scryer 0.3.0 → 1.1.1

data/lib/tasks/scryer.rake

@@ -8,7 +8,7 @@ require "fileutils"
 # ActiveSupport methods (`.presence`/`.blank?`) for the same reason — plain
 # Ruby nil-or-empty checks only.
 namespace :scryer do
-  desc "Run Scryer and write a report. Args are any mix of json/html/csv (which formats " \
+  desc "Run Scryer and write a report. Args are any mix of json/html/csv/sarif (which formats " \
        "to write — default json,html), the token 'nodeps' (skip the dependency audit — OSV.dev " \
        "vulnerable gems + insecure git/http sources — that otherwise runs by default; use for a " \
        "fast, fully offline run), plus at most one path (a directory when writing more than one " \
@@ -16,7 +16,9 @@ namespace :scryer do
        "so pass each token as its own item rather than one comma-joined string. " \
        "e.g. rails scryer:report, rails 'scryer:report[html]', " \
        "rails 'scryer:report[json,doc/security.json]', rails 'scryer:report[json,html]', " \
-       "rails 'scryer:report[html,nodeps]', rails 'scryer:report[csv]'"
+       "rails 'scryer:report[html,nodeps]', rails 'scryer:report[csv]', rails 'scryer:report[sarif]'. " \
+       "Set SCRYER_BASELINE=PATH (an env var, not a bracket arg — see scryer:save_baseline) to " \
+       "report only findings new since that baseline was saved."
   task :report, [:format] do |_, args|
     root = defined?(Rails) ? Rails.root.to_s : Dir.pwd
     dirs = Scryer.configuration.dirs
@@ -38,12 +40,27 @@ namespace :scryer do
     dependency_findings = []
     if run_deps
       puts "Scryer: querying OSV.dev for known-vulnerable gems (needs network)..."
-      dependency_findings = Scryer::DependencyAudit.insecure_sources(root) + Scryer::DependencyAudit.vulnerable_gems(root)
+      dependency_findings = Scryer::DependencyAudit.insecure_sources(root) + Scryer::DependencyAudit.vulnerable_gems(root) +
+                             Scryer::DependencyAudit.ruby_eol_check(root) + Scryer::DependencyAudit.credentials_exposure_check(root)
+    end
+
+    # Rake bracket args are already stretched thin (format tokens + nodeps +
+    # one output path) — an ENV var is the more conventional way Rails rake
+    # tasks take an extra config value without overloading positional args
+    # further. `rails 'scryer:save_baseline[tmp/scryer_baseline.json]'` writes
+    # one; `SCRYER_BASELINE=tmp/scryer_baseline.json rails scryer:report`
+    # reads it back. See Scryer::Baseline / the CLI's --baseline flag for
+    # what this actually does (fingerprint-based new-vs-fixed diffing, not
+    # tied to line number).
+    baseline_path = blank_to_nil(ENV["SCRYER_BASELINE"])
+    fixed_count = 0
+    if baseline_path
+      dependency_findings, fixed_count = ScryerTasks.apply_baseline(baseline_path, result, dependency_findings)
     end
 
     if Scryer.configuration.ai_client
       puts "Scryer: rewriting suggested fixes via the configured AI client..."
-      Scryer::AiFixSuggester.enhance_result!(result)
+      Scryer::AiFixSuggester.enhance_result!(result, root: root)
       Scryer::AiFixSuggester.enhance_many!(dependency_findings) unless dependency_findings.empty?
     end
 
@@ -63,12 +80,14 @@ namespace :scryer do
       content = case format
                 when "json" then renderer.as_json
                 when "csv" then renderer.as_csv
+                when "sarif" then renderer.as_sarif
                 else renderer.as_html
                 end
       File.write(path, content)
     end
 
-    ScryerTasks.print_summary(result: result, dependency_findings: dependency_findings, ran_deps: run_deps, paths: paths)
+    ScryerTasks.print_summary(result: result, dependency_findings: dependency_findings, ran_deps: run_deps, paths: paths,
+                               renderer: renderer, fixed_count: fixed_count, baseline_path: baseline_path)
 
