@produtype/core 0.42.0 → 0.44.0

package/dist/analyzer/absenceEvidence.d.ts

@@ -13,3 +13,16 @@ import type { DetectorEvidence } from './types';
  * would not. That is the difference between a claim and an assertion.
  */
 export declare function searchedFor(what: string, terms: string[], claim?: string): DetectorEvidence[];
+/**
+ * The evidence, or the search that came up empty — never neither.
+ *
+ * Measured across eighty-three repositories: 768 of 2101 findings carried "no direct
+ * evidence captured", and 180 of those were `high`. A reader is told at high severity
+ * that their product has no error reporting, no roles, no tenant isolation, and the
+ * only thing under it is a sentence that reads like an admission of not having looked.
+ *
+ * Every detector already knows what it searched for. This is the one line that makes
+ * it say so, so that a reader whose roles are called `capabilities` can see why they
+ * were missed and tell us we are wrong.
+ */
+export declare function evidenceOrSearch(evidence: DetectorEvidence[], what: string, terms: string[], claim?: string): DetectorEvidence[];

package/dist/analyzer/absenceEvidence.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.searchedFor = searchedFor;
+exports.evidenceOrSearch = evidenceOrSearch;
 /**
  * What was looked for, when nothing was found.
  *
@@ -23,3 +24,18 @@ function searchedFor(what, terms, claim) {
             ...(claim ? { claim } : {}),
         }];
 }
+/**
+ * The evidence, or the search that came up empty — never neither.
+ *
+ * Measured across eighty-three repositories: 768 of 2101 findings carried "no direct
+ * evidence captured", and 180 of those were `high`. A reader is told at high severity
+ * that their product has no error reporting, no roles, no tenant isolation, and the
+ * only thing under it is a sentence that reads like an admission of not having looked.
+ *
+ * Every detector already knows what it searched for. This is the one line that makes
+ * it say so, so that a reader whose roles are called `capabilities` can see why they
+ * were missed and tell us we are wrong.
+ */
+function evidenceOrSearch(evidence, what, terms, claim) {
+    return evidence.length > 0 ? evidence : searchedFor(what, terms, claim);
+}

package/dist/analyzer/detectAuth.js

@@ -312,7 +312,7 @@ async function detectAuth(ctx) {
             key: 'auth.core',
             present: hasAuth,
             complete: hasAuth && hasAuthz,
-            evidence: [...depEvidence(authDeps), ...snippetEvidence(routeSignals)],
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)([...depEvidence(authDeps), ...snippetEvidence(routeSignals)], 'a way for somebody to sign in', ['next-auth', 'passport', 'lucia', '@clerk/', '@supabase/auth', 'django.contrib.auth', 'devise', 'jsonwebtoken', 'a /login or /signin route', 'signIn(', 'authenticate(']),
             details: {
                 hasAuth,
                 hasAuthz,
@@ -334,12 +334,12 @@ async function detectAuth(ctx) {
         {
             key: 'auth.2fa',
             present: twoFaDeps.length > 0 || twoFaSignals.length > 0,
-            evidence: [...depEvidence(twoFaDeps), ...snippetEvidence(twoFaSignals)],
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)([...depEvidence(twoFaDeps), ...snippetEvidence(twoFaSignals)], 'a second factor', ['otplib', 'speakeasy', 'notp', 'pyotp', 'django-otp', 'totp', 'authenticator app', 'webauthn', '@simplewebauthn']),
         },
         {
             key: 'auth.apiKeys',
             present: apiKeySignals.length > 0,
-            evidence: snippetEvidence(apiKeySignals),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(apiKeySignals), 'keys this product issues and checks', ['x-api-key', 'api_keys.find', 'api_keys.where', 'hashedApiKey', 'token scope']),
         },
         {
             key: 'auth.passwordReset',
@@ -366,22 +366,22 @@ async function detectAuth(ctx) {
         {
             key: 'authz.roles',
             present: roleSignals.length > 0,
-            evidence: snippetEvidence(roleSignals),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(roleSignals), 'role checks', ['role ===', 'hasRole', 'isAdmin', 'user.role', 'roles.includes', '@Roles', 'role_required']),
         },
         {
             key: 'authz.permissions',
             present: permissionSignals.length > 0,
-            evidence: snippetEvidence(permissionSignals),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(permissionSignals), 'permission checks', ['requirePermission', 'permission_classes', 'permissions.py', 'authorize(', 'can(']),
         },
         {
             key: 'authz.resourceLevel',
             present: resourceLevelSignals.length > 0 || permissionSignals.length > 0,
-            evidence: snippetEvidence(resourceLevelSignals),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(resourceLevelSignals), 'a check that the row belongs to the caller', ['requirePermission', 'permission_classes', 'authorize(', 'canAccess(', 'hasAccessTo(', 'ownerId', 'createdBy', 'req.user.id', 'userId ===']),
         },
         {
             key: 'tenancy.organization',
             present: hasOrganization,
-            evidence: snippetEvidence(organizationSignals),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(organizationSignals), 'a tenant of its own', ['organizationId', 'organization_id', 'tenantId', 'tenant_id', 'workspaceId', 'accountId']),
             details: {
                 b2bHint,
                 missingTenantRisk: b2bHint && !hasOrganization,
@@ -390,7 +390,7 @@ async function detectAuth(ctx) {
         {
             key: 'tenancy.membership',
             present: membershipSignals.length > 0,
-            evidence: snippetEvidence(membershipSignals),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(membershipSignals), 'a membership joining a person to a tenant', ['membership', 'organizationMember', 'teamMember', 'workspaceMember', 'memberId with a tenant word beside it']),
         },
     ];
 }

