scryer 0.2.0 → 1.0.0

data/lib/scryer/dependency_audit.rb

@@ -1,4 +1,5 @@
 require "json"
+require "date"
 
 module Scryer
   # Dependency vulnerability + supply-chain-hygiene checks for Gemfile.lock —
@@ -55,15 +56,35 @@ module Scryer
       "LOW" => "info"
     }.freeze
 
+    # Ruby's own published maintenance-branch EOL dates
+    # (ruby-lang.org/en/downloads/branches/) — these are announced years in
+    # advance and essentially never move, unlike a CVE feed, so this is a
+    # one-time/occasional-update cost rather than an ongoing sync burden.
+    # Update when a new branch's EOL is announced, or an older branch not
+    # listed here needs adding.
+    RUBY_EOL_DATES = {
+      "2.5" => Date.new(2021, 3, 31),
+      "2.6" => Date.new(2022, 3, 31),
+      "2.7" => Date.new(2023, 3, 31),
+      "3.0" => Date.new(2024, 3, 31),
+      "3.1" => Date.new(2025, 3, 31),
+      "3.2" => Date.new(2026, 3, 31),
+      "3.3" => Date.new(2027, 3, 31),
+      "3.4" => Date.new(2028, 3, 31)
+    }.freeze
+
     class << self
-      # Parses a Gemfile.lock into `{ gems: { name => {version:, source:} }, git_or_path_sources: [...] }`.
-      # `source` is "gem", "git", or "path" — taken from which top-level
-      # block (GEM/GIT/PATH) the spec's `specs:` list appeared under.
+      # Parses a Gemfile.lock into `{ gems: { name => {version:, source:} },
+      # git_or_path_sources: [...], ruby_version: "3.3.3" | nil }`. `source`
+      # is "gem", "git", or "path" — taken from which top-level block
+      # (GEM/GIT/PATH) the spec's `specs:` list appeared under.
       def parse_lockfile(path)
         gems = {}
         git_or_path_sources = []
+        ruby_version = nil
 
-        current_block = nil # "gem" | "git" | "path" | other section name
+        current_block = nil # "gem" | "git" | "path" | nil (other section)
+        current_section = nil # PLATFORMS | DEPENDENCIES | BUNDLED WITH | RUBY VERSION | nil
         current_remote = nil
         in_specs = false
 
@@ -71,10 +92,12 @@ module Scryer
           case line
           when /\A(GEM|GIT|PATH)\s*\z/
             current_block = Regexp.last_match(1).downcase
+            current_section = nil
             current_remote = nil
             in_specs = false
           when /\A(PLATFORMS|DEPENDENCIES|BUNDLED WITH|RUBY VERSION)\s*\z/
             current_block = nil
+            current_section = Regexp.last_match(1)
             in_specs = false
           when /\A {2}remote:\s*(\S+)\s*\z/
             current_remote = Regexp.last_match(1)
@@ -90,10 +113,46 @@ module Scryer
             # in pathological Gemfiles; last one wins, consistent with how
             # Bundler itself resolves a single spec per gem name.
             gems[name] = { version: version, source: current_block }
+          when /\A\s*ruby\s+(\S+)\s*\z/
+            ruby_version = Regexp.last_match(1) if current_section == "RUBY VERSION"
           end
         end
 
-        { gems: gems, git_or_path_sources: git_or_path_sources }
+        { gems: gems, git_or_path_sources: git_or_path_sources, ruby_version: ruby_version }
+      end
+
+      # Offline. Flags the Ruby version pinned in Gemfile.lock's RUBY
+      # VERSION section if its minor series is past end-of-life — after that
+      # date Ruby publishes no more security patches for it, for any issue,
+      # so this is a real gap even with every gem otherwise up to date.
+      # Returns [] if no version is pinned, or its series isn't one
+      # RUBY_EOL_DATES knows about (never guessed as "fine" by omission).
+      def ruby_eol_check(root)
+        lockfile = File.join(root, "Gemfile.lock")
+        return [] unless File.exist?(lockfile)
+
+        ruby_version = parse_lockfile(lockfile)[:ruby_version]
+        return [] unless ruby_version
+
+        series = ruby_version[/\A\d+\.\d+/]
+        eol_date = series && RUBY_EOL_DATES[series]
+        return [] unless eol_date && Date.today > eol_date
+
+        [
+          Finding.new(
+            kind: "ruby_eol",
+            gem_name: "Ruby",
+            installed_version: ruby_version,
+            severity: "critical",
+            title: "Ruby #{series} is end-of-life",
+            url: "https://www.ruby-lang.org/en/downloads/branches/",
+            patched_versions: [],
+            message: "Ruby #{ruby_version} (#{series} series) reached end-of-life on " \
+                      "#{eol_date} — no security patches are published for it anymore, for any issue.",
+            suggested_fix: "Upgrade to a Ruby version still receiving security maintenance — see " \
+                            "https://www.ruby-lang.org/en/downloads/branches/ for current status."
+          )
+        ]
       end
 