     # Same gate as the `scryer` executable and scryer:audit_dependencies
     # below: fail the task (and so the CI job running it) on any security or
@@ -81,6 +100,37 @@ namespace :scryer do
     end
   end
 
+  desc "Convenience wrapper for CI: runs scryer:report with CI-sensible defaults — JSON + " \
+       "SARIF written under tmp/ (SARIF for GitHub Code Scanning / similar dashboards, JSON as " \
+       "the machine-readable form other CI steps can parse), dependency audit on, same " \
+       "SCRYER_BASELINE support and same fail-the-build-on-findings behavior as scryer:report. " \
+       "Equivalent to `rails 'scryer:report[json,sarif]'` under a name that doesn't require " \
+       "remembering the bracket-arg syntax. e.g. rails scryer:ci"
+  task :ci do
+    Rake::Task["scryer:report"].invoke("json", "sarif")
+  end
+
+  desc "Run Scryer and save every finding's fingerprint to PATH, for later comparison via " \
+       "SCRYER_BASELINE=PATH rails scryer:report (see that task's SCRYER_BASELINE note). " \
+       "Runs the same scan as scryer:report (including the dependency audit) but writes no " \
+       "report files. e.g. rails 'scryer:save_baseline[tmp/scryer_baseline.json]'"
+  task :save_baseline, [:path] do |_, args|
+    path = args[:path] || abort("Scryer: scryer:save_baseline needs a path, " \
+                                 "e.g. rails 'scryer:save_baseline[tmp/scryer_baseline.json]'")
+    root = defined?(Rails) ? Rails.root.to_s : Dir.pwd
+    dirs = Scryer.configuration.dirs
+
+    result = Scryer::Scanner.new(root: root, dirs: dirs, skip_rules: Scryer.configuration.skip_rules).call
+    puts "Scryer: querying OSV.dev for known-vulnerable gems (needs network)..."
+    dependency_findings = Scryer::DependencyAudit.insecure_sources(root) + Scryer::DependencyAudit.vulnerable_gems(root) +
+                           Scryer::DependencyAudit.ruby_eol_check(root) + Scryer::DependencyAudit.credentials_exposure_check(root)
+
+    all_findings = (result.security_findings + result.performance_findings + result.style_findings).map(&:to_h) +
+                   dependency_findings.map(&:to_h)
+    Scryer::Baseline.save(path, all_findings)
+    puts "Scryer: saved baseline of #{all_findings.size} finding(s) to #{path}."
+  end
+
   desc "Check Gemfile.lock for known-vulnerable gem versions (via OSV.dev — needs network) " \
        "and insecure git/http gem sources (offline). Exits non-zero if anything is found, so " \
        "this can gate CI the same way `bundle-audit check` does."
@@ -92,20 +142,23 @@ namespace :scryer do
 
     puts "Scryer: querying OSV.dev for known vulnerabilities (needs network)..."
     vulnerable = Scryer::DependencyAudit.vulnerable_gems(root)
+    ruby_eol = Scryer::DependencyAudit.ruby_eol_check(root)
+    credentials_exposure = Scryer::DependencyAudit.credentials_exposure_check(root)
 
-    (insecure + vulnerable).each do |f|
-      label = f.kind == "insecure_source" ? "[#{f.severity.upcase}] #{f.message}" : "[#{f.severity.upcase}] #{f.gem_name} #{f.installed_version} - #{f.advisory_id}: #{f.title}"
-      puts label
+    (insecure + vulnerable + ruby_eol + credentials_exposure).each do |f|
+      puts "[#{f.severity.upcase}] #{ScryerTasks.dependency_label(f)}"
       puts "  fix: #{f.suggested_fix}"
     end
 
