scryer 1.0.0 → 1.1.1

data/lib/scryer/rules/ssrf_rule.rb

@@ -11,6 +11,9 @@ module Scryer
       self.category = "security"
       self.default_severity = "critical"
       self.title = "Possible server-side request forgery (SSRF)"
+      self.cwe = "CWE-918"
+      self.owasp_category = "A10:2021-Server-Side Request Forgery"
+      self.confidence = "medium"
 
       DANGEROUS_CALLS = {
         "Net::HTTP" => %w[get get_response post post_form],
@@ -34,21 +37,40 @@ module Scryer
           next unless dangerous_call?(receiver, method_name)
 
           args = Ast.call_arguments(node)
-          next unless args.any? { |a| Ast.references_params?(a) }
+          matched_arg = args.find { |a| Ast.references_params?(a) }
+          next unless matched_arg
 
           line = Ast.line_of(node)
-          findings << finding(
-            line: line,
-            message: "`#{describe_call(receiver, method_name)}` is called with a URL/argument " \
-                      "that references `params` — the server can be made to issue a request to " \
-                      "any host an attacker chooses, including internal services and cloud " \
-                      "metadata endpoints (e.g. `169.254.169.254`) that aren't meant to be " \
-                      "reachable from outside.",
-            suggested_fix: "Validate the destination against an allowlist of known-safe hosts " \
-                            "before making the request, rather than passing the user-supplied " \
-                            "value straight through — and reject internal/link-local IP ranges " \
-                            "explicitly if the allowlist is host-based (DNS can still resolve to one)."
-          )
+          if (fixed_host = fixed_host_with_dynamic_path(matched_arg))
+            findings << finding(
+              line: line,
+              severity: "warning",
+              message: "`#{describe_call(receiver, method_name)}` is called with a URL whose host " \
+                        "(`#{fixed_host}`) is a fixed literal — only a path/query segment is " \
+                        "`params`-derived, so this can't redirect the request to an arbitrary " \
+                        "attacker-chosen host the way a fully dynamic URL could. Still worth a " \
+                        "look: a params-derived path segment can enumerate/probe endpoints on " \
+                        "that fixed host, or (if the target app doesn't validate it either) reach " \
+                        "unintended paths there.",
+              suggested_fix: "If the path segment is meant to be one of a known set of values " \
+                              "(an id, an enum), validate/allowlist it rather than interpolating " \
+                              "`params` straight into the URL — a stray `/` or `..` segment can " \
+                              "still change which path on #{fixed_host} gets requested."
+            )
+          else
+            findings << finding(
+              line: line,
+              message: "`#{describe_call(receiver, method_name)}` is called with a URL/argument " \
+                        "that references `params` — the server can be made to issue a request to " \
+                        "any host an attacker chooses, including internal services and cloud " \
+                        "metadata endpoints (e.g. `169.254.169.254`) that aren't meant to be " \
+                        "reachable from outside.",
+              suggested_fix: "Validate the destination against an allowlist of known-safe hosts " \
+                              "before making the request, rather than passing the user-supplied " \
+                              "value straight through — and reject internal/link-local IP ranges " \
+                              "explicitly if the allowlist is host-based (DNS can still resolve to one)."
+            )
+          end
         end
 
         findings
@@ -67,6 +89,38 @@ module Scryer
         name ? "#{name}.#{method_name}" : method_name
       end
 
