@agentic-qe/v3 3.0.0-alpha.6 → 3.0.0-alpha.7

package/src/domains/security-compliance/services/security-auditor.ts

@@ -1,2227 +0,0 @@
-/**
- * Agentic QE v3 - Security Auditor Service
- * Provides comprehensive security audit functionality
- */
-
-import { v4 as uuidv4 } from 'uuid';
-import * as fs from 'fs/promises';
-import * as path from 'path';
-import { Result, ok, err } from '../../../shared/types/index.js';
-import type { MemoryBackend } from '../../../kernel/interfaces.js';
-import type { FilePath, RiskScore } from '../../../shared/value-objects/index.js';
-
-// ============================================================================
-// Package.json Types
-// ============================================================================
-
-interface PackageJson {
-  name?: string;
-  version?: string;
-  dependencies?: Record<string, string>;
-  devDependencies?: Record<string, string>;
-  peerDependencies?: Record<string, string>;
-  optionalDependencies?: Record<string, string>;
-}
-
-// ============================================================================
-// OSV (Open Source Vulnerabilities) API Types
-// ============================================================================
-
-interface OSVQueryRequest {
-  package: {
-    name: string;
-    ecosystem: string;
-  };
-  version: string;
-}
-
-interface OSVVulnerability {
-  id: string;
-  summary?: string;
-  details?: string;
-  aliases?: string[];
-  severity?: Array<{
-    type: string;
-    score: string;
-  }>;
-  affected?: Array<{
-    package?: {
-      name: string;
-      ecosystem: string;
-    };
-    ranges?: Array<{
-      type: string;
-      events?: Array<{
-        introduced?: string;
-        fixed?: string;
-      }>;
-    }>;
-    versions?: string[];
-  }>;
-  references?: Array<{
-    type: string;
-    url: string;
-  }>;
-}
-
-interface OSVQueryResponse {
-  vulns?: OSVVulnerability[];
-}
-
-// ============================================================================
-// HTTP Client for API calls
-// ============================================================================
-
-interface HttpResponse<T> {
-  ok: boolean;
-  status: number;
-  data: T;
-}
-
-async function httpPost<T, R>(url: string, body: T): Promise<HttpResponse<R>> {
-  const response = await fetch(url, {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/json',
-    },
-    body: JSON.stringify(body),
-  });
-
-  const data = await response.json() as R;
-  return {
-    ok: response.ok,
-    status: response.status,
-    data,
-  };
-}
-
-async function httpGet<R>(url: string): Promise<HttpResponse<R>> {
-  const response = await fetch(url, {
-    method: 'GET',
-    headers: {
-      'Accept': 'application/json',
-    },
-  });
-
-  const data = await response.json() as R;
-  return {
-    ok: response.ok,
-    status: response.status,
-    data,
-  };
-}
-import type {
-  IDependencySecurityService,
-  DependencyScanResult,
-  PackageSecurityInfo,
-  UpgradeRecommendation,
-  Vulnerability,
-  VulnerabilitySeverity,
-  VulnerabilityCategory,
-  VulnerabilityLocation,
-  DependencyInfo,
-  OutdatedPackage,
-  RemediationAdvice,
-  ScanSummary,
-  DetectedSecret,
-  SecretScanResult,
-  SecurityAuditOptions,
-  SecurityAuditReport,
-  SASTResult,
-  DASTResult,
-} from '../interfaces.js';
-
-// ============================================================================
-// Service Interface
-// ============================================================================
-
-export interface ISecurityAuditorService extends IDependencySecurityService {
-  /**
-   * Run comprehensive security audit
-   */
-  runAudit(options: SecurityAuditOptions): Promise<Result<SecurityAuditReport>>;
-
-  /**
-   * Scan for secrets/credentials in code
-   */
-  scanSecrets(files: FilePath[]): Promise<Result<SecretScanResult>>;
-
-  /**
-   * Get security posture summary
-   */
-  getSecurityPosture(): Promise<Result<SecurityPostureSummary>>;
-
-  /**
-   * Triage vulnerabilities by priority
-   */
-  triageVulnerabilities(
-    vulnerabilities: Vulnerability[]
-  ): Promise<Result<TriagedVulnerabilities>>;
-}
-
-export interface SecurityPostureSummary {
-  overallScore: number;
-  trend: 'improving' | 'stable' | 'declining';
-  criticalIssues: number;
-  highIssues: number;
-  openVulnerabilities: number;
-  resolvedLastWeek: number;
-  averageResolutionTime: number;
-  lastAuditDate: Date;
-  recommendations: string[];
-}
-
-export interface TriagedVulnerabilities {
-  immediate: Vulnerability[];
-  shortTerm: Vulnerability[];
-  mediumTerm: Vulnerability[];
-  longTerm: Vulnerability[];
-  accepted: Vulnerability[];
-}
-
-// ============================================================================
-// Configuration
-// ============================================================================
-
-export interface SecurityAuditorConfig {
-  secretPatterns: RegExp[];
-  excludePatterns: string[];
-  maxFileSizeKb: number;
-  enableHistoricalAnalysis: boolean;
-  riskThreshold: number;
-}
-
-const DEFAULT_CONFIG: SecurityAuditorConfig = {
-  secretPatterns: [
-    /(?:api[_-]?key|apikey)['":\s]*['"=]?\s*['"]?([a-zA-Z0-9_\-]{20,})['"]?/gi,
-    /(?:password|passwd|pwd)['":\s]*['"=]?\s*['"]?([^\s'"]{8,})['"]?/gi,
-    /(?:secret|token)['":\s]*['"=]?\s*['"]?([a-zA-Z0-9_\-]{16,})['"]?/gi,
-    /(?:aws[_-]?access[_-]?key|aws[_-]?secret)['":\s]*['"=]?\s*['"]?([A-Z0-9]{20,})['"]?/gi,
-    /-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/gi,
-    /ghp_[a-zA-Z0-9]{36}/g, // GitHub personal access token
-    /gho_[a-zA-Z0-9]{36}/g, // GitHub OAuth access token
-    /sk-[a-zA-Z0-9]{48}/g, // OpenAI API key
-  ],
-  excludePatterns: ['node_modules', 'dist', 'build', '.git', '*.test.*', '*.spec.*'],
-  maxFileSizeKb: 1024,
-  enableHistoricalAnalysis: true,
-  riskThreshold: 0.7,
-};
-
-// ============================================================================
-// Security Auditor Service Implementation
-// ============================================================================
-
-export class SecurityAuditorService implements ISecurityAuditorService {
-  private readonly config: SecurityAuditorConfig;
-
-  constructor(
-    private readonly memory: MemoryBackend,
-    config: Partial<SecurityAuditorConfig> = {}
-  ) {
-    this.config = { ...DEFAULT_CONFIG, ...config };
-  }
-
-  // ==========================================================================
-  // IDependencySecurityService Implementation
-  // ==========================================================================
-
-  /**
-   * Scan dependencies for vulnerabilities
-   */
-  async scanDependencies(manifestPath: FilePath): Promise<Result<DependencyScanResult>> {
-    try {
-      const manifest = manifestPath.value;
-      const ecosystem = this.detectEcosystem(manifest);
-
-      if (!ecosystem) {
-        return err(new Error(`Unknown manifest format: ${manifest}`));
-      }
-
-      const vulnerabilities: Vulnerability[] = [];
-      const outdatedPackages: OutdatedPackage[] = [];
-
-      // Parse dependencies from manifest file
-      const dependencies = await this.parseDependencies(manifest, ecosystem);
-
-      for (const dep of dependencies) {
-        // Check for known vulnerabilities
-        const vulns = await this.checkDependencyVulnerabilities(dep, ecosystem);
-        vulnerabilities.push(...vulns);
-
-        // Check for outdated packages
-        const outdated = await this.checkOutdated(dep);
-        if (outdated) {
-          outdatedPackages.push(outdated);
-        }
-      }
-
-      const summary = this.createDependencySummary(vulnerabilities, dependencies.length);
-
-      // Store results
-      await this.memory.set(
-        `security:deps:${manifestPath.filename}`,
-        { vulnerabilities, outdatedPackages, summary },
-        { namespace: 'security-compliance', ttl: 86400 } // 24 hours
-      );
-
-      return ok({
-        vulnerabilities,
-        outdatedPackages,
-        summary,
-      });
-    } catch (error) {
-      return err(error instanceof Error ? error : new Error(String(error)));
-    }
-  }
-
-  /**
-   * Check specific package for security issues
-   */
-  async checkPackage(
-    name: string,
-    version: string,
-    ecosystem: DependencyInfo['ecosystem']
-  ): Promise<Result<PackageSecurityInfo>> {
-    try {
-      // Query OSV vulnerability database
-      const vulnerabilities = await this.queryVulnerabilityDatabase(
-        name,
-        version,
-        ecosystem
-      );
-
-      const latestVersion = await this.getLatestVersion(name, ecosystem);
-      const isDeprecated = await this.checkDeprecation(name, ecosystem);
-
-      return ok({
-        name,
-        version,
-        vulnerabilities,
-        latestVersion,
-        isDeprecated,
-      });
-    } catch (error) {
-      return err(error instanceof Error ? error : new Error(String(error)));
-    }
-  }
-
-  /**
-   * Get upgrade recommendations for vulnerabilities
