@profullstack/threatcrush 0.11.0 → 0.11.2

package/dist/daemon.js

@@ -2022,8 +2022,8 @@ var require_toml = __commonJS({
 });
 
 // src/daemon/index.ts
-var import_node_fs15 = require("fs");
-var import_node_path10 = require("path");
+var import_node_fs17 = require("fs");
+var import_node_path12 = require("path");
 
 // src/daemon/paths.ts
 var import_node_fs = require("fs");
@@ -2107,7 +2107,28 @@ function findRunningDaemon() {
 
 // src/daemon/ipc-server.ts
 var import_node_net = require("net");
+var import_node_fs4 = require("fs");
+
+// src/daemon/control-token.ts
+var import_node_crypto = require("crypto");
 var import_node_fs3 = require("fs");
+var import_node_path2 = require("path");
+var CONTROL_TOKEN_FILE = (0, import_node_path2.join)(PATHS.runDir, "control.token");
+function issueControlToken() {
+  const token = (0, import_node_crypto.randomBytes)(32).toString("hex");
+  (0, import_node_fs3.writeFileSync)(CONTROL_TOKEN_FILE, token, { mode: 384 });
+  try {
+    (0, import_node_fs3.chmodSync)(CONTROL_TOKEN_FILE, 384);
+  } catch {
+  }
+  return token;
+}
+function tokensMatch(expected, provided) {
+  if (typeof provided !== "string" || !provided) return false;
+  const a = Buffer.from(expected);
+  const b = Buffer.from(provided);
+  return a.length === b.length && (0, import_node_crypto.timingSafeEqual)(a, b);
+}
 
 // src/daemon/event-bus.ts
 var import_node_events = require("events");
@@ -2303,10 +2324,12 @@ var IpcServer = class {
   nextClientId = 1;
   startedAt = /* @__PURE__ */ new Date();
   counters = { events: 0, threats: 0, alerts: 0 };
+  controlToken = "";
   async start() {
-    if ((0, import_node_fs3.existsSync)(PATHS.socket)) {
+    this.controlToken = issueControlToken();
+    if ((0, import_node_fs4.existsSync)(PATHS.socket)) {
       try {
-        (0, import_node_fs3.unlinkSync)(PATHS.socket);
+        (0, import_node_fs4.unlinkSync)(PATHS.socket);
       } catch {
       }
     }
@@ -2342,14 +2365,14 @@ var IpcServer = class {
     return new Promise((resolve3) => {
       if (!this.server) {
         try {
-          if ((0, import_node_fs3.existsSync)(PATHS.socket)) (0, import_node_fs3.unlinkSync)(PATHS.socket);
+          if ((0, import_node_fs4.existsSync)(PATHS.socket)) (0, import_node_fs4.unlinkSync)(PATHS.socket);
         } catch {
         }
         return resolve3();
       }
       this.server.close(() => {
         try {
-          if ((0, import_node_fs3.existsSync)(PATHS.socket)) (0, import_node_fs3.unlinkSync)(PATHS.socket);
+          if ((0, import_node_fs4.existsSync)(PATHS.socket)) (0, import_node_fs4.unlinkSync)(PATHS.socket);
         } catch {
         }
         resolve3();
@@ -2435,6 +2458,13 @@ var IpcServer = class {
         for (const ch of req.params.channels) client.subscriptions.add(ch);
         return this.send(client, { id: req.id, ok: true, result: { subscribed: [...client.subscriptions] } });
       case "shutdown":
+        if (!tokensMatch(this.controlToken, req.params?.token)) {
+          return this.send(client, {
+            id: req.id,
+            ok: false,
+            error: "shutdown requires the daemon control token (run as root, or use systemctl)"
+          });
+        }
         this.send(client, { id: req.id, ok: true, result: "shutting down" });
         setTimeout(() => process.emit("SIGTERM"), 50);
         return;
@@ -2455,13 +2485,134 @@ var IpcServer = class {
 };
 
 // src/daemon/module-host.ts
-var import_node_fs8 = require("fs");
-var import_node_path3 = require("path");
+var import_node_fs10 = require("fs");
+var import_node_path5 = require("path");
 var import_node_url = require("url");
 var import_toml2 = __toESM(require_toml());
 
+// src/daemon/module-trust.ts
+var import_node_crypto2 = require("crypto");
+var import_node_fs5 = require("fs");
+var import_node_path3 = require("path");
+var TRUST_FILE = (0, import_node_path3.join)(PATHS.configDir, "trusted-modules.json");
+var PUBLISHER_KEYS_FILE = (0, import_node_path3.join)(PATHS.configDir, "publisher-keys.json");
+var DIGEST_EXCLUDED_DIRS = /* @__PURE__ */ new Set([".git"]);
+function collectFiles(root, dir = root, out = []) {
+  for (const entry of (0, import_node_fs5.readdirSync)(dir, { withFileTypes: true }).sort(
+    (a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0
+  )) {
+    const full = (0, import_node_path3.join)(dir, entry.name);
+    if (entry.isSymbolicLink()) {
+      out.push({ path: full, isSymlink: true });
+    } else if (entry.isDirectory()) {
+      if (DIGEST_EXCLUDED_DIRS.has(entry.name)) continue;
+      collectFiles(root, full, out);
+    } else if (entry.isFile()) {
+      out.push({ path: full, isSymlink: false });
+    }
+  }
+  return out;
+}
+function computeModuleDigest(modulePath) {
+  const hash = (0, import_node_crypto2.createHash)("sha256");
+  for (const entry of collectFiles(modulePath)) {
+    const relPath = (0, import_node_path3.relative)(modulePath, entry.path).split(import_node_path3.sep).join("/");
+    hash.update(relPath);
+    hash.update("\0");
+    if (entry.isSymlink) {
+      hash.update("symlink:");
+      hash.update((0, import_node_fs5.readlinkSync)(entry.path));
+    } else {
+      hash.update("file:");
+      hash.update((0, import_node_fs5.readFileSync)(entry.path));
+    }
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+function readTrustFile() {
+  if (!(0, import_node_fs5.existsSync)(TRUST_FILE)) return { version: 1, modules: {} };
+  try {
+    const parsed = JSON.parse((0, import_node_fs5.readFileSync)(TRUST_FILE, "utf-8"));
+    if (parsed.version !== 1 || typeof parsed.modules !== "object" || !parsed.modules) {
+      return { version: 1, modules: {} };
+    }
+    return { version: 1, modules: parsed.modules };
+  } catch {
+    return { version: 1, modules: {} };
+  }
+}
+function readPublisherKeys() {
+  if (!(0, import_node_fs5.existsSync)(PUBLISHER_KEYS_FILE)) return {};
+  try {
+    const parsed = JSON.parse((0, import_node_fs5.readFileSync)(PUBLISHER_KEYS_FILE, "utf-8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function verifyModuleSignature(modulePath, digest) {
+  const keys = readPublisherKeys();
+  const pinnedKeyIds = Object.keys(keys);
+  const sigPath = (0, import_node_path3.join)(modulePath, "mod.sig");
+  if (pinnedKeyIds.length === 0) {
+    return { ok: true };
+  }
+  if (!(0, import_node_fs5.existsSync)(sigPath)) {
+    return { ok: false, reason: "publisher keys are pinned but the module ships no mod.sig" };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse((0, import_node_fs5.readFileSync)(sigPath, "utf-8"));
+  } catch {
+    return { ok: false, reason: "mod.sig is not valid JSON" };
+  }
+  if (!parsed.keyId || !parsed.signature) {
+    return { ok: false, reason: "mod.sig is missing keyId or signature" };
+  }
+  const publicKey = keys[parsed.keyId];
+  if (!publicKey) {
+    return { ok: false, reason: `mod.sig references unpinned key "${parsed.keyId}"` };
+  }
+  try {
+    const valid = (0, import_node_crypto2.verify)(
+      null,
+      Buffer.from(digest, "hex"),
+      publicKey,
+      Buffer.from(parsed.signature, "base64")
+    );
+    return valid ? { ok: true } : { ok: false, reason: "mod.sig signature does not match" };
+  } catch (err) {
+    return { ok: false, reason: `signature check failed: ${String(err.message || err)}` };
+  }
+}
+function verifyModuleTrust(name, modulePath) {
+  let digest;
+  try {
+    digest = computeModuleDigest(modulePath);
+  } catch (err) {
+    return { ok: false, reason: `could not hash module: ${String(err.message || err)}` };
+  }
+  const signature = verifyModuleSignature(modulePath, digest);
+  if (!signature.ok) return signature;
+  const record = readTrustFile().modules[name];
+  if (!record) {
+    return {
+      ok: false,
+      reason: `not trusted \u2014 review it, then run: threatcrush modules trust ${name}`
+    };
+  }
+  if (record.digest !== digest) {
+    return {
+      ok: false,
+      reason: `contents changed since it was trusted on ${record.trustedAt} \u2014 re-review it, then run: threatcrush modules trust ${name}`
+    };
+  }
+  return { ok: true };
+}
+
 // src/daemon/watchers/log-watcher.ts
-var import_node_fs4 = require("fs");
+var import_node_fs6 = require("fs");
 var import_node_readline = require("readline");
 