       # Offline. Flags GIT/PATH sources recorded with an unencrypted remote
@@ -160,6 +219,41 @@ module Scryer
         findings
       end
 
+      # Offline. Flags `config/master.key` (the key that decrypts Rails
+      # encrypted credentials, config/credentials.yml.enc) if it exists on
+      # disk and .gitignore doesn't exclude it — Rails generates it
+      # gitignored by default (`/config/master.key`), but that line is easy
+      # to lose (a merge, a from-scratch .gitignore, copying the file into a
+      # repo that never had the Rails default). If this file is ever
+      # committed, anyone with repo access — including git history, even
+      # after a later removal — can decrypt every credential in
+      # config/credentials.yml.enc.
+      def credentials_exposure_check(root)
+        master_key_path = File.join(root, "config", "master.key")
+        return [] unless File.exist?(master_key_path)
+        return [] if master_key_gitignored?(root)
+
+        [
+          Finding.new(
+            kind: "credentials_exposure",
+            gem_name: "Rails",
+            severity: "critical",
+            title: "config/master.key is present and not gitignored",
+            url: "https://guides.rubyonrails.org/security.html",
+            patched_versions: [],
+            message: "config/master.key exists in this app, but .gitignore doesn't exclude it " \
+                      "(checked for both `/config/master.key` and `config/master.key`) — if this " \
+                      "file is ever committed, anyone with repository access, including git " \
+                      "history even after a later removal, can decrypt every credential in " \
+                      "config/credentials.yml.enc.",
+            suggested_fix: "Add `/config/master.key` to .gitignore immediately. If this key was " \
+                            "ever actually committed to git history, treat every credential in " \
+                            "config/credentials.yml.enc as compromised: rotate them and regenerate " \
+                            "the master key (delete both files, then `bin/rails credentials:edit`)."
+          )
+        ]
+      end
+
       # Needs network. One-off OSV.dev lookup for a single gem, independent
       # of any Gemfile.lock — backs `scryer --check-gem NAME[:VERSION]`.
       # With a version, only vulnerabilities affecting that exact version
@@ -171,6 +265,15 @@ module Scryer
 
       private
 
+      def master_key_gitignored?(root)
+        gitignore_path = File.join(root, ".gitignore")
+        return false unless File.exist?(gitignore_path)
+
+        File.foreach(gitignore_path).any? do |line|
+          line.strip.match?(%r{\A/?config/master\.key\z})
+        end
+      end
+
       def query_osv(name, version = nil)
         require "net/http"
         require "uri"

data/lib/scryer/report_renderer.rb

@@ -73,6 +73,18 @@ module Scryer
       rows.map { |row| row.map { |field| csv_field(field) }.join(",") }.join("\n")
     end
 
+    SARIF_LEVEL_BY_SEVERITY = { "critical" => "error", "warning" => "warning", "info" => "note" }.freeze
+
+    # SARIF 2.1.0 (docs.oasis-open.org/sarif/sarif/v2.1.0) — the format
+    # GitHub Code Scanning (and other CI security dashboards) natively
+    # ingest, turning findings into inline PR annotations and Security-tab
+    # entries instead of a report file nobody opens. Pure data mapping of
+    # what's already in as_hash — no new detection logic, and every finding
+    # behaves identically to how it does in the other formats.
+    def as_sarif
+      JSON.pretty_generate(sarif_hash)
+    end
+
     def as_html
       h = as_hash
       security = h["security_findings"]
@@ -353,7 +365,7 @@ module Scryer
           </div>
           <p>#{escape(f["message"])}</p>
           #{f["code_snippet"] ? "<pre>#{escape(f["code_snippet"])}</pre>" : ""}
-          <div class="fix"><strong>Suggested fix:</strong> #{escape(f["suggested_fix"])}</div>
+          <div class="fix"><strong>Suggested fix:</strong>#{render_markdown(f["suggested_fix"])}</div>
         </div>
       ROW
     end
@@ -408,7 +420,8 @@ module Scryer
     def render_dependency_finding(f)
       severity = f["severity"]
       heading = f["kind"] == "insecure_source" ? "Insecure gem source" : "#{escape(f["gem_name"])} #{escape(f["installed_version"])}"
-      advisory = f["advisory_id"] ? "<span class=\"loc\">#{escape(f["advisory_id"])}#{f["title"] ? " — #{escape(f["title"])}" : ""}</span>" : ""
+      advisory_text = [f["advisory_id"], f["title"]].compact.map { |t| escape(t) }.join(" — ")
+      advisory = advisory_text.empty? ? "" : "<span class=\"loc\">#{advisory_text}</span>"
       link = f["url"] ? " &middot; <a href=\"#{escape(f["url"])}\" target=\"_blank\" rel=\"noopener\">advisory</a>" : ""
       patched = Array(f["patched_versions"])
 