-   */
-  async getUpgradeRecommendations(
-    vulnerabilities: Vulnerability[]
-  ): Promise<Result<UpgradeRecommendation[]>> {
-    try {
-      const recommendations: UpgradeRecommendation[] = [];
-
-      // Group vulnerabilities by package
-      const byPackage = new Map<string, Vulnerability[]>();
-      for (const vuln of vulnerabilities) {
-        const dep = vuln.location.dependency;
-        if (dep) {
-          const key = `${dep.ecosystem}:${dep.name}`;
-          const existing = byPackage.get(key) || [];
-          existing.push(vuln);
-          byPackage.set(key, existing);
-        }
-      }
-
-      // Generate recommendations for each package
-      for (const [key, vulns] of byPackage) {
-        const [ecosystem, name] = key.split(':');
-        const currentVersion = vulns[0].location.dependency?.version || 'unknown';
-
-        const latestVersion = await this.getLatestVersion(
-          name,
-          ecosystem as DependencyInfo['ecosystem']
-        );
-
-        const fixedVersions = vulns
-          .filter((v) => v.id)
-          .map((v) => v.id);
-
-        recommendations.push({
-          package: name,
-          fromVersion: currentVersion,
-          toVersion: latestVersion,
-          fixesVulnerabilities: fixedVersions,
-          breakingChanges: this.hasBreakingChanges(currentVersion, latestVersion),
-        });
-      }
-
-      // Sort by number of vulnerabilities fixed
-      recommendations.sort(
-        (a, b) => b.fixesVulnerabilities.length - a.fixesVulnerabilities.length
-      );
-
-      return ok(recommendations);
-    } catch (error) {
-      return err(error instanceof Error ? error : new Error(String(error)));
-    }
-  }
-
-  // ==========================================================================
-  // Audit Functionality
-  // ==========================================================================
-
-  /**
-   * Run comprehensive security audit
-   */
-  async runAudit(options: SecurityAuditOptions): Promise<Result<SecurityAuditReport>> {
-    const auditId = uuidv4();
-    const timestamp = new Date();
-
-    try {
-      let sastResults: SASTResult | undefined;
-      let dastResults: DASTResult | undefined;
-      let dependencyResults: DependencyScanResult | undefined;
-      let secretScanResults: SecretScanResult | undefined;
-
-      // Note: Actual SAST/DAST scanning would be delegated to SecurityScannerService
-      // This is orchestration-level code that combines results
-
-      if (options.includeSAST) {
-        // SAST scanning delegated to SecurityScannerService
-        sastResults = await this.performSASTScan();
-      }
-
-      if (options.includeDAST && options.targetUrl) {
-        // DAST scanning delegated to SecurityScannerService
-        dastResults = await this.performDASTScan(options.targetUrl);
-      }
-
-      if (options.includeDependencies) {
-        // Scan package manifests for vulnerabilities
-        dependencyResults = await this.performDependencyScan();
-      }
-
-      if (options.includeSecrets) {
-        // Scan source files for secrets
-        secretScanResults = await this.performSecretScan();
-      }
-
-      // Calculate overall risk score
-      const overallRiskScore = this.calculateOverallRisk(
-        sastResults,
-        dastResults,
-        dependencyResults,
-        secretScanResults
-      );
-
-      // Generate recommendations
-      const recommendations = this.generateRecommendations(
-        sastResults,
-        dastResults,
-        dependencyResults,
-        secretScanResults
-      );
-
-      const report: SecurityAuditReport = {
-        auditId,
-        timestamp,
-        sastResults,
-        dastResults,
-        dependencyResults,
-        secretScanResults,
-        overallRiskScore,
-        recommendations,
-      };
-
-      // Store audit report
-      await this.memory.set(
-        `security:audit:${auditId}`,
-        report,
-        { namespace: 'security-compliance', persist: true }
-      );
-
-      return ok(report);
-    } catch (error) {
-      return err(error instanceof Error ? error : new Error(String(error)));
-    }
-  }
-
-  /**
-   * Scan for secrets in code
-   */
-  async scanSecrets(files: FilePath[]): Promise<Result<SecretScanResult>> {
-    try {
-      const secretsFound: DetectedSecret[] = [];
-      let filesScanned = 0;
-
-      for (const file of files) {
-        // Skip excluded patterns
-        if (this.shouldExclude(file.value)) {
-          continue;
-        }
-
-        filesScanned++;
-
-        // Read and scan file for secrets using regex patterns
-        const secrets = await this.scanFileForSecrets(file);
-        secretsFound.push(...secrets);
-      }
-
-      return ok({
-        secretsFound,
-        filesScanned,
-      });
-    } catch (error) {
-      return err(error instanceof Error ? error : new Error(String(error)));
-    }
-  }
-
-  /**
-   * Get security posture summary
-   */
-  async getSecurityPosture(): Promise<Result<SecurityPostureSummary>> {
-    try {
-      // Get historical audit data
-      const audits = await this.getRecentAudits();
-
-      // Calculate metrics
-      const latestAudit = audits[0];
-      const previousAudit = audits[1];
-
-      const criticalIssues = this.countBySeverity(latestAudit, 'critical');
-      const highIssues = this.countBySeverity(latestAudit, 'high');
-      const openVulnerabilities = this.countOpenVulnerabilities(latestAudit);
-
-      // Calculate trend
-      const trend = this.calculateTrend(latestAudit, previousAudit);
-
-      // Calculate overall score (0-100)
-      const overallScore = this.calculatePostureScore(
-        criticalIssues,
-        highIssues,
-        openVulnerabilities
-      );
-
-      // Generate recommendations
-      const recommendations = this.generatePostureRecommendations(
-        criticalIssues,
-        highIssues,
-        overallScore
-      );
-
-      return ok({
-        overallScore,
-        trend,
-        criticalIssues,
-        highIssues,
-        openVulnerabilities,
-        resolvedLastWeek: await this.countResolvedLastWeek(),
-        averageResolutionTime: await this.calculateAverageResolutionTime(),
-        lastAuditDate: latestAudit?.timestamp ?? new Date(),
-        recommendations,
-      });
-    } catch (error) {
-      return err(error instanceof Error ? error : new Error(String(error)));
-    }
-  }
-
-  /**
-   * Triage vulnerabilities by priority
-   */
-  async triageVulnerabilities(
-    vulnerabilities: Vulnerability[]
-  ): Promise<Result<TriagedVulnerabilities>> {
-    try {
-      const triaged: TriagedVulnerabilities = {
-        immediate: [],
-        shortTerm: [],
-        mediumTerm: [],
-        longTerm: [],
-        accepted: [],
-      };
-
-      for (const vuln of vulnerabilities) {
-        const bucket = this.determinePriorityBucket(vuln);
-        triaged[bucket].push(vuln);
-      }
-
-      // Sort each bucket by severity
-      const severityOrder = ['critical', 'high', 'medium', 'low', 'informational'];
-      for (const bucket of Object.values(triaged)) {
-        bucket.sort(
-          (a: Vulnerability, b: Vulnerability) =>
-            severityOrder.indexOf(a.severity) - severityOrder.indexOf(b.severity)
-        );
-      }
-
-      return ok(triaged);
-    } catch (error) {
-      return err(error instanceof Error ? error : new Error(String(error)));
-    }
-  }
-
-  // ==========================================================================
-  // Private Helper Methods
-  // ==========================================================================
-
-  private detectEcosystem(manifest: string): DependencyInfo['ecosystem'] | null {
-    if (manifest.includes('package.json')) return 'npm';
-    if (manifest.includes('requirements.txt') || manifest.includes('Pipfile')) return 'pip';
-    if (manifest.includes('pom.xml') || manifest.includes('build.gradle')) return 'maven';
-    if (manifest.includes('Cargo.toml')) return 'cargo';
-    if (manifest.includes('.csproj') || manifest.includes('packages.config')) return 'nuget';
-    return null;
-  }
-
-  private async parseDependencies(
-    manifest: string,
-    ecosystem: DependencyInfo['ecosystem']
-  ): Promise<DependencyInfo[]> {
-    const dependencies: DependencyInfo[] = [];
-
-    try {
-      if (ecosystem === 'npm') {
-        // Read and parse package.json
-        const content = await fs.readFile(manifest, 'utf-8');
-        const packageJson: PackageJson = JSON.parse(content);
-
-        // Collect all dependency types
-        const allDeps: Record<string, string> = {
-          ...packageJson.dependencies,
-          ...packageJson.devDependencies,
-          ...packageJson.peerDependencies,
-          ...packageJson.optionalDependencies,
-        };
-
-        // Convert to DependencyInfo array
-        for (const [name, versionSpec] of Object.entries(allDeps)) {
-          // Clean version specifiers (^, ~, >=, etc.)
