omamori 0.1.2 → 0.2.0

data/lib/omamori/ai_analysis_engine/sub_checks/insufficient_encryption.yml

@@ -0,0 +1,19 @@
+# Concrete patterns that are each enough to make insufficient encryption real on their own.
+# Each question asks for the pattern AND a missing defense, so that code which uses the same construct safely is a no.
+weak_randomness: >-
+  Does the code generate a token, reset code, one-time code, session id, or key with a predictable random source
+  (rand, Random.new, Kernel#srand, or values derived from the time or an id) instead of SecureRandom? Answer no when
+  SecureRandom (or a library that uses it) produces the value.
+weak_cipher_use: >-
+  Does the code encrypt data with a fixed, reused, or derived-from-data IV or nonce, with ECB mode, with a hard-coded
+  key, or with an unauthenticated mode where tampering matters (for example AES-CBC without a MAC)? Answer no when it
+  uses ActiveSupport::MessageEncryptor or Active Record encryption with their defaults, or an authenticated mode such
+  as AES-GCM with a fresh random IV for every message.
+encryption_removed: >-
+  Does the change stop encrypting sensitive data that was encrypted before, for example removing encrypts from a model
+  attribute, storing a secret or personal data in a plain column, or replacing encryption with encoding (Base64)?
+  Answer no when the data stays encrypted, or only a non-sensitive value is stored in plain form.
+weak_password_hash: >-
+  Does the code store or compare passwords, or other low-entropy secrets such as short codes, with a fast digest (MD5,
+  SHA1, SHA256 without a password hashing scheme) or without a salt? Answer no when it uses has_secure_password,
+  bcrypt, scrypt, or Argon2, or when the hashed value is a long random token where a fast digest is fine.

data/lib/omamori/ai_analysis_engine/sub_checks/mass_assignment.yml

@@ -0,0 +1,19 @@
+# Concrete patterns that are each enough to make mass assignment real on their own.
+# Each question asks for the pattern AND a missing defense, so that code which uses the same construct safely is a no.
+permit_all: >-
+  Does the code create or update a model with request parameters that are not limited to a fixed list of
+  attributes, through params.permit!, to_unsafe_h, to_unsafe_hash, permit(*Model.column_names), or a permit list
+  chosen by the client, in an action regular users can call? Answer no when the parameters are limited with permit
+  or expect to a fixed list, or when a hash permit such as permit(preferences: {}) only fills a single JSON or
+  serialized column.
+sensitive_attribute: >-
+  Does an action that regular users can call (sign-up, profile or account update, a member API) permit attributes
+  that users should not control, such as role, admin, owner_id, user_id, account_id, balance, price, plan, verified,
+  or confirmed_at? Answer no when such attributes are only permitted in an admin-only action that checks the user is
+  an administrator, or are set on the server instead of from params.
+strong_params_bypass: >-
+  Does the code pass request data to a model write (new, create, update, assign_attributes, insert_all, upsert)
+  without going through strong parameters, for example JSON.parse(request.body.read), request.request_parameters,
+  request.POST, or the arguments of a GraphQL mutation (GraphQL input objects are not protected by strong
+  parameters, so every argument the input type declares can be written)? Answer no when only explicitly listed,
+  harmless attributes are taken from that data, or the GraphQL input type declares only harmless arguments.

data/lib/omamori/ai_analysis_engine/sub_checks/open_redirect.yml

@@ -0,0 +1,17 @@
+# Concrete patterns that are each enough to make an open redirect real on their own.
+# Each question asks for the pattern AND a missing defense, so that code which uses the same construct safely is a no.
+other_host_allowed: >-
+  Does the code redirect to a URL that may come from users (params, a value saved in the session from params, or
+  the Referer header) in a way that allows other hosts: redirect_to or redirect_back with allow_other_host: true,
+  raise_on_open_redirects turned off, or a redirect outside Rails' redirect_to such as a Sinatra or Rack redirect
+  or a Location header set by hand? Answer no when the destination is checked first with url_from, or its parsed
+  host is compared exactly against a fixed list, or Rails' default protection (Rails 7+) is left on.
+weak_url_check: >-
+  Does the code decide that a redirect destination is safe with a string check that can be fooled: start_with?,
+  include?, or end_with? on the URL or host, or only checking that the value starts with "/" (which lets
+  //evil.example and /\evil.example through)? Answer no when the URL is parsed and its host compared exactly, or
+  when a path check also rejects values starting with "//" or "/\".
+client_side_redirect: >-
+  Does front-end JavaScript send the browser to a URL taken from the query string, the hash, or other
+  user-controlled input (window.location, location.href, location.assign, location.replace) without making sure it
+  stays on the same origin? Answer no when it only accepts URLs whose origin equals location.origin.