package/dist/analyzer/detectBilling.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectBilling = detectBilling;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
+const absenceEvidence_1 = require("./absenceEvidence");
 function toEvidence(matches) {
     return matches.map((m) => ({ type: 'snippet', value: m.snippet, file: m.file, line: m.line }));
 }
@@ -120,7 +121,7 @@ async function detectBilling(ctx) {
         {
             key: 'billing.stripe',
             present: hasStrongStripeSignal,
-            evidence,
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'a payment integration', ['stripe', '@stripe/stripe-js', 'checkout.sessions.create', 'paddle', 'lemonsqueezy', 'braintree', 'a route under /webhook/stripe']),
             details: {
                 stripe: hasStrongStripeSignal,
             },
@@ -128,25 +129,25 @@ async function detectBilling(ctx) {
         {
             key: 'billing.webhook.route',
             present: webhookRouteHits.length > 0 || webhookPathHits.length > 0,
-            evidence: [
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)([
                 ...toEvidence(webhookRouteHits),
                 ...webhookPathHits.map((file) => ({ type: 'file', value: file, file })),
-            ],
+            ], 'a route the payment provider calls back', ['/webhook', '/webhooks/stripe', 'a file under a webhook directory']),
         },
         {
             key: 'billing.webhook.rawBody',
             present: rawBodyHits.length > 0,
-            evidence: toEvidence(rawBodyHits),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(toEvidence(rawBodyHits), 'the unparsed body a signature is computed over', ['express.raw', 'bodyParser.raw', 'request.text()', 'rawBody', 'await req.arrayBuffer()']),
         },
         {
             key: 'billing.webhook.secret',
             present: secretHits.length > 0,
-            evidence: toEvidence(secretHits),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(toEvidence(secretHits), 'the signing secret, read from configuration', ['STRIPE_WEBHOOK_SECRET', 'WEBHOOK_SIGNING_SECRET', 'whsec_']),
         },
         {
             key: 'billing.webhook.signatureValidation',
             present: signatureHits.length > 0,
-            evidence: toEvidence(signatureHits),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(toEvidence(signatureHits), 'the signature being checked', ['constructEvent(', 'verifyHeader(', 'Webhook.constructEvent', 'stripe-signature']),
         },
     ];
 }

package/dist/analyzer/detectDeployment.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectDeployment = detectDeployment;
 const textSearch_1 = require("../utils/textSearch");
+const absenceEvidence_1 = require("./absenceEvidence");
 async function detectDeployment(ctx) {
     const evidence = [];
     /**
@@ -77,7 +78,7 @@ async function detectDeployment(ctx) {
         key: 'deployment.readiness',
         present: presentFiles.length > 0 || hits.length > 0,
         complete: prodAware,
-        evidence,
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'anything that says how this is deployed', ['Dockerfile', 'docker-compose', '.github/workflows/', 'Procfile', 'fly.toml', 'render.yaml', 'NODE_ENV', 'RAILS_ENV', 'ASPNETCORE_ENVIRONMENT', 'a file naming production']),
         details: {
             dockerArtifacts: presentFiles.some((f) => /Dockerfile|compose/.test(f)),
             ci: presentFiles.some((f) => f.startsWith('.github/workflows/')),

