npm - @oculum/scanner - Versions diffs - 1.0.13 → 1.0.15 - Mend

@oculum/scanner 1.0.13 → 1.0.15

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1328) hide show

package/dist/detect/ai-code/index.d.ts +6 -11
package/dist/detect/ai-code/index.d.ts.map +1 -1
package/dist/detect/ai-code/index.js +6 -24
package/dist/detect/ai-code/index.js.map +1 -1
package/dist/detect/ast-rules/agent-tools-ast.d.ts +14 -0
package/dist/detect/ast-rules/agent-tools-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/agent-tools-ast.js +809 -0
package/dist/detect/ast-rules/agent-tools-ast.js.map +1 -0
package/dist/detect/ast-rules/ai-fingerprinting-ast.d.ts +14 -0
package/dist/detect/ast-rules/ai-fingerprinting-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/ai-fingerprinting-ast.js +344 -0
package/dist/detect/ast-rules/ai-fingerprinting-ast.js.map +1 -0
package/dist/detect/ast-rules/auth-patterns-ast.d.ts +14 -0
package/dist/detect/ast-rules/auth-patterns-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/auth-patterns-ast.js +280 -0
package/dist/detect/ast-rules/auth-patterns-ast.js.map +1 -0
package/dist/detect/ast-rules/byok-ast.d.ts +13 -0
package/dist/detect/ast-rules/byok-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/byok-ast.js +180 -0
package/dist/detect/ast-rules/byok-ast.js.map +1 -0
package/dist/detect/ast-rules/child-process-ast.d.ts +13 -0
package/dist/detect/ast-rules/child-process-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/child-process-ast.js +252 -0
package/dist/detect/ast-rules/child-process-ast.js.map +1 -0
package/dist/detect/ast-rules/dangerous-eval-ast.d.ts +13 -0
package/dist/detect/ast-rules/dangerous-eval-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/dangerous-eval-ast.js +218 -0
package/dist/detect/ast-rules/dangerous-eval-ast.js.map +1 -0
package/dist/detect/ast-rules/data-exposure-ast.d.ts +13 -0
package/dist/detect/ast-rules/data-exposure-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/data-exposure-ast.js +158 -0
package/dist/detect/ast-rules/data-exposure-ast.js.map +1 -0
package/dist/detect/ast-rules/dom-xss-ast.d.ts +14 -0
package/dist/detect/ast-rules/dom-xss-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/dom-xss-ast.js +217 -0
package/dist/detect/ast-rules/dom-xss-ast.js.map +1 -0
package/dist/detect/ast-rules/endpoint-protection-ast.d.ts +13 -0
package/dist/detect/ast-rules/endpoint-protection-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/endpoint-protection-ast.js +228 -0
package/dist/detect/ast-rules/endpoint-protection-ast.js.map +1 -0
package/dist/detect/ast-rules/entropy-ast.d.ts +17 -0
package/dist/detect/ast-rules/entropy-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/entropy-ast.js +265 -0
package/dist/detect/ast-rules/entropy-ast.js.map +1 -0
package/dist/detect/ast-rules/flask-debug-ast.d.ts +10 -0
package/dist/detect/ast-rules/flask-debug-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/flask-debug-ast.js +125 -0
package/dist/detect/ast-rules/flask-debug-ast.js.map +1 -0
package/dist/detect/ast-rules/framework-checks-ast.d.ts +13 -0
package/dist/detect/ast-rules/framework-checks-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/framework-checks-ast.js +185 -0
package/dist/detect/ast-rules/framework-checks-ast.js.map +1 -0
package/dist/detect/ast-rules/helpers/call-analysis.d.ts +62 -0
package/dist/detect/ast-rules/helpers/call-analysis.d.ts.map +1 -0
package/dist/detect/ast-rules/helpers/call-analysis.js +217 -0
package/dist/detect/ast-rules/helpers/call-analysis.js.map +1 -0
package/dist/detect/ast-rules/helpers/context-detection.d.ts +33 -0
package/dist/detect/ast-rules/helpers/context-detection.d.ts.map +1 -0
package/dist/detect/ast-rules/helpers/context-detection.js +256 -0
package/dist/detect/ast-rules/helpers/context-detection.js.map +1 -0
package/dist/detect/ast-rules/helpers/control-flow.d.ts +40 -0
package/dist/detect/ast-rules/helpers/control-flow.d.ts.map +1 -0
package/dist/detect/ast-rules/helpers/control-flow.js +174 -0
package/dist/detect/ast-rules/helpers/control-flow.js.map +1 -0
package/dist/detect/ast-rules/helpers/import-analysis.d.ts +43 -0
package/dist/detect/ast-rules/helpers/import-analysis.d.ts.map +1 -0
package/dist/detect/ast-rules/helpers/import-analysis.js +149 -0
package/dist/detect/ast-rules/helpers/import-analysis.js.map +1 -0
package/dist/detect/ast-rules/helpers/index.d.ts +16 -0
package/dist/detect/ast-rules/helpers/index.d.ts.map +1 -0
package/dist/detect/ast-rules/helpers/index.js +112 -0
package/dist/detect/ast-rules/helpers/index.js.map +1 -0
package/dist/detect/ast-rules/helpers/python-helpers.d.ts +215 -0
package/dist/detect/ast-rules/helpers/python-helpers.d.ts.map +1 -0
package/dist/detect/ast-rules/helpers/python-helpers.js +935 -0
package/dist/detect/ast-rules/helpers/python-helpers.js.map +1 -0
package/dist/detect/ast-rules/helpers/scope-analysis.d.ts +50 -0
package/dist/detect/ast-rules/helpers/scope-analysis.d.ts.map +1 -0
package/dist/detect/ast-rules/helpers/scope-analysis.js +194 -0
package/dist/detect/ast-rules/helpers/scope-analysis.js.map +1 -0
package/dist/detect/ast-rules/helpers/string-analysis.d.ts +57 -0
package/dist/detect/ast-rules/helpers/string-analysis.d.ts.map +1 -0
package/dist/detect/ast-rules/helpers/string-analysis.js +184 -0
package/dist/detect/ast-rules/helpers/string-analysis.js.map +1 -0
package/dist/detect/ast-rules/helpers/type-extraction.d.ts +44 -0
package/dist/detect/ast-rules/helpers/type-extraction.d.ts.map +1 -0
package/dist/detect/ast-rules/helpers/type-extraction.js +125 -0
package/dist/detect/ast-rules/helpers/type-extraction.js.map +1 -0
package/dist/detect/ast-rules/helpers/user-input.d.ts +35 -0
package/dist/detect/ast-rules/helpers/user-input.d.ts.map +1 -0
package/dist/detect/ast-rules/helpers/user-input.js +243 -0
package/dist/detect/ast-rules/helpers/user-input.js.map +1 -0
package/dist/detect/ast-rules/index.d.ts +112 -0
package/dist/detect/ast-rules/index.d.ts.map +1 -0
package/dist/detect/ast-rules/index.js +232 -0
package/dist/detect/ast-rules/index.js.map +1 -0
package/dist/detect/ast-rules/json-parse-ast.d.ts +13 -0
package/dist/detect/ast-rules/json-parse-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/json-parse-ast.js +143 -0
package/dist/detect/ast-rules/json-parse-ast.js.map +1 -0
package/dist/detect/ast-rules/log-injection-ast.d.ts +14 -0
package/dist/detect/ast-rules/log-injection-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/log-injection-ast.js +235 -0
package/dist/detect/ast-rules/log-injection-ast.js.map +1 -0
package/dist/detect/ast-rules/logic-gates-ast.d.ts +14 -0
package/dist/detect/ast-rules/logic-gates-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/logic-gates-ast.js +312 -0
package/dist/detect/ast-rules/logic-gates-ast.js.map +1 -0
package/dist/detect/ast-rules/mcp-security-ast.d.ts +14 -0
package/dist/detect/ast-rules/mcp-security-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/mcp-security-ast.js +755 -0
package/dist/detect/ast-rules/mcp-security-ast.js.map +1 -0
package/dist/detect/ast-rules/model-supply-chain-ast.d.ts +13 -0
package/dist/detect/ast-rules/model-supply-chain-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/model-supply-chain-ast.js +188 -0
package/dist/detect/ast-rules/model-supply-chain-ast.js.map +1 -0
package/dist/detect/ast-rules/package-hallucination-ast.d.ts +13 -0
package/dist/detect/ast-rules/package-hallucination-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/package-hallucination-ast.js +607 -0
package/dist/detect/ast-rules/package-hallucination-ast.js.map +1 -0
package/dist/detect/ast-rules/prompt-hygiene-ast.d.ts +15 -0
package/dist/detect/ast-rules/prompt-hygiene-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/prompt-hygiene-ast.js +332 -0
package/dist/detect/ast-rules/prompt-hygiene-ast.js.map +1 -0
package/dist/detect/ast-rules/rag-safety-ast.d.ts +18 -0
package/dist/detect/ast-rules/rag-safety-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/rag-safety-ast.js +640 -0
package/dist/detect/ast-rules/rag-safety-ast.js.map +1 -0
package/dist/detect/ast-rules/request-validation-ast.d.ts +13 -0
package/dist/detect/ast-rules/request-validation-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/request-validation-ast.js +116 -0
package/dist/detect/ast-rules/request-validation-ast.js.map +1 -0
package/dist/detect/ast-rules/risky-imports-ast.d.ts +14 -0
package/dist/detect/ast-rules/risky-imports-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/risky-imports-ast.js +114 -0
package/dist/detect/ast-rules/risky-imports-ast.js.map +1 -0
package/dist/detect/ast-rules/schema-validation-ast.d.ts +14 -0
package/dist/detect/ast-rules/schema-validation-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/schema-validation-ast.js +233 -0
package/dist/detect/ast-rules/schema-validation-ast.js.map +1 -0
package/dist/detect/ast-rules/secret-patterns-ast.d.ts +17 -0
package/dist/detect/ast-rules/secret-patterns-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/secret-patterns-ast.js +199 -0
package/dist/detect/ast-rules/secret-patterns-ast.js.map +1 -0
package/dist/detect/ast-rules/security-headers-ast.d.ts +14 -0
package/dist/detect/ast-rules/security-headers-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/security-headers-ast.js +187 -0
package/dist/detect/ast-rules/security-headers-ast.js.map +1 -0
package/dist/detect/ast-rules/sql-injection-ast.d.ts +17 -0
package/dist/detect/ast-rules/sql-injection-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/sql-injection-ast.js +497 -0
package/dist/detect/ast-rules/sql-injection-ast.js.map +1 -0
package/dist/detect/ast-rules/ssrf-ast.d.ts +14 -0
package/dist/detect/ast-rules/ssrf-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/ssrf-ast.js +573 -0
package/dist/detect/ast-rules/ssrf-ast.js.map +1 -0
package/dist/detect/ast-rules/taint-fix-templates.d.ts +18 -0
package/dist/detect/ast-rules/taint-fix-templates.d.ts.map +1 -0
package/dist/detect/ast-rules/taint-fix-templates.js +92 -0
package/dist/detect/ast-rules/taint-fix-templates.js.map +1 -0
package/dist/detect/ast-rules/taint-flow-ast.d.ts +24 -0
package/dist/detect/ast-rules/taint-flow-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/taint-flow-ast.js +340 -0
package/dist/detect/ast-rules/taint-flow-ast.js.map +1 -0
package/dist/detect/ast-rules/variables-ast.d.ts +24 -0
package/dist/detect/ast-rules/variables-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/variables-ast.js +362 -0
package/dist/detect/ast-rules/variables-ast.js.map +1 -0
package/dist/detect/ast-rules/weak-crypto-ast.d.ts +15 -0
package/dist/detect/ast-rules/weak-crypto-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/weak-crypto-ast.js +406 -0
package/dist/detect/ast-rules/weak-crypto-ast.js.map +1 -0
package/dist/detect/ast-rules/xxe-ast.d.ts +13 -0
package/dist/detect/ast-rules/xxe-ast.d.ts.map +1 -0
package/dist/detect/ast-rules/xxe-ast.js +157 -0
package/dist/detect/ast-rules/xxe-ast.js.map +1 -0
package/dist/detect/config/agent-skill-injection.d.ts.map +1 -1
package/dist/detect/config/agent-skill-injection.js +2 -24
package/dist/detect/config/agent-skill-injection.js.map +1 -1
package/dist/detect/config/index.d.ts +1 -0
package/dist/detect/config/index.d.ts.map +1 -1
package/dist/detect/config/index.js +3 -1
package/dist/detect/config/index.js.map +1 -1
package/dist/detect/config/osv-check.d.ts.map +1 -1
package/dist/detect/config/osv-check.js +6 -1
package/dist/detect/config/osv-check.js.map +1 -1
package/dist/detect/config/package-check.d.ts.map +1 -1
package/dist/detect/config/package-check.js +6 -1
package/dist/detect/config/package-check.js.map +1 -1
package/dist/detect/config/rules-file-backdoor.d.ts +36 -0
package/dist/detect/config/rules-file-backdoor.d.ts.map +1 -0
package/dist/detect/config/rules-file-backdoor.js +379 -0
package/dist/detect/config/rules-file-backdoor.js.map +1 -0
package/dist/detect/index.d.ts +43 -6
package/dist/detect/index.d.ts.map +1 -1
package/dist/detect/index.js +70 -7
package/dist/detect/index.js.map +1 -1
package/dist/detect/secrets/config-audit.d.ts +5 -0
package/dist/detect/secrets/config-audit.d.ts.map +1 -1
package/dist/detect/secrets/config-audit.js +131 -3
package/dist/detect/secrets/config-audit.js.map +1 -1
package/dist/detect/secrets/entropy.d.ts.map +1 -1
package/dist/detect/secrets/entropy.js +180 -0
package/dist/detect/secrets/entropy.js.map +1 -1
package/dist/detect/secrets/index.d.ts +0 -2
package/dist/detect/secrets/index.d.ts.map +1 -1
package/dist/detect/secrets/index.js +7 -17
package/dist/detect/secrets/index.js.map +1 -1
package/dist/detect/structural/index.d.ts +15 -28
package/dist/detect/structural/index.d.ts.map +1 -1
package/dist/detect/structural/index.js +20 -497
package/dist/detect/structural/index.js.map +1 -1
package/dist/index.d.ts +3 -0
package/dist/index.d.ts.map +1 -1
package/dist/index.js +9 -1
package/dist/index.js.map +1 -1
package/dist/model/auth-helper-detector.d.ts.map +1 -1
package/dist/model/auth-helper-detector.js +2 -7
package/dist/model/auth-helper-detector.js.map +1 -1
package/dist/model/import-resolver.d.ts.map +1 -1
package/dist/model/import-resolver.js +94 -0
package/dist/model/import-resolver.js.map +1 -1
package/dist/model/imported-auth-detector.js +8 -8
package/dist/model/imported-auth-detector.js.map +1 -1
package/dist/model/index.d.ts +8 -0
package/dist/model/index.d.ts.map +1 -1
package/dist/model/index.js +198 -73
package/dist/model/index.js.map +1 -1
package/dist/model/module-graph.d.ts.map +1 -1
package/dist/model/module-graph.js +22 -9
package/dist/model/module-graph.js.map +1 -1
package/dist/model/project-context.d.ts +1 -1
package/dist/model/project-context.d.ts.map +1 -1
package/dist/model/project-context.js +34 -0
package/dist/model/project-context.js.map +1 -1
package/dist/model/route-auth-resolver.d.ts.map +1 -1
package/dist/model/route-auth-resolver.js +17 -2
package/dist/model/route-auth-resolver.js.map +1 -1
package/dist/model/route-discovery/index.js +1 -1
package/dist/model/route-discovery/index.js.map +1 -1
package/dist/model/route-discovery/nextjs.js +1 -1
package/dist/model/route-discovery/nextjs.js.map +1 -1
package/dist/model/route-discovery/python.d.ts +6 -3
package/dist/model/route-discovery/python.d.ts.map +1 -1
package/dist/model/route-discovery/python.js +132 -9
package/dist/model/route-discovery/python.js.map +1 -1
package/dist/model/route-discovery/types.d.ts +1 -1
package/dist/model/route-discovery/types.d.ts.map +1 -1
package/dist/model/route-discovery/utils.d.ts +8 -0
package/dist/model/route-discovery/utils.d.ts.map +1 -1
package/dist/model/route-discovery/utils.js +70 -0
package/dist/model/route-discovery/utils.js.map +1 -1
package/dist/model/taint-types.d.ts +0 -4
package/dist/model/taint-types.d.ts.map +1 -1
package/dist/parse/ast.d.ts +58 -0
package/dist/parse/ast.d.ts.map +1 -0
package/dist/parse/ast.js +230 -0
package/dist/parse/ast.js.map +1 -0
package/dist/parse/call-graph.d.ts +41 -0
package/dist/parse/call-graph.d.ts.map +1 -0
package/dist/parse/call-graph.js +386 -0
package/dist/parse/call-graph.js.map +1 -0
package/dist/parse/file-classifier.d.ts +11 -0
package/dist/parse/file-classifier.d.ts.map +1 -1
package/dist/parse/file-classifier.js +63 -15
package/dist/parse/file-classifier.js.map +1 -1
package/dist/parse/node-index.d.ts +32 -0
package/dist/parse/node-index.d.ts.map +1 -0
package/dist/parse/node-index.js +103 -0
package/dist/parse/node-index.js.map +1 -0
package/dist/parse/type-extractor.d.ts +50 -0
package/dist/parse/type-extractor.d.ts.map +1 -0
package/dist/parse/type-extractor.js +243 -0
package/dist/parse/type-extractor.js.map +1 -0
package/dist/pipeline/config.d.ts +10 -2
package/dist/pipeline/config.d.ts.map +1 -1
package/dist/pipeline/config.js.map +1 -1
package/dist/pipeline/index.d.ts +3 -3
package/dist/pipeline/index.d.ts.map +1 -1
package/dist/pipeline/index.js +214 -65
package/dist/pipeline/index.js.map +1 -1
package/dist/pipeline/modes/incremental.d.ts.map +1 -1
