@opensip-cli/checks-universal 0.1.0

package/dist/checks/security/rate-limit-coverage.js

@@ -0,0 +1,143 @@
+/**
+ * @fileoverview Validate routes have rate limiting configured
+ */
+import { logger } from '@opensip-cli/core';
+import { defineCheck } from '@opensip-cli/fitness';
+import { stripStringLiterals, stripStringsAndComments } from '@opensip-cli/fitness';
+/**
+ * Pre-compiled regex patterns for rate limit detection.
+ * These patterns match fixed, bounded strings with no user input - safe from ReDoS.
+ */
+const RATE_LIMIT_REGEX = new RegExp('rateLimit|rateLimiter|preHandler.*rateLimit|onRequest.*rateLimit', 'i');
+const INTERNAL_ROUTE_REGEX = new RegExp('/health|/metrics|/ready|/live|internal', 'i');
+const FASTIFY_ROUTE_REGEX = new RegExp('fastify\\.(get|post|put|patch|delete)\\s*\\(\\s*[\'"`]/api[^\'"`]*[\'"`]', 'gi');
+const EXPRESS_ROUTE_REGEX = new RegExp('(?:app|router)\\.(get|post|put|patch|delete)\\s*\\(\\s*[\'"`]/api[^\'"`]*[\'"`]', 'gi');
+const SENSITIVE_ENDPOINT_REGEX = new RegExp('\\.(post|put)\\s*\\(\\s*[\'"`][^\'"`]*(?:login|signin|signup|register|password|reset|auth|token)[^\'"`]*[\'"`]', 'gi');
+const GLOBAL_RATE_LIMIT_REGISTER_REGEX = new RegExp(String.raw `register\s*\(\s*(?:rateLimit|rateLimiter)`, 'i');
+const GLOBAL_RATE_LIMIT_USE_REGEX = new RegExp(String.raw `use\s*\(\s*(?:rateLimit|rateLimiter)`, 'i');
+const FRAMEWORK_DETECT_REGEX = /(?:fastify|app|router)\.(get|post|put|patch|delete)\s*\(/i;
+/**
+ * Check if context has rate limiting
+ * @param context - The code context to check
+ * @returns True if rate limiting is present
+ */
+function hasRateLimiting(context) {
+    logger.debug({
+        evt: 'fitness.checks.rate_limit_coverage.has_rate_limiting',
+        msg: 'Checking if context has rate limiting',
+    });
+    return RATE_LIMIT_REGEX.test(context);
+}
+/**
+ * Check if route is internal (health, metrics, etc.)
+ * @param context - The code context to check
+ * @returns True if the route is internal
+ */
+function isInternalRoute(context) {
+    logger.debug({
+        evt: 'fitness.checks.rate_limit_coverage.is_internal_route',
+        msg: 'Checking if route is internal',
+    });
+    return INTERNAL_ROUTE_REGEX.test(context);
+}
+// Patterns that indicate route definitions needing rate limiting
+const ROUTE_PATTERNS = [
+    // Fastify routes
+    {
+        regex: FASTIFY_ROUTE_REGEX,
+        check: (context) => !hasRateLimiting(context) && !isInternalRoute(context),
+        message: 'API route may be missing rate limiting configuration',
+        suggestion: 'Add rate limiting middleware: fastify.register(rateLimiter, { max: 100, timeWindow: "1 minute" }). Apply per-route or globally.',
+        severity: 'warning',
+    },
+    // Express routes
+    {
+        regex: EXPRESS_ROUTE_REGEX,
+        check: (context) => !hasRateLimiting(context) && !isInternalRoute(context),
+        message: 'API route may be missing rate limiting configuration',
+        suggestion: 'Add rate limiting middleware: app.use(rateLimiter({ max: 100, windowMs: 60000 })). Apply per-route or globally.',
+        severity: 'warning',
+    },
+    // Sensitive endpoints that must have rate limiting
+    {
+        regex: SENSITIVE_ENDPOINT_REGEX,
+        check: (context) => !hasRateLimiting(context),
+        message: 'Sensitive authentication endpoint should have rate limiting',
+        suggestion: 'Authentication endpoints must have strict rate limiting to prevent brute force attacks. Apply a limit of ~5-10 requests per minute for login/password endpoints.',
+        severity: 'error',
+    },
+];
+/**
+ * Check: security/rate-limit-coverage
+ *
+ * Validates that routes have rate limiting configured.
+ */
+export const rateLimitCoverage = defineCheck({
+    id: '19382a02-5d84-4316-b0a3-906f4acd7061',
+    slug: 'rate-limit-coverage',
+    disabled: true,
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    contentFilter: 'strip-strings',
+    confidence: 'medium',
+    description: 'Validate routes have rate limiting configured',
+    longDescription: `**Purpose:** Ensures API routes have rate limiting configured to prevent abuse, with stricter enforcement on authentication endpoints.
+
+**Detects:**
+- Fastify routes (\`fastify.get/post/put/patch/delete('/api/...')\`) without rateLimit/rateLimiter in the surrounding context (next 8 lines)
+- Express routes (\`app/router.get/post/put/patch/delete('/api/...')\`) without rate limiting
+- Sensitive authentication endpoints (\`.post/.put\` with login, signin, signup, register, password, reset, auth, or token in path) missing rate limiting (elevated to error severity)
+
+**Why it matters:** Without rate limiting, APIs are vulnerable to brute-force attacks, credential stuffing, and denial-of-service. Authentication endpoints are especially critical targets.
+
+**Scope:** General best practice. Analyzes each file individually. Skips files with global rate limiting (\`register(rateLimit)\` or \`use(rateLimit)\`).`,
+    tags: ['security', 'rate-limiting', 'api'],
+    fileTypes: ['ts'],
+    analyze(content, filePath) {
+        logger.debug({
+            evt: 'fitness.checks.rate_limit_coverage.analyze',
+            msg: 'Analyzing file for rate limit coverage',
+        });
+        // Only check files that might define routes
+        if (!FRAMEWORK_DETECT_REGEX.test(stripStringsAndComments(content))) {
+            return [];
+        }
+        // Check if file has global rate limiting applied
+        const hasGlobalRateLimit = GLOBAL_RATE_LIMIT_REGISTER_REGEX.test(content) || GLOBAL_RATE_LIMIT_USE_REGEX.test(content);
+        // If global rate limiting is applied, skip detailed checking
+        if (hasGlobalRateLimit) {
+            return [];
+        }
+        const violations = [];
+        const lines = content.split('\n');
+        for (let lineNum = 0; lineNum < lines.length; lineNum++) {
+            const line = lines[lineNum] ?? '';
+            // Get context (current line + next few lines)
+            const context = lines.slice(lineNum, lineNum + 8).join(' ');
+            // Skip comments
+            const trimmed = line.trim();
+            if (trimmed.startsWith('//') || trimmed.startsWith('*')) {
+                continue;
+            }
+            const strippedLine = stripStringLiterals(line);
+            const strippedContext = stripStringLiterals(context);
+            for (const pattern of ROUTE_PATTERNS) {
+                // Reset regex state
+                pattern.regex.lastIndex = 0;
+                const match = pattern.regex.exec(strippedLine);
+                if (match && pattern.check(strippedContext)) {
+                    violations.push({
+                        line: lineNum + 1,
+                        column: match.index,
+                        message: pattern.message,
+                        severity: pattern.severity,
+                        suggestion: pattern.suggestion,
+                        match: match[0],
+                        filePath,
+                    });
+                }
+            }
+        }
+        return violations;
+    },
+});
+//# sourceMappingURL=rate-limit-coverage.js.map

