scryer 1.2.1 → 1.3.0

data/lib/scryer/rules/dangerous_eval_rule.rb

@@ -0,0 +1,117 @@
+# frozen_string_literal: true
+module Scryer
+  module Rules
+    # Flags `eval`/`instance_eval`/`class_eval`/`module_eval` called with
+    # anything other than a plain string literal with no interpolation —
+    # the standard "Dangerous Eval" pattern every mainstream Rails security
+    # scanner (Brakeman included) checks for.
+    #
+    # Deliberately broader than this gem's other injection rules
+    # (sql_injection/mass_assignment/ssrf/path_traversal all only fire when
+    # the argument specifically traces back to `params` — see
+    # Ast.references_params?): eval-family methods execute their argument
+    # as arbitrary Ruby code, and there's essentially no legitimate reason
+    # for that string to be anything other than a literal the developer
+    # wrote themselves. A local variable, an instance variable, a method
+    # call, or an interpolated string are all flagged here regardless of
+    # where the value actually came from, since tracing where a local
+    # variable's value originated is real data-flow analysis this gem's
+    # per-expression heuristics don't attempt (see the README's honest
+    # comparison to Brakeman).
+    #
+    # `severity` is always "critical" — regardless of confidence, the
+    # blast radius if this argument is ever attacker-influenced is the
+    # same (arbitrary code execution in this process), and `eval` is never
+    # the *correct* way to do dynamic dispatch even when today's value
+    # happens to be safe (`const_get`/`safe_constantize` do the same job
+    # with zero code-execution risk). `confidence`, though, genuinely
+    # varies — this is exactly the axis Brakeman's own "Dangerous Eval"
+    # check varies confidence on too (High when its taint engine traces the
+    # argument to request data, Weak otherwise), and a real false-positive
+    # comparison against a real app surfaced why: the single most common
+    # shape here by far is `eval(controller_path.classify)` — a Rails-
+    # internal string identifying the *current controller class*, not
+    # request data at all, used as a (badly chosen) dynamic-dispatch idiom.
+    # That's still worth flagging at "critical" — it's needless RCE risk
+    # for something `const_get` does safely — but it is not the same
+    # confidence-of-actual-exploitability as `eval(params[:code])`. Since
+    # this gem has no real taint tracking, `Ast.references_params?`
+    # appearing anywhere in the argument is the strongest signal available
+    # for "this is confidently, not just plausibly, attacker-reachable" —
+    # confidence is "high" when it's present, and the class default
+    # ("medium" — real risk, but not confidently proven external input)
+    # otherwise.
+    #
+    # A block-only call (`obj.instance_eval { ... }`, no string argument at
+    # all) is never flagged — that's just running a block of code the
+    # developer wrote inline, nothing dynamic about it, and it doesn't even
+    # reach this rule's node-matching (see class comment on the shared
+    # `:method_add_arg, :command, :command_call` matching this gem's other
+    # call-shaped rules use — a block wraps the call in `:method_add_block`
+    # instead, a different tag entirely).
+    class DangerousEvalRule < Rule
+      self.rule_id = "dangerous_eval"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Dynamic code evaluation (eval) with non-literal input"
+      self.cwe = "CWE-95"
+      self.owasp_category = "A03:2021-Injection"
+      self.confidence = "medium"
+
+      EVAL_METHODS = %w[eval instance_eval class_eval module_eval].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          receiver_and_name = Ast.call_name(inner)
+          next unless receiver_and_name
+
+          _receiver, method_name = receiver_and_name
+          next unless EVAL_METHODS.include?(method_name)
+
+          args = Ast.call_arguments(node)
+          next if args.empty? # block-only call — nothing dynamic being evaluated
+
+          arg = args.first
+          next if safe_literal?(arg)
+
+          params_tainted = Ast.references_params?(arg)
+          message =
+            if params_tainted
+              "`#{method_name}` executes its argument as Ruby code, and that argument directly " \
+              "references `params` — request data reaches this eval, which means arbitrary code " \
+              "execution for anyone who can influence that value."
+            else
+              "`#{method_name}` executes its argument as Ruby code, and this one isn't a plain " \
+              "hardcoded string — no `params` reference is directly visible here, but there's " \
+              "still no safe way to be sure the value can never come from outside this process, " \
+              "and `eval` risks arbitrary code execution the moment it does."
+            end
+
+          line = Ast.line_of(arg) || Ast.line_of(node)
+          findings << finding(
+            line: line,
+            confidence: params_tainted ? "high" : self.class.confidence,
+            message: message,
+            suggested_fix: "Avoid `#{method_name}` with dynamic input entirely — there's almost " \
+                            "always a safer, narrower way to express what it's doing (e.g. " \
+                            "`public_send`/`const_get`/`safe_constantize` for dynamic dispatch, a " \
+                            "case/lookup table instead of building code as a string)."
+          )
+        end
+
+        findings
+      end
+
+      private
+
+      def safe_literal?(node)
+        Ast.tagged?(node, :string_literal) && !Ast.string_literal_has_interpolation?(node)
+      end
+    end
+  end
+end

