@kevinrabun/judges-cli 3.124.0

package/dist/evaluators/internationalization.js

@@ -0,0 +1,287 @@
+import { getLangFamily, isCommentLine, isLikelyAnalysisCode, testCode } from "./shared.js";
+export function analyzeInternationalization(code, language) {
+    const findings = [];
+    const lines = code.split("\n");
+    const prefix = "I18N";
+    let ruleNum = 1;
+    const _lang = getLangFamily(language);
+    // Analysis code has `title:` and `description:` properties for machine-
+    // readable finding output — not user-facing strings that need translation.
+    if (isLikelyAnalysisCode(code))
+        return findings;
+    // Detect hardcoded user-facing strings in UI code
+    const hardcodedStringLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        // Look for JSX text content or UI labels
+        if (/>[\s]*[A-Z][a-z]+[\s\w]+<\//i.test(line) && !/translate|t\(|i18n|intl|formatMessage/i.test(line)) {
+            hardcodedStringLines.push(i + 1);
+        }
+        // Look for label/title/placeholder with hardcoded strings
+        if (/(?:label|title|placeholder|aria-label)\s*[=:]\s*["'`][A-Z]/i.test(line) &&
+            !/translate|t\(|i18n|intl|formatMessage/i.test(line) &&
+            // Skip framework/API metadata (e.g., FastAPI title=, OpenAPI description=)
+            !/(?:FastAPI|Flask|App|Blueprint|Swagger|OpenAPI|APIRouter)\s*\(/i.test(line)) {
+            hardcodedStringLines.push(i + 1);
+        }
+    });
+    if (hardcodedStringLines.length > 5) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Hardcoded user-facing strings",
+            description: "User-facing text is hardcoded instead of using an internationalization framework, making translation impossible.",
+            lineNumbers: [...new Set(hardcodedStringLines)].slice(0, 8),
+            recommendation: "Use an i18n library (react-intl, i18next, vue-i18n) and extract strings to translation files.",
+            reference: "Internationalization Best Practices",
+            suggestedFix: "Replace hardcoded text with translation keys: use t('greeting_message') or <FormattedMessage id='greeting_message' /> instead of inline strings.",
+            confidence: 0.75,
+        });
+    }
+    // Detect string concatenation for user messages
+    const concatMsgLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        if (/["'][^"']*["']\s*\+\s*\w+\s*\+\s*["']/i.test(line) &&
+            /(?:message|msg|text|label|title|error|warning|alert|toast)/i.test(line)) {
+            concatMsgLines.push(i + 1);
+        }
+    });
+    if (concatMsgLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "String concatenation for user messages",
+            description: "Building user-facing messages with string concatenation doesn't work with i18n because word order varies by language.",
+            lineNumbers: concatMsgLines,
+            recommendation: "Use parameterized translation strings with named placeholders: t('greeting', { name }) instead of 'Hello ' + name.",
+            reference: "ICU MessageFormat / i18n Parameterization",
+            suggestedFix: "Replace string concatenation with parameterized translations: t('greeting', { name }) instead of 'Hello ' + name + '!'.",
+            confidence: 0.75,
+        });
+    }
+    // Detect locale-sensitive operations without locale
+    const localeSensitiveLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        if (/\.toLocaleDateString\s*\(\s*\)|\.toLocaleString\s*\(\s*\)|new\s+Date\(\)\.toString\(\)/i.test(line)) {
+            localeSensitiveLines.push(i + 1);
+        }
+        // Sort with comparison callback using < or > (locale-unaware string ordering)
+        if (/\.sort\s*\(\s*\(.*\)\s*=>\s*\w+\s*[<>]\s*\w+/i.test(line) && /name|label|title/i.test(line)) {
+            localeSensitiveLines.push(i + 1);
+        }
+        // Bare .sort() without arguments — uses UTF-16 code unit order, not locale-aware
+        if (/\.sort\s*\(\s*\)/.test(line) && !/Intl\.Collator|localeCompare/i.test(line)) {
+            localeSensitiveLines.push(i + 1);
+        }
+        // toLowerCase()/toUpperCase() for comparison — locale-sensitive (Turkish İ/i issue)
+        if (/\.(?:toLowerCase|toUpperCase)\s*\(\s*\)/.test(line) &&
+            /filter|search|find|includes|compare|match|query/i.test(line) &&