package/dist/analyzer/detectDocker.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectDocker = detectDocker;
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
+const absenceEvidence_1 = require("./absenceEvidence");
 async function detectDocker(ctx) {
     const evidence = [];
     const dockerfile = ctx.files.all.find((f) => /(^|\/)Dockerfile$/.test(f));
@@ -37,7 +38,7 @@ async function detectDocker(ctx) {
         key: 'infra.docker',
         present: Boolean(dockerfile || composeFile),
         complete: hasHealthcheck,
-        evidence,
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'a container definition', ['Dockerfile', 'Containerfile', 'docker-compose.yml', 'compose.yaml']),
         details: { dockerfile: Boolean(dockerfile), compose: Boolean(composeFile), hasHealthcheck, hasExpose, services },
     };
 }

package/dist/analyzer/detectErrorReporting.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectErrorReporting = detectErrorReporting;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
+const absenceEvidence_1 = require("./absenceEvidence");
 /**
  * Whether a crash reaches the people who can fix it.
  *
@@ -53,7 +54,7 @@ async function detectErrorReporting(ctx) {
         // A reporting service is wired up once and covers everything; a hand-rolled handler
         // usually covers what its author remembered.
         complete: deps.length > 0,
-        evidence,
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'somewhere a crash in the browser is sent', ['@sentry/browser', '@sentry/react', '@bugsnag/js', 'rollbar', 'logrocket', '@datadog/browser-rum', 'sentry-sdk', 'window.onerror', 'addEventListener("error")', 'addEventListener("unhandledrejection")']),
         details: { services: deps, handlers: handlers.length },
     };
 }

package/dist/analyzer/detectGame.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectGame = detectGame;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
+const absenceEvidence_1 = require("./absenceEvidence");
 /**
  * Whether this project is a game.
  *
@@ -162,7 +163,7 @@ async function detectStatePersistence(ctx) {
         present: saves || durable,
         // Client storage alone is the partial case: it saves, until it does not.
         complete: durable,
-        evidence,
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'anywhere progress is written down', ['localStorage', 'sessionStorage', 'IndexedDB', 'a save route', 'schema.prisma', 'a .sql file', 'pg', 'mongoose', 'better-sqlite3']),
         details: { durable, clientStorage: clientOnly.length > 0, saveRoutines: saveRoutes.length },
     };
 }
@@ -193,7 +194,7 @@ async function detectAssetDelivery(ctx) {
     return {
         key: 'app.assetDelivery',
         present: hits.length > 0 || headerFiles.length > 0,
-        evidence,
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'anything that lets a browser keep the assets', ['express.static(..., maxAge)', 'Cache-Control: max-age', 'setHeaders:', 'assetPrefix:', 'immutable', '_headers', 'netlify.toml', 'vercel.json']),
         details: { inCode: hits.length, headerFiles: headerFiles.length },
     };
 }

package/dist/analyzer/detectJobs.js

@@ -4,6 +4,7 @@ exports.detectJobs = detectJobs;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
+const absenceEvidence_1 = require("./absenceEvidence");
 /**
  * Work that happens outside a request.
  *
@@ -124,7 +125,7 @@ async function detectJobs(ctx) {
         // A file named `workers/` is only taken as proof alongside something declared in
         // the code: the name is a convention, and conventions are borrowed.
         present: declared,
-        evidence,
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'work that happens outside a request', ['bullmq', 'bull', 'agenda', 'bee-queue', 'celery', 'rq', 'sidekiq', 'resque', 'graphile-worker', 'a cron schedule', 'a worker entrypoint']),
         details: {
             nodeQueue: nodeDeps.length > 0,
             pythonQueue: pyDeps.length > 0,