data/lib/scryer/rules/force_ssl_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags `config.force_ssl = false` — an explicit opt-out of Rails'

data/lib/scryer/rules/graphql_missing_query_limits_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags a `class X < GraphQL::Schema` (or a class whose superclass

data/lib/scryer/rules/hardcoded_basic_auth_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags `http_basic_authenticate_with` calls whose `password:` (or

data/lib/scryer/rules/hardcoded_secret_key_base_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags `config.secret_key_base = "literal"` (or

data/lib/scryer/rules/hardcoded_secret_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags plain string literals assigned to a constant/variable/hash-key

data/lib/scryer/rules/host_authorization_disabled_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags `config.hosts.clear` (in any file — `Rails.application.config.

data/lib/scryer/rules/idor_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags `Model.find(params[...])` / `Model.find_by(...params...)` inside
@@ -27,15 +28,6 @@ module Scryer
 
       FINDER_METHODS = %w[find find_by find_by!].freeze
 
-      # Same reasoning as MassAssignmentRule::NON_MODEL_RECEIVERS: common
-      # stdlib/gem constants with their own `.find`-style methods that have
-      # nothing to do with an ActiveRecord model lookup.
-      NON_MODEL_RECEIVERS = %w[
-        Struct OpenStruct Data Class Module BCrypt OpenSSL Net URI Digest
-        JSON YAML Marshal String Array Hash Integer Float Symbol Comparable
-        Enumerable File Dir
-      ].freeze
-
       # Pundit's `authorize`/`policy_scope`/`can?`/`cannot?` plus two more
       # well-established framework-provided safeguards, deliberately not an
       # attempt at an exhaustive list of every app's custom guard method
@@ -140,17 +132,17 @@ module Scryer
       # namespaced model's `.find(params[...])` was silently never examined
       # at all (a false negative, not a false positive — worth fixing since
       # namespacing under a module is an extremely common Rails convention).
-      # Checked against the *last* segment (`"Post"`, not `"Admin"`), same
-      # exclusion list either way — none of NON_MODEL_RECEIVERS are commonly
-      # used in namespaced form for this purpose, but checking the actual
-      # class name being looked up is the more correct match regardless.
+      # Checked against the *last* segment (`"Post"`, not `"Admin"`) — same
+      # last-segment matching Scanner's known_models/known_non_models
+      # already use (see Ast.likely_model_name?), so a namespaced model
+      # resolves consistently either way.
       def likely_model_receiver?(receiver)
         return false if receiver.nil? # bare find(...) inside the model itself, not a controller lookup
 
         const_name = const_receiver_name(receiver)
         return false unless const_name
 
-        !NON_MODEL_RECEIVERS.include?(const_name)
+        Ast.likely_model_name?(const_name, known_models: known_models, known_non_models: known_non_models)
       end
 
       def const_receiver_name(node)

data/lib/scryer/rules/insecure_cookie_serializer_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags `config.action_dispatch.cookies_serializer = :marshal`. Rails

data/lib/scryer/rules/job_raw_params_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags `SomeJob.perform_async(...)` / `.perform_later(...)` /

data/lib/scryer/rules/jwt_insecure_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags insecure usage of the `jwt` gem's `JWT.decode`/`JWT.encode`:

data/lib/scryer/rules/mass_assignment_rule.rb

@@ -1,10 +1,16 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags `Model.new(params[...])` / `Model.new(params)` / `.update(params[...])`
     # / `.assign_attributes(params)` where the argument is `params` (or a
     # subscript of it) with no `.permit(...)` anywhere in the same argument
     # expression — i.e. attributes are being mass-assigned straight from the
-    # request with no allow-list.
+    # request with no allow-list. "Is the receiver actually an ActiveRecord
+    # model" is answered by Ast.likely_model_name? (known_models/
+    # known_non_models, resolved once per scan by Scanner from every
+    # `class X < Y` declaration it saw — see its own doc comment) — this
+    # rule only supplies the receiver-shape acceptance itself (a bare
+    # constant, an implicit receiver, or an ivar for the update-style verbs).
     class MassAssignmentRule < Rule
       self.rule_id = "mass_assignment"
       self.category = "security"
@@ -32,18 +38,6 @@ module Scryer
       # `@filters.update(params[:filters])` on a Hash.
       IVAR_RECEIVER_METHODS = %w[update update! assign_attributes attributes=].freeze
 
-      # Common stdlib/gem constants with their own `.new`/`.create`-style
-      # factory methods that have nothing to do with ActiveRecord mass
-      # assignment (e.g. `BCrypt::Password.create(params[:password])` is
-      # hashing a single value, not setting a hash of model attributes).
-      # Excluding these — plus anything referenced through a namespaced
-      # `A::B` path, which real Rails models are less commonly called via at
-      # the exact call site — cuts down false positives significantly.
-      NON_MODEL_RECEIVERS = %w[
-        Struct OpenStruct Data Class Module BCrypt OpenSSL Net URI Digest
-        JSON YAML Marshal String Array Hash Integer Float Symbol Comparable
-      ].freeze
-
       def scan
         findings = []
 
@@ -83,8 +77,8 @@ module Scryer
       private
 
       # true for an implicit receiver (bare `create(...)` inside the model
-      # itself), a plain unnamespaced constant reference (`Order`) that isn't
-      # a known non-model stdlib/gem constant, or — for the update-style
+      # itself), a plain unnamespaced constant reference (`Order`) Ast.
+      # likely_model_name? doesn't rule out, or — for the update-style
       # verbs only, see IVAR_RECEIVER_METHODS — an instance variable
       # (`@order`); false for namespaced constant paths (`BCrypt::Password`,
       # `Admin::Order` — a real gap, see mass_assignment_rule's class comment
@@ -97,7 +91,7 @@ module Scryer
         const_node = receiver[1]
         return false unless const_node.is_a?(Array) && const_node[0] == :@const
 
-        !NON_MODEL_RECEIVERS.include?(const_node[1])
+        Ast.likely_model_name?(const_node[1], known_models: known_models, known_non_models: known_non_models)
       end
 
       def ivar_receiver?(node)

data/lib/scryer/rules/missing_authorization_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags a `*Controller` class that defines `create`/`update`/`destroy`

data/lib/scryer/rules/missing_policy_scope_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags a controller's `index` action that queries a model directly
@@ -31,14 +32,6 @@ module Scryer
       self.confidence = "medium"
 
       UNSCOPED_METHODS = %w[all where].freeze
-      # Same list IdorRule/MassAssignmentRule use for the same reason —
-      # stdlib/gem constants with their own `.all`/`.where`-shaped methods
-      # that have nothing to do with an ActiveRecord model query.
-      NON_MODEL_RECEIVERS = %w[
-        Struct OpenStruct Data Class Module BCrypt OpenSSL Net URI Digest
-        JSON YAML Marshal String Array Hash Integer Float Symbol Comparable
-        Enumerable File Dir
-      ].freeze
 
       def scan
         findings = []
@@ -108,7 +101,7 @@ module Scryer
         const_name = const_receiver_name(receiver)
         return false unless const_name
 
