@clear-capabilities/agentic-security-scanner 0.140.0 → 0.142.0

package/src/engine.js

@@ -15,6 +15,7 @@ import { scanLlmCost } from './sast/llm-cost-advisor.js';
 import { scanBusinessLogic } from './sast/logic.js';
 import { scanPipeline } from './sast/pipeline.js';
 import { scanMCP } from './sast/mcp-audit.js';
+import { detectRugPull as _detectRugPull, saveBaseline as _saveMcpBaseline, fingerprintConfig as _fingerprintMcp } from './posture/mcp-rug-pull.js';
 import { scanClaudeSettings } from './sast/claude-settings.js';
 import { scanClaudeMdPromptInjection } from './sast/claude-md-prompt-injection.js';
 import { scanClaudeHookInjection } from './sast/claude-hook-injection.js';
@@ -36,8 +37,10 @@ import { scanMobileManifest } from './sast/mobile-manifest.js';
 import { scanQuarkusHardening } from './sast/quarkus-hardening.js';
 import { scanFastapiHardening } from './sast/fastapi-hardening.js';
 import { isDeterministic } from './posture/deterministic.js';
+import { proofCoverage } from './posture/proof-coverage.js';
 import { scanAuthZ } from './sast/authz.js';
 import { scanApiBrokenAuthz } from './sast/api-authz.js';
+import { scanCloudTemplates, isCloudFormationTemplate } from './sast/iac-cloud-templates.js';
 import { scanTerraform } from './sast/iac-terraform.js';
 import { scanCrossService } from './sast/cross-service.js';
 import { scanRbacConsistency } from './sast/rbac-consistency.js';
@@ -125,7 +128,7 @@ import { scanMutationXSS } from './sast/mutation-xss.js';
 import { scanDeserializationGadgets, _detectGadgets } from './sast/deserialization-gadgets.js';
 // Phase 2 — Kotlin / Ruby / PHP coverage.
 import { scanKotlin } from './sast/kotlin.js';
-import { scanRuby } from './sast/ruby.js';
+import { scanRuby, scanRubyPathJoin } from './sast/ruby.js';
 import { scanPhp } from './sast/php.js';
 import { classifySecretCandidate as _entropyClassifySecret } from './sast/_secret-entropy.js';
 // Phase 1 — precision-engineering posture modules.
@@ -665,6 +668,7 @@ function _isIaCFile(p){
   if (IAC_FILENAMES.has(base)) return true;
   if (/\.dockerfile$/i.test(base)) return true;
   if (/\.tf$|\.tfvars$/i.test(base)) return true;
+  if (/\.bicep$/i.test(base)) return true;
   // K8s YAML heuristic: under k8s/ — the CONTENT half of this rule lives in
   // `isKubernetesManifest` below, because a path predicate cannot see content.
   if (/(?:^|\/)k8s(?:\/|$)/.test(p) && /\.ya?ml$/i.test(base)) return true;
@@ -710,6 +714,27 @@ export function isKubernetesManifest(relPath, content) {
   return _K8S_API_VERSION_RE.test(head) && _K8S_KIND_RE.test(head);
 }
 function getExt(n){const p=n.split(".");return p.length>1?p.pop().toLowerCase():"";}
+
+// Agent instruction files (CLAUDE.md, AGENTS.md, .cursorrules, …) are admitted
+// by CONTENT-INDEPENDENT NAME, the same way isKubernetesManifest admits a
+// manifest a path predicate cannot recognise.
+//
+// They fail shouldScan() because they are markdown, so `fileContents` never held
+// one, so scanClaudeMdPromptInjection / scanClaudeHookInjection / scanMCP at the
+// per-file dispatch could never run on them. The detectors were CORRECT and
+// fully tested when called directly — they were simply never called. That is the
+// same dark-detector shape as k8s-admission and install-script, and it is worse
+// here: for an agentic security tool a poisoned instruction file loaded into
+// every session is a flagship threat, and a normal scan could not see it.
+//
+// Matched on the naming convention only. A repository's ordinary docs stay out
+// of scope, so this admits a handful of files rather than every .md in the tree.
+const _INSTRUCTION_FILE_ADMIT_RE = /(?:^|[\\/])(?:CLAUDE|AGENTS|GEMINI|CURSOR|CODEX|KIRO|QWEN|TRAE|OPENCODE|SYSTEM_PROMPT)\.(?:md|markdown|txt|prompt|system\.md)$|(?:^|[\\/])\.(?:cursorrules|windsurfrules|aiderrules)$|(?:^|[\\/])\.(?:claude|cursor|codex|gemini)[\\/].*\.(?:md|json|ya?ml)$/i;
+
+export function isInstructionFile(relPath) {
+  return typeof relPath === 'string' && _INSTRUCTION_FILE_ADMIT_RE.test(relPath);
+}
+
 function shouldScan(p){if(/\.(test|spec|mock)\./i.test(p))return false;if(/_test\.go$/i.test(p))return false;if(/_spec\.rb$/i.test(p))return false;if(/Test\.(?:java|cs|kt|scala)$/i.test(p))return false;if(/\.min\.[mc]?js$/i.test(p))return false;for(const x of p.split("/"))if(IGNORE_DIRS.has(x))return false;
   // Mobile + framework manifest files needed by the v4 detectors.
   const base=p.split('/').pop();
@@ -1402,6 +1427,10 @@ function _sinkLineIdentifiers(ctx) {
 // (excluding the sink line itself, which trivially contains its own
 // argument). Tries every match, not just the first, since a window can
 // contain several guard-shaped lines and only one need actually correlate.
+// A function/method declaration line, in every language this engine reads.
+// Matching a guard-shaped NAME here means a method is being defined, not called.
+const _DECL_LINE_RE = /^\s*(?:@\w+\s*)?(?:(?:public|private|protected|internal|static|final|abstract|override|async|export|default|func|fun|fn|def|sub|function)\s+)+[\w.<>\[\]]+\s*\(|^\s*def\s+\w|^\s*(?:async\s+)?function\s+\w|^\s*func\s+(?:\([^)]*\)\s*)?\w+\s*\(|^\s*(?:const|let|var)\s+\w+\s*=\s*(?:async\s*)?\([^)]*\)\s*=>/;
+
 function _guardMatchNearSinkIdentifier(ctx, guardRe, span = 2) {
   const w = _guardWindow(ctx);
   const re = new RegExp(guardRe.source, guardRe.flags.includes('g') ? guardRe.flags : guardRe.flags + 'g');
@@ -1412,6 +1441,19 @@ function _guardMatchNearSinkIdentifier(ctx, guardRe, span = 2) {
   let m;
   while ((m = re.exec(w))) {
     const guardLineIdx = w.slice(0, m.index).split('\n').length - 1; // 0-based within window
+    // A DECLARATION is not a guard. The shape alternative deliberately matches a
+    // project-local validator by name (`[Cc]heck\w+\(`, `[Ee]nsure\w+\(`, …), and
+    // that also matches the line that DEFINES such a method — so
+    // `def check_static_cache(request)` was read as containment being applied,
+    // and every path-traversal finding inside a method whose own name begins
+    // "check"/"validate"/"ensure"/"verify"/"assert"/"require" was dropped.