+      # A URL's host is fully attacker-controlled the moment `params` reaches
+      # any part of it — but a `params` reference confined to the *path* of
+      # an otherwise-literal URL (`"https://api.example.com/users/#{params[:id]}"`)
+      # can't redirect the request to a different host at all, which is the
+      # actual SSRF risk (reaching internal services / cloud metadata
+      # endpoints). Distinguishing the two isn't possible in general — a URL
+      # built via string concatenation, a helper method, `URI.join`, or a
+      # variable can put `params` anywhere including the host, and this rule
+      # has no way to trace that. This only recognizes the one shape where
+      # it's unambiguous: a direct string_literal argument whose *first*
+      # literal chunk (everything before the first interpolation) already
+      # spells out a complete `scheme://host/` — meaning every `params`
+      # reference in the string necessarily lands after that fixed host, in
+      # the path/query. Returns the literal host text for the message, or
+      # nil if this argument doesn't match that exact shape (in which case
+      # the call is treated with full SSRF severity, same as before this
+      # existed — this only *adds* a more precise, lower-severity message
+      # for the case that's provably narrower, it never suppresses the
+      # finding).
+      def fixed_host_with_dynamic_path(node)
+        return nil unless Ast.tagged?(node, :string_literal)
+
+        content = node[1]
+        return nil unless Ast.tagged?(content, :string_content)
+
+        first_chunk = content[1]
+        return nil unless Ast.tagged?(first_chunk, :@tstring_content)
+
+        match = /\A(https?:\/\/[^\/\s{}]+)\//.match(first_chunk[1])
+        match && match[1]
+      end
+
       # Textual name of a (possibly namespaced) constant receiver —
       # "URI" for `[:var_ref, [:@const, "URI", pos]]`, "Net::HTTP" for the
       # `[:const_path_ref, ...]` chain `Net::HTTP` parses into. nil for

data/lib/scryer/rules/unsafe_deserialization_rule.rb

@@ -9,6 +9,9 @@ module Scryer
       self.category = "security"
       self.default_severity = "critical"
       self.title = "Unsafe deserialization of untrusted data"
+      self.cwe = "CWE-502"
+      self.owasp_category = "A08:2021-Software and Data Integrity Failures"
+      self.confidence = "high"
 
       UNSAFE_CALLS = {
         %w[Marshal load] => "Marshal.load can instantiate arbitrary Ruby objects, including ones " \

data/lib/scryer/rules/verbose_production_log_level_rule.rb

@@ -0,0 +1,53 @@
+module Scryer
+  module Rules
+    # Flags `config.log_level = :debug` specifically in
+    # config/environments/production.rb. Debug-level Rails logging can write
+    # full request parameters (including anything not filtered by
+    # `config.filter_parameters`) and raw SQL bind values to the production
+    # log — wherever that log ends up (a shared file, a log-aggregation
+    # service), that's a broader-than-intended audience for potentially
+    # sensitive data. `:debug` is Rails' own default in development.rb, so
+    # it's only flagged in production.rb; other levels (`:info`, `:warn`)
+    # aren't flagged at all — those don't carry this risk.
+    class VerboseProductionLogLevelRule < Rule
+      self.rule_id = "verbose_production_log_level"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "Debug-level logging enabled in production"
+      self.cwe = "CWE-532"
+      self.owasp_category = "A09:2021-Security Logging and Monitoring Failures"
+      self.confidence = "medium"
+
+      PRODUCTION_ENV_FILE = "config/environments/production.rb"
+
+      def scan
+        return [] unless file.to_s.end_with?(PRODUCTION_ENV_FILE)
+
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :assign)
+
+          target = node[1]
+          next unless Ast.tagged?(target, :field)
+          next unless Ast.ident_text(target[3]) == "log_level"
+          next unless Ast.literal_text(node[2]) == "debug"
+
+          findings << finding(
+            line: Ast.line_of(node),
+            message: "`config.log_level = :debug` in #{PRODUCTION_ENV_FILE} logs full request " \
+                      "parameters and raw SQL bind values in production — anything not covered " \
+                      "by `config.filter_parameters` (e.g. a param name added after that list was " \
+                      "last updated) ends up in the log verbatim.",
+            suggested_fix: "Use `:info` (Rails' own production default) or higher in production, " \
+                            "and confirm `config.filter_parameters` covers every sensitive param " \
+                            "name this app actually receives if verbose logging is genuinely needed " \
+                            "for debugging."
+          )
+        end
+
+        findings
+      end
+    end
+  end
+end

data/lib/scryer/rules/weak_crypto_rule.rb

@@ -11,9 +11,21 @@ module Scryer
       self.category = "security"
       self.default_severity = "warning"
       self.title = "Weak hash algorithm used for password/credential hashing"
+      self.cwe = "CWE-327"
+      self.owasp_category = "A02:2021-Cryptographic Failures"
+      self.confidence = "medium"
 