-        !NON_MODEL_RECEIVERS.include?(const_name)
+        Ast.likely_model_name?(const_name, known_models: known_models, known_non_models: known_non_models)
       end
 
       def const_receiver_name(node)

data/lib/scryer/rules/open_redirect_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags `redirect_to` called with `params[...]` (or plain `params`)

data/lib/scryer/rules/path_traversal_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags a filesystem operation (`File.join/read/open/new/write/delete`,

data/lib/scryer/rules/security_headers_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags an explicit insecure override of Rails' default security

data/lib/scryer/rules/sql_injection_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags ActiveRecord finder/query methods called with a string argument

data/lib/scryer/rules/ssrf_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags an outbound HTTP call (`Net::HTTP`, `URI.open`/bare `open`

data/lib/scryer/rules/unsafe_deserialization_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags `Marshal.load`, `YAML.load` (as opposed to `YAML.safe_load`), and

data/lib/scryer/rules/verbose_production_log_level_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags `config.log_level = :debug` specifically in

data/lib/scryer/rules/weak_crypto_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags `Digest::MD5`/`Digest::SHA1` used in a context that looks like

data/lib/scryer/rules/weak_session_cookie_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags `config.session_store :cookie_store, ...` with no `secure: true`

data/lib/scryer/rules/xss_unsafe_html_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags `.html_safe` and `raw(...)` calls on anything that isn't an

data/lib/scryer/scanner.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require "ripper"
 require "set"
 
@@ -26,6 +27,20 @@ module Scryer
     QUERY_SIMILARITY_THRESHOLD = 0.7
     CACHE_SIMILARITY_THRESHOLD = 0.7
 
+    # Real ActiveRecord model base classes — a class transitively inheriting
+    # from one of these (see #model_via_chain?) goes into known_models.
+    KNOWN_MODEL_BASE_CLASSES = %w[ApplicationRecord ActiveRecord::Base].freeze
+
+    # Rails generates exactly one non-model "Application*" base class per
+    # concern (ApplicationController, ApplicationJob, ApplicationMailer,
+    # ApplicationCable::Connection/Channel) — ApplicationRecord is the only
+    # one of that family that models actually inherit from. A class
+    # inheriting from anything else matching this shape (including a
+    # project's own equivalent, e.g. a hand-rolled `ApplicationService`)
+    # can never also be an ActiveRecord model, regardless of what it's
+    # named — see Ast.likely_model_name?'s known_non_models.
+    NON_MODEL_SUPERCLASS_PATTERN = /\AApplication(?!Record\z)\w*\z/.freeze
+
     Result = Struct.new(:security_findings, :performance_findings, :style_findings, :duplicate_groups, :files_scanned, :parse_errors, keyword_init: true)
 
     # `skip_rules` silences specific checks by rule_id (e.g. a known false
@@ -48,14 +63,28 @@ module Scryer
 
     def call
       files = collect_files
-      all_methods = []
-      all_queries = []
-      all_cache_calls = []
-      security_findings = []
-      performance_findings = []
-      style_findings = []
+      parsed_files = []
       parse_errors = []
 
+      # First pass: read + parse every file exactly once (cached in
+      # parsed_files for the second pass below) and, while we're already
+      # walking each file's sexp, collect every `class X < Y` declaration
+      # into class_superclass/no_superclass_classes/application_family_classes
+      # — the raw material #resolve_known_models/#resolve_known_non_models
+      # turn into a real, project-wide "is this actually an ActiveRecord
+      # model" signal (see Ast.likely_model_name?'s doc comment for why this
+      # exists: a plain Ruby service/command object's `.new(params)` call
+      # looks identical to a real model's, and no per-file view can tell
+      # them apart — this can, because it's seen every class declaration in
+      # the project before any rule runs). Has to be a separate pass from
+      # rule-scanning below: a model declared in one file needs to be known
+      # before an *earlier-processed* file's controller referencing it is
+      # scanned, which a single combined pass can't guarantee regardless of
+      # file processing order.
+      class_superclass = {}
+      no_superclass_classes = Set.new
+      application_family_classes = Set.new
+
       files.each do |abs_path|
         rel_path = abs_path.sub(/\A#{Regexp.escape(@root)}\/?/, "")
         source = File.read(abs_path)
@@ -72,6 +101,21 @@ module Scryer
           next
         end
 
+        parsed_files << [rel_path, source, sexp]
+        collect_class_declarations(sexp, class_superclass, no_superclass_classes, application_family_classes)
+      end
+
+      known_models = resolve_known_models(class_superclass)
+      known_non_models = no_superclass_classes | application_family_classes
+
+      all_methods = []
+      all_queries = []
+      all_cache_calls = []
+      security_findings = []
+      performance_findings = []
+      style_findings = []
+
+      parsed_files.each do |rel_path, source, sexp|
         RuleSet.all.each do |rule_class|
           next if @skip_rules.include?(rule_class.rule_id.to_s)
 
