@dailephd/my-dev-kit-lab 0.4.0 → 0.4.2

package/dist/src/mobile/android/advancedSecurity/sensitiveData/classifyDirectExpression.js

@@ -0,0 +1,99 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — shared bounded direct-expression classification.
+//
+// Classifies a single, already-extracted argument/value expression string
+// (captured by an analyzer's own bounded regex, e.g. the second argument to
+// a Log.d(...) call, or the value passed to putString(...)) into a coarse
+// syntactic kind. This performs no evaluation, no alias resolution beyond
+// what the caller already resolved, and no interprocedural analysis — it is
+// purely a classifier over the literal text of the expression.
+//
+// Safety invariant: `rawExpression` and the derived `literalValue` are
+// returned for the caller's own redaction step (via
+// makeCandidateEvidence/redactedPreviewForCandidate) — `boundedSummary` never
+// contains literal content, only the classified kind and shape, so a caller
+// that forgets to redact still cannot leak a raw value through the summary.
+// ---------------------------------------------------------------------------
+export const DIRECT_EXPRESSION_KINDS = [
+    "string-literal",
+    "numeric-literal",
+    "boolean-literal",
+    "null-literal",
+    "identifier",
+    "member-access",
+    "method-parameter",
+    "method-call",
+    "environment-lookup",
+    "property-lookup",
+    "placeholder-interpolation",
+    "collection-object",
+    "dynamic-unsupported",
+];
+const MAX_EXPRESSION_LENGTH = 400;
+function bound(expression) {
+    return expression.length > MAX_EXPRESSION_LENGTH ? `${expression.slice(0, MAX_EXPRESSION_LENGTH)}...` : expression;
+}
+function unquoteJavaKotlinString(literal) {
+    const tripleMatch = /^"""([\s\S]*)"""$/.exec(literal);
+    if (tripleMatch)
+        return tripleMatch[1];
+    const doubleMatch = /^"((?:[^"\\]|\\.)*)"$/.exec(literal);
+    if (doubleMatch) {
+        try {
+            return JSON.parse(literal);
+        }
+        catch {
+            return doubleMatch[1];
+        }
+    }
+    return undefined;
+}
+export function classifyDirectExpression(rawExpression) {
+    const trimmed = bound(rawExpression.trim());
+    const summaryFor = (kind) => `${kind} (length=${trimmed.length})`;
+    if (trimmed.length === 0) {
+        return { kind: "dynamic-unsupported", isDirectLiteral: false, boundedSummary: summaryFor("dynamic-unsupported") };
+    }
+    // Kotlin string templates / Java concatenation with a dynamic operand:
+    // treated as placeholder-interpolation, not a pure literal, even though it
+    // may still contain a sensitive literal fragment — callers that need the
+    // literal fragment extract it separately before classification.
+    if (/\$\{[^}]*\}|\$[A-Za-z_][\w]*/.test(trimmed) && /^"/.test(trimmed)) {
+        return { kind: "placeholder-interpolation", isDirectLiteral: false, boundedSummary: summaryFor("placeholder-interpolation") };
+    }
+    if (/^"[^"]*"\s*\+/.test(trimmed) || /\+\s*"[^"]*"$/.test(trimmed) || (/^".*"$/.test(trimmed) && /\+/.test(trimmed))) {
+        return { kind: "placeholder-interpolation", isDirectLiteral: false, boundedSummary: summaryFor("placeholder-interpolation") };
+    }
+    const unquoted = unquoteJavaKotlinString(trimmed);
+    if (unquoted !== undefined) {
+        return { kind: "string-literal", isDirectLiteral: true, literalValue: unquoted, boundedSummary: summaryFor("string-literal") };
+    }
+    if (/^-?\d+(\.\d+)?[fFdDlL]?$/.test(trimmed)) {
+        return { kind: "numeric-literal", isDirectLiteral: true, literalValue: trimmed, boundedSummary: summaryFor("numeric-literal") };
+    }
+    if (trimmed === "true" || trimmed === "false") {
+        return { kind: "boolean-literal", isDirectLiteral: true, literalValue: trimmed, boundedSummary: summaryFor("boolean-literal") };
+    }
+    if (trimmed === "null") {
+        return { kind: "null-literal", isDirectLiteral: false, boundedSummary: summaryFor("null-literal") };
+    }
+    if (/^(System\.getenv|getenv)\s*\(/.test(trimmed)) {
+        return { kind: "environment-lookup", isDirectLiteral: false, boundedSummary: summaryFor("environment-lookup") };
+    }
+    if (/^BuildConfig\./.test(trimmed)) {
+        return { kind: "property-lookup", isDirectLiteral: false, boundedSummary: summaryFor("property-lookup") };
+    }
+    if (/^[{\[]/.test(trimmed)) {
+        return { kind: "collection-object", isDirectLiteral: false, boundedSummary: summaryFor("collection-object") };
+    }
+    if (/^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)*\s*\(/.test(trimmed)) {
+        return { kind: "method-call", isDirectLiteral: false, boundedSummary: summaryFor("method-call") };
+    }
+    if (/^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)+$/.test(trimmed)) {
+        return { kind: "member-access", isDirectLiteral: false, boundedSummary: summaryFor("member-access") };
+    }
+    if (/^[A-Za-z_$][\w$]*$/.test(trimmed)) {
+        return { kind: "identifier", isDirectLiteral: false, boundedSummary: summaryFor("identifier") };
+    }
+    return { kind: "dynamic-unsupported", isDirectLiteral: false, boundedSummary: summaryFor("dynamic-unsupported") };
+}