package/dist/checks/security/rate-limit-coverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-coverage.js","sourceRoot":"","sources":["../../../src/checks/security/rate-limit-coverage.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAuB,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAEpF;;;GAGG;AACH,MAAM,gBAAgB,GAAG,IAAI,MAAM,CACjC,kEAAkE,EAClE,GAAG,CACJ,CAAC;AACF,MAAM,oBAAoB,GAAG,IAAI,MAAM,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;AACvF,MAAM,mBAAmB,GAAG,IAAI,MAAM,CACpC,0EAA0E,EAC1E,IAAI,CACL,CAAC;AACF,MAAM,mBAAmB,GAAG,IAAI,MAAM,CACpC,iFAAiF,EACjF,IAAI,CACL,CAAC;AACF,MAAM,wBAAwB,GAAG,IAAI,MAAM,CACzC,gHAAgH,EAChH,IAAI,CACL,CAAC;AACF,MAAM,gCAAgC,GAAG,IAAI,MAAM,CACjD,MAAM,CAAC,GAAG,CAAA,2CAA2C,EACrD,GAAG,CACJ,CAAC;AACF,MAAM,2BAA2B,GAAG,IAAI,MAAM,CAC5C,MAAM,CAAC,GAAG,CAAA,sCAAsC,EAChD,GAAG,CACJ,CAAC;AACF,MAAM,sBAAsB,GAAG,2DAA2D,CAAC;AAE3F;;;;GAIG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,sDAAsD;QAC3D,GAAG,EAAE,uCAAuC;KAC7C,CAAC,CAAC;IACH,OAAO,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,sDAAsD;QAC3D,GAAG,EAAE,+BAA+B;KACrC,CAAC,CAAC;IACH,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED,iEAAiE;AACjE,MAAM,cAAc,GAAG;IACrB,iBAAiB;IACjB;QACE,KAAK,EAAE,mBAAmB;QAC1B,KAAK,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;QAClF,OAAO,EAAE,sDAAsD;QAC/D,UAAU,EACR,iIAAiI;QACnI,QAAQ,EAAE,SAAkB;KAC7B;IACD,iBAAiB;IACjB;QACE,KAAK,EAAE,mBAAmB;QAC1B,KAAK,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;QAClF,OAAO,EAAE,sDAAsD;QAC/D,UAAU,EACR,iHAAiH;QACnH,QAAQ,EAAE,SAAkB;KAC7B;IACD,mDAAmD;IACnD;QACE,KAAK,EAAE,wBAAwB;QAC/B,KAAK,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC;QACrD,OAAO,EAAE,6DAA6D;QACtE,UAAU,EACR,kKAAkK;QACpK,QAAQ,EAAE,OAAgB;KAC3B;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;IAC3C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,qBAAqB;IAC3B,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,aAAa,EAAE,eAAe;IAE9B,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,+CAA+C;IAC5D,eAAe,EAAE;;;;;;;;;0JASuI;IACxJ,IAAI,EAAE,CAAC,UAAU,EAAE,eAAe,EAAE,KAAK,CAAC;IAC1C,SAAS,EAAE,CAAC,IAAI,CAAC;IAEjB,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,MAAM,CAAC,KAAK,CAAC;YACX,GAAG,EAAE,4CAA4C;YACjD,GAAG,EAAE,wCAAwC;SAC9C,CAAC,CAAC;QACH,4CAA4C;QAC5C,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,iDAAiD;QACjD,MAAM,kBAAkB,GACtB,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE9F,6DAA6D;QAC7D,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,UAAU,GAAqB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAElC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAElC,8CAA8C;YAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAE5D,gBAAgB;YAChB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxD,SAAS;YACX,CAAC;YAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,eAAe,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAErD,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;gBACrC,oBAAoB;gBACpB,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;gBAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC/C,IAAI,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;oBAC5C,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,OAAO,GAAG,CAAC;wBACjB,MAAM,EAAE,KAAK,CAAC,KAAK;wBACnB,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;wBAC9B,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;wBACf,QAAQ;qBACT,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/security/semgrep-scan.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @fileoverview Semgrep static analysis security scan
+ *
+ * Runs Semgrep with auto config to detect security vulnerabilities,
+ * code injection, and other issues across all supported languages.
+ */
+/**
+ * Check: security/semgrep-scan
+ *
+ * Runs Semgrep static analysis with curated security rules.
+ */
+export declare const semgrepScan: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=semgrep-scan.d.ts.map

