@kevinrabun/judges-cli 3.124.0

package/dist/evaluators/app-builder.js

@@ -0,0 +1,155 @@
+/**
+ * App Builder Workflow
+ *
+ * Extracted from the evaluators monolith. Provides a high-level, opinionated
+ * workflow that chains tribunal review → plain-language translation → task planning
+ * for use by AI-powered code review agents and CI/CD pipelines.
+ */
+import { severityRank } from "../dedup.js";
+// ─── Internal Helpers ────────────────────────────────────────────────────────
+function dedupeFindings(findings) {
+    const seen = new Set();
+    const result = [];
+    for (const finding of findings) {
+        const key = `${finding.ruleId}|${finding.title}|${finding.severity}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        result.push(finding);
+    }
+    return result;
+}
+function decideRelease(criticalCount, highCount, score) {
+    if (criticalCount > 0 || score < 60)
+        return "do-not-ship";
+    if (highCount > 0 || score < 80)
+        return "ship-with-caution";
+    return "ship-now";
+}
+function toPlainLanguageFinding(finding) {
+    const severityImpact = {
+        critical: "This can directly cause security incidents, outages, or serious compliance exposure.",
+        high: "This is likely to impact users or operations if left unresolved.",
+        medium: "This can create reliability, maintainability, or quality issues over time.",
+        low: "This is a quality improvement that reduces friction and future rework.",
+        info: "This is guidance to strengthen consistency and engineering hygiene.",
+    };
+    return {
+        ruleId: finding.ruleId,
+        severity: finding.severity,
+        title: finding.title,
+        whatIsWrong: `${finding.title}: ${finding.description}`,
+        whyItMatters: severityImpact[finding.severity],
+        nextAction: finding.recommendation,
+    };
+}
+function pickOwner(finding) {
+    if (/^(UX|A11Y|I18N|ETHICS|COMPAT)-/.test(finding.ruleId))
+        return "product";
+    if (/^(DOC|TEST|MAINT|ERR|CFG)-/.test(finding.ruleId))
+        return "ai";
+    return "developer";
+}
+function pickPriority(severity) {
+    if (severity === "critical")
+        return "P0";
+    if (severity === "high")
+        return "P1";
+    return "P2";
+}
+function pickEffort(finding) {
+    if (finding.severity === "critical")
+        return "L";
+    if (finding.severity === "high")
+        return "M";
+    return finding.lineNumbers && finding.lineNumbers.length > 3 ? "M" : "S";
+}
+function toWorkflowTask(finding) {
+    const owner = pickOwner(finding);
+    const priority = pickPriority(finding.severity);
+    const effort = pickEffort(finding);
+    const aiFixable = owner !== "product";
+    return {
+        priority,
+        owner,
+        effort,
+        ruleId: finding.ruleId,
+        task: `${finding.title} — ${finding.recommendation}`,
+        doneWhen: `A follow-up review no longer reports ${finding.ruleId} and related tests/checks pass.`,
+        aiFixable,
+    };
+}
+// ─── Public API ──────────────────────────────────────────────────────────────
+export function runAppBuilderWorkflow(engine, params) {
+    const maxFindings = Math.max(1, params.maxFindings ?? 10);
+    const maxTasks = Math.max(1, params.maxTasks ?? 20);
+    let mode;
+    let verdict;
+    let score;
+    let findings;
+    if (params.files && params.files.length > 0) {
+        mode = "project";
+        const result = engine.evaluateProject(params.files, params.context, {
+            includeAstFindings: params.includeAstFindings,
+            minConfidence: params.minConfidence,
+        });
+        verdict = result.overallVerdict;
+        score = result.overallScore;
+        findings = [...result.fileResults.flatMap((fr) => fr.findings), ...result.architecturalFindings];
+    }
+    else if (params.changedLines && params.changedLines.length > 0) {
+        if (!params.code || !params.language) {
+            throw new Error("changedLines mode requires both code and language inputs");
+        }
+        mode = "diff";
+        const result = engine.evaluateDiff(params.code, params.language, params.changedLines, params.context, {
+            includeAstFindings: params.includeAstFindings,
+            minConfidence: params.minConfidence,
+        });
+        verdict = result.verdict;
+        score = result.score;
+        findings = result.findings;
+    }
+    else {
+        if (!params.code || !params.language) {
+            throw new Error("code mode requires both code and language, or provide files for project mode");
+        }
+        mode = "code";
+        const result = engine.evaluateWithTribunal(params.code, params.language, params.context, {
+            includeAstFindings: params.includeAstFindings,
+            minConfidence: params.minConfidence,
+        });
+        verdict = result.overallVerdict;
+        score = result.overallScore;
+        findings = result.findings;
+    }
+    const dedupedFindings = dedupeFindings(findings).sort((a, b) => severityRank(b.severity) - severityRank(a.severity));
+    const criticalCount = dedupedFindings.filter((finding) => finding.severity === "critical").length;
+    const highCount = dedupedFindings.filter((finding) => finding.severity === "high").length;
+    const mediumCount = dedupedFindings.filter((finding) => finding.severity === "medium").length;
+    const releaseDecision = decideRelease(criticalCount, highCount, score);
+    const topFindings = dedupedFindings
+        .filter((finding) => ["critical", "high", "medium"].includes(finding.severity))
+        .slice(0, maxFindings);
+    const plainLanguageFindings = topFindings.map(toPlainLanguageFinding);
+    const tasks = dedupedFindings.slice(0, maxTasks).map(toWorkflowTask);
+    const aiFixableNow = tasks.filter((task) => task.aiFixable && (task.priority === "P0" || task.priority === "P1"));
+    const summary = releaseDecision === "do-not-ship"
+        ? "Do not ship yet. Resolve critical risks before release."
