@datahogo/core 0.1.0

package/dist/engines/config.d.ts

@@ -0,0 +1,3 @@
+import type { FindingData } from "./types.js";
+export declare function analyzeConfig(files: Map<string, string>): FindingData[];
+//# sourceMappingURL=config.d.ts.map

package/dist/engines/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/engines/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,wBAAgB,aAAa,CAC3B,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GACzB,WAAW,EAAE,CA8Bf"}

package/dist/engines/config.js

@@ -0,0 +1,433 @@
+// Config analyzer engine - checks configuration files for security issues
+// Analyzes: Dockerfile, next.config, package.json, .gitignore, etc.
+export function analyzeConfig(files) {
+    const findings = [];
+    for (const [filePath, content] of files) {
+        const fileName = filePath.split("/").pop() || "";
+        if (fileName === "Dockerfile" || fileName.endsWith(".dockerfile")) {
+            findings.push(...analyzeDockerfile(content, filePath));
+        }
+        if (fileName === "next.config.js" || fileName === "next.config.ts" || fileName === "next.config.mjs") {
+            findings.push(...analyzeNextConfig(content, filePath));
+        }
+        if (fileName === "package.json" && !filePath.includes("node_modules")) {
+            findings.push(...analyzePackageJson(content, filePath));
+        }
+        if (fileName === ".gitignore") {
+            findings.push(...analyzeGitignore(content, filePath, files));
+        }
+        if (fileName === "docker-compose.yml" || fileName === "docker-compose.yaml") {
+            findings.push(...analyzeDockerCompose(content, filePath));
+        }
+        if (fileName === "tsconfig.json" && !filePath.includes("node_modules")) {
+            findings.push(...analyzeTsConfig(content, filePath));
+        }
+        if (fileName === "vercel.json") {
+            findings.push(...analyzeVercelConfig(content, filePath));
+        }
+    }
+    return findings;
+}
+function analyzeDockerfile(content, filePath) {
+    const findings = [];
+    const lines = content.split("\n");
+    // Check for running as root (no USER instruction)
+    // Skip if FROM scratch or distroless (no shell, USER is irrelevant)
+    const baseImage = lines.find((l) => /^FROM\s+/i.test(l.trim()));
+    const isMinimalImage = baseImage && /(?:scratch|distroless|busybox)/i.test(baseImage);
+    const hasUserInstruction = lines.some((l) => /^USER\s+/i.test(l.trim()));
+    if (!hasUserInstruction && !isMinimalImage) {
+        findings.push({
+            vulnerability_id: 148,
+            severity: "medium",
+            category: "docker",
+            title: "Container Running as Root",
+            file_path: filePath,
+            code_snippet: "# No USER instruction found in Dockerfile",
+            owasp_ref: "A05:2021",
+            status: "open",
+            confidence: "low",
+        });
+    }
+    // Check for latest tag
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i].trim();
+        if (/^FROM\s+\S+:latest/i.test(line)) {
+            findings.push({
+                vulnerability_id: 149,
+                severity: "low",
+                category: "docker",
+                title: "Using :latest Tag in Dockerfile",
+                file_path: filePath,
+                line_number: i + 1,
+                code_snippet: line,
+                status: "open",
+                confidence: "medium",
+            });
+        }
+        // Check for secrets in Dockerfile — skip if value references build arg or env var
+        if (/^(?:ENV|ARG)\s+(?:.*(?:PASSWORD|SECRET|KEY|TOKEN|PRIVATE))/i.test(line)) {
+            const hasHardcodedValue = /[=]\s*[^$\s{][^\s]+/.test(line);
+            findings.push({
+                vulnerability_id: 150,
+                severity: hasHardcodedValue ? "critical" : "medium",
+                category: "docker",
+                title: "Secrets in Dockerfile ENV/ARG",
+                file_path: filePath,
+                line_number: i + 1,
+                code_snippet: line,
+                status: "open",
+                confidence: hasHardcodedValue ? "high" : "low",
+            });
+        }
+        // Check for COPY .env — skip .env.example, .env.template, .env.sample
+        if (/^COPY\s+.*\.env(?!\.example|\.template|\.sample)/i.test(line)) {
+            findings.push({
+                vulnerability_id: 150,
+                severity: "critical",
+                category: "docker",
+                title: "Copying .env File into Docker Image",
+                file_path: filePath,
+                line_number: i + 1,
+                code_snippet: line,
+                status: "open",
+                confidence: "high",
+            });
+        }
+    }
+    // Check for HEALTHCHECK
+    const hasHealthcheck = lines.some((l) => /^HEALTHCHECK/i.test(l.trim()));
+    if (!hasHealthcheck) {
+        findings.push({
+            vulnerability_id: 152,
+            severity: "low",
+            category: "docker",
+            title: "No HEALTHCHECK in Dockerfile",
+            file_path: filePath,
