@datahogo/core 0.1.0

package/dist/engines/db-rules.js

@@ -0,0 +1,166 @@
+// Database rules parser engine - analyzes Supabase RLS and Firebase security rules
+// Parses user-provided rule text to detect misconfigurations
+export function analyzeDbRules(rulesInput, rulesType) {
+    const detectedType = rulesType === "auto" ? detectRulesType(rulesInput) : rulesType;
+    if (detectedType === "supabase") {
+        return analyzeSupabaseRules(rulesInput);
+    }
+    if (detectedType === "firebase") {
+        return analyzeFirebaseRules(rulesInput);
+    }
+    return [];
+}
+function detectRulesType(input) {
+    if (input.includes("CREATE POLICY") || input.includes("ENABLE ROW LEVEL SECURITY") || input.includes("CREATE TABLE")) {
+        return "supabase";
+    }
+    if (input.includes("allow read") || input.includes("allow write") || input.includes("match /") || input.includes(".read") || input.includes(".write")) {
+        return "firebase";
+    }
+    return "unknown";
+}
+// === Supabase RLS Analysis ===
+function analyzeSupabaseRules(sql) {
+    const findings = [];
+    // Find all CREATE TABLE statements
+    const tableRegex = /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(\w+)/gi;
+    let tableMatch;
+    const tables = [];
+    while ((tableMatch = tableRegex.exec(sql)) !== null) {
+        tables.push(tableMatch[1]);
+    }
+    // Check if each table has RLS enabled
+    for (const table of tables) {
+        const rlsPattern = new RegExp(`ALTER\\s+TABLE\\s+${table}\\s+ENABLE\\s+ROW\\s+LEVEL\\s+SECURITY`, "i");
+        if (!rlsPattern.test(sql)) {
+            findings.push({
+                vulnerability_id: 31,
+                severity: "critical",
+                category: "supabase",
+                title: `RLS Not Enabled on Table: ${table}`,
+                description_technical: `Table ${table} does not have Row Level Security enabled. All data is accessible without restrictions.`,
+                code_snippet: `CREATE TABLE ${table} (...)\n-- Missing: ALTER TABLE ${table} ENABLE ROW LEVEL SECURITY;`,
+                fix_code: `ALTER TABLE ${table} ENABLE ROW LEVEL SECURITY;`,
+                status: "open",
+            });
+        }
+    }
+    // Check for USING(true) policies (allow everything)
+    const policyUsingTrue = /CREATE\s+POLICY\s+["']?(\w+)["']?\s+ON\s+(\w+)[\s\S]*?USING\s*\(\s*true\s*\)/gi;
+    let policyMatch;
+    while ((policyMatch = policyUsingTrue.exec(sql)) !== null) {
+        findings.push({
+            vulnerability_id: 32,
+            severity: "critical",
+            category: "supabase",
+            title: `RLS Policy Allows Everything: ${policyMatch[1]}`,
+            description_technical: `Policy "${policyMatch[1]}" on table "${policyMatch[2]}" uses USING(true), which allows all rows to be accessed by any user.`,
+            code_snippet: policyMatch[0],
+            status: "open",
+        });
+    }
+    // Check for tables with RLS enabled but no policies
+    for (const table of tables) {
+        const rlsEnabled = new RegExp(`ALTER\\s+TABLE\\s+${table}\\s+ENABLE\\s+ROW\\s+LEVEL\\s+SECURITY`, "i").test(sql);
+        const hasPolicies = new RegExp(`CREATE\\s+POLICY[\\s\\S]*?ON\\s+${table}\\b`, "i").test(sql);
+        if (rlsEnabled && !hasPolicies) {
+            findings.push({
+                vulnerability_id: 33,
+                severity: "high",
+                category: "supabase",
+                title: `RLS Enabled But No Policies on: ${table}`,
+                description_technical: `Table "${table}" has RLS enabled but no policies defined. This blocks ALL access, which may be intentional for service-role-only tables, but verify this is expected.`,
+                code_snippet: `ALTER TABLE ${table} ENABLE ROW LEVEL SECURITY;\n-- No CREATE POLICY found for this table`,
+                status: "open",
+            });
+        }
+    }
+    // Check for RPC functions without auth.uid()