+        : releaseDecision === "ship-with-caution"
+            ? "Ship with caution. Address high-priority gaps and monitor closely."
+            : "Ship now. No blocking risks were detected in this review pass.";
+    return {
+        mode,
+        verdict,
+        score,
+        criticalCount,
+        highCount,
+        mediumCount,
+        releaseDecision,
+        summary,
+        plainLanguageFindings,
+        tasks,
+        aiFixableNow,
+    };
+}

package/dist/evaluators/authentication.d.ts

@@ -0,0 +1,2 @@
+import type { Finding, AnalyzeContext } from "../types.js";
+export declare function analyzeAuthentication(code: string, language: string, context?: AnalyzeContext): Finding[];

package/dist/evaluators/authentication.js

@@ -0,0 +1,455 @@
+import { getLineNumbers, getLangLineNumbers, getLangFamily, looksLikeRealCredentialValue, isCommentLine, testCode, isLikelyAnalysisCode as isAnalysisModule, } from "./shared.js";
+import * as LP from "../language-patterns.js";
+function getHardcodedCredentialLinesWithoutPlaceholders(code) {
+    const lines = code.split("\n");
+    const flaggedLines = [];
+    const assignmentPattern = /\b(password|passwd|pwd|secret|api_?key|apikey|token|auth_?token)\b\s*[:=]\s*["'`]([^"'`]{3,})["'`]/gi;
+    // Also match compound identifiers like DB_PASSWORD, ADMIN_SECRET, MY_API_KEY
+    const compoundAssignmentPattern = /\b\w+[_-](password|passwd|pwd|secret|api_?key|apikey|token|auth_?token)\b\s*[:=]\s*["'`]([^"'`]{3,})["'`]/gi;
+    // Also match camelCase identifiers like dockerPassword, awsSecretAccessKey
+    const camelCaseAssignmentPattern = /\b(\w+(?:Password|Passwd|Pwd|Secret|SecretKey|AccessKey|ApiKey|APIKey|Token|AuthToken))\s*[:=]\s*["'`]([^"'`]{3,})["'`]/gi;
+    const nonProductionContextPattern = /\b(?:test|tests|mock|mocks|fixture|fixtures|harness|e2e|example|sample|dummy)\b/i;
+    const productionContextPattern = /\b(?:prod|production|release|deploy|deployment)\b/i;
+    const isLikelyTestModule = /\b(?:describe|it|test)\s*\(/i.test(code);
+    if (isLikelyTestModule && !productionContextPattern.test(code)) {
+        return [];
+    }
+    for (let index = 0; index < lines.length; index += 1) {
+        const line = lines[index];
+        if (isCommentLine(line))
+            continue;
+        // Skip lines where credential keywords appear inside regex literals or test/match calls
+        if (/\/[^/\n]+\/[gimsuy]*/.test(line) && /\.test\s*\(|\.match\s*\(|new\s+RegExp/i.test(line))
+            continue;
+        const matches = [
+            ...line.matchAll(assignmentPattern),
+            ...line.matchAll(compoundAssignmentPattern),
+            ...line.matchAll(camelCaseAssignmentPattern),
+        ];
+        if (matches.length === 0)
+            continue;
+        const contextStart = Math.max(0, index - 2);
+        const contextEnd = Math.min(lines.length, index + 3);
+        const context = lines.slice(contextStart, contextEnd).join("\n");
+        // Strip URLs and domain names before checking non-production context
+        // to avoid false suppression from domains like "api.example.com"
+        const contextWithoutUrls = context
+            .replace(/https?:\/\/[^\s"'`]+/gi, "")
+            .replace(/[a-z0-9-]+\.(?:example|test|localhost)\.[a-z]{2,}/gi, "");
+        const isLikelyNonProductionContext = nonProductionContextPattern.test(contextWithoutUrls) && !productionContextPattern.test(contextWithoutUrls);
+        const hasRealCredential = matches.some((match) => {
+            const value = match[2] ?? "";
+            return looksLikeRealCredentialValue(value);
+        });
+        if (hasRealCredential && !isLikelyNonProductionContext) {
+            flaggedLines.push(index + 1);
+        }
+    }
+    return flaggedLines;
+}
+function getWeakCredentialHashLines(code) {
+    const lines = code.split("\n");
+    const weakHashPattern = /createHash\s*\(\s*["'`](?:md5|sha1|sha256)["'`]\)|(?:\bmd5\b|\bsha1\b)\s*\(/gi;
+    const authContextPattern = /password|passwd|pwd|credential|login|signin|signup|auth|token|session|user/i;
+    const flagged = [];
+    for (let index = 0; index < lines.length; index += 1) {
+        weakHashPattern.lastIndex = 0;
+        if (!weakHashPattern.test(lines[index])) {
+            continue;
+        }
+        const start = Math.max(0, index - 4);
+        const end = Math.min(lines.length - 1, index + 4);
+        const context = lines.slice(start, end + 1).join("\n");
+        if (authContextPattern.test(context)) {
+            flagged.push(index + 1);
+        }
+    }
+    return flagged;
+}
+export function analyzeAuthentication(code, language, context) {
+    const findings = [];
+    let ruleNum = 1;
+    const prefix = "AUTH";
+    const _lang = getLangFamily(language);
+    // Analysis code references password/credential keywords in regex patterns
+    // for detection purposes — these are not actual authentication flows.
+    if (isAnalysisModule(code))
+        return findings;
+    const lines = code.split("\n");
+    // ── AST context (optional — enables decorator and import awareness) ───────
+    const ast = context?.ast;
+    const astImports = new Set((ast?.imports ?? []).map((i) => {
+        const parts = i.split("/");
+        return (i.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0]).toLowerCase();
+    }));
+    const astFunctions = ast?.functions ?? [];
+    // Detect auth-related decorators across all functions
+    const hasAuthDecorator = astFunctions.some((f) => f.decorators?.some((d) => /login_required|requires_auth|Authorize|PreAuthorize|Secured|RequiresAuthentication|authenticate|protected/i.test(d)));
+    // Detect auth library imports via AST
+    const hasAuthImport = astImports.has("passport") ||
+        astImports.has("jsonwebtoken") ||
+        astImports.has("jose") ||
+        astImports.has("bcrypt") ||
+        astImports.has("argon2") ||
+        astImports.has("passport-jwt") ||
+        astImports.has("express-jwt") ||
+        astImports.has("next-auth") ||
+        astImports.has("@auth0/nextjs-auth0");
+    // Hardcoded credentials
+    const credentialLines = getHardcodedCredentialLinesWithoutPlaceholders(code);
+    // Also detect PHP define() with credential constants
+    const defineCredLines = [];
+    const envCredLines = [];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (isCommentLine(line))
+            continue;
+        // PHP define('DB_PASSWORD', 'value') or define('SECRET_KEY', 'value')
+        const defineMatch = line.match(/\bdefine\s*\(\s*['"]([^'"]*(?:password|passwd|pwd|secret|api_?key|apikey|token|auth_?token|db_pass)[^'"]*)['"],\s*['"]([^'"]{3,})['"]/i);
+        if (defineMatch) {
+            const val = defineMatch[2];
+            if (looksLikeRealCredentialValue(val)) {
+                defineCredLines.push(i + 1);
+            }
+        }
+        // Dockerfile ENV with secret values: ENV SECRET_KEY=value or ENV SECRET_KEY value
+        if (/^\s*ENV\s+\w*(?:password|passwd|pwd|secret|api_?key|token|auth_?token|db_pass)\w*[\s=]+/i.test(line)) {
+            // Exclude variable references like ${VAR} or $VAR
+            if (!/\$\{?\w+\}?/.test(line)) {
+                envCredLines.push(i + 1);
+            }
+        }
+    }
+    const allCredLines = [...new Set([...credentialLines, ...defineCredLines, ...envCredLines])].sort((a, b) => a - b);
+    if (allCredLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "critical",
+            title: "Hardcoded credentials in source code",
+            description: `Found ${allCredLines.length} instance(s) of what appears to be hardcoded credentials. Credentials in source code are exposed in version control and cannot be rotated without redeployment.`,
+            lineNumbers: allCredLines,
+            recommendation: "Use environment variables or a secrets manager (Azure Key Vault, AWS Secrets Manager, HashiCorp Vault). Never commit credentials to version control.",
+            reference: "OWASP: Credential Management / CWE-798",
+            suggestedFix: "Replace hardcoded credentials with environment variables: process.env.SECRET_NAME (Node.js), os.environ['SECRET_NAME'] (Python), or inject from a secrets manager.",
+            confidence: 0.9,
+        });
+    }
+    // No auth middleware on routes (multi-language)
+    const routeLines = getLangLineNumbers(code, language, LP.HTTP_ROUTE);
+    // Filter out route-pattern references inside regex/test calls (analysis code, not real routes)
+    const actualRouteLines = routeLines.filter((ln) => {
+        const line = lines[ln - 1] || "";
