@oculum/scanner 1.0.0

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@oculum/scanner",
+  "version": "1.0.0",
+  "description": "AI-native security scanner for detecting vulnerabilities in LLM-generated code",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.js"
+    },
+    "./formatters": {
+      "types": "./dist/formatters/index.d.ts",
+      "import": "./dist/formatters/index.js",
+      "require": "./dist/formatters/index.js"
+    },
+    "./types": {
+      "types": "./dist/types.d.ts",
+      "import": "./dist/types.js",
+      "require": "./dist/types.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "test": "echo \"No tests configured yet\"",
+    "lint": "eslint src/"
+  },
+  "dependencies": {
+    "@anthropic-ai/sdk": "^0.71.2",
+    "openai": "^6.16.0"
+  },
+  "devDependencies": {
+    "@types/jest": "^30.0.0",
+    "@types/node": "^20",
+    "jest": "^29.7.0",
+    "ts-jest": "^29.4.6",
+    "typescript": "^5"
+  },
+  "files": [
+    "dist",
+    "src"
+  ]
+}

package/src/__tests__/benchmark/fixtures/false-positives.ts

@@ -0,0 +1,227 @@
+/**
+ * False Positive Test Fixtures
+ * Files that should NOT generate high-severity findings
+ */
+
+import type { TestFixture } from '../types'
+
+/**
+ * Test/Mock files should be ignored
+ */
+export const testFileFixture: TestFixture = {
+  name: 'Test File - Should Not Flag',
+  expectFindings: false,
+  description: 'Test files with mock data should not generate high-severity findings',
+  file: {
+    path: 'src/__tests__/auth.test.ts',
+    content: `
+// Test file - all these should be SAFE
+const TEST_API_KEY = "sk-test-12345"
+const MOCK_SECRET = "mock-secret-for-testing"
+
+describe('Authentication', () => {
+  it('should authenticate with valid key', async () => {
+    const result = await authenticate(TEST_API_KEY)
+    expect(result).toBeTruthy()
+  })
+
+  it('should reject eval for testing', () => {
+    // Testing eval handling
+    expect(() => eval('1+1')).not.toThrow()
+  })
+})
+`,
+    language: 'typescript',
+    size: 400,
+  },
+}
+
+/**
+ * Example/documentation files should be ignored
+ */
+export const exampleFileFixture: TestFixture = {
+  name: 'Example File - Should Not Flag',
+  expectFindings: false,
+  description: 'Example files with placeholder values should not be flagged',
+  file: {
+    path: 'examples/getting-started.ts',
+    content: `
+// Example file - all these should be SAFE
+const EXAMPLE_API_KEY = "your-api-key-here"
+const SAMPLE_SECRET = "replace-with-your-secret"
+
+// Example usage
+const client = new Client({
+  apiKey: EXAMPLE_API_KEY
+})
+
+// Example SQL (for documentation)
+const exampleQuery = "SELECT * FROM users WHERE id = '" + userId + "'"
+`,
+    language: 'typescript',
+    size: 300,
+  },
+}
+
+/**
+ * Configuration files with env vars should be mostly safe
+ */
+export const configFileFixture: TestFixture = {
+  name: 'Config File - Should Not Flag',
+  expectFindings: false,
+  description: 'Config files using environment variables should be safe',
+  file: {
+    path: 'src/config/index.ts',
+    content: `
+// All from environment - SAFE
+export const config = {
+  database: {
+    url: process.env.DATABASE_URL!,
+    poolSize: parseInt(process.env.DB_POOL_SIZE || '10'),
+  },
+  auth: {
+    secret: process.env.JWT_SECRET!,
+    expiresIn: process.env.JWT_EXPIRES_IN || '7d',
+  },
+  api: {
+    openaiKey: process.env.OPENAI_API_KEY!,
+    anthropicKey: process.env.ANTHROPIC_API_KEY!,
+  },
+}
+
+// Type checking
+if (!config.database.url) {
+  throw new Error('DATABASE_URL is required')
+}
+`,
+    language: 'typescript',
+    size: 500,
+  },
+}
+
+/**
+ * Middleware file that protects routes
+ */
+export const middlewareFileFixture: TestFixture = {
+  name: 'Middleware - Should Detect Auth',
+  expectFindings: false,
+  description: 'Middleware files should not generate auth warnings',
+  file: {
+    path: 'middleware.ts',
+    content: `
+import { clerkMiddleware, createRouteMatcher } from '@clerk/nextjs/server'
+
+const isPublicRoute = createRouteMatcher([
+  '/sign-in(.*)',
+  '/sign-up(.*)',
+  '/api/webhook(.*)',
+  '/',
+])
+
+export default clerkMiddleware((auth, request) => {
+  if (!isPublicRoute(request)) {
+    auth().protect()
+  }
+})
+
+export const config = {
+  matcher: ['/((?!.+\\.[\\w]+$|_next).*)', '/', '/(api|trpc)(.*)'],
+}
+`,
+    language: 'typescript',
+    size: 400,
+  },
+}
+
+/**
+ * Routes under /api should NOT be flagged (protected by middleware)
+ */
+export const protectedApiRouteFixture: TestFixture = {
+  name: 'Protected Route - Should Not Flag Missing Auth',
+  expectFindings: false,
+  description: 'Routes protected by middleware should not be flagged for missing auth',
+  file: {
+    path: 'app/api/user/settings/route.ts',
+    content: `
+import { NextResponse } from 'next/server'
+import { db } from '@/lib/db'
+import { getCurrentUserId } from '@/lib/auth'
+
+// Protected by Clerk middleware - Should NOT flag as missing auth
+export async function GET() {
+  const userId = await getCurrentUserId()  // Throws if not authenticated
+
+  const settings = await db.settings.findUnique({
+    where: { userId }
+  })
+
+  return NextResponse.json(settings)
+}
+
+export async function PUT(request: Request) {
+  const userId = await getCurrentUserId()
+  const body = await request.json()
+
+  await db.settings.update({
+    where: { userId },
+    data: body
+  })
+
+  return NextResponse.json({ success: true })
+}
+`,
+    language: 'typescript',
+    size: 600,
+  },
+}
+
+/**
+ * Documentation/README files
+ */
+export const documentationFixture: TestFixture = {
+  name: 'Documentation - Should Not Flag',
+  expectFindings: false,
+  description: 'Documentation files should not be flagged',
+  file: {
+    path: 'docs/API_GUIDE.md',
+    content: `
+# API Guide
+
+## Authentication
+
+To authenticate, you need an API key:
+
+\`\`\`typescript
+const client = new Client({
+  apiKey: "sk-your-api-key-here"
+})
+\`\`\`
+
+## Example Query
+
+\`\`\`sql
+SELECT * FROM users WHERE id = 'user_123'
+\`\`\`
+
+## Configuration
+
+Set these environment variables:
+- \`API_KEY=your-api-key\`
+- \`DATABASE_URL=postgresql://localhost/mydb\`
+`,
+    language: 'markdown',
+    size: 400,
+  },
+}
+
+/**
+ * All false positive fixtures
+ */
+export const falsePositiveFixtures: TestFixture[] = [
+  testFileFixture,
+  exampleFileFixture,
+  configFileFixture,
+  middlewareFileFixture,
+  protectedApiRouteFixture,
+  documentationFixture,
+]