package/dist/analyzer/detectMobile.js

@@ -4,6 +4,7 @@ exports.detectMobile = detectMobile;
 const detectContext_1 = require("./detectContext");
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
 const textSearch_1 = require("../utils/textSearch");
+const absenceEvidence_1 = require("./absenceEvidence");
 /**
  * Whether this is an application that ships to somebody else's phone, and what that
  * demands of it.
@@ -351,24 +352,32 @@ async function detectMobile(ctx) {
             // Declared-and-explained, or asked at the moment of use. A manifest full of
             // permissions with nothing next to them is the failing case, not the passing one.
             present: permissionsExplained,
-            evidence: permissionEvidence,
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(permissionEvidence, 'a reason given for each permission asked for', ['NSCameraUsageDescription and the other NS*UsageDescription keys', 'a permission rationale beside uses-permission', 'requestPermissions(', 'Permission.request']),
+        },
+        {
+            key: 'mobile.credentialStorage',
+            present: credentialEvidence.length > 0,
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(credentialEvidence, 'a secure store for credentials on the device', ['react-native-keychain', 'expo-secure-store', 'flutter_secure_storage', 'KeychainAccess', 'kSecClass', 'EncryptedSharedPreferences', 'AndroidKeyStore', 'SecItemAdd']),
+        },
+        {
+            key: 'mobile.offline',
+            present: offlineDeps.length > 0,
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(offlineEvidence, 'a local database the app can read with no network', ['sqflite', 'drift', 'hive', 'isar', 'objectbox', 'realm', 'androidx.room', 'sqldelight', 'grdb.swift', 'sqlite.swift']),
         },
-        { key: 'mobile.credentialStorage', present: credentialEvidence.length > 0, evidence: credentialEvidence },
-        { key: 'mobile.offline', present: offlineDeps.length > 0, evidence: offlineEvidence },
         {
             key: 'mobile.forcedUpdate',
             present: forcedUpdate.length > 0,
-            evidence: forcedUpdate.map((match) => ({
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(forcedUpdate.map((match) => ({
                 type: 'snippet',
                 value: match.snippet,
                 file: match.file,
                 line: match.line,
-            })),
+            })), 'a check that the installed version is still supported', ['minimumVersion', 'minSupportedVersion', 'forceUpdate', 'upgrade_required', 'in_app_update', 'AppUpdateManager']),
         },
         {
             key: 'mobile.privacyDeclaration',
             present: privacyFiles.length > 0,
-            evidence: privacyFiles.map((file) => ({ type: 'file', value: file, file })),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(privacyFiles.map((file) => ({ type: 'file', value: file, file })), 'the privacy declaration the stores require', ['PrivacyInfo.xcprivacy', 'a data-safety declaration', 'privacy_policy', 'PRIVACY.md']),
         },
     ];
 }

package/dist/analyzer/detectNotifications.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectEngagement = detectEngagement;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
+const absenceEvidence_1 = require("./absenceEvidence");
 /**
  * Signals for the two things a consumer product needs that a backend service does not:
  * a way to bring a stranger from signup to first use, and a way to reach them
@@ -50,7 +51,7 @@ async function detectNotifications(ctx) {
         key: 'notifications.transactional',
         present: capable || wired,
         complete: capable && wired,
-        evidence,
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'a way to tell a user something happened', ['nodemailer', 'resend', '@sendgrid/mail', 'postmark', 'mailgun', 'django.core.mail', 'sendMail(', 'send_mail(', 'firebase-admin messaging', 'an email template file']),
         details: {
             emailDependency: emailDeps.length > 0,
             pushDependency: pushDeps.length > 0,
@@ -72,7 +73,7 @@ async function detectOnboarding(ctx) {
         key: 'onboarding.flow',
         present: strong || hits.length > 0,
         complete: strong,
-        evidence,
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'anything that takes a new user through a first run', ['onboarding', 'getting-started', 'welcome', 'firstRun', 'setup wizard', 'a file named for onboarding']),
         details: { onboardingFiles: files.length, onboardingSignals: hits.length },
     };
 }