+            code_snippet: "# No HEALTHCHECK instruction found",
+            status: "open",
+            confidence: "low",
+        });
+    }
+    return findings;
+}
+function analyzeNextConfig(content, filePath) {
+    const findings = [];
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // Check for exposed source maps
+        if (/productionBrowserSourceMaps\s*:\s*true/i.test(line)) {
+            findings.push({
+                vulnerability_id: 49,
+                severity: "medium",
+                category: "react-nextjs",
+                title: "Source Maps Exposed in Production",
+                file_path: filePath,
+                line_number: i + 1,
+                code_snippet: line.trim(),
+                status: "open",
+                confidence: "high",
+            });
+        }
+        // Check for permissive headers/CORS
+        if (/Access-Control-Allow-Origin.*\*/i.test(line)) {
+            findings.push({
+                vulnerability_id: 50,
+                severity: "medium",
+                category: "react-nextjs",
+                title: "Open CORS in Next.js Config",
+                file_path: filePath,
+                line_number: i + 1,
+                code_snippet: line.trim(),
+                status: "open",
+                confidence: "high",
+            });
+        }
+    }
+    // Check if poweredByHeader is explicitly disabled
+    if (!content.includes("poweredByHeader") || !/poweredByHeader\s*:\s*false/.test(content)) {
+        findings.push({
+            vulnerability_id: 4,
+            severity: "low",
+            category: "react-nextjs",
+            title: "X-Powered-By Header Not Disabled",
+            file_path: filePath,
+            code_snippet: "// Missing: poweredByHeader: false in next.config",
+            fix_description: "Add poweredByHeader: false to your next.config to prevent disclosing Next.js",
+            owasp_ref: "A05:2021",
+            status: "open",
+            confidence: "medium",
+        });
+    }
+    return findings;
+}
+function analyzePackageJson(content, filePath) {
+    const findings = [];
+    try {
+        const pkg = JSON.parse(content);
+        // Check for suspicious install scripts
+        if (pkg.scripts) {
+            const suspiciousScripts = ["preinstall", "postinstall", "install"];
+            for (const script of suspiciousScripts) {
+                const value = pkg.scripts[script];
+                if (value && (/curl|wget|bash|sh\s+-c|eval|exec/i.test(value))) {
+                    findings.push({
+                        vulnerability_id: 139,
+                        severity: "high",
+                        category: "supply-chain",
+                        title: "Suspicious Install Script in package.json",
+                        file_path: filePath,
+                        code_snippet: `"${script}": "${value}"`,
+                        status: "open",
+                        confidence: "medium",
+                    });
+                }
+            }
+        }
+    }
+    catch {
+        // Invalid JSON - not a security issue per se
+    }
+    return findings;
+}
+function analyzeGitignore(content, filePath, allFiles) {
+    const findings = [];
+    const lines = content.split("\n").map((l) => l.trim());
+    // Check if .env is ignored
+    const hasEnvIgnore = lines.some((l) => l === ".env" || l === ".env*" || l === ".env.local");
+    if (!hasEnvIgnore) {
+        findings.push({
+            vulnerability_id: 168,
+            severity: "medium",
+            category: "config",
+            title: "Inadequate .gitignore - Missing .env",
+            file_path: filePath,
+            code_snippet: "# .env is not listed in .gitignore",
+            status: "open",
+            confidence: "high",
+        });
+    }
+    // Check if .env.example exists
+    if (!allFiles.has(".env.example")) {
+        findings.push({
+            vulnerability_id: 165,
+            severity: "low",
+            category: "config",
+            title: "No .env.example File",
+            code_snippet: "Project is missing .env.example for documenting required env vars",
+            status: "open",
+            confidence: "low",
+        });
+    }
+    // Check if lockfile exists
+    const hasLockfile = allFiles.has("package-lock.json") ||
+        allFiles.has("yarn.lock") ||
+        allFiles.has("pnpm-lock.yaml");
+    if (allFiles.has("package.json") && !hasLockfile) {
+        findings.push({
+            vulnerability_id: 141,
+            severity: "medium",
+            category: "supply-chain",
+            title: "Missing Lockfile",
+            code_snippet: "No package-lock.json, yarn.lock, or pnpm-lock.yaml found",
+            status: "open",
+            confidence: "high",
+        });
+    }
+    return findings;
+}
+function analyzeDockerCompose(content, filePath) {
+    const findings = [];
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // Privileged mode
+        if (/privileged\s*:\s*true/i.test(line)) {
+            findings.push({
+                vulnerability_id: 148,