+    const functionRegex = /CREATE\s+(?:OR\s+REPLACE\s+)?FUNCTION\s+(\w+)[\s\S]*?(?:LANGUAGE\s+plpgsql|LANGUAGE\s+sql)/gi;
+    let funcMatch;
+    while ((funcMatch = functionRegex.exec(sql)) !== null) {
+        const funcBody = funcMatch[0];
+        const funcName = funcMatch[1];
+        // Skip trigger functions (they use SECURITY DEFINER for a reason)
+        if (/RETURNS\s+TRIGGER/i.test(funcBody))
+            continue;
+        if (!funcBody.includes("auth.uid()") && !funcBody.includes("SECURITY DEFINER")) {
+            // Only flag functions that could be called via RPC
+            if (!funcName.startsWith("handle_") && !funcName.startsWith("update_")) {
+                findings.push({
+                    vulnerability_id: 36,
+                    severity: "high",
+                    category: "supabase",
+                    title: `RPC Function Without Auth Check: ${funcName}`,
+                    description_technical: `Function "${funcName}" doesn't check auth.uid(). If exposed via RPC, any user can call it.`,
+                    code_snippet: funcBody.substring(0, 200),
+                    status: "open",
+                });
+            }
+        }
+    }
+    return findings;
+}
+// === Firebase Rules Analysis ===
+function analyzeFirebaseRules(rules) {
+    const findings = [];
+    // Check for "allow read, write: if true" (Firestore)
+    const firestoreOpenRegex = /allow\s+(?:read|write|read,\s*write)\s*:\s*if\s+true/gi;
+    let firestoreMatch;
+    while ((firestoreMatch = firestoreOpenRegex.exec(rules)) !== null) {
+        findings.push({
+            vulnerability_id: 39,
+            severity: "critical",
+            category: "firebase",
+            title: "Firestore Rules Allow All Access",
+            description_technical: "Rule 'allow read, write: if true' makes your database completely open to anyone.",
+            code_snippet: getContextAroundMatch(rules, firestoreMatch.index),
+            status: "open",
+        });
+    }
+    // Check for ".read": true or ".write": true (Realtime DB)
+    const realtimeOpenRegex = /["']\.(?:read|write)["']\s*:\s*(?:true|"true")/gi;
+    let realtimeMatch;
+    while ((realtimeMatch = realtimeOpenRegex.exec(rules)) !== null) {
+        findings.push({
+            vulnerability_id: 40,
+            severity: "critical",
+            category: "firebase",
+            title: "Realtime Database Rules Allow All Access",
+            description_technical: "Open .read or .write rules make your database accessible to anyone.",
+            code_snippet: getContextAroundMatch(rules, realtimeMatch.index),
+            status: "open",
+        });
+    }
+    // Check for permissive storage rules
+    const storageOpenRegex = /allow\s+(?:read|write|read,\s*write)\s*:\s*if\s+true[\s\S]*?match\s+\/b\/\{bucket\}\/o\/\{allPaths=\*\*\}/gi;
+    if (storageOpenRegex.test(rules)) {
+        findings.push({
+            vulnerability_id: 41,
+            severity: "high",
+            category: "firebase",
+            title: "Storage Rules Are Permissive",
+            description_technical: "Storage rules allow unrestricted access to all files.",
+            status: "open",
+        });
+    }
+    // Check for missing request.auth in rules
+    if (rules.includes("match /") && !rules.includes("request.auth")) {
+        findings.push({
+            vulnerability_id: 39,
+            severity: "high",
+            category: "firebase",
+            title: "Firestore Rules Missing Authentication Check",
+            description_technical: "Rules don't check request.auth, meaning unauthenticated users may have access.",
+            code_snippet: rules.substring(0, 300),
+            status: "open",
+        });
+    }
+    return findings;
+}
+function getContextAroundMatch(text, index) {
+    const start = Math.max(0, text.lastIndexOf("\n", index - 1));
+    const end = text.indexOf("\n", index + 50);
+    return text.substring(start, end === -1 ? text.length : end).trim();
+}
+//# sourceMappingURL=db-rules.js.map