-    total = insecure.size + vulnerable.size
-    puts "\nScryer: #{total} dependency finding(s) (#{insecure.size} insecure source, #{vulnerable.size} vulnerable gem)."
+    total = insecure.size + vulnerable.size + ruby_eol.size + credentials_exposure.size
+    puts "\nScryer: #{total} dependency finding(s) (#{insecure.size} insecure source, " \
+         "#{vulnerable.size} vulnerable gem, #{ruby_eol.size} Ruby EOL, " \
+         "#{credentials_exposure.size} credentials exposure)."
     abort("Scryer: dependency audit failed.") if total.positive?
   end
 
-  VALID_FORMATS = %w[json html csv].freeze
-  EXTENSION_FOR_FORMAT = { "json" => "json", "html" => "html", "csv" => "csv" }.freeze
+  VALID_FORMATS = %w[json html csv sarif].freeze
+  EXTENSION_FOR_FORMAT = { "json" => "json", "html" => "html", "csv" => "csv", "sarif" => "sarif" }.freeze
   NO_DEPS_TOKEN = "nodeps".freeze
 
   # tokens is every bracket arg Rake was given, e.g. %w[json doc/security.json] or
@@ -178,11 +231,47 @@ module ScryerTasks
     nil
   end
 
+  def dependency_label(f)
+    return f.message if f.kind == "insecure_source"
+    return "#{f.gem_name} #{f.installed_version} - #{f.advisory_id}: #{f.title}" if f.advisory_id
+
+    "#{f.gem_name} #{f.installed_version}: #{f.title}"
+  end
+
+  # Same logic as Scryer::CLI#apply_baseline (see that method's comment for
+  # why fixed_count has to be computed once against the combined set of
+  # every category's current fingerprints, not once per category summed).
+  def apply_baseline(path, result, dependency_findings)
+    baseline_fingerprints = Scryer::Baseline.load(path)
+
+    security_hashes = result.security_findings.map(&:to_h)
+    performance_hashes = result.performance_findings.map(&:to_h)
+    style_hashes = result.style_findings.map(&:to_h)
+    dependency_hashes = dependency_findings.map(&:to_h)
+
+    all_current_fingerprints = Scryer::Baseline.fingerprints(security_hashes + performance_hashes + style_hashes + dependency_hashes)
+    fixed_count = (baseline_fingerprints - all_current_fingerprints.to_set).size
+
+    result.security_findings = filter_new(result.security_findings, security_hashes, baseline_fingerprints)
+    result.performance_findings = filter_new(result.performance_findings, performance_hashes, baseline_fingerprints)
+    result.style_findings = filter_new(result.style_findings, style_hashes, baseline_fingerprints)
+    filtered_deps = filter_new(dependency_findings, dependency_hashes, baseline_fingerprints)
+
+    [filtered_deps, fixed_count]
+  rescue Scryer::Baseline::LoadError => e
+    abort("Scryer: #{e.message}")
+  end
+
+  def filter_new(objects, hashes, baseline_fingerprints)
+    fingerprints = Scryer::Baseline.fingerprints(hashes)
+    objects.each_with_index.reject { |_, i| baseline_fingerprints.include?(fingerprints[i]) }.map(&:first)
+  end
+
   # The "one audit command" summary — a single scan's worth of every
   # category Scryer covers (security, performance, duplicate/smelly code,
   # dependencies), the same categories usually split across RuboCop +
   # Brakeman + bundler-audit + Reek, side by side in one box.
-  def print_summary(result:, dependency_findings:, ran_deps:, paths:)
+  def print_summary(result:, dependency_findings:, ran_deps:, paths:, renderer:, fixed_count: 0, baseline_path: nil)
     # "Code Quality" is the umbrella label for both duplicate-code groups
     # and rule-based style findings (e.g. frozen_string_literal) — two
     # different detectors, same broad concern, one row in the box.
@@ -198,14 +287,25 @@ module ScryerTasks
     ]
 