+                severity: "critical",
+                category: "docker",
+                title: "Docker Compose: Privileged Container",
+                description_technical: "Container runs in privileged mode, giving it full host access",
+                file_path: filePath,
+                line_number: i + 1,
+                code_snippet: line.trim(),
+                status: "open",
+                confidence: "high",
+            });
+        }
+        // Dangerous volume mounts
+        if (/volumes:/.test(line)) {
+            const nextLines = lines.slice(i + 1, i + 10).join("\n");
+            if (/["']?\/?(?:var\/run\/docker\.sock|\/etc|\/root|\/proc|\/sys)/.test(nextLines)) {
+                findings.push({
+                    vulnerability_id: 148,
+                    severity: "high",
+                    category: "docker",
+                    title: "Docker Compose: Sensitive Volume Mount",
+                    description_technical: "Container mounts a sensitive host path (docker.sock, /etc, /root, /proc, /sys)",
+                    file_path: filePath,
+                    line_number: i + 1,
+                    code_snippet: lines.slice(i, i + 4).join("\n"),
+                    status: "open",
+                    confidence: "high",
+                });
+            }
+        }
+        // Database without password
+        if (/(?:POSTGRES_PASSWORD|MYSQL_ROOT_PASSWORD|MONGO_INITDB_ROOT_PASSWORD)\s*:\s*["']?\s*["']?$/i.test(line)) {
+            findings.push({
+                vulnerability_id: 101,
+                severity: "critical",
+                category: "database",
+                title: "Docker Compose: Database Without Password",
+                file_path: filePath,
+                line_number: i + 1,
+                code_snippet: line.trim(),
+                status: "open",
+                confidence: "high",
+            });
+        }
+        // Default database credentials
+        if (/(?:POSTGRES_PASSWORD|MYSQL_ROOT_PASSWORD|MONGO_INITDB_ROOT_PASSWORD)\s*:\s*["']?(?:postgres|root|admin|password|secret|test|123456|changeme)["']?\s*$/i.test(line)) {
+            findings.push({
+                vulnerability_id: 101,
+                severity: "critical",
+                category: "database-connection",
+                title: "Docker Compose: Default Database Credentials",
+                description_technical: "Database uses default/weak credentials. Use strong, unique passwords via secrets management.",
+                file_path: filePath,
+                line_number: i + 1,
+                code_snippet: line.trim().replace(/:\s*["']?(.*)["']?/, ": ***REDACTED***"),
+                status: "open",
+                confidence: "high",
+            });
+        }
+        // Database port exposed to host without restriction
+        if (/ports:/.test(line)) {
+            const nextLines = lines.slice(i + 1, i + 5).join("\n");
+            if (/["']?(?:0\.0\.0\.0:)?(?:5432|3306|27017|6379|9200|9300|5984):/.test(nextLines)) {
+                findings.push({
+                    vulnerability_id: 148,
+                    severity: "high",
+                    category: "database-connection",
+                    title: "Docker Compose: Database Port Exposed to Host",
+                    description_technical: "Database port is mapped to the host. In production, databases should only be accessible via internal network.",
+                    file_path: filePath,
+                    line_number: i + 1,
+                    code_snippet: lines.slice(i, i + 3).join("\n"),
+                    status: "open",
+                    confidence: "medium",
+                });
+            }
+        }
+        // Redis without password
+        if (/redis/i.test(line) && i > 0) {
+            const serviceBlock = lines.slice(Math.max(0, i - 5), i + 15).join("\n");
+            if (/image\s*:\s*["']?redis/i.test(serviceBlock) && !/requirepass|--requirepass|REDIS_PASSWORD/i.test(serviceBlock)) {
+                if (/command|entrypoint/i.test(line) === false && /image\s*:\s*["']?redis/i.test(line)) {
+                    findings.push({
+                        vulnerability_id: 101,
+                        severity: "high",
+                        category: "database-connection",
+                        title: "Docker Compose: Redis Without Password",
+                        description_technical: "Redis service has no password configured. Use --requirepass or REDIS_PASSWORD.",
+                        file_path: filePath,
+                        line_number: i + 1,
+                        code_snippet: line.trim(),
+                        status: "open",
+                        confidence: "medium",
+                    });
+                }
+            }
+        }
+        // network_mode: host
+        if (/network_mode\s*:\s*["']?host/i.test(line)) {
+            findings.push({
+                vulnerability_id: 148,
+                severity: "medium",
+                category: "docker",
+                title: "Docker Compose: Host Network Mode",