@@ -421,7 +434,7 @@ module Scryer
           </div>
           <p>#{escape(f["message"])}</p>
           #{patched.empty? ? "" : "<p class=\"loc\">Patched version(s): #{escape(patched.join(", "))}</p>"}
-          <div class="fix"><strong>Suggested fix:</strong> #{escape(f["suggested_fix"])}</div>
+          <div class="fix"><strong>Suggested fix:</strong>#{render_markdown(f["suggested_fix"])}</div>
         </div>
       ROW
     end
@@ -430,6 +443,48 @@ module Scryer
       text.to_s.gsub("&", "&amp;").gsub("<", "&lt;").gsub(">", "&gt;")
     end
 
+    CODE_FENCE = /```\w*\n?(.*?)```/m
+    BOLD = /\*\*(.+?)\*\*/
+    INLINE_CODE = /`([^`]+?)`/
+
+    # Suggested-fix text is always human-written prose, whether it came from
+    # a rule's static template (occasional inline `code`) or an LLM rewrite
+    # (often full Markdown: **bold**, ```fenced code```, paragraphs) — see
+    # AiFixSuggester's prompts, which explicitly ask for a
+    # "before/after code example". Rendering it as one plain escaped string
+    # left literal ** and ``` visible in the HTML report instead of actual
+    # formatting. This renders the handful of constructs those two sources
+    # actually produce; anything unrecognized just passes through as escaped
+    # text, same as before.
+    #
+    # Every code path here escapes raw text *before* adding any HTML tags of
+    # its own, so nothing in `text` (however untrusted — this may be verbatim
+    # LLM output) can inject markup; the only unescaped HTML is the literal
+    # tag strings this method writes itself.
+    def render_markdown(text)
+      return "" if text.nil?
+
+      html = +""
+      pos = 0
+      text.to_s.scan(CODE_FENCE) do
+        match = Regexp.last_match
+        html << render_prose(text[pos...match.begin(0)])
+        html << "<pre>#{escape(match[1].strip)}</pre>"
+        pos = match.end(0)
+      end
+      html << render_prose(text[pos..])
+      html
+    end
+
+    def render_prose(text)
+      return "" if text.nil? || text.strip.empty?
+
+      text.strip.split(/\n{2,}/).map do |paragraph|
+        formatted = escape(paragraph.strip).gsub(BOLD, '<strong>\1</strong>').gsub(INLINE_CODE, '<code>\1</code>')
+        "<p>#{formatted.gsub("\n", "<br>")}</p>"
+      end.join
+    end
+
     def static_csv_row(f)
       [
         f["category"], f["rule_id"], f["severity"],
@@ -439,7 +494,14 @@ module Scryer
     end
 
     def dependency_csv_row(f)
-      identifier = f["kind"] == "insecure_source" ? "insecure_source" : "#{f["gem_name"]} #{f["installed_version"]} (#{f["advisory_id"]})"
+      identifier =
+        if f["kind"] == "insecure_source"
+          "insecure_source"
+        elsif f["advisory_id"]
+          "#{f["gem_name"]} #{f["installed_version"]} (#{f["advisory_id"]})"
+        else
+          "#{f["gem_name"]} #{f["installed_version"]}"
+        end
       [f["kind"], identifier, f["severity"], "Gemfile.lock", f["message"], f["suggested_fix"], nil, f["url"]]
     end
 
