div>\n <div class=\"ic\">D\u00e9lai pour le cas conteneuris\u00e9 simple. Un environnement d’entreprise complexe (pr\u00e9paration r\u00e9seau, terminaison TLS, identification du principal) demande davantage.<\/div>\n <\/div>\n <\/div>\n \n <p class=\"cidor-lead\" style=\"margin-top:32px;margin-bottom:18px;\">Et la mise en route est <b>progressive<\/b> \u2014 chaque palier est un jalon autonome, \u00e0 votre rythme :<\/p>\n <div class=\"cidor-flow\">\n <div class=\"cidor-step\"><div class=\"n\">01<\/div><div class=\"t\">Observation<\/div><div class=\"d\">Mise en coupure, z\u00e9ro enforcement. La passerelle observe, ne bloque rien.<\/div><\/div>\n <div class=\"cidor-step\"><div class=\"n\">02<\/div><div class=\"t\">Cartographie<\/div><div class=\"d\">Rapport de couverture + mode d\u00e9couverte \u2192 routes porteuses d’objets expos\u00e9es. Suggestions revues par l’humain.<\/div><\/div>\n <div class=\"cidor-step\"><div class=\"n\">03<\/div><div class=\"t\">Enforce progressif<\/div><div class=\"d\">Bascule activ\u00e9e par l’op\u00e9rateur, route par route (virtual-patching). Jamais en bloc, jamais automatique.<\/div><\/div>\n <div class=\"cidor-step\"><div class=\"n\">04<\/div><div class=\"t\">Mesure<\/div><div class=\"d\">Couverture obtenue, faux positifs, latence p50\/p99, journal d’audit tra\u00e7able.<\/div><\/div>\n <\/div>\n \n <div class=\"cidor-prereq\">\n <span class=\"ph\">Pr\u00e9requis<\/span>\n <span>un point d’insertion (DNS \/ amont LB \/ sidecar)<\/span><span>une identit\u00e9 de principal (JWT \/ cookie \/ en-t\u00eate)<\/span><span>un conteneur l\u00e9ger<\/span>\n <\/div>\n <\/section>\n \n <!-- section 05 : comment \u00e7a fonctionne -->\n <div class=\"cidor-divider\"><span class=\"num\">05<\/span><span class=\"line\"><\/span><span class=\"lbl\">COMMENT \u00c7A FONCTIONNE \u2014 \u00c0 L’INT\u00c9RIEUR DE LA PASSERELLE<\/span><span class=\"line\"><\/span><\/div>\n <section class=\"cidor-sec\">\n <h2 class=\"cidor-h2\">Le trajet d’une requ\u00eate, <span class=\"it\">\u00e9tape par \u00e9tape<\/span><\/h2>\n <p class=\"cidor-lead\">\u00c0 l’aller, la passerelle identifie l’utilisateur, applique les gardes d’autorisation (toutes fail-closed), ouvre le jeton de capacit\u00e9 et pr\u00e9-v\u00e9rifie l’autorisation avant m\u00eame de toucher l’amont. Au retour, elle contr\u00f4le la propri\u00e9t\u00e9 de l’objet, filtre les champs, re-tokenise les identifiants et passe le verdict de d\u00e9tection.