+        // Skip lines where route patterns appear inside regex literals or match/test calls
+        if (/\/[^/\n]+\/[gimsuy]*/.test(line) && /\.test\s*\(|\.match\s*\(|new\s+RegExp/i.test(line))
+            return false;
+        // Skip lines that are string literal patterns for code analysis (e.g. pattern maps)
+        if (/^\s*["'`].*["'`]\s*[:,]?\s*$/.test(line) && /app\\?\.(?:get|post|put|delete)/i.test(line))
+            return false;
+        return true;
+    });
+    const hasRoutes = actualRouteLines.length > 0;
+    const hasAuthMiddleware = /(?:authenticate|authorize|requireAuth|ensureAuth|isAuthenticated|verifyToken|passport\.authenticate|jwt\.verify|jwt\.decode|jwt\.Parse|jwt\.ParseWithClaims|OAuth2PasswordBearer|DecodingKey|\[Authorize|authMiddleware|auth_middleware|verify_token|check_auth|get_current_user|getCurrentUser|auth\(\)|protect|guard|requireLogin|@login_required|@requires_auth|@Authorize|@PreAuthorize|@Secured)/gi.test(code);
+    // Suppress when endpoints are explicitly marked as public/anonymous or are standard health-check routes
+    const hasPublicEndpointMarker = /(?:public|noAuth|anonymous|unauthenticated|AllowAnonymous|@PermitAll|permitAll|open.?api|isPublic|skipAuth|no.?auth.?required)/i.test(code);
+    const isHealthCheckOnly = actualRouteLines.length > 0 &&
+        actualRouteLines.every((ln) => {
+            const line = lines[ln - 1] || "";
+            return /['"/](?:health|status|metrics|ready|live|liveness|readiness|ping|version|favicon|\.well-known)/i.test(line);
+        });
+    // Suppress when the file is primarily code-analysis / evaluator logic (many regex .test() calls)
+    const regexTestCallCount = (code.match(/\.test\s*\(/g) || []).length;
+    const isLikelyAnalysisCode = regexTestCallCount >= 8;
+    if (hasRoutes &&
+        !hasAuthMiddleware &&
+        !hasPublicEndpointMarker &&
+        !isHealthCheckOnly &&
+        !isLikelyAnalysisCode &&
+        !hasAuthDecorator &&
+        !hasAuthImport &&
+        code.split("\n").length > 20) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "API routes without authentication middleware",
+            description: "API endpoints are defined without any visible authentication middleware. Any client can access these endpoints without proving their identity.",
+            recommendation: "Apply authentication middleware to routes that require it. Use framework-specific auth guards: Express middleware, Python decorators (@login_required), Java annotations (@PreAuthorize), or Go middleware.",
+            reference: "OWASP API Security Top 10: API2 — Broken Authentication",
+            suggestedFix: "Add auth middleware: app.use(authenticateJWT) (Express), @login_required (Django/Flask), @PreAuthorize (Spring), or middleware.Auth(handler) (Go).",
+            confidence: 0.7,
+            isAbsenceBased: true,
+        });
+    }
+    // Token in query parameters
+    const tokenQueryPattern = /req\.query\.(?:token|api_?key|auth|secret|password|access_token)/gi;
+    const tokenQueryLines = getLineNumbers(code, tokenQueryPattern);
+    if (tokenQueryLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "Sensitive tokens passed in query parameters",
+            description: "Authentication tokens or API keys are read from query parameters. Query params appear in server logs, browser history, referrer headers, and proxy logs.",
+            lineNumbers: tokenQueryLines,
+            recommendation: "Pass tokens in the Authorization header (Bearer scheme) or in httpOnly cookies. Never use query parameters for sensitive credentials.",
+            reference: "OWASP: Transport Layer Security / RFC 6750",
+            suggestedFix: "Read tokens from the Authorization header instead: const token = req.headers.authorization?.replace('Bearer ', '');",
+            confidence: 0.9,
+        });
+    }
+    // Weak password hashing (multi-language)
+    const weakHashByLang = getLangLineNumbers(code, language, LP.WEAK_HASH);
+    const weakHashLines = weakHashByLang.length > 0 ? weakHashByLang : getWeakCredentialHashLines(code);
+    if (weakHashLines.length > 0) {
+        // AST: lower confidence when a strong hashing library is imported — the weak
+        // hash may be used for non-credential purposes (checksums, cache keys, etc.)