@@ -83,7 +127,8 @@ module Scryer
             end
           next unless bucket
 
-          bucket.concat(rule_class.new(file: rel_path, source: source, sexp: sexp).scan)
+          bucket.concat(rule_class.new(file: rel_path, source: source, sexp: sexp,
+                                        known_models: known_models, known_non_models: known_non_models).scan)
         end
 
         if @detect_duplicates && duplicate_detection_target?(rel_path)
@@ -121,6 +166,80 @@ module Scryer
 
     private
 
+    # Records one file's `class X < Y` (and `module X`) declarations into the
+    # three accumulators #call builds across every scanned file.
+    # `class_superclass` maps a class's own (last-segment) name to its
+    # superclass's full name (kept full, not truncated, so e.g.
+    # "ActiveRecord::Base" still matches KNOWN_MODEL_BASE_CLASSES exactly in
+    # #model_via_chain? before that method truncates it to walk the chain
+    # further). A class declared with literally no superclass (`class
+    # Server; end`) goes straight into no_superclass_classes — no real
+    # ActiveRecord model is ever declared that way, so this is an
+    # unconditional, safe "definitely not a model" signal regardless of the
+    # class's name. `module X` gets the same treatment for the same reason:
+    # a bare Ruby module (e.g. this gem's own `RuleSet`) can never be an
+    # ActiveRecord model either, which matters for rules like
+    # UnboundedTableScanRule/NPlusOneQueryRule that otherwise treat any
+    # `Const.all.each`-shaped call as a possible query on a model.
+    def collect_class_declarations(sexp, class_superclass, no_superclass_classes, application_family_classes)
+      Ast.each_node(sexp) do |node|
+        if Ast.tagged?(node, :module)
+          name = Ast.class_name(node[1])
+          no_superclass_classes << last_segment(name) if name
+          next
+        end
+
+        next unless Ast.tagged?(node, :class)
+
+        name = Ast.class_name(node[1])
+        next unless name
+
+        last = last_segment(name)
+        superclass_node = node[2]
+
+        if superclass_node.nil?
+          no_superclass_classes << last
+          next
+        end
+
+        superclass_name = Ast.class_name(superclass_node)
+        next unless superclass_name
+
+        application_family_classes << last if superclass_name.match?(NON_MODEL_SUPERCLASS_PATTERN)
+        class_superclass[last] = superclass_name
+      end
+    end
+
+    # Every class name in class_superclass whose superclass chain
+    # terminates in ApplicationRecord/ActiveRecord::Base, resolved
+    # transitively (`class Order < ShardedRecord` + `class ShardedRecord <
+    # ApplicationRecord` both scanned) — not just direct inheritance, so
+    # e.g. a real Rails app's own abstract per-shard base classes, or STI
+    # subclasses, are recognized as models too.
+    def resolve_known_models(class_superclass)
+      class_superclass.each_key.select { |name| model_via_chain?(name, class_superclass) }.to_set
+    end
+
+    # `seen` guards against an (invalid, but not this method's job to
+    # reject) inheritance cycle recursing forever.
+    def model_via_chain?(name, class_superclass, seen = Set.new)
+      return false if seen.include?(name)
+
+      seen << name
+      superclass = class_superclass[name]
+      return false unless superclass
+      return true if KNOWN_MODEL_BASE_CLASSES.include?(superclass)
+
+      next_name = last_segment(superclass)
+      return false unless class_superclass.key?(next_name)
+
+      model_via_chain?(next_name, class_superclass, seen)
+    end
+
+    def last_segment(name)
+      name.to_s.split("::").last
+    end
+
     def duplicate_detection_target?(relative_path)
       segments = relative_path.split("/")
       return true if segments.include?("concerns")

data/lib/scryer/style_rules/frozen_string_literal_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags Ruby files with no `# frozen_string_literal: true` magic comment

data/lib/scryer/version.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
-  VERSION = "1.2.1"
+  VERSION = "1.3.0"
 end

data/lib/scryer.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require "scryer/version"
 require "scryer/colorizer"
 require "scryer/ast"
@@ -54,6 +55,50 @@ module Scryer
     # configured default) if it's too noisy or too slow for a given project.
     attr_accessor :project_name, :dirs, :branch, :ai_client, :skip_rules, :detect_duplicates
 
