@clear-capabilities/agentic-security-scanner 0.137.0 → 0.139.0

package/src/engine.js

@@ -51,7 +51,9 @@ import { isJavaBarProvablySafe } from './sast/java-constant-fold.js';
 import { findTaintedCollections, extractionFromTaintedCollection } from './sast/java-collection-passthrough.js';
 import { deadBranchRanges as _deadBranchRanges, isLineInDeadRange as _isLineInDeadRange } from './sast/java-ast-folding.js';
 import { scanJavaDeserialization } from './sast/java-deserialization.js';
+import { blankComments } from './sast/_comment-strip.js';
 import { scanJwtExp } from './sast/jwt-exp.js';
+import { scanSiblingGuard } from './sast/sibling-guard.js';
 import { scanZipSlip } from './sast/zip-slip.js';
 import { scanFileUpload } from './sast/file-upload.js';
 import { scanHostHeader } from './sast/host-header.js';
@@ -65,6 +67,11 @@ import { scanRust, extractRustImportMap } from './sast/rust.js';
 import { scanGoExtended } from './sast/go-extended.js';
 import { scanDatabaseRLS } from './sast/db-rls.js';
 import { scanRateLimit } from './sast/rate-limit.js';
+import { scanConventionDeviationProject } from './sast/convention-deviation.js';
+import { scanResourceExhaustion } from './sast/resource-exhaustion.js';
+import { scanRedirectToctou } from './sast/redirect-toctou.js';
+import { scanCodegenSink } from './sast/codegen-sink.js';
+import { scanOwnershipAuthz } from './sast/ownership-authz.js';
 import { scanAuthProvider } from './sast/auth-provider.js';
 import { scanEnvHygiene } from './sast/env-hygiene.js';
 import { scanWebhook } from './sast/webhook.js';
@@ -242,7 +249,59 @@ const localStorage = sessionStorage;
 const DATA_CLASSES={PII:{label:"PII",color:"#c792ea",patterns:["fname","lname","first_name","last_name","surname","full_name","dob","date_of_birth","ssn","social_security","tax_id","national_id","address_line","postal_code","zip_code","home_address","phone","mobile","email","drivers_license","passport_no","voter_id","geolocation","fingerprint","voice_print","dna_sequence","student_id","salary"]},PHI:{label:"PHI",color:"#ff6b9d",patterns:["ehr_id","mrn","medical_record_number","patient_id","patient_name","diagnosis","icd_code","cpt_code","prescription","blood_type","pregnancy_status","disability","mental_health","medical_history","treatment_plan","lab_result","medication","immunization","insurance_plan","policy_number","hipaa","phi"]},PCI:{label:"PCI",color:"#ff6b35",patterns:["pan","credit_card","card_number","cc_num","cardholder_name","cvv","cvc","cvv2","security_code","card_verification","exp_date","card_expiry","track_1","track_2","magstripe","pin_block","routing_number","bank_account","iban","swift_code","account_number"]},Confidential:{label:"Confidential",color:"#ffb800",patterns:["top_secret","secret","confidential","classified","cui","controlled","attorney_client","privileged","trade_secret","proprietary","internal_use_only","do_not_distribute","export_controlled","itar","cjis","password","passwd","api_key","secret_key","access_token","auth_token","connection_string","private_key"]}};
 function classifyField(n){const l=n.toLowerCase().replace(/[-\s]/g,"_");const m=[];for(const[c,info]of Object.entries(DATA_CLASSES))for(const p of info.patterns)if(l.includes(p)){m.push(c);break;}return m;}
 function classifyEndpoint(fields){const c=new Set();for(const f of fields)for(const x of classifyField(f))c.add(x);return[...c];}
-function stripNoise(code){let c=code.replace(/\/\*[\s\S]*?\*\//g,m=>m.replace(/[^\n]/g,' '));c=c.replace(/\/\/[^\n]*/g,m=>' '.repeat(m.length));return c;}
+// Which comment syntax a file uses. This has to be language-aware rather than
+// one regex for every file, because the same two characters mean OPPOSITE
+// things across languages: `#` opens a comment in Python/Ruby/shell but is a
+// preprocessor or region directive in C/C++/C# (`#include`, `#region`), and
+// `//` is a comment in the C family but FLOOR DIVISION in Python. Guessing
+// wrong does not merely leak a false positive — it deletes real code and
+// silently destroys every finding on the rest of the line.
+const _HASH_COMMENT_EXTS = new Set([
+  '.py', '.pyw', '.pyi', '.sh', '.bash', '.zsh',
+  '.yml', '.yaml', '.pl', '.pm', '.ex', '.exs', '.cr', '.nim', '.toml', '.cfg', '.ini',
+]);
+// Ruby: `#` lines plus `=begin`/`=end` blocks.
+const _RUBY_COMMENT_EXTS = new Set(['.rb', '.rake', '.gemspec', '.ru']);
+// PHP and HCL/Terraform accept `//`, `/* */` AND `#` simultaneously.
+const _ALL_COMMENT_EXTS = new Set(['.php', '.php5', '.phtml', '.tf', '.tfvars', '.hcl']);
+function _commentLangFor(fp) {
+  const base = (String(fp || '').toLowerCase().split(/[\\/]/).pop()) || '';
+  if (base === 'dockerfile' || base.startsWith('dockerfile.') || base === 'makefile') return 'py';
+  const dot = base.lastIndexOf('.');
+  const ext = dot > 0 ? base.slice(dot) : '';
+  if (_ALL_COMMENT_EXTS.has(ext)) return 'php';
+  if (_RUBY_COMMENT_EXTS.has(ext)) return 'rb';
+  if (_HASH_COMMENT_EXTS.has(ext)) return 'py';
+  return undefined; // C-family default: `//` and `/* */` only, `#` left alone.
+}
+// Single-entry memo for the comment-blanked view.
+//
+// `stripNoise` is called ~15 times for the SAME file within one pass
+// (performRegexAnalysis, scanRoutes, scanStructuralVulns, scanLogicVulns,
+// scanJavaSAST, scanCiphers, …), and the per-file dispatch computes `cc` on top
+// of that. The old implementation was two native regex replaces, so recomputing
+// was nearly free; `blankComments` is an interpreted character loop, so it is
+// not. Measured on a 307-file entry: 13.4 s → 16.0 s, a 19.7% regression,
+// before this memo.
+//
+// One slot is enough because the engine processes one file at a time, and
+// `fileContents[p]` hands back the SAME string reference on every call — so the
+// `===` guard is a pointer comparison, not a content comparison, and cannot
+// return a stale result for different content.
+let _blankMemoSrc = null, _blankMemoLang, _blankMemoOut = null;
+function _blankCached(src, lang) {
+  if (src === _blankMemoSrc && lang === _blankMemoLang) return _blankMemoOut;
+  const out = blankComments(src, lang);
+  _blankMemoSrc = src; _blankMemoLang = lang; _blankMemoOut = out;
+  return out;
+}
+
+// `fp` is optional for backwards compatibility with call sites that have no
+// path in scope. WITH a path this delegates to the shared, string-literal-aware
+// `blankComments`; without one it keeps the original C-family-only behaviour.
+function stripNoise(code, fp){
+  if (fp !== undefined && fp !== null) return _blankCached(code, _commentLangFor(fp));
+  let c=code.replace(/\/\*[\s\S]*?\*\//g,m=>m.replace(/[^\n]/g,' '));c=c.replace(/\/\/[^\n]*/g,m=>' '.repeat(m.length));return c;}
 // File-context inference. Used to gate rules that only apply in a given runtime
 // context — e.g. "Synchronous Blocking I/O (DoS Risk in Server Context)" should
 // not fire on CLI scripts / hooks / VS Code extensions.
@@ -605,7 +664,8 @@ function _isIaCFile(p){
   if (IAC_FILENAMES.has(base)) return true;
   if (/\.dockerfile$/i.test(base)) return true;
   if (/\.tf$|\.tfvars$/i.test(base)) return true;
-  // K8s YAML heuristic: under k8s/ or contains "kind:" — caller checks content
+  // K8s YAML heuristic: under k8s/ — the CONTENT half of this rule lives in
+  // `isKubernetesManifest` below, because a path predicate cannot see content.
   if (/(?:^|\/)k8s(?:\/|$)/.test(p) && /\.ya?ml$/i.test(base)) return true;
   if (/(?:^|\/)\.github\/workflows\/.*\.ya?ml$/.test(p)) return true;
   if (/(?:^|\/)\.gitlab-ci\.ya?ml$/.test(p)) return true;
@@ -620,6 +680,34 @@ function _isIaCFile(p){
   if (/(?:^|\/)(?:prompts?|templates?\/prompts?)\//i.test(p)) return true;
   return false;
 }
+// PRD F11.4 — the content half of the Kubernetes-manifest rule.
+//
+// `_isIaCFile` admitted YAML as Kubernetes only when the path contained a
+// directory literally named `k8s/`, while its own comment claimed the caller
+// also checked for `kind:`. Nothing ever did. Measured consequence: the
+// k8s-admission detector returned 3 findings when called directly on its own
+// fixture and 0 through a scan, because `shouldScan()` never let the walker
+// keep the file — real manifests under `deploy/`, `manifests/`, `charts/`,
+// `kubernetes/`, `overlays/` or the repository root were invisible, and that is
+// where most projects actually put them.
+//
+// Keyed on CONTENT rather than on more directory names, because the set of
+// directory names people use is unbounded and the file format is not. A
+// Kubernetes object is defined by carrying BOTH `apiVersion:` and `kind:` at
+// the start of a line — requiring both, at line-start, is what keeps this from
+// matching ordinary YAML that merely mentions the word "kind" in a value.
+//
+// Only the head of the file is examined: a manifest declares these in its first
+// few lines, and reading further would put an unbounded regex on the hot path
+// of every YAML file in a repository.