<\/p>\n \n <div class=\"cidor-prow-label\">Entr\u00e9e \u2014 vers l’application<\/div>\n <div class=\"cidor-pipe\">\n <div class=\"cidor-pstep c-id\"><div class=\"pn\">01<\/div><div class=\"ph\">Extraction du principal<\/div><div class=\"pd\">JWT \u00b7 session \u00b7 en-t\u00eate \u00b7 v\u00e9rifs HS256\/RS256 s\u00e9par\u00e9es (anti-confusion d’algorithme)<\/div><\/div>\n <div class=\"cidor-pstep c-tok\"><div class=\"pn\">02<\/div><div class=\"ph\">D\u00e9tok. + liaison<\/div><div class=\"pd\">rejet si le jeton est celui d’un autre utilisateur<\/div><\/div>\n <div class=\"cidor-pstep c-auth\"><div class=\"pn\">03<\/div><div class=\"ph\">Gardes + pr\u00e9-autorisation<\/div><div class=\"pd\">auth requise (401) \u00b7 scopes\/BFLA (403) \u00b7 d\u00e9bit (429) \u00b7 traversal (400) \u00b7 corps (422) \u00b7 owner-check \u2014 l’amont n’est pas touch\u00e9 si refus<\/div><\/div>\n <\/div>\n \n <div class=\"cidor-pivot\">\u2195 <b>Application \/ API amont<\/b> (inchang\u00e9e)<\/div>\n \n <div class=\"cidor-prow-label\">Sortie \u2014 retour vers le client<\/div>\n <div class=\"cidor-pipe\">\n <div class=\"cidor-pstep c-auth\"><div class=\"pn\">04<\/div><div class=\"ph\">Autorisation de champ<\/div><div class=\"pd\">allowlist par scope, fail-closed \u2014 le champ non autoris\u00e9 (ou inconnu) dispara\u00eet<\/div><\/div>\n <div class=\"cidor-pstep c-tok\"><div class=\"pn\">05<\/div><div class=\"ph\">Tokenisation des IDs<\/div><div class=\"pd\">capability \u2014 tue l’\u00e9num\u00e9ration par construction<\/div><\/div>\n <div class=\"cidor-pstep c-det\"><div class=\"pn\">06<\/div><div class=\"ph\">D\u00e9tection + verdict<\/div><div class=\"pd\">\u00e9num\u00e9ration \u00b7 cardinalit\u00e9 \u00b7 d\u00e9bit<\/div><\/div>\n <\/div>\n \n <div class=\"cidor-async\">En asynchrone, <b>hors du chemin critique<\/b> : journal d’audit cha\u00een\u00e9 (HMAC, tamper-evident) \u00b7 tableau de bord \u00b7 export SIEM.<\/div>\n \n <div class=\"cidor-legend\">\n <span><i class=\"lg-tok\"><\/i>Tokenisation \/ capability<\/span>\n <span><i class=\"lg-auth\"><\/i>Autorisation (policy \/ owner \/ champ)<\/span>\n <span><i class=\"lg-det\"><\/i>D\u00e9tection<\/span>\n <span><i class=\"lg-id\"><\/i>Identit\u00e9<\/span>\n <\/div>\n <\/section>\n \n <!-- section 06 : diff\u00e9rence & concurrence -->\n <div class=\"cidor-divider\"><span class=\"num\">06<\/span><span class=\"line\"><\/span><span class=\"lbl\">EN QUOI C’EST DIFF\u00c9RENT \u2014 VS LA CONCURRENCE<\/span><span class=\"line\"><\/span><\/div>\n <section class=\"cidor-sec\">\n <h2 class=\"cidor-h2\">Ni un WAF, ni une passerelle d’API <span class=\"it\">\u2014 de l’autorisation au niveau objet<\/span><\/h2>\n <p class=\"cidor-lead\">Le WAF et l’EDR cherchent des signatures ; la passerelle d’API fait de l’authentification, du routage, de la limitation de d\u00e9bit. Aucun ne tranche \u00ab cet utilisateur a-t-il le droit d’acc\u00e9der \u00e0 <i>cet<\/i> objet, et de voir <i>ce<\/i> champ ? \u00bb. C’est pr\u00e9cis\u00e9ment ce qu’enforce CORTEX IDOR \u2014 par un contr\u00f4le <b>positif<\/b> (capability + autorisation d\u00e9clar\u00e9e) plut\u00f4t que par la seule d\u00e9tection, et sans toucher au code.