package/dist/src/mobile/android/advancedSecurity/sensitiveData/classifySensitiveIdentifier.js

@@ -0,0 +1,111 @@
+const EXACT_WORD_CATEGORY = new Map([
+    // Authentication and credentials
+    ["password", "password"],
+    ["passwd", "password"],
+    ["pwd", "password"],
+    ["passcode", "password"],
+    ["pin", "password"],
+    ["secret", "unknown-sensitive-value"],
+    ["credential", "unknown-sensitive-value"],
+    ["credentials", "unknown-sensitive-value"],
+    ["auth", "access-token"],
+    ["authorization", "access-token"],
+    ["bearer", "bearer-token"],
+    ["bearertoken", "bearer-token"],
+    ["token", "access-token"],
+    ["accesstoken", "access-token"],
+    ["refreshtoken", "access-token"],
+    ["authtoken", "access-token"],
+    ["sessiontoken", "access-token"],
+    ["apisecret", "cloud-secret-key"],
+    ["clientsecret", "oauth-client-secret"],
+    // Signing and recovery
+    ["signingpassword", "signing-password"],
+    ["storepassword", "signing-password"],
+    ["keypassword", "signing-password"],
+    ["recoverycode", "recovery-code"],
+    ["backupcode", "recovery-code"],
+    ["otp", "recovery-code"],
+    ["onetimepassword", "recovery-code"],
+    // Personal and account data
+    ["email", "personal-data"],
+    ["phone", "personal-data"],
+    ["phonenumber", "personal-data"],
+    ["address", "personal-data"],
+    ["location", "personal-data"],
+    ["latitude", "personal-data"],
+    ["longitude", "personal-data"],
+    ["userid", "personal-data"],
+    ["accountid", "personal-data"],
+    ["deviceid", "personal-data"],
+    ["advertisingid", "personal-data"],
+    // Financial or regulated data (no dedicated category — reuses
+    // personal-data, the closest Batch 1 regulated-data category)
+    ["cardnumber", "personal-data"],
+    ["creditcard", "personal-data"],
+    ["bankaccount", "personal-data"],
+    ["ssn", "personal-data"],
+    ["taxid", "personal-data"],
+    // Database/session data
+    ["session", "access-token"],
+    ["cookie", "access-token"],
+    ["databasepassword", "database-credential"],
+    ["dbpassword", "database-credential"],
+    ["connectionstring", "database-credential"],
+]);
+// Public identifiers that must never be classified as sensitive by name
+// alone, even though a naive substring match might otherwise catch them.
+const PUBLIC_IDENTIFIER_WORDS = new Set([
+    "apikey",
+    "projectid",
+    "appid",
+    "packagename",
+    "storagebucket",
+    "databaseurl",
+    "senderid",
+    "clientid",
+    "mobilesdkappid",
+    "applicationid",
+    "namespace",
+]);
+// Splits camelCase/PascalCase/snake_case/kebab-case identifiers into
+// lowercase words, e.g. "userAuthToken" / "user_auth_token" -> ["user",
+// "auth", "token"].
+export function splitIdentifierWords(identifier) {
+    return identifier
+        .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+        .replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2")
+        .replace(/[-_.]+/g, " ")
+        .trim()
+        .split(/\s+/)
+        .filter(Boolean)
+        .map((word) => word.toLowerCase());
+}
+function normalizeCompound(words) {
+    return words.join("");
+}
+// Returns a classification only for a defensible direct match: either the
+// whole normalized identifier (with separators removed) matches a known
+// compound entry, or any individual word in the identifier exactly matches a
+// known single-word entry. Never matches on an arbitrary substring.
+export function classifySensitiveIdentifier(identifier) {
+    const words = splitIdentifierWords(identifier);
+    if (words.length === 0)
+        return undefined;
+    const compound = normalizeCompound(words);
+    if (PUBLIC_IDENTIFIER_WORDS.has(compound))
+        return undefined;
+    const compoundCategory = EXACT_WORD_CATEGORY.get(compound);
+    if (compoundCategory !== undefined) {
+        return { sensitiveDataCategory: compoundCategory, normalized: compound };
+    }
+    for (const word of words) {
+        if (PUBLIC_IDENTIFIER_WORDS.has(word))
+            continue;
+        const category = EXACT_WORD_CATEGORY.get(word);
+        if (category !== undefined) {
+            return { sensitiveDataCategory: category, normalized: word };
+        }
+    }
+    return undefined;
+}

