@greenarmor/ges-audit-engine 1.0.1 → 1.1.1

package/dist/index.d.ts

@@ -4,4 +4,16 @@ export declare function runAudit(root: string): {
     findings: Finding[];
     scannedFiles: number;
 };
+export interface AuditCache {
+    [filePath: string]: {
+        hash: string;
+        findings: Finding[];
+    };
+}
+export declare function runAuditIncremental(root: string, cache?: AuditCache): {
+    findings: Finding[];
+    scannedFiles: number;
+    newCache: AuditCache;
+    changedFiles: number;
+};
 export declare function deduplicateFindings(findings: Finding[]): Finding[];

package/dist/index.js

@@ -6,10 +6,11 @@ import { CodeSecurityScanner } from "./scanners/code-security-scanner.js";
 import { AuthScanner } from "./scanners/auth-scanner.js";
 import { ConfigScanner } from "./scanners/config-scanner.js";
 import { DatabaseScanner } from "./scanners/database-scanner.js";
+import { IaCScanner } from "./scanners/iac-scanner.js";
 const IGNORE_DIRS = new Set([
     "node_modules", ".git", "dist", "build", ".next", ".nuxt", "coverage",
     ".ges", "vendor", "__pycache__", ".venv", "venv", ".turbo", ".cache",
-    "reports", "compliance", "security", "controls", "policies", "checklists", "docs",
+    "reports",
     "bundle", ".crush", ".vscode", ".idea",
 ]);
 const SKIP_PATHS = [
@@ -20,8 +21,48 @@ const IGNORE_EXTENSIONS = new Set([
     ".woff2", ".ttf", ".eot", ".mp4", ".mp3", ".zip", ".gz", ".tar",
     ".lock", ".map", ".wasm",
 ]);
+function loadGesIgnore(root) {
+    const ignorePath = path.join(root, ".gesignore");
+    if (!fs.existsSync(ignorePath))
+        return [];
+    try {
+        const content = fs.readFileSync(ignorePath, "utf-8");
+        return content
+            .split("\n")
+            .map(line => line.trim())
+            .filter(line => line.length > 0 && !line.startsWith("#"));
+    }
+    catch {
+        return [];
+    }
+}
+function isIgnored(filePath, patterns) {
+    for (const pattern of patterns) {
+        if (pattern.endsWith("/")) {
+            const dir = pattern.slice(0, -1);
+            if (filePath === dir || filePath.startsWith(dir + "/"))
+                return true;
+        }
+        else if (pattern.startsWith("*.")) {
+            const ext = pattern.slice(1);
+            if (filePath.endsWith(ext))
+                return true;
+        }
+        else if (pattern.includes("*")) {
+            const regex = new RegExp("^" + pattern.replace(/\./g, "\\.").replace(/\*/g, ".*") + "$");
+            if (regex.test(filePath))
+                return true;
+        }
+        else {
+            if (filePath === pattern || filePath.startsWith(pattern + "/"))
+                return true;
+        }
+    }
+    return false;
+}
 function collectFiles(root) {
     const files = [];
+    const ignorePatterns = loadGesIgnore(root);
     function walk(dir) {
         const entries = fs.readdirSync(dir, { withFileTypes: true });
         for (const entry of entries) {
@@ -36,7 +77,9 @@ function collectFiles(root) {
                 if (!IGNORE_EXTENSIONS.has(ext)) {
                     const rel = path.relative(root, fullPath).replace(/\\/g, "/");