+    //
+    // Found by test/detector-liveness.test.js on the ruby-path-join fixture: the
+    // rule fired in isolation and produced nothing through a scan — the same
+    // signature as rate-limit.js and sibling-guard-omission. Narrow by design:
+    // it skips declaration LINES, and does not touch the window heuristic that
+    // every other CWE-22 and CWE-918 emitter depends on.
+    if (_DECL_LINE_RE.test(wLines[guardLineIdx] || '')) continue;
     const lo = Math.max(0, guardLineIdx - span);
     const hi = Math.min(wLines.length, guardLineIdx + span + 1);
     const local = wLines.slice(lo, hi).filter((l) => l !== sinkLineText).join('\n');
@@ -1850,9 +1892,27 @@ const STRUCTURAL_VULN_PATTERNS=[
    type:"File Serve",vuln:"Path Traversal (sendFile with User Input)",severity:"high",cwe:"CWE-22",stride:"Information Disclosure",
    fix:"Allowlist file paths; never pass raw user input to sendFile"},
   // ── Command Injection ──────────────────────────────────────────────────────
-  {regex:/(?:exec|spawn|execSync|execFile)\s*\([^;)]*(?:req\.|\.body\.|\.query\.|\.params\.)[^;)]{0,200}\)/g,
+  // SHELL-INVOKING forms only. `exec`/`execSync` hand the whole string to a
+  // shell, so user input anywhere in the command is injection.
+  //
+  // `execFile`/`spawn` are DELIBERATELY NOT HERE. They take an argv array and
+  // do not spawn a shell, so a tainted ARGUMENT cannot inject a command — they
+  // are the canonical FIX for this very finding. The previous rule matched them
+  // and rated it critical, while its own remediation text read "Use execFile
+  // with argument array": following the advice could not clear the finding.
+  // Flagging the fix as the bug is how a team learns to ignore a scanner.
+  {regex:/(?:exec|execSync)\s*\([^;)]*(?:req\.|\.body\.|\.query\.|\.params\.)[^;)]{0,200}\)/g,
    type:"OS Command",vuln:"Command Injection (User-Controlled Input)",severity:"critical",cwe:"CWE-78",stride:"Elevation of Privilege",
    fix:"Use execFile with argument array; never interpolate user input into shell commands"},
+  // The two ways an argv-form call IS still injectable:
+  //   1. the tainted value is the COMMAND (first argument), not an argument to it
+  //   2. `shell: true` is passed, which re-introduces the shell the argv form avoids
+  {regex:/(?:execFile|spawn)(?:Sync)?\s*\(\s*[^,;)]*(?:req\.|\.body\.|\.query\.|\.params\.)[^,;)]{0,120}[,)]/g,
+   type:"OS Command",vuln:"Command Injection (User-Controlled Command Name)",severity:"critical",cwe:"CWE-78",stride:"Elevation of Privilege",
+   fix:"The COMMAND itself is user-controlled — an argv array does not help. Resolve the binary from a fixed allowlist."},
+  {regex:/(?:execFile|spawn)(?:Sync)?\s*\([^;]{0,300}shell\s*:\s*true[^;]{0,200}(?:req\.|\.body\.|\.query\.|\.params\.)|(?:execFile|spawn)(?:Sync)?\s*\([^;]{0,300}(?:req\.|\.body\.|\.query\.|\.params\.)[^;]{0,200}shell\s*:\s*true/g,
+   type:"OS Command",vuln:"Command Injection (argv form with shell:true)",severity:"critical",cwe:"CWE-78",stride:"Elevation of Privilege",
+   fix:"`shell: true` re-introduces the shell that the argv array exists to avoid. Drop the option, or escape the input."},
   {regex:/(?:vm\.runInContext|vm\.runInNewContext|new\s+vm\.Script)\s*\(/g,
    type:"VM Sandbox",vuln:"VM Sandbox Execution (RCE Risk)",severity:"critical",cwe:"CWE-94",stride:"Elevation of Privilege",
    fix:"Never execute user-supplied code in vm.runInContext; use a strict AST sandbox"},
@@ -6547,6 +6607,11 @@ function _annotateFunctionReachability(supplyChain, routes, callGraph, fc){
     if (!sites.length) { sc.functionReachable = 'unknown'; sc.routeReachable = false; continue; }
     let functionReachable = false;
     let routeReachable = false;
+    // Did ANY call site yield enough structure to reason about? If not, the
+    // honest answer is `unknown` — see the verdict assignment below.
+    let analysable = false;
+    // At least one call site sits inside an exported function — see below.
+    let publicApiSite = false;
     for (const site of sites) {
       // Classifier 1: site is inline inside a route handler (within 25 lines
       // of the route def, no intervening function declaration). This is the
@@ -6569,8 +6634,16 @@ function _annotateFunctionReachability(supplyChain, routes, callGraph, fc){
       // If any caller-chain hits a known route-handler function, the site
       // is route-reachable-via-function. If no caller at all, we keep
       // functionReachable=false for this site.
-      const enclosing = _enclosingFn(fc[site.file] || '', site.line);
+      const encInfo = _enclosingFnInfo(fc[site.file] || '', site.line);
+      const enclosing = encInfo && encInfo.name;
+      // Not being able to name the enclosing function is INCONCLUSIVE, not
+      // evidence of unreachability. Tracked so the verdict below can say so.
       if (!enclosing) continue;
+      // A public-API function with no in-tree caller is the NORMAL case, not
+      // dead code: its callers are its users. Only a private function can be
+      // shown unreachable by the absence of callers.
+      if (encInfo.exported) { publicApiSite = true; continue; }
+      analysable = true;
       const callers = _reverseCallGraphReachable(callGraph, enclosing, 4);
       if (callers.size > 1) functionReachable = true; // at least one caller exists
       for (const callerFn of callers) {
@@ -6582,18 +6655,76 @@ function _annotateFunctionReachability(supplyChain, routes, callGraph, fc){
       }
       if (routeReachable) break;
     }
-    sc.functionReachable = functionReachable ? 'reachable' : 'unreachable';
+    // ABSENCE OF PROOF IS NOT PROOF OF ABSENCE.
+    //
+    // This read `functionReachable ? 'reachable' : 'unreachable'`, so a site the
+    // analysis could not reason about — no recognisable enclosing function, no
+    // routes in the project at all — was reported as UNREACHABLE and the finding
+    // demoted to `info`. For a LIBRARY that is every site: express has no routes,
+    // so `cookie` and `send`, both required at the top of `lib/response.js` and
+    // called directly, were demoted out of the report.
+    //
+    // Measured by bench/sca-replay's reachability scorer (PRD F3.2): of the three
+    // demotions it could adjudicate against an import-level oracle, ALL THREE were
+    // false — express/cookie, express/send, poetry/requests, each genuinely
+    // imported. A false `unreachable` is a MISSED EXPLOIT, the expensive
+    // direction, so inconclusive now yields `unknown`: the finding keeps its
+    // severity and the analysis stops making a claim it cannot support.