package/dist/src/mobile/android/advancedSecurity/sensitiveData/index.js

@@ -0,0 +1,3 @@
+export { classifySensitiveIdentifier, splitIdentifierWords } from "./classifySensitiveIdentifier.js";
+export { classifyDirectExpression, DIRECT_EXPRESSION_KINDS } from "./classifyDirectExpression.js";
+export { executableMask, lineForOffset, methodScopes, scopeAt, sameScope } from "./localSourceContext.js";

package/dist/src/mobile/android/advancedSecurity/sensitiveData/localSourceContext.js

@@ -0,0 +1,90 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — narrow shared local Java/Kotlin source-context helpers.
+//
+// Extracted (not copied verbatim) from the bounded masking/scope technique
+// Batch 5's WebView analyzer implemented privately in
+// advancedSecurity/webview/checkResult.ts. That file is left completely
+// unchanged (its own mask/scope logic stays inline) — this module is new,
+// additive code used only by the four Batch 6 analyzers, generalized just
+// enough to be language-general rather than SSL-callback-specific. It is
+// NOT a compiler front end: no AST, no symbol resolution, no cross-method
+// data flow. It only offers:
+//   - executableMask(): comment/string-masked text with byte-for-byte
+//     preserved offsets and line breaks, so downstream regexes never match
+//     inside a comment or a string literal, and reported line numbers stay
+//     correct against the original source.
+//   - methodScopes(): brace-depth-bounded method-like ranges (used for
+//     same-method correlation only — never cross-method).
+//   - lineForOffset(): 1-based line number for a byte offset.
+// ---------------------------------------------------------------------------
+const STRING_OR_COMMENT = /"""[\s\S]*?"""|"(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*'|\/\/[^\n]*|\/\*[\s\S]*?\*\//g;
+// Masks comment and string/char contents with spaces (preserving embedded
+// newlines) so line numbers and offsets never shift and downstream regexes
+// never match text that only appears inside a comment or a literal.
+export function executableMask(source) {
+    return source.replace(STRING_OR_COMMENT, (match) => match.replace(/[^\n]/g, " "));
+}
+export function lineForOffset(source, offset) {
+    let line = 1;
+    for (let i = 0; i < offset && i < source.length; i += 1) {
+        if (source[i] === "\n")
+            line += 1;
+    }
+    return line;
+}
+const METHOD_HEADER = /(?:fun|void|[A-Za-z_$][\w$.<>,?\[\] ]*?)\s+[A-Za-z_$][\w$]*\s*\([^)]*\)[^{;]*\{/g;
+function braceEnd(mask, openBraceIndex) {
+    let depth = 0;
+    for (let i = openBraceIndex; i < mask.length; i += 1) {
+        if (mask[i] === "{")
+            depth += 1;
+        else if (mask[i] === "}") {
+            depth -= 1;
+            if (depth === 0)
+                return i;
+        }
+    }
+    return mask.length - 1;
+}
+// Bounded, best-effort method-like scope extraction over already-masked
+// text. Overlapping/nested matches are tolerated (each open-brace found by
+// the header regex gets its own scope) — callers only use scope identity for
+// "same enclosing scope" correlation, never for accurate call-graph shape.
+export function methodScopes(mask) {
+    const scopes = [];
+    let match;
+    let id = 0;
+    METHOD_HEADER.lastIndex = 0;
+    while ((match = METHOD_HEADER.exec(mask)) !== null) {
+        const openBrace = match.index + match[0].length - 1;