+            !/Intl|locale|toLocale/i.test(line)) {
+            localeSensitiveLines.push(i + 1);
+        }
+        // Standalone locale-unaware string comparison function
+        if (/\w+\s*[<>]\s*\w+\s*\?/.test(line) &&
+            /compare|sort|order/i.test(lines.slice(Math.max(0, i - 3), i + 1).join("\n"))) {
+            localeSensitiveLines.push(i + 1);
+        }
+    });
+    if (localeSensitiveLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "Locale-sensitive operation without explicit locale",
+            description: "Date formatting and string sorting without explicit locale will behave inconsistently across different user environments.",
+            lineNumbers: localeSensitiveLines,
+            recommendation: "Pass explicit locale to toLocaleDateString(), use Intl.DateTimeFormat, and Intl.Collator for string comparison.",
+            reference: "JavaScript Intl API",
+            suggestedFix: "Pass an explicit locale argument: date.toLocaleDateString(userLocale) or new Intl.DateTimeFormat(userLocale).format(date).",
+            confidence: 0.85,
+        });
+    }
+    // Detect hardcoded currency symbols
+    // Avoid matching plain template literals like `${var}` — require a dollar sign
+    // followed by a digit or by an interpolation that itself is preceded by another dollar sign (e.g. `$${amount}`)
+    const currencyLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        if (/["']\$\d|["']\$["']\s*\+|`\s*\$\s*\$\{|["`']\s*€|["`']\s*£|["`']\s*¥/i.test(line)) {
+            currencyLines.push(i + 1);
+        }
+    });
+    if (currencyLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Hardcoded currency formatting",
+            description: "Hardcoded currency symbols and formatting don't account for different currencies, decimal separators, and symbol positions.",
+            lineNumbers: currencyLines,
+            recommendation: "Use Intl.NumberFormat with style: 'currency' for locale-aware currency formatting.",
+            reference: "JavaScript Intl.NumberFormat",
+            suggestedFix: "Replace hardcoded currency symbols with Intl.NumberFormat: new Intl.NumberFormat(locale, { style: 'currency', currency: currencyCode }).format(amount).",
+            confidence: 0.85,
+        });
+    }
+    // Detect text direction assumptions
+    const ltrAssumptionLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        // CSS syntax: text-align: left, padding-left, margin-left
+        if (/text-align\s*:\s*left|padding-left|margin-left:\s*auto|float\s*:\s*left/i.test(line) &&
+            /header|nav|menu|sidebar/i.test(lines.slice(Math.max(0, i - 3), i + 1).join("\n"))) {
+            ltrAssumptionLines.push(i + 1);
+        }
+        // JSX inline style: textAlign: "left", paddingLeft, marginLeft, marginRight
+        if (/\b(?:textAlign)\s*:\s*["']left["']|\b(?:paddingLeft|marginRight)\s*:\s*\d/i.test(line) &&
+            !/paddingRight|marginLeft/i.test(line) // only flag if not bidirectional
+        ) {
+            ltrAssumptionLines.push(i + 1);
+        }
+    });
+    if (ltrAssumptionLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "Assumed left-to-right text direction",
+            description: "Hardcoded left/right positioning in layout elements doesn't support right-to-left (RTL) languages like Arabic or Hebrew.",
+            lineNumbers: ltrAssumptionLines,
+            recommendation: "Use logical CSS properties (inline-start/inline-end) or CSS logical properties (margin-inline-start) instead of left/right.",
+            reference: "CSS Logical Properties / RTL Support",
+            suggestedFix: "Replace directional CSS with logical properties: use margin-inline-start instead of margin-left and text-align: start instead of text-align: left.",
+            confidence: 0.8,
+        });
+    }
+    // Detect hardcoded pluralization
+    const pluralLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        if (/count\s*===?\s*1\s*\?\s*["'`].*["'`]\s*:\s*["'`].*s["'`]/i.test(line) ||
+            /\+\s*["'`]\s*items?["'`]/i.test(line)) {
+            pluralLines.push(i + 1);
+        }
+    });
+    if (pluralLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Hardcoded pluralization logic",