 // src/core/log-parser.ts
@@ -2618,9 +2769,9 @@ var LogWatcher = class {
   start() {
     const started = [];
     for (const src of this.sources) {
-      if (!(0, import_node_fs4.existsSync)(src.path)) continue;
+      if (!(0, import_node_fs6.existsSync)(src.path)) continue;
       try {
-        (0, import_node_fs4.accessSync)(src.path, import_node_fs4.constants.R_OK);
+        (0, import_node_fs6.accessSync)(src.path, import_node_fs6.constants.R_OK);
       } catch {
         continue;
       }
@@ -2640,7 +2791,7 @@ var LogWatcher = class {
   }
   tail(src) {
     try {
-      this.positions.set(src.path, (0, import_node_fs4.statSync)(src.path).size);
+      this.positions.set(src.path, (0, import_node_fs6.statSync)(src.path).size);
     } catch {
       this.positions.set(src.path, 0);
     }
@@ -2651,7 +2802,7 @@ var LogWatcher = class {
   poll(src) {
     let stat;
     try {
-      stat = (0, import_node_fs4.statSync)(src.path);
+      stat = (0, import_node_fs6.statSync)(src.path);
     } catch {
       return;
     }
@@ -2661,7 +2812,7 @@ var LogWatcher = class {
       return;
     }
     if (stat.size === prev) return;
-    const stream = (0, import_node_fs4.createReadStream)(src.path, { start: prev, encoding: "utf-8" });
+    const stream = (0, import_node_fs6.createReadStream)(src.path, { start: prev, encoding: "utf-8" });
     stream.on("error", () => this.positions.set(src.path, stat.size));
     const rl = (0, import_node_readline.createInterface)({ input: stream });
     rl.on("error", () => {
@@ -2853,7 +3004,7 @@ function realtimeToDate(rt) {
 
 // src/modules/network-monitor/index.ts
 var import_node_child_process2 = require("child_process");
-var import_node_fs5 = require("fs");
+var import_node_fs7 = require("fs");
 var NetworkMonitor = class {
   constructor(bus2) {
     this.bus = bus2;
@@ -2891,7 +3042,7 @@ var NetworkMonitor = class {
   hasConntrackOrSs() {
     const ss = (0, import_node_child_process2.spawnSync)("ss", ["--version"], { stdio: "pipe" });
     if (ss.status === 0) return true;
-    return (0, import_node_fs5.existsSync)("/proc/net/tcp");
+    return (0, import_node_fs7.existsSync)("/proc/net/tcp");
   }
   poll() {
     try {
@@ -3030,7 +3181,7 @@ var NetworkMonitor = class {
 };
 
 // src/modules/dns-monitor/index.ts
-var import_node_fs6 = require("fs");
+var import_node_fs8 = require("fs");
 var import_node_readline2 = require("readline");
 var DNS_LOG_SOURCES = [
   "/var/log/syslog",
@@ -3064,9 +3215,9 @@ var DnsMonitor = class {
   entropyThreshold = 3.5;
   start() {
     const sources = DNS_LOG_SOURCES.filter((p) => {
-      if (!(0, import_node_fs6.existsSync)(p)) return false;
+      if (!(0, import_node_fs8.existsSync)(p)) return false;
       try {
-        (0, import_node_fs6.accessSync)(p, import_node_fs6.constants.R_OK);
+        (0, import_node_fs8.accessSync)(p, import_node_fs8.constants.R_OK);
         return true;
       } catch {
         return false;
@@ -3090,7 +3241,7 @@ var DnsMonitor = class {
   }
   tailLog(path) {
     try {
-      this.positions.set(path, (0, import_node_fs6.statSync)(path).size);
+      this.positions.set(path, (0, import_node_fs8.statSync)(path).size);
     } catch {
       this.positions.set(path, 0);
     }
@@ -3100,7 +3251,7 @@ var DnsMonitor = class {
   pollLog(path) {
     let stat;
     try {
-      stat = (0, import_node_fs6.statSync)(path);
+      stat = (0, import_node_fs8.statSync)(path);
     } catch {
       return;
     }
@@ -3110,7 +3261,7 @@ var DnsMonitor = class {
       return;
     }
     if (stat.size === prev) return;
-    const stream = (0, import_node_fs6.createReadStream)(path, { start: prev, encoding: "utf-8" });
+    const stream = (0, import_node_fs8.createReadStream)(path, { start: prev, encoding: "utf-8" });
     stream.on("error", () => this.positions.set(path, stat.size));
     const rl = (0, import_node_readline2.createInterface)({ input: stream });
     rl.on("line", (line) => this.parseDnsLine(line));
@@ -3239,8 +3390,8 @@ var DnsMonitor = class {
 };
 
 // src/core/config.ts
-var import_node_fs7 = require("fs");
-var import_node_path2 = require("path");
+var import_node_fs9 = require("fs");
+var import_node_path4 = require("path");
 var import_toml = __toESM(require_toml());
 var DEFAULT_CONFIG_PATH = "/etc/threatcrush/threatcrushd.conf";
 var DEFAULT_CONFDIR = "/etc/threatcrush/threatcrushd.conf.d";
@@ -3266,11 +3417,11 @@ var DEFAULT_CONFIG = {
 };
 function loadConfig(configPath) {
   const path = configPath || DEFAULT_CONFIG_PATH;
-  if (!(0, import_node_fs7.existsSync)(path)) {
+  if (!(0, import_node_fs9.existsSync)(path)) {
     return { ...DEFAULT_CONFIG };
   }
   try {
-    const raw = (0, import_node_fs7.readFileSync)(path, "utf-8");
+    const raw = (0, import_node_fs9.readFileSync)(path, "utf-8");
     const parsed = import_toml.default.parse(raw);
     return {
       daemon: { ...DEFAULT_CONFIG.daemon, ...parsed.daemon },
@@ -3286,13 +3437,13 @@ function loadConfig(configPath) {
 function loadModuleConfigs(confDir) {
   const dir = confDir || DEFAULT_CONFDIR;
   const configs = /* @__PURE__ */ new Map();
-  if (!(0, import_node_fs7.existsSync)(dir)) {
+  if (!(0, import_node_fs9.existsSync)(dir)) {
     return configs;
   }
-  const files = (0, import_node_fs7.readdirSync)(dir).filter((f) => f.endsWith(".conf"));
+  const files = (0, import_node_fs9.readdirSync)(dir).filter((f) => f.endsWith(".conf"));
   for (const file of files) {
     try {
-      const raw = (0, import_node_fs7.readFileSync)((0, import_node_path2.join)(dir, file), "utf-8");
+      const raw = (0, import_node_fs9.readFileSync)((0, import_node_path4.join)(dir, file), "utf-8");
       const parsed = import_toml.default.parse(raw);
       for (const [name, config] of Object.entries(parsed)) {
         configs.set(name, config);
@@ -3406,15 +3557,15 @@ var ModuleHost = class {
     for (const m of builtins) this.modules.set(m.name, m);
   }
   async discoverAndStartInstalled() {
-    if (!(0, import_node_fs8.existsSync)(PATHS.moduleDir)) return;
+    if (!(0, import_node_fs10.existsSync)(PATHS.moduleDir)) return;
     const configs = loadModuleConfigs(PATHS.confD);
-    const entries = (0, import_node_fs8.readdirSync)(PATHS.moduleDir, { withFileTypes: true });
+    const entries = (0, import_node_fs10.readdirSync)(PATHS.moduleDir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const manifestPath = (0, import_node_path3.join)(PATHS.moduleDir, entry.name, "mod.toml");
-      if (!(0, import_node_fs8.existsSync)(manifestPath)) continue;
+      const manifestPath = (0, import_node_path5.join)(PATHS.moduleDir, entry.name, "mod.toml");
+      if (!(0, import_node_fs10.existsSync)(manifestPath)) continue;
       try {
-        const manifest = import_toml2.default.parse((0, import_node_fs8.readFileSync)(manifestPath, "utf-8"));
+        const manifest = import_toml2.default.parse((0, import_node_fs10.readFileSync)(manifestPath, "utf-8"));
         const name = manifest.module?.name || entry.name;
         const defaults = manifest.module?.config?.defaults || {};
         const config = {
@@ -3428,7 +3579,7 @@ var ModuleHost = class {
           source: "installed",
           status: config.enabled === false ? "disabled" : "loaded",
           events: 0,
-          path: (0, import_node_path3.join)(PATHS.moduleDir, entry.name),
+          path: (0, import_node_path5.join)(PATHS.moduleDir, entry.name),
           config
         };
         this.modules.set(name, hosted);
@@ -3443,7 +3594,7 @@ var ModuleHost = class {
           status: "error",
           events: 0,
           detail: `manifest load failed: ${String(err.message || err)}`,
-          path: (0, import_node_path3.join)(PATHS.moduleDir, entry.name)
+          path: (0, import_node_path5.join)(PATHS.moduleDir, entry.name)
         });
       }
     }
@@ -3455,6 +3606,13 @@ var ModuleHost = class {
       hosted.detail = "no built entrypoint found; run npm install && npm run build in the module directory";
       return;
     }
+    const trust = verifyModuleTrust(hosted.name, hosted.path);
+    if (!trust.ok) {
+      hosted.status = "error";
+      hosted.detail = `refusing to load: ${trust.reason}`;
+      this.bus.announceModule(hosted.name, "error", hosted.detail);
+      return;
+    }
     try {
       const imported = await import((0, import_node_url.pathToFileURL)(entrypoint).href);
       const exported = imported.default || imported.module || imported;
@@ -3475,17 +3633,17 @@ var ModuleHost = class {
     }
   }
   installedEntrypoint(modulePath) {
-    const packageJson = (0, import_node_path3.join)(modulePath, "package.json");
+    const packageJson = (0, import_node_path5.join)(modulePath, "package.json");
     const candidates = [];
-    if ((0, import_node_fs8.existsSync)(packageJson)) {
+    if ((0, import_node_fs10.existsSync)(packageJson)) {
       try {
-        const pkg = JSON.parse((0, import_node_fs8.readFileSync)(packageJson, "utf-8"));
-        if (pkg.main) candidates.push((0, import_node_path3.join)(modulePath, pkg.main));
+        const pkg = JSON.parse((0, import_node_fs10.readFileSync)(packageJson, "utf-8"));
+        if (pkg.main) candidates.push((0, import_node_path5.join)(modulePath, pkg.main));
       } catch {
       }
     }
-    candidates.push((0, import_node_path3.join)(modulePath, "dist", "index.js"), (0, import_node_path3.join)(modulePath, "index.js"));
-    return candidates.find((candidate) => (0, import_node_fs8.existsSync)(candidate)) || null;
+    candidates.push((0, import_node_path5.join)(modulePath, "dist", "index.js"), (0, import_node_path5.join)(modulePath, "index.js"));
+    return candidates.find((candidate) => (0, import_node_fs10.existsSync)(candidate)) || null;
   }
   isThreatCrushModule(value) {
     return Boolean(
@@ -3757,14 +3915,14 @@ function slackChannel(webhookUrl) {
 }
 