+        if (mask[openBrace] !== "{")
+            continue;
+        const close = braceEnd(mask, openBrace);
+        scopes.push({ from: match.index, to: close, id });
+        id += 1;
+    }
+    return scopes;
+}
+// Innermost (smallest-span) scope containing offset, or undefined if offset
+// is not inside any recognized method-like range (e.g. field initializer).
+export function scopeAt(scopes, offset) {
+    let best;
+    for (const scope of scopes) {
+        if (offset >= scope.from && offset <= scope.to) {
+            if (best === undefined || scope.to - scope.from < best.to - best.from)
+                best = scope;
+        }
+    }
+    return best;
+}
+// Same-method correlation: true only when both offsets resolve to the same
+// enclosing scope id (or both resolve to no scope, treated as file-level and
+// therefore not correlated across arbitrary distance — callers should apply
+// an additional bounded-distance check for the no-scope case).
+export function sameScope(scopes, offsetA, offsetB) {
+    const a = scopeAt(scopes, offsetA);
+    const b = scopeAt(scopes, offsetB);
+    if (a === undefined || b === undefined)
+        return false;
+    return a.id === b.id;
+}

package/dist/src/mobile/android/advancedSecurity/sensitiveData/splitArguments.js

@@ -0,0 +1,59 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — shared bounded top-level argument splitter.
+//
+// Splits a call's argument text on top-level commas only (commas nested
+// inside (), [], {}, or string/char literals are not split points). Used by
+// all four Batch 6 analyzers to pull individual arguments out of an already
+// bounded, already-masked-for-comments call match. Not a parser: does not
+// understand trailing lambdas, named/default arguments beyond a literal
+// `name = value` prefix strip, or varargs semantics.
+// ---------------------------------------------------------------------------
+const MAX_ARGUMENTS = 12;
+export function splitTopLevelArguments(argsText) {
+    const args = [];
+    let depth = 0;
+    let current = "";
+    let quote;
+    for (let i = 0; i < argsText.length; i += 1) {
+        const ch = argsText[i];
+        if (quote) {
+            current += ch;
+            if (ch === "\\") {
+                i += 1;
+                if (i < argsText.length)
+                    current += argsText[i];
+                continue;
+            }
+            if (ch === quote)
+                quote = undefined;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            current += ch;
+            continue;
+        }
+        if (ch === "(" || ch === "[" || ch === "{") {
+            depth += 1;
+            current += ch;
+            continue;
+        }
+        if (ch === ")" || ch === "]" || ch === "}") {
+            depth -= 1;
+            current += ch;
+            continue;
+        }
+        if (ch === "," && depth === 0) {
+            args.push(current.trim());
+            current = "";
+            if (args.length >= MAX_ARGUMENTS)
+                break;
+            continue;
+        }
+        current += ch;
+    }
+    if (current.trim().length > 0 || args.length === 0)
+        args.push(current.trim());
+    // Strip a leading `name = ` Kotlin named-argument prefix, if present.
+    return args.map((arg) => arg.replace(/^[A-Za-z_$][\w$]*\s*=\s*(?!=)/, ""));
+}