+                description_technical: "Container uses host networking, bypassing Docker network isolation",
+                file_path: filePath,
+                line_number: i + 1,
+                code_snippet: line.trim(),
+                status: "open",
+                confidence: "medium",
+            });
+        }
+    }
+    return findings;
+}
+function analyzeTsConfig(content, filePath) {
+    const findings = [];
+    try {
+        const config = JSON.parse(content);
+        const compilerOptions = config.compilerOptions || {};
+        if (compilerOptions.strict === false) {
+            findings.push({
+                vulnerability_id: 166,
+                severity: "low",
+                category: "config",
+                title: "TypeScript Strict Mode Disabled",
+                description_technical: "tsconfig.json has strict: false. Strict mode catches many potential bugs at compile time.",
+                file_path: filePath,
+                code_snippet: '"strict": false',
+                status: "open",
+                confidence: "medium",
+            });
+        }
+        if (!compilerOptions.strict && compilerOptions.noImplicitAny === false) {
+            findings.push({
+                vulnerability_id: 166,
+                severity: "low",
+                category: "config",
+                title: "TypeScript noImplicitAny Disabled",
+                description_technical: "noImplicitAny is false, allowing implicit 'any' types which bypass type safety.",
+                file_path: filePath,
+                code_snippet: '"noImplicitAny": false',
+                status: "open",
+                confidence: "medium",
+            });
+        }
+    }
+    catch {
+        // Invalid JSON - skip
+    }
+    return findings;
+}
+function analyzeVercelConfig(content, filePath) {
+    const findings = [];
+    try {
+        const config = JSON.parse(content);
+        // Check for env vars with secret-looking values
+        if (config.env) {
+            for (const [key, value] of Object.entries(config.env)) {
+                if (typeof value === "string" &&
+                    /(?:KEY|SECRET|TOKEN|PASSWORD|PRIVATE)/i.test(key) &&
+                    value.length > 10 &&
+                    !value.startsWith("@") // Vercel secret references start with @
+                ) {
+                    findings.push({
+                        vulnerability_id: 53,
+                        severity: "critical",
+                        category: "vibecoding",
+                        title: `Secret in vercel.json: ${key}`,
+                        description_technical: "Environment variable with secret-looking value is hardcoded in vercel.json. Use Vercel Environment Variables UI or @secret references instead.",
+                        file_path: filePath,
+                        code_snippet: `"${key}": "***REDACTED***"`,
+                        owasp_ref: "A07:2021",
+                        status: "open",
+                        confidence: "high",
+                    });
+                }
+            }
+        }
+    }
+    catch {
+        // Invalid JSON - skip
+    }
+    return findings;
+}
+//# sourceMappingURL=config.js.map

package/dist/engines/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/engines/config.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,oEAAoE;AAIpE,MAAM,UAAU,aAAa,CAC3B,KAA0B;IAE1B,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAEjD,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAClE,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,QAAQ,KAAK,gBAAgB,IAAI,QAAQ,KAAK,gBAAgB,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YACrG,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,QAAQ,KAAK,cAAc,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACtE,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,QAAQ,KAAK,oBAAoB,IAAI,QAAQ,KAAK,qBAAqB,EAAE,CAAC;YAC5E,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,QAAQ,KAAK,eAAe,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACvE,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,QAAgB;IAC1D,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,kDAAkD;IAClD,oEAAoE;IACpE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,cAAc,GAAG,SAAS,IAAI,iCAAiC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtF,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1C,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAC3B,CAAC;IACF,IAAI,CAAC,kBAAkB,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3C,QAAQ,CAAC,IAAI,CAAC;YACZ,gBAAgB,EAAE,GAAG;YACrB,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,2BAA2B;YAClC,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,2CAA2C;YACzD,SAAS,EAAE,UAAU;YACrB,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IAED,uBAAuB;IACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC;gBACZ,gBAAgB,EAAE,GAAG;gBACrB,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,iCAAiC;gBACxC,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,CAAC,GAAG,CAAC;gBAClB,YAAY,EAAE,IAAI;gBAClB,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