       WEAK_DIGESTS = %w[MD5 SHA1].freeze
-      PASSWORD_HINT = /password|passwd|credential/i.freeze
+
+      # `(?!less)` after "password" excludes "passwordless" (and
+      # "passwordlessly") specifically — a real identifier that means the
+      # *opposite* of what this heuristic is looking for (e.g. a magic-link
+      # or passwordless-auth token, `Digest::SHA1.hexdigest(passwordless_token)`),
+      # not a credential. It doesn't affect any legitimate match: every other
+      # "password"-containing identifier this heuristic cares about
+      # (`password`, `user_password`, `password_reset_token`, `hashed_password`,
+      # ...) is never immediately followed by the literal substring "less".
+      PASSWORD_HINT = /password(?!less)|passwd|credential/i.freeze
 
       def scan
         findings = []
@@ -29,7 +41,7 @@ module Scryer
           # non-credential uses (cache keys, ETags, checksums) that shouldn't
           # be flagged as a crypto weakness.
           line = Ast.line_of(node)
-          context_line = Ast.source_line(source, line).to_s
+          context_line = strip_trailing_comment(Ast.source_line(source, line).to_s)
           next unless PASSWORD_HINT.match?(context_line)
 
           findings << finding(
@@ -49,6 +61,29 @@ module Scryer
 
       private
 
+      # Strips a trailing `# ...` line comment before running PASSWORD_HINT
+      # against the raw source line. Without this, a defensive comment that
+      # *disclaims* password use (`Digest::SHA1.hexdigest(file_content) #
+      # cache key, not a password hash` — a natural thing to write specifically
+      # to preempt this exact kind of static-analysis false positive) still
+      # contains the substring "password" and would trip the heuristic just
+      # as hard as a genuine mention. This does give up the (much rarer) case
+      # where a comment is the *only* signal — e.g. an unnamed argument whose
+      # only password-ish hint is a comment describing it — but real
+      # password-hashing call sites almost always also have a password-ish
+      # identifier in the actual code (`password`, `user.password`, ...),
+      # which stays visible on the line after stripping the comment.
+      #
+      # Deliberately simple rather than a full tokenizer: finds the first `#`
+      # that isn't the start of a `#{` string interpolation and treats
+      # everything from there as comment. This means a literal `#` inside a
+      # string argument on the same line (e.g. `hexdigest("score: #1")`) would
+      # be mistaken for a comment start too — an accepted limitation of a
+      # same-line text heuristic, not a full parse.
+      def strip_trailing_comment(line)
+        line.sub(/#(?!\{).*\z/, "")
+      end
+
       # Matches `Digest::MD5` / `Digest::SHA1` referenced as a constant path.
       def digest_algorithm_name(node)
         text = Ast.each_node(node)

data/lib/scryer/rules/weak_session_cookie_rule.rb

@@ -10,6 +10,9 @@ module Scryer
       self.category = "security"
       self.default_severity = "warning"
       self.title = "Session cookie missing the secure flag"
+      self.cwe = "CWE-614"
+      self.owasp_category = "A05:2021-Security Misconfiguration"
+      self.confidence = "high"
 
       def scan
         findings = []