                     if (!SKIP_PATHS.some(skip => rel.includes(skip))) {
-                        files.push(rel);
+                        if (!isIgnored(rel, ignorePatterns)) {
+                            files.push(rel);
+                        }
                     }
                 }
             }
@@ -149,6 +192,7 @@ export function runAudit(root) {
         new AuthScanner(),
         new ConfigScanner(),
         new DatabaseScanner(),
+        new IaCScanner(),
     ];
     const allFindings = [];
     for (const scanner of scanners) {
@@ -156,6 +200,87 @@ export function runAudit(root) {
     }
     return { findings: allFindings, scannedFiles: files.length };
 }
+export function runAuditIncremental(root, cache) {
+    const files = collectFiles(root);
+    const fileContents = readFiles(root, files);
+    const oldCache = cache || {};
+    const newCache = {};
+    const changedFiles = [];
+    for (const file of files) {
+        const content = fileContents.get(file) || "";
+        const hash = simpleHash(content);
+        if (oldCache[file] && oldCache[file].hash === hash) {
+            newCache[file] = oldCache[file];
+        }
+        else {
+            changedFiles.push(file);
+            newCache[file] = { hash, findings: [] };
+        }
+    }
+    const isWebProject = detectWebProject(fileContents);
+    const changedContents = new Map();
+    for (const file of changedFiles) {
+        changedContents.set(file, fileContents.get(file) || "");
+    }
+    const ctx = {
+        root,
+        files: changedFiles,
+        fileContents: changedContents,
+        isWebProject,
+    };
+    const fullCtx = {
+        root,
+        files,
+        fileContents,
+        isWebProject,
+    };
+    const perFileScanners = [
+        new SecretsScanner(),
+        new CryptoScanner(),
+        new CodeSecurityScanner(),
+        new DatabaseScanner(),
+        new IaCScanner(),
+    ];
+    const projectScanners = [
+        new AuthScanner(),
+        new ConfigScanner(),
+    ];
+    const changedFindings = [];
+    for (const scanner of perFileScanners) {
+        changedFindings.push(...scanner.scan(ctx));
+    }
+    for (const finding of changedFindings) {
+        if (newCache[finding.file]) {
+            newCache[finding.file].findings.push(finding);
+        }
+    }
+    const projectFindings = [];
+    for (const scanner of projectScanners) {
+        projectFindings.push(...scanner.scan(fullCtx));
+    }
+    const allFindings = [];
+    for (const file of files) {
+        if (newCache[file]) {
+            allFindings.push(...newCache[file].findings);
+        }
+    }
+    allFindings.push(...projectFindings);
+    return {
+        findings: allFindings,
+        scannedFiles: files.length,
+        newCache,
+        changedFiles: changedFiles.length,
+    };
+}
+function simpleHash(content) {
+    let hash = 0;
+    for (let i = 0; i < content.length; i++) {
+        const char = content.charCodeAt(i);
+        hash = (hash << 5) - hash + char;
+        hash |= 0;
+    }
+    return hash.toString(36);
+}
 export function deduplicateFindings(findings) {
     const seen = new Set();
     return findings.filter(f => {

