@oculum/scanner 1.0.11 → 1.0.13

package/src/{layer2/ai-prompt-hygiene.ts → detect/ai-code/prompt-hygiene.ts}

@@ -7,13 +7,16 @@
  * - B3: Secrets & sensitive data in prompts (LLM06)
  */
 
-import type { Vulnerability, VulnerabilitySeverity } from '../types'
+import type { Vulnerability, VulnerabilitySeverity } from '../../shared/types'
+import type { ParsedFile } from '../../shared/parsed-file'
 import {
   isComment,
   isTestOrMockFile,
   isDocumentationFile,
   isScannerOrFixtureFile,
-} from '../utils/context-helpers'
+} from '../../parse/file-classifier'
+
+const BASE_CONFIDENCE = 0.40
 
 /**
  * Check if a file is in an LLM/AI context based on path and content
@@ -323,16 +326,17 @@ function isSecretVariableName(varName: string): boolean {
 function detectSecretVariableFlow(
   content: string,
   filePath: string,
-  isTestFile: boolean
+  isTestFile: boolean,
+  lines?: string[]
 ): Vulnerability[] {
   const vulnerabilities: Vulnerability[] = []
-  const lines = content.split('\n')
+  const _lines = lines ?? content.split('\n')
 
   // First pass: collect all secret variable declarations
   const secretVariables = new Map<string, { line: number; value: string }>()
 
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i]
+  for (let i = 0; i < _lines.length; i++) {
+    const line = _lines[i]
     if (isComment(line)) continue
 
     for (const pattern of SECRET_VARIABLE_PATTERNS) {
@@ -359,12 +363,12 @@ function detectSecretVariableFlow(
     /messages\s*:\s*\[/i,
   ]
 
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i]
+  for (let i = 0; i < _lines.length; i++) {
+    const line = _lines[i]
     if (isComment(line)) continue
 
     // Check if this line or nearby lines are in prompt context
-    const contextWindow = lines.slice(Math.max(0, i - 5), Math.min(lines.length, i + 5)).join('\n')
+    const contextWindow = _lines.slice(Math.max(0, i - 5), Math.min(_lines.length, i + 5)).join('\n')
     const isPromptContext = promptContextPatterns.some(p => p.test(contextWindow))
 
     if (!isPromptContext) continue
@@ -395,7 +399,9 @@ function detectSecretVariableFlow(
           suggestedFix: `Remove the secret from the prompt. If the AI needs to use an API, make the call server-side instead of passing credentials to the model.`,
           confidence: 'medium',
           layer: 2,
+        source: 'ai_code' as const,
           requiresAIValidation: true,
+          baseConfidence: BASE_CONFIDENCE,
         })
       }
     }
@@ -424,7 +430,9 @@ function detectSecretVariableFlow(
           suggestedFix: `Remove the secret from the prompt. If the AI needs to use an API, make the call server-side.`,
           confidence: 'medium',
           layer: 2,
+        source: 'ai_code' as const,
           requiresAIValidation: true,
+          baseConfidence: BASE_CONFIDENCE,
         })
       }
     }
@@ -440,11 +448,11 @@ function detectSecretVariableFlow(
 /**
  * Check if content filtering/sanitization is present for external content
  */
-function hasContentFiltering(content: string, lineNumber: number): boolean {
-  const lines = content.split('\n')
+function hasContentFiltering(content: string, lineNumber: number, lines?: string[]): boolean {
+  const _lines = lines ?? content.split('\n')
   const contextStart = Math.max(0, lineNumber - 20)
-  const contextEnd = Math.min(lines.length, lineNumber + 10)
-  const context = lines.slice(contextStart, contextEnd).join('\n')
+  const contextEnd = Math.min(_lines.length, lineNumber + 10)
+  const context = _lines.slice(contextStart, contextEnd).join('\n')
 
   const filteringPatterns = [
     /filterContent|sanitizeContent|cleanContent/i,
@@ -461,11 +469,11 @@ function hasContentFiltering(content: string, lineNumber: number): boolean {
 /**
  * Check if proper delimiters are used for external content
  */
-function hasExternalContentDelimiters(content: string, lineNumber: number): boolean {
-  const lines = content.split('\n')
+function hasExternalContentDelimiters(content: string, lineNumber: number, lines?: string[]): boolean {
+  const _lines = lines ?? content.split('\n')
   const contextStart = Math.max(0, lineNumber - 15)
-  const contextEnd = Math.min(lines.length, lineNumber + 15)
-  const context = lines.slice(contextStart, contextEnd).join('\n')
+  const contextEnd = Math.min(_lines.length, lineNumber + 15)
+  const context = _lines.slice(contextStart, contextEnd).join('\n')
 
   const delimiterPatterns = [
     /<context>|<\/context>/i,
@@ -641,6 +649,203 @@ const MISSING_BOUNDARY_PATTERNS: PromptHygienePattern[] = [
   },
 ]
 