package/dist/analyzer/detectPackaging.js

@@ -5,6 +5,7 @@ exports.detectPackaging = detectPackaging;
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
 const detectContext_1 = require("./detectContext");
 const readTextFileSafe_2 = require("../utils/readTextFileSafe");
+const absenceEvidence_1 = require("./absenceEvidence");
 /**
  * Whether a project is fit to be installed and depended on by someone else.
  *
@@ -212,7 +213,7 @@ async function detectPackaging(ctx) {
             // answer, and a reader who has one does not need the other to use the code.
             present: licenseFiles.length > 0 || declaredLicense,
             complete: licenseFiles.length > 0 && declaredLicense,
-            evidence: licenseEvidence,
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(licenseEvidence, 'a licence', ['LICENSE', 'LICENCE', 'COPYING', 'a license field in package.json', 'a license classifier in pyproject.toml']),
             details: { files: licenseFiles.length, declared: declaredLicense },
         },
         {
@@ -234,25 +235,25 @@ async function detectPackaging(ctx) {
             key: 'docs.readme',
             present: readmeFiles.length > 0,
             complete: readmeLength > 400,
-            evidence: readmeFiles.map((file) => ({ type: 'file', value: `${file} (${readmeLength} characters)`, file })),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(readmeFiles.map((file) => ({ type: 'file', value: `${file} (${readmeLength} characters)`, file })), 'a readme', ['README', 'README.md', 'README.rst', 'readme.txt']),
             details: { length: readmeLength },
         },
         {
             key: 'quality.tests',
             present: testFiles.length > 0,
             complete: testFiles.length > 0 && (hasTestScript || hasPyTestRunner),
-            evidence: [
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)([
                 ...testFiles.slice(0, 3).map((file) => ({ type: 'file', value: file, file })),
                 ...(hasTestScript ? [{ type: 'note', value: 'an "npm test" script' }] : []),
                 ...(hasPyTestRunner ? [{ type: 'note', value: 'a Python test runner' }] : []),
-            ],
+            ], 'tests', ['a path under test/ or tests/', '*.test.*', '*.spec.*', 'test_*.py', '*_test.go', 'an "npm test" script', 'pytest', 'tox']),
             details: { files: testFiles.length, runner: hasTestScript || hasPyTestRunner },
         },
         {
             key: 'quality.ci',
             present: ciFiles.length > 0,
             complete: ciFiles.length > 0 && testFiles.length > 0,
-            evidence: ciFiles.map((file) => ({ type: 'file', value: file, file })),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(ciFiles.map((file) => ({ type: 'file', value: file, file })), 'anything that runs the tests without being asked', ['.github/workflows/', '.gitlab-ci.yml', '.circleci/config.yml', 'azure-pipelines.yml', 'Jenkinsfile', '.travis.yml']),
             details: { files: ciFiles.length },
         },
     ];

package/dist/rules/rules.js

@@ -263,7 +263,18 @@ exports.rules = [
                     ? `Hardcoded fallback secrets detected (${weakTypes || 'unknown'} key context).`
                     : 'No weak fallback secret patterns detected.',
                 recommendation: 'Require strong secrets through environment variables with strict startup validation.',
-                evidence: weakEvidence,
+                /**
+                 * A check that passes because it found nothing has to say what it looked for.
+                 *
+                 * This was the most repeated line in the product: 175 reports said "no weak
+                 * fallback secret patterns detected" with nothing underneath, which tells the
+                 * reader neither how hard it looked nor whether their own placeholder would
+                 * have been caught. A negative result is only worth something when the search
+                 * behind it is visible.
+                 */
+                evidence: weakEvidence.length > 0
+                    ? weakEvidence
+                    : (0, absenceEvidence_1.searchedFor)('hardcoded fallback secrets', ['changeme', 'your-secret', 'dev-secret', 'local-secret', 'change-in-production', 'test123', 'a secret assigned a literal beside jwt_secret, secret_key or session_secret']),
             });
         },
     },
@@ -438,7 +449,11 @@ exports.rules = [
                         ? 'Django settings contain DEBUG=True.'
                         : 'No DEBUG=True signal found.',
                 recommendation: 'Set DEBUG=False for non-local environments and enforce via environment variables.',
-                evidence: !isDjango ? [{ type: 'note', value: 'Django stack not detected' }] : evidenceForClaim(sec?.evidence, 'django-debug'),
+                evidence: !isDjango
+                    ? [{ type: 'note', value: 'Django stack not detected' }]
+                    : evidenceForClaim(sec?.evidence, 'django-debug').length > 0
+                        ? evidenceForClaim(sec?.evidence, 'django-debug')
+                        : (0, absenceEvidence_1.searchedFor)('DEBUG left on', ['a line reading DEBUG = True in the settings Django actually loads, outside any if settings.DEBUG block']),
             });
         },
     },
@@ -464,7 +479,11 @@ exports.rules = [
                         ? 'Secure cookie settings appear configured.'
                         : 'SESSION/CSRF secure cookie flags are weak.',
                 recommendation: 'Enable SESSION_COOKIE_SECURE and CSRF_COOKIE_SECURE in production.',
-                evidence: !isDjango ? [{ type: 'note', value: 'Django stack not detected' }] : evidenceForClaim(sec?.evidence, 'django-cookies'),
+                evidence: !isDjango
+                    ? [{ type: 'note', value: 'Django stack not detected' }]
+                    : evidenceForClaim(sec?.evidence, 'django-cookies').length > 0
+                        ? evidenceForClaim(sec?.evidence, 'django-cookies')
+                        : (0, absenceEvidence_1.searchedFor)('cookies left insecure', ['SESSION_COOKIE_SECURE = False', 'CSRF_COOKIE_SECURE = False']),
             });
         },
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.42.0",
+  "version": "0.44.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {