@clear-capabilities/agentic-security-scanner 0.86.0 → 0.119.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (128) hide show
  1. package/CHANGELOG.md +660 -0
  2. package/bin/agentic-security.js +78 -1
  3. package/dist/178.index.js +1 -1
  4. package/dist/384.index.js +1 -1
  5. package/dist/415.index.js +90 -0
  6. package/dist/444.index.js +89 -0
  7. package/dist/503.index.js +288 -0
  8. package/dist/637.index.js +15 -1
  9. package/dist/838.index.js +1 -1
  10. package/dist/985.index.js +5 -1
  11. package/dist/agentic-security.mjs +84 -84
  12. package/dist/agentic-security.mjs.sha256 +1 -1
  13. package/package.json +21 -10
  14. package/src/dataflow/CLAUDE.md +18 -6
  15. package/src/dataflow/catalog.js +59 -11
  16. package/src/dataflow/engine.js +106 -5
  17. package/src/dataflow/implicit-flow.js +4 -2
  18. package/src/dataflow/index.js +17 -4
  19. package/src/dataflow/proof-gate.js +100 -0
  20. package/src/dataflow/summaries.js +63 -6
  21. package/src/engine.js +292 -10
  22. package/src/ir/CLAUDE.md +1 -0
  23. package/src/ir/callgraph.js +12 -1
  24. package/src/ir/parser-go.js +8 -0
  25. package/src/ir/tree-sitter-loader.js +108 -0
  26. package/src/mcp/tools.js +6 -2
  27. package/src/posture/corpus-status.js +74 -0
  28. package/src/posture/coverage-report.js +113 -0
  29. package/src/posture/fix-history.js +24 -0
  30. package/src/posture/holdout-eval.js +57 -0
  31. package/src/posture/provenance.js +39 -0
  32. package/src/posture/router.js +33 -3
  33. package/src/posture/sca-verdict.js +130 -0
  34. package/src/posture/secret-history.js +72 -0
  35. package/src/pr-delta.js +13 -0
  36. package/src/report/index.js +67 -0
  37. package/src/sast/CLAUDE.md +9 -3
  38. package/src/sast/agent-untrusted-flow.js +107 -0
  39. package/src/sast/api-authz.js +71 -0
  40. package/src/sast/code-injection-multilang.js +117 -0
  41. package/src/sast/cross-service.js +98 -0
  42. package/src/sast/crypto-protocol.js +43 -1
  43. package/src/sast/csharp-structural.js +65 -0
  44. package/src/sast/csharp.js +3 -0
  45. package/src/sast/csrf.js +24 -3
  46. package/src/sast/csv-injection.js +84 -0
  47. package/src/sast/event-entrypoint.js +90 -0
  48. package/src/sast/frontend-hygiene.js +106 -0
  49. package/src/sast/go-structural.js +60 -0
  50. package/src/sast/iac-terraform.js +107 -0
  51. package/src/sast/java-structural.js +81 -0
  52. package/src/sast/js-framework-structural.js +115 -0
  53. package/src/sast/kotlin.js +72 -0
  54. package/src/sast/ldap-injection.js +73 -17
  55. package/src/sast/open-redirect.js +47 -5
  56. package/src/sast/php.js +35 -0
  57. package/src/sast/python-structural.js +83 -0
  58. package/src/sast/rbac-consistency.js +113 -0
  59. package/src/sast/redos-nfa.js +75 -0
  60. package/src/sast/response-splitting.js +48 -19
  61. package/src/sast/ruby.js +38 -0
  62. package/src/sast/secret-concat.js +60 -0
  63. package/src/sast/ssrf-cloud-metadata.js +13 -0
  64. package/src/sast/stored-taint.js +88 -0
  65. package/src/sast/tree-sitter-sinks.js +62 -0
  66. package/src/sast/weak-password-hash.js +28 -0
  67. package/src/sast/weak-randomness.js +46 -5
  68. package/src/sast/wrong-context-sanitizer.js +149 -0
  69. package/src/sast/xpath-injection.js +30 -6
  70. package/src/sast/xss-reflected-multilang.js +116 -0
  71. package/src/sast/xxe.js +67 -0
  72. package/src/sca/image-packages.js +74 -0
  73. package/src/sca/import-reachability.js +271 -0
  74. package/src/sca/install-script-analysis.js +82 -0