+            description: "Manual pluralization (adding 's') doesn't work for all languages. Many languages have complex plural forms (e.g., Arabic has 6 forms).",
+            lineNumbers: pluralLines,
+            recommendation: "Use ICU MessageFormat plural syntax or i18n library plural support: t('items', { count }).",
+            reference: "CLDR Plural Rules / ICU MessageFormat",
+            suggestedFix: "Use ICU plural syntax in translation keys: '{count, plural, one {# item} other {# items}}' instead of manual count === 1 ternary logic.",
+            confidence: 0.85,
+        });
+    }
+    // Detect hardcoded date/number formats
+    const formatLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        if (/\.toFixed\s*\(\s*2\s*\)/.test(line) && /price|amount|cost|total/i.test(line)) {
+            formatLines.push(i + 1);
+        }
+        if (/\d{2}\/\d{2}\/\d{4}|MM\/DD\/YYYY|DD\/MM\/YYYY/i.test(line)) {
+            formatLines.push(i + 1);
+        }
+    });
+    if (formatLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "Hardcoded date or number format",
+            description: "Date formats (MM/DD vs DD/MM) and number formats (decimal separators) differ across locales.",
+            lineNumbers: [...new Set(formatLines)],
+            recommendation: "Use Intl.DateTimeFormat and Intl.NumberFormat for locale-aware formatting. Never hardcode date patterns.",
+            reference: "JavaScript Intl API / CLDR",
+            suggestedFix: "Replace hardcoded format patterns with Intl APIs: new Intl.DateTimeFormat(locale, { dateStyle: 'short' }).format(date) instead of MM/DD/YYYY strings.",
+            confidence: 0.85,
+        });
+    }
+    // Detect hardcoded phone/address formats
+    const phoneFormatLines = [];
+    lines.forEach((line, i) => {
+        if (isCommentLine(line))
+            return;
+        if (/\(\d{3}\)\s*\d{3}-\d{4}|phone.*format|zip.*code.*\d{5}/i.test(line)) {
+            phoneFormatLines.push(i + 1);
+        }
+    });
+    if (phoneFormatLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "US-specific format assumptions",
+            description: "Phone number or zip code format validation assumes US format, which will reject valid international formats.",
+            lineNumbers: phoneFormatLines,
+            recommendation: "Use libraries like libphonenumber for phone validation, and flexible address components for international addresses.",
+            reference: "International Phone Numbers / Address Standards",
+            suggestedFix: "Use google-libphonenumber for phone validation and accept international postal codes instead of enforcing US-only zip code patterns.",
+            confidence: 0.9,
+        });
+    }
+    // Detect missing text encoding considerations
+    const hasEncoding = testCode(code, /utf-8|utf8|encoding|charset/i);
+    const handlesText = testCode(code, /readFile|writeFile|fetch|response\.text|Buffer\.from/i);
+    // Suppress for directory / module-loader files — readdir, dynamic imports,
+    // and require() are filesystem navigation, not text-content I/O.
+    const isDirOrModuleLoader = /readdir|readdirSync|opendir|scandir|glob|walkDir|import\s*\(|require\s*\(|require\.resolve|__dirname|path\.(?:join|resolve|dirname)|export\s*\{[^}]*\}\s*from\s/i.test(code);
+    if (handlesText && !hasEncoding && !isDirOrModuleLoader && lines.length > 50) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "No text encoding specification detected",
+            description: "File/text operations without explicit encoding specification may produce garbled text for non-ASCII characters.",
+            recommendation: "Always specify UTF-8 encoding when reading/writing text files. Set charset=utf-8 in Content-Type headers.",
+            reference: "Unicode / UTF-8 Best Practices",
+            suggestedFix: "Specify encoding explicitly: fs.readFileSync(path, 'utf-8') and set Content-Type: 'application/json; charset=utf-8' in HTTP responses.",
+            confidence: 0.7,
+            isAbsenceBased: true,
+        });
+    }
+    // Detect raw number formatting without locale awareness
+    // Skip entirely when the code already uses Intl plural/number/date APIs —
+    // template literals like `${count} items` inside Intl.PluralRules plural
+    // forms are the correct i18n pattern, not raw formatting.