+        const hasStrongHashImport = astImports.has("bcrypt") || astImports.has("argon2") || astImports.has("scrypt");
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "critical",
+            title: "Weak hashing algorithm for credentials",
+            description: "MD5, SHA1, or SHA256 are fast hash algorithms unsuitable for password storage. They can be brute-forced at billions of hashes per second.",
+            lineNumbers: weakHashLines,
+            recommendation: "Use bcrypt, scrypt, or Argon2 for password hashing. These algorithms are intentionally slow and include salt by default.",
+            reference: "OWASP Password Storage Cheat Sheet / NIST 800-63b",
+            suggestedFix: "Replace with bcrypt/argon2: bcrypt.hash(password, 12) (JS), bcrypt.hashpw(password, bcrypt.gensalt()) (Python), Argon2::default().hash_password() (Rust), BCrypt.HashPassword() (C#).",
+            confidence: hasStrongHashImport ? 0.7 : 0.9,
+        });
+    }
+    // No RBAC / authorization checks
+    const hasRoleCheck = testCode(code, /role|permission|isAdmin|isOwner|canAccess|authorize|requiredRole|hasPermission|checkPermission/gi);
+    if (hasRoutes && !hasRoleCheck && code.split("\n").length > 40) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "No authorization / role-based access control detected",
+            description: "No role or permission checks found. Without authorization, any authenticated user could access any resource, including admin functions.",
+            recommendation: "Implement role-based access control (RBAC) or attribute-based access control (ABAC). Check permissions at each endpoint or resource access.",
+            reference: "OWASP API Security Top 10: API5 — Broken Function Level Authorization",
+            suggestedFix: "Add role-based middleware: const requireRole = (role) => (req, res, next) => { if (req.user.role !== role) return res.status(403).json({ error: 'Forbidden' }); next(); };",
+            confidence: 0.7,
+            isAbsenceBased: true,
+        });
+    }
+    // JWT without verification
+    // This is absence-based in single-file mode: verification middleware often
+    // lives in a separate file from the login/sign endpoint.
+    const hasJwt = testCode(code, /jwt|jsonwebtoken|jose/gi);
+    const hasJwtVerify = testCode(code, /jwt\.verify|jwtVerify|verifyToken|jose\.jwtVerify/gi);
+    const hasJwtSign = testCode(code, /jwt\.sign|jwtSign|signToken/gi);
+    if (hasJwt && hasJwtSign && !hasJwtVerify) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "No JWT verification detected alongside signing",
+            description: "JWT tokens are being created but no verification logic is visible in this file. Verification middleware may exist in another module; in project mode this finding is automatically resolved.",
+            recommendation: "Ensure JWT tokens are verified on every request: check signature, expiration (exp), issuer (iss), and audience (aud).",
+            reference: "RFC 7519: JWT / OWASP JWT Cheat Sheet",
+            suggestedFix: "Add JWT verification: const payload = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'], issuer: 'myapp', audience: 'myapp' });",
+            confidence: 0.55,
+            isAbsenceBased: true,
+            provenance: "absence-of-pattern",
+        });
+    }
+    // JWT decode used for auth decisions without signature verification
+    const hasJwtDecode = testCode(code, /jwt\.decode|jwtDecode|jose\.decodeJwt/gi);
+    const jwtDecodeLines = getLineNumbers(code, /jwt\.decode\s*\(|jwtDecode\s*\(|jose\.decodeJwt\s*\(/gi);
+    // Python PyJWT: jwt.decode(token, key, algorithms=[...]) DOES verify the signature
+    const hasPyJwtVerify = /jwt\.decode\s*\([^)]*,\s*\w+[^)]*algorithms/i.test(code);
+    if (hasJwtDecode && !hasJwtVerify && !hasPyJwtVerify) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "critical",
+            title: "JWT decoded without signature verification",
+            description: "JWT tokens are decoded (jwt.decode) but never verified (jwt.verify). jwt.decode does NOT validate the signature — any attacker can forge tokens with arbitrary claims. This is the 'none algorithm' vulnerability.",
+            lineNumbers: jwtDecodeLines,
+            recommendation: "Always use jwt.verify() with a secret/key and explicit algorithm restriction. Never use jwt.decode() for authorization decisions.",