package/dist/scanners/code-security-scanner.js

@@ -5,6 +5,12 @@ const SQL_INJECTION_PATTERNS = [
     { pattern: /INSERT\s+INTO\s+.*VALUES\s*\(.*\+\s*(?:req|params|query|body)/gi, desc: "SQL INSERT with concatenated user input" },
     { pattern: /DELETE\s+FROM\s+.*WHERE\s+.*\+\s*(?:req|params|query|body)/gi, desc: "SQL DELETE with concatenated user input" },
     { pattern: /UPDATE\s+.*SET\s+.*\+\s*(?:req|params|query|body)/gi, desc: "SQL UPDATE with concatenated user input" },
+    { pattern: /(?:execute|cursor\.execute)\s*\(\s*f['"].*\{(?:request|form|args|GET|POST)/gi, desc: "Python f-string SQL injection from request input" },
+    { pattern: /(?:execute|cursor\.execute)\s*\(\s*['"].*%s.*['"].*\+\s*(?:request|form|args)/gi, desc: "Python SQL with string concatenation" },
+    { pattern: /fmt\.Sprintf\s*\(\s*['"].*SELECT.*['"].*,\s*(?:r\.URL|r\.Form|req\.)/gi, desc: "Go SQL injection via fmt.Sprintf with request input" },
+    { pattern: /db\.(Query|Exec|MustExec)\s*\(\s*fmt\.Sprintf/gi, desc: "Go SQL query with fmt.Sprintf (potential injection)" },
+    { pattern: /createQuery\s*\(\s*['"].*\+\s*(?:request|getParameter|req\.)/gi, desc: "Java SQL with string concatenation" },
+    { pattern: /jdbcTemplate.*\+\s*(?:request|getParameter)/gi, desc: "Java Spring SQL injection" },
 ];
 const XSS_PATTERNS = [
     { pattern: /innerHTML\s*=\s*(?:req|params|query|body|input)/gi, desc: "Direct innerHTML assignment from user input" },
@@ -19,8 +25,15 @@ const INPUT_VALIDATION_PATTERNS = [
     { pattern: new RegExp(["F", "u", "n", "c", "t", "i", "o", "n"].join("") + "\\s*\\(\\s*(?:req|params|query|body)", "gi"), desc: ["F", "u", "n", "c", "t", "i", "o", "n"].join("") + " constructor with user input" },
     { pattern: /exec\s*\(\s*(?:req|params|query|body)/gi, desc: "Command execution with user input" },
     { pattern: /child_process.*(?:req|params|query|body)/gi, desc: "Child process with user input" },
+    { pattern: /os\.system\s*\(\s*(?:request|form|args|GET|POST|input)/gi, desc: "Python os.system with user input" },
+    { pattern: /subprocess\.(?:call|run|Popen)\s*\(\s*['"].*\+\s*(?:request|form|args)/gi, desc: "Python subprocess with string concatenation" },
+    { pattern: /eval\s*\(\s*(?:request|form|args|GET|POST|input)/gi, desc: "Python eval with user input" },
+    { pattern: /exec\.Command\s*\(\s*['"].*['"].*,\s*(?:r\.URL|r\.Form|req\.)/gi, desc: "Go exec.Command with request input" },
+    { pattern: /Runtime\.getRuntime\s*\(\s*\)\.exec\s*\(\s*(?:request|getParameter|req\.)/gi, desc: "Java Runtime.exec with request input" },
+    { pattern: /ProcessBuilder.*(?:request|getParameter|args)/gi, desc: "Java ProcessBuilder with request input" },
+    { pattern: /Command::new\s*\(\s*['"].*['"].*\.(?:arg|args)\s*\(\s*(?:req|request|input)/gi, desc: "Rust Command with user input" },
 ];
-const SCAN_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx", ".py", ".rb", ".go", ".java", ".php"]);
+const SCAN_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx", ".py", ".rb", ".go", ".java", ".php", ".rs", ".cs"]);
 export class CodeSecurityScanner {
     name = "code-security";
     scan(ctx) {