+    // A project with NO ROUTES is a library, and "not reachable from any route"
+    // is not a claim that can be made about one: its callers are its users, who
+    // are not in this tree. express requires `cookie` and `send` at the top of
+    // lib/response.js and calls both directly — there is simply no route to
+    // trace them to, and reporting that as `unreachable` demoted two live
+    // dependencies to `info`. Same shape for poetry/requests.
+    //
+    // This is the library-vs-application distinction the PRD already flags for
+    // the taint engine (F2.3, "for a library the caller IS the attacker"),
+    // showing up here as a false demotion instead of a false negative.
+    const projectHasRoutes = Array.isArray(routes) && routes.length > 0;
+    sc.functionReachable = functionReachable
+      ? 'reachable'
+      : (analysable && projectHasRoutes && !publicApiSite ? 'unreachable' : 'unknown');
     sc.routeReachable = routeReachable;
   }
 }
-function _enclosingFn(content,line){
+// The declaration form of the function enclosing `line`, scanning backwards.
+//
+// Recognises four shapes, not one. The original matched only `function name(`
+// and `const name = (`, so an ANONYMOUS function assigned to a member —
+// `res.cookie = function (name, value, options) {`, which is how most of
+// express, and most of the JS ecosystem, defines a public method — was invisible.
+// The scan then walked past it and attributed the call site to whatever
+// unrelated function appeared further up the file.
+//
+// `exported` matters as much as the name: a function assigned to a member or to
+// module.exports is PUBLIC API, so having no caller inside this repository is
+// the normal case and says nothing about whether it can be reached. Treating it
+// as evidence of unreachability is what demoted express's live `cookie`
+// dependency to `info`.
+function _enclosingFnInfo(content,line){
   const lines=content.split('\n');
   for(let i=line-2;i>=0;i--){
-    const m=lines[i].match(/(?:function\s+(\w+)|(?:const|let|var)\s+(\w+)\s*=\s*(?:async\s*)?\()/);
-    if(m)return m[1]||m[2]||null;
+    const l=lines[i];
+    let m=l.match(/(?:^|\s)(?:async\s+)?function\s+(\w+)\s*\(/);
+    if(m)return {name:m[1],exported:/^\s*export\b/.test(l)};
+    m=l.match(/^\s*(?:export\s+)?(?:const|let|var)\s+(\w+)\s*=\s*(?:async\s*)?\(/);
+    if(m)return {name:m[1],exported:/^\s*export\b/.test(l)};
+    // `X.y = function (…)` / `X.y = async (…) => ` / `module.exports.y = …`
+    m=l.match(/^\s*(?:module\.)?(\w+)\.(\w+)\s*=\s*(?:async\s*)?(?:function\b|\()/);
+    if(m)return {name:m[2],exported:true};
+    // `module.exports = function name(…)`
+    m=l.match(/^\s*module\.exports\s*=\s*(?:async\s*)?function\s*(\w*)\s*\(/);
+    if(m)return {name:m[1]||'module.exports',exported:true};
+    // Object-literal method / class method: `cookie: function (` or `cookie(a) {`
+    m=l.match(/^\s*(\w+)\s*:\s*(?:async\s*)?(?:function\b|\()/);
+    if(m)return {name:m[1],exported:false};
   }
   return null;
 }
+function _enclosingFn(content,line){
+  const info=_enclosingFnInfo(content,line);
+  return info?info.name:null;
+}
 
 // 0.6.0 Feat-2: Toxic-combinations score — composes multi-signal risk into 0–100.
 // Composes existing per-finding signals into a 0–100 toxicity score with a
@@ -6851,6 +6982,19 @@ const CIPHER_TRANSIT_PATTERNS=[
 function classifyCipherStrength(cipher){const c=cipher.toUpperCase();if(/\bRC4\b|\bRC2\b|\bARCFOUR\b|SSLV2|SSLV3|\bNULL\b|\bEXPORT\b|\bANULL\b|\bENULL\b|\bECB\b|\bMD5\b|\bSHA1\b(?![\d_])/.test(c))return"weak";if(/\bDES\b/.test(c)&&!/3DES|EDE|TRIPLE/.test(c))return"weak";if(/3DES|TRIPLE.?DES|DES.EDE|TLS.?1.?1|TLSV1\.1/.test(c))return"weak";if(/BCRYPT|ARGON2|SCRYPT|PBKDF2|FERNET|CHACHA20|CHACHAPOLY|PASSWORD_BCRYPT|PASSWORD_ARGON/.test(c))return"strong";if(/\bAES\b|SHA256|SHA384|SHA512|SHA3|BLAKE2|HMACSHA256|HMACSHA512|\bGCM\b|\bCCM\b|ECDHE|DHE|TLS.?1.?[23]|TLSV1\.[23]|HTTPS.SERVER|TLS.SERVER|TLS.CERTIF|HS256|RS256|ES256/.test(c))return"strong";return"unknown";}
 function scanCiphers(fp,raw){const cleaned=stripNoise(raw,fp);const lines=raw.split("\n");const atRest=[],inTransit=[];for(const pat of CIPHER_REST_PATTERNS){const re=new RegExp(pat.regex.source,pat.regex.flags);let m;while((m=re.exec(cleaned))){const line=lineAt(cleaned,m.index);const cipher=pat.getLabel(m);atRest.push({cipher,strength:classifyCipherStrength(cipher),ctx:pat.ctx,file:fp,line,snippet:(lines[line-1]||"").trim()});}}for(const pat of CIPHER_TRANSIT_PATTERNS){const re=new RegExp(pat.regex.source,pat.regex.flags);let m;while((m=re.exec(cleaned))){const line=lineAt(cleaned,m.index);const cipher=pat.getLabel(m);inTransit.push({cipher,strength:classifyCipherStrength(cipher),ctx:pat.ctx,file:fp,line,snippet:(lines[line-1]||"").trim()});}}const uniq=(a)=>a.filter((v,i,arr)=>arr.findIndex(x=>x.cipher===v.cipher&&x.file===v.file&&x.line===v.line)===i);return{atRest:uniq(atRest),inTransit:uniq(inTransit)};}
 
+// True for the JWT specimen published in the standard's own documentation.
+// Decodes the payload rather than matching the encoded string, so a token that
+// merely shares a prefix is not suppressed.