+            reference: "CWE-347: Improper Verification of Cryptographic Signature / OWASP JWT Cheat Sheet",
+            suggestedFix: "Replace jwt.decode(token) with jwt.verify(token, secret, { algorithms: ['HS256'] }). Never trust decoded JWT claims without verifying the signature.",
+            confidence: 0.95,
+        });
+    }
+    // JWT 'none' algorithm — accepting unsigned tokens
+    {
+        const jwtNoneLines = [];
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            // algorithms: ['none'] or ['HS256','none'] or algorithm: 'none'
+            if (/algorithm[s]?\s*[:=].*['"]none['"]/i.test(line)) {
+                jwtNoneLines.push(i + 1);
+            }
+            // Explicitly passing empty string as secret with jwt.sign/verify
+            if (/jwt\.(?:sign|verify)\s*\([^,]+,\s*['"](?:['"]|\s*$)/i.test(line)) {
+                jwtNoneLines.push(i + 1);
+            }
+        }
+        if (jwtNoneLines.length > 0) {
+            findings.push({
+                ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+                severity: "critical",
+                title: "JWT 'none' algorithm accepted — unsigned tokens",
+                description: "The JWT configuration accepts the 'none' algorithm, allowing attackers to forge tokens without any cryptographic signature. This completely bypasses authentication.",
+                lineNumbers: jwtNoneLines,
+                recommendation: "Never accept the 'none' algorithm. Explicitly whitelist strong algorithms: { algorithms: ['HS256'] } or { algorithms: ['RS256'] }.",
+                reference: "CWE-327: Use of a Broken Crypto Algorithm / JWT 'none' Attack",
+                suggestedFix: "Restrict algorithms: jwt.verify(token, secret, { algorithms: ['HS256'] }); — remove 'none' from any algorithm list.",
+                confidence: 0.95,
+            });
+        }
+    }
+    // Timing-unsafe comparison of secrets/tokens/signatures
+    const timingLines = [];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // Detect === or == comparison of variables named secret/token/signature/hash/hmac/expected/digest
+        if (/(?:secret|token|signature|hash|hmac|expected|digest|apiKey|api_key)\s*===?\s*\w|(?:\w)\s*===?\s*(?:secret|token|signature|hash|hmac|expected|digest|apiKey|api_key)/i.test(line)) {
+            // Make sure it's actually a comparison, not assignment
+            if (/===|==[^=]/.test(line)) {
+                timingLines.push(i + 1);
+            }
+        }
+    }
+    const hasTimingSafe = testCode(code, /timingSafeEqual|constantTimeCompare|constant_time_compare|secure_compare|MessageDigest\.isEqual|hmac\.Equal|subtle\.ConstantTimeCompare/gi);
+    if (timingLines.length > 0 && !hasTimingSafe) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "Timing-unsafe comparison of secrets or signatures",
+            description: "Secrets, tokens, or cryptographic signatures are compared using === or == instead of a constant-time comparison function. An attacker can measure response times to deduce the expected value byte-by-byte.",
+            lineNumbers: timingLines,
+            recommendation: "Use crypto.timingSafeEqual() (Node.js), hmac.compare_digest() (Python), MessageDigest.isEqual() (Java), subtle.ConstantTimeCompare() (Go), or equivalent constant-time comparison.",
+            reference: "CWE-208: Observable Timing Discrepancy",
+            suggestedFix: "Replace `if (a === b)` with `if (crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b)))` to prevent timing attacks.",
+            confidence: 0.85,
+        });
+    }
+    // Disabled TLS / certificate validation (multi-language)
+    const tlsLines = getLangLineNumbers(code, language, LP.TLS_DISABLED);
+    if (tlsLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "critical",
+            title: "TLS certificate validation disabled",
+            description: "TLS certificate verification is disabled, allowing man-in-the-middle attacks. Authentication credentials sent over this connection can be intercepted.",
+            lineNumbers: tlsLines,
+            recommendation: "Never disable TLS verification in production. Fix certificate issues properly. Use CA bundles for self-signed certs in development only.",
+            reference: "CWE-295: Improper Certificate Validation",
+            suggestedFix: "Remove TLS bypass: delete rejectUnauthorized:false (JS), verify=False (Python), InsecureSkipVerify:true (Go), danger_accept_invalid_certs(true) (Rust), TrustAllCerts (Java).",
+            confidence: 0.9,
+        });
+    }
+    // No session expiration / no token expiry
+    const hasSession = testCode(code, /session|express-session|cookie-session|SessionMiddleware/gi);
+    const hasExpiry = testCode(code, /maxAge|expires|expiresIn|exp:|ttl|timeout.*session|cookie.*max/gi);
+    if (hasSession && !hasExpiry) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "Sessions without expiration configured",
+            description: "Session middleware is used without visible expiration settings. Sessions that never expire allow stolen session tokens to be used indefinitely.",
+            recommendation: "Set session maxAge (e.g., 30 minutes for sensitive apps). Implement idle timeout. Invalidate sessions on password change or logout.",
+            reference: "OWASP Session Management Cheat Sheet",
+            suggestedFix: "Set session expiry: app.use(session({ cookie: { maxAge: 30 * 60 * 1000 }, rolling: true })); and invalidate sessions on password change.",
+            confidence: 0.7,
+            isAbsenceBased: true,
+        });
+    }
+    // Weak password policy — no complexity enforcement
+    const hasUserRegistration = testCode(code, /register|signup|sign.?up|createUser|create.*user|new.*user/gi);
+    const hasPasswordPolicy = /minLength|minimum.*length|password.*length|complexity|strongPassword|zxcvbn|password.*policy|password.*require/gi.test(code);
+    if (hasUserRegistration && !hasPasswordPolicy) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "No password complexity enforcement",
+            description: "User registration logic without visible password policy. Users can set weak passwords like '123456' or 'password', which are trivially guessable.",
+            recommendation: "Enforce minimum password length (12+ chars), check against known breached passwords (HaveIBeenPwned API), and use a strength estimator like zxcvbn.",
+            reference: "NIST 800-63b / OWASP Password Guidelines",
+            suggestedFix: "Enforce password policy: if (password.length < 12) throw new Error('Min 12 chars'); and check against breached passwords via the HaveIBeenPwned API.",
+            confidence: 0.7,
+            isAbsenceBased: true,
+        });
+    }
+    // No account lockout after failed attempts
+    const hasLogin = testCode(code, /login|signin|sign.?in|authenticate|verifyPassword|checkPassword/gi);
+    const hasLockout = testCode(code, /lockout|lock.*out|attempt|maxAttempt|failedAttempt|rateLimitLogin|brute.?force|account.*lock/gi);
+    if (hasLogin && !hasLockout) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "No account lockout after failed login attempts",
+            description: "Login logic without account lockout or rate limiting. Attackers can brute-force passwords by trying unlimited login attempts.",
+            recommendation: "Implement progressive delays or temporary lockout after 5-10 failed attempts. Use rate limiting on login endpoints. Consider CAPTCHA for repeated failures.",
+            reference: "OWASP Brute Force Prevention / CWE-307",
+            suggestedFix: "Add rate limiting and lockout: after 5 failed attempts, lock the account for 15 minutes. Use express-rate-limit on the login endpoint.",
+            confidence: 0.7,
+            isAbsenceBased: true,
+        });
+    }
+    // Cookie without Secure and HttpOnly flags
+    const cookiePattern = /(?:cookie|Cookie|set-cookie|setCookie|res\.cookie)\s*\(/gi;
+    const cookieLines = getLineNumbers(code, cookiePattern);
+    const hasSecureFlags = testCode(code, /secure\s*:\s*true|httpOnly\s*:\s*true|HttpOnly|Secure/g);
+    if (cookieLines.length > 0 && !hasSecureFlags) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "Cookies set without Secure/HttpOnly flags",
+            description: "Cookies are set without Secure (HTTPS-only) or HttpOnly (no JS access) flags. This exposes cookies to interception and XSS-based theft.",
+            lineNumbers: cookieLines,
+            recommendation: "Set cookies with { secure: true, httpOnly: true, sameSite: 'strict' }. Use Secure for all auth cookies. HttpOnly prevents JavaScript access.",
+            reference: "OWASP Secure Cookie Best Practices / CWE-614",