package/dist/scanners/crypto-scanner.js

@@ -6,6 +6,13 @@ const WEAK_HASH_PATTERNS = [
     { pattern: /\.digest\s*\(\s*['"]md5['"]\s*\)/gi, algo: "MD5 digest" },
     { pattern: /hashlib\.md5\(/gi, algo: "MD5 (Python)" },
     { pattern: /hashlib\.sha1\(/gi, algo: "SHA1 (Python)" },
+    { pattern: /crypto\/md5\.New\(|md5\.New\(/gi, algo: "MD5 (Go)" },
+    { pattern: /crypto\/sha1\.New\(|sha1\.New\(/gi, algo: "SHA1 (Go)" },
+    { pattern: /MessageDigest\.getInstance\s*\(\s*['"]MD5['"]\s*\)/gi, algo: "MD5 (Java)" },
+    { pattern: /MessageDigest\.getInstance\s*\(\s*['"]SHA-?1['"]\s*\)/gi, algo: "SHA1 (Java)" },
+    { pattern: /md5::compute\(/gi, algo: "MD5 (Rust)" },
+    { pattern: /sha1::Sha1/gi, algo: "SHA1 (Rust)" },
+    { pattern: /Digest::new\s*\(\s*\)/gi, algo: "Potential weak digest (Rust)" },
 ];
 const WEAK_CRYPTO_PATTERNS = [
     { pattern: /\bDES\b|\b3DES\b|\bBlowfish\b/g, algo: "Weak encryption algorithm" },
@@ -13,16 +20,23 @@ const WEAK_CRYPTO_PATTERNS = [
     { pattern: /\bcreateCipher\b\s*\(/g, algo: "Deprecated createCipher (use createCipheriv)" },
     { pattern: /\btc_aes_encrypt\b/gi, algo: "AES-128 (use AES-256)" },
     { pattern: /\bAES.*ECB\b/gi, algo: "AES ECB mode (use GCM or CBC)" },
-    { pattern: /Cipher\s*\(\s*['"]des/gi, algo: "DES cipher (deprecated)" },
+    { pattern: /Cipher\.getInstance\s*\(\s*['"]DES/gi, algo: "DES cipher (Java, deprecated)" },
+    { pattern: /des\.new\s*\(/gi, algo: "DES cipher (Rust, deprecated)" },
+    { pattern: /crypto\/des\.NewCipher\s*\(/gi, algo: "DES cipher (Go, deprecated)" },
+    { pattern: /Crypto\.Cipher\.DES/gi, algo: "DES cipher (Python, deprecated)" },
     { pattern: /\btls\.connect\s*\([^)]*rejectUnauthorized\s*:\s*false/gi, algo: "TLS with certificate verification disabled" },
     { pattern: /process\.env\.NODE_TLS_REJECT_UNAUTHORIZED\s*=\s*['"]0['"]/gi, algo: "TLS verification globally disabled" },
+    { pattern: /InsecureSkipVerify\s*:\s*true/gi, algo: "TLS verification disabled (Go)" },
+    { pattern: /verify_mode\s*=\s*ssl\.CERT_NONE/gi, algo: "TLS verification disabled (Python)" },
+    { pattern: /TrustAllCerts|TrustManager.*X509TrustManager/gi, algo: "TLS verification disabled (Java)" },
+    { pattern: /danger_accept_invalid_certs\s*\(\s*true/gi, algo: "TLS verification disabled (Rust)" },
 ];
 const INSECURE_PASSWORD_PATTERNS = [
     { pattern: /\.compare\s*\(.*,\s*.*\)|bcrypt\.compare|argon2\.verify/gi, check: false, desc: "Secure password comparison" },
     { pattern: /(?:stored|saved|hashed|db|database)\s*\.?\s*(?:password|pw)\s*===?\s*(?:req|input|user|plain|raw)/gi, check: true, desc: "Plaintext password comparison (use Argon2id/bcrypt)" },
     { pattern: /(?:password|pw)\s*===?\s*['"][^'"]{2,}['"]/gi, check: true, desc: "Hardcoded password comparison (use Argon2id/bcrypt)" },
 ];
-const SCAN_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx", ".py", ".rb", ".go", ".java", ".php", ".cs"]);
+const SCAN_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx", ".py", ".rb", ".go", ".java", ".php", ".cs", ".rs"]);
 export class CryptoScanner {
     name = "crypto";
     scan(ctx) {

package/dist/scanners/iac-scanner.d.ts

@@ -0,0 +1,11 @@
+import type { Scanner, Finding, ScanContext } from "./types.js";
+export declare class IaCScanner implements Scanner {
+    name: string;
+    scan(ctx: ScanContext): Finding[];
+    private checkTerraform;
+    private checkS3Buckets;
+    private checkSecurityGroups;
+    private checkDatabases;
+    private checkIAMPolicies;
+    private checkKMSKeys;
+}

package/dist/scanners/iac-scanner.js

@@ -0,0 +1,278 @@
+const IAC_EXTENSIONS = new Set([".tf", ".tfvars", ".cfn", ".yaml", ".yml", ".json", ".dockerfile"]);
+export class IaCScanner {
+    name = "iac";
+    scan(ctx) {
+        const findings = [];
+        this.checkTerraform(ctx, findings);
+        this.checkS3Buckets(ctx, findings);
+        this.checkSecurityGroups(ctx, findings);
+        this.checkDatabases(ctx, findings);
+        this.checkIAMPolicies(ctx, findings);
+        this.checkKMSKeys(ctx, findings);
+        return findings;
+    }
+    checkTerraform(ctx, findings) {
+        for (const [filePath, content] of ctx.fileContents) {
+            if (!filePath.endsWith(".tf"))
+                continue;
+            const lines = content.split("\n");
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i].toLowerCase();
+                if (line.includes("force_destroy") && line.includes("true")) {
+                    findings.push({
+                        ruleId: "IAC-001",
+                        severity: "medium",
+                        category: "infrastructure",
+                        title: "S3 bucket force_destroy enabled",
+                        description: "force_destroy will permanently delete all objects in the bucket when destroyed. This can cause unintended data loss.",
+                        file: filePath,
+                        line: i + 1,
+                        evidence: lines[i].trim(),
+                        controlIds: ["GDPR-ART32-008", "ISO27001-A17"],
+                        fix: "Set force_destroy to false unless this is a temporary bucket.",
+                    });
+                }
+                if (line.includes("0.0.0.0/0") && (line.includes("ingress") || line.includes("cidr_blocks"))) {
+                    findings.push({
+                        ruleId: "IAC-002",
+                        severity: "critical",
+                        category: "infrastructure",
+                        title: "Security group open to the entire internet (0.0.0.0/0)",
+                        description: "Security group rule allows traffic from any IP address. This exposes the resource to the entire internet.",
+                        file: filePath,
+                        line: i + 1,
+                        evidence: lines[i].trim(),
+                        controlIds: ["OWASP-ASVS-006", "ISO27001-A9"],
+                        fix: "Restrict cidr_blocks to specific IP ranges instead of 0.0.0.0/0.",
+                    });
+                }
+                if (line.includes("ssl") && (line.includes("false") || line.includes("disabled"))) {
+                    findings.push({
+                        ruleId: "IAC-003",
+                        severity: "high",
+                        category: "encryption",
+                        title: "SSL/TLS disabled on resource",
+                        description: "SSL/TLS is explicitly disabled. Data in transit will be unencrypted.",
+                        file: filePath,
+                        line: i + 1,
+                        evidence: lines[i].trim(),
+                        controlIds: ["GDPR-ART32-002", "HIPAA-164.312-e"],
+                        fix: "Enable SSL/TLS encryption for all data in transit.",
+                    });
+                }
+            }
+        }
+    }
+    checkS3Buckets(ctx, findings) {
+        for (const [filePath, content] of ctx.fileContents) {
+            if (!filePath.endsWith(".tf") && !filePath.endsWith(".yaml") && !filePath.endsWith(".yml"))
+                continue;
+            if (!content.includes("aws_s3_bucket") && !content.includes("AWS::S3::Bucket"))
+                continue;
+            if (content.includes("acl") && (content.match(/acl\s*=\s*["']public-read["']/) || content.match(/AccessControl.*PublicRead/))) {
+                findings.push({
+                    ruleId: "IAC-004",
+                    severity: "critical",
+                    category: "infrastructure",
+                    title: "S3 bucket set to public-read",
+                    description: "S3 bucket ACL is set to public-read. Anyone on the internet can read the contents.",
+                    file: filePath,
+                    evidence: "acl = public-read or AccessControl: PublicRead",
+                    controlIds: ["GDPR-ART32-002", "OWASP-ASVS-006"],
+                    fix: "Set bucket ACL to private. Use presigned URLs for temporary access.",
+                });
+            }
+            if (!content.includes("server_side_encryption") && !content.includes("BucketEncryption")) {
+                findings.push({
+                    ruleId: "IAC-005",
+                    severity: "high",
+                    category: "encryption",
+                    title: "S3 bucket without server-side encryption",
+                    description: "S3 bucket does not have server-side encryption configured. Data at rest is unencrypted.",
+                    file: filePath,
+                    evidence: "No server_side_encryption or BucketEncryption block found",
+                    controlIds: ["GDPR-ART32-001", "HIPAA-164.312-a"],
+                    fix: "Add server_side_encryption_configuration with AES-256 or AWS KMS.",
+                });
+            }
+            if (!content.includes("versioning") && !content.includes("VersioningConfiguration")) {
+                findings.push({
+                    ruleId: "IAC-006",
+                    severity: "medium",
+                    category: "infrastructure",
+                    title: "S3 bucket without versioning",
+                    description: "S3 bucket does not have versioning enabled. Accidental deletions cannot be recovered.",
+                    file: filePath,
+                    evidence: "No versioning or VersioningConfiguration block found",
+                    controlIds: ["GDPR-ART32-008", "ISO27001-A8"],
+                    fix: "Enable versioning on the bucket to protect against accidental data loss.",
+                });
+            }
+        }
+    }
+    checkSecurityGroups(ctx, findings) {
+        for (const [filePath, content] of ctx.fileContents) {
+            if (!filePath.endsWith(".tf") && !filePath.endsWith(".yaml") && !filePath.endsWith(".yml"))
+                continue;
+            if (!content.includes("security") && !content.includes("SecurityGroup"))
+                continue;
+            const lines = content.split("\n");
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i].toLowerCase();
+                if ((line.includes("from_port") && line.match(/\b22\b/)) || (line.includes("port") && line.match(/\b22\b/))) {
+                    const fullBlock = lines.slice(Math.max(0, i - 5), Math.min(lines.length, i + 10)).join(" ").toLowerCase();
+                    if (fullBlock.includes("0.0.0.0/0")) {
+                        findings.push({
+                            ruleId: "IAC-007",
+                            severity: "critical",
+                            category: "infrastructure",
+                            title: "SSH (port 22) open to the internet",
+                            description: "Security group allows SSH access from 0.0.0.0/0. This is a common attack vector.",
+                            file: filePath,
+                            line: i + 1,
+                            evidence: lines[i].trim(),
+                            controlIds: ["OWASP-ASVS-006", "ISO27001-A9", "CIS-005"],
+                            fix: "Restrict SSH access to specific IP ranges or use a bastion host.",
+                        });
+                    }
+                }
+                if ((line.includes("from_port") && line.match(/\b3306\b/)) || (line.includes("port") && line.match(/\b3306\b/))) {
+                    const fullBlock = lines.slice(Math.max(0, i - 5), Math.min(lines.length, i + 10)).join(" ").toLowerCase();
+                    if (fullBlock.includes("0.0.0.0/0")) {
+                        findings.push({
+                            ruleId: "IAC-008",
+                            severity: "critical",
+                            category: "infrastructure",
+                            title: "Database (port 3306) open to the internet",
+                            description: "Security group allows MySQL access from 0.0.0.0/0. Databases should never be publicly accessible.",
+                            file: filePath,
+                            line: i + 1,
+                            evidence: lines[i].trim(),
+                            controlIds: ["GDPR-ART32-002", "OWASP-ASVS-006"],
+                            fix: "Restrict database access to application servers only.",
+                        });
+                    }
+                }
+                if ((line.includes("from_port") && line.match(/\b5432\b/)) || (line.includes("port") && line.match(/\b5432\b/))) {
+                    const fullBlock = lines.slice(Math.max(0, i - 5), Math.min(lines.length, i + 10)).join(" ").toLowerCase();
+                    if (fullBlock.includes("0.0.0.0/0")) {
+                        findings.push({
+                            ruleId: "IAC-009",
+                            severity: "critical",
+                            category: "infrastructure",
+                            title: "Database (port 5432) open to the internet",
+                            description: "Security group allows PostgreSQL access from 0.0.0.0/0. Databases should never be publicly accessible.",
+                            file: filePath,
+                            line: i + 1,
+                            evidence: lines[i].trim(),
+                            controlIds: ["GDPR-ART32-002", "OWASP-ASVS-006"],
+                            fix: "Restrict database access to application servers only.",
+                        });
+                    }
+                }
+            }
+        }
+    }
+    checkDatabases(ctx, findings) {
+        for (const [filePath, content] of ctx.fileContents) {
+            if (!filePath.endsWith(".tf") && !filePath.endsWith(".yaml") && !filePath.endsWith(".yml"))
+                continue;
+            if (content.includes("aws_db_instance") || content.includes("aws_rds_cluster") || content.includes("AWS::RDS::DBInstance")) {
+                if (content.includes("publicly_accessible") && content.match(/publicly_accessible\s*=\s*true/)) {
+                    findings.push({
+                        ruleId: "IAC-010",
+                        severity: "critical",
+                        category: "infrastructure",
+                        title: "RDS instance publicly accessible",
+                        description: "Database instance is configured as publicly accessible. This exposes the database to the internet.",
+                        file: filePath,
+                        evidence: "publicly_accessible = true",
+                        controlIds: ["GDPR-ART32-002", "OWASP-ASVS-006"],
+                        fix: "Set publicly_accessible to false. Use VPC-only access.",
+                    });
+                }