-          const version = this.cleanVersionSpec(versionSpec);
-          dependencies.push({ name, version, ecosystem: 'npm' });
-        }
-      } else if (ecosystem === 'pip') {
-        // Parse requirements.txt or Pipfile
-        const content = await fs.readFile(manifest, 'utf-8');
-        const lines = content.split('\n');
-
-        for (const line of lines) {
-          const trimmed = line.trim();
-          // Skip comments and empty lines
-          if (!trimmed || trimmed.startsWith('#')) continue;
-
-          // Parse package==version or package>=version patterns
-          const match = trimmed.match(/^([a-zA-Z0-9_-]+)(?:[=<>~!]+(.+))?$/);
-          if (match) {
-            dependencies.push({
-              name: match[1],
-              version: match[2] || 'latest',
-              ecosystem: 'pip',
-            });
-          }
-        }
-      }
-      // Additional ecosystems (maven, cargo, nuget) would be implemented similarly
-    } catch (error) {
-      // If file reading fails, return empty array rather than throwing
-      console.error(`Failed to parse dependencies from ${manifest}:`, error);
-    }
-
-    return dependencies;
-  }
-
-  /**
-   * Clean version specifier to extract actual version
-   */
-  private cleanVersionSpec(versionSpec: string): string {
-    // Remove leading specifiers like ^, ~, >=, <=, >, <, =
-    return versionSpec.replace(/^[\^~>=<]+/, '').trim();
-  }
-
-  private async checkDependencyVulnerabilities(
-    dep: DependencyInfo,
-    ecosystem: DependencyInfo['ecosystem']
-  ): Promise<Vulnerability[]> {
-    const vulnerabilities: Vulnerability[] = [];
-
-    try {
-      // Map ecosystem to OSV ecosystem name
-      const osvEcosystem = this.mapToOSVEcosystem(ecosystem);
-
-      // Query OSV API for vulnerabilities
-      const osvQuery: OSVQueryRequest = {
-        package: {
-          name: dep.name,
-          ecosystem: osvEcosystem,
-        },
-        version: dep.version,
-      };
-
-      const response = await httpPost<OSVQueryRequest, OSVQueryResponse>(
-        'https://api.osv.dev/v1/query',
-        osvQuery
-      );
-
-      if (response.ok && response.data.vulns && response.data.vulns.length > 0) {
-        for (const osvVuln of response.data.vulns) {
-          const vulnerability = this.mapOSVVulnerability(osvVuln, dep);
-          vulnerabilities.push(vulnerability);
-        }
-      }
-    } catch (error) {
-      // Log error but don't fail the entire scan
-      console.error(`Failed to check vulnerabilities for ${dep.name}@${dep.version}:`, error);
-    }
-
-    return vulnerabilities;
-  }
-
-  /**
-   * Map internal ecosystem to OSV ecosystem name
-   */
-  private mapToOSVEcosystem(ecosystem: DependencyInfo['ecosystem']): string {
-    const ecosystemMap: Record<DependencyInfo['ecosystem'], string> = {
-      npm: 'npm',
-      pip: 'PyPI',
-      maven: 'Maven',
-      nuget: 'NuGet',
-      cargo: 'crates.io',
-    };
-    return ecosystemMap[ecosystem];
-  }
-
-  /**
-   * Map OSV vulnerability to our Vulnerability type
-   */
-  private mapOSVVulnerability(osvVuln: OSVVulnerability, dep: DependencyInfo): Vulnerability {
-    // Extract CVE ID from aliases
-    const cveId = osvVuln.aliases?.find((alias) => alias.startsWith('CVE-'));
-
-    // Determine severity from OSV severity scores
-    const severity = this.mapOSVSeverity(osvVuln.severity);
-
-    // Extract fixed version from affected ranges
-    const fixedVersion = this.extractFixedVersion(osvVuln);
-
-    // Build references list
-    const references = osvVuln.references?.map((ref) => ref.url) || [];
-
-    const location: VulnerabilityLocation = {
-      file: 'package.json',
-      dependency: dep,
-    };
-
-    const remediation: RemediationAdvice = {
-      description: fixedVersion
-        ? `Upgrade ${dep.name} to version ${fixedVersion} or higher`
-        : `Review and address vulnerability in ${dep.name}`,
-      fixExample: fixedVersion ? `"${dep.name}": "^${fixedVersion}"` : undefined,
-      estimatedEffort: fixedVersion ? 'trivial' : 'moderate',
-      automatable: !!fixedVersion,
-    };
-
-    return {
-      id: uuidv4(),
-      cveId,
-      title: osvVuln.summary || `Vulnerability in ${dep.name}`,
-      description: osvVuln.details || osvVuln.summary || 'No description available',
-      severity,
-      category: this.categorizeVulnerability(osvVuln),
-      location,
-      remediation,
-      references,
-    };
-  }
-
-  /**
-   * Map OSV severity to our severity levels
-   */
-  private mapOSVSeverity(
-    severityScores?: OSVVulnerability['severity']
-  ): VulnerabilitySeverity {
-    if (!severityScores || severityScores.length === 0) {
-      return 'medium'; // Default to medium if no severity info
-    }
-
-    // Find CVSS score
-    const cvssScore = severityScores.find(
-      (s) => s.type === 'CVSS_V3' || s.type === 'CVSS_V2'
-    );
-
-    if (cvssScore) {
-      const score = parseFloat(cvssScore.score);
-      if (score >= 9.0) return 'critical';
-      if (score >= 7.0) return 'high';
-      if (score >= 4.0) return 'medium';
-      if (score > 0) return 'low';
-    }
-
-    return 'medium';
-  }
-
-  /**
-   * Extract fixed version from OSV vulnerability data
-   */
-  private extractFixedVersion(osvVuln: OSVVulnerability): string | undefined {
-    if (!osvVuln.affected) return undefined;
-
-    for (const affected of osvVuln.affected) {
-      if (affected.ranges) {
-        for (const range of affected.ranges) {
-          if (range.events) {
-            const fixedEvent = range.events.find((event) => event.fixed);
-            if (fixedEvent?.fixed) {
-              return fixedEvent.fixed;
-            }
-          }
-        }
-      }
-    }
-
-    return undefined;
-  }
-
-  /**
-   * Categorize vulnerability based on OSV data
-   */
-  private categorizeVulnerability(osvVuln: OSVVulnerability): VulnerabilityCategory {
-    const summary = (osvVuln.summary || '').toLowerCase();
-    const details = (osvVuln.details || '').toLowerCase();
-    const combined = `${summary} ${details}`;
-
-    // Check for common vulnerability patterns
-    if (combined.includes('injection') || combined.includes('sql')) {
-      return 'injection';
-    }
-    if (combined.includes('xss') || combined.includes('cross-site scripting')) {
-      return 'xss';
-    }
-    if (combined.includes('authentication') || combined.includes('auth bypass')) {
-      return 'broken-auth';
-    }
-    if (combined.includes('sensitive data') || combined.includes('exposure')) {
-      return 'sensitive-data';
-    }
-    if (combined.includes('xxe') || combined.includes('xml external')) {
-      return 'xxe';
-    }
-    if (combined.includes('access control') || combined.includes('authorization')) {
-      return 'access-control';
-    }
-    if (combined.includes('deseriali')) {
-      return 'insecure-deserialization';
-    }
-    if (combined.includes('prototype pollution') || combined.includes('dependency')) {
-      return 'vulnerable-components';
-    }
-
-    // Default to vulnerable-components for dependency vulnerabilities
-    return 'vulnerable-components';
-  }
-
-  private async checkOutdated(dep: DependencyInfo): Promise<OutdatedPackage | null> {
-    // Check if package is outdated by comparing with latest version from registry
-    const latestVersion = await this.getLatestVersion(dep.name, dep.ecosystem);
-
-    if (latestVersion !== dep.version) {
-      return {
-        name: dep.name,
-        currentVersion: dep.version,
-        latestVersion,
-        updateType: this.determineUpdateType(dep.version, latestVersion),
-      };
-    }
-
-    return null;
-  }
-
-  private async queryVulnerabilityDatabase(
-    name: string,
-    version: string,
-    ecosystem: DependencyInfo['ecosystem']
-  ): Promise<Vulnerability[]> {
-    // Query OSV API for vulnerabilities
-    const dep: DependencyInfo = { name, version, ecosystem };
-    return this.checkDependencyVulnerabilities(dep, ecosystem);
-  }
-
-  private async getLatestVersion(
-    name: string,
-    ecosystem: DependencyInfo['ecosystem']
-  ): Promise<string> {
-    try {
-      if (ecosystem === 'npm') {
-        // Query npm registry for latest version
-        const response = await httpGet<{ 'dist-tags'?: { latest?: string }; version?: string }>(
-          `https://registry.npmjs.org/${encodeURIComponent(name)}/latest`
-        );
-
-        if (response.ok && response.data.version) {
-          return response.data.version;
-        }
-      } else if (ecosystem === 'pip') {
-        // Query PyPI for latest version
-        const response = await httpGet<{ info?: { version?: string } }>(
-          `https://pypi.org/pypi/${encodeURIComponent(name)}/json`
-        );
-
-        if (response.ok && response.data.info?.version) {
-          return response.data.info.version;
-        }
-      }
-      // Additional registries (Maven, NuGet, Cargo) would be implemented similarly
-    } catch (error) {
-      console.error(`Failed to get latest version for ${name}:`, error);
-    }
-
-    return 'unknown';
-  }
-
-  private async checkDeprecation(
-    name: string,
-    ecosystem: DependencyInfo['ecosystem']
-  ): Promise<boolean> {
-    try {
-      if (ecosystem === 'npm') {