+function _isSpecimenJwt(token){
+  try{
+    const parts=String(token).split('.');
+    if(parts.length!==3)return false;
+    const payload=Buffer.from(parts[1].replace(/-/g,'+').replace(/_/g,'/'),'base64').toString('utf8');
+    const d=JSON.parse(payload);
+    return d&&d.sub==='1234567890'&&typeof d.name==='string'&&d.name==='John Doe';
+  }catch(_){return false;}
+}
+
 function scanCredentials(fp,raw){
   if(!CRED_PREFILTER.test(raw))return[];
   const lines=raw.split("\n");const results=[];const seen=new Set();
@@ -6860,11 +7004,23 @@ function scanCredentials(fp,raw){
     while((m=re.exec(raw))!=null){
       const val=m[0];
       if(/placeholder|example|xxx+|your_|changeme|<[A-Z_]+>|MY_|INSERT_|REPLACE_|TODO|test_key|fake_|sample_|dummy_/i.test(val))continue;
+      // The published specimen token, which appears verbatim in essentially
+      // every piece of JWT documentation and in most auth tutorials. Its
+      // payload decodes to {"sub":"1234567890","name":"John Doe",…} — a
+      // documented example value in exactly the sense AKIAIOSFODNN7EXAMPLE is,
+      // and suppressed for the same reason and just as narrowly: the check is
+      // on the DECODED payload, so a real token that merely resembles it is
+      // unaffected. Found by bench/secrets-precision as the single false
+      // positive in its negative set.
+      if(pat.n==="Exposed JWT Token"&&_isSpecimenJwt(val))continue;
       const line=raw.substring(0,m.index).split("\n").length;
       const snippet=lines[line-1]?.trim()||"";
       // Per-pattern line-context gate: if ctx is set, the matched line must satisfy it
       if(pat.ctx&&!pat.ctx.test(snippet))continue;
-      if(pat.n==="Password in URL"&&/localhost|127\.0\.|0\.0\.0\.0|example\.com|test\.com|::1|user:pass|admin:admin|foo:bar|user:password|username:password|admin:password|root:password|test:test|john:doe|demo:demo|myuser:mypass|guest:guest/i.test(val))continue;
+      // The same placeholder-credential guard now covers every URI-with-inline-
+      // credentials pattern, not just the one it was written for. A connection
+      // string pointing at localhost with `user:pass` is a README, not a leak.
+      if((pat.n==="Password in URL"||pat.urlCreds)&&/localhost|127\.0\.|0\.0\.0\.0|example\.com|test\.com|::1|user:pass|admin:admin|foo:bar|user:password|username:password|admin:password|root:password|test:test|john:doe|demo:demo|myuser:mypass|guest:guest/i.test(val))continue;
       const key=`${fp}:${line}:${pat.n}`;
       if(seen.has(key))continue;seen.add(key);
       const severity=pat.s==="c"?"critical":pat.s==="h"?"high":"medium";
@@ -6873,10 +7029,18 @@ function scanCredentials(fp,raw){
       // unredacted-snippet leak as scanEntropySecrets — `snippet` carried
       // the raw source line (full credential value) straight through to
       // every report format. Redact the exact matched value here too.
-      results.push({vuln:pat.n,severity,cwe:"CWE-798",stride:"Information Disclosure",file:fp,line,snippet:snippet.split(val).join(masked),masked,fix:"Remove the hardcoded credential. Store secrets in environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager). Rotate the exposed credential immediately, treat it as compromised.",code:`// Remove hardcoded value:\n// const secret = "${masked}";\n\n// Use environment variable instead:\nconst secret = process.env.${pat.n.toUpperCase().replace(/[^A-Z0-9]/g,"_")};`});
+      results.push({vuln:pat.n,severity,cwe:"CWE-798",stride:"Information Disclosure",file:fp,line,_urlCreds:!!pat.urlCreds,snippet:snippet.split(val).join(masked),masked,fix:"Remove the hardcoded credential. Store secrets in environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager). Rotate the exposed credential immediately, treat it as compromised.",code:`// Remove hardcoded value:\n// const secret = "${masked}";\n\n// Use environment variable instead:\nconst secret = process.env.${pat.n.toUpperCase().replace(/[^A-Z0-9]/g,"_")};`});
     }
   }
-  return results;
+  // One secret, one finding. A `postgres://user:pass@host/db` matches both the
+  // specific PostgreSQL pattern and the generic "Password in URL" one, and
+  // reporting the same credential on the same line twice is noise that makes a
+  // secrets report look padded. The specific name wins: it tells the reader
+  // which system to go and rotate.
+  const specificUrlLines=new Set(results.filter(r=>r._urlCreds).map(r=>`${r.file}:${r.line}`));
+  const deduped=results.filter(r=>!(r.vuln==="Password in URL"&&specificUrlLines.has(`${r.file}:${r.line}`)));
+  for(const r of deduped)delete r._urlCreds;
+  return deduped;
 }
 
 /* ── OSV-backed SCA Engine ───────────────────────────────────────────────── */
@@ -6977,16 +7141,60 @@ async function _enrichWithEPSS(supplyChainResults){
 const _KEV_FEED_URL = 'https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json';
 const _KEV_TTL_MS = 24 * 60 * 60 * 1000;
 
+// PRD F3.4 — a KEV catalog has no meaning without its age.
+//
+// The refresh TTL above only decides when to TRY the network. Every failure
+// path below falls back to `cached?.byCve` with NO age bound, so an offline
+// machine, a blocked egress rule or a CISA outage silently serves a catalog of
+// any age. A six-month-old catalog does not fail loudly — it quietly omits
+// every vulnerability added since, which UNDERSTATES risk. That is the worst
+// direction for this particular signal: KEV membership is used to escalate.
+//
+// The catalog is still used when stale (dropping it would understate risk even
+// harder), but its age is recorded and surfaced on the scan so a report can
+// state it, and `staleness` is a first-class value rather than an inference.
+const _KEV_STALE_AFTER_MS = 7 * 24 * 60 * 60 * 1000;
+
+// Populated by _loadKEVCatalog and read when the scan result is assembled.