+    const usesIntlApis = /Intl\.(?:PluralRules|NumberFormat|DateTimeFormat)/i.test(code);
+    const rawNumberLines = [];
+    if (!usesIntlApis) {
+        lines.forEach((line, i) => {
+            if (isCommentLine(line))
+                return;
+            // Detect Number().toString(), String(number), or template literals with numeric variables without Intl
+            if (/(?:\.toString\(\)|String\(\w+\)|\$\{\w+\})\s*/.test(line) &&
+                /(?:price|amount|cost|total|quantity|count|balance|salary|revenue)/i.test(line) &&
+                !/Intl|toLocaleString|NumberFormat|i18n|formatNumber/i.test(line)) {
+                rawNumberLines.push(i + 1);
+            }
+            // Detect manual thousand separators or decimal formatting
+            if (/\.replace\(\s*\/\\B\(?=\(\\d\{3\}\)\+\(?!\\d\)\)\/|\.toFixed\s*\(\s*\d\s*\)\s*(?!\s*\))/.test(line) &&
+                /(?:price|amount|cost|total|balance)/i.test(line) &&
+                !/Intl|NumberFormat/i.test(line)) {
+                rawNumberLines.push(i + 1);
+            }
+        });
+    }
+    if (rawNumberLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Numeric values formatted without locale awareness",
+            description: "Monetary or numeric values are formatted without using locale-aware APIs. Thousand separators (1,000 vs 1.000) and decimal marks vary by locale.",
+            lineNumbers: [...new Set(rawNumberLines)],
+            recommendation: "Use Intl.NumberFormat for all user-facing numbers: new Intl.NumberFormat(locale, { style: 'currency', currency }).format(amount).",
+            reference: "JavaScript Intl.NumberFormat / CLDR Number Patterns",
+            suggestedFix: "Format numbers with Intl: new Intl.NumberFormat(userLocale, { style: 'currency', currency: 'USD' }).format(amount); instead of manual formatting.",
+            confidence: 0.8,
+        });
+    }
+    return findings;
+}

package/dist/evaluators/judge-selector.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Adaptive judge selection — picks only the judges relevant to a given file
+ * based on language, framework, file role, and project context.
+ *
+ * Eliminates wasted work (e.g. running "testing" judge on a Dockerfile,
+ * or "iac-security" on a React component) while keeping the full panel
+ * available for explicit requests.
+ */
+import type { JudgeDefinition, JudgeSelectionContext, JudgeSelectionResult } from "../types.js";
+/**
+ * Select the most relevant judges for a given file context.
+ *
+ * Strategy:
+ * 1. Always include core judges (security, false-positive-review)
+ * 2. Skip judges with language incompatibility
+ * 3. Skip judges irrelevant to the file category
+ * 4. Return selection with skip reasons for observability
+ */
+export declare function selectJudges(judges: JudgeDefinition[], ctx: JudgeSelectionContext): JudgeSelectionResult;

package/dist/evaluators/judge-selector.js

@@ -0,0 +1,141 @@
+/**
+ * Adaptive judge selection — picks only the judges relevant to a given file
+ * based on language, framework, file role, and project context.
+ *
+ * Eliminates wasted work (e.g. running "testing" judge on a Dockerfile,
+ * or "iac-security" on a React component) while keeping the full panel
+ * available for explicit requests.
+ */
+// ─── Language → judge relevance ──────────────────────────────────────────────
+/**
+ * Judges that are ONLY relevant for specific language families.
+ * If the language isn't listed, the judge is skipped.
+ * Most judges are language-agnostic and not listed here.
+ */
+const LANGUAGE_SPECIFIC = {
+    // IaC judges only apply to infrastructure languages
+    "iac-security": new Set(["terraform", "bicep", "arm", "dockerfile", "yaml"]),
+};
+/**
+ * Judges to SKIP for specific languages — inverse of above.
+ * E.g. testing patterns don't apply to SQL or Dockerfile.