data/lib/omamori/ai_analysis_engine/sub_checks/sql_injection.yml

@@ -0,0 +1,20 @@
+# Concrete patterns that are each enough to make SQL injection real on their own.
+# Each question asks for the pattern AND a missing defense, so that code which uses the same construct safely is a no.
+string_built_query: >-
+  Does the code interpolate or concatenate data that may come from users into a SQL fragment passed to an
+  ActiveRecord method that accepts raw SQL (where, having, joins, from, lock, find_by_sql)? Answer no when the value
+  is passed through a ? or named placeholder, a hash condition, sanitize_sql_array, connection.quote, or is cast to
+  an integer first.
+raw_connection: >-
+  Does the code run SQL through the database connection directly (connection.execute, select_all, select_value,
+  select_rows, exec_query) with data that may come from users interpolated into the SQL string? Answer no when the
+  values are bound as parameters, quoted with connection.quote, or cast to integers.
+raw_sql_method: >-
+  Does data that may come from users reach a method that takes raw SQL without checking it: Arel.sql(...),
+  select("..."), group("..."), or order / reorder / pluck with Arel.sql? Answer no when the value is mapped through
+  a fixed allowlist of column names or directions, or passed as a symbol or hash such as order(created_at: :desc).
+  Note that plain order(params[:sort]) without Arel.sql is rejected by Rails 6+ for anything but a column name.
+like_and_in_clauses: >-
+  Does the code build a LIKE pattern or an IN (...) list by putting data that may come from users directly into
+  the SQL string, for example where("name LIKE '%#{q}%'") or where("id IN (#{ids.join(',')})")? Answer no when it
+  uses where("name LIKE ?", "%#{sanitize_sql_like(q)}%"), a placeholder, or a hash condition such as where(id: ids).

data/lib/omamori/ai_analysis_engine/sub_checks/xss.yml

@@ -0,0 +1,37 @@
+# Concrete patterns that are each enough to make XSS real on their own.
+# The classifier answers each one separately, alongside the overall XSS question.
+# Each question asks for the pattern AND a missing defense, so that code which uses the same construct safely is a no.
+raw_output: >-
+  Does the code send data that may come from users to the page as HTML without escaping it? Answer yes when such
+  data reaches raw, html_safe, <%== %>, or safe_concat, or is interpolated into a string that is then marked
+  html_safe, without being escaped first. Answer no when every user value is escaped (h, ERB::Util.html_escape,
+  sanitize) or the HTML is built with tag helpers (content_tag, tag.*, link_to, safe_join) before being marked safe.
+js_context: >-
+  Does the code put data that may come from users into JavaScript (an inline <script> block, an event handler
+  attribute such as onclick, or a JavaScript string) without JavaScript-safe escaping? This includes raw output,
+  and JSON produced by JSON.generate or a JSON library other than Rails' to_json, because it does not escape
+  </script>. Answer no when the data goes through json_escape, j / escape_javascript, or Rails' to_json, which
+  escape the characters that could end the script.
+url_attribute: >-
+  Does the code put a URL that may come from users into href, src, action, or formaction without making sure it is
+  not a javascript: URL? Answer no when the scheme is checked to be http or https, the URL comes from a route helper
+  or a fixed path, or the content goes through sanitize, which removes javascript: URLs.
+html_response: >-
+  Does the code build HTML by interpolating data that may come from users into a string and send it to the browser
+  outside the escaping template engine (render html:, render inline:, or a Rack or Sinatra response body), without
+  escaping that data? Answer no when every interpolated value is escaped (h, ERB::Util.html_escape,
+  Rack::Utils.escape_html).
+sanitizer_config: >-
+  Does the code change how content that may come from users is sanitized or rendered so that dangerous HTML can now
+  get through? For example allowing script, iframe, or object tags or on* attributes in sanitize, or enabling raw
+  HTML in a Markdown renderer (Commonmarker unsafe: true, Redcarpet without filter_html). Answer no when the change
+  keeps raw HTML disabled and keeps the default sanitize allowlist.
+dom_sink: >-
+  Does front-end JavaScript insert data that may come from users or from the server into the page as HTML, through
+  innerHTML, outerHTML, insertAdjacentHTML, document.write, or jQuery .html()? Answer no when it only uses
+  textContent, createTextNode, or creates elements and sets their text.
+attribute_injection: >-
+  Does the code build an HTML attribute value by interpolating data that may come from users into a string, without
+  escaping the quotes, so that the value could end the attribute and add a new one such as onmouseover? Answer no
+  when the value is escaped with h or ERB::Util.html_escape (which escape quotes) or the attribute is set through a
+  tag helper.