 // src/core/cli-config.ts
-var import_node_fs9 = require("fs");
-var import_node_path4 = require("path");
+var import_node_fs11 = require("fs");
+var import_node_path6 = require("path");
 var import_node_os2 = require("os");
-var CLI_CONFIG_DIR = (0, import_node_path4.join)((0, import_node_os2.homedir)(), ".threatcrush");
-var CLI_CONFIG_PATH = (0, import_node_path4.join)(CLI_CONFIG_DIR, "config.json");
+var CLI_CONFIG_DIR = (0, import_node_path6.join)((0, import_node_os2.homedir)(), ".threatcrush");
+var CLI_CONFIG_PATH = (0, import_node_path6.join)(CLI_CONFIG_DIR, "config.json");
 function readCliConfig() {
   try {
-    return JSON.parse((0, import_node_fs9.readFileSync)(CLI_CONFIG_PATH, "utf-8"));
+    return JSON.parse((0, import_node_fs11.readFileSync)(CLI_CONFIG_PATH, "utf-8"));
   } catch {
     return {};
   }
@@ -3783,8 +3941,8 @@ function authHeaders() {
 }
 
 // src/commands/scan.ts
-var import_node_fs12 = require("fs");
-var import_node_path8 = require("path");
+var import_node_fs14 = require("fs");
+var import_node_path10 = require("path");
 
 // ../../node_modules/.pnpm/chalk@5.6.2/node_modules/chalk/source/vendor/ansi-styles/index.js
 var ANSI_BACKGROUND_OFFSET = 10;
@@ -4310,6 +4468,357 @@ function workerId() {
   return `${import_node_os4.default.hostname()}/${process.pid}`;
 }
 
+// ../../packages/scan/src/node-rules.ts
+var PATH_CONTAINMENT_GUARD = /\bstartsWith\s*\(|\brelative\s*\(|\bnormalize\s*\(|\brealpath\b|\bisInside\b|\bwithin\s*\(|\bsanitiz\w*\b/i;
+var ARCHIVE_LIBRARY = /\b(?:adm-zip|unzipper|yauzl|node-stream-zip|extract-zip|decompress|tar-stream|tar-fs)\b|require\s*\(\s*['"]tar['"]|from\s+['"]tar['"]/;
+var HEADLESS_BROWSER = /\b(?:puppeteer|playwright|phantom|phantomjs|wkhtmltopdf|wkhtmltoimage|chrome-aws-lambda|html-pdf)\b/;
+var ORIGIN_ALLOWLIST_GUARD = /\b(?:includes|indexOf|has|test|find|some)\s*\(/;
+var FUNCTION_DESERIALIZER = /\b(?:node-serialize|serialize-to-js|funcster|cryo)\b/;
+var CONCATENATED_STRING = String.raw`(?:"[^"\n]*"|'[^'\n]*')\s*\+`;
+var INTERPOLATED_TEMPLATE = "`[^`\\n]*\\$\\{";
+var NODE_RULES = [
+  // ── Code execution ───────────────────────────────────────────────────────
+  {
+    id: "js-vm-untrusted-execution",
+    title: "script compiled and run by the `vm` module",
+    consequence: "Node\u2019s `vm` is not a security boundary \u2014 it isolates globals, not the process. Code reaching it can walk back out through any object it is handed and runs with the server\u2019s full privileges.",
+    cwe: "CWE-94",
+    severity: "critical",
+    languages: ["javascript", "typescript"],
+    pattern: /\bvm\s*\.\s*(?:runInNewContext|runInThisContext|runInContext|compileFunction)\s*\(|\bnew\s+vm\s*\.\s*Script\s*\(/,
+    // A `vm` call whose source is a build-time constant is a plugin loader, not
+    // a vulnerability. The class only becomes real once the script text can be
+    // influenced, so require that evidence before reporting at full severity.
+    needsContext: true
+  },
+  {
+    id: "js-vm2-sandbox",
+    title: "`vm2` used as a sandbox",
+    consequence: "vm2 was discontinued after a series of escapes that its maintainer judged unfixable by design. Any code it runs should be assumed to run on the host.",
+    cwe: "CWE-1104",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\bnew\s+(?:NodeVM|VMScript)\s*\(|\bfrom\s+['"]vm2['"]|require\s*\(\s*['"]vm2['"]\s*\)/,
+    // Nothing on the surrounding lines changes the answer: the package itself
+    // is the finding, the same way a broken cipher is.
+    inherent: true
+  },
+  {
+    id: "js-function-deserialization",
+    title: "deserialiser that reconstructs functions",
+    consequence: "These formats encode functions alongside data and invoke them on load, so parsing an attacker\u2019s payload is executing it. No amount of validation after the parse call helps \u2014 the code has already run.",
+    cwe: "CWE-502",
+    severity: "critical",
+    languages: ["javascript", "typescript"],
+    pattern: /\b(?:unserialize|deepDeserialize|deserialize)\s*\(/,
+    // Without this the rule fires on every project that happens to own a
+    // function called `deserialize`, which is most of them. The import is what
+    // makes the call the dangerous one.
+    fileRequires: FUNCTION_DESERIALIZER,
+    // The parse *is* the execution, so nearby input cannot make it worse and
+    // its absence cannot make it safe. Nobody round-trips a constant through
+    // these libraries.
+    inherent: true
+  },
+  {
+    id: "js-template-injection",
+    title: "template compiled from a non-constant source",
+    consequence: "Template languages are programming languages. A user-supplied template body is remote code execution, not cross-site scripting \u2014 the expression runs on the server before any output is escaped.",
+    cwe: "CWE-1336",
+    severity: "critical",
+    languages: ["javascript", "typescript"],
+    pattern: /\b(?:handlebars|Handlebars|hbs|ejs|pug|jade|nunjucks|eta|twig|dot|doT|liquid|mustache)\s*\.\s*(?:compile|compileFile|render|renderString)\s*\(\s*(?:`[^`\n]*\$\{|[a-zA-Z_$][\w$.]*\s*[,)]|[a-zA-Z_$][\w$.]*\s*\+)/,
+    // Rendering a template held in a variable is the normal case — it was read
+    // from a file at boot. Only the version where request data reaches the
+    // template *body* is this class.
+    needsContext: true
+  },
+  {
+    id: "js-shelljs-command-execution",
+    title: "shelljs command assembled from a string",
+    consequence: "`shell.exec` runs its argument through a shell, so a `;` or backtick in an interpolated value runs as the server user.",
+    cwe: "CWE-78",
+    severity: "critical",
+    languages: ["javascript", "typescript"],
+    pattern: new RegExp(
+      `\\b(?:shell|shelljs|sh)\\s*\\.\\s*exec\\s*\\(\\s*(?:${INTERPOLATED_TEMPLATE}|${CONCATENATED_STRING}|[a-zA-Z_$][\\w$]*\\s*\\+)`
+    ),
+    fileRequires: /\bshelljs\b/
+  },
+  // ── Injection ────────────────────────────────────────────────────────────
+  {
+    id: "js-nosql-where-expression",
+    title: "MongoDB `$where` built by string assembly",
+    consequence: "`$where` is evaluated as JavaScript by the database server, once per document. An interpolated value can rewrite the predicate to `true` or run a denial-of-service loop inside the database.",
+    cwe: "CWE-943",
+    severity: "critical",
+    languages: ["javascript", "typescript"],
+    pattern: new RegExp(
+      `\\$where\\s*['"]?\\s*:\\s*(?:${INTERPOLATED_TEMPLATE}|${CONCATENATED_STRING})|\\.\\s*\\$where\\s*=\\s*(?:${INTERPOLATED_TEMPLATE}|${CONCATENATED_STRING})`
+    )
+  },
+  {
+    id: "js-xpath-injection",
+    title: "XPath expression built by concatenation",
+    consequence: "A quote in the interpolated value closes the predicate early, so the query selects nodes the caller was never meant to read \u2014 the XML equivalent of `OR 1=1`.",
+    cwe: "CWE-643",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    // An XPath expression is recognisable by its own syntax — a descendant
+    // axis or an attribute predicate. Matching on the *call* name alone would
+    // flag every `select(` in the ecosystem. The quoted forms are split per
+    // quote character for the reason given at CONCATENATED_STRING: the
+    // predicate that makes it XPath usually contains the other quote.
+    pattern: new RegExp(
+      `\\b(?:xpath|xpathSelect|select|selectNodes|selectSingleNode|evaluate|find)\\s*\\(\\s*(?:\`[^\`\\n]*(?:\\/\\/|\\[@)[^\`\\n]*\\$\\{|"[^"\\n]*(?:\\/\\/|\\[@)[^"\\n]*"\\s*\\+|'[^'\\n]*(?:\\/\\/|\\[@)[^'\\n]*'\\s*\\+)`
+    ),
+    fileRequires: /\bxpath\b|\bxmldom\b|\blibxmljs\b|\bxpath\.js\b/
+  },
+  {
+    id: "js-regex-from-input",
+    title: "regular expression compiled from a variable",
+    consequence: "A caller who controls the pattern controls the matcher: they can supply catastrophic backtracking to hang the event loop, or a permissive pattern that defeats whatever the regex was validating.",
+    cwe: "CWE-1333",
+    severity: "medium",
+    languages: ["javascript", "typescript"],
+    pattern: new RegExp(
+      `\\bnew\\s+RegExp\\s*\\(\\s*(?:${INTERPOLATED_TEMPLATE}|${CONCATENATED_STRING}|(?!['"\`/])[a-zA-Z_$][\\w$.]*\\s*[,)])`
+    ),
+    needsContext: true
+  },
+  // ── XML ──────────────────────────────────────────────────────────────────
+  {
+    id: "js-xml-external-entities",
+    title: "XML parser configured to resolve entities",
+    consequence: "An entity declaration in the document body makes the parser fetch a local file or an internal URL and paste the result into the parsed output \u2014 file disclosure and server-side request forgery from a document upload.",
+    cwe: "CWE-611",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    // The option name is the finding. Every parser in the ecosystem defaults
+    // these off, so an explicit `true` is a deliberate re-enable.
+    pattern: /\b(?:noent|resolveEntities|expandEntities|externalEntities|resolveExternals)\s*:\s*(?:true|1)\b/,
+    inherent: true
+  },
+  // ── Authentication and tokens ────────────────────────────────────────────
+  {
+    id: "js-jwt-none-algorithm",
+    title: "JWT algorithm set to `none`",
+    consequence: "The `none` algorithm means the signature is not checked. Anyone can mint a token with any claims \u2014 including another user\u2019s id or an admin role \u2014 by base64-encoding a header and a body.",
+    cwe: "CWE-347",
+    severity: "critical",
+    languages: ["javascript", "typescript"],
+    pattern: /\balgorithms?\s*:\s*\[?\s*['"]none['"]/i,
+    inherent: true
+  },
+  // ── Cryptography ─────────────────────────────────────────────────────────
+  {
+    id: "js-broken-cipher-algorithm",
+    title: "broken cipher selected",
+    consequence: "DES, 3DES, RC2, RC4, Blowfish and IDEA are all breakable with commodity hardware or have practical plaintext-recovery attacks. Data encrypted with them should be treated as encoded, not encrypted.",
+    cwe: "CWE-327",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\bcreate(?:Cipher|Decipher)(?:iv)?\s*\(\s*['"](?:des|des3|des-ede\w*|3des|rc2|rc4|bf|blowfish|cast5?|idea|seed)\b/i,
+    inherent: true
+  },
+  {
+    id: "js-ecb-mode-cipher",
+    title: "block cipher in ECB mode",
+    consequence: "ECB encrypts every block independently, so identical plaintext blocks produce identical ciphertext. Structure in the data survives encryption and blocks can be reordered or replayed without detection.",
+    cwe: "CWE-327",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\bcreate(?:Cipher|Decipher)(?:iv)?\s*\(\s*['"][^'"\n]*-ecb\b/i,
+    inherent: true
+  },
+  {
+    id: "js-legacy-cipher-api",
+    title: "deprecated `createCipher` used",
+    consequence: "`createCipher` derives the key from a passphrase with a single unsalted MD5 pass and uses a fixed all-zero IV, so the same passphrase always produces the same keystream. It was removed in Node 22.",
+    cwe: "CWE-327",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    // `createCipheriv` is the correct API and shares the prefix, so the
+    // negative look-ahead is what separates the finding from the fix.
