@greenarmor/ges-audit-engine 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 greenarmor
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "./scanners/types.js";
+export type { Finding } from "./scanners/types.js";
+export declare function runAudit(root: string): {
+    findings: Finding[];
+    scannedFiles: number;
+};
+export declare function deduplicateFindings(findings: Finding[]): Finding[];

package/dist/index.js

@@ -0,0 +1,87 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { SecretsScanner } from "./scanners/secrets-scanner.js";
+import { CryptoScanner } from "./scanners/crypto-scanner.js";
+import { CodeSecurityScanner } from "./scanners/code-security-scanner.js";
+import { AuthScanner } from "./scanners/auth-scanner.js";
+import { ConfigScanner } from "./scanners/config-scanner.js";
+import { DatabaseScanner } from "./scanners/database-scanner.js";
+const IGNORE_DIRS = new Set([
+    "node_modules", ".git", "dist", "build", ".next", ".nuxt", "coverage",
+    ".ges", "vendor", "__pycache__", ".venv", "venv", ".turbo", ".cache",
+    "reports", "compliance", "security", "controls", "policies", "checklists", "docs",
+]);
+const IGNORE_EXTENSIONS = new Set([
+    ".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg", ".ico", ".woff",
+    ".woff2", ".ttf", ".eot", ".mp4", ".mp3", ".zip", ".gz", ".tar",
+    ".lock", ".map", ".wasm",
+]);
+function collectFiles(root) {
+    const files = [];
+    function walk(dir) {
+        const entries = fs.readdirSync(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            if (IGNORE_DIRS.has(entry.name))
+                continue;
+            const fullPath = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                walk(fullPath);
+            }
+            else if (entry.isFile()) {
+                const ext = path.extname(entry.name);
+                if (!IGNORE_EXTENSIONS.has(ext)) {
+                    files.push(path.relative(root, fullPath));
+                }
+            }
+        }
+    }
+    walk(root);
+    return files;
+}
+function readFiles(root, files) {
+    const contents = new Map();
+    const MAX_FILE_SIZE = 1024 * 1024;
+    for (const file of files) {
+        try {
+            const fullPath = path.join(root, file);
+            const stat = fs.statSync(fullPath);
+            if (stat.size > MAX_FILE_SIZE)
+                continue;
+            const content = fs.readFileSync(fullPath, "utf-8");
+            contents.set(file, content);
+        }
+        catch {
+            // skip unreadable files
+        }
+    }
+    return contents;
+}
+export function runAudit(root) {
+    const files = collectFiles(root);
+    const fileContents = readFiles(root, files);
+    const ctx = { root, files, fileContents };
+    const scanners = [
+        new SecretsScanner(),
+        new CryptoScanner(),
+        new CodeSecurityScanner(),
+        new AuthScanner(),
+        new ConfigScanner(),
+        new DatabaseScanner(),
+    ];
+    const allFindings = [];
+    for (const scanner of scanners) {
+        allFindings.push(...scanner.scan(ctx));
+    }
+    return { findings: allFindings, scannedFiles: files.length };
+}
+export function deduplicateFindings(findings) {
+    const seen = new Set();
+    return findings.filter(f => {
+        const key = `${f.ruleId}:${f.file}:${f.line || ""}:${f.evidence}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAIjE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU;IACrE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ;IACpE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM;CAClF,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO;IACjE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;IAC/D,OAAO,EAAE,MAAM,EAAE,OAAO;CACzB,CAAC,CAAC;AAEH,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,SAAS,IAAI,CAAC,GAAW;QACvB,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjB,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAChC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,CAAC;IACX,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,KAAe;IAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,aAAa,GAAG,IAAI,GAAG,IAAI,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,IAAI,CAAC,IAAI,GAAG,aAAa;gBAAE,SAAS;YACxC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IAEvD,MAAM,QAAQ,GAAG;QACf,IAAI,cAAc,EAAE;QACpB,IAAI,aAAa,EAAE;QACnB,IAAI,mBAAmB,EAAE;QACzB,IAAI,WAAW,EAAE;QACjB,IAAI,aAAa,EAAE;QACnB,IAAI,eAAe,EAAE;KACtB,CAAC;IAEF,MAAM,WAAW,GAAc,EAAE,CAAC;IAClC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,WAAW,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAmB;IACrD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/scanners/auth-scanner.d.ts

@@ -0,0 +1,12 @@
+import type { Scanner, Finding, ScanContext } from "./types.js";
+export declare class AuthScanner implements Scanner {
+    name: string;
+    scan(ctx: ScanContext): Finding[];
+    private detectAuthMiddleware;
+    private detectRoutesWithoutAuth;
+    private detectRateLimiting;
+    private detectSessionConfig;
+    private detectCORSSettings;
+    private detectMFA;
+    private searchPatterns;
+}

package/dist/scanners/auth-scanner.js

@@ -0,0 +1,176 @@
+const SCAN_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx", ".py", ".rb", ".go", ".java", ".php"]);
+export class AuthScanner {
+    name = "auth";
+    scan(ctx) {
+        const findings = [];
+        const content = ctx.fileContents;
+        const hasAuthMiddleware = this.detectAuthMiddleware(content);
+        const routesWithoutAuth = this.detectRoutesWithoutAuth(content, hasAuthMiddleware);
+        const hasRateLimiting = this.detectRateLimiting(content);
+        const hasSessionConfig = this.detectSessionConfig(content);
+        const hasCORSSettings = this.detectCORSSettings(content);
+        if (routesWithoutAuth.length > 0) {
+            for (const route of routesWithoutAuth.slice(0, 20)) {
+                findings.push({
+                    ruleId: "AUTH-001",
+                    severity: "high",
+                    category: "authentication",
+                    title: "Route without authentication",
+                    description: `Endpoint ${route.method} ${route.path} does not require authentication. All endpoints handling personal data must require auth.`,
+                    file: route.file,
+                    line: route.line,
+                    evidence: route.evidence,
+                    controlIds: ["GDPR-ART32-004", "OWASP-ASVS-003", "OWASP-ASVS-004"],
+                    fix: "Add authentication middleware to this route or apply globally.",
+                });
+            }
+        }
+        if (!hasRateLimiting) {
+            findings.push({
+                ruleId: "AUTH-002",
+                severity: "high",
+                category: "authentication",
+                title: "No rate limiting detected",
+                description: "No rate limiting library or configuration found. Rate limiting is required on authentication endpoints and API routes.",
+                file: "project",
+                evidence: "No rate limiter (express-rate-limit, etc.) found in codebase",
+                controlIds: ["GDPR-ART32-004", "OWASP-ASVS-003"],
+                fix: "Install and configure rate limiting: npm install express-rate-limit",
+            });
+        }
+        if (!hasSessionConfig) {
+            findings.push({
+                ruleId: "AUTH-003",
+                severity: "medium",
+                category: "authentication",
+                title: "No session timeout configuration detected",
+                description: "No session expiration or timeout configuration found. Sessions must expire after a period of inactivity.",
+                file: "project",
+                evidence: "No session timeout configuration found",
+                controlIds: ["GDPR-ART32-005"],
+                fix: "Configure session expiration: maxAge, idle timeout, or JWT expiration.",
+            });
+        }
+        if (hasCORSSettings === "wildcard") {
+            findings.push({
+                ruleId: "AUTH-004",
+                severity: "high",
+                category: "security",
+                title: "CORS configured as wildcard (*)",
+                description: "CORS is set to allow all origins. This is insecure for production. Restrict to known origins.",
+                file: "project",
+                evidence: "cors({ origin: '*' }) or Access-Control-Allow-Origin: *",
+                controlIds: ["OWASP-ASVS-006"],
+                fix: "Restrict CORS to specific origins: cors({ origin: ['https://yourdomain.com'] })",
+            });
+        }
+        if (!this.detectMFA(content)) {
+            findings.push({
+                ruleId: "AUTH-005",
+                severity: "high",
+                category: "authentication",
+                title: "No MFA implementation detected",
+                description: "No multi-factor authentication implementation found. MFA is mandatory per GDPR Article 32.",
+                file: "project",
+                evidence: "No MFA/2FA/OTP/TOTP library found in dependencies or code",
+                controlIds: ["GDPR-ART32-004"],
+                fix: "Implement MFA using TOTP (otpauth, speakeasy) or WebAuthn.",
+            });
+        }
+        return findings;
+    }
+    detectAuthMiddleware(content) {
+        const authIndicators = [
+            /jwt\.verify|jsonwebtoken|jwtDecode/i,
+            /passport\.use|passport\.authenticate/i,
+            /authMiddleware|authGuard|requireAuth|isAuthenticated/i,
+            /session\s*\(\s*{/i,
+            /bearer\s+token/i,
+            /firebase.*auth/i,
+            /nextAuth|next-auth/i,
+            /supabase.*auth/i,
+            /clerk/i,
+            /auth0/i,
+        ];
+        return this.searchPatterns(content, authIndicators);
+    }
+    detectRoutesWithoutAuth(content, hasGlobalAuth) {
+        const routes = [];
+        if (hasGlobalAuth)
+            return routes;
+        const routePattern = /(?:app|router|route)\s*\.\s*(get|post|put|delete|patch)\s*\(\s*['"`]([^'"`]*)/gi;
+        for (const [filePath, fileContent] of content) {
+            const ext = filePath.substring(filePath.lastIndexOf("."));
+            if (!SCAN_EXTENSIONS.has(ext))
+                continue;
+            const lines = fileContent.split("\n");
+            for (let i = 0; i < lines.length; i++) {
+                routePattern.lastIndex = 0;
+                const match = routePattern.exec(lines[i]);
+                if (match) {
+                    const path = match[2];
+                    const publicPaths = ["/", "/health", "/healthz", "/status", "/ping", "/ready", "/readiness", "/version", "/public"];
+                    if (!publicPaths.some(p => path === p)) {
+                        routes.push({
+                            method: match[1].toUpperCase(),
+                            path,
+                            file: filePath,
+                            line: i + 1,
+                            evidence: lines[i].trim(),
+                        });
+                    }
+                }
+            }
+        }
+        return routes;
+    }
+    detectRateLimiting(content) {
+        return this.searchPatterns(content, [
+            /rate.?limit/i,
+            /rateLimit|rate-limit/i,
+            /express-rate-limit/i,
+            /throttl/i,
+        ]);
+    }
+    detectSessionConfig(content) {
+        return this.searchPatterns(content, [
+            /session\s*\(\s*{[^}]*maxAge/i,
+            /maxAge\s*[:=]/i,
+            /expiresIn\s*[:=]/i,
+            /expires\s*[:=]/i,
+            /cookie\s*:\s*{[^}]*maxAge/i,
+            /idleTimeout/i,
+        ]);
+    }
+    detectCORSSettings(content) {
+        for (const [, fileContent] of content) {
+            if (/cors\s*\(\s*{[^}]*origin\s*:\s*['"]\*['"]/s.test(fileContent) ||
+                /Access-Control-Allow-Origin\s*:\s*\*/i.test(fileContent)) {
+                return "wildcard";
+            }
+            if (/cors\s*\(/i.test(fileContent) || /Access-Control-Allow/i.test(fileContent)) {
+                return "configured";
+            }
+        }
+        return "none";
+    }
+    detectMFA(content) {
+        return this.searchPatterns(content, [
+            /mfa|multi.?factor|2fa|two.?factor/i,
+            /totp|otpauth|speakeasy|otplib/i,
+            /webauthn|fido2|passkey/i,
+            /authenticator/i,
+        ]);
+    }
+    searchPatterns(content, patterns) {
+        for (const [, fileContent] of content) {
+            for (const pattern of patterns) {
+                pattern.lastIndex = 0;
+                if (pattern.test(fileContent))
+                    return true;
+            }
+        }
+        return false;
+    }
+}
+//# sourceMappingURL=auth-scanner.js.map

package/dist/scanners/auth-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-scanner.js","sourceRoot":"","sources":["../../src/scanners/auth-scanner.ts"],"names":[],"mappings":"AAEA,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAEtG,MAAM,OAAO,WAAW;IACtB,IAAI,GAAG,MAAM,CAAC;IAEd,IAAI,CAAC,GAAgB;QACnB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC;QAEjC,MAAM,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,iBAAiB,GAAG,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACnF,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,gBAAgB,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAEzD,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,KAAK,MAAM,KAAK,IAAI,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;gBACnD,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,UAAU;oBAClB,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,gBAAgB;oBAC1B,KAAK,EAAE,8BAA8B;oBACrC,WAAW,EAAE,YAAY,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,2FAA2F;oBAC9I,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,UAAU,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,CAAC;oBAClE,GAAG,EAAE,gEAAgE;iBACtE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,gBAAgB;gBAC1B,KAAK,EAAE,2BAA2B;gBAClC,WAAW,EAAE,wHAAwH;gBACrI,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,8DAA8D;gBACxE,UAAU,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;gBAChD,GAAG,EAAE,qEAAqE;aAC3E,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,gBAAgB;gBAC1B,KAAK,EAAE,2CAA2C;gBAClD,WAAW,EAAE,0GAA0G;gBACvH,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,wCAAwC;gBAClD,UAAU,EAAE,CAAC,gBAAgB,CAAC;gBAC9B,GAAG,EAAE,wEAAwE;aAC9E,CAAC,CAAC;QACL,CAAC;QAED,IAAI,eAAe,KAAK,UAAU,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,iCAAiC;gBACxC,WAAW,EAAE,+FAA+F;gBAC5G,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,yDAAyD;gBACnE,UAAU,EAAE,CAAC,gBAAgB,CAAC;gBAC9B,GAAG,EAAE,iFAAiF;aACvF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,gBAAgB;gBAC1B,KAAK,EAAE,gCAAgC;gBACvC,WAAW,EAAE,4FAA4F;gBACzG,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,2DAA2D;gBACrE,UAAU,EAAE,CAAC,gBAAgB,CAAC;gBAC9B,GAAG,EAAE,4DAA4D;aAClE,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,oBAAoB,CAAC,OAA4B;QACvD,MAAM,cAAc,GAAG;YACrB,qCAAqC;YACrC,uCAAuC;YACvC,uDAAuD;YACvD,mBAAmB;YACnB,iBAAiB;YACjB,iBAAiB;YACjB,qBAAqB;YACrB,iBAAiB;YACjB,QAAQ;YACR,QAAQ;SACT,CAAC;QACF,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACtD,CAAC;IAEO,uBAAuB,CAC7B,OAA4B,EAC5B,aAAsB;QAEtB,MAAM,MAAM,GAA0F,EAAE,CAAC;QAEzG,IAAI,aAAa;YAAE,OAAO,MAAM,CAAC;QAEjC,MAAM,YAAY,GAAG,iFAAiF,CAAC;QAEvG,KAAK,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,OAAO,EAAE,CAAC;YAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1D,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAExC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,YAAY,CAAC,SAAS,GAAG,CAAC,CAAC;gBAC3B,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBACtB,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;oBACpH,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;wBACvC,MAAM,CAAC,IAAI,CAAC;4BACV,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;4BAC9B,IAAI;4BACJ,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,CAAC,GAAG,CAAC;4BACX,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;yBAC1B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,kBAAkB,CAAC,OAA4B;QACrD,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE;YAClC,cAAc;YACd,uBAAuB;YACvB,qBAAqB;YACrB,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAEO,mBAAmB,CAAC,OAA4B;QACtD,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE;YAClC,8BAA8B;YAC9B,gBAAgB;YAChB,mBAAmB;YACnB,iBAAiB;YACjB,4BAA4B;YAC5B,cAAc;SACf,CAAC,CAAC;IACL,CAAC;IAEO,kBAAkB,CAAC,OAA4B;QACrD,KAAK,MAAM,CAAC,EAAE,WAAW,CAAC,IAAI,OAAO,EAAE,CAAC;YACtC,IAAI,4CAA4C,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC9D,uCAAuC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9D,OAAO,UAAU,CAAC;YACpB,CAAC;YACD,IAAI,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBAChF,OAAO,YAAY,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,SAAS,CAAC,OAA4B;QAC5C,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE;YAClC,oCAAoC;YACpC,gCAAgC;YAChC,yBAAyB;YACzB,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,OAA4B,EAAE,QAAkB;QACrE,KAAK,MAAM,CAAC,EAAE,WAAW,CAAC,IAAI,OAAO,EAAE,CAAC;YACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;gBACtB,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;oBAAE,OAAO,IAAI,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/scanners/code-security-scanner.d.ts

@@ -0,0 +1,5 @@
+import type { Scanner, Finding, ScanContext } from "./types.js";
+export declare class CodeSecurityScanner implements Scanner {
+    name: string;
+    scan(ctx: ScanContext): Finding[];
+}

package/dist/scanners/code-security-scanner.js

@@ -0,0 +1,91 @@
+const SQL_INJECTION_PATTERNS = [
+    { pattern: /(?:query|execute|raw|sql)\s*\(\s*[`"'].*\+\s*(?:req|params|query|body|input|request)/gi, desc: "SQL query with string concatenation from user input" },
+    { pattern: /(?:query|execute|raw|sql)\s*\(\s*[`"'].*\$\{(?:req|params|query|body)/gi, desc: "SQL query with template literal injection" },
+    { pattern: /SELECT\s+.*\s+FROM\s+.*\s+WHERE\s+.*\+\s*(?:req|params|query|body)/gi, desc: "SQL SELECT with concatenated user input" },
+    { pattern: /INSERT\s+INTO\s+.*VALUES\s*\(.*\+\s*(?:req|params|query|body)/gi, desc: "SQL INSERT with concatenated user input" },
+    { pattern: /DELETE\s+FROM\s+.*WHERE\s+.*\+\s*(?:req|params|query|body)/gi, desc: "SQL DELETE with concatenated user input" },
+    { pattern: /UPDATE\s+.*SET\s+.*\+\s*(?:req|params|query|body)/gi, desc: "SQL UPDATE with concatenated user input" },
+];
+const XSS_PATTERNS = [
+    { pattern: /innerHTML\s*=\s*(?:req|params|query|body|input)/gi, desc: "Direct innerHTML assignment from user input" },
+    { pattern: /document\.write\s*\(\s*(?:req|params|query|body)/gi, desc: "document.write with user input" },
+    { pattern: /v-html\s*=\s*(?:req|params|query|body|input)/gi, desc: "Vue v-html with user input" },
+    { pattern: /dangerouslySetInnerHTML\s*=\s*\{.*(?:req|params|query|body)/gi, desc: "React dangerouslySetInnerHTML with user input" },
+    { pattern: /\.html\s*\(\s*(?:req|params|query|body)/gi, desc: "jQuery .html() with user input" },
+];
+const INPUT_VALIDATION_PATTERNS = [
+    { pattern: /(?:parseInt|parseFloat|Number)\s*\(\s*req\.(?:body|params|query)/gi, desc: "Unvalidated number parsing from request" },
+    { pattern: /eval\s*\(\s*(?:req|params|query|body|input)/gi, desc: "eval() with user input - critical RCE risk" },
+    { pattern: /Function\s*\(\s*(?:req|params|query|body)/gi, desc: "Function constructor with user input" },
+    { pattern: /exec\s*\(\s*(?:req|params|query|body)/gi, desc: "Command execution with user input" },
+    { pattern: /child_process.*(?:req|params|query|body)/gi, desc: "Child process with user input" },
+];
+const SCAN_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx", ".py", ".rb", ".go", ".java", ".php"]);
+export class CodeSecurityScanner {
+    name = "code-security";
+    scan(ctx) {
+        const findings = [];
+        for (const [filePath, content] of ctx.fileContents) {
+            const ext = filePath.substring(filePath.lastIndexOf("."));
+            if (!SCAN_EXTENSIONS.has(ext))
+                continue;
+            const lines = content.split("\n");
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                for (const { pattern, desc } of SQL_INJECTION_PATTERNS) {
+                    pattern.lastIndex = 0;
+                    if (pattern.test(line)) {
+                        findings.push({
+                            ruleId: "INJECT-001",
+                            severity: "critical",
+                            category: "injection",
+                            title: "SQL Injection vulnerability",
+                            description: desc + ". Use parameterized queries or an ORM.",
+                            file: filePath,
+                            line: i + 1,
+                            evidence: line.trim(),
+                            controlIds: ["OWASP-ASVS-001", "GDPR-ART5-006"],
+                            fix: "Use parameterized queries: db.query('SELECT * FROM users WHERE id = $1', [req.query.id])",
+                        });
+                    }
+                }
+                for (const { pattern, desc } of XSS_PATTERNS) {
+                    pattern.lastIndex = 0;
+                    if (pattern.test(line)) {
+                        findings.push({
+                            ruleId: "INJECT-002",
+                            severity: "critical",
+                            category: "xss",
+                            title: "Cross-Site Scripting (XSS) vulnerability",
+                            description: desc + ". Sanitize all user input before rendering.",
+                            file: filePath,
+                            line: i + 1,
+                            evidence: line.trim(),
+                            controlIds: ["OWASP-ASVS-002", "GDPR-ART5-006"],
+                            fix: "Use textContent instead of innerHTML, or sanitize input with a library like DOMPurify.",
+                        });
+                    }
+                }
+                for (const { pattern, desc } of INPUT_VALIDATION_PATTERNS) {
+                    pattern.lastIndex = 0;
+                    if (pattern.test(line)) {
+                        findings.push({
+                            ruleId: "INJECT-003",
+                            severity: "critical",
+                            category: "injection",
+                            title: "Code injection risk",
+                            description: desc + ". Never pass user input to code execution functions.",
+                            file: filePath,
+                            line: i + 1,
+                            evidence: line.trim(),
+                            controlIds: ["OWASP-ASVS-001"],
+                            fix: "Remove eval/exec usage with user input. Use safe alternatives.",
+                        });
+                    }
+                }
+            }
+        }
+        return findings;
+    }
+}
+//# sourceMappingURL=code-security-scanner.js.map

package/dist/scanners/code-security-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-security-scanner.js","sourceRoot":"","sources":["../../src/scanners/code-security-scanner.ts"],"names":[],"mappings":"AAEA,MAAM,sBAAsB,GAAG;IAC7B,EAAE,OAAO,EAAE,wFAAwF,EAAE,IAAI,EAAE,qDAAqD,EAAE;IAClK,EAAE,OAAO,EAAE,yEAAyE,EAAE,IAAI,EAAE,2CAA2C,EAAE;IACzI,EAAE,OAAO,EAAE,sEAAsE,EAAE,IAAI,EAAE,yCAAyC,EAAE;IACpI,EAAE,OAAO,EAAE,iEAAiE,EAAE,IAAI,EAAE,yCAAyC,EAAE;IAC/H,EAAE,OAAO,EAAE,8DAA8D,EAAE,IAAI,EAAE,yCAAyC,EAAE;IAC5H,EAAE,OAAO,EAAE,qDAAqD,EAAE,IAAI,EAAE,yCAAyC,EAAE;CACpH,CAAC;AAEF,MAAM,YAAY,GAAG;IACnB,EAAE,OAAO,EAAE,mDAAmD,EAAE,IAAI,EAAE,6CAA6C,EAAE;IACrH,EAAE,OAAO,EAAE,oDAAoD,EAAE,IAAI,EAAE,gCAAgC,EAAE;IACzG,EAAE,OAAO,EAAE,gDAAgD,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACjG,EAAE,OAAO,EAAE,+DAA+D,EAAE,IAAI,EAAE,+CAA+C,EAAE;IACnI,EAAE,OAAO,EAAE,2CAA2C,EAAE,IAAI,EAAE,gCAAgC,EAAE;CACjG,CAAC;AAEF,MAAM,yBAAyB,GAAG;IAChC,EAAE,OAAO,EAAE,oEAAoE,EAAE,IAAI,EAAE,yCAAyC,EAAE;IAClI,EAAE,OAAO,EAAE,+CAA+C,EAAE,IAAI,EAAE,4CAA4C,EAAE;IAChH,EAAE,OAAO,EAAE,6CAA6C,EAAE,IAAI,EAAE,sCAAsC,EAAE;IACxG,EAAE,OAAO,EAAE,yCAAyC,EAAE,IAAI,EAAE,mCAAmC,EAAE;IACjG,EAAE,OAAO,EAAE,4CAA4C,EAAE,IAAI,EAAE,+BAA+B,EAAE;CACjG,CAAC;AAEF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAEtG,MAAM,OAAO,mBAAmB;IAC9B,IAAI,GAAG,eAAe,CAAC;IAEvB,IAAI,CAAC,GAAgB;QACnB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1D,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAExC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAEtB,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,sBAAsB,EAAE,CAAC;oBACvD,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;oBACtB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvB,QAAQ,CAAC,IAAI,CAAC;4BACZ,MAAM,EAAE,YAAY;4BACpB,QAAQ,EAAE,UAAU;4BACpB,QAAQ,EAAE,WAAW;4BACrB,KAAK,EAAE,6BAA6B;4BACpC,WAAW,EAAE,IAAI,GAAG,wCAAwC;4BAC5D,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,CAAC,GAAG,CAAC;4BACX,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE;4BACrB,UAAU,EAAE,CAAC,gBAAgB,EAAE,eAAe,CAAC;4BAC/C,GAAG,EAAE,0FAA0F;yBAChG,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAED,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,YAAY,EAAE,CAAC;oBAC7C,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;oBACtB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvB,QAAQ,CAAC,IAAI,CAAC;4BACZ,MAAM,EAAE,YAAY;4BACpB,QAAQ,EAAE,UAAU;4BACpB,QAAQ,EAAE,KAAK;4BACf,KAAK,EAAE,0CAA0C;4BACjD,WAAW,EAAE,IAAI,GAAG,6CAA6C;4BACjE,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,CAAC,GAAG,CAAC;4BACX,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE;4BACrB,UAAU,EAAE,CAAC,gBAAgB,EAAE,eAAe,CAAC;4BAC/C,GAAG,EAAE,wFAAwF;yBAC9F,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAED,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,yBAAyB,EAAE,CAAC;oBAC1D,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;oBACtB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvB,QAAQ,CAAC,IAAI,CAAC;4BACZ,MAAM,EAAE,YAAY;4BACpB,QAAQ,EAAE,UAAU;4BACpB,QAAQ,EAAE,WAAW;4BACrB,KAAK,EAAE,qBAAqB;4BAC5B,WAAW,EAAE,IAAI,GAAG,sDAAsD;4BAC1E,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,CAAC,GAAG,CAAC;4BACX,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE;4BACrB,UAAU,EAAE,CAAC,gBAAgB,CAAC;4BAC9B,GAAG,EAAE,gEAAgE;yBACtE,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/scanners/config-scanner.d.ts

@@ -0,0 +1,12 @@
+import type { Scanner, Finding, ScanContext } from "./types.js";
+export declare class ConfigScanner implements Scanner {
+    name: string;
+    scan(ctx: ScanContext): Finding[];
+    private checkPackageJson;
+    private checkEnvFiles;
+    private checkDockerConfig;
+    private checkTLSConfig;
+    private checkGitignore;
+    private checkLoggingConfig;
+    private searchContent;
+}

package/dist/scanners/config-scanner.js

@@ -0,0 +1,210 @@
+export class ConfigScanner {
+    name = "config";
+    scan(ctx) {
+        const findings = [];
+        this.checkPackageJson(ctx, findings);
+        this.checkEnvFiles(ctx, findings);
+        this.checkDockerConfig(ctx, findings);
+        this.checkTLSConfig(ctx, findings);
+        this.checkGitignore(ctx, findings);
+        this.checkLoggingConfig(ctx, findings);
+        return findings;
+    }
+    checkPackageJson(ctx, findings) {
+        const pkgContent = ctx.fileContents.get("package.json");
+        if (!pkgContent)
+            return;
+        try {
+            const pkg = JSON.parse(pkgContent);
+            const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+            if (deps.helmet === undefined && (deps.express || deps.koa || deps.fastify)) {
+                findings.push({
+                    ruleId: "CONFIG-001",
+                    severity: "high",
+                    category: "security",
+                    title: "Missing security headers (no helmet)",
+                    description: "No helmet middleware detected for HTTP framework. Security headers protect against XSS, clickjacking, and other attacks.",
+                    file: "package.json",
+                    evidence: "helmet not in dependencies",
+                    controlIds: ["OWASP-ASVS-002", "OWASP-ASVS-006"],
+                    fix: "npm install helmet && app.use(helmet())",
+                });
+            }
+            if (deps.cors === undefined && (deps.express || deps.fastify)) {
+                findings.push({
+                    ruleId: "CONFIG-002",
+                    severity: "medium",
+                    category: "security",
+                    title: "No CORS configuration",
+                    description: "No CORS package found. Unrestricted CORS can expose your API to cross-origin attacks.",
+                    file: "package.json",
+                    evidence: "cors not in dependencies",
+                    controlIds: ["OWASP-ASVS-006"],
+                    fix: "npm install cors and configure allowed origins explicitly.",
+                });
+            }
+            const auditDeps = ["express", "lodash", "axios", "underscore"];
+            for (const dep of auditDeps) {
+                if (deps[dep]) {
+                    findings.push({
+                        ruleId: "CONFIG-003",
+                        severity: "medium",
+                        category: "dependencies",
+                        title: `Dependency review needed: ${dep}`,
+                        description: `${dep} is a commonly exploited dependency. Ensure you are running the latest version with no known vulnerabilities.`,
+                        file: "package.json",
+                        evidence: `${dep}: ${deps[dep]}`,
+                        controlIds: ["CIS-004", "OWASP-ASVS-005"],
+                        fix: "Run npm audit regularly. Update to latest version. Consider automated dependency scanning.",
+                    });
+                }
+            }
+        }
+        catch {
+            // not valid JSON
+        }
+    }
+    checkEnvFiles(ctx, findings) {
+        for (const [filePath, content] of ctx.fileContents) {
+            if (filePath !== ".env" && !filePath.endsWith("/.env") && !filePath.startsWith(".env."))
+                continue;
+            if (filePath.includes("example") || filePath.includes("template"))
+                continue;
+            const lines = content.split("\n");
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i].trim();
+                if (!line || line.startsWith("#"))
+                    continue;
+                if (/\b(PASSWORD|SECRET|KEY|TOKEN|PRIVATE)\b.*=\s*[^\s]/i.test(line) &&
+                    !line.includes("your_") && !line.includes("changeme") && !line.includes("xxx")) {
+                    findings.push({
+                        ruleId: "CONFIG-004",
+                        severity: "critical",
+                        category: "secrets",
+                        title: "Secret with value in .env file",
+                        description: "A .env file contains actual secret values. Ensure .env files are in .gitignore and never committed.",
+                        file: filePath,
+                        line: i + 1,
+                        evidence: line.split("=")[0] + "=***",
+                        controlIds: ["OWASP-ASVS-005", "GDPR-ART32-002"],
+                        fix: "Ensure .env is in .gitignore. Use a secrets management solution for production.",
+                    });
+                }
+            }
+        }
+    }
+    checkDockerConfig(ctx, findings) {
+        const dockerfile = ctx.fileContents.get("Dockerfile");
+        if (dockerfile) {
+            if (/USER\s+root/i.test(dockerfile) || (!/USER\s+/i.test(dockerfile))) {
+                findings.push({
+                    ruleId: "CONFIG-005",
+                    severity: "medium",
+                    category: "infrastructure",
+                    title: "Docker running as root",
+                    description: "Container may be running as root. Use a non-root user for security.",
+                    file: "Dockerfile",
+                    evidence: "No non-root USER directive found",
+                    controlIds: ["CIS-003"],
+                    fix: "Add: USER node (or other non-root user) to your Dockerfile.",
+                });
+            }
+            if (/\bENV\b.*(?:PASSWORD|SECRET|KEY|TOKEN)\s*=\s*\S+/i.test(dockerfile)) {
+                findings.push({
+                    ruleId: "CONFIG-006",
+                    severity: "critical",
+                    category: "secrets",
+                    title: "Secret in Dockerfile ENV",
+                    description: "Secrets must not be baked into Docker images.",
+                    file: "Dockerfile",
+                    evidence: "ENV with secret value",
+                    controlIds: ["OWASP-ASVS-005"],
+                    fix: "Use Docker secrets or environment variables at runtime instead.",
+                });
+            }
+        }
+    }
+    checkTLSConfig(ctx, findings) {
+        for (const [filePath, content] of ctx.fileContents) {
+            if (!filePath.includes(".env") && !filePath.includes("config"))
+                continue;
+            if (/\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*['"]?0['"]?/i.test(content)) {
+                findings.push({
+                    ruleId: "CONFIG-007",
+                    severity: "critical",
+                    category: "encryption",
+                    title: "TLS verification disabled",
+                    description: "NODE_TLS_REJECT_UNAUTHORIZED=0 disables TLS certificate verification, enabling MITM attacks.",
+                    file: filePath,
+                    evidence: "NODE_TLS_REJECT_UNAUTHORIZED=0",
+                    controlIds: ["GDPR-ART32-003", "OWASP-ASVS-006"],
+                    fix: "Remove NODE_TLS_REJECT_UNAUTHORIZED=0. Fix the certificate issue instead.",
+                });
+            }
+        }
+    }
+    checkGitignore(ctx, findings) {
+        const gitignore = ctx.fileContents.get(".gitignore");
+        if (!gitignore) {
+            findings.push({
+                ruleId: "CONFIG-008",
+                severity: "high",
+                category: "security",
+                title: "No .gitignore file",
+                description: "No .gitignore found. Secrets and build artifacts may be committed accidentally.",
+                file: ".gitignore",
+                evidence: "File not found",
+                controlIds: ["OWASP-ASVS-005"],
+                fix: "Create .gitignore with node_modules/, .env, dist/, *.key, etc.",
+            });
+            return;
+        }
+        const required = [".env", "node_modules"];
+        for (const pattern of required) {
+            if (!gitignore.includes(pattern)) {
+                findings.push({
+                    ruleId: "CONFIG-009",
+                    severity: "high",
+                    category: "security",
+                    title: `.gitignore missing ${pattern}`,
+                    description: `${pattern} should be in .gitignore to prevent accidental commits.`,
+                    file: ".gitignore",
+                    evidence: `${pattern} not found in .gitignore`,
+                    controlIds: ["OWASP-ASVS-005"],
+                    fix: `Add ${pattern} to .gitignore.`,
+                });
+            }
+        }
+    }
+    checkLoggingConfig(ctx, findings) {
+        const hasLogging = this.searchContent(ctx, [
+            /winston|pino|bunyan|morgan|helmet/i,
+            /logging|logger/i,
+            /auditLog|audit_log/i,
+        ]);
+        if (!hasLogging) {
+            findings.push({
+                ruleId: "CONFIG-010",
+                severity: "high",
+                category: "audit",
+                title: "No logging framework detected",
+                description: "No logging library or audit logging found. Audit logging is mandatory for GDPR compliance.",
+                file: "project",
+                evidence: "No logging library (winston, pino, etc.) found",
+                controlIds: ["GDPR-ART32-006", "OWASP-ASVS-004"],
+                fix: "Install a logging library (winston or pino) and implement structured audit logging.",
+            });
+        }
+    }
+    searchContent(ctx, patterns) {
+        for (const [, content] of ctx.fileContents) {
+            for (const pattern of patterns) {
+                pattern.lastIndex = 0;
+                if (pattern.test(content))
+                    return true;
+            }
+        }
+        return false;
+    }
+}
+//# sourceMappingURL=config-scanner.js.map