data/lib/omamori/ai_settings.rb

@@ -0,0 +1,273 @@
+# frozen_string_literal: true
+
+require_relative 'ai_analysis_engine/ruby_llm_context'
+require_relative 'ai_analysis_engine/llm_client'
+require_relative 'ai_analysis_engine/judge_client'
+require_relative 'ai_analysis_engine/cli_clients/claude_code_client'
+require_relative 'ai_analysis_engine/cli_clients/codex_client'
+require_relative 'ai_analysis_engine/fallback_client'
+
+module Omamori
+  # Decides which classifier and reporter to use, from .omamorirc and command-line options.
+  #
+  #   classifier:            # omit to let the reporter check everything itself
+  #     provider: typesafe   # any RubyLLM provider that can judge (typesafe, openai, ollama)
+  #     model: jev-1.13.0
+  #     sub_checks: true     # also ask each risk's concrete patterns (sub_checks/*.yml)
+  #   reporter:
+  #     provider: anthropic  # any RubyLLM provider, or claude_code / codex (subscription CLIs)
+  #     model: claude-sonnet-5-5
+  #     fallback:            # optional; asked only when the reporter refuses or fails
+  #       provider: claude_code
+  #       model: sonnet
+  #
+  # There is no default reporter: `omamori init --reporter ...` writes one. The older keys (engine, llm,
+  # model, provider, api_key, decision, claude, codex) are still read; an old config with only `api_key`
+  # keeps using Gemini, as it did before.
+  class AISettings
+    class Error < StandardError; end
+
+    CLI_REPORTERS = %w[claude_code codex].freeze
+    # The reporter of omamori 0.1, used only for old configs that set the top-level api_key (a Gemini key)
+    LEGACY_REPORTER = { 'provider' => 'gemini', 'model' => AIAnalysisEngine::LLMClient::DEFAULT_MODEL }.freeze
+    # Classifier providers whose model can be omitted
+    DEFAULT_CLASSIFIER_MODELS = { 'typesafe' => 'jev-1.13.0', 'openai' => 'gpt-6-luna' }.freeze
+    # Questions per request accepted by each classifier provider (no entry: no limit)
+    MAX_QUESTIONS = { 'openai' => 200 }.freeze
+    # RubyLLM protocols that answer judgment questions
+    JUDGE_PROTOCOLS = %i[system_one decisions].freeze
+    DEFAULT_THRESHOLD = 0.5
+    DEFAULT_CLASSIFIER_CONCURRENCY = 8
+    DEFAULT_API_REPORTER_CONCURRENCY = 8
+    # Subscription CLIs have tighter rate limits than APIs
+    DEFAULT_CLI_REPORTER_CONCURRENCY = 3
+
+    LEGACY_ENGINES = { 'jev' => 'typesafe', 'openai' => 'openai' }.freeze
+    LEGACY_NO_CLASSIFIER = %w[llm gemini].freeze
+    LEGACY_LLMS = { 'claude' => 'claude_code', 'codex' => 'codex' }.freeze
+
+    # The classifier settings, or nil when the reporter checks everything itself
+    attr_reader :classifier
+    # The reporter settings, or nil when none is configured (`omamori scan` stops with #reporter_missing_message)
+    attr_reader :reporter
+
+    # overrides: classifier:, classifier_model:, reporter:, reporter_model:, reporter_fallback:,
+    # reporter_fallback_model: (from the command line)
+    def initialize(config, overrides = {})
+      @config = config
+      @overrides = overrides.compact.transform_values(&:to_s)
+      @classifier = resolve_classifier
+      @reporter = resolve_reporter
+      @reporter_fallback = resolve_reporter_fallback
+    end
+
+    def classifier?
+      !@classifier.nil?
+    end
+
+    def reporter?
+      !@reporter.nil?
+    end
+
+    def cli_reporter?
+      reporter? && CLI_REPORTERS.include?(@reporter['provider'])
+    end
+
+    def threshold
+      @classifier.fetch('threshold', DEFAULT_THRESHOLD)
+    end
+
+    # Whether each risk is also asked as concrete sub-checks (on unless `classifier.sub_checks: false`)
+    def sub_checks?
+      @classifier.fetch('sub_checks', true)
+    end
+
+    def classifier_concurrency
+      @classifier.fetch('concurrency', DEFAULT_CLASSIFIER_CONCURRENCY)
+    end
+
+    def reporter_concurrency
+      @reporter.fetch('concurrency', cli_reporter? ? DEFAULT_CLI_REPORTER_CONCURRENCY : DEFAULT_API_REPORTER_CONCURRENCY)