@@ -448,6 +510,86 @@ module Scryer
       s.match?(/[",\n\r]/) ? "\"#{s.gsub('"', '""')}\"" : s
     end
 
+    # kind/title/severity for the three DependencyAudit finding kinds, which
+    # (unlike security/performance/style findings) aren't backed by a
+    # Scryer::Rule — described here just so SARIF's tool.driver.rules[]
+    # taxonomy has an entry for them too.
+    DEPENDENCY_SARIF_RULES = [
+      { "id" => "vulnerable_dependency", "title" => "Known-vulnerable gem version (OSV.dev)", "severity" => "critical" },
+      { "id" => "insecure_source", "title" => "Insecure (unencrypted) Gemfile.lock source", "severity" => "warning" },
+      { "id" => "ruby_eol", "title" => "Ruby version is end-of-life", "severity" => "critical" },
+      { "id" => "credentials_exposure", "title" => "config/master.key present and not gitignored", "severity" => "critical" }
+    ].freeze
+
+    def sarif_hash
+      h = as_hash
+      findings = h["security_findings"] + h["performance_findings"] + h["style_findings"]
+
+      {
+        "$schema" => "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+        "version" => "2.1.0",
+        "runs" => [
+          {
+            "tool" => {
+              "driver" => {
+                "name" => "Scryer",
+                "version" => Scryer::VERSION,
+                "informationUri" => "https://ramlaxmanyadav.github.io/scryer/",
+                "rules" => sarif_rules
+              }
+            },
+            "results" => findings.map { |f| sarif_result(f) } + h["dependency_findings"].map { |f| sarif_dependency_result(f) }
+          }
+        ]
+      }
+    end
+
+    def sarif_rules
+      rule_entries = Scryer::RuleSet.all.map do |rule|
+        {
+          "id" => rule.rule_id,
+          "name" => rule.rule_id,
+          "shortDescription" => { "text" => rule.title },
+          "defaultConfiguration" => { "level" => SARIF_LEVEL_BY_SEVERITY[rule.default_severity] || "warning" }
+        }
+      end
+
+      dependency_entries = DEPENDENCY_SARIF_RULES.map do |r|
+        {
+          "id" => r["id"],
+          "name" => r["id"],
+          "shortDescription" => { "text" => r["title"] },
+          "defaultConfiguration" => { "level" => SARIF_LEVEL_BY_SEVERITY[r["severity"]] || "warning" }
+        }
+      end
+
+      rule_entries + dependency_entries
+    end
+
+    def sarif_result(f)
+      physical_location = { "artifactLocation" => { "uri" => f["file"] } }
+      physical_location["region"] = { "startLine" => f["line"] } if f["line"]
+
+      {
+        "ruleId" => f["rule_id"],
+        "level" => SARIF_LEVEL_BY_SEVERITY[f["severity"]] || "warning",
+        "message" => { "text" => f["message"] },
+        "locations" => [{ "physicalLocation" => physical_location }]
+      }
+    end
+
+    # Dependency findings don't point at a line in app source — Gemfile.lock
+    # itself is the meaningful "location" (no region: nothing to underline
+    # inside it the way a code finding underlines a specific line).
+    def sarif_dependency_result(f)
+      {
+        "ruleId" => f["kind"],
+        "level" => SARIF_LEVEL_BY_SEVERITY[f["severity"]] || "warning",
+        "message" => { "text" => f["message"] },
+        "locations" => [{ "physicalLocation" => { "artifactLocation" => { "uri" => "Gemfile.lock" } } }]
+      }
+    end
+
     CSS = <<~CSS
       body { font-family: -apple-system, Helvetica, Arial, sans-serif; margin: 2rem; color: #1e293b; }
       h1 { margin-bottom: 0.25rem; }
@@ -474,7 +616,13 @@ module Scryer
       .badge.kind { background: #ede9fe; color: #5b21b6; }
       .loc { color: #64748b; font-size: 0.8rem; }
       pre { background: #0f172a; color: #e2e8f0; padding: 0.5rem 0.75rem; border-radius: 6px; overflow-x: auto; font-size: 0.8rem; }
+      code { background: #e2e8f0; color: #334155; padding: 0.1rem 0.35rem; border-radius: 4px; font-size: 0.85em; }
       .fix { background: #eef2ff; border-radius: 6px; padding: 0.5rem 0.75rem; font-size: 0.875rem; }
+      .fix > strong { display: block; margin-bottom: 0.35rem; }
+      .fix p { margin: 0 0 0.5rem; }
+      .fix p:last-child { margin-bottom: 0; }
+      .fix pre { margin: 0.5rem 0 0; }
+      .fix pre:last-child { margin-bottom: 0; }
       .dup-member { margin-top: 0.5rem; }
       .dup-member:first-child { margin-top: 0; }
       .muted { color: #94a3b8; }