+const _K8S_HEAD_BYTES = 2048;
+const _K8S_API_VERSION_RE = /^\s*apiVersion\s*:/m;
+const _K8S_KIND_RE = /^\s*kind\s*:\s*\S/m;
+export function isKubernetesManifest(relPath, content) {
+  if (typeof content !== 'string' || !/\.ya?ml$/i.test(relPath || '')) return false;
+  const head = content.length > _K8S_HEAD_BYTES ? content.slice(0, _K8S_HEAD_BYTES) : content;
+  return _K8S_API_VERSION_RE.test(head) && _K8S_KIND_RE.test(head);
+}
 function getExt(n){const p=n.split(".");return p.length>1?p.pop().toLowerCase():"";}
 function shouldScan(p){if(/\.(test|spec|mock)\./i.test(p))return false;if(/_test\.go$/i.test(p))return false;if(/_spec\.rb$/i.test(p))return false;if(/Test\.(?:java|cs|kt|scala)$/i.test(p))return false;if(/\.min\.[mc]?js$/i.test(p))return false;for(const x of p.split("/"))if(IGNORE_DIRS.has(x))return false;
   // Mobile + framework manifest files needed by the v4 detectors.
@@ -1338,7 +1426,14 @@ function _hasSsrfHostGuard(ctx) { return _guardMatchNearSinkIdentifier(ctx, _SSR
 // A path-traversal containment guard near the file sink: a basename/strip
 // helper that removes directory components, a framework safe-join, or a
 // canonicalize-then-startsWith containment check.
-const _PATH_GUARD_RE = /\b(?:basename|GetFileName|secure_filename|sanitize_filename|send_from_directory|safe_join)\s*\(|\b(?:startsWith|startswith|StartsWith|HasPrefix)\s*\(|\bgetCanonicalPath\b|\btoRealPath\b|\bfilepath\s*\.\s*(?:Clean|Base|Abs)\b/;
+// The trailing alternative is a SHAPE, not a name: a project-local throwing
+// validator invoked on the value that reaches the sink. A closed list of
+// blessed helpers can never contain a codebase's own validator, so
+// GHSA-q939-rpr3-3284's fix (`EnsureValidLocalName(filename);` immediately
+// before `Path.Combine(..., filename)`) left the finding firing on the FIXED
+// revision. Safe to match on shape because _guardMatchNearSinkIdentifier
+// already requires the guard to name the same identifier as the sink.
+const _PATH_GUARD_RE = /\b(?:basename|GetFileName|secure_filename|sanitize_filename|send_from_directory|safe_join)\s*\(|\b(?:startsWith|startswith|StartsWith|HasPrefix)\s*\(|\bgetCanonicalPath\b|\btoRealPath\b|\bfilepath\s*\.\s*(?:Clean|Base|Abs)\b|\b(?:[Ee]nsure|[Vv]alidate|[Aa]ssert|[Rr]equire|[Vv]erify|[Cc]heck)\w{1,40}\s*\(/;
 function _hasPathGuard(ctx) { return _guardMatchNearSinkIdentifier(ctx, _PATH_GUARD_RE); }
 
 // Reflected-XSS output-encoding guard: an HTML escaper applied near the sink.
@@ -1394,6 +1489,20 @@ export function dropGuardedFindings(findings, fileContents) {
     // sanitizer-dataflow pipeline, which records them in scan.suppressions.
     // Don't hard-drop them here or that bookkeeping is lost (smoke FP-3).
     if (f.isSanitized) return true;
+    // A finding whose CLAIM IS the guard's presence must survive guard
+    // recognition, or the evidence is read as the refutation.
+    //
+    // `sibling-guard-omission` reports "this file applies <guard> to X and not
+    // to its sibling Y". The window around Y therefore ALWAYS contains a
+    // containment guard — that is the whole point — so the generic check below
+    // dropped 100% of these findings, structurally, and no amount of detector
+    // work could ever have surfaced one. Found while writing the rule: it fired
+    // correctly in isolation and produced nothing through a scan, the same
+    // signature as the rate-limit.js defect.
+    //
+    // Scoped to this family rather than loosening the window heuristic, which
+    // is doing its job for every other CWE-22 emitter.
+    if (f.family === 'sibling-guard-omission') return true;
     const cwe = f.cwe || '';
     const isXss = cwe === 'CWE-79' && /reflected xss/i.test(f.vuln || '');
     if (cwe !== 'CWE-918' && cwe !== 'CWE-22' && !isXss) return true;
@@ -1567,7 +1676,7 @@ function _detectAllowlistGuard(lines, varName, srcLine, sinkLine) {
   return null;
 }
 
-function performRegexAnalysis(fp,raw){if(_INTENTIONAL_VULN_PATH_RE.test(fp.replace(/\\/g,'/')))return{findings:[],sources:[],sinks:[],sanitizers:[]};const cleaned=stripNoise(raw);const cleanedNoStrings=stripNoiseAndStrings(raw);const lines=raw.split("\n");const findings=[],sources=[],sinks=[],sanitizers=[];
+function performRegexAnalysis(fp,raw){if(_INTENTIONAL_VULN_PATH_RE.test(fp.replace(/\\/g,'/')))return{findings:[],sources:[],sinks:[],sanitizers:[]};const cleaned=stripNoise(raw,fp);const cleanedNoStrings=stripNoiseAndStrings(raw);const lines=raw.split("\n");const findings=[],sources=[],sinks=[],sanitizers=[];
   for(const sp of SOURCE_PATTERNS){const re=new RegExp(sp.regex.source,sp.regex.flags);let m;while((m=re.exec(cleaned))){const line=lineAt(cleaned,m.index);const lt=lines[line-1]||"";let _srcVar=null;if(typeof sp.getVar==='function'){try{_srcVar=sp.getVar(m,lt)||null;}catch(_){_srcVar=null;}}if(!_srcVar){const am=lt.match(/(?:const|let|var|)\s*(\w+)\s*=/)||lt.match(/(\w+)\s*=/);_srcVar=am?am[1]:null;}const _itype=sp.inputType(m);if(_srcVar&&(_itype==='cookies'||_itype==='headers')){const _mc=lt.indexOf(m[0]);if(_mc>=0){const _before=lt.substring(0,_mc);if((_before.match(/\(/g)||[]).length>(_before.match(/\)/g)||[]).length)_srcVar=null;}}sources.push({label:sp.getLabel(m),category:sp.category,inputType:_itype,variable:_srcVar,line,file:fp,snippet:lt.trim()});}}
   // Feat-1: in-file Python helper-taint propagation. Pushes synthetic sources
   // for function parameters that are tainted via call-site argument flow.
@@ -1647,7 +1756,7 @@ function performAnalysis(fp, raw) {
     return performRegexAnalysis(fp, raw);
 }
 
-function scanRoutes(fp,raw){const cleaned=stripNoise(raw);const lines=raw.split("\n");const routes=[];const mwAuth=detectMiddlewareAuth(raw);for(const p of ROUTE_PATTERNS){const re=new RegExp(p.regex.source,p.regex.flags);let m;while((m=re.exec(cleaned))){let method="GET";if(p.mI&&m[p.mI]){const r=m[p.mI].toUpperCase();method=["GET","POST","PUT","PATCH","DELETE","ALL","OPTIONS","HEAD"].includes(r)?r:"GET";}if(p.mtI&&m[p.mtI]){const fm=m[p.mtI].replace(/['"]/g,"").split(",").map(s=>s.trim().toUpperCase());if(fm.length)method=fm[0];}const path=p.pI&&m[p.pI]?m[p.pI]:"(file-based)";const line=lineAt(cleaned,m.index);let hasAuth=false;const nearby=lines.slice(Math.max(0,line-3),line+3).join(" ");if(/(?:authenticate|auth|jwt\.verify|verifyToken|authMiddleware|checkAuth|protect|authorize|isAuthorized|expressJwt|denyAll)\s*[\(,]/i.test(nearby))hasAuth=true;if(!hasAuth)for(const mw of mwAuth)if(line>mw.line&&(mw.scope==="/"||path.startsWith(mw.scope)))hasAuth=true;const rp=[];for(const sp of SOURCE_PATTERNS){const re2=new RegExp(sp.regex.source,sp.regex.flags);const block=lines.slice(Math.max(0,line-2),Math.min(lines.length,line+30)).join("\n");let m2;while((m2=re2.exec(block))){const v=m2[2]||m2[3]||m2[1];if(v)rp.push(v);}}const cls=classifyEndpoint(rp);const classifiedFields={};rp.forEach(field=>{const fc=classifyField(field);if(fc.length)classifiedFields[field]=fc;});const uploadBlock2=lines.slice(Math.max(0,line-5),Math.min(lines.length,line+40)).join("\n");const hasFileUpload=/(?:multer|busboy|formidable|upload\.(?:single|array|fields|any|none)|req\.files?\b|request\.files?\b|request\.FILES|\$_FILES|\$request->(?:file|hasFile)|multipart\/form-data|r\.FormFile|r\.MultipartForm)/i.test(uploadBlock2);routes.push({method,path,framework:p.fw,file:fp,line,hasAuth,hasFileUpload,params:rp,classifications:cls,classifiedFields});}}return routes;}
+function scanRoutes(fp,raw){const cleaned=stripNoise(raw,fp);const lines=raw.split("\n");const routes=[];const mwAuth=detectMiddlewareAuth(raw);for(const p of ROUTE_PATTERNS){const re=new RegExp(p.regex.source,p.regex.flags);let m;while((m=re.exec(cleaned))){let method="GET";if(p.mI&&m[p.mI]){const r=m[p.mI].toUpperCase();method=["GET","POST","PUT","PATCH","DELETE","ALL","OPTIONS","HEAD"].includes(r)?r:"GET";}if(p.mtI&&m[p.mtI]){const fm=m[p.mtI].replace(/['"]/g,"").split(",").map(s=>s.trim().toUpperCase());if(fm.length)method=fm[0];}const path=p.pI&&m[p.pI]?m[p.pI]:"(file-based)";const line=lineAt(cleaned,m.index);let hasAuth=false;const nearby=lines.slice(Math.max(0,line-3),line+3).join(" ");if(/(?:authenticate|auth|jwt\.verify|verifyToken|authMiddleware|checkAuth|protect|authorize|isAuthorized|expressJwt|denyAll|checkPermission|checkAnyPermission|hasAnyPermission|hasPermission|requirePermission)\s*[\(,]/i.test(nearby))hasAuth=true;if(!hasAuth)for(const mw of mwAuth)if(line>mw.line&&(mw.scope==="/"||path.startsWith(mw.scope)))hasAuth=true;const rp=[];for(const sp of SOURCE_PATTERNS){const re2=new RegExp(sp.regex.source,sp.regex.flags);const block=lines.slice(Math.max(0,line-2),Math.min(lines.length,line+30)).join("\n");let m2;while((m2=re2.exec(block))){const v=m2[2]||m2[3]||m2[1];if(v)rp.push(v);}}const cls=classifyEndpoint(rp);const classifiedFields={};rp.forEach(field=>{const fc=classifyField(field);if(fc.length)classifiedFields[field]=fc;});const uploadBlock2=lines.slice(Math.max(0,line-5),Math.min(lines.length,line+40)).join("\n");const hasFileUpload=/(?:multer|busboy|formidable|upload\.(?:single|array|fields|any|none)|req\.files?\b|request\.files?\b|request\.FILES|\$_FILES|\$request->(?:file|hasFile)|multipart\/form-data|r\.FormFile|r\.MultipartForm)/i.test(uploadBlock2);routes.push({method,path,framework:p.fw,file:fp,line,hasAuth,hasFileUpload,params:rp,classifications:cls,classifiedFields});}}return routes;}
 