,QAAQ;aACrB,CAAC,CAAC;QACL,CAAC;QAED,kFAAkF;QAClF,IAAI,6DAA6D,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7E,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3D,QAAQ,CAAC,IAAI,CAAC;gBACZ,gBAAgB,EAAE,GAAG;gBACrB,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;gBACnD,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,+BAA+B;gBACtC,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,CAAC,GAAG,CAAC;gBAClB,YAAY,EAAE,IAAI;gBAClB,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;aAC/C,CAAC,CAAC;QACL,CAAC;QAED,sEAAsE;QACtE,IAAI,mDAAmD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnE,QAAQ,CAAC,IAAI,CAAC;gBACZ,gBAAgB,EAAE,GAAG;gBACrB,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,qCAAqC;gBAC5C,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,CAAC,GAAG,CAAC;gBAClB,YAAY,EAAE,IAAI;gBAClB,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,MAAM;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACtC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAC/B,CAAC;IACF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,CAAC;YACZ,gBAAgB,EAAE,GAAG;YACrB,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,8BAA8B;YACrC,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,oCAAoC;YAClD,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,QAAgB;IAC1D,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,gCAAgC;QAChC,IAAI,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC;gBACZ,gBAAgB,EAAE,EAAE;gBACpB,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,cAAc;gBACxB,KAAK,EAAE,mCAAmC;gBAC1C,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,CAAC,GAAG,CAAC;gBAClB,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE;gBACzB,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,MAAM;aACnB,CAAC,CAAC;QACL,CAAC;QAED,oCAAoC;QACpC,IAAI,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,QAAQ,CAAC,IAAI,CAAC;gBACZ,gBAAgB,EAAE,EAAE;gBACpB,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,cAAc;gBACxB,KAAK,EAAE,6BAA6B;gBACpC,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,CAAC,GAAG,CAAC;gBAClB,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE;gBACzB,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,MAAM;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACzF,QAAQ,CAAC,IAAI,CAAC;YACZ,gBAAgB,EAAE,CAAC;YACnB,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,cAAc;YACxB,KAAK,EAAE,kCAAkC;YACzC,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,mDAAmD;YACjE,eAAe,EAAE,8EAA8E;YAC/F,SAAS,EAAE,UAAU;YACrB,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,QAAQ;SACrB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe,EAAE,QAAgB;IAC3D,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEhC,uCAAuC;QACvC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,MAAM,iBAAiB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;YACnE,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;gBACvC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClC,IAAI,KAAK,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;oBAC/D,QAAQ,CAAC,IAAI,CAAC;wBACZ,gBAAgB,EAAE,GAAG;wBACrB,QAAQ,EAAE,MAAM;wBAChB,QAAQ,EAAE,cAAc;wBACxB,KAAK,EAAE,2CAA2C;wBAClD,SAAS,EAAE,QAAQ;wBACnB,YAAY,EAAE,IAAI,MAAM,OAAO,KAAK,GAAG;wBACvC,MAAM,EAAE,MAAM;wBACd,UAAU,EAAE,QAAQ;qBACrB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IAEH,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAe,EACf,QAAgB,EAChB,QAA6B;IAE7B,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAEvD,2BAA2B;IAC3B,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,YAAY,CAC3D,CAAC;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,QAAQ,CAAC,IAAI,CAAC;YACZ,gBAAgB,EAAE,GAAG;YACrB,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,sCAAsC;YAC7C,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,oCAAoC;YAClD,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,MAAM;SACnB,CAAC,CAAC;IACL,CAAC;IAED,+BAA+B;IAC/B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QAClC,QAAQ,CAAC,IAAI,CAAC;YACZ,gBAAgB,EAAE,GAAG;YACrB,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,sBAAsB;YAC7B,YAAY,EAAE,mEAAmE;YACjF,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IAED,2BAA2B;IAC3B,MAAM,WAAW,GACf,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACjC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;QACzB,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjD,QAAQ,CAAC,IAAI,CAAC;YACZ,gBAAgB,EAAE,GAAG;YACrB,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,cAAc;YACxB,KAAK,EAAE,kBAAkB;YACzB,YAAY,EAAE,0DAA0D;YACxE,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,MAAM;SACnB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe,EAAE,QAAgB;IAC7D,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,kBAAkB;QAClB,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC;gBACZ,gBAAgB,EAAE,GAAG;gBACrB,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,sCAAsC;gBAC7C,qBAAqB,EAAE,+DAA+D;gBACtF,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,CAAC,GAAG,CAAC;gBAClB,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE;gBACzB,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,MAAM;aACnB,CAAC,CAAC;QACL,CAAC;QAED,0BAA0B;QAC1B,