-        // Query npm registry for deprecation notice
-        const response = await httpGet<{ deprecated?: string }>(
-          `https://registry.npmjs.org/${encodeURIComponent(name)}/latest`
-        );
-
-        if (response.ok && response.data.deprecated) {
-          return true;
-        }
-      }
-      // Additional registries would be implemented similarly
-    } catch (error) {
-      console.error(`Failed to check deprecation for ${name}:`, error);
-    }
-
-    return false;
-  }
-
-  private determineUpdateType(
-    current: string,
-    latest: string
-  ): 'major' | 'minor' | 'patch' {
-    const currentParts = current.split('.').map(Number);
-    const latestParts = latest.split('.').map(Number);
-
-    if (latestParts[0] > currentParts[0]) return 'major';
-    if (latestParts[1] > currentParts[1]) return 'minor';
-    return 'patch';
-  }
-
-  private hasBreakingChanges(current: string, latest: string): boolean {
-    const currentMajor = parseInt(current.split('.')[0]);
-    const latestMajor = parseInt(latest.split('.')[0]);
-    return latestMajor > currentMajor;
-  }
-
-  private createDependencySummary(
-    vulnerabilities: Vulnerability[],
-    totalDeps: number
-  ): ScanSummary {
-    // Count vulnerabilities by severity
-    let critical = 0;
-    let high = 0;
-    let medium = 0;
-    let low = 0;
-    let informational = 0;
-
-    for (const vuln of vulnerabilities) {
-      switch (vuln.severity) {
-        case 'critical':
-          critical++;
-          break;
-        case 'high':
-          high++;
-          break;
-        case 'medium':
-          medium++;
-          break;
-        case 'low':
-          low++;
-          break;
-        case 'informational':
-          informational++;
-          break;
-      }
-    }
-
-    return {
-      critical,
-      high,
-      medium,
-      low,
-      informational,
-      totalFiles: totalDeps,
-      scanDurationMs: 0,
-    };
-  }
-
-  private shouldExclude(filePath: string): boolean {
-    return this.config.excludePatterns.some((pattern) => {
-      if (pattern.startsWith('*')) {
-        return filePath.endsWith(pattern.slice(1));
-      }
-      return filePath.includes(pattern);
-    });
-  }
-
-  private async scanFileForSecrets(file: FilePath): Promise<DetectedSecret[]> {
-    const secrets: DetectedSecret[] = [];
-
-    try {
-      // Read the file content
-      const content = await fs.readFile(file.value, 'utf-8');
-      const lines = content.split('\n');
-
-      // Comprehensive secret detection patterns
-      const secretPatterns: Array<{
-        name: string;
-        type: DetectedSecret['type'];
-        regex: RegExp;
-        entropyThreshold?: number;
-      }> = [
-        // AWS Keys
-        {
-          name: 'AWS Access Key ID',
-          type: 'api-key',
-          regex: /AKIA[0-9A-Z]{16}/g,
-        },
-        {
-          name: 'AWS Secret Access Key',
-          type: 'api-key',
-          regex: /(?:aws[_-]?secret[_-]?access[_-]?key|AWS_SECRET_ACCESS_KEY)['"]?\s*[:=]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gi,
-          entropyThreshold: 4.0,
-        },
-        // GitHub Tokens
-        {
-          name: 'GitHub Personal Access Token',
-          type: 'token',
-          regex: /ghp_[A-Za-z0-9]{36}/g,
-        },
-        {
-          name: 'GitHub OAuth Access Token',
-          type: 'token',
-          regex: /gho_[A-Za-z0-9]{36}/g,
-        },
-        {
-          name: 'GitHub App Token',
-          type: 'token',
-          regex: /(?:ghu|ghs)_[A-Za-z0-9]{36}/g,
-        },
-        // Generic API Keys
-        {
-          name: 'Generic API Key',
-          type: 'api-key',
-          regex: /(?:api[_-]?key|apikey|api_secret)['"]?\s*[:=]\s*['"]([A-Za-z0-9_\-]{20,})['"]?/gi,
-          entropyThreshold: 3.5,
-        },
-        // OpenAI API Key
-        {
-          name: 'OpenAI API Key',
-          type: 'api-key',
-          regex: /sk-[A-Za-z0-9]{48}/g,
-        },
-        // Stripe Keys
-        {
-          name: 'Stripe Secret Key',
-          type: 'api-key',
-          regex: /sk_live_[A-Za-z0-9]{24,}/g,
-        },
-        {
-          name: 'Stripe Publishable Key',
-          type: 'api-key',
-          regex: /pk_live_[A-Za-z0-9]{24,}/g,
-        },
-        // Private Keys
-        {
-          name: 'RSA Private Key',
-          type: 'private-key',
-          regex: /-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/gi,
-        },
-        {
-          name: 'PGP Private Key',
-          type: 'private-key',
-          regex: /-----BEGIN\s+PGP\s+PRIVATE\s+KEY\s+BLOCK-----/gi,
-        },
-        {
-          name: 'SSH Private Key',
-          type: 'private-key',
-          regex: /-----BEGIN\s+(?:OPENSSH|DSA|EC)?\s*PRIVATE\s+KEY-----/gi,
-        },
-        // Passwords
-        {
-          name: 'Password Assignment',
-          type: 'password',
-          regex: /(?:password|passwd|pwd|secret)['"]?\s*[:=]\s*['"]([^'"\s]{8,})['"]?/gi,
-          entropyThreshold: 3.0,
-        },
-        // Database Connection Strings
-        {
-          name: 'Database Connection String',
-          type: 'password',
-          regex: /(?:mongodb|postgres|mysql|redis):\/\/[^:]+:[^@]+@[^\s'"]+/gi,
-        },
-        // JWT Tokens
-        {
-          name: 'JWT Token',
-          type: 'token',
-          regex: /eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*/g,
-          entropyThreshold: 4.0,
-        },
-        // Slack Tokens
-        {
-          name: 'Slack Token',
-          type: 'token',
-          regex: /xox[baprs]-[A-Za-z0-9-]{10,}/g,
-        },
-        // Google API Key
-        {
-          name: 'Google API Key',
-          type: 'api-key',
-          regex: /AIza[A-Za-z0-9_-]{35}/g,
-        },
-        // Twilio
-        {
-          name: 'Twilio API Key',
-          type: 'api-key',
-          regex: /SK[A-Za-z0-9]{32}/g,
-        },
-        // SendGrid
-        {
-          name: 'SendGrid API Key',
-          type: 'api-key',
-          regex: /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g,
-        },
-        // Certificates
-        {
-          name: 'X.509 Certificate',
-          type: 'certificate',
-          regex: /-----BEGIN\s+CERTIFICATE-----/gi,
-        },
-      ];
-
-      // Scan each line for secrets
-      for (let lineIndex = 0; lineIndex < lines.length; lineIndex++) {
-        const line = lines[lineIndex];
-        const lineNumber = lineIndex + 1;
-
-        for (const pattern of secretPatterns) {
-          // Reset regex lastIndex for global patterns
-          pattern.regex.lastIndex = 0;
-
-          let match: RegExpExecArray | null;
-          while ((match = pattern.regex.exec(line)) !== null) {
-            const matchedValue = match[1] || match[0];
-
-            // Calculate entropy if threshold is specified
-            const entropy = this.calculateEntropy(matchedValue);
-
-            // Skip low-entropy matches if threshold is specified
-            if (pattern.entropyThreshold && entropy < pattern.entropyThreshold) {
-              continue;
-            }
-
-            // Create masked snippet (show context but mask the actual secret)
-            const snippet = this.createMaskedSnippet(line, match.index, matchedValue.length);
-
-            const location: VulnerabilityLocation = {
-              file: file.value,
-              line: lineNumber,
-              column: match.index + 1,
-              snippet,
-            };
-
-            secrets.push({
-              type: pattern.type,
-              location,
-              entropy,
-              isValid: this.validateSecret(pattern.type, matchedValue),
-            });
-          }
-        }
-      }
-    } catch (error) {
-      // File reading error - skip this file
-      console.error(`Failed to scan file for secrets: ${file.value}`, error);
-    }
-
-    return secrets;
-  }
-
-  /**
-   * Calculate Shannon entropy of a string
-   */
-  private calculateEntropy(str: string): number {
-    if (!str || str.length === 0) return 0;
-
-    const charFrequency: Record<string, number> = {};
-
-    for (const char of str) {
-      charFrequency[char] = (charFrequency[char] || 0) + 1;
-    }
-
-    let entropy = 0;
-    const len = str.length;
-
-    for (const char in charFrequency) {
-      const probability = charFrequency[char] / len;
-      entropy -= probability * Math.log2(probability);
-    }
-
-    return entropy;
-  }
-
-  /**
-   * Create a masked snippet for display
-   */
-  private createMaskedSnippet(line: string, matchIndex: number, matchLength: number): string {
-    const contextBefore = 20;
-    const contextAfter = 10;
-
-    const start = Math.max(0, matchIndex - contextBefore);
-    const end = Math.min(line.length, matchIndex + matchLength + contextAfter);
-
-    let snippet = line.substring(start, end);
-
-    // Mask the secret value (show first 4 and last 4 characters)
-    const secretStart = matchIndex - start;
-    const secretInSnippet = snippet.substring(secretStart, secretStart + matchLength);
-
-    if (secretInSnippet.length > 8) {
-      const masked = secretInSnippet.substring(0, 4) + '...' + secretInSnippet.substring(secretInSnippet.length - 4);