 const LOGIC_PATTERNS=[
   {regex:/Math\.random\s*\(\s*\)/g,vuln:"Weak Randomness",severity:"medium",cwe:"CWE-330",stride:"Spoofing",fix:"Use crypto.randomBytes or crypto.randomUUID for security-sensitive values.",code:"// BEFORE\nconst token = Math.random().toString(36);\n\n// AFTER\nconst token = crypto.randomBytes(32).toString('hex');"},
@@ -1678,7 +1787,7 @@ const LOGIC_PATTERNS=[
   // ── Missing Bounds on Financial/Quantity Fields ──────────────────────────────
   {regex:/(?:req|request|ctx)\s*(?:\.\s*body|\[\s*['"]body['"]\s*\])\s*[.[\s]*(?:quantity|amount|price|units|count|qty)\b(?![^;]{0,200}(?:Number\.isInteger|isNaN|Math\.abs|>=\s*1|>\s*0|>0|>=1|max\s*:))/g,vuln:"Missing Positive-Integer Validation on Financial Field",severity:"medium",cwe:"CWE-20",stride:"Tampering",fix:"Validate that financial/quantity fields are positive integers before processing. Negative values can create credit or reverse transactions.",code:"// BEFORE\nawait Order.create({ quantity: req.body.quantity, price: product.price });\n\n// AFTER\nconst qty = req.body.quantity;\nif (!Number.isInteger(qty) || qty < 1 || qty > 10000)\n  return res.status(400).json({ error: 'quantity must be 1-10000' });\nawait Order.create({ quantity: qty, price: product.price });"},
   // ── #22: Missing timeout on outbound HTTP requests (DoS) ─────────────────────
-  {regex:/(?:await\s+)?(?:fetch|axios\.(?:get|post|put|patch|delete|request)|http\.(?:get|request)|https\.(?:get|request)|got)\s*\(/gi,vuln:"Missing Timeout on Outbound HTTP Request (DoS)",severity:"medium",cwe:"CWE-400",stride:"Denial of Service",appliesTo:["server"],fix:"Set a timeout on all outbound requests to prevent event-loop starvation from stalled upstreams.",code:"// fetch (Node 18+)\nconst resp = await fetch(url, { signal: AbortSignal.timeout(5000) });\n\n// axios\nawait axios.get(url, { timeout: 5000 });\n\n// node http\nconst req = http.get(url, cb);\nreq.setTimeout(5000, () => req.destroy());"},
+  {regex:/(?:await\s+)?\b(?:fetch|axios\.(?:get|post|put|patch|delete|request)|http\.(?:get|request)|https\.(?:get|request)|got)\s*\(/gi,vuln:"Missing Timeout on Outbound HTTP Request (DoS)",severity:"medium",cwe:"CWE-400",stride:"Denial of Service",appliesTo:["server"],fix:"Set a timeout on all outbound requests to prevent event-loop starvation from stalled upstreams.",code:"// fetch (Node 18+)\nconst resp = await fetch(url, { signal: AbortSignal.timeout(5000) });\n\n// axios\nawait axios.get(url, { timeout: 5000 });\n\n// node http\nconst req = http.get(url, cb);\nreq.setTimeout(5000, () => req.destroy());"},
   // ── #24: ORM collection queries without pagination limit (DoS) ───────────────
   {regex:/\.\s*(?:findAll|findMany|findAndCountAll)\s*\(\s*\{[^}]{0,500}\}/g,vuln:"ORM Collection Query Without Pagination Limit (DoS)",severity:"medium",cwe:"CWE-400",stride:"Denial of Service",appliesTo:["server"],fix:"Always set limit/take on collection queries to bound memory and DB load.",code:"const items = await Model.findAll({\n  where: { userId: req.user.id },\n  limit: Math.min(Number(req.query.limit) || 50, 100),\n  offset: Number(req.query.offset) || 0,\n});"},
   // ── #27: Missing audit log on sensitive mutations (Repudiation) ──────────────
@@ -2149,7 +2258,7 @@ function scanStructuralVulns(fp, raw) {
   // Default cleaned view strips strings; if any pattern needs the literal-aware
   // view, we fall back to stripNoise for that one pattern.
   const cleaned = stripNoiseAndStrings(raw);
-  const cleanedNoise = stripNoise(raw);
+  const cleanedNoise = stripNoise(raw,fp);
   const lines = raw.split('\n');
   const findings = [];
   const ctx = inferFileContext(fp, raw);
@@ -2332,6 +2441,28 @@ function _isFalsePositiveCredential(fp, snippet, fullMatch){
   const pathLC = fp.replace(/\\\\/g,'/').toLowerCase();
   if (_CRED_PATH_RE.test(pathLC) || _CRED_FILE_RE.test(pathLC)) return {skip:true, reason:'path-filter'};
   // Extract LHS identifier from the snippet (handles `const x =`, `x =`, `{ x:`, etc.)
+// Well-known protocol / spec vocabulary that is public by definition: OAuth
+// and OIDC grant, token and response types, URN token-type identifiers, HTTP
+// auth schemes, JWT alg names, and common enum-ish method names. Anchored to
+// the WHOLE value so a real secret that merely contains one of these words is
+// unaffected.
+const _PROTOCOL_CONSTANT_VAL_RE = new RegExp('^(?:'
+  + 'urn:[\\w.:-]+'                                        // urn:ietf:params:oauth:...
+  + '|(?:refresh|access|id|device|bearer|mac|dpop)_token'
+  + '|authorization_code|client_credentials|implicit|password_grant'
+  + '|urn:ietf:params:oauth:grant-type:[\\w-]+'
+  + '|(?:client_secret|private_key)_(?:basic|post|jwt)'
+  + '|(?:Bearer|Basic|Digest|Negotiate|Hawk)'
+  + '|(?:HS|RS|ES|PS)(?:256|384|512)|none|EdDSA'
+  + '|(?:openid|profile|email|offline_access|address|phone)'
+  + '|code|token id_token|id_token token|query|fragment|form_post'
+  // Enum-ish auth vocabulary, NOT all snake_case: the value must end in a
+  // protocol-vocabulary word. A first draft allowed any snake_case string,
+  // which would have suppressed a genuine lowercase secret.
+  + '|[a-z][a-z0-9_]{0,40}_(?:auth|token|grant|type|method|scope|mode|flow)'
+  + '|(?:auth|token|grant|scope)_[a-z][a-z0-9_]{0,40}'
+  + ')$', 'i');
+
   const am = snippet.match(/(?:^|\W)(\w{2,})\s*[:=]\s*['"]/);
   const varName = am ? am[1] : '';
   if (varName && _CRED_VARNAME_RE.test(varName)) return {skip:true, reason:'var-name-placeholder'};
@@ -2340,6 +2471,19 @@ function _isFalsePositiveCredential(fp, snippet, fullMatch){
   const val = valM ? valM[1] : '';
   if (val.length < 8) return {skip:true, reason:'value-too-short'};
   if (_CRED_PLACEHOLDER_VAL_RE.test(val)) return {skip:true, reason:'placeholder-value'};
+  // T2.1 audit — PROTOCOL CONSTANTS are not secrets.
+  //
+  // "Hardcoded Secret" was the 2nd-highest-volume rule over the independent
+  // population (70 findings in a 24-entry sample), and the sampled instances
+  // were all OAuth/OIDC vocabulary declared as named constants:
+  //   GrantTypeRefreshToken   = "refresh_token"
+  //   TokenTypeURNAccessToken = "urn:ietf:params:oauth:token-type:access_token"
+  //   AuthRecipeMethodMobileBasicAuth = "mobile_basic_auth"
+  // These are PUBLIC identifiers from a published spec — every conforming
+  // implementation ships the identical string. The rule fired only because the
+  // constant's NAME contains token/auth. Flagging them teaches readers to
+  // ignore the whole class, which is what a noisy critical-severity rule costs.
+  if (_PROTOCOL_CONSTANT_VAL_RE.test(val)) return {skip:true, reason:'protocol-constant'};
   // Shannon-entropy + dictionary-word filter (Recommendation #1 from the
   // SCA/SAST improvement plan). The Juliet Java hardcoded-secret detector
   // was producing 468 FPs / 1 TP because test fixtures use short
@@ -2671,7 +2815,7 @@ function _buildProjectIndex(fileContents){
     if (typeof c !== 'string') continue;
     // Strip comments before checking — keywords in JSDoc / TODO / docstrings shouldn't
     // count as evidence of an e-commerce model. Only real code does.
-    const cleaned = stripNoise(c);
+    const cleaned = stripNoise(c,fp);
     if (_ECOMMERCE_MODEL_RE.test(cleaned)) hasEcommerce = true;
     const fileConsts = {};
     let m;
@@ -2802,7 +2946,7 @@ function scanLogicVulns(fp,raw){
   // string-literal route paths and key names, so the comment-stripped (but
   // string-preserving) view is the right default. Rules that explicitly only
   // describe a code shape can opt in via `stripsStrings: true`.
-  const cleaned=stripNoise(raw);
+  const cleaned=stripNoise(raw,fp);
   const cleanedFull=stripNoiseAndStrings(raw);
   const lines=raw.split("\n");const results=[];
   const ctx = inferFileContext(fp, raw);
@@ -2868,8 +3012,24 @@ const STORED_TAINT_SINK_PATTERNS=[
 
 function buildStoredTaintRegistry(fc){
   const registry={};
+  // PRD T3.2 — this used to REQUIRE the field name to be one of a closed list
+  // (bio|description|about|…). That is the same closed-enumeration bug found
+  // four separate times in this engine during the same audit (blessed auth
+  // dependencies, `id`/`userId`-only object ids, snake_case-only guards): real
+  // schemas name their fields whatever they like, and a field called `payload`,
+  // `src` or `mobiledoc` carries stored user input exactly as well as `bio`.