package/src/__tests__/benchmark/fixtures/index.ts

@@ -0,0 +1,68 @@
+/**
+ * Main Fixtures Index
+ * Exports all test fixtures for the security benchmark suite
+ */
+
+// Layer 1 fixtures
+export * from './layer1'
+export { layer1TestGroups, highEntropyTests } from './layer1'
+
+// Layer 2 fixtures
+export * from './layer2'
+export { layer2TestGroups } from './layer2'
+
+// False positive fixtures
+export { falsePositiveFixtures } from './false-positives'
+export {
+  testFileFixture,
+  exampleFileFixture,
+  configFileFixture,
+  middlewareFileFixture,
+  protectedApiRouteFixture,
+  documentationFixture,
+} from './false-positives'
+
+import type { TestGroup, TestFixture } from '../types'
+import { layer1TestGroups, highEntropyTests } from './layer1'
+import { layer2TestGroups } from './layer2'
+import { falsePositiveFixtures } from './false-positives'
+
+/**
+ * All test groups organized by layer and tier
+ */
+export const allTestGroups: TestGroup[] = [
+  ...layer1TestGroups,
+  highEntropyTests,
+  ...layer2TestGroups,
+]
+
+/**
+ * Get all true positive fixtures
+ */
+export function getAllTruePositives(): TestFixture[] {
+  return allTestGroups.flatMap(group => group.truePositives)
+}
+
+/**
+ * Get all false negative fixtures
+ */
+export function getAllFalseNegatives(): TestFixture[] {
+  return [
+    ...allTestGroups.flatMap(group => group.falseNegatives),
+    ...falsePositiveFixtures,
+  ]
+}
+
+/**
+ * Get test groups by layer
+ */
+export function getTestGroupsByLayer(layer: 1 | 2): TestGroup[] {
+  return allTestGroups.filter(group => group.layer === layer)
+}
+
+/**
+ * Get test groups by tier
+ */
+export function getTestGroupsByTier(tier: 'A' | 'B' | 'C'): TestGroup[] {
+  return allTestGroups.filter(group => group.tier === tier)
+}