package/dist/pipeline/modes/incremental.js +2 -7
package/dist/pipeline/modes/incremental.js.map +1 -1
package/dist/postprocess/dedup.d.ts +5 -2
package/dist/postprocess/dedup.d.ts.map +1 -1
package/dist/postprocess/dedup.js +47 -16
package/dist/postprocess/dedup.js.map +1 -1
package/dist/report/build-result.d.ts +9 -4
package/dist/report/build-result.d.ts.map +1 -1
package/dist/report/build-result.js +15 -4
package/dist/report/build-result.js.map +1 -1
package/dist/report/formatters/cli-terminal.d.ts +1 -1
package/dist/report/formatters/cli-terminal.d.ts.map +1 -1
package/dist/report/formatters/cli-terminal.js +434 -231
package/dist/report/formatters/cli-terminal.js.map +1 -1
package/dist/report/sanitize.d.ts +10 -0
package/dist/report/sanitize.d.ts.map +1 -0
package/dist/report/sanitize.js +19 -0
package/dist/report/sanitize.js.map +1 -0
package/dist/score/adjustments.d.ts +20 -2
package/dist/score/adjustments.d.ts.map +1 -1
package/dist/score/adjustments.js +108 -37
package/dist/score/adjustments.js.map +1 -1
package/dist/score/confidence.d.ts +6 -0
package/dist/score/confidence.d.ts.map +1 -1
package/dist/score/confidence.js +10 -4
package/dist/score/confidence.js.map +1 -1
package/dist/score/evidence.d.ts +25 -0
package/dist/score/evidence.d.ts.map +1 -0
package/dist/score/evidence.js +51 -0
package/dist/score/evidence.js.map +1 -0
package/dist/score/index.d.ts +3 -1
package/dist/score/index.d.ts.map +1 -1
package/dist/score/index.js +25 -50
package/dist/score/index.js.map +1 -1
package/dist/score/types.d.ts +5 -1
package/dist/score/types.d.ts.map +1 -1
package/dist/shared/category-filter.d.ts.map +1 -1
package/dist/shared/category-filter.js +12 -0
package/dist/shared/category-filter.js.map +1 -1
package/dist/shared/regex-utils.d.ts +3 -0
package/dist/shared/regex-utils.d.ts.map +1 -0
package/dist/shared/regex-utils.js +8 -0
package/dist/shared/regex-utils.js.map +1 -0
package/dist/shared/registry-clients.d.ts +7 -0
package/dist/shared/registry-clients.d.ts.map +1 -1
package/dist/shared/registry-clients.js +94 -17
package/dist/shared/registry-clients.js.map +1 -1
package/dist/shared/rules/metadata.d.ts.map +1 -1
package/dist/shared/rules/metadata.js +17 -0
package/dist/shared/rules/metadata.js.map +1 -1
package/dist/shared/types.d.ts +60 -16
package/dist/shared/types.d.ts.map +1 -1
package/dist/shared/types.js +38 -21
package/dist/shared/types.js.map +1 -1
package/dist/taint/async-flow.d.ts +44 -0
package/dist/taint/async-flow.d.ts.map +1 -0
package/dist/taint/async-flow.js +271 -0
package/dist/taint/async-flow.js.map +1 -0
package/dist/taint/cfg-builder.d.ts +35 -0
package/dist/taint/cfg-builder.d.ts.map +1 -0
package/dist/taint/cfg-builder.js +980 -0
package/dist/taint/cfg-builder.js.map +1 -0
package/dist/taint/cfg-types.d.ts +76 -0
package/dist/taint/cfg-types.d.ts.map +1 -0
package/dist/taint/cfg-types.js +13 -0
package/dist/taint/cfg-types.js.map +1 -0
package/dist/taint/constant-propagation.d.ts +34 -0
package/dist/taint/constant-propagation.d.ts.map +1 -0
package/dist/taint/constant-propagation.js +164 -0
package/dist/taint/constant-propagation.js.map +1 -0
package/dist/taint/cross-file-analyzer.d.ts +27 -0
package/dist/taint/cross-file-analyzer.d.ts.map +1 -0
package/dist/taint/cross-file-analyzer.js +99 -0
package/dist/taint/cross-file-analyzer.js.map +1 -0
package/dist/taint/cross-file-index.d.ts +59 -0
package/dist/taint/cross-file-index.d.ts.map +1 -0
package/dist/taint/cross-file-index.js +183 -0
package/dist/taint/cross-file-index.js.map +1 -0
package/dist/taint/def-use.d.ts +27 -0
package/dist/taint/def-use.d.ts.map +1 -0
package/dist/taint/def-use.js +519 -0
package/dist/taint/def-use.js.map +1 -0
package/dist/taint/file-analysis-cache.d.ts +47 -0
package/dist/taint/file-analysis-cache.d.ts.map +1 -0
package/dist/taint/file-analysis-cache.js +107 -0
package/dist/taint/file-analysis-cache.js.map +1 -0
package/dist/taint/framework-models.d.ts +77 -0
package/dist/taint/framework-models.d.ts.map +1 -0
package/dist/taint/framework-models.js +258 -0
package/dist/taint/framework-models.js.map +1 -0
package/dist/taint/helpers.d.ts +31 -0
package/dist/taint/helpers.d.ts.map +1 -0
package/dist/taint/helpers.js +130 -0
package/dist/taint/helpers.js.map +1 -0
package/dist/taint/index.d.ts +28 -0
package/dist/taint/index.d.ts.map +1 -0
package/dist/taint/index.js +77 -0
package/dist/taint/index.js.map +1 -0
package/dist/taint/llm-registry.d.ts +47 -0
package/dist/taint/llm-registry.d.ts.map +1 -0
package/dist/taint/llm-registry.js +152 -0
package/dist/taint/llm-registry.js.map +1 -0
package/dist/taint/llm-risk-scoring.d.ts +54 -0
package/dist/taint/llm-risk-scoring.d.ts.map +1 -0
package/dist/taint/llm-risk-scoring.js +376 -0
package/dist/taint/llm-risk-scoring.js.map +1 -0
package/dist/taint/propagation-types.d.ts +104 -0
package/dist/taint/propagation-types.d.ts.map +1 -0
package/dist/taint/propagation-types.js +98 -0
package/dist/taint/propagation-types.js.map +1 -0
package/dist/taint/propagation.d.ts +111 -0
package/dist/taint/propagation.d.ts.map +1 -0
package/dist/taint/propagation.js +1576 -0
package/dist/taint/propagation.js.map +1 -0
package/dist/taint/sanitizer-registry.d.ts +26 -0
package/dist/taint/sanitizer-registry.d.ts.map +1 -0
package/dist/taint/sanitizer-registry.js +422 -0
package/dist/taint/sanitizer-registry.js.map +1 -0
package/dist/taint/sink-classifier.d.ts +27 -0
package/dist/taint/sink-classifier.d.ts.map +1 -0
package/dist/taint/sink-classifier.js +1166 -0
package/dist/taint/sink-classifier.js.map +1 -0
package/dist/taint/source-classifier.d.ts +29 -0
package/dist/taint/source-classifier.d.ts.map +1 -0
package/dist/taint/source-classifier.js +814 -0
package/dist/taint/source-classifier.js.map +1 -0
package/dist/taint/taint-analyzer.d.ts +33 -0
package/dist/taint/taint-analyzer.d.ts.map +1 -0
package/dist/taint/taint-analyzer.js +88 -0
package/dist/taint/taint-analyzer.js.map +1 -0
package/dist/taint/taint-summary.d.ts +37 -0
package/dist/taint/taint-summary.d.ts.map +1 -0
package/dist/taint/taint-summary.js +293 -0
package/dist/taint/taint-summary.js.map +1 -0
package/dist/taint/types.d.ts +47 -0
package/dist/taint/types.d.ts.map +1 -0
package/dist/taint/types.js +19 -0
package/dist/taint/types.js.map +1 -0
package/dist/tiers.d.ts +2 -2
package/dist/tiers.js +1 -1
package/dist/validate/clients.d.ts +2 -1
package/dist/validate/clients.d.ts.map +1 -1
package/dist/validate/clients.js +3 -2
package/dist/validate/clients.js.map +1 -1
package/dist/validate/index.d.ts +5 -6
package/dist/validate/index.d.ts.map +1 -1
package/dist/validate/index.js +22 -21
package/dist/validate/index.js.map +1 -1
package/dist/validate/prompts/modules/ai-patterns.d.ts +1 -1
package/dist/validate/prompts/modules/ai-patterns.d.ts.map +1 -1
package/dist/validate/prompts/modules/ai-patterns.js +16 -0
package/dist/validate/prompts/modules/ai-patterns.js.map +1 -1
package/dist/validate/prompts/modules/common.d.ts +1 -1
package/dist/validate/prompts/modules/common.d.ts.map +1 -1
package/dist/validate/prompts/modules/common.js +12 -3
package/dist/validate/prompts/modules/common.js.map +1 -1
package/dist/validate/providers/anthropic.d.ts +4 -4
package/dist/validate/providers/anthropic.d.ts.map +1 -1
package/dist/validate/providers/anthropic.js +85 -58
package/dist/validate/providers/anthropic.js.map +1 -1
package/dist/validate/providers/openai.d.ts +4 -4
package/dist/validate/providers/openai.d.ts.map +1 -1
package/dist/validate/providers/openai.js +149 -99
package/dist/validate/providers/openai.js.map +1 -1
package/dist/validate/request-builder.d.ts +2 -8
package/dist/validate/request-builder.d.ts.map +1 -1
package/dist/validate/request-builder.js +4 -34
package/dist/validate/request-builder.js.map +1 -1
package/dist/validate/types.d.ts +9 -0
package/dist/validate/types.d.ts.map +1 -1
package/dist/validate/types.js.map +1 -1
package/dist/validate/utils/path-helpers.js +2 -2
package/dist/validate/utils/path-helpers.js.map +1 -1
package/dist/validate/utils/response-parser.d.ts +10 -0
package/dist/validate/utils/response-parser.d.ts.map +1 -1
package/dist/validate/utils/response-parser.js +21 -2
package/dist/validate/utils/response-parser.js.map +1 -1
package/dist/validate/utils/retry.d.ts.map +1 -1
package/dist/validate/utils/retry.js +19 -4
package/dist/validate/utils/retry.js.map +1 -1
package/package.json +7 -4
package/src/__tests__/benchmark/fixtures/layer2/ai-execution-sinks.ts +1 -1
package/src/__tests__/benchmark/planted-benchmark.test.ts +337 -0
package/src/__tests__/benchmark/utils/test-runner.ts +38 -4
package/src/__tests__/category-filter.test.ts +5 -1
package/src/__tests__/context-engine/route-discovery/python.test.ts +726 -0
package/src/__tests__/detect/ast-rules.test.ts +1043 -0
package/src/__tests__/detect/offline-mode.test.ts +147 -0
package/src/__tests__/detect/postinstall-enrichment.test.ts +300 -0
package/src/__tests__/detect/python-ast-rules.test.ts +569 -0
package/src/__tests__/detect/python-helpers.test.ts +536 -0
package/src/__tests__/detect/python-sast-rules.test.ts +453 -0
package/src/__tests__/detect/rules-file-backdoor-decoders.test.ts +151 -0
package/src/__tests__/detect/rules-file-backdoor.test.ts +284 -0
package/src/__tests__/detect/taint-fix-templates.test.ts +150 -0
package/src/__tests__/detect/taint-path-serialization.test.ts +170 -0
package/src/__tests__/parse/call-graph.test.ts +300 -0
package/src/__tests__/parse/python-parser.test.ts +274 -0
package/src/__tests__/regression/known-false-positives.test.ts +491 -9
package/src/__tests__/regression/rules-file-backdoor.test.ts +137 -0
package/src/__tests__/score/adjustments.test.ts +34 -16
package/src/__tests__/score/confidence.test.ts +84 -57
package/src/__tests__/score/evidence-scoring.test.ts +249 -0
package/src/__tests__/score/evidence.test.ts +144 -0
package/src/__tests__/score/scoring-integration.test.ts +56 -34
package/src/__tests__/score/taint-adjustments.test.ts +14 -228
package/src/__tests__/snapshots/__snapshots__/scan-depth.test.ts.snap +65 -59
package/src/__tests__/snapshots/scan-depth.test.ts +39 -7
package/src/__tests__/taint/async-flow.test.ts +247 -0
package/src/__tests__/taint/cfg-builder.test.ts +835 -0
package/src/__tests__/taint/constant-propagation.test.ts +302 -0
package/src/__tests__/taint/cross-file-index.test.ts +683 -0
package/src/__tests__/taint/cross-file-integration.test.ts +275 -0
package/src/__tests__/taint/cross-file-propagation.test.ts +910 -0
package/src/__tests__/taint/def-use.test.ts +132 -0
package/src/__tests__/taint/field-sensitive-sinks.test.ts +179 -0
package/src/__tests__/taint/field-sensitivity.test.ts +342 -0
package/src/__tests__/taint/file-analysis-cache.test.ts +290 -0
package/src/__tests__/taint/framework-models.test.ts +227 -0
package/src/__tests__/taint/llm-flow-graph.test.ts +850 -0
package/src/__tests__/taint/llm-risk-scoring.test.ts +439 -0
package/src/__tests__/taint/performance-parity.test.ts +315 -0
package/src/__tests__/taint/propagation.test.ts +621 -0
package/src/__tests__/taint/python-cross-file.test.ts +494 -0
package/src/__tests__/taint/python-taint.test.ts +1344 -0
package/src/__tests__/taint/sanitizer-registry.test.ts +304 -0
package/src/__tests__/taint/sanitizer-regression.test.ts +111 -0
package/src/__tests__/taint/sink-classifier.test.ts +537 -0
package/src/__tests__/taint/source-classifier.test.ts +367 -0
package/src/__tests__/taint/taint-pipeline.test.ts +418 -0
package/src/__tests__/taint/taint-smoke.test.ts +400 -0
package/src/__tests__/taint/taint-summary.test.ts +472 -0
package/src/detect/ai-code/index.ts +6 -11
package/src/detect/ast-rules/agent-tools-ast.ts +861 -0
package/src/detect/ast-rules/ai-fingerprinting-ast.ts +451 -0
package/src/detect/ast-rules/auth-patterns-ast.ts +304 -0
package/src/detect/ast-rules/byok-ast.ts +195 -0
package/src/detect/ast-rules/child-process-ast.ts +276 -0
package/src/detect/ast-rules/dangerous-eval-ast.ts +227 -0
package/src/detect/ast-rules/data-exposure-ast.ts +162 -0
package/src/detect/ast-rules/dom-xss-ast.ts +260 -0
package/src/detect/ast-rules/endpoint-protection-ast.ts +231 -0
package/src/detect/ast-rules/entropy-ast.ts +268 -0
package/src/detect/ast-rules/flask-debug-ast.ts +148 -0
package/src/detect/ast-rules/framework-checks-ast.ts +200 -0
package/src/detect/ast-rules/helpers/call-analysis.ts +256 -0
package/src/detect/ast-rules/helpers/context-detection.ts +277 -0
package/src/detect/ast-rules/helpers/control-flow.ts +179 -0
package/src/detect/ast-rules/helpers/import-analysis.ts +185 -0
package/src/detect/ast-rules/helpers/index.ts +133 -0
package/src/detect/ast-rules/helpers/python-helpers.ts +1054 -0
package/src/detect/ast-rules/helpers/scope-analysis.ts +224 -0
package/src/detect/ast-rules/helpers/string-analysis.ts +215 -0
package/src/detect/ast-rules/helpers/type-extraction.ts +138 -0
package/src/detect/ast-rules/helpers/user-input.ts +256 -0
package/src/detect/ast-rules/index.ts +311 -0
package/src/detect/ast-rules/json-parse-ast.ts +162 -0
package/src/detect/ast-rules/log-injection-ast.ts +243 -0
package/src/detect/ast-rules/logic-gates-ast.ts +343 -0
package/src/detect/ast-rules/mcp-security-ast.ts +808 -0
package/src/detect/ast-rules/model-supply-chain-ast.ts +202 -0
package/src/detect/ast-rules/package-hallucination-ast.ts +664 -0
package/src/detect/ast-rules/prompt-hygiene-ast.ts +329 -0
package/src/detect/ast-rules/rag-safety-ast.ts +689 -0
package/src/detect/ast-rules/request-validation-ast.ts +122 -0
package/src/detect/ast-rules/risky-imports-ast.ts +133 -0
package/src/detect/ast-rules/schema-validation-ast.ts +244 -0
package/src/detect/ast-rules/secret-patterns-ast.ts +223 -0
package/src/detect/ast-rules/security-headers-ast.ts +206 -0
package/src/detect/ast-rules/sql-injection-ast.ts +614 -0
package/src/detect/ast-rules/ssrf-ast.ts +601 -0
package/src/detect/ast-rules/taint-fix-templates.ts +108 -0
package/src/detect/ast-rules/taint-flow-ast.ts +416 -0
package/src/detect/ast-rules/variables-ast.ts +446 -0
package/src/detect/ast-rules/weak-crypto-ast.ts +441 -0
package/src/detect/ast-rules/xxe-ast.ts +184 -0
package/src/detect/config/agent-skill-injection.ts +2 -24
package/src/detect/config/index.ts +1 -0
package/src/detect/config/osv-check.ts +6 -1
package/src/detect/config/package-check.ts +6 -1
package/src/detect/config/rules-file-backdoor.ts +438 -0
package/src/detect/index.ts +146 -52
package/src/detect/secrets/config-audit.ts +148 -3
package/src/detect/secrets/entropy.ts +195 -0
package/src/detect/secrets/index.ts +7 -16
package/src/detect/structural/index.ts +23 -566
package/src/index.ts +7 -0
package/src/model/auth-helper-detector.ts +1 -7
package/src/model/import-resolver.ts +104 -0
package/src/model/imported-auth-detector.ts +1 -1
package/src/model/index.ts +240 -80
package/src/model/module-graph.ts +17 -5
package/src/model/project-context.ts +28 -1
package/src/model/route-auth-resolver.ts +18 -3
package/src/model/route-discovery/index.ts +1 -1
package/src/model/route-discovery/nextjs.ts +1 -1
package/src/model/route-discovery/python.ts +156 -9
package/src/model/route-discovery/types.ts +1 -1
package/src/model/route-discovery/utils.ts +73 -0
package/src/model/taint-types.ts +1 -6
package/src/parse/ast.ts +271 -0
package/src/parse/call-graph.ts +419 -0
package/src/parse/file-classifier.ts +69 -15
package/src/parse/node-index.ts +118 -0
package/src/parse/type-extractor.ts +293 -0
package/src/pipeline/config.ts +10 -1
package/src/pipeline/index.ts +475 -187
package/src/pipeline/modes/incremental.ts +1 -7
package/src/postprocess/dedup.ts +48 -17
package/src/report/build-result.ts +57 -29
package/src/report/formatters/cli-terminal.ts +731 -415
package/src/report/sanitize.ts +27 -0
package/src/score/adjustments.ts +113 -40
package/src/score/confidence.ts +10 -5
package/src/score/evidence.ts +55 -0
package/src/score/index.ts +27 -55
package/src/score/types.ts +4 -0
package/src/shared/category-filter.ts +12 -0
package/src/shared/regex-utils.ts +4 -0
package/src/shared/registry-clients.ts +106 -18