+    end
+
+    def reporter_model
+      @reporter&.fetch('model', nil)
+    end
+
+    def self.reporter_missing_message(command: 'scan')
+      message = <<~MESSAGE
+        No reporter is configured. Choose the LLM that writes reports, for example:
+
+          omamori init --reporter claude_code                                # Claude Code subscription (claude -p)
+          omamori init --reporter codex                                      # Codex subscription (codex exec)
+          omamori init --reporter anthropic --reporter-model claude-sonnet-5-5   # Any RubyLLM provider and model
+      MESSAGE
+      return message unless command == 'scan'
+
+      "#{message}\nOr pass --reporter (and --reporter-model) to `omamori scan`.\n"
+    end
+
+    # The environment variable that holds the API key of a RubyLLM provider, or nil when it has none
+    # (claude_code / codex use the CLI's login; some providers only need a server address)
+    def self.api_key_env(provider)
+      return nil if provider.nil? || CLI_REPORTERS.include?(provider)
+
+      name = "#{provider}_api_key"
+      RubyLLM.config.respond_to?("#{name}=") ? name.upcase : nil
+    end
+
+    def build_classifier_client
+      return nil unless classifier?
+
+      AIAnalysisEngine::JudgeClient.new(
+        ruby_llm_context,
+        provider: @classifier['provider'].to_sym, model: @classifier['model'],
+        max_questions: @classifier.fetch('max_questions', MAX_QUESTIONS[@classifier['provider']])
+      )
+    end
+
+    def build_reporter_client
+      return nil unless reporter?
+
+      client = build_llm_client(@reporter)
+      return client unless @reporter_fallback
+
+      AIAnalysisEngine::FallbackClient.new(client, build_llm_client(@reporter_fallback),
+                                           fallback_model: @reporter_fallback['model'])
+    end
+
+    attr_reader :reporter_fallback
+
+    # A client for one reporter's settings (the reporter or its fallback)
+    def build_llm_client(settings)
+      case settings['provider']
+      when 'claude_code' then AIAnalysisEngine::CLIClients::ClaudeCodeClient.new(command: settings['command'])
+      when 'codex' then AIAnalysisEngine::CLIClients::CodexClient.new(command: settings['command'])
+      else AIAnalysisEngine::LLMClient.new(ruby_llm_context, provider: settings['provider']&.to_sym)
+      end
+    end
+
+    # One line for the console, e.g. "classifier: typesafe/jev-1.13.0, reporter: gemini/gemini-3.8-flash"
+    def describe
+      reporter = reporter? ? [@reporter['provider'], @reporter['model']].compact.join('/') : 'none'
+      reporter += " (fallback: #{[@reporter_fallback['provider'], @reporter_fallback['model']].compact.join('/')})" if @reporter_fallback
+      return "reporter: #{reporter}" unless classifier?
+
+      "classifier: #{@classifier['provider']}/#{@classifier['model']}, reporter: #{reporter}"
+    end
+
+    private
+
+    def get(key)
+      @config.get(key, nil)
+    end
+
+    def resolve_classifier
+      settings = apply_override(configured_classifier, @overrides[:classifier], @overrides[:classifier_model])
+      return nil if settings.nil? || settings['provider'] == 'none'
+
+      provider = settings.fetch('provider') { raise Error, 'classifier.provider is required' }
+      validate_classifier_provider!(provider)
+      settings['model'] ||= DEFAULT_CLASSIFIER_MODELS.fetch(provider) do
+        raise Error, "classifier.model is required for provider #{provider}"
+      end
+      settings
+    end
+
+    def resolve_reporter
+      settings = apply_override(configured_reporter, @overrides[:reporter], @overrides[:reporter_model])
+      settings = LEGACY_REPORTER.merge(settings || {}) if legacy_gemini?(settings)
+      return nil if settings.nil? || (settings['provider'].nil? && settings['model'].nil?)
+
+      validate_reporter(settings.except('fallback'))
+    end
+
+    def resolve_reporter_fallback