package/dist/checks/security/semgrep-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semgrep-scan.d.ts","sourceRoot":"","sources":["../../../src/checks/security/semgrep-scan.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AA4FH;;;;GAIG;AACH,eAAO,MAAM,WAAW,sCA6BtB,CAAC"}

package/dist/checks/security/semgrep-scan.js

@@ -0,0 +1,86 @@
+// @fitness-ignore-file batch-operation-limits -- reviewed: pattern is architecturally justified or false positive
+/**
+ * @fileoverview Semgrep static analysis security scan
+ *
+ * Runs Semgrep with auto config to detect security vulnerabilities,
+ * code injection, and other issues across all supported languages.
+ */
+import * as path from 'node:path';
+import { defineCheck } from '@opensip-cli/fitness';
+// =============================================================================
+// SEVERITY MAPPING
+// =============================================================================
+/* v8 ignore start -- semgrep parsing helpers exercised via integration tests (requires semgrep CLI) */
+function mapSeverity(semgrepSeverity) {
+    return semgrepSeverity === 'ERROR' ? 'error' : 'warning';
+}
+// =============================================================================
+// OUTPUT PARSING
+// =============================================================================
+function parseSemgrepOutput(stdout, _stderr, _exitCode, _files, cwd) {
+    if (!stdout.trim())
+        return [];
+    let output;
+    try {
+        output = JSON.parse(stdout);
+    }
+    catch {
+        // @swallow-ok Non-JSON output from semgrep (e.g. login prompts, version warnings)
+        return [];
+    }
+    const violations = [];
+    for (const result of output.results) {
+        const meta = result.extra.metadata;
+        const cwe = meta?.cwe?.[0] ?? '';
+        const prefix = cwe ? `[${cwe.split(':')[0]}] ` : '';
+        violations.push({
+            filePath: path.isAbsolute(result.path) ? result.path : path.join(cwd, result.path),
+            line: result.start.line,
+            column: result.start.col,
+            message: `${prefix}${result.extra.message}`,
+            severity: mapSeverity(result.extra.severity),
+            suggestion: `Fix semgrep finding: ${result.check_id}`,
+            type: result.check_id,
+            match: result.check_id,
+        });
+    }
+    return violations;
+}
+/* v8 ignore stop */
+// =============================================================================
+// CHECK DEFINITION
+// =============================================================================
+/**
+ * Check: security/semgrep-scan
+ *
+ * Runs Semgrep static analysis with curated security rules.
+ */
+export const semgrepScan = defineCheck({
+    id: 'b8e2f4a1-6c3d-4e5f-9a1b-7d8c2e3f4a5b',
+    slug: 'semgrep-scan',
+    scope: { languages: ['typescript'], concerns: ['backend', 'frontend', 'cli'] },
+    confidence: 'high',
+    description: 'Run Semgrep static analysis to detect security vulnerabilities',
+    longDescription: `**Purpose:** Runs Semgrep with \`--config auto\` to detect security vulnerabilities, injection flaws, and dangerous code patterns across the codebase.
+
+**Detects:**
+- Code injection (eval, template injection)
+- SQL injection and command injection
+- Insecure cryptographic usage
+- Path traversal and SSRF
+- Hardcoded secrets and credentials
+- OWASP Top 10 vulnerability patterns
+
+**Why it matters:** Semgrep performs AST-aware pattern matching that catches vulnerabilities regex-based tools miss. The \`auto\` config uses Semgrep's curated registry of security rules maintained by the community and Semgrep team.
+
+**Requires:** \`semgrep\` CLI installed (\`pip install semgrep\` or \`brew install semgrep\`). 5-minute timeout for large codebases.`,
+    tags: ['security', 'static-analysis', 'vulnerability', 'owasp'],
+    timeout: 300_000, // 5 minutes — semgrep auto downloads rules on first run
+    command: {
+        bin: 'semgrep',
+        args: ['scan', '--json', '--config', 'auto', '--quiet', '.'],
+        expectedExitCodes: [0, 1], // 0 = clean, 1 = findings
+        parseOutput: parseSemgrepOutput,
+    },
+});
+//# sourceMappingURL=semgrep-scan.js.map

package/dist/checks/security/semgrep-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semgrep-scan.js","sourceRoot":"","sources":["../../../src/checks/security/semgrep-scan.ts"],"names":[],"mappings":"AAAA,kHAAkH;AAClH;;;;;GAKG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,WAAW,EAAuB,MAAM,sBAAsB,CAAC;AA+BxE,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF,uGAAuG;AACvG,SAAS,WAAW,CAAC,eAAuB;IAC1C,OAAO,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,SAAS,kBAAkB,CACzB,MAAc,EACd,OAAe,EACf,SAAiB,EACjB,MAAyB,EACzB,GAAW;IAEX,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAE9B,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAkB,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,kFAAkF;QAClF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,UAAU,GAAqB,EAAE,CAAC;IAExC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAEpD,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC;YAClF,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;YACvB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG;YACxB,OAAO,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;YAC3C,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC5C,UAAU,EAAE,wBAAwB,MAAM,CAAC,QAAQ,EAAE;YACrD,IAAI,EAAE,MAAM,CAAC,QAAQ;YACrB,KAAK,EAAE,MAAM,CAAC,QAAQ;SACvB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AACD,oBAAoB;AAEpB,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC;IACrC,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,cAAc;IACpB,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE;IAE9E,UAAU,EAAE,MAAM;IAClB,WAAW,EAAE,gEAAgE;IAC7E,eAAe,EAAE;;;;;;;;;;;;qIAYkH;IACnI,IAAI,EAAE,CAAC,UAAU,EAAE,iBAAiB,EAAE,eAAe,EAAE,OAAO,CAAC;IAC/D,OAAO,EAAE,OAAO,EAAE,wDAAwD;IAE1E,OAAO,EAAE;QACP,GAAG,EAAE,SAAS;QACd,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC;QAC5D,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,0BAA0B;QACrD,WAAW,EAAE,kBAAkB;KAChC;CACF,CAAC,CAAC"}