+    pattern: /\bcrypto\s*\.\s*create(?:Cipher|Decipher)\s*\(/,
+    lineGuard: /create(?:Cipher|Decipher)iv\s*\(/,
+    inherent: true
+  },
+  // ── Cross-site scripting ─────────────────────────────────────────────────
+  {
+    id: "js-template-autoescape-disabled",
+    title: "template auto-escaping turned off",
+    consequence: "Auto-escaping is the control that makes a template engine safe by default. Disabling it globally means every interpolation in every template becomes an injection point, including ones written later by someone who assumed the default.",
+    cwe: "CWE-79",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\bautoescape\s*:\s*false\b|\bescape\s*:\s*false\b|\bnoEscape\s*:\s*true\b/,
+    inherent: true
+  },
+  {
+    id: "js-serialize-javascript-unsafe",
+    title: "`serialize-javascript` in unsafe mode",
+    consequence: "The `unsafe` flag turns off escaping of HTML-significant characters in the output. Embedding the result in a `<script>` block lets a string value close the tag and start a new one.",
+    cwe: "CWE-79",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\bunsafe\s*:\s*true\b/,
+    fileRequires: /\bserialize-javascript\b/,
+    inherent: true
+  },
+  {
+    id: "js-cors-origin-reflected",
+    title: "CORS origin reflected from the request",
+    consequence: "Echoing the caller\u2019s `Origin` header back as `Access-Control-Allow-Origin` allows every site, while looking like an allow-list. Combined with credentials, any page the victim visits can read their authenticated responses.",
+    cwe: "CWE-942",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    // Both spellings of the same mistake: writing the header directly, and
+    // handing the request's origin to a CORS middleware's `origin` option.
+    //
+    // An earlier draft also matched a bare variable — `setHeader('…', origin)`
+    // — which is wrong. A variable holding a *validated* origin is exactly
+    // what the correct implementation looks like, and the rule cannot tell the
+    // two apart. Only the visible read from the request qualifies.
+    pattern: /\bAccess-Control-Allow-Origin['"]\s*,\s*(?:req|request|ctx)\s*\.|\borigin\s*:\s*(?:req|request|ctx)\s*\./,
+    // Reflecting the header is the defect whatever surrounds it; there is no
+    // arrangement of nearby lines that makes an echoed origin safe — except a
+    // membership test on the value, which is what the guard looks for.
+    inherent: true,
+    guard: ORIGIN_ALLOWLIST_GUARD,
+    /**
+     * Logging the origin is not reflecting it.
+     *
+     * `origin: request.headers.origin` is the CORS mistake *and* the ordinary
+     * way to record who called — the two are character-for-character
+     * identical, and only what encloses them differs. A response header goes
+     * out to the browser; a log line goes to stdout, where it grants nobody
+     * anything.
+     */
+    enclosingCallGuard: /(?:^|\.)(?:log|debug|info|warn|error|trace|verbose|fatal)$/
+  },
+  // ── Server-side request forgery ──────────────────────────────────────────
+  {
+    id: "js-headless-browser-navigation",
+    title: "headless browser sent to a non-constant URL",
+    consequence: "The browser runs on the server, inside the private network. A controlled URL reaches the cloud metadata endpoint, localhost admin panels and internal services \u2014 and `file://` reads the disk.",
+    cwe: "CWE-918",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\.\s*(?:goto|setContent|navigate)\s*\(\s*(?:`[^`\n]*\$\{|(?!['"`])[a-zA-Z_$][\w$.]*\s*[,)])/,
+    fileRequires: HEADLESS_BROWSER,
+    needsContext: true
+  },
+  // ── Path handling ────────────────────────────────────────────────────────
+  {
+    id: "js-archive-entry-path",
+    title: "archive entry written to a path built from its own name",
+    consequence: "An entry named `../../etc/cron.d/x` escapes the extraction directory when its name is joined to the destination. Overwriting a file outside the target \u2014 a systemd unit, an SSH key, a deployed script \u2014 is code execution on the next run.",
+    cwe: "CWE-22",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\b(?:join|resolve)\s*\(\s*[^,\n)]+,\s*[a-zA-Z_$][\w$]*\s*\.\s*(?:entryName|fileName|filename|name|path)\b/,
+    fileRequires: ARCHIVE_LIBRARY,
+    guard: PATH_CONTAINMENT_GUARD,
+    // The containment check comes *after* the join — you build the path, then
+    // verify it stayed inside. A backwards-only window would miss every
+    // correct implementation and report the safe code alongside the unsafe.
+    guardForward: 3
+  },
+  // ── Electron ─────────────────────────────────────────────────────────────
+  {
+    id: "js-electron-node-integration",
+    title: "Electron renderer given Node access",
+    consequence: "With node integration on \u2014 or context isolation off \u2014 any script that reaches the page reaches `require`. A single XSS in rendered content becomes `child_process.exec` on the user\u2019s machine.",
+    cwe: "CWE-1188",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\bnodeIntegration(?:InWorker|InSubFrames)?\s*:\s*true\b|\bcontextIsolation\s*:\s*false\b|\benableRemoteModule\s*:\s*true\b|\bsandbox\s*:\s*false\b/,
+    inherent: true
+  },
+  {
+    id: "js-electron-web-security-disabled",
+    title: "Electron web security disabled",
+    consequence: "Turning off `webSecurity` drops the same-origin policy for the window, so remote content can read local files and every other origin the app has loaded.",
+    cwe: "CWE-1173",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\bwebSecurity\s*:\s*false\b|\ballowRunningInsecureContent\s*:\s*true\b|\bwebviewTag\s*:\s*true\b/,
+    inherent: true
+  },
+  {
+    id: "js-electron-open-external",
+    title: "Electron `openExternal` with a non-constant URL",
+    consequence: "`shell.openExternal` hands the string to the operating system\u2019s handler. A `file://` path executes a local binary and, on Windows, an SMB path executes a remote one.",
+    cwe: "CWE-749",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\bshell\s*\.\s*openExternal\s*\(\s*(?:`[^`\n]*\$\{|(?!['"`])[a-zA-Z_$][\w$.]*\s*[,)])/,
+    needsContext: true
+  },
+  // ── Hardening and resource limits ────────────────────────────────────────
+  {
+    id: "js-helmet-protection-disabled",
+    title: "security header explicitly disabled",
+    consequence: "Each of these switches off a browser-side protection that was already on. The header stops being sent, so the defence it enables \u2014 framing, sniffing, referrer leakage, transport downgrade \u2014 is available to an attacker again.",
+    cwe: "CWE-693",
+    severity: "medium",
+    languages: ["javascript", "typescript"],
+    pattern: /\b(?:contentSecurityPolicy|frameguard|hsts|noSniff|xssFilter|hidePoweredBy|referrerPolicy|dnsPrefetchControl|ieNoOpen|permittedCrossDomainPolicies|crossOriginEmbedderPolicy|crossOriginOpenerPolicy|crossOriginResourcePolicy|originAgentCluster)\s*:\s*false\b/,
+    inherent: true
+  },
+  {
+    id: "js-buffer-bounds-check-disabled",
+    title: "buffer bounds checking turned off",
+    consequence: "With `noAssert` the read or write is not range-checked, so an offset past the end of the buffer returns adjacent heap memory or corrupts it instead of throwing.",
+    cwe: "CWE-125",
+    severity: "medium",
+    languages: ["javascript", "typescript"],
+    // The trailing `true` on a Buffer numeric accessor *is* `noAssert` — it is
+    // the last positional parameter of every one of these methods. Anchoring
+    // on the accessor name is what keeps this from matching `, true)` on any
+    // call in the codebase.
+    pattern: /\b(?:read|write)(?:U?Int(?:8|16|32)(?:[BL]E)?|U?Int[BL]E|Float[BL]E|Double[BL]E)\s*\([^)\n]*,\s*true\s*\)|\bnoAssert\s*:\s*true\b/,
+    inherent: true
+  },
+  {
+    id: "js-uninitialized-buffer",
+    title: "buffer allocated without zeroing",
+    consequence: "`allocUnsafe` and the old `new Buffer(size)` hand back whatever was previously in that heap memory \u2014 keys, session tokens, other users\u2019 request bodies. Anything not overwritten before the buffer is sent leaks it.",
+    cwe: "CWE-908",
+    severity: "medium",
+    languages: ["javascript", "typescript"],
+    pattern: /\bBuffer\s*\.\s*allocUnsafe(?:Slow)?\s*\(|\bnew\s+Buffer\s*\(\s*(?![`'"])[a-zA-Z_$0-9]/,
+    inherent: true
+  },
+  {
+    id: "js-oversized-request-body-limit",
+    title: "request body limit raised to a very large value",
+    consequence: "A body limit in the tens of megabytes lets a handful of concurrent requests exhaust memory, and the parse happens before any authentication check the route performs.",
+    cwe: "CWE-400",
+    severity: "medium",
+    languages: ["javascript", "typescript"],
+    // Two or more digits before `mb` — 50mb and up. A limit is a *good* thing;
+    // only an ineffective one is the finding.
+    pattern: /\blimit\s*:\s*['"]\s*(?:[5-9]\d|\d{3,})\s*mb\s*['"]|\blimit\s*:\s*['"]\s*\d+\s*gb\s*['"]/i,
+    inherent: true
+  },
+  // ── Information disclosure ───────────────────────────────────────────────
+  {
+    id: "js-error-detail-returned",
+    title: "error object or stack trace sent to the client",
+    consequence: "A stack trace names absolute paths, package versions and internal function names, and framework errors often carry the failing query or connection string with them. It is a map of the server, handed out on request.",
+    cwe: "CWE-209",
+    severity: "medium",
+    languages: ["javascript", "typescript"],
+    // `res.status(500).send(…)` is the overwhelmingly common spelling, so the
+    // optional `.status(…)` hop is not a nicety — without it the rule misses
+    // nearly every real occurrence.