+      # Read from the configured reporter, so a --reporter override keeps the configured fallback
+      configured = configured_reporter&.fetch('fallback', nil)&.then { |fallback| stringify(fallback) }
+      settings = apply_override(configured, @overrides[:reporter_fallback], @overrides[:reporter_fallback_model])
+      return nil if settings.nil? || settings['provider'] == 'none'
+
+      validate_reporter(settings, role: 'reporter.fallback')
+    end
+
+    def validate_reporter(settings, role: 'reporter')
+      provider = settings['provider']
+      return settings if provider.nil? || CLI_REPORTERS.include?(provider)
+
+      raise Error, "Unknown #{role} provider: #{provider}" unless RubyLLM::Provider.resolve(provider)
+      raise Error, "#{role}.model is required for provider #{provider}" unless settings['model']
+
+      settings
+    end
+
+    # A provider given on the command line replaces the configured one; the configured model only
+    # carries over when the provider stays the same.
+    def apply_override(settings, provider, model)
+      if provider
+        settings = settings&.fetch('provider', nil) == provider ? settings : {}
+        settings = settings.merge('provider' => provider)
+      end
+      settings = (settings || {}).merge('model' => model) if model
+      settings
+    end
+
+    # omamori 0.1 configs had only the Gemini `api_key` (and maybe `model`), and used Gemini by default
+    def legacy_gemini?(settings)
+      get('api_key') && (settings.nil? || (settings['provider'].nil? && settings['model'].nil?))
+    end
+
+    def configured_classifier
+      return stringify(get('classifier')) if get('classifier')
+
+      engine = get('engine')&.to_s
+      return nil if engine.nil? || LEGACY_NO_CLASSIFIER.include?(engine)
+
+      provider = LEGACY_ENGINES.fetch(engine) { raise Error, "Unknown engine: #{engine}" }
+      decision = stringify(get('decision') || {})
+      engine_settings = stringify(decision[engine] || {})
+      { 'provider' => provider, 'threshold' => decision['threshold'], 'concurrency' => decision['concurrency'] }
+        .merge(engine_settings.slice('model', 'base_url', 'api_key')).compact
+    end
+
+    def configured_reporter
+      return stringify(get('reporter')) if get('reporter')
+
+      llm = get('llm')&.to_s
+      report_concurrency = stringify(get('decision') || {})['report_concurrency']
+      settings = if LEGACY_LLMS.key?(llm)
+                   { 'provider' => LEGACY_LLMS[llm] }.merge(stringify(get(llm) || {}).slice('model', 'command'))
+                 else
+                   { 'provider' => get('provider')&.to_s, 'model' => get('model') }
+                 end
+      settings.merge('concurrency' => report_concurrency).compact.then { |s| s.empty? ? nil : s }
+    end
+
+    def validate_classifier_provider!(provider)
+      provider_class = RubyLLM::Provider.resolve(provider)
+      raise Error, "Unknown classifier provider: #{provider}" unless provider_class
+      return if provider_class.protocols.keys.intersect?(JUDGE_PROTOCOLS)
+
+      raise Error, "Provider #{provider} cannot be used as a classifier"
+    end
+
+    # Each role's api_key / base_url go to RubyLLM's <provider>_api_key / <provider>_api_base.
+    # The old top-level api_key is a Gemini key.
+    def ruby_llm_context
+      @ruby_llm_context ||= begin
+        overrides = { gemini_api_key: get('api_key') }
+        [@classifier, @reporter, @reporter_fallback].compact.each do |settings|
+          next unless settings['provider'] && !CLI_REPORTERS.include?(settings['provider'])
+
+          overrides[:"#{settings['provider']}_api_key"] = settings['api_key'] if settings['api_key']
+          overrides[:"#{settings['provider']}_api_base"] = settings['base_url'] if settings['base_url']
+        end
+        AIAnalysisEngine::RubyLLMContext.build(overrides)
+      end
+    end
+
+    def stringify(hash)
+      hash.to_h.transform_keys(&:to_s)
+    end
+  end
+end