+ */
+const LANGUAGE_SKIP = {
+    testing: new Set(["sql", "dockerfile", "terraform", "bicep", "arm", "yaml"]),
+    documentation: new Set(["sql", "dockerfile", "terraform", "bicep", "arm"]),
+    "code-structure": new Set(["sql", "dockerfile", "yaml"]),
+    ux: new Set(["sql", "dockerfile", "terraform", "bicep", "arm", "bash", "powershell"]),
+    accessibility: new Set(["sql", "dockerfile", "terraform", "bicep", "arm", "bash", "powershell"]),
+    internationalization: new Set(["sql", "dockerfile", "terraform", "bicep", "arm"]),
+    concurrency: new Set(["sql", "dockerfile", "terraform", "bicep", "arm", "yaml"]),
+    "over-engineering": new Set(["sql", "dockerfile", "terraform", "bicep", "arm", "yaml"]),
+};
+// ─── File category → judge relevance ────────────────────────────────────────
+/**
+ * Judges to skip when evaluating test files — noise reduction.
+ */
+const SKIP_FOR_TESTS = new Set([
+    "documentation",
+    "rate-limiting",
+    "scalability",
+    "cloud-readiness",
+    "ci-cd",
+    "configuration-management",
+    "cost-effectiveness",
+    "data-sovereignty",
+    "compliance",
+    "internationalization",
+    "ux",
+    "accessibility",
+    "observability",
+]);
+/**
+ * Judges to skip for config/manifest files.
+ */
+const SKIP_FOR_CONFIG = new Set([
+    "testing",
+    "documentation",
+    "code-structure",
+    "error-handling",
+    "performance",
+    "concurrency",
+    "scalability",
+    "ux",
+    "accessibility",
+    "internationalization",
+    "over-engineering",
+    "backwards-compatibility",
+    "maintainability",
+]);
+/**
+ * Judges to skip for IaC files (Terraform, Bicep, ARM, Dockerfile).
+ */
+const SKIP_FOR_IAC = new Set([
+    "testing",
+    "code-structure",
+    "concurrency",
+    "over-engineering",
+    "ux",
+    "accessibility",
+    "internationalization",
+    "api-design",
+    "api-contract",
+    "backwards-compatibility",
+    "hallucination-detection",
+    "multi-turn-coherence",
+    "model-fingerprint",
+]);
+// ─── Core judges that always run ─────────────────────────────────────────────
+/** These judges run unconditionally — they cover universally applicable concerns. */
+const ALWAYS_RUN = new Set(["security", "cybersecurity", "false-positive-review"]);
+// ─── Selection logic ─────────────────────────────────────────────────────────
+/**
+ * Select the most relevant judges for a given file context.
+ *
+ * Strategy:
+ * 1. Always include core judges (security, false-positive-review)
+ * 2. Skip judges with language incompatibility
+ * 3. Skip judges irrelevant to the file category
+ * 4. Return selection with skip reasons for observability
+ */
+export function selectJudges(judges, ctx) {
+    const selected = [];
+    const skipped = [];
+    const lang = ctx.language.toLowerCase();
+    const cat = ctx.fileCategory?.toLowerCase() ?? "";
+    for (const judge of judges) {
+        // Core judges always run
+        if (ALWAYS_RUN.has(judge.id)) {
+            selected.push(judge);
+            continue;
+        }
+        // Language-specific judge: skip if language not in its set
+        const langOnly = LANGUAGE_SPECIFIC[judge.id];
+        if (langOnly && !langOnly.has(lang)) {
+            skipped.push({ judgeId: judge.id, reason: `not relevant for language: ${lang}` });
+            continue;
+        }
+        // Language skip: judge not useful for this language
+        const langSkip = LANGUAGE_SKIP[judge.id];
+        if (langSkip && langSkip.has(lang)) {
+            skipped.push({ judgeId: judge.id, reason: `skipped for language: ${lang}` });
+            continue;
+        }
+        // File category gating
+        if (cat === "test" && SKIP_FOR_TESTS.has(judge.id)) {
+            skipped.push({ judgeId: judge.id, reason: "not relevant for test files" });
+            continue;
+        }
+        if (cat === "config" && SKIP_FOR_CONFIG.has(judge.id)) {
+            skipped.push({ judgeId: judge.id, reason: "not relevant for config files" });
+            continue;
+        }
+        if ((cat === "iac" || lang === "terraform" || lang === "bicep" || lang === "arm" || lang === "dockerfile") &&
+            SKIP_FOR_IAC.has(judge.id)) {
+            skipped.push({ judgeId: judge.id, reason: "not relevant for infrastructure code" });
+            continue;
+        }
+        selected.push(judge);
+    }
+    return { selected, skipped };
+}

package/dist/evaluators/logging-privacy.d.ts

@@ -0,0 +1,2 @@
+import type { Finding } from "../types.js";
+export declare function analyzeLoggingPrivacy(code: string, language: string): Finding[];

package/dist/evaluators/logging-privacy.js

@@ -0,0 +1,190 @@
+import { getLineNumbers, getLangLineNumbers, getLangFamily, isLikelyAnalysisCode, isLikelyCLI, testCode, } from "./shared.js";
+import * as LP from "../language-patterns.js";
+export function analyzeLoggingPrivacy(code, language) {
+    const findings = [];
+    let ruleNum = 1;
+    const prefix = "LOGPRIV";
+    const _lang = getLangFamily(language);
+    // Analysis code references PII/IP/credential keywords in regex patterns for
+    // detection purposes — these are not actual sensitive data being logged.
+    if (isLikelyAnalysisCode(code))
+        return findings;
+    // Helper: find log statement lines that contain sensitive data (multi-language)
+    const logLineSet = new Set([
+        ...getLangLineNumbers(code, language, LP.CONSOLE_LOG),
+        ...getLangLineNumbers(code, language, LP.STRUCTURED_LOG),
+    ]);
+    const codeLines = code.split("\n");
+    function getLogLinesMatching(sensitivePattern) {
+        const flagged = [];
+        for (const lineNum of logLineSet) {
+            const line = codeLines[lineNum - 1];
+            if (line && sensitivePattern.test(line)) {
+                flagged.push(lineNum);
+            }
+        }
+        return flagged;
+    }
+    // Logging authorization/token headers (multi-language)
+    const logAuthLines = getLogLinesMatching(/(?:authorization|bearer|token|auth)/i);
+    if (logAuthLines.length >= 4) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "critical",
+            title: "Authentication tokens logged",
+            description: `Found ${logAuthLines.length} instance(s) where authentication tokens or authorization headers are logged. Tokens in logs can be used for session hijacking.`,
+            lineNumbers: logAuthLines,
+            recommendation: "Never log authentication tokens, Authorization headers, or session IDs. If request logging is needed, redact sensitive headers before logging.",
+            reference: "OWASP Logging Cheat Sheet / CWE-532",
+            suggestedFix: "Redact auth headers: const safeHeaders = { ...req.headers, authorization: '[REDACTED]' }; logger.info({ headers: safeHeaders });",
+            confidence: 0.9,
+        });
+    }
+    // Logging passwords (multi-language)
+    const logPasswordLines = getLogLinesMatching(/(?:password|passwd|pwd|secret|credential)/i);
+    if (logPasswordLines.length >= 2) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "critical",
+            title: "Passwords/secrets logged",
+            description: `Found ${logPasswordLines.length} instance(s) where passwords or secrets appear in log statements. This exposes credentials in log files, monitoring systems, and SIEM tools.`,
+            lineNumbers: logPasswordLines,
+            recommendation: "Never log passwords, credentials, or secrets. Implement a log sanitizer that redacts sensitive fields automatically.",
+            reference: "OWASP Logging Cheat Sheet / GDPR Art. 5(1)(f)",
+            suggestedFix: "Remove password from log output: const { password, ...safeData } = userData; logger.info({ user: safeData });",
+            confidence: 0.9,
+        });
+    }
+    // Logging PII (email, name, SSN, phone) (multi-language)
+    // Use word-boundary anchors to avoid matching fragments inside other words
+    // (e.g., "rename" does not contain PII field "name").