     divider = "─" * 32
+    score = renderer.security_score
     puts ""
     puts "Scryer Audit — #{result.files_scanned} files scanned"
     puts divider
     puts ""
+    if baseline_path
+      puts "Baseline: #{baseline_path} — showing new findings only (#{fixed_count} fixed since baseline)."
+      puts ""
+    end
+    clean_rate = renderer.rules_clean_rate
+    puts "Security Score: #{score["score"]}/100 (#{score["grade"]})"
+    puts "Checks: #{clean_rate["clean"]}/#{clean_rate["total"]} rules clean (#{clean_rate["percent"]}%)"
+    puts ""
     rows.each { |label, count| puts summary_row(label, count) }
     puts divider
     puts summary_row("Total", total)
     puts ""
+    print_top_priorities(renderer.top_risks)
+    print_owasp_coverage(renderer.owasp_coverage)
     paths.each { |format, path| puts "#{format.upcase} report: #{path}" }
   end
 
@@ -213,4 +313,29 @@ module ScryerTasks
     value = count.nil? ? "skipped (nodeps)" : "#{count} finding#{"s" unless count == 1}"
     "#{label.ljust(14)}#{value.rjust(20)}"
   end
+
+  # The categories above are counted separately, but nothing else ranks
+  # across them — this is what actually backs "tells you what to fix
+  # first" rather than just splitting findings into four buckets. Same
+  # data ReportRenderer#top_risks already sorts for the HTML report.
+  def print_top_priorities(risks)
+    return if risks.empty?
+
+    puts "Top priorities:"
+    risks.each_with_index do |r, i|
+      puts "  #{i + 1}. [#{r[:severity]}] #{r[:category]} — #{r[:label]} (#{r[:location]})"
+    end
+    puts ""
+  end
+
+  # Byproduct of every security rule carrying an owasp_category — see
+  # ReportRenderer#owasp_coverage. Scryer's own best-effort tagging, not an
+  # OWASP-audited mapping (documented in full in the README).
+  def print_owasp_coverage(coverage)
+    return if coverage.empty?
+
+    puts "OWASP Top 10 (2021) coverage:"
+    coverage.each { |category, count| puts "  #{category}: #{count} finding#{"s" unless count == 1}" }
+    puts ""
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: scryer
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 1.1.1
 platform: ruby
 authors:
 - Ram Laxman Yadav
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-08-11 00:00:00.000000000 Z
+date: 2026-08-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -25,18 +25,21 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '13.0'
 description: |
-  One scan, one report: security, performance, duplicate-code, and dependency audits for Ruby
-  and Rails — the ground Brakeman, bundler-audit, Reek, and custom glue scripts usually split
-  between them, covered by a single `scryer` command. (Style/lint is RuboCop's job — Scryer
-  doesn't touch that.)
+  Scryer scans a Ruby/Rails codebase for security vulnerabilities, performance problems,
+  dependency risk, and code-quality issues, then ranks everything it finds by severity across
+  all of those categories — so a scan ends with one answer to "what's most worth fixing," not
+  four separate reports to reconcile by hand. (Style/lint is RuboCop's job — Scryer doesn't
+  touch that, except one narrow check.)
 
-  Detects SQL injection, mass assignment, hardcoded secrets, XSS, weak crypto, and more; N+1
-  queries, missing pagination, and other performance heuristics; near-duplicate code; and
-  known-vulnerable gems via a live OSV.dev dependency audit — on by default, every run.
+  Detects SQL injection, mass assignment, SSRF, path traversal, IDOR, insecure JWT/CORS/session
+  config, hardcoded secrets, XSS, weak crypto, and more; N+1 queries, missing pagination, and
+  other performance heuristics; near-duplicate code; and known-vulnerable gems via a live
+  OSV.dev dependency audit — on by default, every run.
 