-      snippet = snippet.substring(0, secretStart) + masked + snippet.substring(secretStart + matchLength);
-    }
-
-    if (start > 0) snippet = '...' + snippet;
-    if (end < line.length) snippet = snippet + '...';
-
-    return snippet;
-  }
-
-  /**
-   * Validate if a detected secret is likely valid (basic validation)
-   */
-  private validateSecret(type: DetectedSecret['type'], value: string): boolean {
-    // Basic validation - in production, could do more sophisticated checks
-    switch (type) {
-      case 'api-key':
-        // Check minimum length and character variety
-        return value.length >= 20 && /[a-z]/.test(value) && /[A-Z0-9]/.test(value);
-      case 'token':
-        return value.length >= 20;
-      case 'password':
-        // Likely not a placeholder password
-        return !['password', 'secret', 'changeme', '12345678', 'qwerty'].includes(value.toLowerCase());
-      case 'private-key':
-        return true; // Private key headers are already specific
-      case 'certificate':
-        return true;
-      default:
-        return true;
-    }
-  }
-
-  /**
-   * Perform SAST scan using AST-based analysis for JavaScript/TypeScript
-   * Scans for common vulnerability patterns: XSS, SQL injection, command injection, path traversal
-   */
-  private async performSASTScan(): Promise<SASTResult> {
-    const scanId = uuidv4();
-    const startTime = Date.now();
-    const vulnerabilities: Vulnerability[] = [];
-    let filesScanned = 0;
-    let linesScanned = 0;
-
-    try {
-      // Find source files to scan
-      const sourceFiles = await this.findSourceFiles(process.cwd());
-
-      // Define vulnerability patterns for AST-like analysis
-      const vulnerabilityPatterns: Array<{
-        id: string;
-        pattern: RegExp;
-        title: string;
-        description: string;
-        severity: VulnerabilitySeverity;
-        category: VulnerabilityCategory;
-        remediation: string;
-        fixExample?: string;
-        cweId: string;
-      }> = [
-        // SQL Injection patterns
-        {
-          id: 'sqli-concat',
-          pattern: /(?:query|execute|exec|run)\s*\(\s*(?:['"`].*?\s*\+|`[^`]*\$\{)/gi,
-          title: 'SQL Injection via String Concatenation',
-          description: 'SQL query constructed using string concatenation with potentially untrusted input',
-          severity: 'critical',
-          category: 'injection',
-          remediation: 'Use parameterized queries or prepared statements',
-          fixExample: 'db.query("SELECT * FROM users WHERE id = $1", [userId])',
-          cweId: 'CWE-89',
-        },
-        // XSS patterns
-        {
-          id: 'xss-innerhtml',
-          pattern: /\.innerHTML\s*=\s*(?!['"`])/g,
-          title: 'XSS via innerHTML Assignment',
-          description: 'Direct innerHTML assignment with potentially unsanitized content',
-          severity: 'high',
-          category: 'xss',
-          remediation: 'Use textContent for text, or sanitize HTML with DOMPurify',
-          fixExample: 'element.textContent = userInput;',
-          cweId: 'CWE-79',
-        },
-        {
-          id: 'xss-document-write',
-          pattern: /document\.write\s*\([^)]+\)/g,
-          title: 'XSS via document.write',
-          description: 'document.write() can execute scripts from untrusted data',
-          severity: 'high',
-          category: 'xss',
-          remediation: 'Avoid document.write(); use DOM manipulation methods',
-          cweId: 'CWE-79',
-        },
-        {
-          id: 'xss-eval',
-          pattern: /(?<!\.)\beval\s*\([^)]+\)/g,
-          title: 'Code Injection via eval()',
-          description: 'eval() executes arbitrary code and is a major security risk',
-          severity: 'critical',
-          category: 'xss',
-          remediation: 'Never use eval(); use JSON.parse() for JSON data',
-          fixExample: 'JSON.parse(jsonString)',
-          cweId: 'CWE-95',
-        },
-        {
-          id: 'xss-dangerous-react',
-          pattern: /dangerouslySetInnerHTML\s*=\s*\{/g,
-          title: 'React dangerouslySetInnerHTML Usage',
-          description: 'dangerouslySetInnerHTML bypasses React XSS protections',
-          severity: 'medium',
-          category: 'xss',
-          remediation: 'Sanitize HTML content with DOMPurify before use',
-          fixExample: 'dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(content) }}',
-          cweId: 'CWE-79',
-        },
-        // Command Injection patterns
-        {
-          id: 'cmd-injection-exec',
-          pattern: /(?:child_process\.)?exec\s*\(\s*(?:[^,)]*\s*\+|`[^`]*\$\{)/g,
-          title: 'Command Injection via exec()',
-          description: 'Shell command execution with unsanitized input',
-          severity: 'critical',
-          category: 'injection',
-          remediation: 'Use execFile() with argument array instead of exec()',
-          fixExample: 'execFile("command", [arg1, arg2], callback)',
-          cweId: 'CWE-78',
-        },
-        {
-          id: 'cmd-injection-spawn-shell',
-          pattern: /spawn\s*\([^)]+,\s*\{[^}]*shell\s*:\s*true/g,
-          title: 'Dangerous Shell Option in spawn()',
-          description: 'spawn() with shell: true can enable command injection',
-          severity: 'high',
-          category: 'injection',
-          remediation: 'Avoid shell: true option; use direct command execution',
-          cweId: 'CWE-78',
-        },
-        // Path Traversal patterns
-        {
-          id: 'path-traversal-readfile',
-          pattern: /(?:readFile|readFileSync)\s*\([^)]*\+/g,
-          title: 'Path Traversal via File Read',
-          description: 'File read operation with concatenated path may allow directory traversal',
-          severity: 'high',
-          category: 'access-control',
-          remediation: 'Validate and sanitize file paths; use path.resolve() and check against base directory',
-          fixExample: 'const safePath = path.resolve(baseDir, path.basename(userInput))',
-          cweId: 'CWE-22',
-        },
-        {
-          id: 'path-traversal-writefile',
-          pattern: /(?:writeFile|writeFileSync)\s*\([^)]*\+/g,
-          title: 'Path Traversal via File Write',
-          description: 'File write operation with concatenated path may allow directory traversal',
-          severity: 'high',
-          category: 'access-control',
-          remediation: 'Validate file paths before writing; ensure path is within allowed directory',
-          cweId: 'CWE-22',
-        },
-        // Hardcoded secrets
-        {
-          id: 'secret-private-key',
-          pattern: /-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/g,
-          title: 'Private Key Detected in Source',
-          description: 'Private key found in source code',
-          severity: 'critical',
-          category: 'sensitive-data',
-          remediation: 'Store private keys in secure key management systems, not in code',
-          cweId: 'CWE-798',
-        },
-        // Insecure configurations
-        {
-          id: 'config-tls-disabled',
-          pattern: /rejectUnauthorized\s*:\s*false/g,
-          title: 'TLS Certificate Validation Disabled',
-          description: 'Disabling TLS certificate validation exposes to MITM attacks',
-          severity: 'high',
-          category: 'security-misconfiguration',
-          remediation: 'Always enable TLS certificate validation in production',
-          cweId: 'CWE-295',
-        },
-        {
-          id: 'config-cors-wildcard',
-          pattern: /cors\s*\(\s*\{[^}]*origin\s*:\s*['"]\*['"]/gi,
-          title: 'Permissive CORS Configuration',
-          description: 'CORS allows all origins (*) which may expose sensitive data',
-          severity: 'medium',
-          category: 'security-misconfiguration',
-          remediation: 'Restrict CORS to specific trusted origins',
-          fixExample: 'cors({ origin: ["https://trusted-domain.com"] })',
-          cweId: 'CWE-942',
-        },
-      ];
-
-      for (const filePath of sourceFiles) {
-        if (this.shouldExclude(filePath)) {
-          continue;
-        }
-
-        // Only scan JS/TS files
-        const ext = path.extname(filePath).toLowerCase();
-        if (!['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs'].includes(ext)) {
-          continue;
-        }
-
-        try {
-          const content = await fs.readFile(filePath, 'utf-8');
-          const lines = content.split('\n');
-          filesScanned++;
-          linesScanned += lines.length;
-
-          // Check each vulnerability pattern
-          for (const vulnPattern of vulnerabilityPatterns) {
-            // Reset regex state
-            vulnPattern.pattern.lastIndex = 0;
-            let match: RegExpExecArray | null;
-
-            while ((match = vulnPattern.pattern.exec(content)) !== null) {
-              // Calculate line and column
-              const beforeMatch = content.substring(0, match.index);
-              const linesBefore = beforeMatch.split('\n');
-              const lineNumber = linesBefore.length;
-              const column = linesBefore[linesBefore.length - 1].length + 1;
-
-              // Check if in comment
-              const currentLine = lines[lineNumber - 1] || '';