package/dist/checks/security/use-centralized-crypto.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @fileoverview Enforce use of centralized crypto module
+ */
+/**
+ * Check: security/use-centralized-crypto
+ *
+ * Enforces that services use a centralized crypto utility instead of directly
+ * using Node.js crypto, AWS KMS SDK, or other crypto libraries.
+ */
+export declare const useCentralizedCrypto: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=use-centralized-crypto.d.ts.map

package/dist/checks/security/use-centralized-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-centralized-crypto.d.ts","sourceRoot":"","sources":["../../../src/checks/security/use-centralized-crypto.ts"],"names":[],"mappings":"AACA;;GAEG;AA8KH;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,sCA8D/B,CAAC"}

package/dist/checks/security/use-centralized-crypto.js

@@ -0,0 +1,129 @@
+// @fitness-ignore-file batch-operation-limits -- iterates bounded collections (config entries, registry items, or small analysis results)
+/**
+ * @fileoverview Enforce use of centralized crypto module
+ */
+import { logger } from '@opensip-cli/core';
+import { createPathMatcher, defineCheck, isCommentLine, } from '@opensip-cli/fitness';
+/**
+ * Creates a crypto pattern with standard RegExp
+ * Using RegExp constructor avoids sonarjs/regular-expr warnings on literal regex
+ * @param pattern - Pattern string to match
+ * @param message - Error message to display
+ * @param suggestion - Suggested fix
+ * @param severity - Severity level
+ * @returns Pattern configuration object
+ */
+function createCryptoPattern(pattern, message, suggestion, severity) {
+    // @fitness-ignore-next-line semgrep-scan -- non-literal RegExp is intentional; patterns are hardcoded string constants for code analysis, not user input
+    return { regex: new RegExp(pattern, 'g'), message, suggestion, severity };
+}
+// Patterns indicating direct crypto usage
+const DIRECT_CRYPTO_PATTERNS = [
+    // Node.js crypto module - symmetric/hashing
+    createCryptoPattern(String.raw `crypto\.createHash\s*\(`, 'Direct crypto.createHash usage - use hashingService.sha256() from crypto module', 'Use a centralized crypto utility instead of direct crypto.createHash calls.', 'error'),
+    createCryptoPattern(String.raw `crypto\.createHmac\s*\(`, 'Direct crypto.createHmac usage - use hashingService.hmac() from crypto module', 'Use a centralized crypto utility instead of direct crypto.createHmac calls.', 'error'),
+    createCryptoPattern(String.raw `crypto\.createCipheriv\s*\(`, 'Direct crypto.createCipheriv usage - use encryptionService.encrypt() from crypto module', 'Use a centralized crypto utility for encryption instead of direct crypto.createCipheriv calls.', 'error'),
+    createCryptoPattern(String.raw `crypto\.createDecipheriv\s*\(`, 'Direct crypto.createDecipheriv usage - use encryptionService.decrypt() from crypto module', 'Use a centralized crypto utility for decryption instead of direct crypto.createDecipheriv calls.', 'error'),
+    createCryptoPattern(String.raw `crypto\.pbkdf2(?:Sync)?\s*\(`, 'Direct crypto.pbkdf2 usage - use deriveKeyPbkdf2() from crypto module', 'Use a centralized crypto utility for key derivation instead of direct crypto.pbkdf2 calls.', 'error'),
+    createCryptoPattern(String.raw `crypto\.scrypt(?:Sync)?\s*\(`, 'Direct crypto.scrypt usage - use deriveKeyScrypt() from crypto module', 'Use a centralized crypto utility for key derivation instead of direct crypto.scrypt calls.', 'error'),
+    // Node.js crypto module - asymmetric signing
+    createCryptoPattern(String.raw `crypto\.createSign\s*\(`, 'Direct crypto.createSign usage - use signingService.sign() from crypto module', 'Use a centralized crypto utility for signing instead of direct crypto.createSign calls.', 'error'),
+    // @fitness-ignore-next-line jwt-validation -- Fitness check definition, not production code; .verify() in suggestion text
+    createCryptoPattern(String.raw `crypto\.createVerify\s*\(`, 'Direct crypto.createVerify usage - use signingService.verify() from crypto module', 'Use a centralized crypto utility for signature verification instead of direct crypto.createVerify calls.', 'error'),
+    createCryptoPattern(String.raw `crypto\.sign\s*\(`, 'Direct crypto.sign usage - use signingService.sign() from crypto module', 'Use a centralized crypto utility for signing instead of direct crypto.sign calls.', 'error'),
+    // @fitness-ignore-next-line jwt-validation -- Fitness check definition, not production code; .verify() in suggestion text
+    createCryptoPattern(String.raw `crypto\.verify\s*\(`, 'Direct crypto.verify usage - use signingService.verify() from crypto module', 'Use a centralized crypto utility for signature verification instead of direct crypto.verify calls.', 'error'),
+    // Direct createHmac import usage
+    createCryptoPattern(String.raw `\bcreateHmac\s*\(\s*['"]sha256['"]`, 'Direct createHmac usage - use hashingService.hmac() from crypto module', 'Use a centralized crypto utility instead of direct createHmac calls.', 'error'),
+    // AWS KMS direct imports
+    createCryptoPattern('@aws-sdk/client-kms', 'Direct AWS KMS SDK import - use a centralized crypto utility with KMS provider', 'Use a centralized crypto utility that handles KMS integration for key management.', 'error'),
+    createCryptoPattern(String.raw `new KMSClient\s*\(`, 'Direct KMSClient usage - use a centralized crypto utility with KMS provider', 'Use a centralized crypto utility that handles KMS integration for key management.', 'error'),
+    // bcrypt/argon2 direct imports
+    createCryptoPattern('from [\'"]bcrypt[\'"]', 'Direct bcrypt import - use hashingService.hashPassword() from crypto module', 'Use a centralized crypto utility for password hashing instead of direct bcrypt calls.', 'error'),
+    createCryptoPattern('from [\'"]argon2[\'"]', 'Direct argon2 import - use hashingService.hashPassword() from crypto module', 'Use a centralized crypto utility for password hashing instead of direct argon2 calls.', 'error'),
+    // Direct jose imports (should use ISigningService wrapper)
+    createCryptoPattern('from [\'"]jose[\'"]', 'Direct jose import - use ISigningService from crypto module', 'Use a centralized crypto utility for JWT operations instead of direct jose imports.', 'warning'),
+    createCryptoPattern(String.raw `import\s+\*\s+as\s+jose\s+from`, 'Direct jose import - use ISigningService from crypto module', 'Use a centralized crypto utility for JWT operations instead of direct jose imports.', 'warning'),
+];
+// Paths to exclude from checking
+const CRYPTO_IMPL_PATTERNS = [
+    // The crypto module itself (matches /infrastructure/src/crypto/)
+    '/crypto/adapters/',
+    '/crypto/core/',
+    '/crypto/interfaces/',
+    '/crypto/types/',
+    // Foundation modules may use crypto primitives
+    '/foundation/',
+    // Security JWT module uses jose for JWT-specific operations
+    '/security/implementations/jwt/',
+    // Cognito provider uses jose for AWS Cognito-specific JWT validation
+    '/security/providers/cognito/',
+    // Webhook verifiers implement provider-specific signature algorithms
+    '/webhooks/verifiers/',
+    // Fitness check definitions contain pattern strings, not actual crypto usage
+    '/fitness/src/checks/',
+];
+const isExcludedCryptoPath = createPathMatcher(CRYPTO_IMPL_PATTERNS);
+/**
+ * Check: security/use-centralized-crypto
+ *
+ * Enforces that services use a centralized crypto utility instead of directly
+ * using Node.js crypto, AWS KMS SDK, or other crypto libraries.
+ */
+export const useCentralizedCrypto = defineCheck({
+    id: '38c350d5-1605-4d02-811c-c76261bcbba4',
+    slug: 'use-centralized-crypto',
+    disabled: true,
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    contentFilter: 'strip-strings',
+    confidence: 'medium',
+    description: 'Enforce use of centralized crypto module instead of direct crypto operations',
+    longDescription: `**Purpose:** Enforces that services use a centralized crypto utility instead of directly calling Node.js crypto, AWS KMS, or third-party crypto libraries.
+
+**Detects:**
+- Direct Node.js crypto calls: \`crypto.createHash\`, \`crypto.createHmac\`, \`crypto.createCipheriv\`, \`crypto.createDecipheriv\`, \`crypto.pbkdf2\`, \`crypto.scrypt\`, \`crypto.createSign\`, \`crypto.createVerify\`, \`crypto.sign\`, \`crypto.verify\`
+- Direct \`createHmac('sha256', ...)\` usage
+- AWS KMS direct imports: \`@aws-sdk/client-kms\`, \`new KMSClient()\`
+- Direct password hashing imports: \`from 'bcrypt'\`, \`from 'argon2'\`
+- Direct JOSE imports: \`from 'jose'\`, \`import * as jose\`
+
+**Why it matters:** Centralized crypto ensures consistent algorithm choices, key management, and makes it possible to audit or rotate cryptographic operations from a single location.
+
+**Scope:** Codebase-specific convention. Analyzes each file individually. Excludes the crypto module itself, foundation, security JWT, Cognito provider, webhook verifiers, and fitness check definitions.`,
+    tags: ['security', 'crypto', 'centralization', 'best-practices'],
+    fileTypes: ['ts'],
+    analyze(content, filePath) {
+        logger.debug({
+            evt: 'fitness.checks.centralized_crypto.analyze',
+            msg: 'Analyzing file for direct crypto usage',
+        });
+        if (isExcludedCryptoPath(filePath)) {
+            return [];
+        }
+        const violations = [];
+        const lines = content.split('\n');
+        for (const [lineNum, line_] of lines.entries()) {
+            const line = line_ ?? '';
+            if (isCommentLine(line)) {
+                continue;
+            }
+            for (const pattern of DIRECT_CRYPTO_PATTERNS) {
+                pattern.regex.lastIndex = 0;
+                const match = pattern.regex.exec(line);
+                if (match) {
+                    violations.push({
+                        line: lineNum + 1,
+                        column: match.index,
+                        message: pattern.message,
+                        severity: pattern.severity,
+                        suggestion: pattern.suggestion,
+                        match: match[0],
+                        filePath,
+                    });
+                }
+            }
+        }
+        return violations;
+    },
+});
+//# sourceMappingURL=use-centralized-crypto.js.map