   Every finding includes a human-reviewable suggested fix — never auto-applied, optionally
   rewritten against your actual code by any LLM you configure. Reports in JSON, self-contained
-  HTML, or CSV. Zero runtime dependencies beyond Ruby's own stdlib.
+  HTML, CSV, or SARIF (for GitHub Code Scanning). Zero runtime dependencies beyond Ruby's own
+  stdlib.
 email:
 executables:
 - scryer
@@ -54,12 +57,16 @@ files:
 - lib/scryer/ai_client.rb
 - lib/scryer/ai_fix_suggester.rb
 - lib/scryer/ast.rb
+- lib/scryer/authorization_watcher.rb
+- lib/scryer/baseline.rb
 - lib/scryer/cache_extractor.rb
 - lib/scryer/cli.rb
 - lib/scryer/dependency_audit.rb
 - lib/scryer/duplicate_detector.rb
 - lib/scryer/finding.rb
+- lib/scryer/fix_verifier.rb
 - lib/scryer/method_extractor.rb
+- lib/scryer/minitest.rb
 - lib/scryer/performance_rules/inefficient_save_loop_rule.rb
 - lib/scryer/performance_rules/missing_pagination_rule.rb
 - lib/scryer/performance_rules/n_plus_one_query_rule.rb
@@ -68,16 +75,39 @@ files:
 - lib/scryer/query_watcher.rb
 - lib/scryer/railtie.rb
 - lib/scryer/report_renderer.rb
+- lib/scryer/rspec.rb
 - lib/scryer/rule.rb
 - lib/scryer/rule_set.rb
+- lib/scryer/rules/action_cable_forgery_protection_rule.rb
+- lib/scryer/rules/active_storage_inline_disposition_rule.rb
+- lib/scryer/rules/active_storage_missing_content_type_validation_rule.rb
+- lib/scryer/rules/authentication_bypass_rule.rb
 - lib/scryer/rules/command_injection_rule.rb
+- lib/scryer/rules/consider_all_requests_local_rule.rb
+- lib/scryer/rules/cors_misconfiguration_rule.rb
 - lib/scryer/rules/csrf_protection_rule.rb
+- lib/scryer/rules/force_ssl_rule.rb
+- lib/scryer/rules/graphql_missing_query_limits_rule.rb
+- lib/scryer/rules/hardcoded_basic_auth_rule.rb
+- lib/scryer/rules/hardcoded_secret_key_base_rule.rb
 - lib/scryer/rules/hardcoded_secret_rule.rb
+- lib/scryer/rules/host_authorization_disabled_rule.rb
+- lib/scryer/rules/idor_rule.rb
+- lib/scryer/rules/insecure_cookie_serializer_rule.rb
+- lib/scryer/rules/job_raw_params_rule.rb
+- lib/scryer/rules/jwt_insecure_rule.rb
 - lib/scryer/rules/mass_assignment_rule.rb
+- lib/scryer/rules/missing_authorization_rule.rb
+- lib/scryer/rules/missing_policy_scope_rule.rb
 - lib/scryer/rules/open_redirect_rule.rb
+- lib/scryer/rules/path_traversal_rule.rb
+- lib/scryer/rules/security_headers_rule.rb
 - lib/scryer/rules/sql_injection_rule.rb
+- lib/scryer/rules/ssrf_rule.rb
 - lib/scryer/rules/unsafe_deserialization_rule.rb
+- lib/scryer/rules/verbose_production_log_level_rule.rb
 - lib/scryer/rules/weak_crypto_rule.rb
+- lib/scryer/rules/weak_session_cookie_rule.rb
 - lib/scryer/rules/xss_unsafe_html_rule.rb
 - lib/scryer/scanner.rb
 - lib/scryer/style_rules/frozen_string_literal_rule.rb
@@ -110,6 +140,5 @@ requirements: []
 rubygems_version: 3.5.11
 signing_key:
 specification_version: 4
-summary: Ruby/Rails security & quality auditor — one command instead of Brakeman +
-  bundler-audit + Reek.
+summary: Ruby/Rails application security & risk auditor — tells you what to fix first.
 test_files: []