data/lib/scryer/rules/xss_unsafe_html_rule.rb

@@ -10,6 +10,33 @@ module Scryer
       self.category = "security"
       self.default_severity = "warning"
       self.title = "Unescaped HTML output (possible XSS)"
+      self.cwe = "CWE-79"
+      self.owasp_category = "A03:2021-Injection"
+      self.confidence = "high"
+
+      # Rails helpers whose whole job is to hand back HTML that's already
+      # safe to render unescaped, so a `.html_safe` immediately wrapped
+      # around a call to one of these isn't the same risk as calling it on
+      # raw user input:
+      #   - `sanitize(x)` strips to an explicit allow-list of tags/attrs —
+      #     it's the standard sanitize-then-mark-safe idiom this rule exists
+      #     to steer people *toward*, so flagging it would contradict our
+      #     own suggested fix.
+      #   - `strip_tags(x)` removes all markup, so there's no HTML left to
+      #     inject.
+      #   - `simple_format(x)` runs the text through `sanitize` internally by
+      #     default (it only skips that when called with an explicit
+      #     `sanitize: false` option, which we don't special-case here).
+      #   - `t(...)`/`translate(...)` pulls from the app's own locale files,
+      #     not attacker-controlled request data — translators, not users,
+      #     write that content, so this is Rails' own common "trusted copy"
+      #     idiom rather than a raw-input passthrough.
+      # This says nothing about the *argument* passed to these methods being
+      # safe on its own — it's specifically the combination of "wrapped in
+      # one of these calls, then marked html_safe" that's the recognized
+      # pattern. A bare `params[:bio].html_safe` or an interpolated string
+      # marked safe still flags, since neither goes through any of these.
+      SANITIZING_METHODS = %w[sanitize strip_tags simple_format t translate].freeze
 
       def scan
         findings = []
@@ -62,9 +89,23 @@ module Scryer
       def safe_literal?(node)
         return true if node.nil?
         return true if Ast.tagged?(node, :string_literal) && !Ast.string_literal_has_interpolation?(node)
+        return true if sanitizing_call?(node)
 
         false
       end
+
+      # True if `node` is a call (parenthesized or bare) to one of
+      # SANITIZING_METHODS — see that constant's comment for why those
+      # specific methods are exempt.
+      def sanitizing_call?(node)
+        inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+        return false unless Ast.tagged?(inner, :call, :command_call, :vcall, :fcall, :command)
+
+        name_pair = Ast.call_name(inner)
+        return false unless name_pair
+
+        SANITIZING_METHODS.include?(name_pair[1])
+      end
     end
   end
 end

data/lib/scryer/style_rules/frozen_string_literal_rule.rb

@@ -12,6 +12,7 @@ module Scryer
       self.category = "style"
       self.default_severity = "info"
       self.title = "Missing `frozen_string_literal` magic comment"
+      self.confidence = "high"
 
       MAGIC_COMMENT = /\A#\s*frozen_string_literal:\s*(true|false)\s*\z/i.freeze
 

data/lib/scryer/version.rb

@@ -1,3 +1,3 @@
 module Scryer
-  VERSION = "1.0.0"
+  VERSION = "1.1.1"
 end

data/lib/scryer.rb

@@ -10,7 +10,9 @@ require "scryer/duplicate_detector"
 require "scryer/scanner"
 require "scryer/report_renderer"
 require "scryer/dependency_audit"
+require "scryer/baseline"
 require "scryer/ai_client"
+require "scryer/fix_verifier"
 require "scryer/ai_fix_suggester"
 
 Dir[File.join(__dir__, "scryer", "rules", "*.rb")].sort.each { |f| require f }
@@ -53,6 +55,19 @@ module Scryer
     def configuration
       @configuration ||= Configuration.new
     end
+
+    # Runs the static scan with the current configuration (or explicit
+    # overrides) applied, without needing to know Scanner's own constructor
+    # shape. Exists mainly so the RSpec/Minitest test helpers (see
+    # lib/scryer/rspec.rb / lib/scryer/minitest.rb) — and any other future
+    # caller that just wants "the result of a normal scan" — don't each
+    # duplicate `Scanner.new(root:, dirs:, skip_rules:).call`. The CLI/rake
+    # task aren't changed to use this (they also handle dependency auditing,
+    # baselines, and report writing inline) — this is for callers that only
+    # need the static-scan Result itself.
+    def scan(root:, dirs: configuration.dirs, skip_rules: configuration.skip_rules)
+      Scryer::Scanner.new(root: root, dirs: dirs, skip_rules: skip_rules).call
+    end
   end
 end
 