package/src/__tests__/benchmark/fixtures/layer1/config-audit.ts

@@ -0,0 +1,364 @@
+/**
+ * Configuration Audit Test Fixtures
+ * Tests for detecting security misconfigurations in config files
+ */
+
+import type { TestGroup } from '../../types'
+
+export const configAuditTests: TestGroup = {
+  name: 'Configuration Auditing',
+  tier: 'B',
+  layer: 1,
+  description: 'Detection of security misconfigurations in Dockerfile, CORS, Next.js, and package.json',
+
+  truePositives: [
+    {
+      name: 'Dockerfile Security Issues',
+      expectFindings: true,
+      expectedCategories: ['insecure_config'],
+      description: 'Dockerfile misconfigurations that MUST be detected',
+      file: {
+        path: 'Dockerfile',
+        content: `
+FROM node:18-alpine
+
+WORKDIR /app
+
+COPY package*.json ./
+RUN npm install
+
+COPY . .
+
+# Explicitly running as root - HIGH
+USER root
+
+# Hardcoded secrets in build args - CRITICAL
+ARG DATABASE_PASSWORD=supersecret123
+ARG API_SECRET_KEY=sk-live-abc123
+ENV JWT_SECRET=my-jwt-signing-key
+ENV DB_PASSWORD=production-db-pass
+
+EXPOSE 3000
+
+CMD ["npm", "start"]
+`,
+        language: 'dockerfile',
+        size: 350,
+      },
+    },
+    {
+      name: 'Permissive CORS Configuration',
+      expectFindings: true,
+      expectedCategories: ['insecure_config'],
+      description: 'Wildcard CORS that MUST be detected',
+      file: {
+        path: 'src/server/cors.ts',
+        content: `
+import express from 'express'
+import cors from 'cors'
+
+const app = express()
+
+// Permissive CORS - MEDIUM
+app.use(cors({
+  origin: '*',
+  credentials: true,
+}))
+
+// Another pattern - MEDIUM
+const headers = {
+  'Access-Control-Allow-Origin': '*',
+  'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE',
+}
+
+// Config object pattern - MEDIUM
+const corsConfig = {
+  allowedOrigins: ['*'],
+  origin: '*',
+}
+
+// In response header
+res.setHeader('Access-Control-Allow-Origin', '*')
+`,
+        language: 'typescript',
+        size: 450,
+      },
+    },
+    {
+      name: 'Next.js Security Config',
+      expectFindings: true,
+      expectedCategories: ['insecure_config'],
+      description: 'Next.js security misconfigurations that MUST be detected',
+      file: {
+        path: 'next.config.js',
+        content: `
+/** @type {import('next').NextConfig} */
+const nextConfig = {
+  // Exposing X-Powered-By header - LOW
+  poweredByHeader: true,
+
+  // Exposing source maps in production - MEDIUM
+  productionBrowserSourceMaps: true,
+
+  // Other config
+  reactStrictMode: true,
+  images: {
+    domains: ['cdn.example.com'],
+  },
+}
+
+module.exports = nextConfig
+`,
+        language: 'javascript',
+        size: 300,
+      },
+    },
+    {
+      name: 'Package.json Security Issues',
+      expectFindings: true,
+      expectedCategories: ['insecure_config'],
+      description: 'Package.json security issues that MUST be detected',
+      file: {
+        path: 'package.json',
+        content: `{
+  "name": "my-app",
+  "version": "1.0.0",
+  "scripts": {
+    "start": "node index.js",
+    "postinstall": "node scripts/setup.js",
+    "preinstall": "node scripts/verify.js"
+  },
+  "dependencies": {
+    "express": "*",
+    "lodash": "latest",
+    "axios": "^1.0.0"
+  },
+  "devDependencies": {
+    "jest": "*"
+  }
+}`,
+        language: 'json',
+        size: 350,
+      },
+    },
+    {
+      name: 'Dockerfile Without USER',
+      expectFindings: true,
+      expectedCategories: ['insecure_config'],
+      description: 'Dockerfile without USER instruction runs as root by default',
+      file: {
+        path: 'services/api/Dockerfile',
+        content: `
+FROM python:3.11-slim
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install -r requirements.txt
+
+COPY . .
+
+EXPOSE 8000
+
+# No USER instruction - runs as root by default - MEDIUM
+CMD ["python", "app.py"]
+`,
+        language: 'dockerfile',
+        size: 200,
+      },
+    },
+  ],
+
+  falseNegatives: [
+    {
+      name: 'Safe Dockerfile Configuration',
+      expectFindings: false,
+      description: 'Properly configured Dockerfile that should NOT be flagged',
+      allowedInfoFindings: [
+        {