data/lib/scryer/rules/action_cable_forgery_protection_rule.rb

@@ -0,0 +1,47 @@
+module Scryer
+  module Rules
+    # Flags `config.action_cable.disable_request_forgery_protection = true`
+    # — an explicit opt-out of Action Cable's default check that a
+    # WebSocket connection's request `Origin` header matches the app's own
+    # allowed origins, which otherwise blocks cross-site WebSocket hijacking.
+    # Same shape/reasoning as ForceSslRule: only the explicit opt-in to the
+    # insecure behavior is flagged, not its absence.
+    class ActionCableForgeryProtectionRule < Rule
+      self.rule_id = "action_cable_forgery_protection_disabled"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Action Cable request forgery protection explicitly disabled"
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :assign)
+
+          target = node[1]
+          next unless Ast.tagged?(target, :field)
+          next unless Ast.ident_text(target[3]) == "disable_request_forgery_protection"
+
+          value = node[2]
+          next unless Ast.true_literal?(value)
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`config.action_cable.disable_request_forgery_protection = true` explicitly " \
+                      "disables Action Cable's default check that a WebSocket connection's " \
+                      "`Origin` header matches an allowed origin — without it, another site can " \
+                      "open a WebSocket connection to this app in a visitor's browser and act as " \
+                      "that visitor (cross-site WebSocket hijacking).",
+            suggested_fix: "Remove this override and set `config.action_cable.allowed_request_origins` " \
+                            "to the app's real origin(s) instead, unless request forgery protection is " \
+                            "deliberately being handled some other way — if so, leave a comment " \
+                            "explaining that."
+          )
+        end
+
+        findings
+      end
+    end
+  end
+end

data/lib/scryer/rules/active_storage_inline_disposition_rule.rb

@@ -0,0 +1,47 @@
+module Scryer
+  module Rules
+    # Flags an explicit `disposition: "inline"`/`:inline` on a blob/variant
+    # URL helper (`rails_blob_path`, `rails_blob_url`, `url_for`, a
+    # `.variant(...)` chain). Serving user-uploaded content inline (rendered
+    # directly in the browser, rather than downloaded) can lead to stored
+    # XSS if the uploaded file's content-type isn't tightly restricted — an
+    # uploaded SVG or HTML file executes in the page's own origin.
+    class ActiveStorageInlineDispositionRule < Rule
+      self.rule_id = "active_storage_inline_disposition"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "Active Storage content served with inline disposition"
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          name_pair = Ast.call_name(inner)
+          next unless name_pair
+
+          args = Ast.call_arguments(node)
+          disposition = Ast.keyword_arg(args, "disposition")
+          next unless disposition && Ast.literal_text(disposition) == "inline"
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`disposition: \"inline\"` renders this attachment's content directly in " \
+                      "the browser instead of downloading it — if the attachment's content-type " \
+                      "isn't tightly restricted, a user-uploaded SVG or HTML file served this way " \
+                      "executes as if it were part of the site.",
+            suggested_fix: "Prefer the default `disposition: \"attachment\"` (or drop the option " \
+                            "entirely) unless inline rendering is genuinely required — and if it " \
+                            "is, make sure the attachment has a strict `content_type:` allowlist " \
+                            "(e.g. image types only) so nothing executable can reach this code path."
+          )
+        end
+
+        findings
+      end
+    end
+  end
+end