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,8DAA8D,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnF,QAAQ,CAAC,IAAI,CAAC;oBACZ,gBAAgB,EAAE,GAAG;oBACrB,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,QAAQ;oBAClB,KAAK,EAAE,wCAAwC;oBAC/C,qBAAqB,EAAE,gFAAgF;oBACvG,SAAS,EAAE,QAAQ;oBACnB,WAAW,EAAE,CAAC,GAAG,CAAC;oBAClB,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC9C,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,MAAM;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,4FAA4F,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5G,QAAQ,CAAC,IAAI,CAAC;gBACZ,gBAAgB,EAAE,GAAG;gBACrB,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,2CAA2C;gBAClD,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,CAAC,GAAG,CAAC;gBAClB,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE;gBACzB,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,MAAM;aACnB,CAAC,CAAC;QACL,CAAC;QAED,+BAA+B;QAC/B,IAAI,wJAAwJ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxK,QAAQ,CAAC,IAAI,CAAC;gBACZ,gBAAgB,EAAE,GAAG;gBACrB,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,qBAAqB;gBAC/B,KAAK,EAAE,8CAA8C;gBACrD,qBAAqB,EAAE,8FAA8F;gBACrH,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,CAAC,GAAG,CAAC;gBAClB,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,oBAAoB,EAAE,kBAAkB,CAAC;gBAC3E,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,MAAM;aACnB,CAAC,CAAC;QACL,CAAC;QAED,oDAAoD;QACpD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,IAAI,+DAA+D,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpF,QAAQ,CAAC,IAAI,CAAC;oBACZ,gBAAgB,EAAE,GAAG;oBACrB,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,qBAAqB;oBAC/B,KAAK,EAAE,+CAA+C;oBACtD,qBAAqB,EAAE,+GAA+G;oBACtI,SAAS,EAAE,QAAQ;oBACnB,WAAW,EAAE,CAAC,GAAG,CAAC;oBAClB,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC9C,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,QAAQ;iBACrB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,yBAAyB;QACzB,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxE,IAAI,yBAAyB,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,2CAA2C,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBACpH,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvF,QAAQ,CAAC,IAAI,CAAC;wBACZ,gBAAgB,EAAE,GAAG;wBACrB,QAAQ,EAAE,MAAM;wBAChB,QAAQ,EAAE,qBAAqB;wBAC/B,KAAK,EAAE,wCAAwC;wBAC/C,qBAAqB,EAAE,gFAAgF;wBACvG,SAAS,EAAE,QAAQ;wBACnB,WAAW,EAAE,CAAC,GAAG,CAAC;wBAClB,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE;wBACzB,MAAM,EAAE,MAAM;wBACd,UAAU,EAAE,QAAQ;qBACrB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,QAAQ,CAAC,IAAI,CAAC;gBACZ,gBAAgB,EAAE,GAAG;gBACrB,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,mCAAmC;gBAC1C,qBAAqB,EAAE,oEAAoE;gBAC3F,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,CAAC,GAAG,CAAC;gBAClB,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE;gBACzB,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,QAAQ;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,QAAgB;IACxD,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;QAErD,IAAI,eAAe,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC;gBACZ,gBAAgB,EAAE,GAAG;gBACrB,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,iCAAiC;gBACxC,qBAAqB,EAAE,2FAA2F;gBAClH,SAAS,EAAE,QAAQ;gBACnB,YAAY,EAAE,iBAAiB;gBAC/B,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,QAAQ;aACrB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,MAAM,IAAI,eAAe,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;YACvE,QAAQ,CAAC,IAAI,CAAC;gBACZ,gBAAgB,EAAE,GAAG;gBACrB,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,mCAAmC;gBAC1C,qBAAqB,EAAE,iFAAiF;gBACxG,SAAS,EAAE,QAAQ;gBACnB,YAAY,EAAE,wBAAwB;gBACtC,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,QAAQ;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe,EAAE,QAAgB;IAC5D,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnC,gDAAgD;QAChD,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtD,IACE,OAAO,KAAK,KAAK,QAAQ;oBACzB,wCAAwC,CAAC,IAAI,CAAC,GAAG,CAAC;oBAClD,KAAK,CAAC,MAAM,GAAG,EAAE;oBACjB,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,wCAAwC;kBAC/D,CAAC;oBACD,QAAQ,CAAC,IAAI,CAAC;wBACZ,gBAAgB,EAAE,EAAE;wBACpB,QAAQ,EAAE,UAAU;wBACpB,QAAQ,EAAE,YAAY;wBACtB,KAAK,EAAE,0BAA0B,GAAG,EAAE;wBACtC,qBAAqB,EAAE,gJAAgJ;wBACvK,SAAS,EAAE,QAAQ;wBACnB,YAAY,EAAE,IAAI,GAAG,qBAAqB;wBAC1C,SAAS,EAAE,UAAU;wBACrB,MAAM,EAAE,MAAM;wBACd,UAAU,EAAE,MAAM;qBACnB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/engines/dast.d.ts

@@ -0,0 +1,3 @@
+import type { FindingData } from "./types.js";
+export declare function runDast(appUrl: string): Promise<FindingData[]>;
+//# sourceMappingURL=dast.d.ts.map

package/dist/engines/dast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dast.d.ts","sourceRoot":"","sources":["../../src/engines/dast.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAY,MAAM,YAAY,CAAC;AAmExD,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CA8CpE"}

package/dist/engines/dast.js

@@ -0,0 +1,167 @@
+// DAST engine - Dynamic Application Security Testing via Nuclei.
+// Scans deployed URLs for real vulnerabilities (SQL injection, XSS, SSRF, etc.).
+// Only runs when appUrl is provided in scan params.