+let _kevCatalogMeta = { source: 'not-loaded', fetchedAt: null, ageDays: null, stale: null, entries: 0 };
+export function kevCatalogMeta() { return { ..._kevCatalogMeta }; }
+
+function _setKevMeta(source, ts, entries) {
+  const ageMs = ts ? Date.now() - ts : null;
+  _kevCatalogMeta = {
+    source,
+    fetchedAt: ts ? new Date(ts).toISOString() : null,
+    ageDays: ageMs == null ? null : Math.floor(ageMs / 86400000),
+    stale: ageMs == null ? null : ageMs > _KEV_STALE_AFTER_MS,
+    entries: entries || 0,
+    meaning: 'KEV membership escalates severity. A stale catalog omits recently-added CVEs, so it understates risk rather than overstating it.',
+  };
+}
+
 async function _loadKEVCatalog(){
-  if (process.env.AGENTIC_SECURITY_OFFLINE === '1') return null;
+  if (process.env.AGENTIC_SECURITY_OFFLINE === '1') {
+    _setKevMeta('offline-skipped', null, 0);
+    return null;
+  }
   // Cached blob: { ts, byCve: { 'CVE-XXXX-YYYY': { dateAdded, ransomwareCampaign, vendor, product, vuln, action } } }
   const cached = _osvCacheGet('kev:catalog');
-  if (cached && cached.ts && (Date.now() - cached.ts < _KEV_TTL_MS)) return cached.byCve || null;
+  if (cached && cached.ts && (Date.now() - cached.ts < _KEV_TTL_MS)) {
+    _setKevMeta('cache-fresh', cached.ts, Object.keys(cached.byCve || {}).length);
+    return cached.byCve || null;
+  }
+  const fallback = () => {
+    if (cached && cached.byCve) {
+      _setKevMeta('cache-stale', cached.ts || null, Object.keys(cached.byCve).length);
+      return cached.byCve;
+    }
+    _setKevMeta('unavailable', null, 0);
+    return null;
+  };
   try {
     const res = await fetch(_KEV_FEED_URL, {
       headers: { 'User-Agent': 'agentic-security/0.1' },
     });
-    if (!res.ok) return cached?.byCve || null;
+    if (!res.ok) return fallback();
     const j = await res.json();
     const byCve = {};
     for (const v of (j.vulnerabilities || [])) {
@@ -7001,9 +7209,11 @@ async function _loadKEVCatalog(){
         dueDate: v.dueDate || null,
       };
     }
-    _osvCacheSet('kev:catalog', { ts: Date.now(), byCve });
+    const ts = Date.now();
+    _osvCacheSet('kev:catalog', { ts, byCve });
+    _setKevMeta('network', ts, Object.keys(byCve).length);
     return byCve;
-  } catch { return cached?.byCve || null; }
+  } catch { return fallback(); }
 }
 
 async function _enrichWithKEV(supplyChainResults){
@@ -7155,7 +7365,14 @@ function _parseGoMod(text,filePath){
     if(t===')'){inReq=false;continue;}
     let m=inReq?t.match(/^([^\s]+)\s+v([^\s/]+)/):t.match(/^require\s+([^\s]+)\s+v([^\s/]+)/);
     if(m){
-      const name=m[1];const ver=m[2].replace(/-.*$/,'');
+      // Keep the version VERBATIM. This used to do `.replace(/-.*$/,'')`,
+      // which turns every Go pseudo-version — v0.0.0-20210903162142-ad29c8ab022f
+      // — into a bare `0.0.0`. That is not a shorter version, it is a different
+      // and nonexistent one, and it made every pseudo-versioned module in a tree
+      // collapse onto the same key. Normalisation for an advisory query belongs
+      // at the query, where _osvQueryVersion does it; a component's recorded
+      // version is also what lands in the SBOM, where truncating it is worse.
+      const name=m[1];const ver=m[2];
       const isIndirect=t.includes('// indirect');
       out.push({name,version:ver,group:name.split('/').slice(0,2).join('/'),
         scope:isIndirect?'optional':'required',purl:_makePurl('golang',name,ver,''),
@@ -7550,8 +7767,10 @@ function _parseGoSum(text, filePath){
     const m = t.match(/^(\S+)\s+v([^\s]+)\s+h1:/);
     if (!m) continue;
     const name = m[1];
-    // Strip +incompatible / -timestamp-sha suffixes that aren't useful for OSV matching.
-    const ver = m[2].replace(/\+incompatible$/, '').replace(/^v?/, '');
+    // Verbatim, minus the leading `v`. The suffixes this used to strip
+    // (`+incompatible`, the pseudo-version timestamp+sha) are part of the
+    // module version the advisory database matches on — see _parseGoMod.
+    const ver = m[2].replace(/^v/, '');
     const dedupKey = `${name}@${ver}`;
     if (seen.has(dedupKey)) continue;
     seen.add(dedupKey);
@@ -7646,11 +7865,20 @@ function parseManifests(allFileContents){
     // R10: Gradle resolved transitive graph — `gradle dependencies > gradle-dependencies.txt`.
     'gradle-dependencies.txt':_parseGradleDependencies,
   };
+  // Requirements files are named a dozen ways and the basename table can only
+  // hold one of them. `requirements/dev.txt`, `requirements-dev.txt` and
+  // `requirements/base.txt` are all ordinary; matched by SHAPE so a new variant
+  // does not need a new table entry. Kept narrow on purpose — an arbitrary
+  // `.txt` reaching this parser would invent dependencies out of prose.
+  const _REQ_FILE=/^requirements(?:[._-][\w.-]+)?\.txt$/i;
+  const _REQ_DIR=/(?:^|\/)requirements\/[\w.-]+\.txt$/i;
+  const _pick=(fp,base)=>PARSERS[base]||((_REQ_FILE.test(base)||_REQ_DIR.test(fp))?_parseRequirementsTxt:null);
   const out=[],seen=new Set();
   for(const[fp,content]of Object.entries(allFileContents)){
     const base=fp.split('/').pop();
-    if(!PARSERS[base])continue;
-    for(const comp of PARSERS[base](content,fp)){
+    const parser=_pick(fp.split('\\').join('/'),base);
+    if(!parser)continue;
+    for(const comp of parser(content,fp)){
       const key=`${comp.ecosystem}:${comp.name}:${comp.version}`;
       if(!seen.has(key)){seen.add(key);out.push(comp);}
     }
@@ -7728,6 +7956,34 @@ function computeAttackPathComponents(findings,components,byFile){
   return{flagged,pathsByKey};
 }
 
+// The version string an advisory database can actually match on.
+//
+// This used to be `version.match(/(\d+\.\d+(?:\.\d+)*)/)`, which takes the
+// first dotted-number run and throws the rest away. For most ecosystems that is
+// harmless; for Go it is destructive. A Go pseudo-version is
+//
+//     v0.0.0-20210903162142-ad29c8ab022f
+//
+// and the leading `0.0.0` is a placeholder, not a version — every pseudo-version
+// in the tree collapsed to the same meaningless `0.0.0`, so the query asked
+// about a release that does not exist and the real one was never checked.
+// bench/sca-replay attributed nearly every remaining Go miss to exactly this.
+// `+incompatible` builds lost their suffix the same way.
+//
+// A WILDCARD is refused outright rather than truncated. `2.0.*` is a range; it
+// has no single version to be affected, and reporting "phpseclib 2.0.* is
+// vulnerable" names something that was never installed.
+function _osvQueryVersion(raw){
+  const s=String(raw||'').trim();
+  if(!s)return null;
+  if(/[*x]/i.test(s.replace(/^[\^~>=<\s]+/,'').replace(/[-+][\w.-]+$/,'')))return null;
+  // Strip only a leading range operator or `v`; keep the whole version after it.