package/dist/checks/security/use-centralized-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-centralized-crypto.js","sourceRoot":"","sources":["../../../src/checks/security/use-centralized-crypto.ts"],"names":[],"mappings":"AAAA,0IAA0I;AAC1I;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EACL,iBAAiB,EACjB,WAAW,EACX,aAAa,GAEd,MAAM,sBAAsB,CAAC;AAY9B;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAC1B,OAAe,EACf,OAAe,EACf,UAAkB,EAClB,QAA6B;IAE7B,yJAAyJ;IACzJ,OAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAC5E,CAAC;AAED,0CAA0C;AAC1C,MAAM,sBAAsB,GAAoB;IAC9C,4CAA4C;IAC5C,mBAAmB,CACjB,MAAM,CAAC,GAAG,CAAA,yBAAyB,EACnC,iFAAiF,EACjF,6EAA6E,EAC7E,OAAO,CACR;IACD,mBAAmB,CACjB,MAAM,CAAC,GAAG,CAAA,yBAAyB,EACnC,+EAA+E,EAC/E,6EAA6E,EAC7E,OAAO,CACR;IACD,mBAAmB,CACjB,MAAM,CAAC,GAAG,CAAA,6BAA6B,EACvC,yFAAyF,EACzF,gGAAgG,EAChG,OAAO,CACR;IACD,mBAAmB,CACjB,MAAM,CAAC,GAAG,CAAA,+BAA+B,EACzC,2FAA2F,EAC3F,kGAAkG,EAClG,OAAO,CACR;IACD,mBAAmB,CACjB,MAAM,CAAC,GAAG,CAAA,8BAA8B,EACxC,uEAAuE,EACvE,4FAA4F,EAC5F,OAAO,CACR;IACD,mBAAmB,CACjB,MAAM,CAAC,GAAG,CAAA,8BAA8B,EACxC,uEAAuE,EACvE,4FAA4F,EAC5F,OAAO,CACR;IACD,6CAA6C;IAC7C,mBAAmB,CACjB,MAAM,CAAC,GAAG,CAAA,yBAAyB,EACnC,+EAA+E,EAC/E,yFAAyF,EACzF,OAAO,CACR;IACD,0HAA0H;IAC1H,mBAAmB,CACjB,MAAM,CAAC,GAAG,CAAA,2BAA2B,EACrC,mFAAmF,EACnF,0GAA0G,EAC1G,OAAO,CACR;IACD,mBAAmB,CACjB,MAAM,CAAC,GAAG,CAAA,mBAAmB,EAC7B,yEAAyE,EACzE,mFAAmF,EACnF,OAAO,CACR;IACD,0HAA0H;IAC1H,mBAAmB,CACjB,MAAM,CAAC,GAAG,CAAA,qBAAqB,EAC/B,6EAA6E,EAC7E,oGAAoG,EACpG,OAAO,CACR;IACD,iCAAiC;IACjC,mBAAmB,CACjB,MAAM,CAAC,GAAG,CAAA,oCAAoC,EAC9C,wEAAwE,EACxE,sEAAsE,EACtE,OAAO,CACR;IACD,yBAAyB;IACzB,mBAAmB,CACjB,qBAAqB,EACrB,gFAAgF,EAChF,mFAAmF,EACnF,OAAO,CACR;IACD,mBAAmB,CACjB,MAAM,CAAC,GAAG,CAAA,oBAAoB,EAC9B,6EAA6E,EAC7E,mFAAmF,EACnF,OAAO,CACR;IACD,+BAA+B;IAC/B,mBAAmB,CACjB,uBAAuB,EACvB,6EAA6E,EAC7E,uFAAuF,EACvF,OAAO,CACR;IACD,mBAAmB,CACjB,uBAAuB,EACvB,6EAA6E,EAC7E,uFAAuF,EACvF,OAAO,CACR;IACD,2DAA2D;IAC3D,mBAAmB,CACjB,qBAAqB,EACrB,6DAA6D,EAC7D,qFAAqF,EACrF,SAAS,CACV;IACD,mBAAmB,CACjB,MAAM,CAAC,GAAG,CAAA,gCAAgC,EAC1C,6DAA6D,EAC7D,qFAAqF,EACrF,SAAS,CACV;CACF,CAAC;AAEF,iCAAiC;AACjC,MAAM,oBAAoB,GAAG;IAC3B,iEAAiE;IACjE,mBAAmB;IACnB,eAAe;IACf,qBAAqB;IACrB,gBAAgB;IAChB,+CAA+C;IAC/C,cAAc;IACd,4DAA4D;IAC5D,gCAAgC;IAChC,qEAAqE;IACrE,8BAA8B;IAC9B,qEAAqE;IACrE,sBAAsB;IACtB,6EAA6E;IAC7E,sBAAsB;CACvB,CAAC;AAEF,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,oBAAoB,CAAC,CAAC;AAErE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,WAAW,CAAC;IAC9C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,wBAAwB;IAC9B,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,aAAa,EAAE,eAAe;IAE9B,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,8EAA8E;IAC3F,eAAe,EAAE;;;;;;;;;;;2MAWwL;IACzM,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,CAAC;IAChE,SAAS,EAAE,CAAC,IAAI,CAAC;IAEjB,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,MAAM,CAAC,KAAK,CAAC;YACX,GAAG,EAAE,2CAA2C;YAChD,GAAG,EAAE,wCAAwC;SAC9C,CAAC,CAAC;QACH,IAAI,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,UAAU,GAAqB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAElC,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAEzB,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,SAAS;YACX,CAAC;YAED,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;gBAC7C,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;gBAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACvC,IAAI,KAAK,EAAE,CAAC;oBACV,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,OAAO,GAAG,CAAC;wBACjB,MAAM,EAAE,KAAK,CAAC,KAAK;wBACnB,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;wBAC9B,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;wBACf,QAAQ;qBACT,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/security/webhook-signature-verification.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @fileoverview Detect webhook endpoints without signature verification
+ */
+/**
+ * Check: security/webhook-signature-verification
+ *
+ * Detects webhook endpoints without proper signature verification.
+ */
+export declare const webhookSignatureVerification: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=webhook-signature-verification.d.ts.map

package/dist/checks/security/webhook-signature-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-signature-verification.d.ts","sourceRoot":"","sources":["../../../src/checks/security/webhook-signature-verification.ts"],"names":[],"mappings":"AAAA;;GAEG;AAiLH;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,sCAmDvC,CAAC"}

package/dist/checks/security/webhook-signature-verification.js

@@ -0,0 +1,183 @@
+/**
+ * @fileoverview Detect webhook endpoints without signature verification
+ */
+import { logger } from '@opensip-cli/core';
+import { defineCheck, isCommentLine } from '@opensip-cli/fitness';
+/**
+ * Creates a security pattern with RegExp constructor
+ * Using RegExp constructor avoids sonarjs/regular-expr and sonarjs/slow-regex warnings
+ * @param options - The options for creating the pattern
+ * @returns Security pattern configuration
+ */
+function createSecurityPattern(options) {
+    const { pattern, flags, message, suggestion, severity, category } = options;
+    // @fitness-ignore-next-line semgrep-scan -- non-literal RegExp is intentional; patterns are hardcoded string constants for code analysis, not user input
+    return { regex: new RegExp(pattern, flags), message, suggestion, severity, category };
+}
+/**
+ * Check if a file path is a webhook-related file
+ * @param filePath - Path to check
+ * @returns True if file is webhook-related
+ */
+function isWebhookRelatedFile(filePath) {
+    logger.debug({
+        evt: 'fitness.checks.webhook_signature.is_webhook_related_file',
+        msg: 'Checking if file is webhook-related',
+    });
+    const lowerPath = filePath.toLowerCase();
+    // Simple checks that are safe from ReDoS
+    if (lowerPath.includes('webhook')) {
+        return true;
+    }
+    // Check for /hook/ or /hooks/ path segments
+    return lowerPath.includes('/hook/') || lowerPath.includes('/hooks/');
+}
+// Patterns indicating proper verifier usage - simple string checks
+const VERIFIER_STRINGS = [
+    'infrastructure/webhooks',
+    'createHmacVerifier',
+    'createStripeVerifier',
+    'createTwilioVerifier',
+    'createSendGridVerifier',
+    'verifySignature',
+    'validateSignature',
+];
+/**
+ * Check if content has proper verifier imports
+ * @param content - File content
+ * @returns True if content has verifier imports
+ */
+function hasVerifierImport(content) {
+    logger.debug({
+        evt: 'fitness.checks.webhook_signature.has_verifier_import',
+        msg: 'Checking if content has verifier imports',
+    });
+    return VERIFIER_STRINGS.some((str) => content.includes(str));
+}
+// Security issue patterns - using RegExp constructor to avoid sonarjs warnings
+const SECURITY_ISSUE_PATTERNS = [
+    // Hardcoded webhook secrets - simplified non-backtracking pattern
+    createSecurityPattern({
+        pattern: String.raw `(?:webhook)?secret\s*[:=]\s*['"][^'"]{10,}['"]`,
+        flags: 'gi',
+        message: 'Hardcoded webhook secret detected - use environment variables',
+        suggestion: 'Move webhook secret to environment variable: process.env.WEBHOOK_SECRET. Never commit secrets to source control.',
+        severity: 'error',
+        category: 'hardcoded-secret',
+    }),
+    createSecurityPattern({
+        pattern: 'whsec_[a-zA-Z0-9]+',
+        flags: 'g',
+        message: 'Hardcoded Stripe webhook secret detected - use environment variables',
+        suggestion: 'Move Stripe webhook secret to process.env.STRIPE_WEBHOOK_SECRET. Rotate the secret immediately if it was exposed in git history.',
+        severity: 'error',
+        category: 'hardcoded-secret',
+    }),
+    // Direct string comparison for signatures (not timing-safe)
+    // Simplified pattern without lookahead to avoid slow-regex/backtracking
+    createSecurityPattern({
+        pattern: String.raw `signature\s*(?:===|!==|==|!=)\s*[^;]+`,
+        flags: 'gi',
+        message: 'Direct signature comparison detected - use timing-safe comparison to prevent timing attacks',
+        suggestion: 'Use crypto.timingSafeEqual() for signature comparison: crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b)). Direct comparison is vulnerable to timing attacks.',
+        severity: 'warning',
+        category: 'insecure-signature',
+    }),
+];
+// Patterns indicating JSON parsing without verification - simplified
+const UNSAFE_JSON_PATTERNS = [
+    createSecurityPattern({
+        pattern: String.raw `JSON\.parse\s*\([^)]*(?:req\.body|request\.body|rawBody)`,
+        flags: 'gi',
+        message: 'JSON.parse on webhook body without signature verification - use a shared webhook verification utility',
+        suggestion: 'Use webhook verifiers that handle signature verification. Example: const payload = await verifier.verify(req);',
+        severity: 'error',
+        category: 'missing-verification',
+    }),
+];
+/**
+ * Check if file should be skipped
+ * @param filePath - Path to check
+ * @returns True if file should be skipped
+ */
+function shouldSkipFile(filePath) {
+    logger.debug({
+        evt: 'fitness.checks.webhook_signature.should_skip_file',
+        msg: 'Checking if file should be skipped',
+    });
+    return !isWebhookRelatedFile(filePath);
+}
+function checkPatterns(patterns, line, lineNum, filePath) {
+    logger.debug({
+        evt: 'fitness.checks.webhook_signature.check_patterns',
+        msg: 'Checking line against security patterns',
+    });
+    const violations = [];
+    for (const pattern of patterns) {
+        pattern.regex.lastIndex = 0;
+        const match = pattern.regex.exec(line);
+        if (match) {
+            violations.push({
+                line: lineNum + 1,
+                column: match.index,
+                message: pattern.message,
+                severity: pattern.severity,
+                suggestion: pattern.suggestion,
+                match: match[0],
+                type: pattern.category,
+                filePath,
+            });
+        }
+    }
+    return violations;
+}
+/**
+ * Check: security/webhook-signature-verification
+ *
+ * Detects webhook endpoints without proper signature verification.
+ */
+export const webhookSignatureVerification = defineCheck({
+    id: '02a157b3-88a9-45d4-95da-ed754e347439',
+    slug: 'webhook-signature-verification',
+    disabled: true,
+    tags: ['security'],
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    contentFilter: 'strip-strings',
+    confidence: 'medium',
+    description: 'Detect webhook endpoints without signature verification',
+    longDescription: `**Purpose:** Detects webhook handler files that process incoming payloads without proper signature verification, and flags related security issues.
+
+**Detects:**
+- Hardcoded webhook secrets: \`secret: '<value>'\` or \`whsec_\` prefixed Stripe webhook secrets in source code
+- Direct signature string comparison using \`===\`/\`!==\`/\`==\`/\`!=\` (vulnerable to timing attacks)
+- \`JSON.parse(req.body)\` / \`JSON.parse(request.body)\` / \`JSON.parse(rawBody)\` in webhook files without verifier imports (infrastructure/webhooks, createHmacVerifier, createStripeVerifier, etc.)
+
+**Why it matters:** Without signature verification, attackers can forge webhook payloads to trigger unauthorized actions. Direct string comparison of signatures leaks timing information.
+
+**Scope:** General best practice. Analyzes each file individually. Only scans files in webhook/hook-related paths.`,
+    fileTypes: ['ts'],
+    analyze(content, filePath) {
+        logger.debug({
+            evt: 'fitness.checks.webhook_signature.analyze',
+            msg: 'Analyzing file for webhook signature verification',
+        });
+        if (shouldSkipFile(filePath)) {
+            return [];
+        }
+        const violations = [];
+        const fileHasVerifierImport = hasVerifierImport(content);
+        const lines = content.split('\n');
+        for (const [lineNum, line_] of lines.entries()) {
+            const line = line_ ?? '';
+            if (isCommentLine(line)) {
+                continue;
+            }
+            violations.push(...checkPatterns(SECURITY_ISSUE_PATTERNS, line, lineNum, filePath));
+            if (!fileHasVerifierImport) {
+                violations.push(...checkPatterns(UNSAFE_JSON_PATTERNS, line, lineNum, filePath));
+            }
+        }
+        return violations;
+    },
+});
+//# sourceMappingURL=webhook-signature-verification.js.map