<\/p>\n <div class=\"cidor-cmp-wrap\">\n <table class=\"cidor-cmp\">\n <thead>\n <tr>\n <th style=\"text-align:left;\">Capacit\u00e9<\/th>\n <th>WAF<\/th>\n <th>Passerelle d’API<\/th>\n <th>Correctif dans le code<\/th>\n <th class=\"cx\">CORTEX IDOR<\/th>\n <\/tr>\n <\/thead>\n <tbody>\n <tr><th>Voit l’IDOR (trafic authentifi\u00e9, l\u00e9gitime en apparence)<\/th><td class=\"cidor-no\">\u2717<\/td><td class=\"cidor-no\">\u2717<\/td><td class=\"cidor-yes\">\u2713<\/td><td class=\"cx cidor-yes\">\u2713<\/td><\/tr>\n <tr><th>Autorisation au niveau objet (BOLA)<\/th><td class=\"cidor-no\">\u2717<\/td><td class=\"cidor-no\">\u2717<\/td><td class=\"cidor-yes\">\u2713<\/td><td class=\"cx cidor-yes\">\u2713<\/td><\/tr>\n <tr><th>Autorisation au niveau champ (par mandant)<\/th><td class=\"cidor-no\">\u2717<\/td><td class=\"cidor-no\">\u2717<\/td><td class=\"cidor-part\">~<\/td><td class=\"cx cidor-yes\">\u2713<\/td><\/tr>\n <tr><th>\u00c9num\u00e9ration tu\u00e9e par construction (capability)<\/th><td class=\"cidor-no\">\u2717<\/td><td class=\"cidor-no\">\u2717<\/td><td class=\"cidor-part\">~<\/td><td class=\"cx cidor-yes\">\u2713<\/td><\/tr>\n <tr><th>Sans modifier le code applicatif<\/th><td class=\"cidor-yes\">\u2713<\/td><td class=\"cidor-yes\">\u2713<\/td><td class=\"cidor-no\">\u2717<\/td><td class=\"cx cidor-yes\">\u2713<\/td><\/tr>\n <tr><th>D\u00e9ploiement en jours, pas en mois<\/th><td class=\"cidor-yes\">\u2713<\/td><td class=\"cidor-yes\">\u2713<\/td><td class=\"cidor-no\">\u2717<\/td><td class=\"cx cidor-yes\">\u2713<\/td><\/tr>\n <tr><th>Souverain \/ d\u00e9connect\u00e9 possible<\/th><td class=\"cidor-part\">~<\/td><td class=\"cidor-part\">~<\/td><td>\u2014<\/td><td class=\"cx cidor-yes\">\u2713<\/td><\/tr>\n <\/tbody>\n <\/table>\n <\/div>\n <div class=\"cidor-cmp-note\"><b>Le correctif dans le code reste la solution de fond<\/b> \u2014 mais lent, endpoint par endpoint. CORTEX IDOR est le pont qui prot\u00e8ge d\u00e8s maintenant, et son c\u0153ur capability est rare sur le march\u00e9. La protection s’applique aux routes couvertes (cf. rapport de couverture). \u00ab ~ \u00bb = partiel \/ d\u00e9pend du d\u00e9ploiement.<\/div>\n <\/section>\n \n <!-- section 07 : ce qui est prouv\u00e9 -->\n <div class=\"cidor-divider\"><span class=\"num\">07<\/span><span class=\"line\"><\/span><span class=\"lbl\">CE QUI EST PROUV\u00c9 \u2014 166 TESTS VERTS<\/span><span class=\"line\"><\/span><\/div>\n <section class=\"cidor-sec\">\n <h2 class=\"cidor-h2\">Quatorze propri\u00e9t\u00e9s <span class=\"it\">prouv\u00e9es par mutation<\/span><\/h2>\n <p class=\"cidor-lead\">V\u00e9rifi\u00e9es par tests d’int\u00e9gration et property-based testing (proptest). La rigueur est <b>anti-placebo<\/b> : pour chaque propri\u00e9t\u00e9, on casse d\u00e9lib\u00e9r\u00e9ment la garde \u2014 le test correspondant <b>doit<\/b> alors devenir rouge. Une garantie n’est revendiqu\u00e9e que si son test \u00e9choue quand on la rompt. <b>14 propri\u00e9t\u00e9s sur 14, z\u00e9ro placebo.