data/lib/tasks/scryer.rake

@@ -16,7 +16,9 @@ namespace :scryer do
        "so pass each token as its own item rather than one comma-joined string. " \
        "e.g. rails scryer:report, rails 'scryer:report[html]', " \
        "rails 'scryer:report[json,doc/security.json]', rails 'scryer:report[json,html]', " \
-       "rails 'scryer:report[html,nodeps]', rails 'scryer:report[csv]', rails 'scryer:report[sarif]'"
+       "rails 'scryer:report[html,nodeps]', rails 'scryer:report[csv]', rails 'scryer:report[sarif]'. " \
+       "Set SCRYER_BASELINE=PATH (an env var, not a bracket arg — see scryer:save_baseline) to " \
+       "report only findings new since that baseline was saved."
   task :report, [:format] do |_, args|
     root = defined?(Rails) ? Rails.root.to_s : Dir.pwd
     dirs = Scryer.configuration.dirs
@@ -42,9 +44,23 @@ namespace :scryer do
                              Scryer::DependencyAudit.ruby_eol_check(root) + Scryer::DependencyAudit.credentials_exposure_check(root)
     end
 
+    # Rake bracket args are already stretched thin (format tokens + nodeps +
+    # one output path) — an ENV var is the more conventional way Rails rake
+    # tasks take an extra config value without overloading positional args
+    # further. `rails 'scryer:save_baseline[tmp/scryer_baseline.json]'` writes
+    # one; `SCRYER_BASELINE=tmp/scryer_baseline.json rails scryer:report`
+    # reads it back. See Scryer::Baseline / the CLI's --baseline flag for
+    # what this actually does (fingerprint-based new-vs-fixed diffing, not
+    # tied to line number).
+    baseline_path = blank_to_nil(ENV["SCRYER_BASELINE"])
+    fixed_count = 0
+    if baseline_path
+      dependency_findings, fixed_count = ScryerTasks.apply_baseline(baseline_path, result, dependency_findings)
+    end
+
     if Scryer.configuration.ai_client
       puts "Scryer: rewriting suggested fixes via the configured AI client..."
-      Scryer::AiFixSuggester.enhance_result!(result)
+      Scryer::AiFixSuggester.enhance_result!(result, root: root)
       Scryer::AiFixSuggester.enhance_many!(dependency_findings) unless dependency_findings.empty?
     end
 
@@ -70,7 +86,8 @@ namespace :scryer do
       File.write(path, content)
     end
 
-    ScryerTasks.print_summary(result: result, dependency_findings: dependency_findings, ran_deps: run_deps, paths: paths)
+    ScryerTasks.print_summary(result: result, dependency_findings: dependency_findings, ran_deps: run_deps, paths: paths,
+                               renderer: renderer, fixed_count: fixed_count, baseline_path: baseline_path)
 
     # Same gate as the `scryer` executable and scryer:audit_dependencies
     # below: fail the task (and so the CI job running it) on any security or
@@ -83,6 +100,37 @@ namespace :scryer do
     end
   end
 