-              if (currentLine.trimStart().startsWith('//') || currentLine.trimStart().startsWith('*')) {
-                continue;
-              }
-
-              // Check for nosec annotation
-              if (currentLine.includes('// nosec') || currentLine.includes('// security-ignore')) {
-                continue;
-              }
-
-              // Extract snippet with context
-              const startLine = Math.max(0, lineNumber - 2);
-              const endLine = Math.min(lines.length, lineNumber + 1);
-              const snippet = lines.slice(startLine, endLine).join('\n');
-
-              const location: VulnerabilityLocation = {
-                file: filePath,
-                line: lineNumber,
-                column,
-                snippet,
-              };
-
-              const remediation: RemediationAdvice = {
-                description: vulnPattern.remediation,
-                fixExample: vulnPattern.fixExample,
-                estimatedEffort: vulnPattern.severity === 'critical' ? 'moderate' : 'minor',
-                automatable: vulnPattern.severity === 'low' || vulnPattern.severity === 'medium',
-              };
-
-              vulnerabilities.push({
-                id: uuidv4(),
-                cveId: undefined,
-                title: vulnPattern.title,
-                description: `${vulnPattern.description} [${vulnPattern.cweId}]`,
-                severity: vulnPattern.severity,
-                category: vulnPattern.category,
-                location,
-                remediation,
-                references: [
-                  `https://cwe.mitre.org/data/definitions/${vulnPattern.cweId.replace('CWE-', '')}.html`,
-                ],
-              });
-            }
-          }
-        } catch {
-          // Skip files that can't be read
-        }
-      }
-    } catch (error) {
-      console.error('SAST scan failed:', error);
-    }
-
-    const scanDurationMs = Date.now() - startTime;
-
-    // Calculate summary
-    let critical = 0, high = 0, medium = 0, low = 0, informational = 0;
-    for (const vuln of vulnerabilities) {
-      switch (vuln.severity) {
-        case 'critical': critical++; break;
-        case 'high': high++; break;
-        case 'medium': medium++; break;
-        case 'low': low++; break;
-        case 'informational': informational++; break;
-      }
-    }
-
-    return {
-      scanId,
-      vulnerabilities,
-      summary: {
-        critical,
-        high,
-        medium,
-        low,
-        informational,
-        totalFiles: filesScanned,
-        scanDurationMs,
-      },
-      coverage: {
-        filesScanned,
-        linesScanned,
-        rulesApplied: 12, // Number of vulnerability patterns
-      },
-    };
-  }
-
-  /**
-   * Perform DAST scan using HTTP requests to test for vulnerabilities
-   * Tests for common web vulnerabilities: XSS, SQL injection, security headers, etc.
-   */
-  private async performDASTScan(targetUrl: string): Promise<DASTResult> {
-    const scanId = uuidv4();
-    const startTime = Date.now();
-    const vulnerabilities: Vulnerability[] = [];
-    let crawledUrls = 0;
-
-    try {
-      // Validate URL
-      let parsedUrl: URL;
-      try {
-        parsedUrl = new URL(targetUrl);
-      } catch {
-        return {
-          scanId,
-          targetUrl,
-          vulnerabilities: [{
-            id: uuidv4(),
-            title: 'Invalid Target URL',
-            description: 'The provided target URL is not valid',
-            severity: 'informational',
-            category: 'security-misconfiguration',
-            location: { file: targetUrl },
-            remediation: { description: 'Provide a valid URL', estimatedEffort: 'trivial', automatable: false },
-            references: [],
-          }],
-          summary: { critical: 0, high: 0, medium: 0, low: 0, informational: 1, totalFiles: 0, scanDurationMs: Date.now() - startTime },
-          crawledUrls: 0,
-        };
-      }
-
-      // Perform HTTP request to check security headers and response characteristics
-      const controller = new AbortController();
-      const timeoutId = setTimeout(() => controller.abort(), 30000); // 30s timeout
-
-      try {
-        const response = await fetch(targetUrl, {
-          method: 'GET',
-          headers: {
-            'User-Agent': 'AgenticQE-SecurityScanner/3.0',
-            'Accept': 'text/html,application/json,*/*',
-          },
-          signal: controller.signal,
-          redirect: 'follow',
-        });
-
-        clearTimeout(timeoutId);
-        crawledUrls = 1;
-
-        // Check security headers
-        const headers = response.headers;
-
-        // Check for missing security headers
-        const securityHeaderChecks: Array<{
-          header: string;
-          title: string;
-          description: string;
-          severity: VulnerabilitySeverity;
-          remediation: string;
-        }> = [
-          {
-            header: 'strict-transport-security',
-            title: 'Missing HTTP Strict Transport Security (HSTS)',
-            description: 'HSTS header is missing, allowing downgrade attacks',
-            severity: 'medium',
-            remediation: 'Add Strict-Transport-Security header with appropriate max-age',
-          },
-          {
-            header: 'x-content-type-options',
-            title: 'Missing X-Content-Type-Options Header',
-            description: 'X-Content-Type-Options header is missing, allowing MIME sniffing attacks',
-            severity: 'low',
-            remediation: 'Add X-Content-Type-Options: nosniff header',
-          },
-          {
-            header: 'x-frame-options',
-            title: 'Missing X-Frame-Options Header',
-            description: 'X-Frame-Options header is missing, allowing clickjacking attacks',
-            severity: 'medium',
-            remediation: 'Add X-Frame-Options: DENY or SAMEORIGIN header',
-          },
-          {
-            header: 'content-security-policy',
-            title: 'Missing Content Security Policy',
-            description: 'CSP header is missing, increasing XSS attack surface',
-            severity: 'medium',
-            remediation: 'Implement a Content-Security-Policy header',
-          },
-          {
-            header: 'x-xss-protection',
-            title: 'Missing X-XSS-Protection Header',
-            description: 'X-XSS-Protection header is missing (legacy XSS filter)',
-            severity: 'low',
-            remediation: 'Add X-XSS-Protection: 1; mode=block header',
-          },
-        ];
-
-        for (const check of securityHeaderChecks) {
-          if (!headers.get(check.header)) {
-            vulnerabilities.push({
-              id: uuidv4(),
-              title: check.title,
-              description: check.description,
-              severity: check.severity,
-              category: 'security-misconfiguration',
-              location: {
-                file: targetUrl,
-                snippet: `Response Headers: ${check.header} not present`,
-              },
-              remediation: {
-                description: check.remediation,
-                estimatedEffort: 'minor',
-                automatable: true,
-              },
-              references: [
-                'https://owasp.org/www-project-secure-headers/',
-              ],
-            });
-          }
-        }
-
-        // Check for insecure cookies
-        const cookies = headers.get('set-cookie');
-        if (cookies) {
-          if (!cookies.toLowerCase().includes('secure')) {
-            vulnerabilities.push({
-              id: uuidv4(),
-              title: 'Cookie Without Secure Flag',
-              description: 'Session cookie is set without the Secure flag',
-              severity: 'medium',
-              category: 'sensitive-data',
-              location: { file: targetUrl, snippet: `Set-Cookie: ${cookies.substring(0, 50)}...` },
-              remediation: { description: 'Add Secure flag to cookies', estimatedEffort: 'trivial', automatable: true },
-              references: ['https://owasp.org/www-community/controls/SecureCookieAttribute'],
-            });
-          }
-          if (!cookies.toLowerCase().includes('httponly')) {
-            vulnerabilities.push({
-              id: uuidv4(),
-              title: 'Cookie Without HttpOnly Flag',
-              description: 'Session cookie is set without the HttpOnly flag, making it accessible to JavaScript',
-              severity: 'medium',
-              category: 'sensitive-data',
-              location: { file: targetUrl, snippet: `Set-Cookie: ${cookies.substring(0, 50)}...` },
-              remediation: { description: 'Add HttpOnly flag to session cookies', estimatedEffort: 'trivial', automatable: true },
-              references: ['https://owasp.org/www-community/HttpOnly'],
-            });
-          }
-          if (!cookies.toLowerCase().includes('samesite')) {
-            vulnerabilities.push({
-              id: uuidv4(),
-              title: 'Cookie Without SameSite Attribute',
-              description: 'Cookie is set without the SameSite attribute, potentially vulnerable to CSRF',
-              severity: 'low',