+// ============================================================================
+// Sprint 6: Model-Specific Injection Syntax Detection
+// ============================================================================
+
+/**
+ * Model-specific injection markers that could manipulate prompt structure
+ * These patterns detect when user input might contain control tokens
+ */
+const MODEL_SPECIFIC_INJECTION_PATTERNS: PromptHygienePattern[] = [
+  // Claude/ChatML XML-style markers
+  {
+    name: 'Claude/ChatML injection markers in user input',
+    pattern: /(?:userInput|userMessage|input|message|query)\s*[=:][^\n]*<\|?(?:system|human|assistant|user)\|?>/gi,
+    severity: 'high',
+    description: 'User input may contain system/role markers that could manipulate prompt structure. Attackers can inject fake system or assistant messages.',
+    suggestedFix: 'Strip or escape control tokens from user input: input.replace(/<\\|?(?:system|human|assistant|user)\\|?>/gi, "")',
+  },
+  // OpenAI ChatML markers
+  {
+    name: 'OpenAI ChatML control tokens',
+    pattern: /(?:userInput|userMessage|input|message|query)\s*[=:][^\n]*<\|im_(?:start|end)\|>/gi,
+    severity: 'high',
+    description: 'User input contains OpenAI ChatML control tokens (<|im_start|>, <|im_end|>) that could break message boundaries.',
+    suggestedFix: 'Filter ChatML tokens from user input before processing: input.replace(/<\\|im_(?:start|end)\\|>/gi, "")',
+  },
+  // Anthropic Human/Assistant turn markers
+  {
+    name: 'Anthropic turn markers in user input',
+    pattern: /(?:userInput|userMessage|input|message|query)\s*[=:][^\n]*\\n\\n(?:Human|Assistant):\s*/gi,
+    severity: 'medium',
+    description: 'User input contains Anthropic turn markers (Human:, Assistant:) that could inject fake assistant responses.',
+    suggestedFix: 'Sanitize turn markers from user input: input.replace(/\\n\\n(Human|Assistant):\\s*/gi, "")',
+  },
+  // Generic role injection attempts
+  {
+    name: 'Role injection in user input',
+    pattern: /`[^`]*\$\{[^}]*(?:user|input|query)[^}]*\}[^`]*(?:system|assistant|Human:|Assistant:|<\|)/gi,
+    severity: 'high',
+    description: 'User input is interpolated near role markers without proper boundaries. Could enable role impersonation.',
+    suggestedFix: 'Use strict message formatting and strip role-like patterns from user input.',
+    checkDelimiters: true,
+  },
+  // Instruction override attempts in templates
+  {
+    name: 'Instruction override pattern',
+    pattern: /`[^`]*\$\{[^}]*\}[^`]*(?:ignore\s+(?:all\s+)?previous|disregard\s+(?:your\s+)?(?:rules|instructions)|you\s+are\s+now)/gi,
+    severity: 'medium',
+    description: 'Template allows interpolation near common jailbreak phrases. User could inject instruction override attempts.',
+    suggestedFix: 'Filter jailbreak patterns from user input before interpolation.',
+    checkDelimiters: true,
+  },
+]
+
+// ============================================================================
+// Sprint 6: Encoding-Based Escape Detection
+// ============================================================================
+
+/**
+ * Patterns for detecting encoding-based prompt injection bypasses
+ */
+const ENCODING_ESCAPE_PATTERNS: PromptHygienePattern[] = [
+  // Base64 decoded content flowing to prompts
+  {
+    name: 'Base64 decoded content in prompt',
+    pattern: /(?:atob|Buffer\.from|base64\.decode|b64decode)\s*\([^)]+\)[^;]*(?:\+|,)[^;]*(?:prompt|system|message|content)/gi,
+    severity: 'medium',
+    description: 'Decoded base64 content concatenated with prompts. Attackers can hide malicious instructions in base64 encoding to bypass filters.',
+    suggestedFix: 'Validate and sanitize decoded content before including in prompts. Apply same security checks to decoded content.',