+import { execWithTimeout } from "../utils/exec.js";
+const SEVERITY_MAP = {
+    critical: "critical",
+    high: "high",
+    medium: "medium",
+    low: "low",
+    info: "info",
+};
+// Map Nuclei template tags/IDs to our vulnerability catalog
+const TAG_TO_VULN_ID = {
+    sqli: 5,
+    "sql-injection": 5,
+    xss: 7,
+    ssrf: 10,
+    lfi: 106,
+    rfi: 106,
+    rce: 75,
+    "command-injection": 75,
+    xxe: 72,
+    ssti: 76,
+    "open-redirect": 119,
+    cors: 4,
+    csrf: 8,
+    idor: 1,
+    "path-traversal": 106,
+    "file-inclusion": 106,
+    "directory-listing": 116,
+    "exposed-panel": 116,
+    "admin-panel": 116,
+    misconfiguration: 4,
+    disclosure: 99,
+    "information-disclosure": 99,
+    "default-login": 77,
+    "default-credential": 77,
+    "weak-password": 55,
+    cve: 3,
+    token: 53,
+    "api-key": 53,
+    debug: 116,
+    "source-map": 49,
+};
+export async function runDast(appUrl) {
+    const args = [
+        "-u", appUrl,
+        "-jsonl",
+        "-severity", "critical,high,medium",
+        "-t", "misconfiguration/",
+        "-t", "exposed-panels/",
+        "-t", "vulnerabilities/",
+        "-t", "exposures/",
+        "-silent",
+        "-no-color",
+        "-rate-limit", "100",
+        "-timeout", "10",
+        "-retries", "1",
+        "-no-interactsh", // Don't use out-of-band testing service
+        "-disable-update-check",
+    ];
+    let stdout;
+    try {
+        const result = await execWithTimeout("nuclei", args, {
+            timeoutMs: 170_000, // 10s under orchestrator's 180s DAST timeout
+            env: { HOME: "/home/worker" }, // Nuclei needs HOME for templates
+        });
+        stdout = result.stdout;
+    }
+    catch (error) {
+        // Nuclei may fail for many reasons (missing binary, missing templates,
+        // timeout, non-zero exit). Never mark DAST as failed — just return empty.
+        console.warn(`[dast] Nuclei failed: ${error instanceof Error ? error.message : error}`);
+        return [];
+    }
+    if (!stdout.trim())
+        return [];
+    const findings = [];
+    for (const line of stdout.split("\n")) {
+        if (!line.trim())
+            continue;
+        try {
+            const result = JSON.parse(line);
+            findings.push(mapNucleiToFinding(result));
+        }
+        catch {
+            // Skip malformed lines
+        }
+    }
+    return findings;
+}
+function mapNucleiToFinding(result) {
+    const severity = SEVERITY_MAP[result.info.severity] ?? "medium";
+    const vulnId = resolveVulnerabilityId(result);
+    const tags = result.info.tags ?? [];
+    const cves = result.info.classification?.["cve-id"] ?? [];
+    const cwes = result.info.classification?.["cwe-id"] ?? [];
+    const technicalDetails = [
+        result.info.description,
+        cves.length > 0 ? `CVE: ${cves.join(", ")}` : "",
+        cwes.length > 0 ? `CWE: ${cwes.join(", ")}` : "",
+        result.info.reference?.length ? `References: ${result.info.reference.join(", ")}` : "",
+        `Matched at: ${result["matched-at"]}`,
+        tags.length > 0 ? `Tags: ${tags.join(", ")}` : "",
+    ].filter(Boolean).join("\n");
+    return {
+        vulnerability_id: vulnId,
+        severity,
+        category: "dast",
+        title: `[DAST] ${result.info.name}`,
+        description_technical: technicalDetails,
+        file_path: result["matched-at"],
+        code_snippet: result["curl-command"] ?? `Template: ${result["template-id"]}`,
+        owasp_ref: mapToOwasp(tags),
+        status: "open",
+    };
+}
+function resolveVulnerabilityId(result) {
+    const tags = result.info.tags ?? [];
+    // Check template tags first (most specific)
+    for (const tag of tags) {
+        const id = TAG_TO_VULN_ID[tag.toLowerCase()];
+        if (id)
+            return id;
+    }
+    // Check template ID for known patterns
+    const templateId = result["template-id"].toLowerCase();
+    if (templateId.includes("sqli"))
+        return 5;
+    if (templateId.includes("xss"))
+        return 7;
+    if (templateId.includes("ssrf"))
+        return 10;
+    if (templateId.includes("rce"))
+        return 75;
+    if (templateId.includes("lfi") || templateId.includes("path-traversal"))
+        return 106;
+    if (templateId.includes("redirect"))
+        return 119;
+    if (templateId.includes("cve-"))
+        return 3;
+    if (templateId.includes("panel") || templateId.includes("admin"))
+        return 116;
+    if (templateId.includes("config") || templateId.includes("misconfig"))
+        return 4;
+    // Fallback based on type
+    if (result.type === "http")
+        return 4; // Security misconfiguration
+    return 199; // Generic best practice
+}
+function mapToOwasp(tags) {
+    const tagSet = new Set(tags.map((t) => t.toLowerCase()));
+    if (tagSet.has("sqli") || tagSet.has("xss") || tagSet.has("rce") || tagSet.has("xxe") || tagSet.has("ssti"))
+        return "A03:2021";
+    if (tagSet.has("ssrf"))
+        return "A10:2021";
+    if (tagSet.has("idor") || tagSet.has("open-redirect"))