data/lib/scryer/rules/active_storage_missing_content_type_validation_rule.rb

@@ -0,0 +1,76 @@
+module Scryer
+  module Rules
+    # Flags `has_one_attached`/`has_many_attached :name` with no
+    # `validates :name, content_type: [...]` anywhere in the same class —
+    # without a content-type allowlist, a user can upload anything (an SVG
+    # or HTML file that executes script when served, an executable, ...),
+    # not just the file type the feature was built for.
+    class ActiveStorageMissingContentTypeValidationRule < Rule
+      self.rule_id = "active_storage_missing_content_type_validation"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "Active Storage attachment without a content-type validation"
+
+      ATTACHMENT_METHODS = %w[has_one_attached has_many_attached].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :class)
+
+          body = node[3]
+          validated_names = each_content_type_validated_names(body)
+
+          each_attachment(body).each do |call_node, name|
+            next if validated_names.include?(name)
+
+            line = Ast.line_of(call_node)
+            findings << finding(
+              line: line,
+              message: "`:#{name}` is attached via Active Storage with no `content_type:` " \
+                        "validation anywhere in this class — any file type can be uploaded, " \
+                        "including ones that execute in a browser if ever served back (e.g. SVG, " \
+                        "HTML) or aren't safe to store at all.",
+              suggested_fix: "Add an explicit allowlist: `validates :#{name}, content_type: " \
+                              "['image/png', 'image/jpeg']` (whatever types this feature actually " \
+                              "needs) so anything else is rejected at upload time."
+            )
+          end
+        end
+
+        findings
+      end
+
+      private
+
+      def each_attachment(body)
+        Ast.each_node(body).filter_map do |n|
+          next unless Ast.tagged?(n, :command, :command_call, :method_add_arg)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          name_pair = Ast.call_name(inner)
+          next unless name_pair && ATTACHMENT_METHODS.include?(name_pair[1])
+
+          name = Ast.call_arguments(n).filter_map { |a| Ast.literal_text(a) }.first
+          [n, name] if name
+        end
+      end
+
+      def each_content_type_validated_names(body)
+        Ast.each_node(body).filter_map do |n|
+          next unless Ast.tagged?(n, :command, :command_call, :method_add_arg)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          name_pair = Ast.call_name(inner)
+          next unless name_pair && name_pair[1] == "validates"
+
+          args = Ast.call_arguments(n)
+          next unless Ast.keyword_arg(args, "content_type")
+
+          Ast.literal_text(args.first)
+        end
+      end
+    end
+  end
+end

data/lib/scryer/rules/authentication_bypass_rule.rb

@@ -0,0 +1,72 @@
+module Scryer
+  module Rules
+    # Flags a controller class that calls `skip_before_action`/
+    # `skip_action_callback` naming a common authentication filter
+    # (`authenticate_user!`, `authenticate!`, ...) — same shape and reasoning
+    # as CsrfProtectionRule, just for auth filters instead of CSRF: skipping
+    # one is sometimes correct (a public endpoint, a webhook) but is also a
+    # common way to accidentally leave an action reachable without login,
+    # especially with a broad `except:`/no scoping at all.
+    class AuthenticationBypassRule < Rule
+      self.rule_id = "authentication_bypass"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "Authentication filter explicitly skipped"
+
+      SKIP_METHODS = %w[skip_before_action skip_action_callback skip_before_filter].freeze
+      AUTH_FILTER_NAMES = %w[
+        authenticate_user! authenticate! authenticate_admin! authenticate_account!
+        require_login require_authentication authorize_request
+      ].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :class)
+
+          class_name = Ast.ident_text(node[1].is_a?(Array) ? node[1][1] : nil)
+          next unless class_name.to_s.end_with?("Controller")
+
+          each_skip_call(node[3]).each do |skip_node, filter_name|
+            line = Ast.line_of(skip_node)
+            findings << finding(
+              line: line,
+              message: "`#{class_name}` skips the `#{filter_name}` authentication filter " \
+                        "(`#{skip_call_method(skip_node)} :#{filter_name}`) — every action this " \
+                        "applies to is reachable without logging in unless something else in " \
+                        "this controller re-checks authentication.",
+              suggested_fix: "If this is genuinely a public action (a webhook, a login/signup " \
+                              "page), scope the skip tightly with `only: [:action_name]` rather " \
+                              "than leaving it unscoped or using a broad `except:`. If it's not " \
+                              "meant to be public, remove the skip."
+            )
+          end
+        end
+
+        findings
+      end
+
+      private
+
+      def each_skip_call(body)
+        Ast.each_node(body).filter_map do |n|
+          next unless Ast.tagged?(n, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          name_pair = Ast.call_name(inner)
+          next unless name_pair && SKIP_METHODS.include?(name_pair[1])
+
+          args = Ast.call_arguments(n)
+          filter_name = args.filter_map { |a| Ast.literal_text(a) }.find { |v| AUTH_FILTER_NAMES.include?(v) }
+          [n, filter_name] if filter_name
+        end
+      end
+
+      def skip_call_method(node)
+        inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+        Ast.call_name(inner)&.last
+      end
+    end
+  end
+end