+    pattern: /\bres\s*\.\s*(?:status\s*\([^)\n]*\)\s*\.\s*)?(?:send|json|end|write)\s*\(\s*(?:[a-zA-Z_$][\w$]*\s*\.\s*stack\b|(?:error|err|e)\s*[,)])|\.\s*(?:send|json)\s*\(\s*\{[^}\n]*\b(?:stack|err|error)\s*:\s*(?:error|err|e)\s*[,}]/,
+    inherent: true
+  }
+];
+
 // ../../packages/scan/src/types.ts
 var SEVERITY_ORDER = ["info", "low", "medium", "high", "critical"];
 function severityRank(severity) {
@@ -4356,7 +4865,20 @@ var GENERIC_GUARD = (
   // The identifier must END at the escaper (with at most a known output-context
   // suffix). An earlier, looser form also matched `describe(`, which would have
   // silenced findings across every test file in every repository.
-  /\ballow(?:ed|list|_list|ed_hosts)?\b|\bwhitelist\b|\b\w{0,6}[Ee]sc(?:ape)?(?:[Hh]tml|HTML|[Xx]ml|XML|[Ss]ql|[Aa]ttr|[Jj]s|[Uu]ri|[Uu]rl)?\s*\(|\bhtml_escape\b|\bhtmlspecialchars\s*\(|\bsanitiz\w*\b|\bencoded\b|\brealpath\b|\bcommonpath\b|\bresolve\(\)\.startsWith\b|\bprocess\.env\b|\bos\.environ\b|\bgetenv\b|\bENV\s*\[|setObjectInputFilter|ObjectInputFilter/i
+  // The `Access-Control-` lookbehind is not a nicety. This regex is
+  // case-insensitive, and `Access-Control-Allow-Origin` contains the word
+  // "Allow" followed by a non-word character — so the CORS header name matched
+  // the allow-list heuristic. Because the guard is tested against an 8-line
+  // *window*, one header line silently disabled every guardable rule near it:
+  // in a four-line Express error handler, the header on one line suppressed
+  // both the `none`-algorithm JWT finding and the returned stack trace below
+  // it. The failure mode is the dangerous kind — not fewer findings, none, and
+  // indistinguishable from clean code.
+  //
+  // Scoped to the header prefix rather than to a bare `allow(?!-)`, because
+  // this guard also runs over `.yml` and `.conf` files, where `allow-list:`
+  // and `allowed-hosts:` are ordinary keys that should still guard.
+  /(?<!Access-Control-)\ballow(?:ed|list|_list|ed_hosts)?\b|\bwhitelist\b|\b\w{0,6}[Ee]sc(?:ape)?(?:[Hh]tml|HTML|[Xx]ml|XML|[Ss]ql|[Aa]ttr|[Jj]s|[Uu]ri|[Uu]rl)?\s*\(|\bhtml_escape\b|\bhtmlspecialchars\s*\(|\bsanitiz\w*\b|\bencoded\b|\brealpath\b|\bcommonpath\b|\bresolve\(\)\.startsWith\b|\bprocess\.env\b|\bos\.environ\b|\bgetenv\b|\bENV\s*\[|setObjectInputFilter|ObjectInputFilter/i
 );
 var XXE_GUARD = /FEATURE_SECURE_PROCESSING|setExpandEntityReferences|disallow-doctype-decl|external-general-entities|external-parameter-entities|setXIncludeAware\s*\(\s*false/;
 var XML_PARSING_FILE = /\b(?:javax\.xml|org\.xml\.sax|org\.w3c\.dom|org\.jdom2?|org\.dom4j|XmlPullParser|DocumentBuilderFactory|DocumentBuilder|SAXParserFactory|SAXParser|XMLInputFactory|XMLReaderFactory|XMLReader|SAXBuilder|SAXReader)\b/;
@@ -4422,7 +4944,8 @@ var CODE_RULES = [
     cwe: "CWE-78",
     severity: "critical",
     languages: ["javascript", "typescript"],
-    pattern: /\b(?:exec|execSync|spawn|spawnSync)\s*\(\s*(?:`[^`]*\$\{|['"][^'"]*['"]\s*\+|[a-zA-Z_$][\w$]*\s*\+)/
+    pattern: /\b(?:exec|execSync|spawn|spawnSync)\s*\(\s*(?:`[^`]*\$\{|['"][^'"]*['"]\s*\+|[a-zA-Z_$][\w$]*\s*\+)/,
+    constantInterpolationGuard: true
   },
   {
     id: "py-shell-command-string",
@@ -4784,6 +5307,20 @@ var CODE_RULES = [
     consequence: "Catastrophic backtracking: a crafted input of a few dozen characters pins a CPU core for minutes.",
     cwe: "CWE-1333",
     severity: "medium",
+    // Scoped, because unscoped this rule reads C as if it were a regex.
+    //
+    // `(void *)*memptr64` — a cast to a pointer type, then a dereference — is
+    // the single most ordinary line in a C file, and it matches the first
+    // alternative exactly: `(`, some text, `*`, `)`, `*`. Every `*(char *)*p`
+    // in a codebase became a ReDoS finding. Caught on inspektor-gadget, where
+    // the rule's one and only hit across 1186 files was a `bpf_probe_read_user`
+    // call in an eBPF C program.
+    //
+    // Scoping is the fix rather than a cleverer pattern: C has no regex
+    // literals, so there is nothing here for the rule to find no matter how
+    // the pattern is written. `other` also covers C++, Rust and Zig, which
+    // share the cast-then-deref spelling.
+    languages: ["javascript", "typescript", "python", "ruby", "go", "java", "php"],
     pattern: /\([^)\n]*[+*]\s*\)\s*[+*]|\([^)\n]*\{\d+,\}\s*\)\s*[+*{]/
   },
   // ── Temporary files ──────────────────────────────────────────────────────
@@ -5307,8 +5844,27 @@ var CODE_RULES = [
     cwe: "CWE-346",
     severity: "high",
     languages: ["javascript", "typescript"],
-    pattern: /\$\{[^}\n]*\breq(?:uest)?\s*\.\s*(?:headers\s*\.\s*host|hostname|host)\b|['"`]\s*\+\s*req(?:uest)?\s*\.\s*(?:headers\s*\.\s*host|hostname)\b/
-  }
+    pattern: /\$\{[^}\n]*\breq(?:uest)?\s*\.\s*(?:headers\s*\.\s*host|hostname|host)\b|['"`]\s*\+\s*req(?:uest)?\s*\.\s*(?:headers\s*\.\s*host|hostname)\b/,
+    /**
+     * Parsing the request's own URL is not building a link from the Host
+     * header, even though it is spelled with one.
+     *
+     *     const url = new URL(request.url, `http://${request.headers.host}`);
+     *     const token = url.searchParams.get('token');
+     *
+     * `request.url` on a Node server is a path — `/ws?token=…` — and `new URL`
+     * refuses a relative input without a base. The base exists to satisfy the
+     * parser and is thrown away; only the path and query are ever read. Every
+     * Node HTTP handler that wants a query parameter is written this way, so
+     * the rule fired on the framework idiom rather than on the defect.
+     *
+     * Narrow on purpose: the first argument must be `req.url` itself. The
+     * dangerous shape passes a *path* the application chose —
+     * `new URL('/reset?t=…', `https://${req.headers.host}`)` — and that is what
+     * produces an attacker-controlled link. It does not match this guard.
+     */
+    lineGuard: /\bnew\s+URL\s*\(\s*(?:req|request|ctx)(?:uest)?\s*\.\s*url\b\s*,/
+  },
   // A recursive-merge prototype-pollution rule (`target[key] = source[key]`
   // with no `__proto__` guard) was built and dropped. The bare copy-by-key is
   // the safe allow-listed shape (`updates[field] = body[field]` over an
@@ -5318,6 +5874,11 @@ var CODE_RULES = [
   // answer. It flagged legitimate merges in Capacitor and in this repo's own
   // web app. `js-prototype-pollution` still catches the explicit `__proto__`
   // literal; the recursive-merge case is left to KNOWN_GAPS.
+  // Node-ecosystem classes — vm2, Electron, JWT, archive extraction, headless
+  // browsers — are kept in their own table because each has to know which
+  // package it is looking at before it can claim anything. Folded in here so
+  // there stays exactly one rule list for every consumer to iterate.
+  ...NODE_RULES
 ];
 var COMMENT_PREFIX = /^\s*(?:\/\/|\/\*|\*|#|--|<!--)/;
 var DEFINITION_PREFIX = /^\s*(?:(?:export|public|private|protected|static|final|async|abstract)\s+)*(?:def|function|func|class|module|interface|struct|impl|fn|sub)\b/;
@@ -5370,6 +5931,55 @@ function fileTextOf(lines) {
 function withoutSingleQuoted(text) {
   return text.replace(/'[^'\n]*'/g, "''");
 }
+function calleeEndingAt(text, open) {
+  let end = open;
+  while (end > 0 && (text[end - 1] === " " || text[end - 1] === "	")) end -= 1;
+  let start = end;
+  while (start > 0 && /[\w$.]/.test(text[start - 1])) start -= 1;
+  return text.slice(start, end);
+}
+function enclosingCallees(lines, index, back) {
+  const before = lines.slice(Math.max(0, index - back), index).join("\n");
+  const stack = [];
+  let quote = null;
+  for (let i = 0; i < before.length; i += 1) {
+    const ch = before[i];
+    if (quote) {
+      if (ch === "\\") i += 1;
+      else if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") quote = ch;
+    else if (ch === "(") stack.push(calleeEndingAt(before, i));
+    else if (ch === ")") stack.pop();
+  }
+  return stack;
+}
+function interpolations(line) {
+  const found = [];
+  for (let i = 0; ; ) {
+    const start = line.indexOf("${", i);
+    if (start === -1) break;
+    const end = line.indexOf("}", start + 2);
+    if (end === -1) return null;
+    found.push(line.slice(start + 2, end).trim());
+    i = end + 1;
+  }
+  return found.length > 0 ? found : null;
+}
+function isConstantString(name, fileText) {
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(
+    `\\bconst\\s+${escaped}\\s*(?::[^=\\n]+)?=\\s*(?:'[^'\\n]*'|"[^"\\n]*"|\`[^\`$\\n]*\`)`
+  ).test(fileText);
+}
+function interpolationsAreConstant(line, fileText) {
+  const found = interpolations(line);
+  if (!found) return false;
+  return found.every(
+    (expr) => /^[A-Za-z_$][\w$]*$/.test(expr) && isConstantString(expr, fileText)
+  );
+}
 function evaluateRule(rule, ctx) {
   if (rule.languages && !rule.languages.includes(ctx.language)) return null;
   const line = ctx.lines[ctx.index] ?? "";
@@ -5381,6 +5991,13 @@ function evaluateRule(rule, ctx) {
   const context = windowText(ctx.lines, ctx.index, back, forward, ctx.prose);
   if (rule.requires && !rule.requires.test(context)) return null;
   if (rule.lineGuard?.test(line)) return null;
+  if (rule.enclosingCallGuard) {
+    const callees = enclosingCallees(ctx.lines, ctx.index, back);
+    if (callees.some((callee) => rule.enclosingCallGuard.test(callee))) return null;
+  }
+  if (rule.constantInterpolationGuard && interpolationsAreConstant(line, fileTextOf(ctx.lines))) {
+    return null;
+  }
   const guard = rule.guard === void 0 ? GENERIC_GUARD : rule.guard;
   if (guard && (guard.test(line) || guard.test(context))) return null;
   const untrusted = untrustedPatternFor(ctx.language);
@@ -5392,6 +6009,188 @@ function evaluateRule(rule, ctx) {
   return { rule, confidence, severity: severityFor(rule.severity, confidence) };
 }
 