+  },
+  // URL decoded content in prompts
+  {
+    name: 'URL decoded content in prompt',
+    pattern: /(?:unescape|decodeURIComponent|decodeURI|urllib\.parse\.unquote)\s*\([^)]+\)[^;]*(?:\+|,)[^;]*(?:prompt|system|message|content)/gi,
+    severity: 'medium',
+    description: 'URL decoded content flows into prompt. Encoded payloads can bypass input sanitization.',
+    suggestedFix: 'Sanitize content after decoding. Apply prompt injection filters to the decoded output.',
+  },
+  // HTML entity decoded content
+  {
+    name: 'HTML decoded content in prompt',
+    pattern: /(?:htmlDecode|decodeHTMLEntities|he\.decode|html\.unescape)\s*\([^)]+\)[^;]*(?:\+|,)[^;]*(?:prompt|system|message|content)/gi,
+    severity: 'medium',
+    description: 'HTML decoded content flows into prompt. HTML entities can hide malicious instructions.',
+    suggestedFix: 'Apply prompt injection filters after HTML decoding.',
+  },
+  // JSON parsed content directly in prompt (could contain encoded payloads)
+  {
+    name: 'Unvalidated JSON in prompt',
+    pattern: /JSON\.parse\s*\([^)]*(?:userInput|body|request|external)[^)]*\)[^;]*(?:\+|,)[^;]*(?:prompt|system|message)/gi,
+    severity: 'medium',
+    description: 'Parsed JSON content directly used in prompt. JSON values could contain encoded injection payloads.',
+    suggestedFix: 'Validate JSON schema and sanitize string values before including in prompts.',
+    checkDelimiters: true,
+  },
+  // Unicode escape sequences that could hide instructions
+  {
+    name: 'Unicode content in prompt',
+    pattern: /(?:String\.fromCharCode|String\.fromCodePoint|chr\(|unichr\()\s*\([^)]+\)[^;]*(?:\+|,)[^;]*(?:prompt|system|message)/gi,
+    severity: 'low',
+    description: 'Unicode character construction flows into prompt. Could be used to hide malicious characters.',
+    suggestedFix: 'Normalize and validate Unicode content before including in prompts.',
+  },
+]
+
+// ============================================================================
+// Sprint 6: Jailbreak Pattern Detection
+// ============================================================================
+
+/**
+ * Common jailbreak preamble patterns that indicate injection attempts
+ * These detect when user input flow might contain jailbreak phrases
+ */
+const JAILBREAK_INDICATOR_PATTERNS: PromptHygienePattern[] = [
+  // Instruction override phrases flowing to LLM
+  {
+    name: 'Instruction override phrases in input flow',
+    pattern: /(?:userInput|userMessage|input|message|query)\s*[=:][^\n]*(?:ignore\s+(?:all\s+)?previous\s+(?:instructions|prompts)|disregard\s+(?:your\s+)?(?:rules|guidelines|instructions))/gi,
+    severity: 'high',
+    description: 'User input variable contains instruction override phrases. Classic jailbreak attempt detected.',
+    suggestedFix: 'Implement jailbreak detection filter. Block or sanitize inputs containing instruction override patterns.',
+  },
+  // Role-playing jailbreak attempts
+  {
+    name: 'Role-playing jailbreak in input',
+    pattern: /(?:userInput|userMessage|input|message|query)\s*[=:][^\n]*(?:you\s+are\s+now\s+(?:a|an)\s+\w+|pretend\s+(?:you|to\s+be)\s+(?:are\s+)?(?:a|an|not)|act\s+as\s+(?:if|though)\s+you)/gi,
+    severity: 'medium',
+    description: 'User input contains role-playing jailbreak patterns. Attempts to make model assume a different persona.',
+    suggestedFix: 'Filter role-manipulation phrases from user input. Implement persona consistency checks.',
+  },
+  // "From now on" style instruction changes
+  {
+    name: 'Instruction change phrases',
+    pattern: /(?:userInput|userMessage|input|message|query)\s*[=:][^\n]*(?:from\s+now\s+on\s+(?:you\s+will|ignore)|for\s+the\s+rest\s+of\s+this\s+(?:conversation|session))/gi,