package/src/shared/rules/__tests__/metadata.test.ts +5 -1
package/src/shared/rules/metadata.ts +19 -0
package/src/shared/types.ts +373 -254
package/src/taint/async-flow.ts +301 -0
package/src/taint/cfg-builder.ts +1127 -0
package/src/taint/cfg-types.ts +110 -0
package/src/taint/constant-propagation.ts +170 -0
package/src/taint/cross-file-analyzer.ts +118 -0
package/src/taint/cross-file-index.ts +275 -0
package/src/taint/def-use.ts +556 -0
package/src/taint/file-analysis-cache.ts +145 -0
package/src/taint/framework-models.ts +313 -0
package/src/taint/helpers.ts +138 -0
package/src/taint/index.ts +71 -0
package/src/taint/llm-registry.ts +174 -0
package/src/taint/llm-risk-scoring.ts +412 -0
package/src/taint/propagation-types.ts +188 -0
package/src/taint/propagation.ts +1750 -0
package/src/taint/sanitizer-registry.ts +490 -0
package/src/taint/sink-classifier.ts +1402 -0
package/src/taint/source-classifier.ts +859 -0
package/src/taint/taint-analyzer.ts +112 -0
package/src/taint/taint-summary.ts +341 -0
package/src/taint/types.ts +86 -0
package/src/tiers.ts +2 -2
package/src/validate/clients.ts +3 -2
package/src/validate/index.ts +89 -53
package/src/validate/prompts/modules/ai-patterns.ts +16 -0
package/src/validate/prompts/modules/common.ts +12 -3
package/src/validate/providers/anthropic.ts +254 -148
package/src/validate/providers/openai.ts +363 -218
package/src/validate/request-builder.ts +2 -45
package/src/validate/types.ts +9 -0
package/src/validate/utils/path-helpers.ts +2 -2
package/src/validate/utils/response-parser.ts +32 -3
package/src/validate/utils/retry.ts +19 -4
package/dist/ai-context/index.d.ts +0 -6
package/dist/ai-context/index.d.ts.map +0 -1
package/dist/ai-context/index.js +0 -13
package/dist/ai-context/index.js.map +0 -1
package/dist/ai-context/manager.d.ts +0 -67
package/dist/ai-context/manager.d.ts.map +0 -1
package/dist/ai-context/manager.js +0 -104
package/dist/ai-context/manager.js.map +0 -1
package/dist/baseline/diff.d.ts +0 -32
package/dist/baseline/diff.d.ts.map +0 -1
package/dist/baseline/diff.js +0 -119
package/dist/baseline/diff.js.map +0 -1
package/dist/baseline/index.d.ts +0 -9
package/dist/baseline/index.d.ts.map +0 -1
package/dist/baseline/index.js +0 -19
package/dist/baseline/index.js.map +0 -1
package/dist/baseline/manager.d.ts +0 -67
package/dist/baseline/manager.d.ts.map +0 -1
package/dist/baseline/manager.js +0 -180
package/dist/baseline/manager.js.map +0 -1
package/dist/baseline/types.d.ts +0 -91
package/dist/baseline/types.d.ts.map +0 -1
package/dist/baseline/types.js +0 -12
package/dist/baseline/types.js.map +0 -1
package/dist/category-filter.d.ts +0 -125
package/dist/category-filter.d.ts.map +0 -1
package/dist/category-filter.js +0 -360
package/dist/category-filter.js.map +0 -1
package/dist/detect/ai-code/agent-tools.d.ts +0 -22
package/dist/detect/ai-code/agent-tools.d.ts.map +0 -1
package/dist/detect/ai-code/agent-tools.js +0 -1509
package/dist/detect/ai-code/agent-tools.js.map +0 -1
package/dist/detect/ai-code/byok-patterns.d.ts +0 -15
package/dist/detect/ai-code/byok-patterns.d.ts.map +0 -1
package/dist/detect/ai-code/byok-patterns.js +0 -313
package/dist/detect/ai-code/byok-patterns.js.map +0 -1
package/dist/detect/ai-code/endpoint-protection.d.ts +0 -38
package/dist/detect/ai-code/endpoint-protection.d.ts.map +0 -1
package/dist/detect/ai-code/endpoint-protection.js +0 -349
package/dist/detect/ai-code/endpoint-protection.js.map +0 -1
package/dist/detect/ai-code/execution-sinks.d.ts +0 -21
package/dist/detect/ai-code/execution-sinks.d.ts.map +0 -1
package/dist/detect/ai-code/execution-sinks.js +0 -1158
package/dist/detect/ai-code/execution-sinks.js.map +0 -1
package/dist/detect/ai-code/fingerprinting.d.ts +0 -10
package/dist/detect/ai-code/fingerprinting.d.ts.map +0 -1
package/dist/detect/ai-code/fingerprinting.js +0 -665
package/dist/detect/ai-code/fingerprinting.js.map +0 -1
package/dist/detect/ai-code/mcp-security.d.ts +0 -20
package/dist/detect/ai-code/mcp-security.d.ts.map +0 -1
package/dist/detect/ai-code/mcp-security.js +0 -880
package/dist/detect/ai-code/mcp-security.js.map +0 -1
package/dist/detect/ai-code/model-supply-chain.d.ts +0 -23
package/dist/detect/ai-code/model-supply-chain.d.ts.map +0 -1
package/dist/detect/ai-code/model-supply-chain.js +0 -447
package/dist/detect/ai-code/model-supply-chain.js.map +0 -1
package/dist/detect/ai-code/package-hallucination.d.ts +0 -22
package/dist/detect/ai-code/package-hallucination.d.ts.map +0 -1
package/dist/detect/ai-code/package-hallucination.js +0 -841
package/dist/detect/ai-code/package-hallucination.js.map +0 -1
package/dist/detect/ai-code/prompt-hygiene.d.ts +0 -22
package/dist/detect/ai-code/prompt-hygiene.d.ts.map +0 -1
package/dist/detect/ai-code/prompt-hygiene.js +0 -1177
package/dist/detect/ai-code/prompt-hygiene.js.map +0 -1
package/dist/detect/ai-code/rag-safety.d.ts +0 -24
package/dist/detect/ai-code/rag-safety.d.ts.map +0 -1
package/dist/detect/ai-code/rag-safety.js +0 -913
package/dist/detect/ai-code/rag-safety.js.map +0 -1
package/dist/detect/ai-code/schema-validation.d.ts +0 -28
package/dist/detect/ai-code/schema-validation.d.ts.map +0 -1
package/dist/detect/ai-code/schema-validation.js +0 -378
package/dist/detect/ai-code/schema-validation.js.map +0 -1
package/dist/detect/secrets/patterns.d.ts +0 -11
package/dist/detect/secrets/patterns.d.ts.map +0 -1
package/dist/detect/secrets/patterns.js +0 -518
package/dist/detect/secrets/patterns.js.map +0 -1
package/dist/detect/secrets/weak-crypto.d.ts +0 -10
package/dist/detect/secrets/weak-crypto.d.ts.map +0 -1
package/dist/detect/secrets/weak-crypto.js +0 -432
package/dist/detect/secrets/weak-crypto.js.map +0 -1
package/dist/detect/structural/auth-patterns.d.ts +0 -22
package/dist/detect/structural/auth-patterns.d.ts.map +0 -1
package/dist/detect/structural/auth-patterns.js +0 -533
package/dist/detect/structural/auth-patterns.js.map +0 -1
package/dist/detect/structural/dangerous-functions/child-process.d.ts +0 -16
package/dist/detect/structural/dangerous-functions/child-process.d.ts.map +0 -1
package/dist/detect/structural/dangerous-functions/child-process.js +0 -74
package/dist/detect/structural/dangerous-functions/child-process.js.map +0 -1
package/dist/detect/structural/dangerous-functions/dom-xss.d.ts +0 -34
package/dist/detect/structural/dangerous-functions/dom-xss.d.ts.map +0 -1
package/dist/detect/structural/dangerous-functions/dom-xss.js +0 -230
package/dist/detect/structural/dangerous-functions/dom-xss.js.map +0 -1
package/dist/detect/structural/dangerous-functions/index.d.ts +0 -16
package/dist/detect/structural/dangerous-functions/index.d.ts.map +0 -1
package/dist/detect/structural/dangerous-functions/index.js +0 -1193
package/dist/detect/structural/dangerous-functions/index.js.map +0 -1
package/dist/detect/structural/dangerous-functions/json-parse.d.ts +0 -31
package/dist/detect/structural/dangerous-functions/json-parse.d.ts.map +0 -1
package/dist/detect/structural/dangerous-functions/json-parse.js +0 -326
package/dist/detect/structural/dangerous-functions/json-parse.js.map +0 -1
package/dist/detect/structural/dangerous-functions/math-random.d.ts +0 -111
package/dist/detect/structural/dangerous-functions/math-random.d.ts.map +0 -1
package/dist/detect/structural/dangerous-functions/math-random.js +0 -684
package/dist/detect/structural/dangerous-functions/math-random.js.map +0 -1
package/dist/detect/structural/dangerous-functions/patterns.d.ts +0 -21
package/dist/detect/structural/dangerous-functions/patterns.d.ts.map +0 -1
package/dist/detect/structural/dangerous-functions/patterns.js +0 -163
package/dist/detect/structural/dangerous-functions/patterns.js.map +0 -1
package/dist/detect/structural/dangerous-functions/request-validation.d.ts +0 -13
package/dist/detect/structural/dangerous-functions/request-validation.d.ts.map +0 -1
package/dist/detect/structural/dangerous-functions/request-validation.js +0 -126
package/dist/detect/structural/dangerous-functions/request-validation.js.map +0 -1
package/dist/detect/structural/dangerous-functions/utils/control-flow.d.ts +0 -24
package/dist/detect/structural/dangerous-functions/utils/control-flow.d.ts.map +0 -1
package/dist/detect/structural/dangerous-functions/utils/control-flow.js +0 -70
package/dist/detect/structural/dangerous-functions/utils/control-flow.js.map +0 -1
package/dist/detect/structural/dangerous-functions/utils/helpers.d.ts +0 -31
package/dist/detect/structural/dangerous-functions/utils/helpers.d.ts.map +0 -1
package/dist/detect/structural/dangerous-functions/utils/helpers.js +0 -147
package/dist/detect/structural/dangerous-functions/utils/helpers.js.map +0 -1
package/dist/detect/structural/dangerous-functions/utils/index.d.ts +0 -9
package/dist/detect/structural/dangerous-functions/utils/index.d.ts.map +0 -1
package/dist/detect/structural/dangerous-functions/utils/index.js +0 -23
package/dist/detect/structural/dangerous-functions/utils/index.js.map +0 -1
package/dist/detect/structural/dangerous-functions/utils/schema-validation.d.ts +0 -22
package/dist/detect/structural/dangerous-functions/utils/schema-validation.d.ts.map +0 -1
package/dist/detect/structural/dangerous-functions/utils/schema-validation.js +0 -102
package/dist/detect/structural/dangerous-functions/utils/schema-validation.js.map +0 -1
package/dist/detect/structural/data-exposure.d.ts +0 -19
package/dist/detect/structural/data-exposure.d.ts.map +0 -1
package/dist/detect/structural/data-exposure.js +0 -262
package/dist/detect/structural/data-exposure.js.map +0 -1
package/dist/detect/structural/framework-checks.d.ts +0 -10
package/dist/detect/structural/framework-checks.d.ts.map +0 -1
package/dist/detect/structural/framework-checks.js +0 -389
package/dist/detect/structural/framework-checks.js.map +0 -1
package/dist/detect/structural/log-injection.d.ts +0 -18
package/dist/detect/structural/log-injection.d.ts.map +0 -1
package/dist/detect/structural/log-injection.js +0 -217
package/dist/detect/structural/log-injection.js.map +0 -1
package/dist/detect/structural/logic-gates.d.ts +0 -10
package/dist/detect/structural/logic-gates.d.ts.map +0 -1
package/dist/detect/structural/logic-gates.js +0 -227
package/dist/detect/structural/logic-gates.js.map +0 -1
package/dist/detect/structural/risky-imports.d.ts +0 -10
package/dist/detect/structural/risky-imports.d.ts.map +0 -1
package/dist/detect/structural/risky-imports.js +0 -168
package/dist/detect/structural/risky-imports.js.map +0 -1
package/dist/detect/structural/security-headers.d.ts +0 -18
package/dist/detect/structural/security-headers.d.ts.map +0 -1
package/dist/detect/structural/security-headers.js +0 -196
package/dist/detect/structural/security-headers.js.map +0 -1
package/dist/detect/structural/ssrf-detection.d.ts +0 -18
package/dist/detect/structural/ssrf-detection.d.ts.map +0 -1
package/dist/detect/structural/ssrf-detection.js +0 -263
package/dist/detect/structural/ssrf-detection.js.map +0 -1
package/dist/detect/structural/variables.d.ts +0 -11
package/dist/detect/structural/variables.d.ts.map +0 -1
package/dist/detect/structural/variables.js +0 -159
package/dist/detect/structural/variables.js.map +0 -1
package/dist/detect/structural/xxe-detection.d.ts +0 -18
package/dist/detect/structural/xxe-detection.d.ts.map +0 -1
package/dist/detect/structural/xxe-detection.js +0 -245
package/dist/detect/structural/xxe-detection.js.map +0 -1
package/dist/filtering/context-adjustments.d.ts +0 -23
package/dist/filtering/context-adjustments.d.ts.map +0 -1
package/dist/filtering/context-adjustments.js +0 -100
package/dist/filtering/context-adjustments.js.map +0 -1
package/dist/filtering/index.d.ts +0 -3
package/dist/filtering/index.d.ts.map +0 -1
package/dist/filtering/index.js +0 -8
package/dist/filtering/index.js.map +0 -1
package/dist/filtering/pipeline.d.ts +0 -48
package/dist/filtering/pipeline.d.ts.map +0 -1
package/dist/filtering/pipeline.js +0 -76
package/dist/filtering/pipeline.js.map +0 -1
package/dist/formatters/ai-context.d.ts +0 -23
package/dist/formatters/ai-context.d.ts.map +0 -1
package/dist/formatters/ai-context.js +0 -238
package/dist/formatters/ai-context.js.map +0 -1
package/dist/formatters/cli-terminal.d.ts +0 -65
package/dist/formatters/cli-terminal.d.ts.map +0 -1
package/dist/formatters/cli-terminal.js +0 -735
package/dist/formatters/cli-terminal.js.map +0 -1
package/dist/formatters/github-comment.d.ts +0 -41
package/dist/formatters/github-comment.d.ts.map +0 -1
package/dist/formatters/github-comment.js +0 -370
package/dist/formatters/github-comment.js.map +0 -1
package/dist/formatters/grouping.d.ts +0 -52
package/dist/formatters/grouping.d.ts.map +0 -1
package/dist/formatters/grouping.js +0 -152
package/dist/formatters/grouping.js.map +0 -1
package/dist/formatters/ide/claude-code.d.ts +0 -17
package/dist/formatters/ide/claude-code.d.ts.map +0 -1
package/dist/formatters/ide/claude-code.js +0 -94
package/dist/formatters/ide/claude-code.js.map +0 -1
package/dist/formatters/ide/cursor.d.ts +0 -13
package/dist/formatters/ide/cursor.d.ts.map +0 -1
package/dist/formatters/ide/cursor.js +0 -125
package/dist/formatters/ide/cursor.js.map +0 -1
package/dist/formatters/ide/index.d.ts +0 -62
package/dist/formatters/ide/index.d.ts.map +0 -1
package/dist/formatters/ide/index.js +0 -184
package/dist/formatters/ide/index.js.map +0 -1
package/dist/formatters/ide/windsurf.d.ts +0 -13
package/dist/formatters/ide/windsurf.d.ts.map +0 -1
package/dist/formatters/ide/windsurf.js +0 -117
package/dist/formatters/ide/windsurf.js.map +0 -1
package/dist/formatters/index.d.ts +0 -11
package/dist/formatters/index.d.ts.map +0 -1
package/dist/formatters/index.js +0 -54
package/dist/formatters/index.js.map +0 -1
package/dist/formatters/vscode-diagnostic.d.ts +0 -103
package/dist/formatters/vscode-diagnostic.d.ts.map +0 -1
package/dist/formatters/vscode-diagnostic.js +0 -151
package/dist/formatters/vscode-diagnostic.js.map +0 -1
package/dist/layer1/comments.d.ts +0 -11
package/dist/layer1/comments.d.ts.map +0 -1
package/dist/layer1/comments.js +0 -203
package/dist/layer1/comments.js.map +0 -1
package/dist/layer1/config-audit.d.ts +0 -11
package/dist/layer1/config-audit.d.ts.map +0 -1
package/dist/layer1/config-audit.js +0 -311
package/dist/layer1/config-audit.js.map +0 -1
package/dist/layer1/config-mcp-audit.d.ts +0 -23
package/dist/layer1/config-mcp-audit.d.ts.map +0 -1
package/dist/layer1/config-mcp-audit.js +0 -239
package/dist/layer1/config-mcp-audit.js.map +0 -1
package/dist/layer1/entropy.d.ts +0 -11
package/dist/layer1/entropy.d.ts.map +0 -1
package/dist/layer1/entropy.js +0 -741
package/dist/layer1/entropy.js.map +0 -1
package/dist/layer1/file-flags.d.ts +0 -10
package/dist/layer1/file-flags.d.ts.map +0 -1
package/dist/layer1/file-flags.js +0 -119
package/dist/layer1/file-flags.js.map +0 -1
package/dist/layer1/index.d.ts +0 -38
package/dist/layer1/index.d.ts.map +0 -1
package/dist/layer1/index.js +0 -170
package/dist/layer1/index.js.map +0 -1
package/dist/layer1/patterns.d.ts +0 -11
package/dist/layer1/patterns.d.ts.map +0 -1
package/dist/layer1/patterns.js +0 -512
package/dist/layer1/patterns.js.map +0 -1
package/dist/layer1/urls.d.ts +0 -11
package/dist/layer1/urls.d.ts.map +0 -1
package/dist/layer1/urls.js +0 -444
package/dist/layer1/urls.js.map +0 -1
package/dist/layer1/weak-crypto.d.ts +0 -10
package/dist/layer1/weak-crypto.d.ts.map +0 -1
package/dist/layer1/weak-crypto.js +0 -428
package/dist/layer1/weak-crypto.js.map +0 -1
package/dist/layer2/ai-agent-tools.d.ts +0 -22
package/dist/layer2/ai-agent-tools.d.ts.map +0 -1
package/dist/layer2/ai-agent-tools.js +0 -1490
package/dist/layer2/ai-agent-tools.js.map +0 -1
package/dist/layer2/ai-endpoint-protection.d.ts +0 -38
package/dist/layer2/ai-endpoint-protection.d.ts.map +0 -1
package/dist/layer2/ai-endpoint-protection.js +0 -346
package/dist/layer2/ai-endpoint-protection.js.map +0 -1
package/dist/layer2/ai-execution-sinks.d.ts +0 -21
package/dist/layer2/ai-execution-sinks.d.ts.map +0 -1
package/dist/layer2/ai-execution-sinks.js +0 -1155