package/dist/src/mobile/android/advancedSecurity/sensitiveLogging/analyzeSensitiveLogging.js

@@ -0,0 +1,117 @@
+import { makeAndroidFinding } from "../../audit/androidFinding.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { classifyDirectExpression } from "../sensitiveData/classifyDirectExpression.js";
+import { classifySensitiveIdentifier } from "../sensitiveData/classifySensitiveIdentifier.js";
+import { collectLoggingEvidence } from "./collectLoggingEvidence.js";
+// Authorization/Bearer/Cookie/session/token identifiers are already covered
+// by classifySensitiveIdentifier's shared vocabulary (no separate header
+// word list here) — a bare string literal equal to a header *name* (e.g.
+// "Authorization" used as a log tag) is deliberately never inspected for
+// content, so it never produces a finding (see module header note above).
+function sensitiveIdentifierNameFor(expression) {
+    if (expression === undefined)
+        return undefined;
+    const classification = classifyDirectExpression(expression);
+    if (classification.kind !== "identifier" && classification.kind !== "member-access")
+        return undefined;
+    const name = expression.replace(/^.*\./, "");
+    const result = classifySensitiveIdentifier(name);
+    return result ? { sensitiveDataCategory: result } : undefined;
+}
+function isExceptionMessageExpression(expression) {
+    if (expression === undefined)
+        return false;
+    return /\.(message|localizedMessage)$/.test(expression) || /\.(getMessage|stackTraceToString)\s*\(\s*\)$/.test(expression);
+}
+export function analyzeSensitiveLoggingFile(targetRoot, file) {
+    const candidates = [];
+    const findings = [];
+    const matches = collectLoggingEvidence(file.content);
+    const limitations = [
+        "Bounded lexical source analysis; does not prove a log call executed, that logs are present on a device, or that Crashlytics uploaded data.",
+    ];
+    const location = (m) => buildAndroidSourceLocation(targetRoot, file.absolutePath, { line: m.line });
+    const finding = (m, title, evidenceDetails) => findings.push(makeAndroidFinding({
+        ruleId: "android-sensitive-logging",
+        title,
+        severity: m.debugGuarded ? "minor" : "major",
+        confidence: "high",
+        description: `${title} via ${m.api}. Static source evidence only; does not prove the call executed or that logs were collected.`,
+        manifestPath: file.relativePath,
+        identity: `${m.api}:${m.line}`,
+        location: { line: m.line },
+        evidenceDetails: [...evidenceDetails, m.debugGuarded ? "debug-guard=present" : "debug-guard=none"],
+        recommendation: "Remove sensitive values from log statements, or guard them out of release builds entirely.",
+    }));
+    const candidate = (m, summary, rawValue, confidence = "medium", resolutionState = "resolved") => candidates.push(makeCandidateEvidence({
+        ruleId: "android-sensitive-logging",
+        category: "android-sensitive-logging",
+        confidence,
+        modulePath: file.modulePath,
+        location: location(m),
+        summary,
+        rawValue,
+        resolutionState,
+        staticAnalysisLimitations: limitations,
+    }));
+    for (const m of matches) {
+        if (m.kind === "isloggable") {
+            candidate(m, "Log.isLoggable is contextual evidence; it is not a security control by itself", undefined, "low", "not-applicable");