  75. package/bin/.agentic-security/findings.json +0 -1907
  76. package/bin/.agentic-security/last-scan.json +0 -1907
  77. package/bin/.agentic-security/last-scan.json.sig +0 -1
  78. package/bin/.agentic-security/scan-history.json +0 -166
  79. package/bin/.agentic-security/streak.json +0 -20
  80. package/src/.agentic-security/findings.json +0 -117732
  81. package/src/.agentic-security/last-scan.json +0 -117732
  82. package/src/.agentic-security/last-scan.json.sig +0 -1
  83. package/src/.agentic-security/scan-history.json +0 -12946
  84. package/src/.agentic-security/streak.json +0 -21
  85. package/src/dataflow/.agentic-security/findings.json +0 -6086
  86. package/src/dataflow/.agentic-security/last-scan.json +0 -6086
  87. package/src/dataflow/.agentic-security/last-scan.json.sig +0 -1
  88. package/src/dataflow/.agentic-security/scan-history.json +0 -250
  89. package/src/dataflow/.agentic-security/streak.json +0 -21
  90. package/src/ir/.agentic-security/findings.json +0 -4011
  91. package/src/ir/.agentic-security/last-scan.json +0 -4011
  92. package/src/ir/.agentic-security/last-scan.json.sig +0 -1
  93. package/src/ir/.agentic-security/scan-history.json +0 -193
  94. package/src/ir/.agentic-security/streak.json +0 -20
  95. package/src/mcp/.agentic-security/findings.json +0 -8632
  96. package/src/mcp/.agentic-security/last-scan.json +0 -8632
  97. package/src/mcp/.agentic-security/last-scan.json.sig +0 -1
  98. package/src/mcp/.agentic-security/scan-history.json +0 -331
  99. package/src/mcp/.agentic-security/streak.json +0 -20
  100. package/src/posture/.agentic-security/dpia.md +0 -26
  101. package/src/posture/.agentic-security/findings.json +0 -77181
  102. package/src/posture/.agentic-security/last-scan.json +0 -77181
  103. package/src/posture/.agentic-security/last-scan.json.sig +0 -1
  104. package/src/posture/.agentic-security/pqc-migration-plan.json +0 -65
  105. package/src/posture/.agentic-security/pqc-migration-plan.md +0 -30
  106. package/src/posture/.agentic-security/sbom-history/7d45b5e03804aac084b4a2b4dc8c6f10107d2005.json +0 -6
  107. package/src/posture/.agentic-security/scan-history.json +0 -8904
  108. package/src/posture/.agentic-security/streak.json +0 -21
  109. package/src/posture/.agentic-security/threat-model.json +0 -2038
  110. package/src/posture/.agentic-security/threat-model.md +0 -73
  111. package/src/posture/compliance-frameworks/.agentic-security/findings.json +0 -80
  112. package/src/posture/compliance-frameworks/.agentic-security/last-scan.json +0 -80
  113. package/src/posture/compliance-frameworks/.agentic-security/last-scan.json.sig +0 -1
  114. package/src/posture/compliance-frameworks/.agentic-security/scan-history.json +0 -90
  115. package/src/posture/compliance-frameworks/.agentic-security/streak.json +0 -22
  116. package/src/report/.agentic-security/sbom-history/7d45b5e03804aac084b4a2b4dc8c6f10107d2005.json +0 -6
  117. package/src/report/.agentic-security/threat-model.json +0 -7
  118. package/src/report/.agentic-security/threat-model.md +0 -22
  119. package/src/sast/.agentic-security/findings.json +0 -6154
  120. package/src/sast/.agentic-security/last-scan.json +0 -6154
  121. package/src/sast/.agentic-security/last-scan.json.sig +0 -1
  122. package/src/sast/.agentic-security/scan-history.json +0 -941
  123. package/src/sast/.agentic-security/streak.json +0 -22
  124. package/src/sca/.agentic-security/findings.json +0 -7460
  125. package/src/sca/.agentic-security/last-scan.json +0 -7460