+    severity: 'medium',
+    description: 'User input contains temporal instruction override attempts. Tries to change model behavior for the session.',
+    suggestedFix: 'Sanitize phrases that attempt to change ongoing behavior.',
+  },
+  // Developer mode / DAN style jailbreaks
+  {
+    name: 'Developer mode jailbreak patterns',
+    pattern: /(?:userInput|userMessage|input|message|query)\s*[=:][^\n]*(?:developer\s+mode|DAN|Do\s+Anything\s+Now|jailbreak|no\s+restrictions)/gi,
+    severity: 'high',
+    description: 'User input contains known jailbreak terminology (DAN, developer mode). High-confidence malicious input.',
+    suggestedFix: 'Block inputs containing known jailbreak terminology. Log for security review.',
+  },
+  // Hypothetical scenario framing
+  {
+    name: 'Hypothetical framing jailbreak',
+    pattern: /(?:userInput|userMessage|input|message|query)\s*[=:][^\n]*(?:hypothetically|in\s+a\s+(?:fictional|imaginary)\s+(?:world|scenario)|what\s+if\s+you\s+(?:could|had\s+no))/gi,
+    severity: 'low',
+    description: 'User input uses hypothetical framing often used in jailbreak attempts. May be legitimate creative use.',
+    suggestedFix: 'Apply additional scrutiny to hypothetically-framed requests. Consider context before blocking.',
+  },
+]
+
+/**
+ * Check if input sanitization is present for jailbreak patterns
+ */
+function hasJailbreakFiltering(content: string, lineNumber: number, lines?: string[]): boolean {
+  const _lines = lines ?? content.split('\n')
+  const contextStart = Math.max(0, lineNumber - 20)
+  const contextEnd = Math.min(_lines.length, lineNumber + 10)
+  const context = _lines.slice(contextStart, contextEnd).join('\n')
+
+  const filteringPatterns = [
+    /filterJailbreak|detectJailbreak|jailbreakFilter/i,
+    /sanitizePrompt|filterPrompt|cleanPrompt/i,
+    /blockInjection|preventInjection/i,
+    /moderationApi|contentModeration/i,
+    /instructionFilter|roleFilter/i,
+    /guardRails|guardrail/i,
+    /promptGuard|inputGuard/i,
+  ]
+
+  return filteringPatterns.some(p => p.test(context))
+}
+
+/**
+ * Check if encoding sanitization is present
+ */
+function hasEncodingSanitization(content: string, lineNumber: number, lines?: string[]): boolean {
+  const _lines = lines ?? content.split('\n')
+  const contextStart = Math.max(0, lineNumber - 15)
+  const contextEnd = Math.min(_lines.length, lineNumber + 5)
+  const context = _lines.slice(contextStart, contextEnd).join('\n')
+
+  const sanitizationPatterns = [
+    /validateDecoded|sanitizeDecoded/i,
+    /afterDecode.*sanitize|decode.*then.*filter/i,
+    /normalizeInput|sanitizeInput/i,
+    /schema\.parse|validate.*schema/i,
+    /stripControlChars|removeControlTokens/i,
+  ]
+
+  return sanitizationPatterns.some(p => p.test(context))
+}
+
 // ============================================================================
 // Detection Functions
 // ============================================================================
@@ -648,11 +853,11 @@ const MISSING_BOUNDARY_PATTERNS: PromptHygienePattern[] = [
 /**
  * Get surrounding context lines for analysis
  */
-function getSurroundingContext(content: string, lineIndex: number, windowSize: number = 10): string[] {
-  const lines = content.split('\n')
+function getSurroundingContext(content: string, lineIndex: number, windowSize: number = 10, lines?: string[]): string[] {
+  const _lines = lines ?? content.split('\n')
   const start = Math.max(0, lineIndex - windowSize)
-  const end = Math.min(lines.length, lineIndex + windowSize)
-  return lines.slice(start, end)
+  const end = Math.min(_lines.length, lineIndex + windowSize)
+  return _lines.slice(start, end)
 }
 
 /**
@@ -660,7 +865,8 @@ function getSurroundingContext(content: string, lineIndex: number, windowSize: n
  */
 export function detectAIPromptHygiene(
   content: string,
-  filePath: string
+  filePath: string,
+  options?: { parsed?: ParsedFile }
 ): Vulnerability[] {
   const vulnerabilities: Vulnerability[] = []
 
@@ -673,7 +879,7 @@ export function detectAIPromptHygiene(
     return vulnerabilities
   }
 
-  const lines = content.split('\n')
+  const lines = options?.parsed?.lines ?? content.split('\n')
   const isTestFile = isTestOrMockFile(filePath)
 
   // Scan for unsafe interpolation patterns (B1)
@@ -694,7 +900,7 @@ export function detectAIPromptHygiene(
       // Check for delimiters if applicable
       let severity = pattern.severity
       let description = pattern.description
-      const contextLines = getSurroundingContext(content, lineNumber - 1, 15)
+      const contextLines = getSurroundingContext(content, lineNumber - 1, 15, lines)
 
       if (pattern.checkDelimiters && hasPromptDelimiters(lineContent, contextLines)) {
         // Delimiters present - downgrade severity
@@ -720,7 +926,9 @@ export function detectAIPromptHygiene(
         suggestedFix: pattern.suggestedFix,
         confidence: severity === 'info' ? 'low' : 'medium',
         layer: 2,
+        source: 'ai_code' as const,
         requiresAIValidation: severity !== 'info',
+        baseConfidence: BASE_CONFIDENCE,
       })
     }
   }
@@ -769,7 +977,9 @@ export function detectAIPromptHygiene(
         suggestedFix: pattern.suggestedFix,
         confidence: 'high',
         layer: 2,
+        source: 'ai_code' as const,
         requiresAIValidation: false, // Secrets don't need AI validation - they're definitive
+        baseConfidence: BASE_CONFIDENCE,
       })
     }
   }
@@ -834,14 +1044,16 @@ export function detectAIPromptHygiene(
         suggestedFix: 'Remove the hardcoded secret. Use environment variables server-side. Never expose secrets to LLM prompts.',
         confidence: 'high',
         layer: 2,
+        source: 'ai_code' as const,
         requiresAIValidation: false,
+        baseConfidence: BASE_CONFIDENCE,
       })
     }
   }
 
   // ========== NEW: Variable flow detection ==========
   // Detect secrets flowing from variables into prompts
-  const flowVulns = detectSecretVariableFlow(content, filePath, isTestFile)
+  const flowVulns = detectSecretVariableFlow(content, filePath, isTestFile, lines)
   vulnerabilities.push(...flowVulns)
 
   // Scan for missing boundary patterns (B1 continued)
@@ -856,7 +1068,7 @@ export function detectAIPromptHygiene(
       // Skip comments
       if (isComment(lineContent)) continue
 
-      const contextLines = getSurroundingContext(content, lineNumber - 1, 10)
+      const contextLines = getSurroundingContext(content, lineNumber - 1, 10, lines)
 
       // Skip if delimiters are present
       if (hasPromptDelimiters(lineContent, contextLines)) continue
@@ -881,7 +1093,9 @@ export function detectAIPromptHygiene(
         suggestedFix: pattern.suggestedFix,
         confidence: 'medium',
         layer: 2,
+        source: 'ai_code' as const,
         requiresAIValidation: true,
+        baseConfidence: BASE_CONFIDENCE,
       })
     }
   }
@@ -902,8 +1116,8 @@ export function detectAIPromptHygiene(
       let description = pattern.description
 
       // Check for content filtering/sanitization
-      const hasFiltering = hasContentFiltering(content, lineNumber)
-      const hasDelimiters = hasExternalContentDelimiters(content, lineNumber)
+      const hasFiltering = hasContentFiltering(content, lineNumber, lines)
+      const hasDelimiters = hasExternalContentDelimiters(content, lineNumber, lines)
 