+// ../../packages/scan/src/template-rules.ts
+var LAYOUT_SLOT = /\{\{\{\s*(?:body|content|outlet|children)\s*\}\}\}/;
+var XSS_CONSEQUENCE = "The value is written into the page as markup rather than as text, so a `<script>` or an `onerror=` attribute in it executes in the visitor\u2019s session \u2014 with their cookies, and their privileges.";
+var TEMPLATE_RULES = [
+  {
+    id: "tpl-handlebars-unescaped",
+    title: "Handlebars/Mustache interpolation that skips escaping",
+    consequence: XSS_CONSEQUENCE,
+    cwe: "CWE-79",
+    severity: "high",
+    extensions: [".hbs", ".handlebars", ".hdbs", ".mustache", ".ms"],
+    // Two spellings of the same opt-out: the triple-stache and the `&` prefix.
+    pattern: /\{\{\{(?!\{)[^}]*\}\}\}|\{\{\s*&\s*[^}]+\}\}/,
+    lineGuard: LAYOUT_SLOT
+  },
+  {
+    id: "tpl-vue-v-html",
+    title: "`v-html` binding",
+    consequence: XSS_CONSEQUENCE,
+    cwe: "CWE-79",
+    severity: "high",
+    extensions: [".vue", ".html", ".htm"],
+    pattern: /\bv-html\s*=|\s:inner-html\.prop\s*=/
+  },
+  {
+    id: "tpl-pug-unescaped",
+    title: "Pug/Jade unescaped interpolation",
+    consequence: XSS_CONSEQUENCE,
+    cwe: "CWE-79",
+    severity: "high",
+    extensions: [".pug", ".jade"],
+    // `!{…}` is unescaped interpolation anywhere on the line. `!=` is
+    // unescaped buffered code, but only in the tag position — anchored to the
+    // start of the line and preceded by nothing but tag, class and id
+    // characters, so the `!==` inside `- if (a !== b)` cannot reach it.
+    pattern: /!\{[^}\n]*\}|^\s*[\w.#%-]*!=(?!=)\s*\S/
+  },
+  {
+    id: "tpl-ejs-raw-output",
+    title: "EJS/ECT raw output tag",
+    consequence: XSS_CONSEQUENCE,
+    cwe: "CWE-79",
+    severity: "high",
+    extensions: [".ejs", ".ect"],
+    // In EJS `<%= %>` escapes and `<%-` does not, which is the reverse of
+    // Underscore's convention — see KNOWN_GAPS.
+    pattern: /<%-(?!\s*(?:include|-))/,
+    // `<%- include('partial') %>` splices another template, not user data.
+    lineGuard: /<%-\s*(?:include|partial)\s*\(/
+  },
+  {
+    id: "tpl-dust-escape-filter-off",
+    title: "Dust reference with escaping suppressed",
+    consequence: XSS_CONSEQUENCE,
+    cwe: "CWE-79",
+    severity: "high",
+    extensions: [".dust", ".tl"],
+    // The `|s` filter means "suppress the default HTML escape".
+    pattern: /\{[^{}\n]+\|\s*s\s*\}/
+  },
+  {
+    id: "tpl-jinja-safe-filter",
+    title: "Nunjucks/Twig/Jinja `safe` filter or autoescape block off",
+    consequence: XSS_CONSEQUENCE,
+    cwe: "CWE-79",
+    severity: "high",
+    extensions: [".njk", ".nunjucks", ".twig", ".jinja", ".jinja2", ".j2"],
+    pattern: /\|\s*(?:safe|raw)\s*(?:\}\}|\|)|\{%\s*autoescape\s+(?:false|off)\s*%\}/
+  },
+  {
+    id: "tpl-haml-unescaped",
+    title: "Haml unescaped output",
+    consequence: XSS_CONSEQUENCE,
+    cwe: "CWE-79",
+    severity: "high",
+    extensions: [".haml"],
+    pattern: /^\s*[\w.#%-]*!=(?!=)\s*\S/
+  }
+];
+var TEMPLATE_EXTENSIONS = new Set(
+  TEMPLATE_RULES.flatMap((rule) => rule.extensions)
+);
+function evaluateTemplateRules(extension, lines) {
+  const ext = extension.toLowerCase();
+  const applicable = TEMPLATE_RULES.filter((rule) => rule.extensions.includes(ext));
+  if (applicable.length === 0) return [];
+  const matches = [];
+  lines.forEach((line, index) => {
+    for (const rule of applicable) {
+      if (!rule.pattern.test(line)) continue;
+      if (rule.lineGuard?.test(line)) continue;
+      matches.push({
+        rule,
+        // A template cannot show that the value is untrusted, so the claim
+        // never rises above `pattern` and the shared cap holds it at medium.
+        severity: severityFor(rule.severity, "pattern"),
+        line: index + 1
+      });
+    }
+  });
+  return matches;
+}
+
+// ../../packages/scan/src/controls.ts
+var SERVER_FRAMEWORK = /\bexpress\s*\(\s*\)|\bnew\s+Koa\s*\(|\bfastify\s*\(|\brequire\s*\(\s*['"](?:express|koa|@hapi\/hapi|restify)['"]\s*\)|\bfrom\s+['"](?:express|koa|@hapi\/hapi|restify)['"]|\bhttp\s*\.\s*createServer\s*\(|\bNestFactory\s*\.\s*create\s*\(/;
+var SECURITY_CONTROLS = [
+  {
+    id: "control-security-headers-absent",
+    title: "no security header middleware",
+    consequence: "Without them the browser applies no framing protection, sniffs content types, sends full referrers cross-origin and never learns to require HTTPS \u2014 a set of defences that cost one line to enable.",
+    cwe: "CWE-693",
+    severity: "medium",
+    evidence: /\bhelmet\b|\bkoa-helmet\b|\b@fastify\/helmet\b|\blusca\b|Strict-Transport-Security|Content-Security-Policy|X-Frame-Options|X-Content-Type-Options/i
+  },
+  {
+    id: "control-anti-csrf-absent",
+    title: "no cross-site request forgery protection",
+    consequence: "A cookie-authenticated endpoint with no token check can be driven by a form on any other site \u2014 the browser attaches the session automatically, so the victim only has to visit a page.",
+    cwe: "CWE-352",
+    severity: "medium",
+    // SameSite counts. A cookie the browser refuses to send cross-site is not
+    // reachable by the attack this control exists to stop, so a project that
+    // chose that route instead of tokens has the control, not a gap.
+    evidence: /\bcsurf\b|\bcsrf\b|\bxsrf\b|\blusca\b|\b@fastify\/csrf\b|\bdouble-csrf\b|\bsameSite\s*:\s*['"](?:strict|lax)['"]/i
+  },
+  {
+    id: "control-rate-limiting-absent",
+    title: "no request rate limiting",
+    consequence: "Login and password-reset endpoints with no limiter can be tried at the speed of the network \u2014 credential stuffing, token brute force and enumeration all become a matter of waiting.",
+    cwe: "CWE-770",
+    severity: "medium",
+    evidence: /\bexpress-rate-limit\b|\brateLimit\b|\brate-limiter\b|\bratelimit\b|\bexpress-slow-down\b|\bslowDown\b|\bbottleneck\b|\bthrottle\b/i
+  },
+  {
+    id: "control-body-size-limit-absent",
+    title: "no request body size limit",
+    consequence: "The body is parsed into memory before any handler \u2014 and before any authentication check \u2014 so unbounded parsing lets a few concurrent requests exhaust the process.",
+    cwe: "CWE-400",
+    severity: "medium",
+    evidence: /\blimit\s*:\s*['"]?\d+\s*(?:kb|mb|b)\b|\bbodyLimit\b|\bmaxRequestBodySize\b|\bclient_max_body_size\b/i
+  }
+];
+var ControlAudit = class {
+  seen = /* @__PURE__ */ new Set();
+  /** Where the server is built. Anchors the findings somewhere meaningful. */
+  serverFile = null;
+  observe(relativePath, text) {
+    if (this.serverFile === null && SERVER_FRAMEWORK.test(text)) {
+      this.serverFile = relativePath;
+    }
+    for (const control of SECURITY_CONTROLS) {
+      if (this.seen.has(control.id)) continue;
+      if (control.evidence.test(text)) this.seen.add(control.id);
+    }
+  }
+  /** Controls with no evidence anywhere. Empty when the tree serves no HTTP. */
+  missing() {
+    if (this.serverFile === null) return [];
+    return SECURITY_CONTROLS.filter((control) => !this.seen.has(control.id));
+  }
+  findings() {
+    const anchor = this.serverFile;
+    if (anchor === null) return [];
+    return this.missing().map((control) => ({
+      ruleId: control.id,
+      title: control.title,
+      file: anchor,
+      line: 1,
+      // `pattern` is doing real work here: it caps the severity, and it says
+      // in the report itself how much the scanner is claiming. An absence is
+      // never `evidence`.
+      severity: severityFor(control.severity, "pattern"),
+      confidence: "pattern",
+      message: `${control.title} \u2014 no evidence of one anywhere in the scanned tree (${control.cwe})`,
+      consequence: control.consequence,
+      cwe: control.cwe,
+      excerpt: "",
+      category: "code"
+    }));
+  }
+};
+
 // ../../packages/scan/src/manifest-rules.ts
 var POPULAR_NPM = [
   "react",
@@ -5781,7 +6580,8 @@ var SECRET_RULES = [
     pattern: /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_.+/=-]*/,
     severity: "medium",
     cwe: "CWE-798",
-    consequence: "Session or service identity until it expires \u2014 and committed tokens are usually long-lived."
+    consequence: "Session or service identity until it expires \u2014 and committed tokens are usually long-lived.",
+    keywordShaped: true
   },
   {
     id: "secret-generic-api-key",
@@ -5792,7 +6592,8 @@ var SECRET_RULES = [
     pattern: /(?:api[_-]?key|apikey|access[_-]?token|auth[_-]?token)\s*[=:]\s*['"]([A-Za-z0-9\-_.]{20,})['"]/i,
     severity: "high",
     cwe: "CWE-798",
-    consequence: "Whatever the third-party service lets the key do, for as long as it stays valid."
+    consequence: "Whatever the third-party service lets the key do, for as long as it stays valid.",
+    keywordShaped: true
   },
   {
     id: "secret-generic-credential",
@@ -5800,7 +6601,8 @@ var SECRET_RULES = [
     pattern: /(?:secret|password|passwd|pwd|token)\s*[=:]\s*['"]([^'"\s]{8,})['"]/i,
     severity: "high",
     cwe: "CWE-798",
-    consequence: "A password in source is a password in every clone, fork and CI cache of that source."
+    consequence: "A password in source is a password in every clone, fork and CI cache of that source.",
+    keywordShaped: true
   },
   {
     id: "secret-hex-token",
@@ -5808,7 +6610,8 @@ var SECRET_RULES = [
     pattern: /(?:token|key|secret|auth|signing)\w*\s*[=:]\s*['"]?([0-9a-f]{32,})['"]?/i,
     severity: "medium",
     cwe: "CWE-798",
-    consequence: "Signing secrets and session keys are usually hex; a leaked one forges anything they sign."
+    consequence: "Signing secrets and session keys are usually hex; a leaked one forges anything they sign.",
+    keywordShaped: true
   }
 ];
 var KNOWN_PLACEHOLDERS = [
@@ -5823,11 +6626,70 @@ var KNOWN_PLACEHOLDERS = [
   /\bEXAMPLE_?KEY\b/i,
   /\bYOUR_[A-Z_]*(?:KEY|TOKEN|SECRET|PASSWORD)\b/,
   /\b(?:xxx+|X{4,}|\*{4,}|<[a-z-]+>)\b/,
-  /\bchangeme\b/i
+  /\bchangeme\b/i,
+  // The metasyntactic pair in a connection string, `postgres://user:pass@host`.
+  // This is not the AWS case above and the distinction is the whole reason it
+  // is allowed: `AKIAIOSFODNN7EXAMPLE` is a real credential *format* carrying a
+  // fake value, so it arrives by way of a pasted template. `user:pass` is the
+  // English words sitting where a credential goes, which is how every database
+  // driver writes its DSN in its own README, and nobody pastes that out of a
+  // secret manager.
+  //
+  // Both halves have to be metasyntactic. `root:hunter2@` is not exempt, since
+  // a real password beside a common username is the case this must not swallow.
+  /:\/\/(?:user(?:name)?|admin|root|dbuser|myuser):(?:pass(?:word|wd)?|secret|dbpass|mypassword)@/i
 ];
 function isKnownPlaceholder(text) {
   return KNOWN_PLACEHOLDERS.some((pattern) => pattern.test(text));
 }
+function isVariableReference(value) {
+  const trimmed = value.trim();
+  const braced = /^\$\{\s*([A-Za-z_][\w.]*)\s*(?::?[-=+?]([\s\S]*))?\}$/.exec(trimmed);
+  if (braced) {
+    const fallback = braced[2];
+    if (fallback === void 0 || fallback.trim() === "") return true;
+    return /^\$\{?[A-Za-z_][\w.]*\}?$/.test(fallback.trim());
+  }
+  return /^\$[A-Za-z_]\w*$/.test(trimmed) || // $VAR
+  /^\$\([\s\S]*\)$/.test(trimmed) || // $(command substitution)
+  /^%[A-Za-z_]\w*%$/.test(trimmed) || // %VAR% on Windows
+  /^\{\{[\s\S]*\}\}$/.test(trimmed) || // {{ template }}
+  /^#\{[\s\S]*\}$/.test(trimmed) || // #{ruby}
+  /^<%=?[\s\S]*%>$/.test(trimmed);
+}
+var FIXTURE_STEMS = [
+  "test",
+  "mock",
+  "fake",
+  "dummy",
+  "stub",
+  "sample",
+  "example",
+  "placeholder",
+  "fixture",
+  "invalid",
+  "expired",
+  "forged",
+  "bogus",
+  "notreal",
+  "nonexistent",
+  "changeme",
+  "foobar",
+  "lorem"
+];
+var KEY_NOISE = /* @__PURE__ */ new Set(["const", "this", "return", "await", "async", "expect", "value"]);
+function words(text) {
+  return text.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[^A-Za-z]+/g, " ").toLowerCase().split(" ").filter(Boolean);
+}
+function isTestFixtureValue(line, value) {
+  const valueWords = words(value);
+  if (valueWords.some((word) => FIXTURE_STEMS.some((stem) => word.startsWith(stem)))) return true;
+  if (value.length > 48) return false;
+  const valueAt = line.lastIndexOf(value);
+  const key = valueAt === -1 ? line : line.slice(0, valueAt);
+  const flattened = valueWords.join("");
+  return words(key).filter((word) => word.length >= 4 && !KEY_NOISE.has(word)).some((word) => flattened.includes(word));
+}
 function redactSecret(line) {
   return line.replace(/([A-Za-z0-9+/=_.-]{12,})/g, (match) => {
     if (match.length <= 12) return match;
@@ -5928,7 +6790,12 @@ var SCAN_EXTENSIONS = /* @__PURE__ */ new Set([
   ".erb",
   ".ejs",
   ".vue",
-  ".svelte"
+  ".svelte",
+  // Template files, so the engine in `template-rules.ts` has something to
+  // read. Sourced from the rules themselves rather than repeated here: an
+  // engine added there becomes scannable without a second edit that could be
+  // forgotten, which is how a rule ends up quietly never firing.
+  ...TEMPLATE_EXTENSIONS
 ]);
 var LANGUAGE_BY_EXTENSION = {
   ".js": "javascript",
@@ -6000,6 +6867,10 @@ function languageOfShebang(firstLine) {
 }
 var SUPPRESS_NEXT = /threatcrush-disable-next-line(?:\s+([\w-]+))?/;
 var SUPPRESS_LINE = /threatcrush-disable-line(?:\s+([\w-]+))?/;
+var FOREIGN_CREDENTIAL = /\b(?:nolint:[\w,]*gosec|nosec)\b[^\n]*\bG101\b|\bG101\b[^\n]*\b(?:nolint:[\w,]*gosec|nosec)\b/;
+function foreignCredentialMark(line) {
+  return FOREIGN_CREDENTIAL.test(line);
+}
 function collectSuppressions(lines) {
   const byLine = /* @__PURE__ */ new Map();
   let count = 0;
@@ -6037,16 +6908,21 @@ function scanText(relativePath, text, language = languageOf(relativePath)) {
       if (!match) continue;
       if (isKnownPlaceholder(match[0])) continue;
       if (isSuppressed(suppressions, index, rule.id)) continue;
+      const value = match[1] ?? match[0];
+      if (isVariableReference(value)) continue;
+      if (inTests && rule.keywordShaped && isTestFixtureValue(line, value)) continue;
+      const marked = foreignCredentialMark(line);
       findings.push({
         ruleId: rule.id,
         title: rule.name,
         file: relativePath,
         line: index + 1,
-        // Reported but not blocking in tests — see isTestPath.
-        severity: inTests ? "low" : rule.severity,
+        // Reported but not blocking in tests — see isTestPath. The same goes
+        // for a line another linter's credential rule was already told about.
+        severity: inTests || marked ? "low" : rule.severity,
         // A matched credential format is the finding, not a proxy for one.
         confidence: "evidence",
-        message: inTests ? `Possible ${rule.name} detected in a test file \u2014 usually a fixture, still worth confirming it is not a live credential` : `Possible ${rule.name} detected`,
+        message: inTests ? `Possible ${rule.name} detected in a test file \u2014 usually a fixture, still worth confirming it is not a live credential` : marked ? `Possible ${rule.name} detected on a line already marked as a false positive for another linter's credential rule` : `Possible ${rule.name} detected`,
         consequence: rule.consequence,
         cwe: rule.cwe,
         excerpt: redactSecret(line.trim()).slice(0, 200),
@@ -6076,6 +6952,23 @@ function scanText(relativePath, text, language = languageOf(relativePath)) {
       });
     }
   });
+  for (const match of evaluateTemplateRules(extensionOf(relativePath), lines)) {
+    const index = match.line - 1;
+    if (isSuppressed(suppressions, index, match.rule.id)) continue;
+    findings.push({
+      ruleId: match.rule.id,
+      title: match.rule.title,
+      file: relativePath,
+      line: match.line,
+      severity: match.severity,
+      confidence: "pattern",
+      message: `${match.rule.title} (${match.rule.cwe})`,
+      consequence: match.rule.consequence,
+      cwe: match.rule.cwe,
+      excerpt: (lines[index] ?? "").trim().slice(0, 200),
+      category: "code"
+    });
+  }
   return findings;
 }
 function scanManifest(relativePath, filename, text) {
@@ -6096,8 +6989,8 @@ function scanManifest(relativePath, filename, text) {
 }
 