package/dist/checks/security/webhook-signature-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-signature-verification.js","sourceRoot":"","sources":["../../../src/checks/security/webhook-signature-verification.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAuB,MAAM,sBAAsB,CAAC;AAyBvF;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,OAAqC;IAClE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC5E,yJAAyJ;IACzJ,OAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACxF,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,0DAA0D;QAC/D,GAAG,EAAE,qCAAqC;KAC3C,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACzC,yCAAyC;IACzC,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,4CAA4C;IAC5C,OAAO,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AACvE,CAAC;AAED,mEAAmE;AACnE,MAAM,gBAAgB,GAAG;IACvB,yBAAyB;IACzB,oBAAoB;IACpB,sBAAsB;IACtB,sBAAsB;IACtB,wBAAwB;IACxB,iBAAiB;IACjB,mBAAmB;CACpB,CAAC;AAEF;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,sDAAsD;QAC3D,GAAG,EAAE,0CAA0C;KAChD,CAAC,CAAC;IACH,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,+EAA+E;AAC/E,MAAM,uBAAuB,GAAsB;IACjD,kEAAkE;IAClE,qBAAqB,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAA,gDAAgD;QACnE,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,+DAA+D;QACxE,UAAU,EACR,kHAAkH;QACpH,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,kBAAkB;KAC7B,CAAC;IACF,qBAAqB,CAAC;QACpB,OAAO,EAAE,oBAAoB;QAC7B,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,sEAAsE;QAC/E,UAAU,EACR,kIAAkI;QACpI,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,kBAAkB;KAC7B,CAAC;IACF,4DAA4D;IAC5D,wEAAwE;IACxE,qBAAqB,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAA,uCAAuC;QAC1D,KAAK,EAAE,IAAI;QACX,OAAO,EACL,6FAA6F;QAC/F,UAAU,EACR,mKAAmK;QACrK,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,oBAAoB;KAC/B,CAAC;CACH,CAAC;AAEF,qEAAqE;AACrE,MAAM,oBAAoB,GAAsB;IAC9C,qBAAqB,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAA,0DAA0D;QAC7E,KAAK,EAAE,IAAI;QACX,OAAO,EACL,uGAAuG;QACzG,UAAU,EACR,gHAAgH;QAClH,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,sBAAsB;KACjC,CAAC;CACH,CAAC;AAEF;;;;GAIG;AACH,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,mDAAmD;QACxD,GAAG,EAAE,oCAAoC;KAC1C,CAAC,CAAC;IACH,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,aAAa,CACpB,QAA2B,EAC3B,IAAY,EACZ,OAAe,EACf,QAAgB;IAEhB,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,iDAAiD;QACtD,GAAG,EAAE,yCAAyC;KAC/C,CAAC,CAAC;IACH,MAAM,UAAU,GAAqB,EAAE,CAAC;IAExC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,KAAK,EAAE,CAAC;YACV,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,OAAO,GAAG,CAAC;gBACjB,MAAM,EAAE,KAAK,CAAC,KAAK;gBACnB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;gBACf,IAAI,EAAE,OAAO,CAAC,QAAQ;gBACtB,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CAAC;IACtD,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,gCAAgC;IACtC,QAAQ,EAAE,IAAI;IACd,IAAI,EAAE,CAAC,UAAU,CAAC;IAClB,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,aAAa,EAAE,eAAe;IAE9B,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,yDAAyD;IACtE,eAAe,EAAE;;;;;;;;;mHASgG;IACjH,SAAS,EAAE,CAAC,IAAI,CAAC;IAEjB,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,MAAM,CAAC,KAAK,CAAC;YACX,GAAG,EAAE,0CAA0C;YAC/C,GAAG,EAAE,mDAAmD;SACzD,CAAC,CAAC;QACH,IAAI,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,UAAU,GAAqB,EAAE,CAAC;QACxC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAElC,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAEzB,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,SAAS;YACX,CAAC;YAED,UAAU,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;YAEpF,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBAC3B,UAAU,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,oBAAoB,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/testing/index.d.ts

@@ -0,0 +1,6 @@
+export * from './no-skipped-tests.js';
+export * from './no-stub-tests.js';
+export * from './test-convention-consistency.js';
+export * from './test-file-naming.js';
+export * from './test-file-pairing.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/checks/testing/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/checks/testing/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kCAAkC,CAAC;AACjD,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC"}