+  // The list is kept only as a CONFIDENCE signal now; admission is decided by
+  // whether the value side actually references a request source.
   const STRING_FIELDS=/(?:bio|description|about|message|content|body|note|comment|title|summary|text|review|feedback|username|displayName)/i;
-  for(const[fp,code] of Object.entries(fc)){
+  // Fields that are never user prose — registering them produces noise, not flows.
+  const NON_CONTENT_FIELDS=/^(?:id|_id|uuid|createdAt|updatedAt|deletedAt|version|type|status|role|password|hash|salt|token)$/i;
+  for(const[fp,rawCode] of Object.entries(fc)){
+    // Comments are not code. sast/CLAUDE.md's first gotcha is exactly this, and
+    // skipping it here registered phantom fields from ILLUSTRATIVE EXAMPLES in
+    // detector docblocks (`// Sequelize Model.create({ field: req.body.x })`),
+    // which then matched in unrelated files and produced 8 cross-file findings
+    // between this project's own source files.
+    const code=stripNoise(rawCode,fp);   // engine-local, line-preserving
     const lines=code.split('\n');
     // Find ORM writes that include string-type fields likely to hold user input
     const ormWrite=/(?:create|update|save|upsert|findOrCreate)\s*\(\s*\{([^}]{0,800})\}/g;
@@ -2879,14 +3039,15 @@ function buildStoredTaintRegistry(fc){
       const fieldMatches=inner.match(/(\w+)\s*:/g)||[];
       for(const f of fieldMatches){
         const fn=f.replace(/\s*:/,'');
-        if(STRING_FIELDS.test(fn)){
-          // Only register if the value side references a request input
-          const fieldRe=new RegExp(fn+'\\s*:\\s*(?:req\\.|request\\.|ctx\\.|\\$_(?:POST|GET)|body\\[|params\\[|query\\[)','i');
-          if(fieldRe.test(inner)||/req\.|request\.|ctx\./i.test(inner)){
-            const line=code.substring(0,m.index).split('\n').length;
-            if(!registry[fn])registry[fn]=[];
-            registry[fn].push({file:fp,line,snippet:lines[line-1]?.trim()||''});
-          }
+        if(NON_CONTENT_FIELDS.test(fn))continue;
+        // Admission is by PROVENANCE, not by name: the value side must
+        // reference a request source. A recognised prose-ish name only raises
+        // confidence.
+        const fieldRe=new RegExp(fn+'\\s*:\\s*(?:req\\.|request\\.|ctx\\.|\\$_(?:POST|GET)|body\\[|params\\[|query\\[)','i');
+        if(fieldRe.test(inner)||/req\.|request\.|ctx\./i.test(inner)){
+          const line=code.substring(0,m.index).split('\n').length;
+          if(!registry[fn])registry[fn]=[];
+          registry[fn].push({file:fp,line,snippet:lines[line-1]?.trim()||'',named:STRING_FIELDS.test(fn)});
         }
       }
     }
@@ -2905,37 +3066,56 @@ function crossStoredTaint(fc, storedRegistry){
       if(writes.some(w=>w.file===fp))continue;
       const lines=code.split('\n');
       // Check if this file renders the stored field in a dangerous context
-      const sinkRe=new RegExp(
-        `(?:\`[^\`]*\\$\\{[^}]*\\b${field}\\b[^}]*\\}\`|(?:innerHTML|outerHTML)\\s*=[^;]{0,200}\\b${field}\\b|res\\s*\\.\\s*(?:send|write|json)\\s*\\([^;]{0,200}\\b${field}\\b)`,
-        'g'
-      );
+      // PRD T3.2 — sink families beyond XSS.
+      //
+      // This used to recognise ONLY render sinks (innerHTML / res.send /
+      // template literal), so a stored value flowing to a network, filesystem
+      // or shell sink was invisible. The evidence entry that forced this is
+      // Ghost's mobiledoc re-render (GHSA-g366-23fw-ggp6): stored post content
+      // is walked on a later render pass and its image `src` handed to an
+      // unguarded fetch — a stored SSRF, not stored XSS. Each family carries
+      // its own CWE so the finding is not mislabelled as XSS.
+      const F = field;
+      const STORED_SINK_FAMILIES = [
+        { re: `(?:\`[^\`]*\\$\\{[^}]*\\b${F}\\b[^}]*\\}\`|(?:innerHTML|outerHTML)\\s*=[^;]{0,200}\\b${F}\\b|res\\s*\\.\\s*(?:send|write|json)\\s*\\([^;]{0,200}\\b${F}\\b)`,
+          vuln: 'Stored XSS / Second-Order Injection', cwe: 'CWE-79', sanit: /(?:escape|DOMPurify|sanitize|encodeURIComponent|escapeHtml|textContent)\s*\(/ },
+        { re: `(?:fetch|axios(?:\\.\\w{1,10})?|got|request|urlopen|requests\\.\\w{1,10}|httpx\\.\\w{1,10}|getImageSize\\w{0,20})\\s*\\([^;]{0,200}\\b${F}\\b`,
+          vuln: 'Stored SSRF (second-order)', cwe: 'CWE-918', sanit: /(?:isAllowed|allowlist|allowList|denyList|isPrivate|ssrf|validateUrl|is_?internal)\s*\(/i },
+        { re: `(?:readFile|readFileSync|createReadStream|open|sendFile|path\\.join)\\s*\\([^;]{0,200}\\b${F}\\b`,
+          vuln: 'Stored path traversal (second-order)', cwe: 'CWE-22', sanit: /(?:basename|resolve|realpath|secure_filename|normalize)\s*\(/i },
+        { re: `(?:exec|execSync|spawn|system|popen)\\s*\\([^;]{0,200}\\b${F}\\b`,
+          vuln: 'Stored command injection (second-order)', cwe: 'CWE-78', sanit: /(?:shell-?escape|shlex\.quote|execFile)\s*\(/i },
+      ];
+      for (const fam of STORED_SINK_FAMILIES) {
+      const sinkRe=new RegExp(fam.re,'g');
       let m2;
       while((m2=sinkRe.exec(code))!==null){
         const sinkLine=code.substring(0,m2.index).split('\n').length;
         const snippet=lines[sinkLine-1]?.trim()||'';
         // Check for sanitizer in the vicinity
         const nearby=lines.slice(Math.max(0,sinkLine-5),sinkLine+2).join(' ');
-        const isSanitized=/(?:escape|DOMPurify|sanitize|encodeURIComponent|escapeHtml|textContent)\s*\(/.test(nearby);
+        const isSanitized=fam.sanit.test(nearby);
         if(!isSanitized){
           for(const write of writes){
             const id=`stored:${write.file}:${write.line}:${fp}:${sinkLine}:${field}`;
             findings.push({
               id,
               source:{label:`Stored field: ${field} (written at ${write.file.split('/').pop()}:${write.line})`,category:'Stored Taint',inputType:'stored',variable:field,line:write.line,file:write.file,snippet:write.snippet},
-              sink:{type:'Stored Sink',severity:'high',vuln:'Stored XSS / Second-Order Injection',cwe:'CWE-79',stride:'Tampering',line:sinkLine,file:fp,snippet,args:snippet},
+              sink:{type:'Stored Sink',severity:'high',vuln:fam.vuln,cwe:fam.cwe,stride:'Tampering',line:sinkLine,file:fp,snippet,args:snippet},
               path:[
                 {type:'source',label:`ORM write: ${field} = user_input`,line:write.line,snippet:write.snippet},
                 {type:'propagation',label:`Stored in database (${field})`,line:write.line,snippet:''},
                 {type:'sink',label:`Rendered unsanitized in ${fp.split('/').pop()}:${sinkLine}`,line:sinkLine,snippet}
               ],
               isSanitized:false,sanitizerType:null,
-              severity:'high',vuln:'Stored XSS / Second-Order Injection',cwe:'CWE-79',stride:'Tampering',
+              severity:'high',vuln:fam.vuln,cwe:fam.cwe,stride:'Tampering',
               file:`${write.file} -> ${fp}`,isCrossFile:true,parser:'STORED_TAINT'
             });
             break; // one finding per (field,sinkFile,sinkLine) is enough
           }
         }
       }
+      }
     }
   }
   return findings;
@@ -3097,6 +3277,19 @@ const JAVA_FAMILY_RULES = [
     sinkRe: /\bnew\s+(?:java\s*\.\s*util\s*\.\s*)?Random\s*\(|\bMath\s*\.\s*random\s*\(\s*\)|\bThreadLocalRandom\s*\.\s*current\s*\(\s*\)\s*\.\s*next/,
     sanitizerRe: /\bSecureRandom\b/,
     requiresSource: false,
+    // T2.1 audit — a weak PRNG is only a vulnerability when its output is used
+    // for something that must be UNPREDICTABLE. This rule had no such
+    // requirement, so it fired on netty's leak-detector sampling
+    // (`ThreadLocalRandom.current().nextInt(samplingInterval)`), round-robin
+    // address selection, and a `new Random(0L)` inside a microbenchmark — 36
+    // findings in a 24-entry sample, none of them security-relevant.
+    //
+    // The JS sibling rule (sast/weak-randomness.js) has always required a
+    // security-context keyword; this is the same gate, applied file-wide
+    // because Java's randomness helpers are usually a few lines from what they
+    // seed. Returning truthy SUPPRESSES, so this reads "no security context
+    // anywhere in the file".
+    fileSafePredicate: (cleaned) => !/\b(?:token|secret|password|passwd|nonce|salt|iv\b|session|cookie|csrf|otp|mfa|api_?key|apikey|credential|auth|jwt|sign|cipher|encrypt|decrypt|random_?id|uuid|guid|reset|verif|captcha|challenge|ticket|voucher|coupon)\w*/i.test(cleaned),   // NOT `seed`: benchmarks seed RNGs deterministically on purpose
   },
   {
     family: 'sql-injection',
@@ -3114,7 +3307,16 @@ const JAVA_FAMILY_RULES = [
     // SqlSession.{selectList,selectOne,selectMap,update,insert,delete} (MyBatis),
     // JdbcTemplate.{queryForStream,queryForRowSet}, R2DBC DatabaseClient.sql,
     // JdbcOperations / JdbcAggregateOperations.* (Spring Data JDBC).