+          category: 'insecure_config',
+          maxCount: 1,
+          reason: 'Some patterns may generate low-severity findings',
+        },
+      ],
+      file: {
+        path: 'Dockerfile',
+        content: `
+FROM node:18-alpine
+
+WORKDIR /app
+
+COPY package*.json ./
+RUN npm install --production
+
+COPY . .
+
+# Running as non-root user - SAFE
+USER node
+
+# Secrets from build args without defaults - SAFE
+ARG DATABASE_URL
+ENV DATABASE_URL=\${DATABASE_URL}
+
+EXPOSE 3000
+
+CMD ["npm", "start"]
+`,
+        language: 'dockerfile',
+        size: 250,
+      },
+    },
+    {
+      name: 'Safe Docker Compose',
+      expectFindings: false,
+      description: 'Docker Compose with secrets from env vars should NOT be flagged',
+      file: {
+        path: 'docker-compose.yml',
+        content: `
+version: '3.8'
+
+services:
+  app:
+    build: .
+    ports:
+      - "3000:3000"
+    environment:
+      # Secrets from environment variables - SAFE
+      DATABASE_PASSWORD: \${DATABASE_PASSWORD}
+      API_KEY: \${API_KEY}
+      JWT_SECRET: \${JWT_SECRET}
+    env_file:
+      - .env
+
+  db:
+    image: postgres:15
+    environment:
+      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD}
+`,
+        language: 'yaml',
+        size: 350,
+      },
+    },
+    {
+      name: 'Safe CORS Configuration',
+      expectFindings: false,
+      description: 'Properly configured CORS should NOT be flagged',
+      allowedInfoFindings: [
+        {
+          category: 'insecure_config',
+          maxCount: 1,
+          reason: 'CORS patterns may generate low-severity findings',
+        },
+        {
+          category: 'sensitive_url',
+          maxCount: 2,
+          reason: 'URLs in CORS config may trigger URL detection',
+        },
+        {
+          category: 'ai_pattern',
+          maxCount: 1,
+          reason: 'Function-based patterns may trigger AI detection',
+        },
+      ],
+      file: {
+        path: 'src/config/cors-config.ts',
+        content: `
+// Environment-based CORS configuration - SAFE
+export const corsConfig = {
+  origin: process.env.ALLOWED_ORIGINS?.split(','),
+  credentials: true,
+}
+`,
+        language: 'typescript',
+        size: 100,
+      },
+    },
+    {
+      name: 'Safe Next.js Config',
+      expectFindings: false,
+      description: 'Secure Next.js configuration should NOT be flagged',
+      file: {
+        path: 'next.config.js',
+        content: `
+/** @type {import('next').NextConfig} */
+const nextConfig = {
+  // Disabled header - SAFE (or omitted entirely)
+  poweredByHeader: false,
+
+  // Source maps disabled - SAFE
+  productionBrowserSourceMaps: false,
+
+  reactStrictMode: true,
+
+  // Security headers
+  async headers() {
+    return [
+      {
+        source: '/:path*',
+        headers: [
+          { key: 'X-Frame-Options', value: 'DENY' },
+          { key: 'X-Content-Type-Options', value: 'nosniff' },
+        ],
+      },
+    ]
+  },
+}
+
+module.exports = nextConfig
+`,
+        language: 'javascript',
+        size: 400,
+      },
+    },
+    {
+      name: 'Safe Package.json',
+      expectFindings: false,
+      description: 'Properly configured package.json should NOT be flagged',
+      file: {
+        path: 'package.json',
+        content: `{
+  "name": "my-app",
+  "version": "1.0.0",
+  "scripts": {
+    "start": "node index.js",
+    "build": "tsc",
+    "test": "jest"
+  },
+  "dependencies": {
+    "express": "^4.18.2",
+    "lodash": "^4.17.21",
+    "axios": "~1.6.0"
+  },
+  "devDependencies": {
+    "jest": "^29.7.0",
+    "typescript": "^5.3.0"
+  }
+}`,
+        language: 'json',
+        size: 300,
+      },
+    },
+    {
+      name: 'Example/Template Configs',
+      expectFindings: false,
+      description: 'Example configs with placeholders should NOT be flagged',
+      file: {
+        path: 'docker-compose.example.yml',
+        content: `
+version: '3.8'
+
+services:
+  app:
+    build: .
+    environment:
+      # Replace with your actual values
+      DATABASE_PASSWORD: <YOUR_PASSWORD_HERE>
+      API_KEY: your-api-key-here
+      JWT_SECRET: CHANGEME
+`,
+        language: 'yaml',
+        size: 200,
+      },
+    },
+  ],
+}