       if (hasFiltering && hasDelimiters) {
         // Both mitigations present - fully mitigated
@@ -937,7 +1151,158 @@ export function detectAIPromptHygiene(
         suggestedFix: pattern.suggestedFix,
         confidence: severity === 'info' ? 'low' : 'medium',
         layer: 2,
+        source: 'ai_code' as const,
         requiresAIValidation: severity !== 'info',
+        baseConfidence: BASE_CONFIDENCE,
+      })
+    }
+  }
+
+  // ========== Sprint 6: Model-specific injection markers ==========
+  for (const pattern of MODEL_SPECIFIC_INJECTION_PATTERNS) {
+    const regex = new RegExp(pattern.pattern.source, pattern.pattern.flags)
+    let match
+
+    while ((match = regex.exec(content)) !== null) {
+      const lineNumber = content.substring(0, match.index).split('\n').length
+      const lineContent = lines[lineNumber - 1]?.trim() || ''
+
+      // Skip comments
+      if (isComment(lineContent)) continue
+
+      let severity = pattern.severity
+      let description = pattern.description
+      const contextLines = getSurroundingContext(content, lineNumber - 1, 15, lines)
+
+      // Check for delimiters/sanitization
+      if (pattern.checkDelimiters && hasPromptDelimiters(lineContent, contextLines)) {
+        severity = 'info'
+        description += ' (Delimiters detected, risk mitigated.)'
+      }
+
+      // Check for jailbreak filtering
+      if (hasJailbreakFiltering(content, lineNumber, lines)) {
+        severity = severity === 'high' ? 'medium' : 'low'
+        description += ' (Jailbreak filtering detected.)'
+      }
+
+      if (isTestFile) {
+        severity = 'info'
+        description += ' (in test file)'
+      }
+
+      vulnerabilities.push({
+        id: `ai-model-injection-${filePath}-${lineNumber}-${pattern.name.replace(/\s+/g, '-')}`,
+        filePath,
+        lineNumber,
+        lineContent,
+        severity,
+        category: 'ai_prompt_injection',
+        title: pattern.name,
+        description,
+        suggestedFix: pattern.suggestedFix,
+        confidence: severity === 'info' ? 'low' : 'medium',
+        layer: 2,
+        source: 'ai_code' as const,
+        requiresAIValidation: severity !== 'info' && severity !== 'low',
+        baseConfidence: BASE_CONFIDENCE,
+      })
+    }
+  }
+
+  // ========== Sprint 6: Encoding-based escape detection ==========
+  for (const pattern of ENCODING_ESCAPE_PATTERNS) {
+    const regex = new RegExp(pattern.pattern.source, pattern.pattern.flags)
+    let match
+
+    while ((match = regex.exec(content)) !== null) {
+      const lineNumber = content.substring(0, match.index).split('\n').length
+      const lineContent = lines[lineNumber - 1]?.trim() || ''
+
+      // Skip comments
+      if (isComment(lineContent)) continue
+
+      let severity = pattern.severity
+      let description = pattern.description
+      const contextLines = getSurroundingContext(content, lineNumber - 1, 15, lines)
+
+      // Check for encoding sanitization
+      if (hasEncodingSanitization(content, lineNumber, lines)) {
+        severity = 'info'
+        description += ' (Encoding sanitization detected.)'
+      }
+
+      // Check for delimiters
+      if (pattern.checkDelimiters && hasPromptDelimiters(lineContent, contextLines)) {
+        severity = 'info'
+        description += ' (Delimiters detected.)'
+      }
+
+      if (isTestFile) {
+        severity = 'info'
+        description += ' (in test file)'
+      }
+
+      vulnerabilities.push({
+        id: `ai-encoding-escape-${filePath}-${lineNumber}-${pattern.name.replace(/\s+/g, '-')}`,
+        filePath,
+        lineNumber,
+        lineContent,
+        severity,
+        category: 'ai_prompt_injection',
+        title: pattern.name + ' (Encoding Bypass)',
+        description,
+        suggestedFix: pattern.suggestedFix,
+        confidence: 'medium',
+        layer: 2,
+        source: 'ai_code' as const,
+        requiresAIValidation: severity !== 'info',
+        baseConfidence: BASE_CONFIDENCE,
+      })
+    }
+  }
+
+  // ========== Sprint 6: Jailbreak pattern detection ==========
+  for (const pattern of JAILBREAK_INDICATOR_PATTERNS) {
+    const regex = new RegExp(pattern.pattern.source, pattern.pattern.flags)
+    let match
+
+    while ((match = regex.exec(content)) !== null) {
+      const lineNumber = content.substring(0, match.index).split('\n').length
+      const lineContent = lines[lineNumber - 1]?.trim() || ''
+
+      // Skip comments
+      if (isComment(lineContent)) continue
+
+      let severity = pattern.severity
+      let description = pattern.description
+
+      // Check for jailbreak filtering
+      if (hasJailbreakFiltering(content, lineNumber, lines)) {
+        severity = 'info'
+        description += ' (Jailbreak filtering detected - mitigated.)'
+      }
+
+      if (isTestFile) {
+        severity = 'info'
+        description += ' (in test file)'
+      }
+
+      vulnerabilities.push({
+        id: `ai-jailbreak-${filePath}-${lineNumber}-${pattern.name.replace(/\s+/g, '-')}`,
+        filePath,
+        lineNumber,
+        lineContent,
+        severity,
+        category: 'ai_prompt_injection',
+        title: pattern.name + ' (Jailbreak Risk)',
+        description,
+        suggestedFix: pattern.suggestedFix,
+        confidence: severity === 'info' ? 'low' : 'medium',
+        layer: 2,
+        source: 'ai_code' as const,
+        requiresAIValidation: severity !== 'info' && severity !== 'low',
+        baseConfidence: BASE_CONFIDENCE,
       })
     }
   }