-    sinkRe: /\.\s*(?:executeQuery|executeUpdate|execute|executeBatch|prepareStatement|prepareCall|createQuery|createNativeQuery|createSQLQuery|createCriteriaQuery|createSqlQuery|createStatement|addBatch|queryForObject|queryForList|queryForMap|queryForLong|queryForInt|queryForRowSet|queryForStream|batchUpdate|find_by_sql|sqlRestriction|selectList|selectOne|selectMap|selectCursor|sql)\s*\(/,
+    // T2.1 audit: bare `execute` was in this list, and in Java that is
+    // overwhelmingly java.util.concurrent.Executor.execute(Runnable) — a
+    // THREAD POOL, not a database. Measured on the independent population
+    // it produced high-severity SQL-injection findings on netty's
+    // DefaultChannelPipeline, NonStickyEventExecutorGroup and
+    // ThreadExecutorMap (`executor.execute(command)`), and on Appium's
+    // AppiumCommandExecutor. Statement.execute(sql) IS real JDBC, so the
+    // verb is kept but now requires a database-shaped receiver. This is the
+    // same correction the comment above records for update/insert/delete.
+    sinkRe: /(?:\.\s*(?:executeQuery|executeUpdate|executeBatch|prepareStatement|prepareCall|createQuery|createNativeQuery|createSQLQuery|createCriteriaQuery|createSqlQuery|createStatement|addBatch|queryForObject|queryForList|queryForMap|queryForLong|queryForInt|queryForRowSet|queryForStream|batchUpdate|find_by_sql|sqlRestriction|selectList|selectOne|selectMap|selectCursor|sql)\s*\(|\b(?:stmt|statement|st|ps|pstmt|preparedStatement|cstmt|conn|connection|jdbc\w{0,20}|jdbcTemplate|template|session|entityManager|em|db|database|dataSource|sqlSession)\s*\.\s*execute\s*\()/i,
     sanitizerRe: null,
     useTaint: true,
   },
@@ -3804,7 +4006,7 @@ function _buildGlobalJavaTaintedMethodIndex(fileContents) {
   for (const [path, content] of Object.entries(fileContents)) {
     if (!/\.java$/i.test(path) || !content || content.length > 500_000) continue;
     if (!_GLOBAL_JAVA_SOURCE_RE_FOR_INDEX.test(content)) continue;
-    const cleaned = stripNoise(content);
+    const cleaned = stripNoise(content,path);
     // Same method-extraction pattern as _javaFindSanitizerMethods.
     const re = /\b(?:public|private|protected|static|final|\s)+\s*[\w.<>\[\]]+\s+([A-Za-z_]\w*)\s*\(([^)]*)\)\s*(?:throws\s+[\w.,\s]+)?\s*\{/g;
     let m;
@@ -4512,7 +4714,7 @@ function _javaArgWrappedBySanitizer(argStr, family) {
 
 function scanJavaSAST(fp, raw) {
   if (!/\.java$/i.test(fp)) return [];
-  const cleaned = stripNoise(raw);
+  const cleaned = stripNoise(raw,fp);
   const lines = raw.split('\n');
   const findings = [];
   // hasSource: file has a direct user-input source OR calls a globally-known
@@ -4968,7 +5170,7 @@ function scanMiddlewareOrdering(fp, raw){
   if (!ctx.isServer) return [];
   // Need literal mount-path strings — keep comments stripped but preserve
   // string contents so the path argument is readable.
-  const cleaned = stripNoise(raw);
+  const cleaned = stripNoise(raw,fp);
   const findings = [];
   const lines = raw.split('\n');
   let firstAuthAt = Infinity;
@@ -5037,7 +5239,7 @@ function scanAliasedSinks(fp, raw){
   if (!/\.(js|jsx|ts|tsx|mjs|cjs)$/i.test(fp)) return [];
   // Comments-only strip; preserve string literals so bracket-access shapes
   // like cp['exec'](...) — which need to see the literal 'exec' — match.
-  const cleaned = stripNoise(raw);
+  const cleaned = stripNoise(raw,fp);
   const lines = raw.split('\n');
   const findings = [];
   // 1. Property-assigned aliases: const X = cp.exec
@@ -5175,10 +5377,129 @@ function scanAliasedSinks(fp, raw){
 // path on patterns that lack any star/plus quantifier altogether.
 let _safeRegex;
 try { _safeRegex = _require('safe-regex'); } catch (_) { _safeRegex = null; }
+/**
+ * Is the pattern anchored at the start (`^`, or `\A`)?
+ *
+ * An UNANCHORED exec() retries from every start offset, so a greedy leading
+ * quantifier that fails late costs O(n) per offset — O(n^2) overall. That
+ * polynomial blow-up, not intrinsic backtracking, is the defect in
+ * GHSA-29g2-3rmr-qm68 (sveltejs/kit), whose entire fix was to prepend `^`.
+ * A start anchor leaves exactly one start position and removes the multiplier.
+ *
+ * Deliberately conservative: `^` inside an alternation (`^a|b`) does NOT
+ * anchor the whole pattern, since the `b` branch is still free-floating.
+ */
+function _isAnchoredRegex(body){
+  const s = String(body || '');
+  if (!/^(?:\^|\\A)/.test(s)) return false;
+  // A top-level `|` means some branch is unanchored — not a real anchor.
+  let depth = 0, cls = false;
+  for (let i = 0; i < s.length; i++) {
+    const ch = s[i];
+    if (ch === '\\') { i++; continue; }
+    if (cls) { if (ch === ']') cls = false; continue; }
+    if (ch === '[') { cls = true; continue; }
+    if (ch === '(') depth++;
+    else if (ch === ')') depth--;
+    else if (ch === '|' && depth === 0) return false;
+  }
+  return true;
+}
+/**
+ * A quantified group that itself contains a quantifier — `(a+)+`, `(?:\w+\s?)*`.
+ * This is the intrinsic, exponential form of catastrophic backtracking, and it
+ * is NOT cured by anchoring, which is why the anchor exemption below refuses
+ * to apply when this is present.
+ */
+function _hasNestedQuantifier(body){
+  const s = String(body || '');
+  for (let i = 0; i < s.length; i++) {
+    if (s[i] === '\\') { i++; continue; }
+    if (s[i] !== '(') continue;
+    let depth = 0, cls = false, j = i;
+    for (; j < s.length; j++) {
+      const ch = s[j];
+      if (ch === '\\') { j++; continue; }
+      if (cls) { if (ch === ']') cls = false; continue; }
+      if (ch === '[') { cls = true; continue; }
+      if (ch === '(') depth++;
+      else if (ch === ')') { depth--; if (depth === 0) break; }
+    }
+    if (j >= s.length) continue;
+    const inner = s.slice(i + 1, j);
+    const after = s.slice(j + 1);
+    const groupQuantified = /^(?:[*+]|\{\d+,\d*\})/.test(after);
+    if (groupQuantified && /[*+]|\{\d+,/.test(inner)) return true;
+  }
+  return false;
+}
+/**
+ * Does an UNBOUNDED quantifier appear before the first REQUIRED literal?
+ *
+ * This is the mechanism behind polynomial (scan-and-retry) ReDoS. When a
+ * greedy `+`/`*` runs before the engine has any literal to discriminate on,
+ * an unanchored match must re-run that scan from every start offset — O(n^2).
+ * Once a required literal comes first, the engine can reject most offsets in
+ * O(1) and the blow-up disappears.
+ *
+ *   /([^/ \t]+)\/…/            → `+` before the required `/`   → true  (the
+ *                                 real defect in GHSA-29g2-3rmr-qm68)
+ *   /(?:^|[\\/])\.env(?:…)?$/  → required `.` first            → false
+ *
+ * Needed because the two analysers available here have opposite blind spots:
+ * redos-nfa.js models exponential backtracking only and clears BOTH revisions
+ * of the sveltejs pattern, while safe-regex's star-height heuristic flags
+ * plain `(?:^|[\\/])\.env…` file-matchers that cannot backtrack at all.
+ */
+function _hasLeadingUnboundedQuantifier(body){
+  const s = String(body || '');
+  const unboundedAt = (k) => s[k] === '+' || s[k] === '*'
+    || (s[k] === '{' && /^\{\d+,\s*\}/.test(s.slice(k)));
+  for (let i = 0; i < s.length; i++){
+    const ch = s[i];
+    if (ch === '\\'){
+      const nxt = s[i + 2];
+      if (unboundedAt(i + 2)) return true;
+      if (nxt !== '?' && nxt !== '*') return false;   // required escaped literal
+      i++; continue;
+    }
+    if (ch === '['){
+      let j = i + 1;
+      for (; j < s.length; j++){
+        if (s[j] === '\\'){ j++; continue; }
+        if (s[j] === ']') break;
+      }
+      if (unboundedAt(j + 1)) return true;
+      i = j; continue;
+    }
+    if (ch === '(' || ch === ')' || ch === '|' || ch === '^' || ch === '?'
+      || ch === ':' || ch === '=' || ch === '!' || ch === '<') continue;
+    if (ch === '.'){ if (unboundedAt(i + 1)) return true; continue; }
+    // A plain literal character: required unless immediately made optional.
+    if (unboundedAt(i + 1)) return true;
+    if (s[i + 1] !== '?') return false;
+  }
+  return false;
+}
 function _isLikelyUnsafeRegex(body){
   if (!body || body.length < 3) return false;
   // Cheap prefilter: must contain a quantifier *, +, or {n,} for ReDoS to be possible.
   if (!/[*+]|\{\d+,/.test(body)) return false;
+  // safe-regex (star-height heuristic) is the only signal below, and it
+  // over-reports on patterns that cannot backtrack — plain file matchers like
+  // /(?:^|[\\/])\.env(?:\.[\w-]+)?$/ were reported across this project's own
+  // source. Require a mechanism to actually be present: either intrinsic
+  // (a nested quantifier) or scan-and-retry (an unbounded quantifier ahead of
+  // the first required literal). redos-nfa.js is consulted as a second
+  // opinion for the intrinsic case only, since it does not model the
+  // polynomial one.
+  if (!_hasNestedQuantifier(body) && !_hasLeadingUnboundedQuantifier(body)) return false;
+  // FIX-DISCRIMINATION (GHSA-29g2-3rmr-qm68): an anchored pattern with no
+  // nested quantifier has neither failure mode — no start-offset multiplier,
+  // no intrinsic catastrophe. safe-regex's star-height heuristic cannot see
+  // anchoring at all and flagged the fixed revision identically to the
+  // vulnerable one, so the finding survived its own fix.
+  if (_isAnchoredRegex(body) && !_hasNestedQuantifier(body)) return false;
   if (_safeRegex) {
     try { if (!_safeRegex(body)) return true; } catch (_) { /* fall through */ }
   }
@@ -5262,6 +5583,44 @@ function _charSetsIntersect(a, b){
 function _inClass(ch, cls){
   return cls.negate ? !cls.members.has(ch) : cls.members.has(ch);
 }
+/**
+ * Extract regex-literal bodies, honouring character classes.
+ *
+ * The previous extractor was itself a regex:
+ *   /\/((?:\\.|[^\/\n])+)\/[gimsuy]{0,5}/g
+ * which has no notion of `[...]`, so an unescaped `/` inside a character
+ * class — legal, and extremely common in path/URL patterns — TERMINATED the
+ * literal early and emitted two phantom fragments in place of one real regex.
+ *
+ * Found via GHSA-29g2-3rmr-qm68, where
+ *   /^[ \t]*([^/ \t]+)\/([^; \t]+)[ \t]*(?:;[ \t]*q=([0-9.]+))?/
+ * was split into `^[ \t]*([^` and `([^; \t]+)[ \t]*(?:;[ \t]*q=([0-9.]+))?`.
+ * The second fragment never existed in the source, and — having lost the
+ * leading `^` to the split — was judged unanchored and reported as ReDoS on
+ * the FIXED revision, so the finding survived its own fix.
+ *
+ * Returns [{body, index}] with `index` at the opening slash.
+ */
+function _extractRegexLiterals(source){
+  const out = [];
+  const s = String(source || '');
+  for (let i = 0; i < s.length; i++){
+    if (s[i] !== '/') continue;
+    if (s[i + 1] === '/' || s[i + 1] === '*') continue;   // comment, not a literal
+    let j = i + 1, cls = false, body = '', closed = false;
+    for (; j < s.length; j++){
+      const ch = s[j];
+      if (ch === '\n') break;                              // literals never span lines
+      if (ch === '\\'){ body += ch + (s[j + 1] || ''); j++; continue; }
+      if (cls){ if (ch === ']') cls = false; body += ch; continue; }
+      if (ch === '['){ cls = true; body += ch; continue; }
+      if (ch === '/'){ closed = true; break; }
+      body += ch;
+    }
+    if (closed && body.length){ out.push({ body, index: i }); i = j; }
+  }
+  return out;
+}
 function scanReDoS(fp,raw){
   // ReDoS only applies to languages with regex-literal or RegExp() syntax.
   // Solidity, Java, Go, C/C++, Rust use `/` as the division operator —
@@ -5274,7 +5633,6 @@ function scanReDoS(fp,raw){
   // shapes. Otherwise lines like `// hello /world/` are mis-parsed as regexes
   // and safe-regex chokes on the text content.
   const cleaned = stripNoiseAndStrings(raw);
-  const litRe=/\/((?:\\.|[^\/\n])+)\/[gimsuy]{0,5}/g;
   const ctorRe=/new\s+RegExp\s*\(\s*['"`]((?:\\.|[^'"`\n])+)['"`]/g;
   function check(re, source){
     let m;while((m=re.exec(source))!==null){
@@ -5291,13 +5649,25 @@ function scanReDoS(fp,raw){
     }
   }
   // Regex literals: scan against `cleaned` so comment slashes don't fool us.
-  check(litRe, cleaned);
+  // Extracted with a character-class-aware walker rather than a regex — see
+  // _extractRegexLiterals for why the regex form was actively harmful.
+  for (const { body, index } of _extractRegexLiterals(cleaned)) {
+    if (!_isLikelyUnsafeRegex(body)) continue;
+    const line = cleaned.substring(0, index).split("\n").length;
+    out.push({
+      vuln:"Regex ReDoS — Catastrophic Backtracking",
+      severity:"medium",cwe:"CWE-1333",stride:"Denial of Service",
+      fix:"Rewrite the regex to avoid nested quantifiers and overlapping alternation. Consider the `re2` library for linear-time matching.",
+      code:"// Use the Google RE2 library which guarantees linear-time evaluation:\nconst RE2 = require('re2');\nconst re = new RE2(pattern);",
+      file:fp,line,snippet:lines[line-1]?.trim()||body
+    });
+  }
   // `new RegExp("...")` form: also via cleaned (comments out, but the literal
   // string pattern is the source we care about — already preserved by
   // stripNoiseAndStrings via the regex-literal carve-out... actually no, our
   // string-stripper blanks "..." contents. Use the comment-stripped view for
   // ctor form so the pattern string survives.).
-  check(ctorRe, stripNoise(raw));
+  check(ctorRe, stripNoise(raw,fp));
   return out;
 }
 
@@ -5405,7 +5775,7 @@ const EXTRA_STRUCTURAL_PATTERNS=[
 
 function scanExtraStructural(fp,raw){
   const cleaned=stripNoiseAndStrings(raw);
-  const cleanedNoise=stripNoise(raw);
+  const cleanedNoise=stripNoise(raw,fp);
   const lines=raw.split('\n');
   const findings=[];
   const ctx = inferFileContext(fp, raw);
@@ -6478,7 +6848,7 @@ const CIPHER_TRANSIT_PATTERNS=[
   {regex:/OpenSSL::SSL::SSLContext\.new/g,getLabel:()=>"Ruby OpenSSL::SSL::SSLContext",ctx:"Ruby ssl"},
 ];
 function classifyCipherStrength(cipher){const c=cipher.toUpperCase();if(/\bRC4\b|\bRC2\b|\bARCFOUR\b|SSLV2|SSLV3|\bNULL\b|\bEXPORT\b|\bANULL\b|\bENULL\b|\bECB\b|\bMD5\b|\bSHA1\b(?![\d_])/.test(c))return"weak";if(/\bDES\b/.test(c)&&!/3DES|EDE|TRIPLE/.test(c))return"weak";if(/3DES|TRIPLE.?DES|DES.EDE|TLS.?1.?1|TLSV1\.1/.test(c))return"weak";if(/BCRYPT|ARGON2|SCRYPT|PBKDF2|FERNET|CHACHA20|CHACHAPOLY|PASSWORD_BCRYPT|PASSWORD_ARGON/.test(c))return"strong";if(/\bAES\b|SHA256|SHA384|SHA512|SHA3|BLAKE2|HMACSHA256|HMACSHA512|\bGCM\b|\bCCM\b|ECDHE|DHE|TLS.?1.?[23]|TLSV1\.[23]|HTTPS.SERVER|TLS.SERVER|TLS.CERTIF|HS256|RS256|ES256/.test(c))return"strong";return"unknown";}
-function scanCiphers(fp,raw){const cleaned=stripNoise(raw);const lines=raw.split("\n");const atRest=[],inTransit=[];for(const pat of CIPHER_REST_PATTERNS){const re=new RegExp(pat.regex.source,pat.regex.flags);let m;while((m=re.exec(cleaned))){const line=lineAt(cleaned,m.index);const cipher=pat.getLabel(m);atRest.push({cipher,strength:classifyCipherStrength(cipher),ctx:pat.ctx,file:fp,line,snippet:(lines[line-1]||"").trim()});}}for(const pat of CIPHER_TRANSIT_PATTERNS){const re=new RegExp(pat.regex.source,pat.regex.flags);let m;while((m=re.exec(cleaned))){const line=lineAt(cleaned,m.index);const cipher=pat.getLabel(m);inTransit.push({cipher,strength:classifyCipherStrength(cipher),ctx:pat.ctx,file:fp,line,snippet:(lines[line-1]||"").trim()});}}const uniq=(a)=>a.filter((v,i,arr)=>arr.findIndex(x=>x.cipher===v.cipher&&x.file===v.file&&x.line===v.line)===i);return{atRest:uniq(atRest),inTransit:uniq(inTransit)};}
+function scanCiphers(fp,raw){const cleaned=stripNoise(raw,fp);const lines=raw.split("\n");const atRest=[],inTransit=[];for(const pat of CIPHER_REST_PATTERNS){const re=new RegExp(pat.regex.source,pat.regex.flags);let m;while((m=re.exec(cleaned))){const line=lineAt(cleaned,m.index);const cipher=pat.getLabel(m);atRest.push({cipher,strength:classifyCipherStrength(cipher),ctx:pat.ctx,file:fp,line,snippet:(lines[line-1]||"").trim()});}}for(const pat of CIPHER_TRANSIT_PATTERNS){const re=new RegExp(pat.regex.source,pat.regex.flags);let m;while((m=re.exec(cleaned))){const line=lineAt(cleaned,m.index);const cipher=pat.getLabel(m);inTransit.push({cipher,strength:classifyCipherStrength(cipher),ctx:pat.ctx,file:fp,line,snippet:(lines[line-1]||"").trim()});}}const uniq=(a)=>a.filter((v,i,arr)=>arr.findIndex(x=>x.cipher===v.cipher&&x.file===v.file&&x.line===v.line)===i);return{atRest:uniq(atRest),inTransit:uniq(inTransit)};}
 
 function scanCredentials(fp,raw){
   if(!CRED_PREFILTER.test(raw))return[];
@@ -7651,7 +8021,7 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   const _perFileTimeoutMs = parseInt(process.env.AGENTIC_SECURITY_PER_FILE_TIMEOUT_MS || '10000', 10);
   const _fileTimings = [];
   let _filesSkipped = 0, _filesTimedOut = 0, _filesDenseSkipped = 0;
-  const files=Object.keys(fileContents).filter(f=>shouldScan(f) && !_isPathIgnored(f));const fc={},pfr={};const aR=[],aF=[],aSrc=[],aSink=[],aSan=[],aLogic=[],aSupply=[],aSecrets=[],aCiphersRest=[],aCiphersTransit=[];
+  const files=Object.keys(fileContents).filter(f=>(shouldScan(f) || isKubernetesManifest(f, fileContents[f])) && !_isPathIgnored(f));const fc={},pfr={};const aR=[],aF=[],aSrc=[],aSink=[],aSan=[],aLogic=[],aSupply=[],aSecrets=[],aCiphersRest=[],aCiphersTransit=[];
   // ---- R8: opt-in per-file checkpointing (AGENTIC_SECURITY_RESUME=1, or
   // runScan({resume:true})). Default OFF, so existing behaviour is untouched.
   // Only this loop is checkpointed; every cross-file pass below re-runs, so
@@ -7719,112 +8089,112 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   let i=0;for(const p of files){i++;const _ft0=Date.now();setProgress({current:i,total:files.length,file:p.split("/").pop(),phase:"Scanning"});
     if(_ckptDone.has(p)&&_ckptReplay(p))continue;
     const _mk={aR:aR.length,aF:aF.length,aSrc:aSrc.length,aSink:aSink.length,aSan:aSan.length,aLogic:aLogic.length,aSecrets:aSecrets.length,aCR:aCiphersRest.length,aCT:aCiphersTransit.length,sup:_suppressionLog.length};
-    try{const c=fileContents[p];if(!c||c.length>500000){_filesSkipped++;continue;}const _avgLine=c.length/Math.max(c.split('\n').length,1);if(_avgLine>400&&c.length>10000){_filesDenseSkipped++;continue;}fc[p]=c;aR.push(...scanRoutes(p,c));const ta=performAnalysis(p,c);pfr[p]=ta;aF.push(...ta.findings);aSrc.push(...ta.sources);aSink.push(...ta.sinks);aSan.push(...ta.sanitizers);aLogic.push(...scanLogicVulns(p,c));aSecrets.push(...scanCredentials(p,c));aF.push(...scanStructuralVulns(p,c));aF.push(...scanExtraStructural(p,c));aF.push(...scanAliasedSinks(p,c));aF.push(...scanJavaSAST(p,c));aF.push(...scanJavaBenchExtras(p,c));aLogic.push(...scanMiddlewareOrdering(p,c));aLogic.push(...scanReDoS(p,c));if(/\.(?:java|cs|kt|py|php|phtml)$/i.test(p)){try{aLogic.push(...scanRegexReDoS(p,c));}catch(_){}}aLogic.push(...scanTodosNearSecurity(p,c));aSecrets.push(...scanEntropySecrets(p,c));const cp=scanCiphers(p,c);aCiphersRest.push(...cp.atRest);aCiphersTransit.push(...cp.inTransit);if(/\.(graphql|gql)$/i.test(p))aF.push(...scanGraphQL(p,c));aF.push(...scanIaC(p,c));aF.push(...scanTerraform(p,c));
+    try{const c=fileContents[p];if(!c||c.length>500000){_filesSkipped++;continue;}const _avgLine=c.length/Math.max(c.split('\n').length,1);if(_avgLine>400&&c.length>10000){_filesDenseSkipped++;continue;}const cc=_blankCached(c,_commentLangFor(p));fc[p]=c;aR.push(...scanRoutes(p,cc));const ta=performAnalysis(p,c);pfr[p]=ta;aF.push(...ta.findings);aSrc.push(...ta.sources);aSink.push(...ta.sinks);aSan.push(...ta.sanitizers);aLogic.push(...scanLogicVulns(p,cc));aSecrets.push(...scanCredentials(p,c));aF.push(...scanStructuralVulns(p,cc));aF.push(...scanExtraStructural(p,cc));aF.push(...scanAliasedSinks(p,cc));aF.push(...scanJavaSAST(p,cc));aF.push(...scanJavaBenchExtras(p,cc));aLogic.push(...scanMiddlewareOrdering(p,cc));aLogic.push(...scanReDoS(p,cc));if(/\.(?:java|cs|kt|py|php|phtml)$/i.test(p)){try{aLogic.push(...scanRegexReDoS(p,cc));}catch(_){}}aLogic.push(...scanTodosNearSecurity(p,c));aSecrets.push(...scanEntropySecrets(p,c));const cp=scanCiphers(p,cc);aCiphersRest.push(...cp.atRest);aCiphersTransit.push(...cp.inTransit);if(/\.(graphql|gql)$/i.test(p))aF.push(...scanGraphQL(p,cc));aF.push(...scanIaC(p,cc));aF.push(...scanTerraform(p,cc));
       aF.push(...scanLLM(p,c));
       aF.push(...scanLLMOwasp(p,c));
       aF.push(...scanLlmCost(p,c));
-      aLogic.push(...scanBusinessLogic(p,c));
-      aF.push(...scanPipeline(p,c));
-      aF.push(...scanContainer(p,c));
-      aF.push(...scanInstallScripts(p,c));
+      aLogic.push(...scanBusinessLogic(p,cc));
+      aF.push(...scanPipeline(p,cc));
+      aF.push(...scanContainer(p,cc));
+      aF.push(...scanInstallScripts(p,cc));
       aF.push(...scanMCP(p,c));
       aF.push(...scanClaudeSettings(p,c));
       aF.push(...scanClaudeMdPromptInjection(p,c));
       aF.push(...scanClaudeHookInjection(p,c));
-      aF.push(...scanDjangoHardening(p,c));
-      aF.push(...scanDefiDeep(p,c));
-      aF.push(...scanSpringbootHardening(p,c));
-      aF.push(...scanLaravelHardening(p,c));
-      aF.push(...scanSwift(p,c));
-      aF.push(...scanDartFlutter(p,c));
-      aF.push(...scanWeakRandomness(p,c));
-      aF.push(...scanGraphQLModule(p,c));
-      aF.push(...scanSensitiveDataLogging(p,c));
-      aF.push(...scanComparisonSafety(p,c));
-      aF.push(...scanWeakPasswordHash(p,c));
-      aF.push(...scanCachePoisoning(p,c));
-      aF.push(...scanNullByteInjection(p,c));
+      aF.push(...scanDjangoHardening(p,cc));
+      aF.push(...scanDefiDeep(p,cc));
+      aF.push(...scanSpringbootHardening(p,cc));
+      aF.push(...scanLaravelHardening(p,cc));
+      aF.push(...scanSwift(p,cc));
+      aF.push(...scanDartFlutter(p,cc));
+      aF.push(...scanWeakRandomness(p,cc));
+      aF.push(...scanGraphQLModule(p,cc));
+      aF.push(...scanSensitiveDataLogging(p,cc));
+      aF.push(...scanComparisonSafety(p,cc));
+      aF.push(...scanWeakPasswordHash(p,cc));
+      aF.push(...scanCachePoisoning(p,cc));
+      aF.push(...scanNullByteInjection(p,cc));
       aF.push(...scanLlmTradingAgent(p,c));
-      aF.push(...scanMobileManifest(p,c));
-      aF.push(...scanQuarkusHardening(p,c));
-      aF.push(...scanFastapiHardening(p,c));
-      aF.push(...scanAuthZ(p,c));
-      aF.push(...scanModelLoad(p,c));
+      aF.push(...scanMobileManifest(p,cc));
+      aF.push(...scanQuarkusHardening(p,cc));
+      aF.push(...scanFastapiHardening(p,cc));
+      aF.push(...scanAuthZ(p,cc));
+      aF.push(...scanModelLoad(p,cc));
       aF.push(...scanPromptTemplate(p,c));
-      aF.push(...scanXXE(p,c));
-      aF.push(...scanJNDI(p,c));
-      aF.push(...scanJavaDeserialization(p,c));
-      aF.push(...scanJwtExp(p,c));
-      aF.push(...scanZipSlip(p,c));
-      aF.push(...scanFileUpload(p,c));
-      aF.push(...scanHostHeader(p,c));
-      aF.push(...scanPythonSinks(p,c));
-      aF.push(...scanCSharp(p,c));
-      aF.push(...scanCpp(p,c));
-      aF.push(...scanSolidity(p,c));
-      aF.push(...scanRust(p,c));
-      aF.push(...scanGoExtended(p,c));
-      aF.push(...scanDatabaseRLS(p,c));
-      aF.push(...scanRateLimit(p,c));
-      aF.push(...scanAuthProvider(p,c));
-      aF.push(...scanEnvHygiene(p,c));
-      aF.push(...scanWebhook(p,c));
-      aF.push(...scanClientSide(p,c));
+      aF.push(...scanXXE(p,cc));
+      aF.push(...scanJNDI(p,cc));
+      aF.push(...scanJavaDeserialization(p,cc));
+      aF.push(...scanJwtExp(p,cc));
+      aF.push(...scanZipSlip(p,cc));aF.push(...scanSiblingGuard(p,cc));
+      aF.push(...scanFileUpload(p,cc));
+      aF.push(...scanHostHeader(p,cc));
+      aF.push(...scanPythonSinks(p,cc));
+      aF.push(...scanCSharp(p,cc));
+      aF.push(...scanCpp(p,cc));
+      aF.push(...scanSolidity(p,cc));
+      aF.push(...scanRust(p,cc));
+      aF.push(...scanGoExtended(p,cc));
+      aF.push(...scanDatabaseRLS(p,cc));
+      aF.push(...scanRateLimit(p,cc));aF.push(...scanResourceExhaustion(p,cc));aF.push(...scanRedirectToctou(p,cc));aF.push(...scanCodegenSink(p,cc));aF.push(...scanOwnershipAuthz(p,cc));
+      aF.push(...scanAuthProvider(p,cc));
+      aF.push(...scanEnvHygiene(p,cc));
+      aF.push(...scanWebhook(p,cc));
+      aF.push(...scanClientSide(p,cc));
       aF.push(...scanPromptFirewall(p,c));
       aF.push(...scanLlmRedteam(p,c));
       aF.push(...scanJulietShape(p,c));
-      aF.push(...scanCppDataflow(p,c));
+      aF.push(...scanCppDataflow(p,cc));
       // Phase 1: new detectors.
-      aF.push(...scanMassAssignment(p,c));
-      aF.push(...scanPrototypePollution(p,c));
-      aF.push(...scanCSRF(p,c));
-      aF.push(...scanTOCTOU(p,c));
-      aF.push(...scanNoSQLInjection(p,c));
-      aF.push(...scanLDAPInjection(p,c));
-      aF.push(...scanXPathInjection(p,c));
-      aF.push(...scanSSTI(p,c));
-      aF.push(...scanOpenRedirect(p,c));
-      aF.push(...scanWrongContextSanitizer(p,c));
-      aF.push(...scanSanitizerContextMismatch(p,c));
-      aF.push(...scanFrontendHygiene(p,c));
-      aF.push(...scanCsvInjection(p,c));
+      aF.push(...scanMassAssignment(p,cc));
+      aF.push(...scanPrototypePollution(p,cc));
+      aF.push(...scanCSRF(p,cc));
+      aF.push(...scanTOCTOU(p,cc));
+      aF.push(...scanNoSQLInjection(p,cc));
+      aF.push(...scanLDAPInjection(p,cc));
+      aF.push(...scanXPathInjection(p,cc));
+      aF.push(...scanSSTI(p,cc));
+      aF.push(...scanOpenRedirect(p,cc));
+      aF.push(...scanWrongContextSanitizer(p,cc));
+      aF.push(...scanSanitizerContextMismatch(p,cc));
+      aF.push(...scanFrontendHygiene(p,cc));
+      aF.push(...scanCsvInjection(p,cc));
       // R16 — specialist crypto-hygiene classes (constant-time comparison,
       // secret zeroization). Narrow by design: keyed on the secret-ness of the
       // identifier, and silent whenever the correct constant-time or
       // guaranteed-wipe API is already present.
-      aF.push(...scanCryptoSpecialist(p,c));
-      aF.push(...scanStoredTaint(p,c));
-      aF.push(...scanJavaStructural(p,c));
-      aF.push(...scanCsharpStructural(p,c));
-      aF.push(...scanJsFrameworkStructural(p,c));
-      aF.push(...scanPythonStructural(p,c));
-      aF.push(...scanGoStructural(p,c));
-      aF.push(...scanSecretConcat(p,c));
-      aF.push(...scanXssReflectedMultilang(p,c));
-      aF.push(...scanCodeInjectionMultilang(p,c));
-      aF.push(...scanResponseSplitting(p,c));
+      aF.push(...scanCryptoSpecialist(p,cc));
+      aF.push(...scanStoredTaint(p,cc));
+      aF.push(...scanJavaStructural(p,cc));
+      aF.push(...scanCsharpStructural(p,cc));
+      aF.push(...scanJsFrameworkStructural(p,cc));
+      aF.push(...scanPythonStructural(p,cc));
+      aF.push(...scanGoStructural(p,cc));
+      aF.push(...scanSecretConcat(p,cc));
+      aF.push(...scanXssReflectedMultilang(p,cc));
+      aF.push(...scanCodeInjectionMultilang(p,cc));
+      aF.push(...scanResponseSplitting(p,cc));
       aF.push(...scanStoredPromptInjection(p,c));
       aF.push(...scanRAGPoisoning(p,c));
       aF.push(...scanAgentToolEscalation(p,c));
       aF.push(...scanAgentUntrustedFlow(p,c));
-      aF.push(...scanEventEntrypoints(p,c));
-      aF.push(...scanDbTaint(p,c));
-      aF.push(...scanSSRFCloudMetadata(p,c));
-      aF.push(...scanMutationXSS(p,c));
-      aF.push(...scanKotlin(p,c));
-      aF.push(...scanRuby(p,c));
-      aF.push(...scanPhp(p,c));
+      aF.push(...scanEventEntrypoints(p,cc));
+      aF.push(...scanDbTaint(p,cc));
+      aF.push(...scanSSRFCloudMetadata(p,cc));
+      aF.push(...scanMutationXSS(p,cc));
+      aF.push(...scanKotlin(p,cc));
+      aF.push(...scanRuby(p,cc));
+      aF.push(...scanPhp(p,cc));
       // Integration block: scaffolded SAST scanners. Gated by env var.
       if (process.env.AGENTIC_SECURITY_NO_INTEGRATION !== '1') {
         if (process.env.AGENTIC_SECURITY_NO_LLM_APP !== '1') aF.push(...scanLlmApp(p,c));
-        if (process.env.AGENTIC_SECURITY_NO_MOBILE  !== '1') aF.push(...scanMobile(p,c));
-        if (process.env.AGENTIC_SECURITY_NO_PQC     !== '1') aF.push(...scanPqc(p,c));
-        if (process.env.AGENTIC_SECURITY_NO_WEB3_ADV!== '1') aF.push(...scanWeb3Advanced(p,c));
-        if (process.env.AGENTIC_SECURITY_NO_DAPP    !== '1') aF.push(...scanDappFrontend(p,c));
-        if (process.env.AGENTIC_SECURITY_NO_CLOUD_IAM!== '1') aF.push(...scanCloudIam(p,c));
-        if (process.env.AGENTIC_SECURITY_NO_K8S_ADM !== '1') aF.push(...scanK8sAdmission(p,c));
-        if (process.env.AGENTIC_SECURITY_NO_CRYPTO_PROTO !== '1') aF.push(...scanCryptoProtocol(p,c));
-        if (process.env.AGENTIC_SECURITY_NO_ML_SUPPLY    !== '1') aF.push(...scanMlSupplyChain(p,c));
+        if (process.env.AGENTIC_SECURITY_NO_MOBILE  !== '1') aF.push(...scanMobile(p,cc));
+        if (process.env.AGENTIC_SECURITY_NO_PQC     !== '1') aF.push(...scanPqc(p,cc));
+        if (process.env.AGENTIC_SECURITY_NO_WEB3_ADV!== '1') aF.push(...scanWeb3Advanced(p,cc));
+        if (process.env.AGENTIC_SECURITY_NO_DAPP    !== '1') aF.push(...scanDappFrontend(p,cc));
+        if (process.env.AGENTIC_SECURITY_NO_CLOUD_IAM!== '1') aF.push(...scanCloudIam(p,cc));
+        if (process.env.AGENTIC_SECURITY_NO_K8S_ADM !== '1') aF.push(...scanK8sAdmission(p,cc));
+        if (process.env.AGENTIC_SECURITY_NO_CRYPTO_PROTO !== '1') aF.push(...scanCryptoProtocol(p,cc));
+        if (process.env.AGENTIC_SECURITY_NO_ML_SUPPLY    !== '1') aF.push(...scanMlSupplyChain(p,cc));
       }
       const _ftElapsed=Date.now()-_ft0;
       if(_ftElapsed>_perFileTimeoutMs){aF.push({id:`file-timeout:${p}`,file:p,line:0,vuln:`File analysis exceeded ${_perFileTimeoutMs}ms (${_ftElapsed}ms)`,severity:'info',parser:'ENGINE',confidence:0.5,_timeout:true});_filesTimedOut++;}
@@ -7918,7 +8288,7 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
       continue;
     }
     // Annotation-based category for OWASP Benchmark: `@WebServlet("/cat-NN/...")`.
-    const cat = _javaWebServletCategory(stripNoise(c));
+    const cat = _javaWebServletCategory(stripNoise(c,p));
     if (cat) _benchCategoryByFile.set(p, cat);
   }
   // Pre-compute fileWide safe shapes per file. Used by _shouldKeep below.
@@ -7933,7 +8303,7 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
     const c = fc[p];
     if (!c) continue;
     const safeSet = new Set();
-    const cleanedP = stripNoise(c);
+    const cleanedP = stripNoise(c,p);
     for (const fam of Object.keys(_OWASP_SAFE_SHAPES || {})) {
       const cfg = _OWASP_SAFE_SHAPES[fam];
       if (cfg && cfg.fileWide && cfg.fileWide(cleanedP)) safeSet.add(fam);
@@ -7979,6 +8349,9 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   setProgress({current:i,total:files.length,file:"Session taint...",phase:"Linking"});const sess=crossSessionTaint(fc);aF.push(...sess);
   setProgress({current:i,total:files.length,file:"Call graph...",phase:"Linking"});const callGraph=buildCallGraph(fc);
   // R19 (PRD §5): cross-route BOLA/BFLA over the aggregated route inventory.
+  // Convention deviation is PROJECT-scoped by design: the convention is a
+  // property of the codebase, not of one file (see convention-deviation.js).
+  try{aF.push(...scanConventionDeviationProject(fc));}catch(_){}
   try{aF.push(...scanApiBrokenAuthz(aR));}catch(_){}
   // R22 (PRD §5): cross-service edges inferred from code (client call → matched route).
   try{aF.push(...scanCrossService(aR,fc));}catch(_){}
@@ -7991,6 +8364,20 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   setProgress({current:i,total:files.length,file:"Config file cross-ref...",phase:"Linking"});aLogic.push(...scanConfigFiles(fc));
   setProgress({current:i,total:files.length,file:"OSV vulnerability database...",phase:"SCA"});
   const allFileContents={...fc, ...depFileContents};
+  // PRD F11.4 — malicious install hooks, scanned where package.json actually
+  // lives. `scanInstallScripts` was wired into the per-file SAST dispatch, but
+  // that loop iterates `files`, which comes from `fileContents` — and
+  // `package.json` is routed to depFileContents and fails `shouldScan()`, so
+  // the detector was never invoked by a real scan. Measured: 1 finding when
+  // called directly on its fixture, 0 through runScan.
+  //
+  // Fixed HERE rather than by admitting package.json into the SAST loop, which
+  // would put a manifest through all ~117 code detectors to satisfy one rule.
+  // A manifest detector belongs on the manifest path.
+  for (const [mp, mc] of Object.entries(depFileContents)) {
+    if (!/(?:^|\/)package\.json$/i.test(mp)) continue;
+    try { aF.push(...scanInstallScripts(mp, mc)); } catch (_) { /* never fail a scan on one manifest */ }
+  }
   const components=parseManifests(allFileContents);
   // R8 (PRD §5): OS packages from an extracted container image's package DBs
   // (dpkg/apk) — baked-in deps the Dockerfile never names. Feed the OSV/SBOM pipeline.
@@ -9606,3 +9993,8 @@ export {
   STORED_TAINT_FIELD_PATTERNS, STORED_TAINT_SINK_PATTERNS,
   FIXES, NEW_FIXES,
 };
+
+/** Internals exposed for targeted unit tests (not part of the public API). */
+export const _internals = {
+  _isLikelyUnsafeRegex, _isAnchoredRegex, _hasNestedQuantifier, _extractRegexLiterals, _hasLeadingUnboundedQuantifier,
+};