+            continue;
+        }
+        if (m.kind === "print-stack-trace") {
+            candidate(m, "printStackTrace() called; review evidence only, does not prove secrets are present", m.throwableExpression, "low", "not-applicable");
+            continue;
+        }
+        if (m.kind === "crashlytics") {
+            if (m.api === "Crashlytics.recordException") {
+                candidate(m, "Crashlytics recordException() called", undefined, "low", "not-applicable");
+                continue;
+            }
+            if (m.api === "Crashlytics.setCustomKey") {
+                const keyLiteral = m.tagExpression !== undefined ? classifyDirectExpression(m.tagExpression) : undefined;
+                const sensitive = keyLiteral?.kind === "string-literal" && keyLiteral.literalValue !== undefined ? classifySensitiveIdentifier(keyLiteral.literalValue) : sensitiveIdentifierNameFor(m.tagExpression);
+                if (sensitive) {
+                    finding(m, "Sensitive Crashlytics custom key or value set", [`key=${m.tagExpression}`]);
+                }
+                else {
+                    candidate(m, "Crashlytics setCustomKey() called", m.messageExpression, "low");
+                }
+                continue;
+            }
+            if (m.api === "Crashlytics.setUserId") {
+                const sensitive = sensitiveIdentifierNameFor(m.messageExpression);
+                if (sensitive) {
+                    finding(m, "Direct personal identifier supplied to Crashlytics setUserId", [`value=${m.messageExpression}`]);
+                }
+                else {
+                    candidate(m, "Crashlytics setUserId() called; privacy review evidence", m.messageExpression, "low");
+                }
+                continue;
+            }
+            // Crashlytics.log — same sensitive-message policy as Log/Timber below.
+        }
+        // Log / Timber / stdout / Crashlytics.log share one sensitive-argument policy.
+        const tagSensitive = sensitiveIdentifierNameFor(m.tagExpression);
+        const messageSensitive = sensitiveIdentifierNameFor(m.messageExpression);
+        if (tagSensitive || messageSensitive) {
+            finding(m, `Direct sensitive value logged via ${m.api}`, [`argument=${messageSensitive ? m.messageExpression : m.tagExpression}`]);
+            continue;
+        }
+        if (isExceptionMessageExpression(m.messageExpression)) {
+            candidate(m, "Exception message/stack-trace text logged; content not inspected", m.messageExpression, "low", "not-applicable");
+            continue;
+        }
+        if (m.messageExpression !== undefined) {
+            const classification = classifyDirectExpression(m.messageExpression);
+            if (classification.kind === "method-call" || classification.kind === "collection-object" || classification.kind === "member-access" || classification.kind === "dynamic-unsupported") {
+                candidate(m, `Dynamic ${classification.kind.replace("-", " ")} logged; contents not inspected`, m.messageExpression, "low", "unresolved");
+            }
+            else if (classification.kind === "identifier") {
+                candidate(m, "Dynamic log message logged; identifier not recognized as sensitive by name", m.messageExpression, "low", "unresolved");
+            }
+        }
+    }
+    return { candidates, findings };
+}