+    # Runtime method-level tracing config (see Scryer::APM) — a separate
+    # nested config object, not flat attrs on Configuration itself, so
+    # `Scryer.configure { |c| c.apm.include = [...] }` reads the same way
+    # section 7 of this feature's own design doc illustrates it, and so
+    # APM's many options don't crowd the static-scan options above into a
+    # single flat namespace.
+    class APMConfiguration
+      # `provider` — :new_relic (soft-detected via
+      # `defined?(NewRelic::Agent::Tracer)`) and :opentelemetry (soft-detected
+      # via `defined?(OpenTelemetry::Trace)`) are implemented; spans just
+      # aren't exported anywhere if the configured provider's SDK isn't
+      # loaded. `instrumentation` — only
+      # :off and :selective exist; :discovery/:deep_trace raise from
+      # Scryer::APM.enable! (not implemented yet, see README). `include`/
+      # `exclude` — arrays of "ClassName"/"Module::ClassName" strings;
+      # `exclude` always additionally contains Scryer's own namespace plus
+      # a small framework-internals floor regardless of what's set here
+      # (see Scryer::APM::DEFAULT_EXCLUDE). `sampling_rate` — 0.0..1.0,
+      # applied once per Scryer::APM.trace scope (a whole request/job is
+      # either sampled or not, not decided span-by-span).
+      # `capture_exception_messages` — false by default: only the
+      # exception *class* is ever recorded unless explicitly opted in,
+      # and even then the message passes through a best-effort redaction
+      # pass (see Scryer::APM#redact_exception_message).
+      attr_accessor :enabled, :provider, :instrumentation, :include, :exclude, :sampling_rate,
+                    :capture_exception_messages
+
+      def initialize
+        @enabled = false
+        @provider = :new_relic
+        @instrumentation = :selective
+        @include = []
+        @exclude = []
+        @sampling_rate = 1.0
+        @capture_exception_messages = false
+      end
+    end
+
+    attr_writer :apm
+
+    def apm
+      @apm ||= APMConfiguration.new
+    end
+
     def initialize
       @dirs = Scryer::Scanner::DEFAULT_GLOB_DIRS
       @skip_rules = []
@@ -91,5 +136,9 @@ end
 # isn't required eagerly here to avoid loading active_support/notifications
 # machinery for the (default) case where nobody asked for it. Require it
 # yourself where you call .enable! (see README's "Runtime query watcher").
+#
+# Scryer::APM (runtime method-level tracing, see lib/scryer/apm.rb) is the
+# same story — opt-in, requires it yourself where you call .enable! (see
+# README's "Runtime method tracing").
 
 require "scryer/railtie" if defined?(Rails::Railtie)

data/lib/tasks/scryer.rake

@@ -440,7 +440,6 @@ module ScryerTasks
     ]
 
     divider = paint("─" * 32, :gray)
-    score = renderer.security_score
     puts ""
     puts paint("Scryer Audit — #{result.files_scanned} files scanned", :bold)
     puts divider
@@ -450,7 +449,10 @@ module ScryerTasks
       puts ""
     end
     clean_rate = renderer.rules_clean_rate
-    puts "Security Score: #{score["score"]}/100 (#{paint_grade(score["grade"], score["grade"])})"
+    puts score_row("Security Score", renderer.security_score)
+    puts score_row("Performance Score", renderer.performance_score)
+    puts score_row("Style Score", renderer.style_score)
+    puts(ran_deps ? score_row("Dependency Score", renderer.dependency_score) : "#{"Dependency Score".ljust(20)}skipped (nodeps)")
     puts "Checks: #{clean_rate["clean"]}/#{clean_rate["total"]} rules clean (#{clean_rate["percent"]}%)"
     puts ""
     rows.each { |label, count| puts summary_row(label, count) }
@@ -467,6 +469,10 @@ module ScryerTasks
     "#{label.ljust(14)}#{value.rjust(20)}"
   end
 
+  def score_row(label, score)
+    "#{label.ljust(20)}#{score["score"]}/100 (#{paint_grade(score["grade"], score["grade"])})"
+  end
+
   # The categories above are counted separately, but nothing else ranks
   # across them — this is what actually backs "tells you what to fix
   # first" rather than just splitting findings into four buckets. Same