+  desc "Convenience wrapper for CI: runs scryer:report with CI-sensible defaults — JSON + " \
+       "SARIF written under tmp/ (SARIF for GitHub Code Scanning / similar dashboards, JSON as " \
+       "the machine-readable form other CI steps can parse), dependency audit on, same " \
+       "SCRYER_BASELINE support and same fail-the-build-on-findings behavior as scryer:report. " \
+       "Equivalent to `rails 'scryer:report[json,sarif]'` under a name that doesn't require " \
+       "remembering the bracket-arg syntax. e.g. rails scryer:ci"
+  task :ci do
+    Rake::Task["scryer:report"].invoke("json", "sarif")
+  end
+
+  desc "Run Scryer and save every finding's fingerprint to PATH, for later comparison via " \
+       "SCRYER_BASELINE=PATH rails scryer:report (see that task's SCRYER_BASELINE note). " \
+       "Runs the same scan as scryer:report (including the dependency audit) but writes no " \
+       "report files. e.g. rails 'scryer:save_baseline[tmp/scryer_baseline.json]'"
+  task :save_baseline, [:path] do |_, args|
+    path = args[:path] || abort("Scryer: scryer:save_baseline needs a path, " \
+                                 "e.g. rails 'scryer:save_baseline[tmp/scryer_baseline.json]'")
+    root = defined?(Rails) ? Rails.root.to_s : Dir.pwd
+    dirs = Scryer.configuration.dirs
+
+    result = Scryer::Scanner.new(root: root, dirs: dirs, skip_rules: Scryer.configuration.skip_rules).call
+    puts "Scryer: querying OSV.dev for known-vulnerable gems (needs network)..."
+    dependency_findings = Scryer::DependencyAudit.insecure_sources(root) + Scryer::DependencyAudit.vulnerable_gems(root) +
+                           Scryer::DependencyAudit.ruby_eol_check(root) + Scryer::DependencyAudit.credentials_exposure_check(root)
+
+    all_findings = (result.security_findings + result.performance_findings + result.style_findings).map(&:to_h) +
+                   dependency_findings.map(&:to_h)
+    Scryer::Baseline.save(path, all_findings)
+    puts "Scryer: saved baseline of #{all_findings.size} finding(s) to #{path}."
+  end
+
   desc "Check Gemfile.lock for known-vulnerable gem versions (via OSV.dev — needs network) " \
        "and insecure git/http gem sources (offline). Exits non-zero if anything is found, so " \
        "this can gate CI the same way `bundle-audit check` does."
@@ -190,11 +238,40 @@ module ScryerTasks
     "#{f.gem_name} #{f.installed_version}: #{f.title}"
   end
 
+  # Same logic as Scryer::CLI#apply_baseline (see that method's comment for
+  # why fixed_count has to be computed once against the combined set of
+  # every category's current fingerprints, not once per category summed).
+  def apply_baseline(path, result, dependency_findings)
+    baseline_fingerprints = Scryer::Baseline.load(path)
+
+    security_hashes = result.security_findings.map(&:to_h)
+    performance_hashes = result.performance_findings.map(&:to_h)
+    style_hashes = result.style_findings.map(&:to_h)
+    dependency_hashes = dependency_findings.map(&:to_h)
+
+    all_current_fingerprints = Scryer::Baseline.fingerprints(security_hashes + performance_hashes + style_hashes + dependency_hashes)
+    fixed_count = (baseline_fingerprints - all_current_fingerprints.to_set).size
+
+    result.security_findings = filter_new(result.security_findings, security_hashes, baseline_fingerprints)
+    result.performance_findings = filter_new(result.performance_findings, performance_hashes, baseline_fingerprints)
+    result.style_findings = filter_new(result.style_findings, style_hashes, baseline_fingerprints)
+    filtered_deps = filter_new(dependency_findings, dependency_hashes, baseline_fingerprints)
+
+    [filtered_deps, fixed_count]
+  rescue Scryer::Baseline::LoadError => e
+    abort("Scryer: #{e.message}")
+  end
+
+  def filter_new(objects, hashes, baseline_fingerprints)
+    fingerprints = Scryer::Baseline.fingerprints(hashes)
+    objects.each_with_index.reject { |_, i| baseline_fingerprints.include?(fingerprints[i]) }.map(&:first)
+  end
+
   # The "one audit command" summary — a single scan's worth of every
   # category Scryer covers (security, performance, duplicate/smelly code,
   # dependencies), the same categories usually split across RuboCop +
   # Brakeman + bundler-audit + Reek, side by side in one box.
-  def print_summary(result:, dependency_findings:, ran_deps:, paths:)
+  def print_summary(result:, dependency_findings:, ran_deps:, paths:, renderer:, fixed_count: 0, baseline_path: nil)
     # "Code Quality" is the umbrella label for both duplicate-code groups
     # and rule-based style findings (e.g. frozen_string_literal) — two
     # different detectors, same broad concern, one row in the box.
@@ -210,14 +287,25 @@ module ScryerTasks
     ]
 