package/dist/src/mobile/android/advancedSecurity/sensitiveLogging/checkResult.js

@@ -0,0 +1,74 @@
+import { sortCandidateEvidence } from "../ordering.js";
+import { discoverSecretSourceFiles } from "../secretCandidates/discoverSecretSourceFiles.js";
+import { analyzeSensitiveLoggingFile } from "./analyzeSensitiveLogging.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — standalone Android sensitive-logging check result.
+// Follows the exact Batch 4/5 standalone pattern: not called from
+// validateAndroidTarget / any active orchestration, not rendered in reports,
+// no CLI effect. Batch 8 integrates.
+// ---------------------------------------------------------------------------
+export const ANDROID_SENSITIVE_LOGGING_AUDIT_CHECK_ID = "android-sensitive-logging-audit";
+export function auditAndroidSensitiveLogging(targetRoot, detection) {
+    if (detection.projectKind === "non-android") {
+        return {
+            id: ANDROID_SENSITIVE_LOGGING_AUDIT_CHECK_ID,
+            category: "android-sensitive-logging",
+            title: "Android sensitive-logging audit",
+            status: "unsupported",
+            requirementLevel: "optional",
+            ran: false,
+            skipped: true,
+            skipInfo: {
+                checkId: ANDROID_SENSITIVE_LOGGING_AUDIT_CHECK_ID,
+                reason: "Target was not detected as an Android project.",
+                requirementLevel: "optional",
+                missingCapability: "android-detection",
+                verdictImpact: "does not apply to a non-Android target",
+                recommendedNextAction: "Re-run against an Android Gradle project, or verify project detection.",
+            },
+            evidence: [],
+            findings: [],
+            warnings: [],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+    const modulePaths = detection.modules.map((m) => m.path);
+    const { files, skipped } = discoverSecretSourceFiles(targetRoot, modulePaths);
+    const sourceFiles = files.filter((file) => /\.(java|kt)$/.test(file.relativePath));
+    const findingsById = new Map();
+    const candidatesById = new Map();
+    for (const file of sourceFiles) {
+        const result = analyzeSensitiveLoggingFile(targetRoot, file);
+        for (const f of result.findings)
+            findingsById.set(f.id, f);
+        for (const c of result.candidates)
+            candidatesById.set(c.id, c);
+    }
+    const findings = [...findingsById.values()].sort((a, b) => a.id.localeCompare(b.id));
+    const candidateEvidence = sortCandidateEvidence([...candidatesById.values()]);
+    const hasReportableFinding = findings.some((f) => f.severity !== "informational");
+    return {
+        id: ANDROID_SENSITIVE_LOGGING_AUDIT_CHECK_ID,
+        category: "android-sensitive-logging",
+        title: "Android sensitive-logging audit",
+        status: hasReportableFinding ? "failed" : "passed",
+        requirementLevel: "required",
+        ran: true,
+        skipped: false,
+        evidence: [`${sourceFiles.length} Java/Kotlin file(s) scanned`],
+        findings,
+        warnings: [
+            ...skipped.map((s) => `${s.relativePath}: skipped (${s.reason}${s.detail ? `: ${s.detail}` : ""})`),
+            "Static analysis only: does not prove log calls executed, that logcat is accessible, or that Crashlytics uploaded data.",
+        ],
+        errors: [],
+        sourcePaths: sourceFiles.map((f) => f.relativePath),
+        confidence: skipped.length > 0 ? "medium" : "high",
+        environmentRequirements: [],
+        candidateEvidence,
+    };
+}

package/dist/src/mobile/android/advancedSecurity/sensitiveLogging/collectLoggingEvidence.js