+    const logPiiLines = getLogLinesMatching(/(?:\bemail\b|\bssn\b|\bphone(?:Number)?\b|\baddress\b(?!\s*(?:=|:)\s*(?:0x|null|undefined|['"](?:\/|http)))|(?:^|[\s{(,.:])name(?:\s*[=:,})\]]|$)|\bfirstName\b|\blast_?[Nn]ame\b|\bdateOfBirth\b|\bdob\b|\bsocial.?security\b)/i);
+    if (logPiiLines.length >= 2 && !isLikelyCLI(code)) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "Personally Identifiable Information (PII) in logs",
+            description: `Found ${logPiiLines.length} instance(s) where PII may be logged. PII in logs violates data minimization principles and may breach GDPR/CCPA requirements.`,
+            lineNumbers: logPiiLines,
+            recommendation: "Redact PII before logging. Use anonymized identifiers. Implement a log redaction filter that automatically masks sensitive fields.",
+            reference: "GDPR Article 5: Data Minimization / OWASP Logging Cheat Sheet",
+            suggestedFix: "Mask PII in logs: logger.info({ email: maskEmail(user.email), id: user.id }); function maskEmail(e) { return e[0] + '***@' + e.split('@')[1]; }",
+            confidence: 0.9,
+        });
+    }
+    // Logging full request/response bodies (multi-language)
+    const logBodyLines = getLogLinesMatching(/(?:req\.body|request\.body|res\.body|response\.body|JSON\.stringify\s*\(\s*req|request\.data|request\.json)/i);
+    if (logBodyLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "Full request/response bodies logged",
+            description: "Full request or response bodies are logged, which may contain sensitive user data, credentials, or PII that should not appear in logs.",
+            lineNumbers: logBodyLines,
+            recommendation: "Log only necessary metadata (method, URL, status, duration). If body logging is needed, implement a whitelist of safe fields and redact everything else.",
+            reference: "Log Sanitization Best Practices",
+            suggestedFix: "Log safe fields only: const safeBody = pick(req.body, ['action', 'timestamp']); logger.info({ method: req.method, url: req.url, body: safeBody });",
+            confidence: 0.85,
+        });
+    }
+    // Logging financial data (multi-language)
+    const logFinanceLines = getLogLinesMatching(/(?:card.?number|credit.?card|cvv|expir|bank.?account|routing.?number|iban|swift)/i);
+    if (logFinanceLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "critical",
+            title: "Financial data logged",
+            description: "Credit card numbers, CVVs, or bank account details appear in log statements. This is a PCI DSS violation and a data breach risk.",
+            lineNumbers: logFinanceLines,
+            recommendation: "Never log financial data. Mask card numbers (show only last 4 digits). PCI DSS prohibits storing CVV data in any form.",
+            reference: "PCI DSS Requirement 3: Protect Stored Data",
+            suggestedFix: "Mask card numbers: const masked = cardNumber.replace(/.(?=.{4})/g, '*'); logger.info({ card: masked }); never log CVV.",
+            confidence: 0.9,
+        });
+    }
+    // Console.log used instead of proper logger (multi-language detection)
+    const consoleLogLines = getLangLineNumbers(code, language, LP.CONSOLE_LOG);
+    const hasProperLogger = testCode(code, /winston|pino|bunyan|log4j|serilog|NLog|structuredLog|logger\./gi);
+    const structuredLogLines = getLangLineNumbers(code, language, LP.STRUCTURED_LOG);
+    if (consoleLogLines.length > 3 && !hasProperLogger && structuredLogLines.length === 0 && !isLikelyCLI(code)) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Unstructured logging lacks redaction capabilities",
+            description: `Found ${consoleLogLines.length} unstructured log statement(s). Console/print logging has no built-in redaction, log level filtering, or structured output — making it impossible to automatically strip sensitive data.`,
+            recommendation: "Use a structured logging library (pino, winston) that supports field-level redaction, log level filtering, and structured output for automated sensitivity scanning.",
+            reference: "Structured Logging / Log Redaction Patterns",
+            suggestedFix: "Use pino with redaction: import pino from 'pino'; const logger = pino({ redact: ['req.headers.authorization', '*.password', '*.ssn'] });",
+            confidence: 0.75,
+        });
+    }
+    // String concatenation in logs
+    const logConcatLines = [];
+    for (const lineNum of logLineSet) {
+        const line = codeLines[lineNum - 1];