     divider = "─" * 32
+    score = renderer.security_score
     puts ""
     puts "Scryer Audit — #{result.files_scanned} files scanned"
     puts divider
     puts ""
+    if baseline_path
+      puts "Baseline: #{baseline_path} — showing new findings only (#{fixed_count} fixed since baseline)."
+      puts ""
+    end
+    clean_rate = renderer.rules_clean_rate
+    puts "Security Score: #{score["score"]}/100 (#{score["grade"]})"
+    puts "Checks: #{clean_rate["clean"]}/#{clean_rate["total"]} rules clean (#{clean_rate["percent"]}%)"
+    puts ""
     rows.each { |label, count| puts summary_row(label, count) }
     puts divider
     puts summary_row("Total", total)
     puts ""
+    print_top_priorities(renderer.top_risks)
+    print_owasp_coverage(renderer.owasp_coverage)
     paths.each { |format, path| puts "#{format.upcase} report: #{path}" }
   end
 
@@ -225,4 +313,29 @@ module ScryerTasks
     value = count.nil? ? "skipped (nodeps)" : "#{count} finding#{"s" unless count == 1}"
     "#{label.ljust(14)}#{value.rjust(20)}"
   end
+
+  # The categories above are counted separately, but nothing else ranks
+  # across them — this is what actually backs "tells you what to fix
+  # first" rather than just splitting findings into four buckets. Same
+  # data ReportRenderer#top_risks already sorts for the HTML report.
+  def print_top_priorities(risks)
+    return if risks.empty?
+
+    puts "Top priorities:"
+    risks.each_with_index do |r, i|
+      puts "  #{i + 1}. [#{r[:severity]}] #{r[:category]} — #{r[:label]} (#{r[:location]})"
+    end
+    puts ""
+  end
+
+  # Byproduct of every security rule carrying an owasp_category — see
+  # ReportRenderer#owasp_coverage. Scryer's own best-effort tagging, not an
+  # OWASP-audited mapping (documented in full in the README).
+  def print_owasp_coverage(coverage)
+    return if coverage.empty?
+
+    puts "OWASP Top 10 (2021) coverage:"
+    coverage.each { |category, count| puts "  #{category}: #{count} finding#{"s" unless count == 1}" }
+    puts ""
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: scryer
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.1.1
 platform: ruby
 authors:
 - Ram Laxman Yadav
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-08-12 00:00:00.000000000 Z
+date: 2026-08-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -25,18 +25,21 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '13.0'
 description: |
-  One scan, one report: security, performance, duplicate-code, and dependency audits for Ruby
-  and Rails — the ground Brakeman, bundler-audit, Reek, and custom glue scripts usually split
-  between them, covered by a single `scryer` command. (Style/lint is RuboCop's job — Scryer
-  doesn't touch that.)
+  Scryer scans a Ruby/Rails codebase for security vulnerabilities, performance problems,
+  dependency risk, and code-quality issues, then ranks everything it finds by severity across
+  all of those categories — so a scan ends with one answer to "what's most worth fixing," not
+  four separate reports to reconcile by hand. (Style/lint is RuboCop's job — Scryer doesn't
+  touch that, except one narrow check.)
 
-  Detects SQL injection, mass assignment, hardcoded secrets, XSS, weak crypto, and more; N+1
-  queries, missing pagination, and other performance heuristics; near-duplicate code; and
-  known-vulnerable gems via a live OSV.dev dependency audit — on by default, every run.
+  Detects SQL injection, mass assignment, SSRF, path traversal, IDOR, insecure JWT/CORS/session
+  config, hardcoded secrets, XSS, weak crypto, and more; N+1 queries, missing pagination, and
+  other performance heuristics; near-duplicate code; and known-vulnerable gems via a live
+  OSV.dev dependency audit — on by default, every run.
 