+        return "A01:2021";
+    if (tagSet.has("cve"))
+        return "A06:2021";
+    if (tagSet.has("misconfiguration") || tagSet.has("cors"))
+        return "A05:2021";
+    if (tagSet.has("default-login") || tagSet.has("default-credential"))
+        return "A07:2021";
+    return undefined;
+}
+//# sourceMappingURL=dast.js.map

package/dist/engines/dast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dast.js","sourceRoot":"","sources":["../../src/engines/dast.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,iFAAiF;AACjF,oDAAoD;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AA0BnD,MAAM,YAAY,GAA6B;IAC7C,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;CACb,CAAC;AAEF,4DAA4D;AAC5D,MAAM,cAAc,GAA2B;IAC7C,IAAI,EAAE,CAAC;IACP,eAAe,EAAE,CAAC;IAClB,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,EAAE;IACR,GAAG,EAAE,GAAG;IACR,GAAG,EAAE,GAAG;IACR,GAAG,EAAE,EAAE;IACP,mBAAmB,EAAE,EAAE;IACvB,GAAG,EAAE,EAAE;IACP,IAAI,EAAE,EAAE;IACR,eAAe,EAAE,GAAG;IACpB,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,gBAAgB,EAAE,GAAG;IACrB,gBAAgB,EAAE,GAAG;IACrB,mBAAmB,EAAE,GAAG;IACxB,eAAe,EAAE,GAAG;IACpB,aAAa,EAAE,GAAG;IAClB,gBAAgB,EAAE,CAAC;IACnB,UAAU,EAAE,EAAE;IACd,wBAAwB,EAAE,EAAE;IAC5B,eAAe,EAAE,EAAE;IACnB,oBAAoB,EAAE,EAAE;IACxB,eAAe,EAAE,EAAE;IACnB,GAAG,EAAE,CAAC;IACN,KAAK,EAAE,EAAE;IACT,SAAS,EAAE,EAAE;IACb,KAAK,EAAE,GAAG;IACV,YAAY,EAAE,EAAE;CACjB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAc;IAC1C,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,MAAM;QACZ,QAAQ;QACR,WAAW,EAAE,sBAAsB;QACnC,IAAI,EAAE,mBAAmB;QACzB,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,YAAY;QAClB,SAAS;QACT,WAAW;QACX,aAAa,EAAE,KAAK;QACpB,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,GAAG;QACf,gBAAgB,EAAE,wCAAwC;QAC1D,uBAAuB;KACxB,CAAC;IAEF,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE;YACnD,SAAS,EAAE,OAAO,EAAE,6CAA6C;YACjE,GAAG,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,kCAAkC;SAClE,CAAC,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uEAAuE;QACvE,0EAA0E;QAC1E,OAAO,CAAC,IAAI,CAAC,yBAAyB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACxF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAE9B,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAiB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAoB;IAC9C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC;IAChE,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAE1D,MAAM,gBAAgB,GAAG;QACvB,MAAM,CAAC,IAAI,CAAC,WAAW;QACvB,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;QAChD,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;QAChD,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;QACtF,eAAe,MAAM,CAAC,YAAY,CAAC,EAAE;QACrC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;KAClD,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE7B,OAAO;QACL,gBAAgB,EAAE,MAAM;QACxB,QAAQ;QACR,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE;QACnC,qBAAqB,EAAE,gBAAgB;QACvC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,YAAY,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,aAAa,MAAM,CAAC,aAAa,CAAC,EAAE;QAC5E,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC;QAC3B,MAAM,EAAE,MAAM;KACf,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAoB;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;IAEpC,4CAA4C;IAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7C,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;IACpB,CAAC;IAED,uCAAuC;IACvC,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;IACvD,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACzC,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3C,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1C,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,GAAG,CAAC;IACpF,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,GAAG,CAAC;IAChD,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,CAAC;IAC7E,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,CAAC,CAAC;IAEhF,yBAAyB;IACzB,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC,CAAC,4BAA4B;IAClE,OAAO,GAAG,CAAC,CAAC,wBAAwB;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,IAAc;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,UAAU,CAAC;IAC/H,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,UAAU,CAAC;IAC1C,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,OAAO,UAAU,CAAC;IACzE,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IACzC,IAAI,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,UAAU,CAAC;IAC5E,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAAE,OAAO,UAAU,CAAC;IACvF,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/engines/db-rules.d.ts

@@ -0,0 +1,3 @@
+import type { FindingData } from "./types.js";
+export declare function analyzeDbRules(rulesInput: string, rulesType: "supabase" | "firebase" | "auto"): FindingData[];
+//# sourceMappingURL=db-rules.d.ts.map

package/dist/engines/db-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-rules.d.ts","sourceRoot":"","sources":["../../src/engines/db-rules.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,UAAU,GAAG,UAAU,GAAG,MAAM,GAC1C,WAAW,EAAE,CAWf"}