@oculum/scanner 1.0.10 → 1.0.12

package/src/layer2/ai-endpoint-protection.ts

@@ -9,6 +9,7 @@
  */
 
 import type { Vulnerability, VulnerabilitySeverity } from '../types'
+import type { ParsedFile } from '../utils/parsed-file'
 import type { MiddlewareAuthConfig } from '../utils/middleware-detector'
 import {
   isComment,
@@ -136,6 +137,12 @@ function isBYOKEndpoint(content: string): boolean {
     // Headers with user's key
     /headers\[['"`]x-openai-key['"`]\]/i,
     /headers\[['"`]x-api-key['"`]\]/i,
+    // Destructuring from request body
+    /const\s*\{\s*[^}]*apiKey[^}]*\}\s*=\s*await\s*(?:request|req)\.json\(\)/i,
+    /const\s*\{\s*[^}]*api_key[^}]*\}\s*=\s*await\s*(?:request|req)\.json\(\)/i,
+    // OpenAI/Anthropic client with user-provided key
+    /new\s+OpenAI\s*\(\s*\{\s*apiKey\s*[,}]/i,
+    /new\s+Anthropic\s*\(\s*\{\s*apiKey\s*[,}]/i,
   ]
   return byokPatterns.some(p => p.test(content))
 }
@@ -249,6 +256,7 @@ const ROUTE_HANDLER_PATTERNS: EndpointProtectionPattern[] = [
 
 export interface EndpointProtectionOptions {
   middlewareConfig?: MiddlewareAuthConfig
+  parsed?: ParsedFile
 }
 
 /**
@@ -270,7 +278,7 @@ export function detectAIEndpointProtection(
     return vulnerabilities
   }
 
-  const lines = content.split('\n')
+  const lines = options?.parsed?.lines ?? content.split('\n')
   const isTestFile = isTestOrMockFile(filePath)
   const isExample = isExampleDirectory(filePath)
 
@@ -327,10 +335,17 @@ export function detectAIEndpointProtection(
         notes.push('Missing authentication and rate limiting')
       }
 
-      // BYOK endpoints have lower risk
+      // BYOK endpoints have lower risk - user provides own API key
       if (isByok && severity !== 'info') {
-        severity = severity === 'high' ? 'medium' : (severity === 'medium' ? 'low' : severity)
-        notes.push('BYOK endpoint - user provides API key')
+        // BYOK with auth = info (user pays for own usage, access controlled)
+        // BYOK without auth = low (potential abuse but user still pays)
+        if (handlerHasAuth || fileHasAuth) {
+          severity = 'info'
+          notes.push('BYOK endpoint with authentication - user pays for their own usage')
+        } else {
+          severity = 'low'
+          notes.push('BYOK endpoint without auth - potential abuse but user provides API key')
+        }
       }
 
       // Downgrade test files