+            suggestedFix: "Add security flags: res.cookie('session', token, { httpOnly: true, secure: true, sameSite: 'strict' });",
+            confidence: 0.8,
+        });
+    }
+    // No CSRF protection
+    const hasFormPost = testCode(code, /app\.post\s*\(|method\s*=\s*["']POST/gi);
+    const hasCsrf = testCode(code, /csrf|csurf|xsrf|_token|csrfToken|antiForgery|X-CSRF|X-XSRF/gi);
+    if (hasFormPost && !hasCsrf && hasSession) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "No CSRF protection on form submissions",
+            description: "POST endpoints with session-based auth but no CSRF tokens. Attackers can craft pages that submit forms on behalf of authenticated users.",
+            recommendation: "Use CSRF tokens (csurf middleware, Django CSRF, Rails authenticity_token). Set SameSite=Strict on cookies. Use custom headers for API calls.",
+            reference: "OWASP CSRF Prevention Cheat Sheet / CWE-352",
+            suggestedFix: "Add CSRF middleware: app.use(csrf({ cookie: { sameSite: 'strict' } })); and include the token in forms: <input type='hidden' name='_csrf' value='{{csrfToken}}'>.",
+            confidence: 0.8,
+            isAbsenceBased: true,
+        });
+    }
+    // Session fixation — no session regeneration after login
+    const hasLoginHandler = /(?:login|signin|sign.?in|authenticate)\s*(?:=|=>|\(|async)|(?:\.post|\.get|\.put)\s*\(\s*["'][^"']*(?:login|signin|sign.?in|auth)["']/gi.test(code);
+    const hasSessionUsage = testCode(code, /req\.session|session\[|session\./gi);
+    const hasSessionRegen = testCode(code, /session\.regenerate|regenerateSession|session\.cycle|rotate.*session|new.*session|session\.create/gi);
+    if (hasLoginHandler && hasSessionUsage && !hasSessionRegen && code.split("\n").length > 10) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "No session regeneration after authentication",
+            description: "Login handler uses sessions but does not regenerate the session ID after successful authentication. This enables session fixation attacks where an attacker pre-sets the session ID.",
+            recommendation: "Call req.session.regenerate() (Express), session.cycle() (Phoenix), or equivalent immediately after successful login. This invalidates the pre-authentication session ID.",
+            reference: "OWASP Session Fixation — CWE-384",
+            suggestedFix: "Regenerate session after login: req.session.regenerate((err) => { req.session.userId = user.id; res.redirect('/dashboard'); });",
+            confidence: 0.8,
+            isAbsenceBased: true,
+        });
+    }
+    // No MFA/2FA consideration in authentication flows
+    const hasAuthFlow = /(?:login|signin|sign.?in|authenticate|password.*reset|change.*password)\s*(?:\(|=>|=|async)|(?:\.post|\.get|\.put)\s*\(\s*["'][^"']*(?:login|signin|sign.?in|auth|password)["']/gi.test(code);
+    const hasProtectedOps = /(?:transfer|payment|withdraw|approve|delete.*account|change.*email|wire|payout)/gi.test(code);
+    const hasMfa = /(?:mfa|2fa|two.?factor|totp|otp|authenticator|verification.?code|sms.?code|security.?code|second.?factor)/gi.test(code);
+    if ((hasAuthFlow || hasProtectedOps) && !hasMfa && code.split("\n").length > 40) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum).padStart(3, "0")}`,
+            severity: "medium",
+            title: "No MFA/2FA consideration in authentication flow",
+            description: "Authentication or sensitive operation flow with no references to multi-factor authentication. Password-only auth is insufficient for protecting high-value operations.",
+            recommendation: "Implement or integrate MFA (TOTP, WebAuthn, SMS). At minimum, support optional MFA for users and require it for admin/sensitive operations. Consider FIDO2/WebAuthn for phishing-resistant auth.",
+            reference: "NIST 800-63B / OWASP MFA Cheat Sheet",
+            suggestedFix: "Integrate TOTP-based MFA: const verified = speakeasy.totp.verify({ secret: user.mfaSecret, token: req.body.totpCode }); and require MFA for admin and sensitive operations.",
+            confidence: 0.7,
+            isAbsenceBased: true,
+        });
+    }
+    return findings;
+}

package/dist/evaluators/backwards-compatibility.d.ts

@@ -0,0 +1,2 @@
+import type { Finding } from "../types.js";
+export declare function analyzeBackwardsCompatibility(code: string, language: string): Finding[];