+        if (line && /\+/.test(line)) {
+            logConcatLines.push(lineNum);
+        }
+    }
+    if (logConcatLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "String concatenation in log statements",
+            description: `Found ${logConcatLines.length} log statement(s) using string concatenation. Concatenated logs are unstructured and make it impossible to apply field-level redaction.`,
+            lineNumbers: logConcatLines.slice(0, 5),
+            recommendation: "Use structured logging with named fields: logger.info({ userId, action }, 'User action performed'). This allows automated redaction of specific fields.",
+            reference: "Structured Logging Best Practices",
+            suggestedFix: "Replace concatenation with structured fields: instead of console.log('User ' + id + ' did ' + action), use logger.info({ userId: id, action }, 'User action performed');",
+            confidence: 0.75,
+        });
+    }
+    // Logging IP addresses (multi-language)
+    const logIpLines = getLogLinesMatching(/(?:ip|ipAddress|remoteAddress|x-forwarded-for|req\.ip|req\.connection\.remoteAddress|REMOTE_ADDR)/i);
+    if (logIpLines.length > 0 && !isLikelyCLI(code)) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "IP addresses logged without anonymization",
+            description: `Found ${logIpLines.length} instance(s) where IP addresses are logged. Under GDPR, IP addresses are personal data and must be handled accordingly.`,
+            lineNumbers: logIpLines,
+            recommendation: "Anonymize IP addresses in logs (truncate last octet for IPv4, mask prefix for IPv6). If full IP is needed for security, ensure log retention complies with privacy policy.",
+            reference: "GDPR Recital 30: IP Addresses as Personal Data",
+            suggestedFix: "Anonymize IPs: function anonymizeIp(ip) { return ip.replace(/\\d+$/, '0'); } logger.info({ ip: anonymizeIp(req.ip) });",
+            confidence: 0.9,
+        });
+    }
+    // Logging database queries with parameters (multi-language)
+    // Require SQL-specific context to avoid false positives on generic action labels like { action: "DELETE" }
+    const logQueryLines = getLogLinesMatching(/(?:query|sql|SELECT\s+.+\s+FROM|INSERT\s+INTO|UPDATE\s+.+\s+SET|DELETE\s+FROM)/i);
+    if (logQueryLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Database queries logged — may contain sensitive parameters",
+            description: `Found ${logQueryLines.length} instance(s) where SQL queries are logged. Query parameters often contain user data (emails, names, IDs) that shouldn't appear in logs.`,
+            lineNumbers: logQueryLines,
+            recommendation: "Log query templates without parameter values. Use parameterized query logging that replaces bind values with placeholders. Redact sensitive column values.",
+            reference: "Database Logging Privacy / OWASP Logging Cheat Sheet",
+            suggestedFix: "Log queries safely: logger.info({ query: 'SELECT * FROM users WHERE id = $1', paramCount: params.length }); // never log actual parameter values.",
+            confidence: 0.8,
+        });
+    }
+    // Stack traces exposed to external consumers
+    const stackExposedPattern = /res\.(?:json|send|status)\s*\([^)]*(?:stack|stackTrace|err\.stack|error\.stack)/gi;
+    const stackExposedLines = getLineNumbers(code, stackExposedPattern);
+    if (stackExposedLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum).padStart(3, "0")}`,
+            severity: "high",
+            title: "Stack traces exposed in API responses",
+            description: "Error stack traces are included in HTTP responses. Stack traces reveal internal file paths, dependency versions, and code structure to potential attackers.",
+            lineNumbers: stackExposedLines,
+            recommendation: "Never send stack traces in production API responses. Log them server-side for debugging. Return a generic error ID that correlates to internal logs.",
+            reference: "OWASP: Improper Error Handling / CWE-209",
+            suggestedFix: "Return safe errors: const errorId = crypto.randomUUID(); logger.error({ errorId, stack: err.stack }); res.status(500).json({ error: 'Internal error', errorId });",
+            confidence: 0.85,
+        });
+    }
+    return findings;
+}

package/dist/evaluators/logic-review.d.ts

@@ -0,0 +1,2 @@
+import type { Finding } from "../types.js";
+export declare function analyzeLogicReview(code: string, language: string): Finding[];