package/dist/engines/db-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-rules.js","sourceRoot":"","sources":["../../src/engines/db-rules.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,6DAA6D;AAI7D,MAAM,UAAU,cAAc,CAC5B,UAAkB,EAClB,SAA2C;IAE3C,MAAM,YAAY,GAAG,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpF,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;QAChC,OAAO,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;QAChC,OAAO,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,2BAA2B,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACrH,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtJ,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gCAAgC;AAEhC,SAAS,oBAAoB,CAAC,GAAW;IACvC,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,mCAAmC;IACnC,MAAM,UAAU,GAAG,mDAAmD,CAAC;IACvE,IAAI,UAAU,CAAC;IACf,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,sCAAsC;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,IAAI,MAAM,CAC3B,qBAAqB,KAAK,wCAAwC,EAClE,GAAG,CACJ,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,gBAAgB,EAAE,EAAE;gBACpB,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,6BAA6B,KAAK,EAAE;gBAC3C,qBAAqB,EAAE,SAAS,KAAK,yFAAyF;gBAC9H,YAAY,EAAE,gBAAgB,KAAK,mCAAmC,KAAK,6BAA6B;gBACxG,QAAQ,EAAE,eAAe,KAAK,6BAA6B;gBAC3D,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,MAAM,eAAe,GAAG,gFAAgF,CAAC;IACzG,IAAI,WAAW,CAAC;IAChB,OAAO,CAAC,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC;YACZ,gBAAgB,EAAE,EAAE;YACpB,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,iCAAiC,WAAW,CAAC,CAAC,CAAC,EAAE;YACxD,qBAAqB,EAAE,WAAW,WAAW,CAAC,CAAC,CAAC,eAAe,WAAW,CAAC,CAAC,CAAC,uEAAuE;YACpJ,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;YAC5B,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;IACL,CAAC;IAED,oDAAoD;IACpD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,IAAI,MAAM,CAC3B,qBAAqB,KAAK,wCAAwC,EAClE,GAAG,CACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,MAAM,WAAW,GAAG,IAAI,MAAM,CAC5B,mCAAmC,KAAK,KAAK,EAC7C,GAAG,CACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,IAAI,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC;gBACZ,gBAAgB,EAAE,EAAE;gBACpB,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,mCAAmC,KAAK,EAAE;gBACjD,qBAAqB,EAAE,UAAU,KAAK,wJAAwJ;gBAC9L,YAAY,EAAE,eAAe,KAAK,uEAAuE;gBACzG,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,MAAM,aAAa,GAAG,8FAA8F,CAAC;IACrH,IAAI,SAAS,CAAC;IACd,OAAO,CAAC,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAE9B,kEAAkE;QAClE,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS;QAElD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC/E,mDAAmD;YACnD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvE,QAAQ,CAAC,IAAI,CAAC;oBACZ,gBAAgB,EAAE,EAAE;oBACpB,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,UAAU;oBACpB,KAAK,EAAE,oCAAoC,QAAQ,EAAE;oBACrD,qBAAqB,EAAE,aAAa,QAAQ,uEAAuE;oBACnH,YAAY,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;oBACxC,MAAM,EAAE,MAAM;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,kCAAkC;AAElC,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,qDAAqD;IACrD,MAAM,kBAAkB,GAAG,wDAAwD,CAAC;IACpF,IAAI,cAAc,CAAC;IACnB,OAAO,CAAC,cAAc,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CAAC;YACZ,gBAAgB,EAAE,EAAE;YACpB,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,kCAAkC;YACzC,qBAAqB,EAAE,kFAAkF;YACzG,YAAY,EAAE,qBAAqB,CAAC,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC;YAChE,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;IACL,CAAC;IAED,0DAA0D;IAC1D,MAAM,iBAAiB,GAAG,kDAAkD,CAAC;IAC7E,IAAI,aAAa,CAAC;IAClB,OAAO,CAAC,aAAa,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAChE,QAAQ,CAAC,IAAI,CAAC;YACZ,gBAAgB,EAAE,EAAE;YACpB,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,0CAA0C;YACjD,qBAAqB,EAAE,qEAAqE;YAC5F,YAAY,EAAE,qBAAqB,CAAC,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC;YAC/D,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;IACL,CAAC;IAED,qCAAqC;IACrC,MAAM,gBAAgB,GAAG,6GAA6G,CAAC;IACvI,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC;YACZ,gBAAgB,EAAE,EAAE;YACpB,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,8BAA8B;YACrC,qBAAqB,EAAE,uDAAuD;YAC9E,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;IACL,CAAC;IAED,0CAA0C;IAC1C,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACjE,QAAQ,CAAC,IAAI,CAAC;YACZ,gBAAgB,EAAE,EAAE;YACpB,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,8CAA8C;YACrD,qBAAqB,EAAE,gFAAgF;YACvG,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;YACrC,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,KAAa;IACxD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACtE,CAAC"}