<\/b><\/p>\n <div class=\"cidor-fuzz\">\n <div class=\"fv\">~54 M<\/div>\n <div class=\"ft\">ex\u00e9cutions \u00b7 <b>token_decoder + parser DSL<\/b> fuzz\u00e9s en coverage-guided (Phase B \u00b7 libFuzzer) ; finding F-1 investigu\u00e9 et mitig\u00e9<\/div>\n <div class=\"fz\">0 crash<\/div>\n <\/div>\n <div class=\"cidor-props\">\n <div class=\"cidor-prop\"><div class=\"pt\">ANTI-\u00c9NUM\u00c9RATION<\/div><div class=\"pd\">Un jeton forg\u00e9 ou pour un autre objet est rejet\u00e9 \u00e0 l’ouverture.<\/div><\/div>\n <div class=\"cidor-prop\"><div class=\"pt\">ANTI-REJEU<\/div><div class=\"pd\">Un jeton intercept\u00e9 et rejou\u00e9 par un autre mandant \u00e9choue.<\/div><\/div>\n <div class=\"cidor-prop\"><div class=\"pt\">OWNER-CHECK<\/div><div class=\"pd\">L’objet demand\u00e9 doit appartenir au mandant authentifi\u00e9.<\/div><\/div>\n <div class=\"cidor-prop\"><div class=\"pt\">PR\u00c9-AUTORISATION<\/div><div class=\"pd\">D\u00e9cision avant tout appel \u00e0 l’amont \u2014 l’amont n’est pas touch\u00e9 si refus.<\/div><\/div>\n <div class=\"cidor-prop\"><div class=\"pt\">AUTHENTIFICATION REQUISE<\/div><div class=\"pd\">Sans mandant valide, la requ\u00eate est refus\u00e9e (401) avant tout appel amont (CWE-306).<\/div><\/div>\n <div class=\"cidor-prop\"><div class=\"pt\">AUDIT TAMPER-EVIDENT<\/div><div class=\"pd\">Journal cha\u00een\u00e9 HMAC + ancrage externe d\u00e9tectant la troncature.<\/div><\/div>\n <div class=\"cidor-prop\"><div class=\"pt\">JWKS \/ RS256 \u00b7 ANTI-ALG<\/div><div class=\"pd\">Extraction par cl\u00e9 publique, rotation ; v\u00e9rifications HS256\/RS256 s\u00e9par\u00e9es (anti-confusion d’algorithme).<\/div><\/div>\n <div class=\"cidor-prop\"><div class=\"pt\">PLAN ADMIN S\u00c9PAR\u00c9<\/div><div class=\"pd\">Couverture, d\u00e9couverte et m\u00e9triques jamais expos\u00e9es sur le port public (404).<\/div><\/div>\n <\/div>\n \n <h2 class=\"cidor-h2\" style=\"font-size:24px;margin-top:42px;\">La pile d’<span class=\"it\">autorisation<\/span>, couche par couche<\/h2>\n <p class=\"cidor-lead\">Au-del\u00e0 du c\u0153ur capability, six gardes d’autorisation \u2014 toutes <b>opt-in<\/b>, toutes <b>fail-closed<\/b>, chacune adoss\u00e9e \u00e0 une propri\u00e9t\u00e9 v\u00e9rifi\u00e9e par mutation. Ce que les moteurs OPA \/ Cedar \/ Cerbos appliquent <i>dans le code<\/i>, CORTEX IDOR l’applique <i>en coupure<\/i>.<\/p>\n <div class=\"cidor-cmp-wrap\">\n <table class=\"cidor-cmp\">\n <thead>\n <tr><th style=\"text-align:left;\">Couche<\/th><th>Garde<\/th><th>Au refus<\/th><th class=\"cx\">R\u00e9f.<\/th><\/tr>\n <\/thead>\n <tbody>\n <tr><th>Fonction (BFLA)<\/th><td>scopes OAuth2 requis (s\u00e9mantique ALL)<\/td><td>403<\/td><td class=\"cx\">CWE-862<\/td><\/tr>\n <tr><th>Chemin<\/th><td>anti-traversal (<code>.\/..<\/code>, <code>%2e<\/code>, NUL\u2026)<\/td><td>400<\/td><td class=\"cx\">CWE-22<\/td><\/tr>\n <tr><th>Champ entr\u00e9e<\/th><td>allowlist de corps (mass-assignment)<\/td><td>422<\/td><td class=\"cx\">CWE-915<\/td><\/tr>\n <tr><th>Champ r\u00e9ponse<\/th><td>masquage (exposition excessive)<\/td><td>champ retir\u00e9<\/td><td class=\"cx\">OWASP API3<\/td><\/tr>\n <tr><th>Champ r\u00e9ponse \u2014 par mandant<\/th><td>allowlist conditionn\u00e9e au scope, <b>fail-closed<\/b><\/td><td>champ inconnu supprim\u00e9<\/td><td class=\"cx\">Field-Level Authz<\/td><\/tr>\n <tr><th>D\u00e9bit<\/th><td>rate-limit par mandant (token bucket)<\/td><td>429 + Retry-After<\/td><td class=\"cx\">CWE-770 \/ API4<\/td><\/tr>\n <\/tbody>\n <\/table>\n <\/div>\n <div class=\"cidor-cmp-note\">Pile compl\u00e8te : <b>objet (BOLA) \u2192 fonction (BFLA) \u2192 champ entr\u00e9e \u2192 champ r\u00e9ponse \u2192 autorisation de champ conditionn\u00e9e au mandant<\/b>, plus rate-limit et anti-traversal. La couche \u00ab par mandant \u00bb referme le d\u00e9faut classique de la simple blocklist : un champ ajout\u00e9 mais oubli\u00e9 de la politique <b>dispara\u00eet par d\u00e9faut<\/b>, au lieu de fuiter.<\/div>\n \n <div class=\"cidor-honest\">\n <div class=\"ht\">Ce qui n’est pas (encore) revendiqu\u00e9<\/div>\n <ul>\n <li>Latence bout-en-bout non mesur\u00e9e \u2014 le loopback n’est pas repr\u00e9sentatif ; validation en pilote (p50\/p99 sur h\u00f4tes s\u00e9par\u00e9s).<\/li>\n <li>Fuzzing : ~54 M ex\u00e9cutions sur deux cibles (token_decoder + parser DSL), 0 crash ; finding F-1 investigu\u00e9 et mitig\u00e9.<\/li>\n <li>Pas de pentest tiers \u00e0 ce jour \u2014 sur la trajectoire (p\u00e9rim\u00e8tre PASSI pr\u00eat).<\/li>\n <li>Non certifi\u00e9 \u2014 CSPN (ANSSI) en trajectoire, pas un EAL.<\/li>\n <li>Autorisation de champ : filtre les noms de champs, pas leurs valeurs ; co\u00fbt de configuration croissant au-del\u00e0 de ~50 routes.<\/li>\n <li>Contr\u00f4le compensatoire : neutralise l’exploitation des IDOR sur les routes couvertes, ne remplace pas la s\u00e9curisation applicative de fond.<\/li>\n <\/ul>\n <\/div>\n <\/section>\n \n <!-- section 08 : conformit\u00e9 -->\n <div class=\"cidor-divider\"><span class=\"num\">08<\/span><span class=\"line\"><\/span><span class=\"lbl\">CONFORMIT\u00c9 \u2014 RGPD \u00b7 NIS2 \u00b7 DORA<\/span><span class=\"line\"><\/span><\/div>\n <section class=\"cidor-sec\">\n <h2 class=\"cidor-h2\">Une brique de <span class=\"it\">conformit\u00e9<\/span>, tra\u00e7able<\/h2>\n <p class=\"cidor-lead\">CORTEX IDOR contribue \u00e0 la d\u00e9monstration de mesures de s\u00e9curit\u00e9 appropri\u00e9es. Le journal d’audit tamper-evident fournit une trace exploitable des d\u00e9cisions d’acc\u00e8s, en cas de contr\u00f4le ou d’enqu\u00eate post-incident.<\/p>\n <div class=\"cidor-modes\">\n <div class=\"cidor-mode\"><div class=\"mh\">RGPD<\/div><div class=\"mb\">Contr\u00f4le d’acc\u00e8s au niveau objet et au niveau champ, minimisation, journalisation auditable des acc\u00e8s aux donn\u00e9es personnelles.<\/div><\/div>\n <div class=\"cidor-mode\"><div class=\"mh\">NIS2<\/div><div class=\"mb\">Mesures techniques de gestion des risques, tra\u00e7abilit\u00e9, d\u00e9tection d’incident.<\/div><\/div>\n <div class=\"cidor-mode\"><div class=\"mh\">DORA<\/div><div class=\"mb\">R\u00e9silience op\u00e9rationnelle, contr\u00f4le et journalisation des acc\u00e8s aux donn\u00e9es sensibles.<\/div><\/div>\n <\/div>\n <div class=\"cidor-cmp-note\">Contribution \u00e0 la conformit\u00e9 \u2014 <b>pas une certification<\/b>. CORTEX IDOR reste un contr\u00f4le compensatoire.<\/div>\n <\/section>\n \n <!-- bandeau CTA -->\n <div class=\"cidor-cta\">\n <div class=\"ct\">Discutons d’un <span class=\"it\">pilote<\/span> \u2014 observe-first.<div class=\"cs\">D\u00e9ploiement en mode observation \u00b7 mesure de couverture et de latence \u00b7 d\u00e9monstration \u00ab A ne peut pas lire les donn\u00e9es de B \u00bb.<br>press@cortexorigin.com<\/div><\/div>\n <a class=\"cb\" href=\"mailto:press@cortexorigin.com?subject=CORTEX%20IDOR%20%E2%80%94%20demande%20de%20pilote\">Demander un pilote<\/a>\n <\/div>\n \n <!-- footer -->\n <footer class=\"cidor-footer\">\n <span><b>\u00c9diteur : CORTEX AI\u2122 SAS<\/b> \u00b7 CORTEX ORIGIN\u2122 \u00b7 press@cortexorigin.com<\/span>\n <span>CFVL-IDOR-PRES-001 V0.2 \u00b7 JUIN 2026<\/span>\n <\/footer>\n \n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Menu ORIGIN\u2122 ORIGIN\u2122 EAS \u00b7 EXPOSITION Plateforme CTEM EAS \u00b7 Exposition externe et interne \u2197 Ce que la plateforme mesure P\u00e9rim\u00e8tre interne \u00b7 annuaire LDAP \/ AD \u2197 Gouvernance & trace de d\u00e9cision \u2197 Paysage concurrentiel \u2197 Demander une cartographie \u2197 AETZU ARROW AI\u2122 AETZU ARROW AI AETZU ARROW AI\u2122 \u00b7 D\u00e9fense active \u2197 Analyse […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-1665","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/cortexorigin.com\/index.php\/wp-json\/wp\/v2\/pages\/1665","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cortexorigin.com\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/cortexorigin.com\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/cortexorigin.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cortexorigin.com\/index.php\/wp-json\/wp\/v2\/comments?post=1665"}],"version-history":[{"count":19,"href":"https:\/\/cortexorigin.com\/index.php\/wp-json\/wp\/v2\/pages\/1665\/revisions"}],"predecessor-version":[{"id":1937,"href":"https:\/\/cortexorigin.com\/index.php\/wp-json\/wp\/v2\/pages\/1665\/revisions\/1937"}],"wp:attachment":[{"href":"https:\/\/cortexorigin.com\/index.php\/wp-json\/wp\/v2\/media?parent=1665"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}