package/dist/layer2/ai-execution-sinks.js.map +0 -1
package/dist/layer2/ai-fingerprinting.d.ts +0 -10
package/dist/layer2/ai-fingerprinting.d.ts.map +0 -1
package/dist/layer2/ai-fingerprinting.js +0 -650
package/dist/layer2/ai-fingerprinting.js.map +0 -1
package/dist/layer2/ai-mcp-security.d.ts +0 -20
package/dist/layer2/ai-mcp-security.d.ts.map +0 -1
package/dist/layer2/ai-mcp-security.js +0 -877
package/dist/layer2/ai-mcp-security.js.map +0 -1
package/dist/layer2/ai-package-hallucination.d.ts +0 -22
package/dist/layer2/ai-package-hallucination.d.ts.map +0 -1
package/dist/layer2/ai-package-hallucination.js +0 -828
package/dist/layer2/ai-package-hallucination.js.map +0 -1
package/dist/layer2/ai-prompt-hygiene.d.ts +0 -22
package/dist/layer2/ai-prompt-hygiene.d.ts.map +0 -1
package/dist/layer2/ai-prompt-hygiene.js +0 -1156
package/dist/layer2/ai-prompt-hygiene.js.map +0 -1
package/dist/layer2/ai-rag-safety.d.ts +0 -24
package/dist/layer2/ai-rag-safety.d.ts.map +0 -1
package/dist/layer2/ai-rag-safety.js +0 -910
package/dist/layer2/ai-rag-safety.js.map +0 -1
package/dist/layer2/ai-schema-validation.d.ts +0 -28
package/dist/layer2/ai-schema-validation.d.ts.map +0 -1
package/dist/layer2/ai-schema-validation.js +0 -375
package/dist/layer2/ai-schema-validation.js.map +0 -1
package/dist/layer2/auth-antipatterns.d.ts +0 -22
package/dist/layer2/auth-antipatterns.d.ts.map +0 -1
package/dist/layer2/auth-antipatterns.js +0 -522
package/dist/layer2/auth-antipatterns.js.map +0 -1
package/dist/layer2/byok-patterns.d.ts +0 -15
package/dist/layer2/byok-patterns.d.ts.map +0 -1
package/dist/layer2/byok-patterns.js +0 -302
package/dist/layer2/byok-patterns.js.map +0 -1
package/dist/layer2/dangerous-functions/child-process.d.ts +0 -16
package/dist/layer2/dangerous-functions/child-process.d.ts.map +0 -1
package/dist/layer2/dangerous-functions/child-process.js +0 -74
package/dist/layer2/dangerous-functions/child-process.js.map +0 -1
package/dist/layer2/dangerous-functions/dom-xss.d.ts +0 -34
package/dist/layer2/dangerous-functions/dom-xss.d.ts.map +0 -1
package/dist/layer2/dangerous-functions/dom-xss.js +0 -230
package/dist/layer2/dangerous-functions/dom-xss.js.map +0 -1
package/dist/layer2/dangerous-functions/index.d.ts +0 -16
package/dist/layer2/dangerous-functions/index.d.ts.map +0 -1
package/dist/layer2/dangerous-functions/index.js +0 -1152
package/dist/layer2/dangerous-functions/index.js.map +0 -1
package/dist/layer2/dangerous-functions/json-parse.d.ts +0 -31
package/dist/layer2/dangerous-functions/json-parse.d.ts.map +0 -1
package/dist/layer2/dangerous-functions/json-parse.js +0 -319
package/dist/layer2/dangerous-functions/json-parse.js.map +0 -1
package/dist/layer2/dangerous-functions/math-random.d.ts +0 -111
package/dist/layer2/dangerous-functions/math-random.d.ts.map +0 -1
package/dist/layer2/dangerous-functions/math-random.js +0 -684
package/dist/layer2/dangerous-functions/math-random.js.map +0 -1
package/dist/layer2/dangerous-functions/patterns.d.ts +0 -21
package/dist/layer2/dangerous-functions/patterns.d.ts.map +0 -1
package/dist/layer2/dangerous-functions/patterns.js +0 -163
package/dist/layer2/dangerous-functions/patterns.js.map +0 -1
package/dist/layer2/dangerous-functions/request-validation.d.ts +0 -13
package/dist/layer2/dangerous-functions/request-validation.d.ts.map +0 -1
package/dist/layer2/dangerous-functions/request-validation.js +0 -119
package/dist/layer2/dangerous-functions/request-validation.js.map +0 -1
package/dist/layer2/dangerous-functions/utils/control-flow.d.ts +0 -24
package/dist/layer2/dangerous-functions/utils/control-flow.d.ts.map +0 -1
package/dist/layer2/dangerous-functions/utils/control-flow.js +0 -70
package/dist/layer2/dangerous-functions/utils/control-flow.js.map +0 -1
package/dist/layer2/dangerous-functions/utils/helpers.d.ts +0 -31
package/dist/layer2/dangerous-functions/utils/helpers.d.ts.map +0 -1
package/dist/layer2/dangerous-functions/utils/helpers.js +0 -147
package/dist/layer2/dangerous-functions/utils/helpers.js.map +0 -1
package/dist/layer2/dangerous-functions/utils/index.d.ts +0 -9
package/dist/layer2/dangerous-functions/utils/index.d.ts.map +0 -1
package/dist/layer2/dangerous-functions/utils/index.js +0 -23
package/dist/layer2/dangerous-functions/utils/index.js.map +0 -1
package/dist/layer2/dangerous-functions/utils/schema-validation.d.ts +0 -22
package/dist/layer2/dangerous-functions/utils/schema-validation.d.ts.map +0 -1
package/dist/layer2/dangerous-functions/utils/schema-validation.js +0 -102
package/dist/layer2/dangerous-functions/utils/schema-validation.js.map +0 -1
package/dist/layer2/data-exposure.d.ts +0 -19
package/dist/layer2/data-exposure.d.ts.map +0 -1
package/dist/layer2/data-exposure.js +0 -255
package/dist/layer2/data-exposure.js.map +0 -1
package/dist/layer2/framework-checks.d.ts +0 -10
package/dist/layer2/framework-checks.d.ts.map +0 -1
package/dist/layer2/framework-checks.js +0 -384
package/dist/layer2/framework-checks.js.map +0 -1
package/dist/layer2/index.d.ts +0 -74
package/dist/layer2/index.d.ts.map +0 -1
package/dist/layer2/index.js +0 -544
package/dist/layer2/index.js.map +0 -1
package/dist/layer2/log-injection.d.ts +0 -18
package/dist/layer2/log-injection.d.ts.map +0 -1
package/dist/layer2/log-injection.js +0 -214
package/dist/layer2/log-injection.js.map +0 -1
package/dist/layer2/logic-gates.d.ts +0 -10
package/dist/layer2/logic-gates.d.ts.map +0 -1
package/dist/layer2/logic-gates.js +0 -220
package/dist/layer2/logic-gates.js.map +0 -1
package/dist/layer2/model-supply-chain.d.ts +0 -23
package/dist/layer2/model-supply-chain.d.ts.map +0 -1
package/dist/layer2/model-supply-chain.js +0 -444
package/dist/layer2/model-supply-chain.js.map +0 -1
package/dist/layer2/risky-imports.d.ts +0 -10
package/dist/layer2/risky-imports.d.ts.map +0 -1
package/dist/layer2/risky-imports.js +0 -165
package/dist/layer2/risky-imports.js.map +0 -1
package/dist/layer2/security-headers.d.ts +0 -18
package/dist/layer2/security-headers.d.ts.map +0 -1
package/dist/layer2/security-headers.js +0 -187
package/dist/layer2/security-headers.js.map +0 -1
package/dist/layer2/ssrf-detection.d.ts +0 -18
package/dist/layer2/ssrf-detection.d.ts.map +0 -1
package/dist/layer2/ssrf-detection.js +0 -252
package/dist/layer2/ssrf-detection.js.map +0 -1
package/dist/layer2/variables.d.ts +0 -11
package/dist/layer2/variables.d.ts.map +0 -1
package/dist/layer2/variables.js +0 -156
package/dist/layer2/variables.js.map +0 -1
package/dist/layer2/xxe-detection.d.ts +0 -18
package/dist/layer2/xxe-detection.d.ts.map +0 -1
package/dist/layer2/xxe-detection.js +0 -242
package/dist/layer2/xxe-detection.js.map +0 -1
package/dist/layer3/anthropic/auto-dismiss.d.ts +0 -24
package/dist/layer3/anthropic/auto-dismiss.d.ts.map +0 -1
package/dist/layer3/anthropic/auto-dismiss.js +0 -199
package/dist/layer3/anthropic/auto-dismiss.js.map +0 -1
package/dist/layer3/anthropic/clients.d.ts +0 -44
package/dist/layer3/anthropic/clients.d.ts.map +0 -1
package/dist/layer3/anthropic/clients.js +0 -81
package/dist/layer3/anthropic/clients.js.map +0 -1
package/dist/layer3/anthropic/index.d.ts +0 -41
package/dist/layer3/anthropic/index.d.ts.map +0 -1
package/dist/layer3/anthropic/index.js +0 -141
package/dist/layer3/anthropic/index.js.map +0 -1
package/dist/layer3/anthropic/prompts/index.d.ts +0 -8
package/dist/layer3/anthropic/prompts/index.d.ts.map +0 -1
package/dist/layer3/anthropic/prompts/index.js +0 -16
package/dist/layer3/anthropic/prompts/index.js.map +0 -1
package/dist/layer3/anthropic/prompts/modules/ai-patterns.d.ts +0 -19
package/dist/layer3/anthropic/prompts/modules/ai-patterns.d.ts.map +0 -1
package/dist/layer3/anthropic/prompts/modules/ai-patterns.js +0 -156
package/dist/layer3/anthropic/prompts/modules/ai-patterns.js.map +0 -1
package/dist/layer3/anthropic/prompts/modules/auth-access.d.ts +0 -9
package/dist/layer3/anthropic/prompts/modules/auth-access.d.ts.map +0 -1
package/dist/layer3/anthropic/prompts/modules/auth-access.js +0 -25
package/dist/layer3/anthropic/prompts/modules/auth-access.js.map +0 -1
package/dist/layer3/anthropic/prompts/modules/common.d.ts +0 -11
package/dist/layer3/anthropic/prompts/modules/common.d.ts.map +0 -1
package/dist/layer3/anthropic/prompts/modules/common.js +0 -152
package/dist/layer3/anthropic/prompts/modules/common.js.map +0 -1
package/dist/layer3/anthropic/prompts/modules/index.d.ts +0 -54
package/dist/layer3/anthropic/prompts/modules/index.d.ts.map +0 -1
package/dist/layer3/anthropic/prompts/modules/index.js +0 -185
package/dist/layer3/anthropic/prompts/modules/index.js.map +0 -1
package/dist/layer3/anthropic/prompts/modules/owasp-classic.d.ts +0 -8
package/dist/layer3/anthropic/prompts/modules/owasp-classic.d.ts.map +0 -1
package/dist/layer3/anthropic/prompts/modules/owasp-classic.js +0 -84
package/dist/layer3/anthropic/prompts/modules/owasp-classic.js.map +0 -1
package/dist/layer3/anthropic/prompts/modules/secrets-crypto.d.ts +0 -8
package/dist/layer3/anthropic/prompts/modules/secrets-crypto.d.ts.map +0 -1
package/dist/layer3/anthropic/prompts/modules/secrets-crypto.js +0 -68
package/dist/layer3/anthropic/prompts/modules/secrets-crypto.js.map +0 -1
package/dist/layer3/anthropic/prompts/modules/xss-prompt.d.ts +0 -8
package/dist/layer3/anthropic/prompts/modules/xss-prompt.d.ts.map +0 -1
package/dist/layer3/anthropic/prompts/modules/xss-prompt.js +0 -22
package/dist/layer3/anthropic/prompts/modules/xss-prompt.js.map +0 -1
package/dist/layer3/anthropic/prompts/semantic-analysis.d.ts +0 -15
package/dist/layer3/anthropic/prompts/semantic-analysis.d.ts.map +0 -1
package/dist/layer3/anthropic/prompts/semantic-analysis.js +0 -169
package/dist/layer3/anthropic/prompts/semantic-analysis.js.map +0 -1
package/dist/layer3/anthropic/prompts/validation.d.ts +0 -18
package/dist/layer3/anthropic/prompts/validation.d.ts.map +0 -1
package/dist/layer3/anthropic/prompts/validation.js +0 -25
package/dist/layer3/anthropic/prompts/validation.js.map +0 -1
package/dist/layer3/anthropic/providers/anthropic.d.ts +0 -21
package/dist/layer3/anthropic/providers/anthropic.d.ts.map +0 -1
package/dist/layer3/anthropic/providers/anthropic.js +0 -269
package/dist/layer3/anthropic/providers/anthropic.js.map +0 -1
package/dist/layer3/anthropic/providers/index.d.ts +0 -8
package/dist/layer3/anthropic/providers/index.d.ts.map +0 -1
package/dist/layer3/anthropic/providers/index.js +0 -15
package/dist/layer3/anthropic/providers/index.js.map +0 -1
package/dist/layer3/anthropic/providers/openai.d.ts +0 -18
package/dist/layer3/anthropic/providers/openai.d.ts.map +0 -1
package/dist/layer3/anthropic/providers/openai.js +0 -343
package/dist/layer3/anthropic/providers/openai.js.map +0 -1
package/dist/layer3/anthropic/request-builder.d.ts +0 -27
package/dist/layer3/anthropic/request-builder.d.ts.map +0 -1
package/dist/layer3/anthropic/request-builder.js +0 -150
package/dist/layer3/anthropic/request-builder.js.map +0 -1
package/dist/layer3/anthropic/types.d.ts +0 -88
package/dist/layer3/anthropic/types.d.ts.map +0 -1
package/dist/layer3/anthropic/types.js +0 -38
package/dist/layer3/anthropic/types.js.map +0 -1
package/dist/layer3/anthropic/utils/context-extractor.d.ts +0 -55
package/dist/layer3/anthropic/utils/context-extractor.d.ts.map +0 -1
package/dist/layer3/anthropic/utils/context-extractor.js +0 -161
package/dist/layer3/anthropic/utils/context-extractor.js.map +0 -1
package/dist/layer3/anthropic/utils/index.d.ts +0 -11
package/dist/layer3/anthropic/utils/index.d.ts.map +0 -1
package/dist/layer3/anthropic/utils/index.js +0 -27
package/dist/layer3/anthropic/utils/index.js.map +0 -1
package/dist/layer3/anthropic/utils/path-helpers.d.ts +0 -21
package/dist/layer3/anthropic/utils/path-helpers.d.ts.map +0 -1
package/dist/layer3/anthropic/utils/path-helpers.js +0 -69
package/dist/layer3/anthropic/utils/path-helpers.js.map +0 -1
package/dist/layer3/anthropic/utils/response-parser.d.ts +0 -40
package/dist/layer3/anthropic/utils/response-parser.d.ts.map +0 -1
package/dist/layer3/anthropic/utils/response-parser.js +0 -285
package/dist/layer3/anthropic/utils/response-parser.js.map +0 -1
package/dist/layer3/anthropic/utils/retry.d.ts +0 -15
package/dist/layer3/anthropic/utils/retry.d.ts.map +0 -1
package/dist/layer3/anthropic/utils/retry.js +0 -62
package/dist/layer3/anthropic/utils/retry.js.map +0 -1
package/dist/layer3/index.d.ts +0 -27
package/dist/layer3/index.d.ts.map +0 -1
package/dist/layer3/index.js +0 -150
package/dist/layer3/index.js.map +0 -1
package/dist/layer3/osv-check.d.ts +0 -75
package/dist/layer3/osv-check.d.ts.map +0 -1
package/dist/layer3/osv-check.js +0 -308
package/dist/layer3/osv-check.js.map +0 -1
package/dist/layer3/package-check.d.ts +0 -63
package/dist/layer3/package-check.d.ts.map +0 -1
package/dist/layer3/package-check.js +0 -508
package/dist/layer3/package-check.js.map +0 -1
package/dist/model/cross-file-taint.d.ts +0 -40
package/dist/model/cross-file-taint.d.ts.map +0 -1
package/dist/model/cross-file-taint.js +0 -290
package/dist/model/cross-file-taint.js.map +0 -1
package/dist/model/function-classifier.d.ts +0 -32
package/dist/model/function-classifier.d.ts.map +0 -1
package/dist/model/function-classifier.js +0 -143
package/dist/model/function-classifier.js.map +0 -1
package/dist/model/sanitiser-detection.d.ts +0 -27
package/dist/model/sanitiser-detection.d.ts.map +0 -1
package/dist/model/sanitiser-detection.js +0 -224
package/dist/model/sanitiser-detection.js.map +0 -1
package/dist/model/sink-matcher.d.ts +0 -17
package/dist/model/sink-matcher.d.ts.map +0 -1
package/dist/model/sink-matcher.js +0 -141
package/dist/model/sink-matcher.js.map +0 -1
package/dist/model/sink-patterns.d.ts +0 -19
package/dist/model/sink-patterns.d.ts.map +0 -1
package/dist/model/sink-patterns.js +0 -88
package/dist/model/sink-patterns.js.map +0 -1
package/dist/model/source-discovery.d.ts +0 -15
package/dist/model/source-discovery.d.ts.map +0 -1
package/dist/model/source-discovery.js +0 -170
package/dist/model/source-discovery.js.map +0 -1
package/dist/model/taint-tracker.d.ts +0 -21
package/dist/model/taint-tracker.d.ts.map +0 -1
package/dist/model/taint-tracker.js +0 -281
package/dist/model/taint-tracker.js.map +0 -1
package/dist/modes/incremental.d.ts +0 -66
package/dist/modes/incremental.d.ts.map +0 -1
package/dist/modes/incremental.js +0 -200
package/dist/modes/incremental.js.map +0 -1
package/dist/rules/framework-fixes.d.ts +0 -48
package/dist/rules/framework-fixes.d.ts.map +0 -1
package/dist/rules/framework-fixes.js +0 -439
package/dist/rules/framework-fixes.js.map +0 -1
package/dist/rules/index.d.ts +0 -8
package/dist/rules/index.d.ts.map +0 -1
package/dist/rules/index.js +0 -18
package/dist/rules/index.js.map +0 -1
package/dist/rules/metadata.d.ts +0 -43
package/dist/rules/metadata.d.ts.map +0 -1
package/dist/rules/metadata.js +0 -800
package/dist/rules/metadata.js.map +0 -1
package/dist/score/auto-dismiss.d.ts +0 -28
package/dist/score/auto-dismiss.d.ts.map +0 -1
package/dist/score/auto-dismiss.js +0 -200
package/dist/score/auto-dismiss.js.map +0 -1
package/dist/suppression/config-loader.d.ts +0 -74
package/dist/suppression/config-loader.d.ts.map +0 -1
package/dist/suppression/config-loader.js +0 -424
package/dist/suppression/config-loader.js.map +0 -1
package/dist/suppression/hash.d.ts +0 -48
package/dist/suppression/hash.d.ts.map +0 -1
package/dist/suppression/hash.js +0 -88
package/dist/suppression/hash.js.map +0 -1
package/dist/suppression/index.d.ts +0 -11
package/dist/suppression/index.d.ts.map +0 -1
package/dist/suppression/index.js +0 -39
package/dist/suppression/index.js.map +0 -1
package/dist/suppression/inline-parser.d.ts +0 -39
package/dist/suppression/inline-parser.d.ts.map +0 -1
package/dist/suppression/inline-parser.js +0 -218
package/dist/suppression/inline-parser.js.map +0 -1
package/dist/suppression/manager.d.ts +0 -94
package/dist/suppression/manager.d.ts.map +0 -1
package/dist/suppression/manager.js +0 -292
package/dist/suppression/manager.js.map +0 -1
package/dist/suppression/types.d.ts +0 -151
package/dist/suppression/types.d.ts.map +0 -1
package/dist/suppression/types.js +0 -28
package/dist/suppression/types.js.map +0 -1
package/dist/types.d.ts +0 -331
package/dist/types.d.ts.map +0 -1
package/dist/types.js +0 -124
package/dist/types.js.map +0 -1
package/dist/utils/auth-helper-detector.d.ts +0 -56
package/dist/utils/auth-helper-detector.d.ts.map +0 -1
package/dist/utils/auth-helper-detector.js +0 -360
package/dist/utils/auth-helper-detector.js.map +0 -1
package/dist/utils/code-analysis.d.ts +0 -39
package/dist/utils/code-analysis.d.ts.map +0 -1
package/dist/utils/code-analysis.js +0 -159
package/dist/utils/code-analysis.js.map +0 -1
package/dist/utils/comment-analyzer.d.ts +0 -38
package/dist/utils/comment-analyzer.d.ts.map +0 -1
package/dist/utils/comment-analyzer.js +0 -218
package/dist/utils/comment-analyzer.js.map +0 -1
package/dist/utils/context-helpers.d.ts +0 -219
package/dist/utils/context-helpers.d.ts.map +0 -1
package/dist/utils/context-helpers.js +0 -886
package/dist/utils/context-helpers.js.map +0 -1
package/dist/utils/diff-detector.d.ts +0 -53
package/dist/utils/diff-detector.d.ts.map +0 -1
package/dist/utils/diff-detector.js +0 -104
package/dist/utils/diff-detector.js.map +0 -1
package/dist/utils/diff-parser.d.ts +0 -80
package/dist/utils/diff-parser.d.ts.map +0 -1
package/dist/utils/diff-parser.js +0 -202
package/dist/utils/diff-parser.js.map +0 -1
package/dist/utils/environment-context.d.ts +0 -76
package/dist/utils/environment-context.d.ts.map +0 -1
package/dist/utils/environment-context.js +0 -271
package/dist/utils/environment-context.js.map +0 -1
package/dist/utils/imported-auth-detector.d.ts +0 -37
package/dist/utils/imported-auth-detector.d.ts.map +0 -1
package/dist/utils/imported-auth-detector.js +0 -251
package/dist/utils/imported-auth-detector.js.map +0 -1
package/dist/utils/intent-detector.d.ts +0 -66
package/dist/utils/intent-detector.d.ts.map +0 -1
package/dist/utils/intent-detector.js +0 -282
package/dist/utils/intent-detector.js.map +0 -1
package/dist/utils/middleware-detector.d.ts +0 -55
package/dist/utils/middleware-detector.d.ts.map +0 -1
package/dist/utils/middleware-detector.js +0 -260
package/dist/utils/middleware-detector.js.map +0 -1
package/dist/utils/oauth-flow-detector.d.ts +0 -41
package/dist/utils/oauth-flow-detector.d.ts.map +0 -1
package/dist/utils/oauth-flow-detector.js +0 -202
package/dist/utils/oauth-flow-detector.js.map +0 -1
package/dist/utils/parsed-file.d.ts +0 -51
package/dist/utils/parsed-file.d.ts.map +0 -1
package/dist/utils/parsed-file.js +0 -95
package/dist/utils/parsed-file.js.map +0 -1
package/dist/utils/path-exclusions.d.ts +0 -55
package/dist/utils/path-exclusions.d.ts.map +0 -1
package/dist/utils/path-exclusions.js +0 -224
package/dist/utils/path-exclusions.js.map +0 -1
package/dist/utils/project-context-builder.d.ts +0 -119
package/dist/utils/project-context-builder.d.ts.map +0 -1
package/dist/utils/project-context-builder.js +0 -534
package/dist/utils/project-context-builder.js.map +0 -1
package/dist/utils/registry-clients.d.ts +0 -93
package/dist/utils/registry-clients.d.ts.map +0 -1
package/dist/utils/registry-clients.js +0 -273
package/dist/utils/registry-clients.js.map +0 -1
package/dist/utils/route-hierarchy.d.ts +0 -50
package/dist/utils/route-hierarchy.d.ts.map +0 -1
package/dist/utils/route-hierarchy.js +0 -226
package/dist/utils/route-hierarchy.js.map +0 -1
package/dist/utils/schema-semantics.d.ts +0 -45
package/dist/utils/schema-semantics.d.ts.map +0 -1
package/dist/utils/schema-semantics.js +0 -193
package/dist/utils/schema-semantics.js.map +0 -1
package/dist/utils/trpc-analyzer.d.ts +0 -78
package/dist/utils/trpc-analyzer.d.ts.map +0 -1
package/dist/utils/trpc-analyzer.js +0 -297
package/dist/utils/trpc-analyzer.js.map +0 -1
package/src/__tests__/context-engine/cross-file-taint.test.ts +0 -284
package/src/__tests__/context-engine/function-classifier.test.ts +0 -146
package/src/__tests__/context-engine/integration.test.ts +0 -320
package/src/__tests__/context-engine/sanitiser-detection.test.ts +0 -187
package/src/__tests__/context-engine/sink-matcher.test.ts +0 -251
package/src/__tests__/context-engine/source-discovery.test.ts +0 -186
package/src/__tests__/context-engine/taint-tracker.test.ts +0 -182
package/src/__tests__/snapshots/__snapshots__/anthropic-validation-refactor.test.ts.snap +0 -750
package/src/__tests__/snapshots/__snapshots__/dangerous-functions-refactor.test.ts.snap +0 -555
package/src/__tests__/snapshots/anthropic-validation-refactor.test.ts +0 -321
package/src/__tests__/snapshots/dangerous-functions-refactor.test.ts +0 -439
package/src/detect/ai-code/agent-tools.ts +0 -1662
package/src/detect/ai-code/byok-patterns.ts +0 -354
package/src/detect/ai-code/endpoint-protection.ts +0 -406
package/src/detect/ai-code/execution-sinks.ts +0 -1310
package/src/detect/ai-code/fingerprinting.ts +0 -774
package/src/detect/ai-code/mcp-security.ts +0 -937
package/src/detect/ai-code/model-supply-chain.ts +0 -535
package/src/detect/ai-code/package-hallucination.ts +0 -955
package/src/detect/ai-code/prompt-hygiene.ts +0 -1314
package/src/detect/ai-code/rag-safety.ts +0 -977
package/src/detect/ai-code/schema-validation.ts +0 -427
package/src/detect/secrets/patterns.ts +0 -561
package/src/detect/secrets/weak-crypto.ts +0 -485
package/src/detect/structural/__tests__/math-random-enhanced.test.ts +0 -405
package/src/detect/structural/auth-patterns.ts +0 -621
package/src/detect/structural/dangerous-functions/child-process.ts +0 -98
package/src/detect/structural/dangerous-functions/dom-xss.ts +0 -292
package/src/detect/structural/dangerous-functions/index.ts +0 -1556
package/src/detect/structural/dangerous-functions/json-parse.ts +0 -393
package/src/detect/structural/dangerous-functions/math-random.ts +0 -789
package/src/detect/structural/dangerous-functions/patterns.ts +0 -176
package/src/detect/structural/dangerous-functions/request-validation.ts +0 -153
package/src/detect/structural/dangerous-functions/utils/control-flow.ts +0 -35
package/src/detect/structural/dangerous-functions/utils/helpers.ts +0 -170
package/src/detect/structural/dangerous-functions/utils/index.ts +0 -25
package/src/detect/structural/dangerous-functions/utils/schema-validation.ts +0 -106
package/src/detect/structural/data-exposure.ts +0 -302
package/src/detect/structural/framework-checks.ts +0 -439
package/src/detect/structural/log-injection.ts +0 -254
package/src/detect/structural/logic-gates.ts +0 -256
package/src/detect/structural/risky-imports.ts +0 -197
package/src/detect/structural/security-headers.ts +0 -231
package/src/detect/structural/ssrf-detection.ts +0 -300
package/src/detect/structural/variables.ts +0 -177
package/src/detect/structural/xxe-detection.ts +0 -295
package/src/model/cross-file-taint.ts +0 -374
package/src/model/function-classifier.ts +0 -184
package/src/model/sanitiser-detection.ts +0 -268
package/src/model/sink-matcher.ts +0 -178
package/src/model/sink-patterns.ts +0 -109
package/src/model/source-discovery.ts +0 -209
package/src/model/taint-tracker.ts +0 -333
package/src/score/auto-dismiss.ts +0 -224

package/src/detect/structural/dangerous-functions/index.ts DELETED Viewed

@@ -1,1556 +0,0 @@
-/**
- * Layer 2: Dangerous Function Call Analysis
- *
- * Detects usage of dangerous functions that can lead to security vulnerabilities.
- * This module orchestrates detection across multiple specialized modules.
- */
-import type { Vulnerability, VulnerabilitySeverity } from '../../../shared/types'
-import type { ParsedFile } from '../../../shared/parsed-file'
-import {
-  isComment,
-  isTestOrMockFile,
-  isScannerOrFixtureFile,
-  isSeedOrDataGenFile,
-  isDesktopAppContext,
-  isMcpServerContext,
-  isFileLoaderContext,
-} from '../../../parse/file-classifier'
-// Pattern definitions
-import {
-  DANGEROUS_FUNCTIONS,
-  matchesLanguage,
-  type DangerousFunctionPattern,
-} from './patterns'
-// Child process detection
-import { isChildProcessExec, isChildProcessSpawn } from './child-process'
-// DOM/XSS detection
-import {
-  isStyleElementInnerHTML,
-  isStaticHTMLContent,
-  hasDOMPurifySanitization,
-  isLLMPromptContext,
-  isStaticBootstrapScript,
-  isTrustedLibraryHTMLOutput,
-} from './dom-xss'
-// JSON.parse detection
-import { detectJSONParseSafe } from './json-parse'
-// Math.random detection
-import {
-  isCosmeticMathRandom,
-  classifyFunctionIntent,
-  analyzeToStringPattern,
-  extractMathRandomVariableName,
-  classifyVariableNameRisk,
-  analyzeMathRandomContext,
-  shouldSkipMathRandom,
-} from './math-random'
-// Request validation detection
-import { detectRequestJsonValidation } from './request-validation'
-// Utilities
-import { extractFunctionContext } from './utils/control-flow'
-import { hasSQLWhitelistValidation } from './utils/schema-validation'
-import { hasOnlyStaticInputs, hasPathTraversalProtection } from './utils/helpers'
-// Re-export types and patterns for external use
-export { DANGEROUS_FUNCTIONS, type DangerousFunctionPattern } from './patterns'
-const BASE_CONFIDENCE = 0.40
-/**
- * Main detection function for dangerous function calls
- */
-export function detectDangerousFunctions(
-  content: string,
-  filePath: string,
-  options?: { parsed?: ParsedFile }
-): Vulnerability[] {
-  const vulnerabilities: Vulnerability[] = []
-  // Skip scanner/fixture files to avoid self-detection
-  if (isScannerOrFixtureFile(filePath)) {
-    return vulnerabilities
-  }
-  const lines = options?.parsed?.lines ?? content.split('\n')
-  const isTestFile = isTestOrMockFile(filePath)
-  lines.forEach((line, index) => {
-    // Skip comment lines
-    if (isComment(line)) return
-    for (const funcPattern of DANGEROUS_FUNCTIONS) {
-      // Check language filter
-      if (!matchesLanguage(filePath, funcPattern.languages)) continue
-      const regex = new RegExp(
-        funcPattern.pattern.source,
-        funcPattern.pattern.flags
-      )
-      if (regex.test(line)) {
-        // Special handling for innerHTML patterns
-        if (
-          funcPattern.name === 'innerHTML assignment' ||
-          funcPattern.name === 'dangerouslySetInnerHTML'
-        ) {
-          handleInnerHTMLPattern(
-            funcPattern,
-            line,
-            content,
-            index,
-            filePath,
-            isTestFile,
-            vulnerabilities,
-            lines
-          )
-          break
-        }
-        // Note: JSON.parse is now handled by standalone detectJSONParseSafe() function
-        // which provides better source-aware severity classification
-        // Special handling for eval and Function constructor
-        if (
-          funcPattern.name === 'eval() usage' ||
-          funcPattern.name === 'Function constructor'
-        ) {
-          if (
-            handleEvalPattern(
-              funcPattern,
-              line,
-              content,
-              index,
-              filePath,
-              isTestFile,
-              vulnerabilities
-            )
-          ) {
-            break
-          }
-          continue
-        }
-        // Special handling for child_process exec - verify it's not RegExp.exec
-        if (funcPattern.name === 'child_process exec') {
-          if (
-            handleChildProcessPattern(
-              funcPattern,
-              line,
-              content,
-              index,
-              filePath,
-              isTestFile,
-              vulnerabilities,
-              lines
-            )
-          ) {
-            break
-          }
-          continue
-        }
-        // Special handling for SQL patterns - check for whitelist validation
-        if (
-          funcPattern.name === 'Raw SQL query construction' ||
-          funcPattern.name === 'SQL template literal'
-        ) {
-          handleSQLPattern(
-            funcPattern,
-            line,
-            content,
-            index,
-            filePath,
-            isTestFile,
-            vulnerabilities,
-            lines
-          )
-          break
-        }
-        // Special handling for dynamic file paths - check for path traversal protection
-        if (
-          funcPattern.name === 'Dynamic file path' ||
-          funcPattern.name === 'Path traversal risk'
-        ) {
-          handleFilePathPattern(
-            funcPattern,
-            line,
-            content,
-            index,
-            filePath,
-            isTestFile,
-            vulnerabilities,
-            lines
-          )
-          break
-        }
-        // Special handling for Math.random
-        if (funcPattern.name === 'Math.random for security') {
-          handleMathRandomPattern(
-            funcPattern,
-            line,
-            content,
-            index,
-            filePath,
-            isTestFile,
-            vulnerabilities
-          )
-          break
-        }
-        // Special handling for Python subprocess/os.system
-        if (funcPattern.name === 'os.system/subprocess (Python)') {
-          handlePythonSubprocessPattern(
-            funcPattern,
-            line,
-            content,
-            index,
-            filePath,
-            isTestFile,
-            vulnerabilities,
-            lines
-          )
-          break
-        }
-        // Special handling for regex patterns - check for escaped input
-        if (funcPattern.name === 'Potentially unsafe regex') {
-          handleRegexPattern(
-            funcPattern,
-            line,
-            content,
-            index,
-            filePath,
-            isTestFile,
-            vulnerabilities,
-            lines
-          )
-          break
-        }
-        // Special handling for spread operator with user input
-        if (funcPattern.name === 'Spread operator with user input') {
-          handleSpreadPattern(
-            funcPattern,
-            line,
-            content,
-            index,
-            filePath,
-            isTestFile,
-            vulnerabilities,
-            lines
-          )
-          break
-        }
-        // Standard handling for all other patterns
-        handleStandardPattern(
-          funcPattern,
-          line,
-          index,
-          filePath,
-          isTestFile,
-          vulnerabilities
-        )
-        break // Only report once per line
-      }
-    }
-  })
-  // Additional standalone checks (not in DANGEROUS_FUNCTIONS array)
-  // JSON.parse source-aware detection
-  detectJSONParseSafe(content, filePath, isTestFile, vulnerabilities)
-  // request.json() / req.json() schema validation suggestion
-  detectRequestJsonValidation(content, filePath, isTestFile, vulnerabilities)
-  return vulnerabilities
-}
-/**
- * Handle innerHTML/dangerouslySetInnerHTML patterns
- */
-function handleInnerHTMLPattern(
-  funcPattern: DangerousFunctionPattern,
-  line: string,
-  content: string,
-  index: number,
-  filePath: string,
-  isTestFile: boolean,
-  vulnerabilities: Vulnerability[],
-  lines?: string[]
-): void {
-  // Check if this is a style element (CSS injection is not XSS)
-  if (isStyleElementInnerHTML(line, content, index, lines)) {
-    // Style elements with CSS are safe - don't report anything
-    // CSS cannot execute JavaScript, so there's no XSS risk
-    return
-  }
-  // Check if this uses static content only - skip entirely (safe)
-  if (isStaticHTMLContent(line, content, index, lines)) {
-    return // Static HTML is safe - no finding needed
-  }
-  // Check if DOMPurify or similar sanitization is used - skip entirely (safe)
-  if (hasDOMPurifySanitization(line, content, index, lines)) {
-    return // Sanitized HTML is safe - no finding needed
-  }
-  // Check if this is a static bootstrap script (e.g., theme/font loader) - skip entirely (safe)
-  if (isStaticBootstrapScript(line, content, index, lines)) {
-    return // Static bootstrap scripts are safe - no finding needed
-  }
-  // Check if this uses output from trusted HTML rendering libraries (Shiki, highlight.js, marked, etc.)
-  // These libraries produce sanitized HTML output
-  if (isTrustedLibraryHTMLOutput(line, content, index, lines)) {
-    return // Trusted library output is safe - no finding needed
-  }
-  // Check if this is in LLM prompt context (not XSS - it's prompt injection)
-  if (isLLMPromptContext(line, content, filePath)) {
-    vulnerabilities.push({
-      id: `dangerous-func-${filePath}-${index + 1}-prompt-injection`,
-      filePath,
-      lineNumber: index + 1,
-      lineContent: line.trim(),
-      severity: 'info',
-      category: 'ai_pattern',
-      title: 'Potential prompt injection risk',
-      description:
-        'User content is being used in an LLM prompt context. This is NOT XSS (the content goes to an AI, not a DOM). However, untrusted content in prompts may lead to prompt injection attacks.',
-      suggestedFix:
-        'Consider input validation, content filtering, or structured prompts to limit prompt injection risk.',
-      confidence: 'low',
-      baseConfidence: BASE_CONFIDENCE,
-      layer: 2,
-      source: 'structural' as const,    })
-    return
-  }
-  // Dynamic content - full severity, needs AI validation
-  let severity = funcPattern.severity
-  if (isTestFile) {
-    severity = 'low'
-  }
-  vulnerabilities.push({
-    id: `dangerous-func-${filePath}-${index + 1}-${funcPattern.name}`,
-    filePath,
-    lineNumber: index + 1,
-    lineContent: line.trim(),
-    severity,
-    category: 'dangerous_function',
-    title: funcPattern.name,
-    description:
-      funcPattern.description +
-      ' This appears to use dynamic content which increases XSS risk.' +
-      (isTestFile ? ' (in test file)' : ''),
-    suggestedFix: funcPattern.suggestedFix,
-    confidence: isTestFile ? 'low' : 'high',
-    baseConfidence: BASE_CONFIDENCE,
-    layer: 2,
-      source: 'structural' as const,    requiresAIValidation: true, // Dynamic HTML needs validation
-  })
-}
-/**
- * Handle eval and Function constructor patterns
- * Returns true if a finding was added, false otherwise
- */
-function handleEvalPattern(
-  funcPattern: DangerousFunctionPattern,
-  line: string,
-  content: string,
-  index: number,
-  filePath: string,
-  isTestFile: boolean,
-  vulnerabilities: Vulnerability[]
-): boolean {
-  // Check if "eval" or "Function" appears inside a string literal
-  // e.g., const docs = "Don't use eval() in production"
-  // This is NOT an actual eval call, just documentation/comments
-  const evalInsideStringPattern = /(['"`])(?:[^\\]|\\.)*?\beval\s*\(.*?\1/
-  const functionInsideStringPattern = /(['"`])(?:[^\\]|\\.)*?\bFunction\s*\(.*?\1/
-  if (evalInsideStringPattern.test(line) || functionInsideStringPattern.test(line)) {
-    return true // Skip - this is just a string mentioning eval, not actual eval()
-  }
-  // Suppress entirely in test files - test files legitimately test eval behavior
-  if (isTestFile) {
-    return true // Skip reporting entirely
-  }
-  // Check if eval is inside a test assertion (expect(), test(), it(), describe())
-  const testAssertionPattern = /\b(expect|test|it|describe)\s*\(/
-  if (testAssertionPattern.test(line)) {
-    return true // Skip reporting - this is testing eval behavior
-  }
-  // Check if inputs are static literals (low risk) - skip entirely
-  if (hasOnlyStaticInputs(line, content, index)) {
-    return true // Static eval is safe enough - no finding needed
-  }
-  vulnerabilities.push({
-    id: `dangerous-func-${filePath}-${index + 1}-${funcPattern.name}`,
-    filePath,
-    lineNumber: index + 1,
-    lineContent: line.trim(),
-    severity: funcPattern.severity,
-    category: 'dangerous_function',
-    title: funcPattern.name,
-    description: funcPattern.description,
-    suggestedFix: funcPattern.suggestedFix,
-    confidence: 'high',
-    baseConfidence: BASE_CONFIDENCE,
-    layer: 2,
-      source: 'structural' as const,    requiresAIValidation: true, // Code execution patterns need validation
-  })
-  return true
-}
-/**
- * Handle child_process exec patterns
- * Returns true if a finding was added, false otherwise
- */
-function handleChildProcessPattern(
-  funcPattern: DangerousFunctionPattern,
-  line: string,
-  content: string,
-  index: number,
-  filePath: string,
-  isTestFile: boolean,
-  vulnerabilities: Vulnerability[],
-  lines?: string[]
-): boolean {
-  // First check if this is actually from child_process (not RegExp.exec)
-  const isExecMatch = /\bexec\s*\(/.test(line)
-  const isOtherMatch = /\b(execSync|spawn|spawnSync|execFile)\s*\(/.test(line)
-  if (isExecMatch && !isOtherMatch) {
-    // This matched 'exec(' - verify it's from child_process
-    if (!isChildProcessExec(content, line)) {
-      // This is RegExp.exec or similar - skip
-      return false
-    }
-  } else if (isOtherMatch) {
-    // This matched spawn/execSync/etc - verify child_process import
-    if (!isChildProcessSpawn(content, line)) {
-      // No child_process import - skip
-      return false
-    }
-  }
-  // Check if arguments are validated via allowlist
-  const _lines = lines ?? content.split('\n')
-  const contextStart = Math.max(0, index - 15)
-  const contextEnd = Math.min(_lines.length, index + 5)
-  const context = _lines.slice(contextStart, contextEnd).join('\n')
-  // Detect allowlist validation patterns before exec/spawn
-  const hasArgAllowlist =
-    /allowedArgs\.includes\s*\(/i.test(context) ||
-    /if\s*\(\s*!?allowedArgs\.includes/i.test(context) ||
-    /if\s*\(\s*!?\w+Args\.includes/i.test(context) ||
-    /validArgs\.includes/i.test(context) ||
-    // ALLOWED_COMMANDS pattern (common naming convention)
-    /ALLOWED_\w+\.includes\s*\(/i.test(context) ||
-    /if\s*\(\s*!?ALLOWED_\w+\.includes/i.test(context) ||
-    // allowedCommands, validCommands, safeCommands
-    /allowed(?:Commands?|Cmds?)\.includes\s*\(/i.test(context) ||
-    /valid(?:Commands?|Cmds?)\.includes\s*\(/i.test(context) ||
-    /safe(?:Commands?|Cmds?)\.includes\s*\(/i.test(context) ||
-    // Generic whitelist/allowlist check
-    /(?:whitelist|allowlist)\.includes\s*\(/i.test(context)
-  // execFile with hardcoded command is safe (safer than exec)
-  const isExecFileWithHardcodedCmd = /execFile\s*\(\s*['"][^'"]+['"]/i.test(line)
-  if (hasArgAllowlist || isExecFileWithHardcodedCmd) {
-    return true // Allowlisted or execFile with hardcoded command - safe
-  }
-  if (hasOnlyStaticInputs(line, content, index)) {
-    return true // Static command is safe - no finding needed
-  }
-  // Check for build/script context with hardcoded command + args array
-  const isBuildScript = /(build|generate|format|lint|setup|deploy|migrate|compile)/i.test(filePath) ||
-    /\/(scripts?|tools?|bin)\//i.test(filePath)
-  if (isBuildScript) {
-    // spawnSync("cmd", ["arg1", "arg2"]) with string literal command is safe in build scripts
-    const hasHardcodedCommand = /spawn(?:Sync)?\s*\(\s*['"][^'"]+['"]/.test(line)
-    if (hasHardcodedCommand) {
-      vulnerabilities.push({
-        id: `dangerous-func-${filePath}-${index + 1}-${funcPattern.name}`,
-        filePath,
-        lineNumber: index + 1,
-        lineContent: line.trim(),
-        severity: 'info',
-        category: 'dangerous_function',
-        title: funcPattern.name + ' (build script)',
-        description: 'Shell command execution in build/tooling script with hardcoded command. Build scripts are developer-controlled.',
-        suggestedFix: 'Ensure this script is not exposed to untrusted input.',
-        confidence: 'low',
-        baseConfidence: BASE_CONFIDENCE,
-        layer: 2,
-      source: 'structural' as const,      })
-      return true
-    }
-  }
-  // Check for desktop app or MCP server context
-  // These contexts legitimately spawn processes
-  const isDesktopApp = isDesktopAppContext(filePath)
-  const isMcpServer = isMcpServerContext(filePath)
-  if (isDesktopApp || isMcpServer) {
-    // Desktop apps and MCP servers legitimately spawn processes
-    // Still report but with reduced severity and context
-    const contextType = isDesktopApp ? 'desktop app' : 'MCP server'
-    vulnerabilities.push({
-      id: `dangerous-func-${filePath}-${index + 1}-${funcPattern.name}`,
-      filePath,
-      lineNumber: index + 1,
-      lineContent: line.trim(),
-      severity: 'medium', // Reduced from high
-      category: 'dangerous_function',
-      title: `${funcPattern.name} (${contextType})`,
-      description: `${funcPattern.description} (Expected in ${contextType} context - verify input validation)`,
-      suggestedFix:
-        'Ensure command arguments from IPC are validated against an allowlist.',
-      confidence: 'medium',
-      baseConfidence: BASE_CONFIDENCE,
-      layer: 2,
-      source: 'structural' as const,    })
-    return true
-  }
-  // Dynamic command - report with standard severity
-  let severity = funcPattern.severity
-  let confidence: 'high' | 'medium' | 'low' = 'high'
-  if (isTestFile) {
-    if (severity === 'critical') {
-      severity = 'medium'
-    } else if (severity === 'high') {
-      severity = 'low'
-    } else {
-      severity = 'info'
-    }
-    confidence = 'low'
-  }
-  vulnerabilities.push({
-    id: `dangerous-func-${filePath}-${index + 1}-${funcPattern.name}`,
-    filePath,
-    lineNumber: index + 1,
-    lineContent: line.trim(),
-    severity,
-    category: 'dangerous_function',
-    title: funcPattern.name,
-    description: funcPattern.description + (isTestFile ? ' (in test file)' : ''),
-    suggestedFix: funcPattern.suggestedFix,
-    confidence,
-    baseConfidence: BASE_CONFIDENCE,
-    layer: 2,
-      source: 'structural' as const,  })
-  return true
-}
-/**
- * Handle SQL injection patterns
- */
-function handleSQLPattern(
-  funcPattern: DangerousFunctionPattern,
-  line: string,
-  content: string,
-  index: number,
-  filePath: string,
-  isTestFile: boolean,
-  vulnerabilities: Vulnerability[],
-  lines?: string[]
-): void {
-  // Check for whitelist validation - skip entirely (safe)
-  if (hasSQLWhitelistValidation(content, index)) {
-    return // Whitelist validated - safe, no finding needed
-  }
-  // Check for ORM methods (not raw SQL) - skip entirely (safe)
-  // Prisma: prisma.user.findMany({ where: {...} })
-  // Sequelize: Model.findAll({ where: {...} })
-  // TypeORM: repository.find({ where: {...} })
-  const ormMethodPattern = /\.(findMany|findUnique|findFirst|findAll|find|create|update|delete|upsert)\s*\(\s*\{/i
-  if (ormMethodPattern.test(line)) {
-    return // ORM method - safe, no finding needed
-  }
-  // Check for parameterized queries - skip entirely (safe)
-  // e.g., db.query('SELECT * FROM users WHERE id = $1', [userId])
-  const parameterizedQueryPattern = /\.\s*(query|execute)\s*\(\s*['"`][^${}]+['"`]\s*,\s*\[/
-  if (parameterizedQueryPattern.test(line)) {
-    return // Parameterized query - safe, no finding needed
-  }
-  // Knex .raw() with ? placeholders and array binding - this IS parameterized
-  // e.g., db.raw(`"table"."col" + ?`, [value]) or db.raw('SELECT ... WHERE id = ?', [id])
-  const knexRawParameterized = /\.raw\s*\(\s*[`'"]/i.test(line) &&
-    /\?\s*[`'"]\s*,\s*\[/.test(line)
-  if (knexRawParameterized) {
-    return // Knex .raw() with ? placeholders is parameterized - safe
-  }
-  // Knex .raw() with only const enum/table name interpolation (not user input)
-  // e.g., db.raw(`"${TableName.Users}"."col"`) where TableName is a const enum
-  const knexRawConstInterpolation = /\.raw\s*\(\s*`/.test(line) &&
-    /\$\{[A-Z][A-Za-z]*\.[A-Z]/.test(line)
-  if (knexRawConstInterpolation) {
-    const interpolations = line.match(/\$\{([^}]+)\}/g) || []
-    const allConst = interpolations.every(i => /^\$\{[A-Z_][A-Z_a-z]*\./.test(i))
-    if (allConst) {
-      return // Only const enum interpolation - safe
-    }
-  }
-  // Knex .raw() for SET statement_timeout (infrastructure, not user input)
-  // e.g., trx.raw(`SET statement_timeout = ${QUERY_TIMEOUT_MS}`)
-  const isSetStatement = /\.raw\s*\(\s*[`'"]SET\s+/i.test(line)
-  if (isSetStatement) {
-    return // SET statements are infrastructure config, not queries with user data
-  }
-  // DROP TRIGGER / DDL statements from migration/schema files
-  const isDDLStatement = /\.raw\s*\(\s*[`'"](DROP|CREATE|ALTER)\s+/i.test(line) &&
-    /(migration|schema|seed)/i.test(filePath)
-  if (isDDLStatement) {
-    return // DDL in migration/schema files - not user-facing
-  }
-  // Check for Prisma tagged template literal - these ARE parameterized (safe)
-  // Prisma's $queryRaw`...${var}...` treats ${} as parameterized values, not string interpolation
-  // e.g., prisma.$queryRaw`SELECT * FROM users WHERE id = ${userId}`
-  const prismaTaggedTemplatePattern = /\$queryRaw\s*`[^`]*\$\{/i
-  if (prismaTaggedTemplatePattern.test(line)) {
-    return // Prisma tagged template - parameterized and safe, no finding needed
-  }
-  // Check for schema-validated input (zod .enum() for table/column names)
-  // e.g., z.enum(['users', 'posts']).parse(input) followed by SQL
-  const _lines = lines ?? content.split('\n')
-  const contextStart = Math.max(0, index - 20)
-  const contextEnd = index
-  const previousContext = _lines.slice(contextStart, contextEnd).join('\n')
-  // Detect zod enum validation for SQL identifiers
-  const hasSchemaValidation =
-    /z\s*\.\s*enum\s*\(\s*\[['"][^'"]+['"]/i.test(previousContext) ||
-    /\.parse\s*\(\s*JSON\.parse/.test(previousContext) ||
-    // Allow validated table/column names from parsed schema
-    /schema\.parse/.test(previousContext) ||
-    /const\s+parsed\s*=\s*schema/.test(previousContext)
-  if (hasSchemaValidation) {
-    return // Schema-validated SQL identifiers - safe, no finding needed
-  }
-  // No whitelist - report with standard severity
-  let severity = funcPattern.severity
-  let confidence: 'high' | 'medium' | 'low' = 'high'
-  if (isTestFile) {
-    if (severity === 'critical') {
-      severity = 'medium'
-    } else if (severity === 'high') {
-      severity = 'low'
-    } else {
-      severity = 'info'
-    }
-    confidence = 'low'
-  }
-  vulnerabilities.push({
-    id: `dangerous-func-${filePath}-${index + 1}-${funcPattern.name}`,
-    filePath,
-    lineNumber: index + 1,
-    lineContent: line.trim(),
-    severity,
-    category: 'dangerous_function',
-    title: funcPattern.name,
-    description: funcPattern.description + (isTestFile ? ' (in test file)' : ''),
-    suggestedFix: funcPattern.suggestedFix,
-    confidence,
-    baseConfidence: BASE_CONFIDENCE,
-    layer: 2,
-      source: 'structural' as const,  })
-}
-/**
- * Handle dynamic file path patterns
- */
-function handleFilePathPattern(
-  funcPattern: DangerousFunctionPattern,
-  line: string,
-  content: string,
-  index: number,
-  filePath: string,
-  isTestFile: boolean,
-  vulnerabilities: Vulnerability[],
-  lines?: string[]
-): void {
-  // Check for desktop app context (Electron, Tauri, etc.)