   Every finding includes a human-reviewable suggested fix — never auto-applied, optionally
   rewritten against your actual code by any LLM you configure. Reports in JSON, self-contained
-  HTML, or CSV. Zero runtime dependencies beyond Ruby's own stdlib.
+  HTML, CSV, or SARIF (for GitHub Code Scanning). Zero runtime dependencies beyond Ruby's own
+  stdlib.
 email:
 executables:
 - scryer
@@ -54,12 +57,16 @@ files:
 - lib/scryer/ai_client.rb
 - lib/scryer/ai_fix_suggester.rb
 - lib/scryer/ast.rb
+- lib/scryer/authorization_watcher.rb
+- lib/scryer/baseline.rb
 - lib/scryer/cache_extractor.rb
 - lib/scryer/cli.rb
 - lib/scryer/dependency_audit.rb
 - lib/scryer/duplicate_detector.rb
 - lib/scryer/finding.rb
+- lib/scryer/fix_verifier.rb
 - lib/scryer/method_extractor.rb
+- lib/scryer/minitest.rb
 - lib/scryer/performance_rules/inefficient_save_loop_rule.rb
 - lib/scryer/performance_rules/missing_pagination_rule.rb
 - lib/scryer/performance_rules/n_plus_one_query_rule.rb
@@ -68,6 +75,7 @@ files:
 - lib/scryer/query_watcher.rb
 - lib/scryer/railtie.rb
 - lib/scryer/report_renderer.rb
+- lib/scryer/rspec.rb
 - lib/scryer/rule.rb
 - lib/scryer/rule_set.rb
 - lib/scryer/rules/action_cable_forgery_protection_rule.rb
@@ -75,6 +83,7 @@ files:
 - lib/scryer/rules/active_storage_missing_content_type_validation_rule.rb
 - lib/scryer/rules/authentication_bypass_rule.rb
 - lib/scryer/rules/command_injection_rule.rb
+- lib/scryer/rules/consider_all_requests_local_rule.rb
 - lib/scryer/rules/cors_misconfiguration_rule.rb
 - lib/scryer/rules/csrf_protection_rule.rb
 - lib/scryer/rules/force_ssl_rule.rb
@@ -82,17 +91,21 @@ files:
 - lib/scryer/rules/hardcoded_basic_auth_rule.rb
 - lib/scryer/rules/hardcoded_secret_key_base_rule.rb
 - lib/scryer/rules/hardcoded_secret_rule.rb
+- lib/scryer/rules/host_authorization_disabled_rule.rb
 - lib/scryer/rules/idor_rule.rb
 - lib/scryer/rules/insecure_cookie_serializer_rule.rb
 - lib/scryer/rules/job_raw_params_rule.rb
 - lib/scryer/rules/jwt_insecure_rule.rb
 - lib/scryer/rules/mass_assignment_rule.rb
+- lib/scryer/rules/missing_authorization_rule.rb
+- lib/scryer/rules/missing_policy_scope_rule.rb
 - lib/scryer/rules/open_redirect_rule.rb
 - lib/scryer/rules/path_traversal_rule.rb
 - lib/scryer/rules/security_headers_rule.rb
 - lib/scryer/rules/sql_injection_rule.rb
 - lib/scryer/rules/ssrf_rule.rb
 - lib/scryer/rules/unsafe_deserialization_rule.rb
+- lib/scryer/rules/verbose_production_log_level_rule.rb
 - lib/scryer/rules/weak_crypto_rule.rb
 - lib/scryer/rules/weak_session_cookie_rule.rb
 - lib/scryer/rules/xss_unsafe_html_rule.rb
@@ -127,6 +140,5 @@ requirements: []
 rubygems_version: 3.5.11
 signing_key:
 specification_version: 4
-summary: Ruby/Rails security & quality auditor — one command instead of Brakeman +
-  bundler-audit + Reek.
+summary: Ruby/Rails application security & risk auditor — tells you what to fix first.
 test_files: []