package/dist/engines/dependencies.d.ts

@@ -0,0 +1,3 @@
+import type { FindingData } from "./types.js";
+export declare function analyzeDependencies(files: Map<string, string>): FindingData[];
+//# sourceMappingURL=dependencies.d.ts.map

package/dist/engines/dependencies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../../src/engines/dependencies.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAyD9C,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GACzB,WAAW,EAAE,CAuFf"}

package/dist/engines/dependencies.js

@@ -0,0 +1,167 @@
+// Dependencies analysis engine - checks for vulnerable packages
+// In production, this calls npm audit and OSV. For now, checks package.json/lock.
+// Known vulnerable packages (subset - in production, use npm audit + OSV API)
+const KNOWN_VULNERABLE = {
+    "node-serialize": {
+        severity: "critical",
+        description: "Remote code execution via deserialization",
+    },
+    "serialize-javascript": {
+        severity: "high",
+        description: "Cross-site scripting via crafted regex",
+        fixVersion: "3.1.0",
+    },
+    "lodash": {
+        severity: "high",
+        description: "Prototype pollution in older versions",
+        fixVersion: "4.17.21",
+    },
+    "minimist": {
+        severity: "high",
+        description: "Prototype pollution",
+        fixVersion: "1.2.6",
+    },
+    "axios": {
+        severity: "medium",
+        description: "SSRF via server-side requests",
+        fixVersion: "1.6.0",
+    },
+    "jsonwebtoken": {
+        severity: "high",
+        description: "Algorithm confusion vulnerability in older versions",
+        fixVersion: "9.0.0",
+    },
+    "express": {
+        severity: "medium",
+        description: "Open redirect in older versions",
+        fixVersion: "4.19.2",
+    },
+    "yaml": {
+        severity: "critical",
+        description: "Code execution via yaml.load unsafe",
+        fixVersion: "2.0.0",
+    },
+};
+// Packages that are suspicious or commonly typosquatted
+const SUSPICIOUS_PACKAGES = [
+    "crossenv", // typosquat of cross-env
+    "event-stream", // known supply chain attack
+    "flatmap-stream", // part of event-stream attack
+    "eslint-scope", // known compromised version
+    "electron-native-notify", // known malware
+    "discord.js-user", // typosquat
+    "colors-js", // typosquat of colors
+    "node-ipc-2", // typosquat
+];
+export function analyzeDependencies(files) {
+    const findings = [];
+    const packageJsonContent = files.get("package.json");
+    if (!packageJsonContent)
+        return findings;
+    try {
+        const pkg = JSON.parse(packageJsonContent);
+        const allDeps = {
+            ...pkg.dependencies,
+            ...pkg.devDependencies,
+        };
+        // Check for known vulnerable packages
+        for (const [name, versionRange] of Object.entries(allDeps)) {
+            const version = String(versionRange);
+            const known = KNOWN_VULNERABLE[name];
+            if (known) {
+                // If fixVersion exists, check if current version might be vulnerable
+                if (known.fixVersion && isVersionPotentiallyFixed(version, known.fixVersion)) {
+                    continue;
+                }
+                findings.push({
+                    vulnerability_id: 3,
+                    severity: known.severity,
+                    category: "supply-chain",
+                    title: `Vulnerable Package: ${name}`,
+                    description_technical: known.description,
+                    file_path: "package.json",
+                    code_snippet: `"${name}": "${version}"`,
+                    fix_description: known.fixVersion
+                        ? `Update to version ${known.fixVersion} or later`
+                        : "Remove this package and find a secure alternative",
+                    owasp_ref: "A06:2021",
+                    status: "open",
+                    confidence: known.fixVersion ? "medium" : "high",
+                });
+            }
+            // Check for suspicious packages
+            if (SUSPICIOUS_PACKAGES.includes(name)) {
+                findings.push({
+                    vulnerability_id: 137,
+                    severity: "high",
+                    category: "supply-chain",
+                    title: `Suspicious Package: ${name}`,
+                    description_technical: "This package is known to be malicious or a typosquat of a popular package",
+                    file_path: "package.json",
+                    code_snippet: `"${name}": "${version}"`,
+                    fix_description: "Remove this package immediately and scan for compromises",
+                    status: "open",
+                    confidence: "high",
+                });
+            }
+        }
+        // Check for unpinned dependencies (using ^ or ~)
+        const deps = pkg.dependencies || {};
+        let unpinnedCount = 0;
+        for (const [, versionRange] of Object.entries(deps)) {
+            const version = String(versionRange);
+            if (version.startsWith("^") || version.startsWith("~") || version === "*" || version === "latest") {
+                unpinnedCount++;
+            }
+        }
+        // Only flag if most deps are unpinned (common enough to not be noise)
+        if (unpinnedCount > 5 && unpinnedCount === Object.keys(deps).length) {
+            findings.push({
+                vulnerability_id: 60,
+                severity: "medium",
+                category: "supply-chain",
+                title: "All Dependencies Use Ranges Instead of Exact Versions",
+                file_path: "package.json",
+                code_snippet: `${unpinnedCount} dependencies use ^ or ~ version ranges`,
+                fix_description: "Pin exact versions in package.json for reproducible builds",
+                status: "open",
+                confidence: "low",
+            });
+        }
+    }
+    catch {
+        // Invalid JSON - skip
+    }
+    return findings;
+}
+function isVersionPotentiallyFixed(currentRange, fixVersion) {
+    // Simple heuristic: extract version numbers and compare
+    const current = extractVersion(currentRange);
+    if (!current)
+        return false;
+    const fix = fixVersion.split(".").map(Number);
+    const cur = current.split(".").map(Number);
+    for (let i = 0; i < 3; i++) {
+        if ((cur[i] || 0) > (fix[i] || 0))
+            return true;
+        if ((cur[i] || 0) < (fix[i] || 0))
+            return false;
+    }
+    return true; // equal versions = fixed
+}
+function extractVersion(versionRange) {
+    // Handle full semver: ^4.17.21, ~4.17.21, >=4.17.21, 4.17.21
+    const fullMatch = versionRange.match(/(\d+\.\d+\.\d+)/);
+    if (fullMatch)
+        return fullMatch[1];
+    // Handle partial: ^4.17, ~4.17 → treat as 4.17.0
+    const partialMatch = versionRange.match(/(\d+\.\d+)/);
+    if (partialMatch)
+        return `${partialMatch[1]}.0`;
+    // Handle major only: ^4 → treat as 4.0.0
+    const majorMatch = versionRange.match(/(\d+)/);
+    if (majorMatch)
+        return `${majorMatch[1]}.0.0`;
+    return null;
+}
+//# sourceMappingURL=dependencies.js.map

package/dist/engines/dependencies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependencies.js","sourceRoot":"","sources":["../../src/engines/dependencies.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,kFAAkF;AAIlF,8EAA8E;AAC9E,MAAM,gBAAgB,GAA2G;IAC/H,gBAAgB,EAAE;QAChB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,2CAA2C;KACzD;IACD,sBAAsB,EAAE;QACtB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,wCAAwC;QACrD,UAAU,EAAE,OAAO;KACpB;IACD,QAAQ,EAAE;QACR,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,uCAAuC;QACpD,UAAU,EAAE,SAAS;KACtB;IACD,UAAU,EAAE;QACV,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,qBAAqB;QAClC,UAAU,EAAE,OAAO;KACpB;IACD,OAAO,EAAE;QACP,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,+BAA+B;QAC5C,UAAU,EAAE,OAAO;KACpB;IACD,cAAc,EAAE;QACd,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,qDAAqD;QAClE,UAAU,EAAE,OAAO;KACpB;IACD,SAAS,EAAE;QACT,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,iCAAiC;QAC9C,UAAU,EAAE,QAAQ;KACrB;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,qCAAqC;QAClD,UAAU,EAAE,OAAO;KACpB;CACF,CAAC;AAEF,wDAAwD;AACxD,MAAM,mBAAmB,GAAG;IAC1B,UAAU,EAAE,yBAAyB;IACrC,cAAc,EAAE,4BAA4B;IAC5C,gBAAgB,EAAE,8BAA8B;IAChD,cAAc,EAAE,4BAA4B;IAC5C,wBAAwB,EAAE,gBAAgB;IAC1C,iBAAiB,EAAE,YAAY;IAC/B,WAAW,EAAE,sBAAsB;IACnC,YAAY,EAAE,YAAY;CAC3B,CAAC;AAEF,MAAM,UAAU,mBAAmB,CACjC,KAA0B;IAE1B,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,MAAM,kBAAkB,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACrD,IAAI,CAAC,kBAAkB;QAAE,OAAO,QAAQ,CAAC;IAEzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG;YACd,GAAG,GAAG,CAAC,YAAY;YACnB,GAAG,GAAG,CAAC,eAAe;SACvB,CAAC;QAEF,sCAAsC;QACtC,KAAK,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAErC,IAAI,KAAK,EAAE,CAAC;gBACV,qEAAqE;gBACrE,IAAI,KAAK,CAAC,UAAU,IAAI,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC7E,SAAS;gBACX,CAAC;gBAED,QAAQ,CAAC,IAAI,CAAC;oBACZ,gBAAgB,EAAE,CAAC;oBACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,QAAQ,EAAE,cAAc;oBACxB,KAAK,EAAE,uBAAuB,IAAI,EAAE;oBACpC,qBAAqB,EAAE,KAAK,CAAC,WAAW;oBACxC,SAAS,EAAE,cAAc;oBACzB,YAAY,EAAE,IAAI,IAAI,OAAO,OAAO,GAAG;oBACvC,eAAe,EAAE,KAAK,CAAC,UAAU;wBAC/B,CAAC,CAAC,qBAAqB,KAAK,CAAC,UAAU,WAAW;wBAClD,CAAC,CAAC,mDAAmD;oBACvD,SAAS,EAAE,UAAU;oBACrB,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;iBACjD,CAAC,CAAC;YACL,CAAC;YAED,gCAAgC;YAChC,IAAI,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,QAAQ,CAAC,IAAI,CAAC;oBACZ,gBAAgB,EAAE,GAAG;oBACrB,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,cAAc;oBACxB,KAAK,EAAE,uBAAuB,IAAI,EAAE;oBACpC,qBAAqB,EAAE,2EAA2E;oBAClG,SAAS,EAAE,cAAc;oBACzB,YAAY,EAAE,IAAI,IAAI,OAAO,OAAO,GAAG;oBACvC,eAAe,EAAE,0DAA0D;oBAC3E,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,MAAM;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;QACpC,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,KAAK,MAAM,CAAC,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;YACrC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAClG,aAAa,EAAE,CAAC;YAClB,CAAC;QACH,CAAC;QACD,sEAAsE;QACtE,IAAI,aAAa,GAAG,CAAC,IAAI,aAAa,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACpE,QAAQ,CAAC,IAAI,CAAC;gBACZ,gBAAgB,EAAE,EAAE;gBACpB,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,cAAc;gBACxB,KAAK,EAAE,uDAAuD;gBAC9D,SAAS,EAAE,cAAc;gBACzB,YAAY,EAAE,GAAG,aAAa,yCAAyC;gBACvE,eAAe,EAAE,4DAA4D;gBAC7E,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,KAAK;aAClB,CAAC,CAAC;QACL,CAAC;IAEH,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,yBAAyB,CAChC,YAAoB,EACpB,UAAkB;IAElB,wDAAwD;IACxD,MAAM,OAAO,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE3B,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAE3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,yBAAyB;AACxC,CAAC;AAED,SAAS,cAAc,CAAC,YAAoB;IAC1C,6DAA6D;IAC7D,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACxD,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC;IAEnC,iDAAiD;IACjD,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,YAAY;QAAE,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAEhD,yCAAyC;IACzC,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,UAAU;QAAE,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;IAE9C,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/engines/github-actions.d.ts

@@ -0,0 +1,3 @@
+import type { FindingData } from "./types.js";
+export declare function analyzeGitHubActions(files: Map<string, string>): FindingData[];
+//# sourceMappingURL=github-actions.d.ts.map

package/dist/engines/github-actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-actions.d.ts","sourceRoot":"","sources":["../../src/engines/github-actions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,WAAW,EAAE,CAe9E"}

package/dist/engines/github-actions.js

@@ -0,0 +1,215 @@
+// GitHub Actions security engine - scans workflow files for common CI/CD vulnerabilities.
+// Operates on the files Map (no filesystem access needed).
+export function analyzeGitHubActions(files) {
+    const findings = [];
+    for (const [filePath, content] of files) {
+        if (!filePath.match(/\.github\/workflows\/.*\.ya?ml$/))
+            continue;
+        findings.push(...checkUnpinnedActions(content, filePath));
+        findings.push(...checkScriptInjection(content, filePath));
+        findings.push(...checkSecretsExposure(content, filePath));
+        findings.push(...checkExcessivePermissions(content, filePath));
+        findings.push(...checkSelfHostedRunners(content, filePath));
+        findings.push(...checkPullRequestTarget(content, filePath));
+    }
+    return findings;
+}
+function checkUnpinnedActions(content, filePath) {
+    const findings = [];
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const match = line.match(/uses:\s*["']?([^"'\s]+)@([^"'\s]+)/);
+        if (!match)
+            continue;
+        const [, action, ref] = match;
+        // Skip Docker and local actions
+        if (action.startsWith("docker://") || action.startsWith("./"))
+            continue;
+        // Flag if using branch ref instead of SHA or version tag
+        if (ref === "main" || ref === "master" || ref === "latest" || ref === "dev") {
+            findings.push({
+                vulnerability_id: 140,
+                severity: "medium",
+                category: "supply-chain",
+                title: `Unpinned Action: ${action}@${ref}`,
+                description_technical: `Action ${action} is pinned to branch '${ref}' instead of a SHA or version tag. This is vulnerable to supply chain attacks if the action is compromised.`,
+                file_path: filePath,
+                line_number: i + 1,
+                code_snippet: line.trim(),
+                fix_description: `Pin to a specific version tag (e.g., @v4) or full SHA (e.g., @abc123...)`,
+                status: "open",
+            });
+        }
+    }
+    return findings;
+}
+function checkScriptInjection(content, filePath) {
+    const findings = [];
+    const lines = content.split("\n");
+    // Dangerous GitHub context expressions in run: blocks
+    const dangerousContexts = [
+        "github.event.issue.title",
+        "github.event.issue.body",
+        "github.event.pull_request.title",
+        "github.event.pull_request.body",
+        "github.event.comment.body",
+        "github.event.review.body",
+        "github.event.discussion.title",
+        "github.event.discussion.body",
+        "github.head_ref",
+        "github.event.pages.page_name",
+    ];
+    let inRunBlock = false;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (line.match(/^\s*run:\s*[|>]?\s*$/)) {
+            inRunBlock = true;
+            continue;
+        }
+        if (line.match(/^\s*run:\s*\S/)) {
+            // Single-line run
+            inRunBlock = false;
+            checkLineForInjection(line, i, filePath, dangerousContexts, findings);
+            continue;
+        }
+        if (inRunBlock && line.match(/^\s*\w+:/)) {
+            inRunBlock = false;
+            continue;
+        }
+        if (inRunBlock || line.match(/^\s*run:/)) {
+            checkLineForInjection(line, i, filePath, dangerousContexts, findings);
+        }
+    }
+    return findings;
+}
+function checkLineForInjection(line, lineIndex, filePath, dangerousContexts, findings) {
+    for (const context of dangerousContexts) {
+        if (line.includes(`\${{ ${context}`) || line.includes(`\${{${context}`)) {
+            findings.push({
+                vulnerability_id: 76,
+                severity: "high",
+                category: "injection",
+                title: `Script Injection via ${context}`,
+                description_technical: `Untrusted input from '${context}' is used in a run: block. An attacker can inject arbitrary commands by crafting a malicious title/body.`,
+                file_path: filePath,
+                line_number: lineIndex + 1,
+                code_snippet: line.trim(),
+                fix_description: "Use an environment variable instead: env: TITLE: ${{ github.event.issue.title }} and reference $TITLE in the script",
+                owasp_ref: "A03:2021",
+                status: "open",
+            });
+            break; // One finding per line
+        }
+    }
+}
+function checkSecretsExposure(content, filePath) {
+    const findings = [];
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // Check for hardcoded secret-like values in env or with blocks
+        if (line.match(/(?:env|with):\s*$/))
+            continue; // Block header, skip
+        if (line.match(/^\s+\w+:\s*["'][A-Za-z0-9_\-./+=]{20,}["']/)) {
+            // Skip if it references secrets context
+            if (line.includes("${{ secrets.") || line.includes("${{ github."))
+                continue;
+            findings.push({
+                vulnerability_id: 53,
+                severity: "critical",
+                category: "vibecoding",
+                title: "Hardcoded Secret in Workflow",
+                description_technical: "A long string value in the workflow file may be a hardcoded secret. Use GitHub Secrets instead.",
+                file_path: filePath,
+                line_number: i + 1,
+                code_snippet: line.trim().replace(/["'][A-Za-z0-9_\-./+=]{20,}["']/, '"***REDACTED***"'),
+                fix_description: "Store the value as a GitHub Secret and reference it via ${{ secrets.SECRET_NAME }}",
+                owasp_ref: "A07:2021",
+                status: "open",
+            });
+        }
+    }
+    return findings;
+}
+function checkExcessivePermissions(content, filePath) {
+    const findings = [];
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // Check for write-all permissions
+        if (line.match(/^\s*permissions:\s*write-all/)) {
+            findings.push({
+                vulnerability_id: 133,
+                severity: "medium",
+                category: "serverless",
+                title: "Workflow Has write-all Permissions",
+                description_technical: "The workflow grants write permissions to all scopes. Follow the principle of least privilege.",
+                file_path: filePath,
+                line_number: i + 1,
+                code_snippet: line.trim(),
+                fix_description: "Specify only the permissions needed, e.g., permissions: { contents: read, pull-requests: write }",
+                status: "open",
+            });
+        }
+        // Check for no permissions block at top level
+        if (i === 0 && !content.includes("permissions:")) {
+            findings.push({
+                vulnerability_id: 133,
+                severity: "low",
+                category: "serverless",
+                title: "Workflow Missing Permissions Block",
+                description_technical: "No permissions block defined. The workflow inherits default permissions which may be broader than needed.",
+                file_path: filePath,
+                line_number: 1,
+                code_snippet: lines.slice(0, 3).join("\n"),
+                fix_description: "Add a top-level permissions block to restrict token scope",
+                status: "open",
+            });
+        }
+    }
+    return findings;
+}
+function checkSelfHostedRunners(content, filePath) {
+    const findings = [];
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (line.match(/runs-on:\s*["']?self-hosted/)) {
+            findings.push({
+                vulnerability_id: 136,
+                severity: "info",
+                category: "serverless",
+                title: "Self-Hosted Runner Used",
+                description_technical: "Self-hosted runners can persist state between jobs. Ensure runners are ephemeral or properly hardened.",
+                file_path: filePath,
+                line_number: i + 1,
+                code_snippet: line.trim(),
+                status: "open",
+            });
+        }
+    }
+    return findings;
+}
+function checkPullRequestTarget(content, filePath) {
+    const findings = [];
+    if (content.includes("pull_request_target") && content.includes("actions/checkout")) {
+        // This is a dangerous pattern: pull_request_target + checkout = code execution from fork
+        const lineNum = content.split("\n").findIndex((l) => l.includes("pull_request_target")) + 1;
+        findings.push({
+            vulnerability_id: 76,
+            severity: "critical",
+            category: "injection",
+            title: "Dangerous pull_request_target + Checkout Pattern",
+            description_technical: "Using pull_request_target with actions/checkout can execute untrusted code from forks with write permissions and secrets access.",
+            file_path: filePath,
+            line_number: lineNum,
+            code_snippet: "on: pull_request_target\n...\nuses: actions/checkout@...",
+            fix_description: "Use pull_request instead, or avoid checking out PR code in pull_request_target workflows",
+            owasp_ref: "A03:2021",
+            status: "open",
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=github-actions.js.map

package/dist/engines/github-actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-actions.js","sourceRoot":"","sources":["../../src/engines/github-actions.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,2DAA2D;AAI3D,MAAM,UAAU,oBAAoB,CAAC,KAA0B;IAC7D,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,iCAAiC,CAAC;YAAE,SAAS;QAEjE,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC/D,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC5D,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe,EAAE,QAAgB;IAC7D,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;QAE9B,gCAAgC;QAChC,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAExE,yDAAyD;QACzD,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;YAC5E,QAAQ,CAAC,IAAI,CAAC;gBACZ,gBAAgB,EAAE,GAAG;gBACrB,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,cAAc;gBACxB,KAAK,EAAE,oBAAoB,MAAM,IAAI,GAAG,EAAE;gBAC1C,qBAAqB,EAAE,UAAU,MAAM,yBAAyB,GAAG,6GAA6G;gBAChL,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,CAAC,GAAG,CAAC;gBAClB,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE;gBACzB,eAAe,EAAE,0EAA0E;gBAC3F,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe,EAAE,QAAgB;IAC7D,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,sDAAsD;IACtD,MAAM,iBAAiB,GAAG;QACxB,0BAA0B;QAC1B,yBAAyB;QACzB,iCAAiC;QACjC,gCAAgC;QAChC,2BAA2B;QAC3B,0BAA0B;QAC1B,+BAA+B;QAC/B,8BAA8B;QAC9B,iBAAiB;QACjB,8BAA8B;KAC/B,CAAC;IAEF,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,IAAI,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,CAAC;YACvC,UAAU,GAAG,IAAI,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;YAChC,kBAAkB;YAClB,UAAU,GAAG,KAAK,CAAC;YACnB,qBAAqB,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QACD,IAAI,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,UAAU,GAAG,KAAK,CAAC;YACnB,SAAS;QACX,CAAC;QAED,IAAI,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,qBAAqB,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAY,EACZ,SAAiB,EACjB,QAAgB,EAChB,iBAA2B,EAC3B,QAAuB;IAEvB,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,OAAO,EAAE,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,OAAO,EAAE,CAAC,EAAE,CAAC;YACxE,QAAQ,CAAC,IAAI,CAAC;gBACZ,gBAAgB,EAAE,EAAE;gBACpB,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,WAAW;gBACrB,KAAK,EAAE,wBAAwB,OAAO,EAAE;gBACxC,qBAAqB,EAAE,yBAAyB,OAAO,0GAA0G;gBACjK,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,SAAS,GAAG,CAAC;gBAC1B,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE;gBACzB,eAAe,EAAE,qHAAqH;gBACtI,SAAS,EAAE,UAAU;gBACrB,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YACH,MAAM,CAAC,uBAAuB;QAChC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe,EAAE,QAAgB;IAC7D,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,+DAA+D;QAC/D,IAAI,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;YAAE,SAAS,CAAC,qBAAqB;QACpE,IAAI,IAAI,CAAC,KAAK,CAAC,4CAA4C,CAAC,EAAE,CAAC;YAC7D,wCAAwC;YACxC,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAAE,SAAS;YAE5E,QAAQ,CAAC,IAAI,CAAC;gBACZ,gBAAgB,EAAE,EAAE;gBACpB,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,YAAY;gBACtB,KAAK,EAAE,8BAA8B;gBACrC,qBAAqB,EAAE,iGAAiG;gBACxH,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,CAAC,GAAG,CAAC;gBAClB,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,iCAAiC,EAAE,kBAAkB,CAAC;gBACxF,eAAe,EAAE,oFAAoF;gBACrG,SAAS,EAAE,UAAU;gBACrB,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAe,EAAE,QAAgB;IAClE,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,kCAAkC;QAClC,IAAI,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,EAAE,CAAC;YAC/C,QAAQ,CAAC,IAAI,CAAC;gBACZ,gBAAgB,EAAE,GAAG;gBACrB,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,YAAY;gBACtB,KAAK,EAAE,oCAAoC;gBAC3C,qBAAqB,EAAE,+FAA+F;gBACtH,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,CAAC,GAAG,CAAC;gBAClB,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE;gBACzB,eAAe,EAAE,kGAAkG;gBACnH,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;QACL,CAAC;QAED,8CAA8C;QAC9C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACjD,QAAQ,CAAC,IAAI,CAAC;gBACZ,gBAAgB,EAAE,GAAG;gBACrB,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,YAAY;gBACtB,KAAK,EAAE,oCAAoC;gBAC3C,qBAAqB,EAAE,2GAA2G;gBAClI,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,CAAC;gBACd,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC1C,eAAe,EAAE,2DAA2D;gBAC5E,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe,EAAE,QAAgB;IAC/D,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,IAAI,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC;gBACZ,gBAAgB,EAAE,GAAG;gBACrB,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,YAAY;gBACtB,KAAK,EAAE,yBAAyB;gBAChC,qBAAqB,EAAE,wGAAwG;gBAC/H,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,CAAC,GAAG,CAAC;gBAClB,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE;gBACzB,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe,EAAE,QAAgB;IAC/D,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,IAAI,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACpF,yFAAyF;QACzF,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5F,QAAQ,CAAC,IAAI,CAAC;YACZ,gBAAgB,EAAE,EAAE;YACpB,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,WAAW;YACrB,KAAK,EAAE,kDAAkD;YACzD,qBAAqB,EAAE,kIAAkI;YACzJ,SAAS,EAAE,QAAQ;YACnB,WAAW,EAAE,OAAO;YACpB,YAAY,EAAE,0DAA0D;YACxE,eAAe,EAAE,0FAA0F;YAC3G,SAAS,EAAE,UAAU;YACrB,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/engines/gitleaks.d.ts

@@ -0,0 +1,3 @@
+import type { FindingData } from "./types.js";
+export declare function runGitleaks(repoDir: string): Promise<FindingData[]>;
+//# sourceMappingURL=gitleaks.d.ts.map

package/dist/engines/gitleaks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitleaks.d.ts","sourceRoot":"","sources":["../../src/engines/gitleaks.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAY,MAAM,YAAY,CAAC;AA0DxD,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CA4CzE"}