@@ -0,0 +1,87 @@
+import { executableMask, lineForOffset } from "../sensitiveData/localSourceContext.js";
+import { splitTopLevelArguments } from "../sensitiveData/splitArguments.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — bounded direct evidence collection for sensitive-logging
+// sinks (Android Log, Timber, stdout/stderr, printStackTrace, and
+// Crashlytics payload sinks). Purely lexical, over comment/string-masked
+// text with argument text re-sliced from the original content via regex
+// match indices (see sensitiveStorage/collectStorageEvidence.ts for the same
+// pattern and its rationale). Nothing here constructs CandidateEvidence or
+// SecurityFinding.
+// ---------------------------------------------------------------------------
+const LOG_CALL = /\bLog\.(v|d|i|w|e|wtf|println)\s*\(([^;\n]*?)\)/gd;
+const TIMBER_CALL = /\bTimber\.(v|d|i|w|e|wtf|log|tag)\s*\(([^;\n]*?)\)/gd;
+const STDOUT_CALL = /(System\.out|System\.err)\.(print|println)\s*\(([^;\n]*?)\)/gd;
+const KOTLIN_PRINT = /(?<![.\w])(print|println)\s*\(([^;\n]*?)\)/gd;
+const PRINT_STACK_TRACE = /([A-Za-z_][\w.]*)\.printStackTrace\s*\(\s*\)/gd;
+const CRASHLYTICS_CALL = /\b(FirebaseCrashlytics(?:\.getInstance\(\))?|crashlytics)\.(log|setCustomKey|setUserId|recordException)\s*\(([^;\n]*?)\)/gd;
+const IS_LOGGABLE = /\bLog\.isLoggable\s*\(([^;\n]*?)\)/gd;
+const DEBUG_GUARD_WINDOW = 3;
+function realGroup(content, match, group) {
+    const span = match.indices?.[group];
+    if (!span)
+        return match[group];
+    return content.slice(span[0], span[1]);
+}
+function isDebugGuarded(content, offset) {
+    const startLine = lineForOffset(content, offset) - DEBUG_GUARD_WINDOW;
+    const lines = content.split("\n");
+    const from = Math.max(0, startLine - 1);
+    const window = lines.slice(from, lineForOffset(content, offset)).join("\n");
+    return /BuildConfig\.DEBUG|\bDEBUG\b/.test(window);
+}
+function push(list, content, kind, api, offset, extra) {
+    list.push({
+        kind,
+        api,
+        debugGuarded: isDebugGuarded(content, offset),
+        offset,
+        line: lineForOffset(content, offset),
+        ...extra,
+    });
+}
+export function collectLoggingEvidence(content) {
+    const mask = executableMask(content);
+    const matches = [];
+    for (const match of mask.matchAll(LOG_CALL)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 2) ?? "");
+        if (match[1] === "println") {
+            push(matches, content, "log", `Log.println`, offset, { messageExpression: args[args.length - 1], tagExpression: args[1] });
+            continue;
+        }
+        push(matches, content, "log", `Log.${match[1]}`, offset, { tagExpression: args[0], messageExpression: args[1], throwableExpression: args[2] });
+    }
+    for (const match of mask.matchAll(IS_LOGGABLE)) {
+        const offset = match.index ?? 0;
+        push(matches, content, "isloggable", "Log.isLoggable", offset, {});
+    }
+    for (const match of mask.matchAll(TIMBER_CALL)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 2) ?? "");
+        push(matches, content, "timber", `Timber.${match[1]}`, offset, { messageExpression: args[0], throwableExpression: args[1] });
+    }
+    for (const match of mask.matchAll(STDOUT_CALL)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 3) ?? "");
+        push(matches, content, "stdout", `${match[1]}.${match[2]}`, offset, { messageExpression: args[0] });
+    }
+    for (const match of mask.matchAll(KOTLIN_PRINT)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 2) ?? "");
+        push(matches, content, "stdout", match[1], offset, { messageExpression: args[0] });
+    }
+    for (const match of mask.matchAll(PRINT_STACK_TRACE)) {
+        const offset = match.index ?? 0;
+        push(matches, content, "print-stack-trace", "printStackTrace", offset, { throwableExpression: match[1] });
+    }
+    for (const match of mask.matchAll(CRASHLYTICS_CALL)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 3) ?? "");
+        push(matches, content, "crashlytics", `Crashlytics.${match[2]}`, offset, {
+            tagExpression: match[2] === "setCustomKey" ? args[0] : undefined,
+            messageExpression: args[match[2] === "setCustomKey" ? 1 : 0],
+        });
+    }
+    return matches.sort((a, b) => a.offset - b.offset);
+}

package/dist/src/mobile/android/advancedSecurity/sensitiveLogging/index.js

@@ -0,0 +1 @@
+export { auditAndroidSensitiveLogging, ANDROID_SENSITIVE_LOGGING_AUDIT_CHECK_ID } from "./checkResult.js";

package/dist/src/mobile/android/advancedSecurity/sensitiveLogging/types.js

@@ -0,0 +1 @@
+export {};