data/lib/omamori/config.rb

@@ -4,11 +4,15 @@ require 'yaml'
 
 module Omamori
   class Config
-    DEFAULT_CONFIG_PATH = ".omamorirc"
+    DEFAULT_CONFIG_PATH = '.omamorirc'
+    DEFAULT_IGNORE_PATH = '.omamoriignore'
+
+    attr_reader :ignore_patterns
 
     def initialize(config_path = DEFAULT_CONFIG_PATH)
       @config_path = config_path
       @config = load_config
+      @ignore_patterns = load_ignore_patterns # Load ignore patterns
       validate_config # Add validation after loading
     end
 
@@ -31,100 +35,116 @@ module Omamori
     end
 
     def validate_api_key
-      api_key = @config["api_key"]
-      if api_key && !api_key.is_a?(String)
-        puts "Warning: Config 'api_key' should be a string."
-      end
+      api_key = @config['api_key']
+      return unless api_key && !api_key.is_a?(String)
+
+      puts "Warning: Config 'api_key' should be a string."
     end
 
     def validate_model
-      model = @config["model"]
-      if model && !model.is_a?(String)
-        puts "Warning: Config 'model' should be a string."
-      end
+      model = @config['model']
+      return unless model && !model.is_a?(String)
+
+      puts "Warning: Config 'model' should be a string."
     end
 
     def validate_checks
-      checks = @config["checks"]
-      if checks && !checks.is_a?(Array)
-        puts "Warning: Config 'checks' should be an array."
-      end
+      checks = @config['checks']
+      return unless checks && !checks.is_a?(Array)
+
+      puts "Warning: Config 'checks' should be an array."
     end
 
     def validate_prompt_templates
-      prompt_templates = @config["prompt_templates"]
-      if prompt_templates && !prompt_templates.is_a?(Hash)
-        puts "Warning: Config 'prompt_templates' should be a hash."
-      end
+      prompt_templates = @config['prompt_templates']
+      return unless prompt_templates && !prompt_templates.is_a?(Hash)
+
+      puts "Warning: Config 'prompt_templates' should be a hash."
     end
 
     def validate_report_settings
-      report = @config["report"]
-      if report
-        unless report.is_a?(Hash)
-          puts "Warning: Config 'report' should be a hash."
-          return
-        end
-        if report.key?("output_path") && !report["output_path"].is_a?(String)
-          puts "Warning: Config 'report.output_path' should be a string."
-        end
-        if report.key?("html_template") && !report["html_template"].is_a?(String)
-          puts "Warning: Config 'report.html_template' should be a string."
-        end
+      report = @config['report']
+      return unless report
+
+      unless report.is_a?(Hash)
+        puts "Warning: Config 'report' should be a hash."
+        return
+      end
+      if report.key?('output_path') && !report['output_path'].is_a?(String)
+        puts "Warning: Config 'report.output_path' should be a string."
       end
+      return unless report.key?('html_template') && !report['html_template'].is_a?(String)
+
+      puts "Warning: Config 'report.html_template' should be a string."
     end
 