+  const m=s.match(/^[\^~>=<\s]*v?(\d[\w.+-]*)$/);
+  if(m)return m[1];
+  const fallback=s.match(/(\d+\.\d+(?:\.\d+)*)/);
+  return fallback?fallback[1]:null;
+}
+
 async function queryOSV(components,allFileContents){
   const OSV_ECO={npm:'npm',pypi:'PyPI',packagist:'Packagist',rubygems:'RubyGems',golang:'Go',cargo:'crates.io',maven:'Maven',pub:'Pub'};
   const results=[];
@@ -7742,7 +7998,7 @@ async function queryOSV(components,allFileContents){
   const queries=[],uncached=[],vulnAffects={};
   for(const comp of queryable){
     const eco=OSV_ECO[comp.ecosystem];
-    const cleanVer=(comp.version.match(/(\d+\.\d+(?:\.\d+)*)/)||[])[1];
+    const cleanVer=_osvQueryVersion(comp.version);
     if(!cleanVer)continue;
     const ck=`comp:${eco}:${comp.name}:${cleanVer}`;
     const cached=_osvCacheGet(ck);
@@ -8039,7 +8295,7 @@ function _deterministicFileTimings(timings) {
 
   const _fileTimings = [];
   let _filesSkipped = 0, _filesTimedOut = 0, _filesDenseSkipped = 0;
-  const files=Object.keys(fileContents).filter(f=>(shouldScan(f) || isKubernetesManifest(f, fileContents[f])) && !_isPathIgnored(f));const fc={},pfr={};const aR=[],aF=[],aSrc=[],aSink=[],aSan=[],aLogic=[],aSupply=[],aSecrets=[],aCiphersRest=[],aCiphersTransit=[];
+  const files=Object.keys(fileContents).filter(f=>(shouldScan(f) || isKubernetesManifest(f, fileContents[f]) || isCloudFormationTemplate(f, fileContents[f]) || isInstructionFile(f)) && !_isPathIgnored(f));const fc={},pfr={};const aR=[],aF=[],aSrc=[],aSink=[],aSan=[],aLogic=[],aSupply=[],aSecrets=[],aCiphersRest=[],aCiphersTransit=[];
   // ---- R8: opt-in per-file checkpointing (AGENTIC_SECURITY_RESUME=1, or
   // runScan({resume:true})). Default OFF, so existing behaviour is untouched.
   // Only this loop is checkpointed; every cross-file pass below re-runs, so
@@ -8107,7 +8363,7 @@ function _deterministicFileTimings(timings) {
   let i=0;for(const p of files){i++;const _ft0=Date.now();setProgress({current:i,total:files.length,file:p.split("/").pop(),phase:"Scanning"});
     if(_ckptDone.has(p)&&_ckptReplay(p))continue;
     const _mk={aR:aR.length,aF:aF.length,aSrc:aSrc.length,aSink:aSink.length,aSan:aSan.length,aLogic:aLogic.length,aSecrets:aSecrets.length,aCR:aCiphersRest.length,aCT:aCiphersTransit.length,sup:_suppressionLog.length};
-    try{const c=fileContents[p];if(!c||c.length>500000){_filesSkipped++;continue;}const _avgLine=c.length/Math.max(c.split('\n').length,1);if(_avgLine>400&&c.length>10000){_filesDenseSkipped++;continue;}const cc=_blankCached(c,_commentLangFor(p));fc[p]=c;aR.push(...scanRoutes(p,cc));const ta=performAnalysis(p,c);pfr[p]=ta;aF.push(...ta.findings);aSrc.push(...ta.sources);aSink.push(...ta.sinks);aSan.push(...ta.sanitizers);aLogic.push(...scanLogicVulns(p,cc));aSecrets.push(...scanCredentials(p,c));aF.push(...scanStructuralVulns(p,cc));aF.push(...scanExtraStructural(p,cc));aF.push(...scanAliasedSinks(p,cc));aF.push(...scanJavaSAST(p,cc));aF.push(...scanJavaBenchExtras(p,cc));aLogic.push(...scanMiddlewareOrdering(p,cc));aLogic.push(...scanReDoS(p,cc));if(/\.(?:java|cs|kt|py|php|phtml)$/i.test(p)){try{aLogic.push(...scanRegexReDoS(p,cc));}catch(_){}}aLogic.push(...scanTodosNearSecurity(p,c));aSecrets.push(...scanEntropySecrets(p,c));const cp=scanCiphers(p,cc);aCiphersRest.push(...cp.atRest);aCiphersTransit.push(...cp.inTransit);if(/\.(graphql|gql)$/i.test(p))aF.push(...scanGraphQL(p,cc));aF.push(...scanIaC(p,cc));aF.push(...scanTerraform(p,cc));
+    try{const c=fileContents[p];if(!c||c.length>500000){_filesSkipped++;continue;}const _avgLine=c.length/Math.max(c.split('\n').length,1);if(_avgLine>400&&c.length>10000){_filesDenseSkipped++;continue;}const cc=_blankCached(c,_commentLangFor(p));fc[p]=c;aR.push(...scanRoutes(p,cc));const ta=performAnalysis(p,c);pfr[p]=ta;aF.push(...ta.findings);aSrc.push(...ta.sources);aSink.push(...ta.sinks);aSan.push(...ta.sanitizers);aLogic.push(...scanLogicVulns(p,cc));aSecrets.push(...scanCredentials(p,c));aF.push(...scanStructuralVulns(p,cc));aF.push(...scanExtraStructural(p,cc));aF.push(...scanAliasedSinks(p,cc));aF.push(...scanJavaSAST(p,cc));aF.push(...scanJavaBenchExtras(p,cc));aLogic.push(...scanMiddlewareOrdering(p,cc));aLogic.push(...scanReDoS(p,cc));if(/\.(?:java|cs|kt|py|php|phtml)$/i.test(p)){try{aLogic.push(...scanRegexReDoS(p,cc));}catch(_){}}aLogic.push(...scanTodosNearSecurity(p,c));aSecrets.push(...scanEntropySecrets(p,c));const cp=scanCiphers(p,cc);aCiphersRest.push(...cp.atRest);aCiphersTransit.push(...cp.inTransit);if(/\.(graphql|gql)$/i.test(p))aF.push(...scanGraphQL(p,cc));aF.push(...scanIaC(p,cc));aF.push(...scanTerraform(p,cc));aF.push(...scanCloudTemplates(p,c));
       aF.push(...scanLLM(p,c));
       aF.push(...scanLLMOwasp(p,c));
       aF.push(...scanLlmCost(p,c));
@@ -8116,6 +8372,31 @@ function _deterministicFileTimings(timings) {
       aF.push(...scanContainer(p,cc));
       aF.push(...scanInstallScripts(p,cc));
       aF.push(...scanMCP(p,c));
+      // PRD F5.2 — rug-pull: a tool whose definition changed AFTER approval.
+      // Every scanMCP rule judges the CURRENT content, so a description that is
+      // innocuous today and hostile tomorrow passes both scans. This compares
+      // against a recorded baseline, which is the only way to see a change.
+      // Wired here rather than left as a tested module: a detector with no call
+      // site is a dark detector, which is the exact class this session keeps
+      // finding.
+      if (/(?:^|[\\/])\.?mcp(?:\.[a-z]+)?\.json$|(?:^|[\\/])\.mcp\.json$/i.test(p)) {
+        try {
+          const _cfg = JSON.parse(c);
+          const _rp = _detectRugPull(scanRoot, _cfg, { file: p });
+          aF.push(..._rp.findings);
+          // Record on first sight so the NEXT scan has something to compare
+          // against; refresh after reporting so a reviewed change is not
+          // re-reported forever.
+          _saveMcpBaseline(scanRoot, _fingerprintMcp(_cfg));
+        } catch (e) {
+          // Only a malformed config is tolerated here — scanMCP already reports
+          // what it can from one. Anything else is a programmer error and must
+          // not be swallowed: a bare `catch {}` around this block hid a
+          // ReferenceError (`root` vs `scanRoot`) that silently disabled the
+          // whole detector while every unit test still passed.