-  // Desktop apps legitimately access filesystem
-  const isDesktopApp = isDesktopAppContext(filePath)
-  // Check for file loader context
-  // File loaders legitimately access filesystem to process files
-  const isFileLoader = isFileLoaderContext(filePath)
-  // Desktop apps and file loaders are expected to access filesystem
-  if (isDesktopApp || isFileLoader) {
-    const contextType = isDesktopApp ? 'desktop app' : 'file loader'
-    vulnerabilities.push({
-      id: `dangerous-func-${filePath}-${index + 1}-${funcPattern.name}`,
-      filePath,
-      lineNumber: index + 1,
-      lineContent: line.trim(),
-      severity: 'info',
-      category: 'dangerous_function',
-      title: `${funcPattern.name} (${contextType})`,
-      description: `Dynamic file path in ${contextType} context. File system access is expected functionality. Verify path inputs are validated.`,
-      suggestedFix:
-        'Ensure file paths are validated and constrained to expected directories.',
-      confidence: 'low',
-      baseConfidence: BASE_CONFIDENCE,
-      layer: 2,
-      source: 'structural' as const,    })
-    return
-  }
-  // Check file context for CLI/tooling (lower risk)
-  const isCLITool =
-    /\/(cli|scripts?|tools?|bin)\//i.test(filePath) ||
-    /cli\.(ts|js)$/i.test(filePath)
-  // Check for GitHub Action context (workflow-controlled paths)
-  const isGitHubAction =
-    /\/(github-action|actions?)\//i.test(filePath) ||
-    /action\.(ts|js)$/i.test(filePath)
-  // Check for utility/helper file context (called by trusted code)
-  const isUtilityFile =
-    /\/(utils?|helpers?|lib|common|shared)\//i.test(filePath) ||
-    /(util(s)?|helper(s)?|checksum|hash)\.(ts|js)$/i.test(filePath)
-  // Check for server infrastructure/config files (transport, signing, credentials)
-  // These files read/write config-controlled paths, not user input
-  const isServerInfrastructureFile =
-    /\/(transports?|signing|credentials?|certificates?|certs?)\//i.test(filePath) ||
-    /\/(config|infrastructure|provisioning)\//i.test(filePath) ||
-    /(transport|signer|credential|certificate)\.(ts|js)$/i.test(filePath)
-  // Get surrounding context for protection check
-  const _lines = lines ?? content.split('\n')
-  const contextStart = Math.max(0, index - 10)
-  const contextEnd = Math.min(_lines.length, index + 10)
-  const context = _lines.slice(contextStart, contextEnd).join('\n')
-  // Check if path comes from directory iteration (fs.readdir, fs.readdirSync)
-  // These paths are filesystem-controlled, not user input
-  const hasDirectoryIteration =
-    /\b(readdir|readdirSync|opendir|opendirSync)\s*\(/.test(content) &&
-    (/for\s*\(\s*(const|let|var)\s+\w+\s+of/.test(context) ||
-     /\.forEach\s*\(/.test(context) ||
-     /\.map\s*\(/.test(context) ||              // array.map() iteration
-     /pMap\s*\(/.test(context) ||               // p-map library (parallel map)
-     /Promise\.all\s*\(/.test(context) ||       // Promise.all mapping
-     /entry\.(name|isFile|isDirectory)/.test(context) ||
-     /dirent\.(name|isFile|isDirectory)/.test(context))
-  if (hasPathTraversalProtection(context, line)) {
-    vulnerabilities.push({
-      id: `dangerous-func-${filePath}-${index + 1}-${funcPattern.name}`,
-      filePath,
-      lineNumber: index + 1,
-      lineContent: line.trim(),
-      severity: 'info',
-      category: 'dangerous_function',
-      title: funcPattern.name + ' (protected)',
-      description:
-        'Dynamic file path with path traversal protection detected. Verify the protection is complete and covers all attack vectors.',
-      suggestedFix:
-        'Ensure path normalization and base directory checks are applied consistently.',
-      confidence: 'low',
-      baseConfidence: BASE_CONFIDENCE,
-      layer: 2,
-      source: 'structural' as const,    })
-    return
-  }
-  // Directory iteration paths are filesystem-controlled (not user input)
-  if (hasDirectoryIteration) {
-    // Skip entirely - paths from fs.readdir are not user-controlled
-    return
-  }
-  // Check for Object.entries/keys/values over hardcoded objects
-  // Pattern: for (const [key, val] of Object.entries(STATIC_OBJ))
-  const hasHardcodedObjectIteration = ((): boolean => {
-    // Look for Object.entries/keys/values in context
-    const hasObjectIteration = /Object\.(entries|keys|values)\s*\(/.test(context)
-    if (!hasObjectIteration) return false
-    // Check if the object being iterated is defined as a const literal nearby
-    // Pattern: const objName = { ... }; ... Object.entries(objName)
-    const objectMatch = context.match(/Object\.(entries|keys|values)\s*\(\s*(\w+)\s*\)/)
-    if (!objectMatch) return false
-    const objName = objectMatch[2]
-    // Check if objName is defined as a const object literal in the file
-    const isConstObject = new RegExp(`const\\s+${objName}\\s*=\\s*\\{`).test(content)
-    return isConstObject
-  })()
-  if (hasHardcodedObjectIteration) {
-    // Skip entirely - iterating over hardcoded object, not user input
-    return
-  }
-  // GitHub Action paths are workflow-controlled (not arbitrary user input)
-  if (isGitHubAction) {
-    vulnerabilities.push({
-      id: `dangerous-func-${filePath}-${index + 1}-${funcPattern.name}`,
-      filePath,
-      lineNumber: index + 1,
-      lineContent: line.trim(),
-      severity: 'info',
-      category: 'dangerous_function',
-      title: funcPattern.name + ' (GitHub Action)',
-      description:
-        'Dynamic file path in GitHub Action. Paths are typically controlled by workflow configuration, not arbitrary user input.',
-      suggestedFix:
-        'Verify paths come from trusted action inputs or environment variables.',
-      confidence: 'low',
-      baseConfidence: BASE_CONFIDENCE,
-      layer: 2,
-      source: 'structural' as const,    })
-    return
-  }
-  // CLI tools with dynamic paths are lower risk (trusted operator)
-  if (isCLITool) {
-    vulnerabilities.push({
-      id: `dangerous-func-${filePath}-${index + 1}-${funcPattern.name}`,
-      filePath,
-      lineNumber: index + 1,
-      lineContent: line.trim(),
-      severity: 'info',
-      category: 'dangerous_function',
-      title: funcPattern.name + ' (CLI tool)',
-      description:
-        'Dynamic file path in CLI tool. CLI tools typically have trusted operators, but consider adding path validation if user input is involved.',
-      suggestedFix:
-        'Add path validation if accepting paths from untrusted sources.',
-      confidence: 'low',
-      baseConfidence: BASE_CONFIDENCE,
-      layer: 2,
-      source: 'structural' as const,    })
-    return
-  }
-  // Utility/helper files with function parameters are lower risk (called by trusted code)
-  // Check if path variable appears to be a function parameter, not from request
-  const hasRequestData = /req\.(params|query|body)|request\.(params|query|body)/i.test(context)
-  if (isUtilityFile && !hasRequestData) {
-    // Skip entirely - utility functions receive paths from trusted callers
-    return
-  }
-  // Server infrastructure files (signing, transport, credentials) use config-controlled paths
-  // These paths come from environment variables or internal configuration, not user input
-  if (isServerInfrastructureFile && !hasRequestData) {
-    // Check if path comes from environment variables or function parameters
-    const hasEnvVarPath = /process\.env\.|import\.meta\.env\.|env\s*\(/i.test(context)
-    const hasConfigPath = /config\.|settings\.|credentials?\./i.test(context)
-    const hasCertPath = /certPath|keyPath|credentialsPath|googleApplicationCredentials/i.test(context)
-    if (hasEnvVarPath || hasConfigPath || hasCertPath) {
-      // Skip entirely - paths from env vars/config are not user-controlled
-      return
-    }
-  }
-  // Check if file path variable comes from environment variable wrapper function
-  // Common pattern: env('VAR_NAME') || 'default', process.env.VAR, etc.
-  const hasEnvVarSource = /env\s*\(\s*['"][^'"]+['"]\s*\)|process\.env\.\w+|import\.meta\.env\.\w+/i.test(context)
-  const hasOnlyConfigSource = hasEnvVarSource && !hasRequestData
-  if (hasOnlyConfigSource) {
-    // Path comes from environment variable, not user input - skip
-    return
-  }
-  // Standard handling for unprotected paths
-  let severity = funcPattern.severity
-  let confidence: 'high' | 'medium' | 'low' = 'high'
-  if (isTestFile) {
-    if (severity === 'critical') {
-      severity = 'medium'
-    } else if (severity === 'high') {
-      severity = 'low'
-    } else {
-      severity = 'info'
-    }
-    confidence = 'low'
-  }
-  vulnerabilities.push({
-    id: `dangerous-func-${filePath}-${index + 1}-${funcPattern.name}`,
-    filePath,
-    lineNumber: index + 1,
-    lineContent: line.trim(),
-    severity,
-    category: 'dangerous_function',
-    title: funcPattern.name,
-    description: funcPattern.description + (isTestFile ? ' (in test file)' : ''),
-    suggestedFix: funcPattern.suggestedFix,
-    confidence,
-    baseConfidence: BASE_CONFIDENCE,
-    layer: 2,
-      source: 'structural' as const,  })
-}
-/**
- * Handle Math.random patterns with context-aware severity
- */
-function handleMathRandomPattern(
-  funcPattern: DangerousFunctionPattern,
-  line: string,
-  content: string,
-  index: number,
-  filePath: string,
-  isTestFile: boolean,
-  vulnerabilities: Vulnerability[]
-): void {
-  // Skip entirely for certain contexts
-  if (shouldSkipMathRandom(content, filePath, index)) {
-    return
-  }
-  // Analyze context
-  const functionName = extractFunctionContext(content, index)
-  const functionIntent = classifyFunctionIntent(functionName)
-  const toStringPattern = analyzeToStringPattern(line)
-  const variableName = extractMathRandomVariableName(line)
-  const variableRisk = classifyVariableNameRisk(variableName)
-  const context = analyzeMathRandomContext(content, filePath, index)
-  // Determine severity based on all factors
-  let severity: VulnerabilitySeverity
-  let confidence: 'high' | 'medium' | 'low'
-  let description: string
-  let suggestedFix: string
-  let explanation = ''
-  // Variable name indicates security risk - check this FIRST before toString patterns
-  // This ensures 'secret', 'token', 'key' etc. are always flagged as high
-  if (variableRisk === 'high') {
-    severity = 'high'
-    confidence = 'high'
-    // Update context description to indicate security context
-    context.contextDescription = 'security-sensitive variable'
-    description = `Math.random() assigned to security-sensitive variable '${variableName}'. Math.random() is NOT cryptographically secure.`
-    suggestedFix =
-      'Use crypto.randomBytes() or crypto.getRandomValues() for security-sensitive values.'
-  }
-  // Security-sensitive contexts get high severity
-  else if (context.inSecurityContext || functionIntent === 'security') {
-    severity = 'high'
-    confidence = 'high'
-    description =
-      'Math.random() is being used in a security-sensitive context. This is NOT cryptographically secure and should be replaced.'
-    suggestedFix =
-      'Use crypto.randomBytes() for Node.js or crypto.getRandomValues() for browsers.'
-  }
-  // Test contexts get info severity
-  else if (context.inTestContext) {
-    severity = 'info'
-    confidence = 'low'
-    description =
-      'Math.random() in test context. Acceptable for test data generation.'
-    suggestedFix = 'No change needed for test data.'
-  }
-  // UUID/CAPTCHA generation - legitimate use
-  else if (functionIntent === 'uuid' || functionIntent === 'captcha') {
-    severity = 'info'
-    confidence = 'low'
-    description = `Math.random() used for ${functionIntent === 'uuid' ? 'ID generation' : 'CAPTCHA/puzzle'} (not security-sensitive).`
-    suggestedFix =
-      'For truly unique IDs, consider crypto.randomUUID(). For security tokens, use crypto.randomBytes().'
-  }
-  // Demo/seed data - legitimate use
-  else if (functionIntent === 'demo') {
-    severity = 'info'
-    confidence = 'low'
-    description =
-      'Math.random() for demo/seed data generation. Acceptable for non-production data.'
-    suggestedFix = 'No change needed for demo/seed data.'
-  }
-  // Short UI IDs (.toString(36).substring(2,9)) - info
-  else if (toStringPattern.intent === 'short-ui-id') {
-    severity = 'info'
-    confidence = 'low'
-    explanation = ` (${toStringPattern.truncationLength || '?'}-char string)`
-    // Override context description for UI IDs
-    context.contextDescription = 'UI identifier generation'
-    description = `Math.random() generating short UI identifier${explanation}. Acceptable for React keys, temp IDs.`
-    suggestedFix =
-      'For security tokens, use crypto.randomBytes(). For unique IDs, crypto.randomUUID().'
-  }
-  // Business IDs (.toString(36) with medium truncation) - low
-  else if (toStringPattern.intent === 'business-id') {
-    severity = 'low'
-    confidence = 'low'
-    explanation = variableName ? ` (variable: ${variableName})` : ''
-    description = `Math.random() generating business identifier${explanation}. Verify this is not used for security purposes.`
-    suggestedFix =
-      'For business IDs, crypto.randomUUID() is preferred. For security tokens, use crypto.randomBytes().'
-  }
-  // Full token (.toString(36) without truncation) - severity based on variable name
-  else if (toStringPattern.intent === 'full-token') {
-    // Note: high-risk variable names are already handled above
-    if (variableRisk === 'low') {
-      severity = 'low'
-      confidence = 'low'
-    } else {
-      severity = 'medium'
-      confidence = 'medium'
-    }
-    explanation = variableName ? ` (variable: ${variableName})` : ''
-    description = `Math.random() generating full-length random string${explanation}. This pattern is often used for security tokens.`
-    suggestedFix =
-      'Use crypto.randomBytes() for security tokens. Use crypto.randomUUID() for unique IDs.'
-  }
-  // UI/cosmetic context - info (skeleton widths, animations, visual effects)
-  else if (context.inUIContext) {
-    severity = 'info'
-    confidence = 'low'
-    description =
-      'Math.random() in UI/cosmetic context. Acceptable for visual effects, skeleton loading, animations.'
-    suggestedFix = 'No change needed for UI/cosmetic randomness.'
-  }
-  // Business logic context - low
-  else if (context.inBusinessLogicContext) {
-    severity = 'low'
-    confidence = 'low'
-    description =
-      'Math.random() in business logic context (backoff, sampling, experiments). Verify this is not for security.'
-    suggestedFix =
-      'If used for security, replace with crypto.randomBytes(). Otherwise, usage is acceptable.'
-  }
-  // Unknown context - medium
-  else {
-    severity = 'medium'
-    confidence = 'medium'
-    description =
-      'Math.random() is being used. Verify this is not for security-critical purposes like tokens, session IDs, or cryptographic operations.'
-    suggestedFix =
-      'If used for security, replace with crypto.randomBytes(). For unique IDs, use crypto.randomUUID()'
-  }
-  // Update title with context
-  const title = `Math.random() in ${context.contextDescription}${explanation}`
-  vulnerabilities.push({
-    id: `dangerous-func-${filePath}-${index + 1}-${funcPattern.name}`,
-    filePath,
-    lineNumber: index + 1,
-    lineContent: line.trim(),
-    severity,
-    category: 'dangerous_function',
-    title,
-    description,
-    suggestedFix,
-    confidence,
-    baseConfidence: BASE_CONFIDENCE,
-    layer: 2,
-      source: 'structural' as const,  })
-}
-/**
- * Extract the full Python function call block starting from the trigger line.
- * Uses paren-balancing to collect up to `maxLines` forward, capturing multi-line calls.
- * Returns the joined block string.
- */
-function extractPythonCallBlock(
-  lines: string[],
-  startIndex: number,
-  maxLines: number = 10
-): string {
-  let depth = 0
-  let started = false
-  const blockLines: string[] = []
-  for (let i = startIndex; i < Math.min(lines.length, startIndex + maxLines); i++) {
-    const ln = lines[i]
-    blockLines.push(ln)
-    for (const ch of ln) {
-      if (ch === '(') {
-        depth++
-        started = true
-      } else if (ch === ')') {
-        depth--
-      }
-    }
-    // Once we've opened at least one paren and balanced back to 0, we're done
-    if (started && depth <= 0) break
-  }
-  return blockLines.join('\n')
-}
-/**
- * Check if a Python list (as a string) contains only static string literals.
- * Returns true if every element is a plain string literal (no f-strings, no variables).
- */
-function isPythonListAllStatic(listContent: string): boolean {
-  // Remove the outer brackets
-  const inner = listContent.replace(/^\[/, '').replace(/\]$/, '').trim()
-  if (!inner) return true // empty list
-  // Split on commas (rough — good enough for typical subprocess args)
-  const elements = inner.split(',').map(e => e.trim()).filter(e => e.length > 0)
-  for (const el of elements) {
-    // Must be a plain string literal: 'foo', "bar", or """...""" / '''...'''