+                if (!content.includes("storage_encrypted") && !content.includes("StorageEncrypted")) {
+                    findings.push({
+                        ruleId: "IAC-011",
+                        severity: "high",
+                        category: "encryption",
+                        title: "RDS instance without encryption at rest",
+                        description: "Database instance does not have storage encryption enabled. Data at rest is unencrypted.",
+                        file: filePath,
+                        evidence: "No storage_encrypted or StorageEncrypted property found",
+                        controlIds: ["GDPR-ART32-001", "HIPAA-164.312-a"],
+                        fix: "Set storage_encrypted = true or enable StorageEncrypted.",
+                    });
+                }
+                if (!content.includes("deletion_protection") || content.match(/deletion_protection\s*=\s*false/)) {
+                    findings.push({
+                        ruleId: "IAC-012",
+                        severity: "medium",
+                        category: "infrastructure",
+                        title: "RDS instance without deletion protection",
+                        description: "Database instance does not have deletion protection enabled. Accidental deletion can cause data loss.",
+                        file: filePath,
+                        evidence: "deletion_protection missing or set to false",
+                        controlIds: ["GDPR-ART32-008"],
+                        fix: "Set deletion_protection = true for production databases.",
+                    });
+                }
+            }
+        }
+    }
+    checkIAMPolicies(ctx, findings) {
+        for (const [filePath, content] of ctx.fileContents) {
+            if (!filePath.endsWith(".tf") && !filePath.endsWith(".json") && !filePath.endsWith(".yaml") && !filePath.endsWith(".yml"))
+                continue;
+            if (content.includes("Action") && content.includes("Resource")) {
+                if (content.includes('"*"') && content.match(/Action.*\*/)) {
+                    findings.push({
+                        ruleId: "IAC-013",
+                        severity: "high",
+                        category: "infrastructure",
+                        title: "IAM policy with wildcard action",
+                        description: "IAM policy grants all actions (*). This violates least privilege principle.",
+                        file: filePath,
+                        evidence: "Action = * grants full access",
+                        controlIds: ["OWASP-ASVS-003", "ISO27001-A9", "CIS-005"],
+                        fix: "Restrict IAM actions to only those required for the role.",
+                    });
+                }
+                if (content.match(/Resource.*\*/) && content.includes("arn:aws")) {
+                    findings.push({
+                        ruleId: "IAC-014",
+                        severity: "medium",
+                        category: "infrastructure",
+                        title: "IAM policy with wildcard resource",
+                        description: "IAM policy applies to all resources (*). This is overly permissive.",
+                        file: filePath,
+                        evidence: "Resource = * applies to all resources",
+                        controlIds: ["OWASP-ASVS-003", "ISO27001-A9"],
+                        fix: "Specify exact resource ARNs instead of using wildcard.",
+                    });
+                }
+            }
+        }
+    }
+    checkKMSKeys(ctx, findings) {
+        for (const [filePath, content] of ctx.fileContents) {
+            if (!filePath.endsWith(".tf"))
+                continue;
+            if (content.includes("aws_kms_key")) {
+                if (content.match(/enable_key_rotation\s*=\s*false/) || !content.includes("enable_key_rotation")) {
+                    findings.push({
+                        ruleId: "IAC-015",
+                        severity: "medium",
+                        category: "encryption",
+                        title: "KMS key without rotation",
+                        description: "KMS key does not have automatic key rotation enabled. Using the same key long-term increases risk.",
+                        file: filePath,
+                        evidence: "enable_key_rotation missing or set to false",
+                        controlIds: ["GDPR-ART32-001", "ISO27001-A10"],
+                        fix: "Set enable_key_rotation = true on KMS keys.",
+                    });
+                }
+            }
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@greenarmor/ges-audit-engine",
-  "version": "1.0.1",
+  "version": "1.1.1",
   "type": "module",
   "description": "GESF Audit Engine - Audit trails and compliance evaluation",
   "main": "./dist/index.js",
@@ -11,16 +11,17 @@
       "default": "./dist/index.js"
     }
   },
+  "scripts": {
+    "build": "tsc",
+    "clean": "rm -rf dist tsconfig.tsbuildinfo",
+    "test": "vitest run"
+  },
   "dependencies": {
-    "@greenarmor/ges-core": "1.0.1"
+    "@greenarmor/ges-core": "1.1.1"
   },
   "devDependencies": {
     "typescript": "^6.0.0",
-    "@types/node": "^22.0.0"
-  },
-  "scripts": {
-    "build": "tsc",
-    "clean": "rm -rf dist tsconfig.tsbuildinfo",
-    "test": "echo \"no tests yet\""
+    "@types/node": "^22.0.0",
+    "vitest": "^4.1.8"
   }
-}
+}

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2025–2026 greenarmor
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.