-              category: 'broken-auth',
-              location: { file: targetUrl, snippet: `Set-Cookie: ${cookies.substring(0, 50)}...` },
-              remediation: { description: 'Add SameSite=Strict or SameSite=Lax to cookies', estimatedEffort: 'trivial', automatable: true },
-              references: ['https://owasp.org/www-community/SameSite'],
-            });
-          }
-        }
-
-        // Check for server information disclosure
-        const server = headers.get('server');
-        if (server && /[0-9]+\.[0-9]+/.test(server)) {
-          vulnerabilities.push({
-            id: uuidv4(),
-            title: 'Server Version Disclosure',
-            description: `Server header reveals version information: ${server}`,
-            severity: 'low',
-            category: 'security-misconfiguration',
-            location: { file: targetUrl, snippet: `Server: ${server}` },
-            remediation: { description: 'Remove or obfuscate server version information', estimatedEffort: 'trivial', automatable: true },
-            references: ['https://owasp.org/www-project-web-security-testing-guide/'],
-          });
-        }
-
-        // Check for HTTPS
-        if (parsedUrl.protocol === 'http:') {
-          vulnerabilities.push({
-            id: uuidv4(),
-            title: 'Insecure HTTP Protocol',
-            description: 'Target is using HTTP instead of HTTPS, exposing data in transit',
-            severity: 'high',
-            category: 'sensitive-data',
-            location: { file: targetUrl },
-            remediation: { description: 'Use HTTPS with valid TLS certificate', estimatedEffort: 'moderate', automatable: false },
-            references: ['https://owasp.org/www-project-web-security-testing-guide/'],
-          });
-        }
-
-        // Try common test endpoints for additional checks
-        const testEndpoints = [
-          { path: '/.git/config', vuln: 'Git Repository Exposed', severity: 'high' as VulnerabilitySeverity },
-          { path: '/.env', vuln: 'Environment File Exposed', severity: 'critical' as VulnerabilitySeverity },
-          { path: '/phpinfo.php', vuln: 'PHP Info Exposed', severity: 'medium' as VulnerabilitySeverity },
-          { path: '/wp-config.php.bak', vuln: 'WordPress Config Backup Exposed', severity: 'critical' as VulnerabilitySeverity },
-        ];
-
-        for (const endpoint of testEndpoints) {
-          try {
-            const testUrl = new URL(endpoint.path, parsedUrl.origin).toString();
-            const testResponse = await fetch(testUrl, {
-              method: 'GET',
-              signal: AbortSignal.timeout(5000),
-            });
-
-            if (testResponse.ok && testResponse.status === 200) {
-              const text = await testResponse.text();
-              // Verify it's actually the sensitive content, not a custom 404
-              if (text.length > 10 && !text.toLowerCase().includes('not found')) {
-                crawledUrls++;
-                vulnerabilities.push({
-                  id: uuidv4(),
-                  title: endpoint.vuln,
-                  description: `Sensitive file found at ${endpoint.path}`,
-                  severity: endpoint.severity,
-                  category: 'sensitive-data',
-                  location: { file: testUrl },
-                  remediation: { description: 'Remove or restrict access to sensitive files', estimatedEffort: 'trivial', automatable: true },
-                  references: ['https://owasp.org/www-project-web-security-testing-guide/'],
-                });
-              }
-            }
-          } catch {
-            // Endpoint not accessible, which is expected/good
-          }
-        }
-
-      } catch (fetchError) {
-        clearTimeout(timeoutId);
-        const errorMessage = fetchError instanceof Error ? fetchError.message : String(fetchError);
-
-        // Network errors might indicate issues
-        if (errorMessage.includes('certificate') || errorMessage.includes('SSL') || errorMessage.includes('TLS')) {
-          vulnerabilities.push({
-            id: uuidv4(),
-            title: 'TLS/SSL Certificate Issue',
-            description: `Certificate error: ${errorMessage}`,
-            severity: 'high',
-            category: 'security-misconfiguration',
-            location: { file: targetUrl },
-            remediation: { description: 'Fix TLS certificate configuration', estimatedEffort: 'moderate', automatable: false },
-            references: ['https://owasp.org/www-project-web-security-testing-guide/'],
-          });
-        }
-      }
-
-    } catch (error) {
-      console.error('DAST scan failed:', error);
-    }
-
-    const scanDurationMs = Date.now() - startTime;
-
-    // Calculate summary
-    let critical = 0, high = 0, medium = 0, low = 0, informational = 0;
-    for (const vuln of vulnerabilities) {
-      switch (vuln.severity) {
-        case 'critical': critical++; break;
-        case 'high': high++; break;
-        case 'medium': medium++; break;
-        case 'low': low++; break;
-        case 'informational': informational++; break;
-      }
-    }
-
-    return {
-      scanId,
-      targetUrl,
-      vulnerabilities,
-      summary: {
-        critical,
-        high,
-        medium,
-        low,
-        informational,
-        totalFiles: 1,
-        scanDurationMs,
-      },
-      crawledUrls,
-    };
-  }
-
-  /**
-   * Perform dependency scan using OSV API
-   */
-  private async performDependencyScan(): Promise<DependencyScanResult> {
-    const startTime = Date.now();
-    const vulnerabilities: Vulnerability[] = [];
-    const outdatedPackages: OutdatedPackage[] = [];
-
-    try {
-      // Look for package.json in current working directory
-      const manifestPath = path.join(process.cwd(), 'package.json');
-      const dependencies = await this.parseDependencies(manifestPath, 'npm');
-
-      for (const dep of dependencies) {
-        // Check for vulnerabilities via OSV API
-        const vulns = await this.checkDependencyVulnerabilities(dep, dep.ecosystem);
-        vulnerabilities.push(...vulns);
-
-        // Check for outdated packages
-        const outdated = await this.checkOutdated(dep);
-        if (outdated) {
-          outdatedPackages.push(outdated);
-        }
-      }
-
-      const scanDurationMs = Date.now() - startTime;
-      const baseSummary = this.createDependencySummary(vulnerabilities, dependencies.length);
-
-      return {
-        vulnerabilities,
-        outdatedPackages,
-        summary: {
-          ...baseSummary,
-          scanDurationMs,
-        },
-      };
-    } catch (error) {
-      console.error('Dependency scan failed:', error);
-      return {
-        vulnerabilities: [],
-        outdatedPackages: [],
-        summary: {
-          critical: 0,
-          high: 0,
-          medium: 0,
-          low: 0,
-          informational: 0,
-          totalFiles: 0,
-          scanDurationMs: Date.now() - startTime,
-        },
-      };
-    }
-  }
-
-  /**
-   * Perform secret scan on source files
-   */
-  private async performSecretScan(): Promise<SecretScanResult> {
-    const secretsFound: DetectedSecret[] = [];
-    let filesScanned = 0;
-
-    try {
-      // Get list of source files to scan
-      const sourceFiles = await this.findSourceFiles(process.cwd());
-
-      for (const filePath of sourceFiles) {
-        if (this.shouldExclude(filePath)) {
-          continue;
-        }
-
-        filesScanned++;
-        const filePathObj = { value: filePath } as FilePath;
-        const secrets = await this.scanFileForSecrets(filePathObj);
-        secretsFound.push(...secrets);
-      }
-    } catch (error) {
-      console.error('Secret scan failed:', error);
-    }
-
-    return {
-      secretsFound,
-      filesScanned,
-    };
-  }
-
-  /**
-   * Find source files in a directory (recursively)
-   */
-  private async findSourceFiles(dir: string, files: string[] = []): Promise<string[]> {
-    const sourceExtensions = ['.ts', '.js', '.tsx', '.jsx', '.json', '.env', '.yaml', '.yml', '.config'];
-
-    try {
-      const entries = await fs.readdir(dir, { withFileTypes: true });
-
-      for (const entry of entries) {
-        const fullPath = path.join(dir, entry.name);
-
-        // Skip excluded directories
-        if (this.shouldExclude(fullPath)) {
-          continue;
-        }
-
-        if (entry.isDirectory()) {
-          await this.findSourceFiles(fullPath, files);
-        } else if (entry.isFile()) {
-          const ext = path.extname(entry.name).toLowerCase();
-          if (sourceExtensions.includes(ext) || entry.name.startsWith('.env')) {
-            files.push(fullPath);
-          }
-        }
-      }
-    } catch (error) {
-      // Silently skip directories we can't read
-    }
-
-    return files;
-  }
-
-  private calculateOverallRisk(
-    sast?: SASTResult,
-    dast?: DASTResult,
-    deps?: DependencyScanResult,
-    secrets?: SecretScanResult
-  ): RiskScore {
-    let riskValue = 0;
-    let weights = 0;
-
-    if (sast) {
-      riskValue +=
-        this.calculateScanRisk(sast.summary) * 0.35;
-      weights += 0.35;
-    }
-
-    if (dast) {
-      riskValue +=
-        this.calculateScanRisk(dast.summary) * 0.25;
-      weights += 0.25;
-    }
-
-    if (deps) {
-      riskValue +=
-        this.calculateScanRisk(deps.summary) * 0.25;
-      weights += 0.25;
-    }
-
-    if (secrets) {
-      const secretRisk = secrets.secretsFound.length > 0 ? 0.9 : 0.1;
-      riskValue += secretRisk * 0.15;
-      weights += 0.15;
-    }
-
-    const normalizedRisk = weights > 0 ? riskValue / weights : 0;
-
-    // Return RiskScore-compatible object
-    return {
-      value: Math.min(1, normalizedRisk),
-      percentage: normalizedRisk * 100,
-      level: normalizedRisk >= 0.8 ? 'critical' :
-             normalizedRisk >= 0.6 ? 'high' :
-             normalizedRisk >= 0.3 ? 'medium' : 'low',
-    } as unknown as RiskScore;
-  }
-
-  private calculateScanRisk(summary: ScanSummary): number {
-    const weights = {
-      critical: 1.0,
-      high: 0.7,
-      medium: 0.4,
-      low: 0.1,
-      informational: 0.02,
-    };
-
-    const totalIssues =
-      summary.critical +
-      summary.high +
-      summary.medium +
-      summary.low +
-      summary.informational;
-
-    if (totalIssues === 0) return 0;
-
-    const weightedSum =
-      summary.critical * weights.critical +
-      summary.high * weights.high +
-      summary.medium * weights.medium +
-      summary.low * weights.low +
-      summary.informational * weights.informational;
-
-    return Math.min(1, weightedSum / 10);
-  }
-
-  private generateRecommendations(
-    sast?: SASTResult,
-    dast?: DASTResult,
-    deps?: DependencyScanResult,
-    secrets?: SecretScanResult
-  ): string[] {
-    const recommendations: string[] = [];
-
-    if (sast && sast.summary.critical > 0) {
-      recommendations.push(
-        `Address ${sast.summary.critical} critical vulnerabilities found in static analysis`
-      );
-    }
-
-    if (dast && dast.summary.high > 0) {
-      recommendations.push(
-        `Fix ${dast.summary.high} high-severity issues found in dynamic testing`
-      );
-    }
-
-    if (deps && deps.outdatedPackages.length > 5) {
-      recommendations.push(
-        `Update ${deps.outdatedPackages.length} outdated dependencies`
-      );
-    }
-
-    if (secrets && secrets.secretsFound.length > 0) {
-      recommendations.push(
-        `Remove ${secrets.secretsFound.length} exposed secrets and rotate credentials`
-      );
-    }
-
-    if (recommendations.length === 0) {
-      recommendations.push('Security posture is good. Continue regular scanning.');
-    }
-
-    return recommendations;
-  }
-
-  private async getRecentAudits(): Promise<SecurityAuditReport[]> {
-    // Query recent audits from memory storage
-    const keys = await this.memory.search('security:audit:*', 10);
-    const audits: SecurityAuditReport[] = [];
-
-    for (const key of keys) {
-      const audit = await this.memory.get<SecurityAuditReport>(key);
-      if (audit) {
-        audits.push(audit);
-      }
-    }
-
-    return audits.sort(
-      (a, b) => new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime()
-    );
-  }
-
-  private countBySeverity(
-    audit: SecurityAuditReport | undefined,
-    severity: 'critical' | 'high'
-  ): number {
-    if (!audit) return 0;
-
-    let count = 0;
-    if (audit.sastResults) count += audit.sastResults.summary[severity];
-    if (audit.dastResults) count += audit.dastResults.summary[severity];
-    if (audit.dependencyResults) count += audit.dependencyResults.summary[severity];
-
-    return count;
-  }
-
-  private countOpenVulnerabilities(audit: SecurityAuditReport | undefined): number {
-    if (!audit) return 0;
-
-    let count = 0;
-    if (audit.sastResults) count += audit.sastResults.vulnerabilities.length;
-    if (audit.dastResults) count += audit.dastResults.vulnerabilities.length;
-    if (audit.dependencyResults) count += audit.dependencyResults.vulnerabilities.length;
-
-    return count;
-  }
-
-  private calculateTrend(
-    latest: SecurityAuditReport | undefined,
-    previous: SecurityAuditReport | undefined
-  ): 'improving' | 'stable' | 'declining' {
-    if (!latest || !previous) return 'stable';
-
-    const latestScore = this.countOpenVulnerabilities(latest);
-    const previousScore = this.countOpenVulnerabilities(previous);
-
-    if (latestScore < previousScore * 0.9) return 'improving';
-    if (latestScore > previousScore * 1.1) return 'declining';
-    return 'stable';
-  }
-
-  private calculatePostureScore(
-    critical: number,
-    high: number,
-    open: number
-  ): number {
-    // Start at 100, deduct points for issues
-    let score = 100;
-    score -= critical * 20;
-    score -= high * 10;
-    score -= open * 2;
-    return Math.max(0, Math.min(100, score));
-  }
-
-  private generatePostureRecommendations(
-    critical: number,
-    high: number,
-    score: number
-  ): string[] {
-    const recommendations: string[] = [];
-
-    if (critical > 0) {
-      recommendations.push('Immediately address all critical vulnerabilities');
-    }
-
-    if (high > 3) {
-      recommendations.push('Prioritize fixing high-severity issues');
-    }
-
-    if (score < 50) {
-      recommendations.push('Consider a comprehensive security review');
-      recommendations.push('Implement automated security scanning in CI/CD');
-    }
-
-    if (score >= 80) {
-      recommendations.push('Maintain current security practices');
-      recommendations.push('Consider penetration testing for deeper analysis');
-    }
-
-    return recommendations;
-  }
-
-  /**
-   * Count vulnerabilities resolved in the last week
-   * Calculates by comparing consecutive audit reports
-   */
-  private async countResolvedLastWeek(): Promise<number> {
-    try {
-      const audits = await this.getRecentAudits();
-      if (audits.length < 2) return 0;
-
-      const oneWeekAgo = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000);
-
-      // Find audits from this week
-      const recentAudits = audits.filter(
-        (audit) => new Date(audit.timestamp) >= oneWeekAgo
-      );
-
-      if (recentAudits.length < 2) return 0;
-
-      // Compare vulnerability counts between first and last audit of the week
-      const oldest = recentAudits[recentAudits.length - 1];
-      const newest = recentAudits[0];
-
-      const oldCount = this.countOpenVulnerabilities(oldest);
-      const newCount = this.countOpenVulnerabilities(newest);
-
-      // Resolved = old count - new count (if positive)
-      return Math.max(0, oldCount - newCount);
-    } catch (error) {
-      console.error('Failed to count resolved vulnerabilities:', error);
-      return 0;
-    }
-  }
-
-  /**
-   * Calculate average resolution time from historical audit data
-   */
-  private async calculateAverageResolutionTime(): Promise<number> {
-    try {
-      const audits = await this.getRecentAudits();
-      if (audits.length < 2) return 72; // Default to 72 hours
-
-      // Track vulnerabilities across audits to calculate resolution time
-      const vulnFirstSeen = new Map<string, Date>();
-      const resolutionTimes: number[] = [];
-
-      // Process audits from oldest to newest
-      const sortedAudits = [...audits].reverse();
-
-      for (const audit of sortedAudits) {
-        const currentVulnIds = new Set<string>();
-
-        // Collect all vulnerability IDs in this audit
-        if (audit.sastResults) {
-          audit.sastResults.vulnerabilities.forEach((v) => currentVulnIds.add(v.id));
-        }
-        if (audit.dastResults) {
-          audit.dastResults.vulnerabilities.forEach((v) => currentVulnIds.add(v.id));
-        }
-        if (audit.dependencyResults) {
-          audit.dependencyResults.vulnerabilities.forEach((v) => currentVulnIds.add(v.id));
-        }
-
-        // Track new vulnerabilities
-        for (const vulnId of currentVulnIds) {
-          if (!vulnFirstSeen.has(vulnId)) {
-            vulnFirstSeen.set(vulnId, audit.timestamp);
-          }
-        }
-
-        // Check for resolved vulnerabilities
-        for (const [vulnId, firstSeen] of vulnFirstSeen) {
-          if (!currentVulnIds.has(vulnId)) {
-            const resolutionTime = (audit.timestamp.getTime() - firstSeen.getTime()) / (1000 * 60 * 60);
-            resolutionTimes.push(resolutionTime);
-            vulnFirstSeen.delete(vulnId);
-          }
-        }
-      }
-
-      if (resolutionTimes.length === 0) return 72; // Default
-
-      // Calculate average
-      const sum = resolutionTimes.reduce((acc, time) => acc + time, 0);
-      return Math.round(sum / resolutionTimes.length);
-    } catch (error) {
-      console.error('Failed to calculate average resolution time:', error);
-      return 72; // Default to 72 hours
-    }
-  }
-
-  private determinePriorityBucket(
-    vuln: Vulnerability
-  ): keyof TriagedVulnerabilities {
-    const effort = vuln.remediation.estimatedEffort;
-
-    if (vuln.severity === 'critical') {
-      return 'immediate';
-    }
-
-    if (vuln.severity === 'high') {
-      return effort === 'trivial' || effort === 'minor' ? 'immediate' : 'shortTerm';
-    }
-
-    if (vuln.severity === 'medium') {
-      return effort === 'major' ? 'longTerm' : 'mediumTerm';
-    }
-
-    if (vuln.severity === 'low' || vuln.severity === 'informational') {
-      return 'longTerm';
-    }
-
-    return 'accepted';
-  }
-}