+          if (!(e instanceof SyntaxError)) throw e;
+        }
+      }
       aF.push(...scanClaudeSettings(p,c));
       aF.push(...scanClaudeMdPromptInjection(p,c));
       aF.push(...scanClaudeHookInjection(p,c));
@@ -8200,7 +8481,7 @@ function _deterministicFileTimings(timings) {
       aF.push(...scanSSRFCloudMetadata(p,cc));
       aF.push(...scanMutationXSS(p,cc));
       aF.push(...scanKotlin(p,cc));
-      aF.push(...scanRuby(p,cc));
+      aF.push(...scanRuby(p,cc));aF.push(...scanRubyPathJoin(p,cc));
       aF.push(...scanPhp(p,cc));
       // Integration block: scaffolded SAST scanners. Gated by env var.
       if (process.env.AGENTIC_SECURITY_NO_INTEGRATION !== '1') {
@@ -8857,13 +9138,24 @@ function _deterministicFileTimings(timings) {
     // sanitizer would then hide a real vulnerability outright, whereas a label
     // only demotes confidence here. Recall-preserving, on purpose.
     const sanitizersOnPath = {};
+    // The same shape for calls that UNDO an encoding. A sanitizer whose effect
+    // is reversed later on the path is not a sanitizer, and the gate could not
+    // see that before: the catalog only models sanitizers, so a decoder was
+    // never recorded at all and `he.decode(escapeHtml(x))` read as clean.
+    const unsanitizersOnPath = {};
     for (const f of finalFindings) {
       const names = f && f._sanitizersOnPath;
-      if (!Array.isArray(names) || !names.length) continue;
-      if (f.id) sanitizersOnPath[f.id] = names;
-      if (f.stableId) sanitizersOnPath[f.stableId] = names;
+      if (Array.isArray(names) && names.length) {
+        if (f.id) sanitizersOnPath[f.id] = names;
+        if (f.stableId) sanitizersOnPath[f.stableId] = names;
+      }
+      const undo = f && f._unsanitizersOnPath;
+      if (Array.isArray(undo) && undo.length) {
+        if (f.id) unsanitizersOnPath[f.id] = undo;
+        if (f.stableId) unsanitizersOnPath[f.stableId] = undo;
+      }
     }
-    _runAnnotator("applySanitizerGate", () => { applySanitizerGate(finalFindings, { sanitizersOnPath }); });
+    _runAnnotator("applySanitizerGate", () => { applySanitizerGate(finalFindings, { sanitizersOnPath, unsanitizersOnPath }); });
     _runAnnotator("annotateProofGate", () => { annotateProofGate(finalFindings); });
   }
   // Addition #1 — default falsification pass. Actively tries to DISPROVE each
@@ -9557,7 +9849,13 @@ function _deterministicFileTimings(timings) {
   // Addition #3 — root-cause sweep: from confirmed findings, find sibling instances
   // detectors missed, with total-count accounting. Confirmed-only (cheap by default).
   let _rootCauseSweep = null; try { _rootCauseSweep = sweepRootCauses(finalFindings, fc); } catch { _rootCauseSweep = null; }
-  return{entrypointInventory:_entrypointInventory,rootCauseSweep:_rootCauseSweep,routes:dd(aR,r=>`${r.method}:${r.path}:${r.file}:${r.line}`),findings:finalFindings,sources:aSrc,sinks:aSink,sanitizers:aSan,filesScanned:files.length,crossFileCount:cf.length,logicVulns:aLogic,supplyChain,components:annotatedComponents,secrets:aSecrets,ciphers:{atRest:aCiphersRest,inTransit:aCiphersTransit},pfr,fc,suppressions:_getSuppressions(),_v3,_scanMeta,_engineErrors:{cppDataflowParseErrors:_cppDataflowParseErrors.value},annotatorErrors:_annotatorErrors,executionProof:_executionProofSummary,logicClaims:_logicClaims,vulnHistory:_vulnHistory,threatModel:_threatModel,privacyFramework:_privacyFramework,sbomDiff:_sbomDiff,complianceReport:_complianceReport,exploitBundles:_exploitBundles,pqcPlan:_pqcPlan,licenseGraph:_licenseGraph,attributions:_attributions,attackTaxonomy:_taxonomySummary};}
+  // PRD F7.2: publish what CANNOT be proven alongside what can. A proof RATE
+  // computed over the provable subset makes a narrow subset look like strength;
+  // the three-bucket split (provable / declined-on-purpose / not-yet-classified)
+  // is the honest shape. Measured on the CVE corpus: 19% / 13% / 68%.
+  let _proofCoverage = null;
+  try { _proofCoverage = proofCoverage([...finalFindings, ...aLogic]); } catch { _proofCoverage = null; }
+  return{entrypointInventory:_entrypointInventory,rootCauseSweep:_rootCauseSweep,proofCoverage:_proofCoverage,kevCatalog:kevCatalogMeta(),routes:dd(aR,r=>`${r.method}:${r.path}:${r.file}:${r.line}`),findings:finalFindings,sources:aSrc,sinks:aSink,sanitizers:aSan,filesScanned:files.length,crossFileCount:cf.length,logicVulns:aLogic,supplyChain,components:annotatedComponents,secrets:aSecrets,ciphers:{atRest:aCiphersRest,inTransit:aCiphersTransit},pfr,fc,suppressions:_getSuppressions(),_v3,_scanMeta,_engineErrors:{cppDataflowParseErrors:_cppDataflowParseErrors.value},annotatorErrors:_annotatorErrors,executionProof:_executionProofSummary,logicClaims:_logicClaims,vulnHistory:_vulnHistory,threatModel:_threatModel,privacyFramework:_privacyFramework,sbomDiff:_sbomDiff,complianceReport:_complianceReport,exploitBundles:_exploitBundles,pqcPlan:_pqcPlan,licenseGraph:_licenseGraph,attributions:_attributions,attackTaxonomy:_taxonomySummary};}
 
 // Post-aggregation classification: every source becomes "unsafe"|"safe"; every sink becomes "confirmed"|"safe".
 // Orphans (no finding linkage) are bucketed by file-local heuristic so the UI shows binary states only.
@@ -9767,6 +10065,30 @@ const CREDENTIAL_PATTERNS=[
   // Database / Infrastructure
   // ctx gate: JDBC URLs in docs/test configs without credentials are not findings; require @ or password= evidence
   {n:"Database Connection String",r:"jdbc:[a-z:]+://[A-Za-z0-9\\.\\-_:;=/@?,&]+",s:"h",ctx:/@|password=|passwd=|pwd=/i},
+  // PRD F4.1. bench/secrets-precision measured format coverage at 83% and every
+  // one of these five was a genuine absence, not a tuning problem. Four are
+  // among the most common real leaks there are — a database URI with the
+  // password inline is what a connection string looks like when someone pastes
+  // one into a config file.