-    // Reject f-strings, variables, function calls
-    if (/^f['"`]/.test(el)) return false // f-string
-    if (/^['"]/.test(el) && /['"]$/.test(el)) continue // simple string literal
-    if (/^"""/.test(el) || /^'''/.test(el)) continue // triple-quoted
-    return false // variable, function call, or other expression
-  }
-  return true
-}
-/**
- * Handle Python subprocess/os.system patterns with multi-line awareness.
- *
- * Decision tree:
- * 1. os.system(...)                              → HIGH (always dangerous)
- * 2. shell=True in call block?                   → HIGH
- * 3. First arg is inline list [...]?
- *    a. All string literals, no f-strings        → SKIP (safe)
- *    b. Has f-strings or variables               → LOW (list args prevent shell injection)
- * 4. First arg is a variable name?
- *    a. Resolved to list nearby, all static      → SKIP
- *    b. Resolved to list nearby, has dynamics    → LOW
- *    c. Can't resolve                            → LOW (unresolved, flag for review)
- * 5. f-string as direct arg (not in list)?       → HIGH (command injection)
- * 6. Everything else                             → HIGH (fallback)
- */
-function handlePythonSubprocessPattern(
-  funcPattern: DangerousFunctionPattern,
-  line: string,
-  content: string,
-  index: number,
-  filePath: string,
-  isTestFile: boolean,
-  vulnerabilities: Vulnerability[],
-  lines?: string[]
-): void {
-  // 1. os.system is always dangerous - no safe usage
-  if (/os\.system\s*\(/i.test(line)) {
-    handleStandardPattern(funcPattern, line, index, filePath, isTestFile, vulnerabilities)
-    return
-  }
-  const _lines = lines ?? content.split('\n')
-  // Extract the full multi-line call block (up to 10 lines forward)
-  const callBlock = extractPythonCallBlock(_lines, index)
-  // 2. Check for shell=True across the entire call block
-  const hasShellTrue = /shell\s*=\s*True/i.test(callBlock)
-  if (hasShellTrue) {
-    handleStandardPattern(funcPattern, line, index, filePath, isTestFile, vulnerabilities)
-    return
-  }
-  // 3. Check for inline list args in the call block (not just same line)
-  const inlineListMatch = callBlock.match(
-    /subprocess\.(run|call|check_output|Popen)\s*\(\s*\[([\s\S]*?)\]/i
-  )
-  if (inlineListMatch) {
-    const listContent = '[' + inlineListMatch[2] + ']'
-    if (isPythonListAllStatic(listContent)) {
-      // 3a. All static string literals → SKIP (safe)
-      return
-    }
-    // 3b. Has f-strings or variables → LOW (list args prevent shell injection)
-    vulnerabilities.push({
-      id: `dangerous-func-${filePath}-${index + 1}-${funcPattern.name}`,
-      filePath,
-      lineNumber: index + 1,
-      lineContent: line.trim(),
-      severity: isTestFile ? 'info' : 'low',
-      category: 'dangerous_function',
-      title: funcPattern.name + ' (list args)',
-      description:
-        'subprocess with list arguments (safer than shell=True). Some arguments contain variables or f-strings — verify they are validated.',
-      suggestedFix: 'Ensure dynamic arguments are validated and sanitized.',
-      confidence: 'low',
-      baseConfidence: BASE_CONFIDENCE,
-      layer: 2,
-      source: 'structural' as const,    })
-    return
-  }
-  // 4. Check for variable reference as first arg
-  // Pattern: subprocess.run(args, ...) or subprocess.check_output(cmd, ...)
-  const varArgMatch = callBlock.match(
-    /subprocess\.(run|call|check_output|Popen)\s*\(\s*([a-zA-Z_]\w*)\s*[,)]/i
-  )
-  if (varArgMatch) {
-    const varName = varArgMatch[2]
-    // Look backwards up to 15 lines for assignment: varName = [...]
-    const searchStart = Math.max(0, index - 15)
-    const previousLines = _lines.slice(searchStart, index + 1).join('\n')
-    // Match varName = [...] assignment (possibly multi-line)
-    const assignmentPattern = new RegExp(
-      varName + '\\s*=\\s*\\[([\\s\\S]*?)\\]',
-      'i'
-    )
-    const assignmentMatch = previousLines.match(assignmentPattern)
-    if (assignmentMatch) {
-      const listContent = '[' + assignmentMatch[1] + ']'
-      if (isPythonListAllStatic(listContent)) {
-        // 4a. Variable resolves to all-static list → SKIP
-        return
-      }
-      // 4b. Variable resolves to list with dynamic elements → LOW
-      vulnerabilities.push({
-        id: `dangerous-func-${filePath}-${index + 1}-${funcPattern.name}`,
-        filePath,
-        lineNumber: index + 1,
-        lineContent: line.trim(),
-        severity: isTestFile ? 'info' : 'low',
-        category: 'dangerous_function',
-        title: funcPattern.name + ' (list args via variable)',
-        description:
-          `subprocess called with variable '${varName}' which resolves to a list. List arguments prevent shell injection, but some elements are dynamic.`,
-        suggestedFix: 'Ensure dynamic list elements are validated and sanitized.',
-        confidence: 'low',
-        baseConfidence: BASE_CONFIDENCE,
-        layer: 2,
-      source: 'structural' as const,      })
-      return
-    }
-    // 4c. Can't resolve the variable — flag for review at LOW
-    vulnerabilities.push({
-      id: `dangerous-func-${filePath}-${index + 1}-${funcPattern.name}`,
-      filePath,
-      lineNumber: index + 1,
-      lineContent: line.trim(),
-      severity: isTestFile ? 'info' : 'low',
-      category: 'dangerous_function',
-      title: funcPattern.name + ' (unresolved variable)',
-      description:
-        `subprocess called with variable '${varName}' — could not resolve its value nearby. If it is a list, shell injection risk is low.`,
-      suggestedFix: 'Verify the variable is a list (not a string) and arguments are validated.',
-      confidence: 'low',
-      baseConfidence: BASE_CONFIDENCE,
-      layer: 2,
-      source: 'structural' as const,    })
-    return
-  }
-  // 5. f-string as direct arg (not inside a list) → HIGH (command injection)
-  const hasFStringDirectArg = /subprocess\.(run|call|check_output|Popen)\s*\(\s*f['"`]/i.test(callBlock)
-  if (hasFStringDirectArg) {
-    handleStandardPattern(funcPattern, line, index, filePath, isTestFile, vulnerabilities)
-    return
-  }
-  // 6. Everything else → HIGH (fallback)
-  handleStandardPattern(funcPattern, line, index, filePath, isTestFile, vulnerabilities)
-}
-/**
- * Handle regex patterns - check for escaped input
- * Pattern: new RegExp(escapedInput) or new RegExp(input.replaceAll(...escaped...))
- */
-function handleRegexPattern(
-  funcPattern: DangerousFunctionPattern,
-  line: string,
-  content: string,
-  index: number,
-  filePath: string,
-  isTestFile: boolean,
-  vulnerabilities: Vulnerability[],
-  lines?: string[]
-): void {
-  const _lines = lines ?? content.split('\n')
-  const contextStart = Math.max(0, index - 15)
-  const contextEnd = Math.min(_lines.length, index + 3)
-  const context = _lines.slice(contextStart, contextEnd).join('\n')
-  // Check for RegExp object property access (.source, .flags)
-  // This indicates input is already a validated RegExp, not user string
-  // e.g., new RegExp(existingRegex.source, existingRegex.flags)
-  const isRegExpFromRegExp = /\.source\s*[,)\s]/.test(line)
-  if (isRegExpFromRegExp) {
-    return // Safe - .source only exists on RegExp objects (already validated)
-  }
-  // Check for escaping ON THE SAME LINE as new RegExp() - this is a strong signal
-  const sameLineEscapingPatterns = [
-    /\.replaceAll\s*\([^)]*\)\s*[,)]/i,  // .replaceAll(...)) - escaping before RegExp
-    /escape\w*\s*\([^)]*\)\s*[,)]/i,     // escapeRegExp(input)) - function result used
-    /\.replace\s*\([^,]+,[^)]+\)\s*[,)]/i, // .replace(..., ...) followed by closing
-  ]
-  if (sameLineEscapingPatterns.some(p => p.test(line))) {
-    return // Safe - escaping applied on same line before RegExp construction
-  }
-  // Check previous 5 lines for escaping assignment (extended from 3 to catch multi-line patterns)
-  const prevLinesStart = Math.max(0, index - 5)
-  const prevLines = _lines.slice(prevLinesStart, index + 1).join('\n')
-  // Check for escaping patterns before new RegExp
-  const escapingPatterns = [
-    // Direct escaping function calls
-    /escapeRegExp\s*\(/i,                          // escapeRegExp(input)
-    /escapeString\s*\(/i,                          // escapeString(input)
-    /escape\s*\(\s*pattern/i,                      // escape(pattern)
-    /escapeForRegex\s*\(/i,                        // escapeForRegex(input)
-    /regexEscape\s*\(/i,                           // regexEscape(input)
-    // replaceAll with regex escape pattern - original strict patterns
-    /\.replaceAll\s*\(\s*\/\[.*\\\\\]\s*\/[gi]*\s*,\s*['"`]\\\\?\$&['"`]\s*\)/,  // .replaceAll(/[special]/g, '\\$&')
-    /\.replace\s*\(\s*\/\[.*\\\\\]\s*\/[gi]*\s*,\s*['"`]\\\\?\$&['"`]\s*\)/,     // .replace(/[special]/g, '\\$&')
-    // More permissive $& replacement detection (the escape marker)
-    // $& is the regex replacement marker that inserts the matched string - used for escaping
-    /\.replace(?:All)?[\s\S]*?['"`]\\*\$&['"`]/,       // .replace/.replaceAll with $& anywhere in call
-    /\.replaceAll?[^;]*\$&/,                           // .replace/.replaceAll until semicolon with $&
-    // Lodash/underscore escapeRegExp
-    /_\.escapeRegExp\s*\(/,                        // _.escapeRegExp(input)
-    /lodash.*escapeRegExp/i,                       // lodash.escapeRegExp
-    // Variable assignment with escaping (check previous lines)
-    /escaped\w*\s*=.*\.replace/i,                  // escapedInput = input.replace(...)
-    /safe\w*\s*=.*escape/i,                        // safePattern = escapeRegExp(...)
-  ]
-  // Check both previous lines and full context
-  const hasEscaping = escapingPatterns.some(p => p.test(line) || p.test(prevLines) || p.test(context))
-  // Check for try-catch wrapping (ReDoS contained)
-  const hasTryCatch =
-    /try\s*\{[^}]*new\s+RegExp/i.test(context) ||
-    (context.includes('try {') && _lines.slice(Math.max(0, index - 5), index + 1).some(l => /try\s*\{/.test(l)))
-  // Check for configuration-based patterns (trusted input)
-  const isConfigBased =
-    /config\./i.test(line) ||
-    /settings\./i.test(line) ||
-    /rules\./i.test(line) ||
-    /options\.\w+Pattern/i.test(line) ||
-    /urlPattern/i.test(line) ||
-    /routePattern/i.test(line)
-  // Escaped input is safe - skip entirely
-  if (hasEscaping) {
-    return
-  }
-  // Config-based patterns are trusted - skip
-  if (isConfigBased) {
-    return
-  }
-  // Check if regex source is an object property (app-controlled data, not user input)
-  // Patterns: obj.pattern, item.regex, l.urlRegExp, entry.matchPattern
-  const objectPropertySource = /new\s+RegExp\s*\(\s*\w+\.\w*(regex|pattern|regexp|match|rule|expression|filter)\w*/i.test(line)
-  if (objectPropertySource) {
-    vulnerabilities.push({
-      id: `dangerous-func-${filePath}-${index + 1}-${funcPattern.name}`,
-      filePath,
-      lineNumber: index + 1,
-      lineContent: line.trim(),
-      severity: 'info',
-      category: 'dangerous_function',
-      title: funcPattern.name + ' (app-controlled)',
-      description: 'Dynamic regex from object property. If the regex source is app-defined (not user input), ReDoS risk is minimal.',
-      suggestedFix: 'Ensure regex patterns come from trusted, validated sources.',
-      confidence: 'low',
-      baseConfidence: BASE_CONFIDENCE,
-      layer: 2,
-      source: 'structural' as const,    })
-    return
-  }
-  // Check if regex source is from array iteration over app data
-  // Pattern: for (const item of items) { new RegExp(item.xxx) }
-  const isArrayIterationContext = /for\s*\(\s*(const|let|var)\s+\w+\s+(of|in)\s+/.test(context) &&
-    /new\s+RegExp\s*\(\s*\w+\./.test(line)
-  if (isArrayIterationContext) {
-    vulnerabilities.push({
-      id: `dangerous-func-${filePath}-${index + 1}-${funcPattern.name}`,
-      filePath,
-      lineNumber: index + 1,
-      lineContent: line.trim(),
-      severity: 'info',
-      category: 'dangerous_function',
-      title: funcPattern.name + ' (iteration)',
-      description: 'Dynamic regex in array iteration. If iterating over app-defined data, ReDoS risk is minimal.',
-      suggestedFix: 'Ensure regex patterns come from trusted sources, not user input.',
-      confidence: 'low',
-      baseConfidence: BASE_CONFIDENCE,
-      layer: 2,
-      source: 'structural' as const,    })
-    return
-  }
-  // Try-catch wrapped - lower severity (ReDoS contained)
-  if (hasTryCatch) {
-    vulnerabilities.push({
-      id: `dangerous-func-${filePath}-${index + 1}-${funcPattern.name}`,
-      filePath,
-      lineNumber: index + 1,
-      lineContent: line.trim(),
-      severity: 'info',
-      category: 'dangerous_function',
-      title: funcPattern.name + ' (try-catch wrapped)',
-      description:
-        'Dynamic regex with try-catch error handling. ReDoS attacks are contained but may still cause performance issues.',
-      suggestedFix: 'Consider using safe-regex library or adding timeout for regex operations.',
-      confidence: 'low',
-      baseConfidence: BASE_CONFIDENCE,
-      layer: 2,
-      source: 'structural' as const,    })
-    return
-  }
-  // Standard handling for unprotected regex
-  handleStandardPattern(funcPattern, line, index, filePath, isTestFile, vulnerabilities)
-}
-/**
- * Handle spread operator with user input patterns
- * Checks for schema validation (Fastify, Zod, tRPC) that strips unknown properties
- */
-function handleSpreadPattern(
-  funcPattern: DangerousFunctionPattern,
-  line: string,
-  content: string,
-  index: number,
-  filePath: string,
-  isTestFile: boolean,
-  vulnerabilities: Vulnerability[],
-  lines?: string[]
-): void {
-  const _lines = lines ?? content.split('\n')
-  const contextStart = Math.max(0, index - 30)
-  const contextEnd = index
-  const context = _lines.slice(contextStart, contextEnd).join('\n')
-  // Fastify/Hapi schema validation on route - body is pre-validated
-  // Pattern: schema: { body: someSchema } before handler
-  const hasRouteSchemaValidation =
-    /schema\s*:\s*\{[^}]*body\s*:\s*\w+/i.test(context) ||
-    /body\s*:\s*\w+Schema/i.test(context)
-  // Express + Zod/Joi/Yup middleware validation
-  const hasMiddlewareValidation =
-    /validate\s*\(\s*\w+Schema\s*\)/i.test(context) ||
-    /\.parse\s*\(\s*req\.body\s*\)/i.test(context) ||
-    /celebrate\s*\(/i.test(context)
-  // tRPC input validation
-  const hasTRPCValidation =
-    /\.input\s*\(\s*z\./i.test(context) ||
-    /\.input\s*\(\s*\w+Schema\s*\)/i.test(context)
-  if (hasRouteSchemaValidation || hasMiddlewareValidation || hasTRPCValidation) {
-    vulnerabilities.push({
-      id: `dangerous-func-${filePath}-${index + 1}-${funcPattern.name}`,
-      filePath,
-      lineNumber: index + 1,
-      lineContent: line.trim(),
-      severity: 'info',
-      category: 'dangerous_function',
-      title: funcPattern.name + ' (schema-validated)',
-      description: 'Request body is spread but has schema validation. Schema validation strips unknown properties, reducing mass assignment risk.',
-      suggestedFix: 'Ensure schema validation is strict (no .passthrough() in Zod, no additionalProperties in JSON Schema).',
-      confidence: 'low',
-      baseConfidence: BASE_CONFIDENCE,
-      layer: 2,
-      source: 'structural' as const,    })
-    return
-  }
-  // No schema validation - standard handling
-  handleStandardPattern(funcPattern, line, index, filePath, isTestFile, vulnerabilities)
-}
-/**
- * Handle standard patterns without special logic
- */
-function handleStandardPattern(
-  funcPattern: DangerousFunctionPattern,
-  line: string,
-  index: number,
-  filePath: string,
-  isTestFile: boolean,
-  vulnerabilities: Vulnerability[]
-): void {
-  let severity = funcPattern.severity
-  let confidence: 'high' | 'medium' | 'low' = 'high'
-  if (isTestFile) {
-    if (severity === 'critical') {
-      severity = 'medium'
-    } else if (severity === 'high') {
-      severity = 'low'
-    } else {
-      severity = 'info'
-    }
-    confidence = 'low'
-  }
-  vulnerabilities.push({
-    id: `dangerous-func-${filePath}-${index + 1}-${funcPattern.name}`,
-    filePath,
-    lineNumber: index + 1,
-    lineContent: line.trim(),
-    severity,
-    category: 'dangerous_function',
-    title: funcPattern.name,
-    description: funcPattern.description + (isTestFile ? ' (in test file)' : ''),
-    suggestedFix: funcPattern.suggestedFix,
-    confidence,
-    baseConfidence: BASE_CONFIDENCE,
-    layer: 2,
-      source: 'structural' as const,  })
-}