     def validate_static_analyser_settings
-      static_analysers = @config["static_analysers"]
-      if static_analysers
-        unless static_analysers.is_a?(Hash)
-          puts "Warning: Config 'static_analysers' should be a hash."
-          return
-        end
-        if static_analysers.key?("brakeman")
-          brakeman_config = static_analysers["brakeman"]
-          unless brakeman_config.is_a?(Hash)
-            puts "Warning: Config 'static_analysers.brakeman' should be a hash."
-          else
-            if brakeman_config.key?("options") && !brakeman_config["options"].is_a?(String)
-              puts "Warning: Config 'static_analysers.brakeman.options' should be a string."
-            end
+      static_analysers = @config['static_analysers']
+      return unless static_analysers
+
+      unless static_analysers.is_a?(Hash)
+        puts "Warning: Config 'static_analysers' should be a hash."
+        return
+      end
+      if static_analysers.key?('brakeman')
+        brakeman_config = static_analysers['brakeman']
+        if brakeman_config.is_a?(Hash)
+          if brakeman_config.key?('options') && !brakeman_config['options'].is_a?(String)
+            puts "Warning: Config 'static_analysers.brakeman.options' should be a string."
           end
+        else
+          puts "Warning: Config 'static_analysers.brakeman' should be a hash."
         end
-        if static_analysers.key?("bundler_audit")
-          bundler_audit_config = static_analysers["bundler_audit"]
-          unless bundler_audit_config.is_a?(Hash)
-            puts "Warning: Config 'static_analysers.bundler_audit' should be a hash."
-          else
-            if bundler_audit_config.key?("options") && !bundler_audit_config["options"].is_a?(String)
-              puts "Warning: Config 'static_analysers.bundler_audit.options' should be a string."
-            end
-          end
+      end
+      return unless static_analysers.key?('bundler_audit')
+
+      bundler_audit_config = static_analysers['bundler_audit']
+      if bundler_audit_config.is_a?(Hash)
+        if bundler_audit_config.key?('options') && !bundler_audit_config['options'].is_a?(String)
+          puts "Warning: Config 'static_analysers.bundler_audit.options' should be a string."
         end
+      else
+        puts "Warning: Config 'static_analysers.bundler_audit' should be a hash."
       end
     end
 
-
     def validate_ci_setup_settings
-      ci_setup = @config["ci_setup"]
-      if ci_setup
-        unless ci_setup.is_a?(Hash)
-          puts "Warning: Config 'ci_setup' should be a hash."
-          return
-        end
-        if ci_setup.key?("github_actions_path") && !ci_setup["github_actions_path"].is_a?(String)
-          puts "Warning: Config 'ci_setup.github_actions_path' should be a string."
-        end
-        if ci_setup.key?("gitlab_ci_path") && !ci_setup["gitlab_ci_path"].is_a?(String)
-          puts "Warning: Config 'ci_setup.gitlab_ci_path' should be a string."
-        end
+      ci_setup = @config['ci_setup']
+      return unless ci_setup
+
+      unless ci_setup.is_a?(Hash)
+        puts "Warning: Config 'ci_setup' should be a hash."
+        return
       end
+      if ci_setup.key?('github_actions_path') && !ci_setup['github_actions_path'].is_a?(String)
+        puts "Warning: Config 'ci_setup.github_actions_path' should be a string."
+      end
+      return unless ci_setup.key?('gitlab_ci_path') && !ci_setup['gitlab_ci_path'].is_a?(String)
+
+      puts "Warning: Config 'ci_setup.gitlab_ci_path' should be a string."
     end
 
     def validate_language
-      language = @config["language"]
-      if language && !language.is_a?(String)
-        puts "Warning: Config 'language' should be a string."
+      language = @config['language']
+      return unless language && !language.is_a?(String)
+
+      puts "Warning: Config 'language' should be a string."
+    end
+
+    # Load .omamoriignore file and return an array of ignore patterns
+    def load_ignore_patterns
+      ignore_path = DEFAULT_IGNORE_PATH
+      if File.exist?(ignore_path)
+        begin
+          File.readlines(ignore_path, chomp: true).reject do |line|
+            line.strip.empty? || line.strip.start_with?('#')
+          end
+        rescue StandardError => e
+          puts "Warning: Error reading .omamoriignore file #{ignore_path}: #{e.message}"
+          [] # Return empty array if reading fails
+        end
+      else
+        [] # Return empty array if file does not exist
       end
     end
 
@@ -141,4 +161,4 @@ module Omamori
       end
     end
   end
-end
+end