  126. package/src/sca/.agentic-security/last-scan.json.sig +0 -1
  127. package/src/sca/.agentic-security/scan-history.json +0 -113
  128. package/src/sca/.agentic-security/streak.json +0 -21
package/src/posture/.agentic-security/last-scan.json.sig DELETED
@@ -1 +0,0 @@
1
- 39996421280552970646e4a1035a28ab4226d74f4ff8ed29cfeae2fa5c693ec8
package/src/posture/.agentic-security/pqc-migration-plan.json DELETED
@@ -1,65 +0,0 @@
1
- {
2
- "generatedAt": "2026-05-30T05:08:00.813Z",
3
- "summary": {
4
- "total": 1,
5
- "hndlCritical": 0,
6
- "standard": 1,
7
- "filesAffected": 1,
8
- "primitivesNeeded": [
9
- "ML-DSA-65"
10
- ]
11
- },
12
- "milestones": [
13
- {
14
- "id": "M1",
15
- "title": "Inventory & policy",
16
- "target": "90 days",
17
- "owner": "security",
18
- "items": [
19
- "Confirm scanner findings against design docs",
20
- "Adopt PQC migration policy (CNSA 2.0 / NIST IR 8547 alignment)",
21
- "Establish KMS support for hybrid keys"
22
- ]
23
- },
24
- {
25
- "id": "M2",
26
- "title": "HNDL-critical paths to PQ-hybrid",
27
- "target": "180 days",
28
- "owner": "platform",
29
- "items": []
30
- },
31
- {
32
- "id": "M3",
33
- "title": "Standard signing/KEX migration",
34
- "target": "12 months",
35
- "owner": "platform",
36
- "items": [
37
- {
38
- "finding": "pqc-ed25519:rule-pack-signing.js:187",
39
- "file": "rule-pack-signing.js",
40
- "line": 187,
41
- "replacement": "ML-DSA-65"
42
- }
43
- ]
44
- },
45
- {
46
- "id": "M4",
47
- "title": "Deprecate classical primitives",
48
- "target": "24 months",
49
- "owner": "security",
50
- "items": [
51
- "Remove dual-stack libraries once peers are PQ-capable",
52
- "Rotate root CA / long-lived signing keys to ML-DSA"
53
- ]
54
- }
55
- ],
56
- "perFile": {
57
- "rule-pack-signing.js": {
58
- "count": 1,
59
- "subfamilies": [
60
- "pqc-ed25519"
61
- ],
62
- "hndlCritical": false
63
- }
64
- }
65
- }
package/src/posture/.agentic-security/pqc-migration-plan.md DELETED
@@ -1,30 +0,0 @@
1
- # Post-quantum cryptography migration plan
2
-
3
- Generated 2026-05-30.
4
-
5
- **1** pre-quantum primitive sites across **1** files.
6
- HNDL-critical: **0** | Standard: **1**
7
-
8
- ## Recommended PQ primitives
9
- - ML-DSA-65
10
-
11
- ## M1 — Inventory & policy (target 90 days, owner security)
12
- - Confirm scanner findings against design docs
13
- - Adopt PQC migration policy (CNSA 2.0 / NIST IR 8547 alignment)
14
- - Establish KMS support for hybrid keys
15
-
16
- ## M2 — HNDL-critical paths to PQ-hybrid (target 180 days, owner platform)
17
-
18
- ## M3 — Standard signing/KEX migration (target 12 months, owner platform)
19
- - `rule-pack-signing.js:187` → ML-DSA-65
20
-
21
- ## M4 — Deprecate classical primitives (target 24 months, owner security)
22
- - Remove dual-stack libraries once peers are PQ-capable
23
- - Rotate root CA / long-lived signing keys to ML-DSA
24
-
25
- ## References
26
- - NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA)
27
- - NIST IR 8547 — Transition to Post-Quantum Cryptographic Standards
28
- - CNSA 2.0 — Commercial National Security Algorithm Suite, Sept 2022
29
- - RFC 9794 — X25519MLKEM768 hybrid key exchange for TLS 1.3
30
- - Open Quantum Safe project (liboqs, oqs-provider for OpenSSL 3)
package/src/posture/.agentic-security/sbom-history/7d45b5e03804aac084b4a2b4dc8c6f10107d2005.json DELETED
@@ -1,6 +0,0 @@
1
- {
2
- "sha": "7d45b5e03804aac084b4a2b4dc8c6f10107d2005",
3
- "ts": "2026-05-30T05:08:00.812Z",
4
- "componentCount": 0,
5
- "components": []
6
- }