+  //
+  // `jdbc:` was the ONLY database URI shape covered. `postgres://` and
+  // `mongodb+srv://` are far more common in the ecosystems this tool is aimed
+  // at, and the generic "Password in URL" pattern could not reach them: it is
+  // gated behind CRED_PREFILTER, which had no token for either scheme.
+  {n:"PostgreSQL Connection URI",r:"postgres(?:ql)?://[^\\s:@/]{1,64}:[^\\s:@/]{6,64}@[^\\s/\"']{1,128}",s:"h",urlCreds:true},
+  {n:"MongoDB Connection URI",r:"mongodb(?:\\+srv)?://[^\\s:@/]{1,64}:[^\\s:@/]{6,64}@[^\\s/\"']{1,128}",s:"h",urlCreds:true},
+  {n:"Azure Storage Account Key",r:"AccountKey=[A-Za-z0-9+/]{86}==",s:"c"},
+  {n:"GitLab Personal Access Token",r:"glpat-[0-9A-Za-z_-]{20}",s:"c"},
+  {n:"DigitalOcean Personal Access Token",r:"dop_v1_[a-f0-9]{64}",s:"c"},
+  {n:"Supabase Service Key",r:"sbp_[a-f0-9]{40}",s:"c"},
+  {n:"HubSpot Private App Token",r:"pat-(?:na|eu)[0-9]-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}",s:"c"},
+  // NOT added, deliberately: Datadog, Vercel and Algolia keys are a bare run of
+  // hex or alphanumerics with no prefix. bench/secrets-precision reports them as
+  // misses and they should stay reported. A pattern for "32 hex characters"
+  // would fire on every content digest, Cargo checksum, test vector and build
+  // hash in the negative set — trading five detections for thousands of false
+  // positives, in the feature most prone to alert fatigue. Closing this needs
+  // variable-name context, not another regex.
   // Downgraded to medium; scanner also skips localhost/example hosts (see scanCredentials)
   {n:"Password in URL",r:"[a-zA-Z]{3,10}://[^/\\s:@]{3,20}:[^/\\s:@]{3,20}@.{1,100}[\"'\\s]",s:"m"},
   {n:"WordPress Secret Key",r:"define(.{0,20})?(DB_PASSWORD|AUTH_KEY|SECURE_AUTH_KEY|LOGGED_IN_KEY|AUTH_SALT|NONCE_KEY).{0,20}['\"].{10,120}['\"]",s:"h"},
@@ -9778,7 +10100,7 @@ const CREDENTIAL_PATTERNS=[
   // ctx gate: only report when the line contains a storage/assignment keyword, filters standalone examples in comments
   {n:"Exposed JWT Token",r:"eyJ[a-zA-Z0-9]{10,}\\.eyJ[a-zA-Z0-9]{10,}\\.[a-zA-Z0-9_\\-]{10,}",s:"m",ctx:/token|jwt|auth|bearer|secret|key|credential|sign|=|:/i},
 ];
-const CRED_PREFILTER=/AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA|da2-[a-z0-9]{10}|amzn\.mws|AIza|ya29\.[0-9A-Za-z]{15}|googleusercontent|[Hh][Ee][Rr][Oo][Kk][Uu]|dt0[A-Za-z][0-9]{2}\.|ghp_|gho_|ghu_|ghs_|ghr_|sk_live_|sk_test_|rk_live_|access_token\$production|sq0atp|sq0csp|xox[baprs]-[0-9a-zA-Z]{8}|hooks\.slack\.com|discord(?:app)?\.com\/api\/webhooks|outlook\.office\.com\/webhook|[0-9]{8,10}:AA[0-9A-Za-z]|AAAA[a-zA-Z0-9_-]{7}:|twilio|SG\.[a-zA-Z0-9_-]{15}|mailchimp|key-[0-9a-zA-Z]{20}|shpat_|shpss_|shpca_|shppa_|-----BEGIN .*(PRIVATE|PGP)|NRAA-|NRII-|NRIQ-|NRRA-|EAACEdEose0cBA|pypi-AgEIcH|hooks\.zapier\.com|jdbc:|cloudinary:\/\/|R_[0-9a-f]{20}|eyJ[a-zA-Z0-9]{10,}\.eyJ/i;
+const CRED_PREFILTER=/AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA|da2-[a-z0-9]{10}|amzn\.mws|AIza|ya29\.[0-9A-Za-z]{15}|googleusercontent|[Hh][Ee][Rr][Oo][Kk][Uu]|dt0[A-Za-z][0-9]{2}\.|ghp_|gho_|ghu_|ghs_|ghr_|sk_live_|sk_test_|rk_live_|access_token\$production|sq0atp|sq0csp|xox[baprs]-[0-9a-zA-Z]{8}|hooks\.slack\.com|discord(?:app)?\.com\/api\/webhooks|outlook\.office\.com\/webhook|[0-9]{8,10}:AA[0-9A-Za-z]|AAAA[a-zA-Z0-9_-]{7}:|twilio|SG\.[a-zA-Z0-9_-]{15}|mailchimp|key-[0-9a-zA-Z]{20}|shpat_|shpss_|shpca_|shppa_|-----BEGIN .*(PRIVATE|PGP)|NRAA-|NRII-|NRIQ-|NRRA-|EAACEdEose0cBA|pypi-AgEIcH|hooks\.zapier\.com|jdbc:|cloudinary:\/\/|R_[0-9a-f]{20}|eyJ[a-zA-Z0-9]{10,}\.eyJ|postgres(?:ql)?:\/\/|mongodb(?:\+srv)?:\/\/|AccountKey=|glpat-|dop_v1_|sbp_[a-f0-9]{10}|pat-(?:na|eu)[0-9]-|[a-z][a-z0-9+.-]{2,15}:\/\/[^\s:@\/]{3,64}:[^\s:@\/]{3,64}@/i;
 const SECRET_IMPACT_MAP={
   "AWS Access Key ID":"Provides programmatic access to AWS resources. With the paired secret key, an attacker can enumerate S3 buckets, exfiltrate databases, spin up EC2 instances for cryptomining, or pivot to any service the role permits. If the key belongs to an admin role, this is full cloud account takeover.",
   "AWS AppSync GraphQL Key":"Allows unauthenticated queries and mutations against your AppSync GraphQL API. Attackers can read application data, trigger mutations to corrupt records, or enumerate the schema to map further attack surface.",
@@ -10000,7 +10322,7 @@ export {
   classifyOrphans, classifyField, classifyEndpoint, shouldScan,
   _isFalsePositiveCredential, _detectSafeSinkShape,
   _loadCustomRules, _isCustomSuppressed, _isPathIgnored,
-  scanIaC, IAC_PATTERNS, _isIaCFile,
+  scanIaC, IAC_PATTERNS, _isIaCFile, isCloudFormationTemplate,
   payloadsForFinding, buildProofObligation,
   DATA_CLASSES, SOURCE_PATTERNS, SINK_PATTERNS, SANITIZER_PATTERNS,
   ROUTE_PATTERNS, AUTH_PATTERNS, IGNORE_DIRS, CODE_EXTS,