 // ../../packages/scan/src/node/walk.ts
-var import_node_fs10 = require("fs");
-var import_node_path5 = require("path");
+var import_node_fs12 = require("fs");
+var import_node_path7 = require("path");
 function compileExcludes(patterns) {
   const matchers = patterns.map((p) => p.trim()).filter((p) => p.length > 0 && !p.startsWith("#")).map(compilePattern);
   if (matchers.length === 0) return () => false;
@@ -6168,7 +7061,7 @@ function matchPrefix(parts, segs) {
 }
 function readIgnoreFile(root) {
   try {
-    return (0, import_node_fs10.readFileSync)((0, import_node_path5.join)(root, ".threatcrushignore"), "utf-8").split("\n");
+    return (0, import_node_fs12.readFileSync)((0, import_node_path7.join)(root, ".threatcrushignore"), "utf-8").split("\n");
   } catch {
     return [];
   }
@@ -6177,22 +7070,23 @@ function scanPath(targetPath, options = {}) {
   const maxFileBytes = options.maxFileBytes ?? 1024 * 1024;
   const allowed = options.categories ? new Set(options.categories) : null;
   const findings = [];
+  const controls = new ControlAudit();
   const unreadable = [];
   let filesScanned = 0;
   let suppressed = 0;
   let excluded = 0;
   const rootIsDirectory = (() => {
     try {
-      return (0, import_node_fs10.statSync)(targetPath).isDirectory();
+      return (0, import_node_fs12.statSync)(targetPath).isDirectory();
     } catch {
       return true;
     }
   })();
-  const walkRoot = rootIsDirectory ? targetPath : (0, import_node_path5.dirname)(targetPath);
+  const walkRoot = rootIsDirectory ? targetPath : (0, import_node_path7.dirname)(targetPath);
   const isExcluded = compileExcludes([...options.exclude ?? [], ...readIgnoreFile(walkRoot)]);
   const scanFile = (fullPath, filename) => {
     const relativePath = toRelative(walkRoot, fullPath);
-    const extension = (0, import_node_path5.extname)(filename).toLowerCase();
+    const extension = (0, import_node_path7.extname)(filename).toLowerCase();
     const isManifest = filename === "package.json" || filename === "requirements.txt";
     const scannable = SCAN_EXTENSIONS.has(extension) || filename.startsWith(".env");
     const mayDeclareInterpreter = !scannable && !isManifest && extension === "";
@@ -6204,32 +7098,33 @@ function scanPath(targetPath, options = {}) {
     let handle;
     let declared = null;
     try {
-      handle = (0, import_node_fs10.openSync)(fullPath, "r");
+      handle = (0, import_node_fs12.openSync)(fullPath, "r");
     } catch {
       unreadable.push(relativePath);
       return;
     }
     try {
-      if ((0, import_node_fs10.fstatSync)(handle).size > maxFileBytes) return;
+      if ((0, import_node_fs12.fstatSync)(handle).size > maxFileBytes) return;
       if (mayDeclareInterpreter) {
         const prefix = Buffer.alloc(128);
-        const read = (0, import_node_fs10.readSync)(handle, prefix, 0, prefix.length, 0);
+        const read = (0, import_node_fs12.readSync)(handle, prefix, 0, prefix.length, 0);
         declared = languageOfShebang(prefix.subarray(0, read).toString("utf-8").split("\n", 1)[0] ?? "");
         if (!declared) return;
       }
-      text = (0, import_node_fs10.readFileSync)(handle, "utf-8");
+      text = (0, import_node_fs12.readFileSync)(handle, "utf-8");
     } catch {
       unreadable.push(relativePath);
       return;
     } finally {
       try {
-        (0, import_node_fs10.closeSync)(handle);
+        (0, import_node_fs12.closeSync)(handle);
       } catch {
       }
     }
     filesScanned += 1;
     options.onFile?.(relativePath);
     suppressed += collectSuppressions(text.split("\n")).count;
+    controls.observe(relativePath, text);
     const fileFindings = [
       ...scanText(relativePath, text, declared ?? languageOf(filename)),
       ...isManifest ? scanManifest(relativePath, filename, text) : []
@@ -6240,13 +7135,13 @@ function scanPath(targetPath, options = {}) {
   const walk = (currentPath) => {
     let entries;
     try {
-      entries = (0, import_node_fs10.readdirSync)(currentPath, { withFileTypes: true });
+      entries = (0, import_node_fs12.readdirSync)(currentPath, { withFileTypes: true });
     } catch {
       unreadable.push(toRelative(walkRoot, currentPath));
       return;
     }
     for (const entry of entries) {
-      const fullPath = (0, import_node_path5.join)(currentPath, entry.name);
+      const fullPath = (0, import_node_path7.join)(currentPath, entry.name);
       const relativePath = toRelative(walkRoot, fullPath);
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name)) continue;
@@ -6270,8 +7165,9 @@ function scanPath(targetPath, options = {}) {
   } else if (isExcluded(toRelative(walkRoot, targetPath))) {
     excluded += 1;
   } else {
-    scanFile(targetPath, (0, import_node_path5.basename)(targetPath));
+    scanFile(targetPath, (0, import_node_path7.basename)(targetPath));
   }
+  if (options.missingControls) findings.push(...controls.findings());
   const filtered = allowed ? findings.filter((f) => allowed.has(f.category)) : findings;
   filtered.sort(
     (a, b) => severityRank(b.severity) - severityRank(a.severity) || a.file.localeCompare(b.file) || a.line - b.line
@@ -6301,32 +7197,37 @@ function recordSensitiveFile(filename, relativePath, sink, fileFindings) {
   }
 }
 function toRelative(base, target) {
-  const rel = (0, import_node_path5.relative)(base, target);
-  return (rel === "" ? target : rel).split(import_node_path5.sep).join("/");
+  const rel = (0, import_node_path7.relative)(base, target);
+  return (rel === "" ? target : rel).split(import_node_path7.sep).join("/");
 }
 
 // ../../packages/scan/src/node/dependencies.ts
-var import_node_fs11 = require("fs");
-var import_node_path6 = require("path");
-var LOCKFILES = [
-  { file: "package-lock.json", ecosystem: "npm" },
-  { file: "pnpm-lock.yaml", ecosystem: "npm" },
-  { file: "yarn.lock", ecosystem: "npm" },
-  { file: "requirements.txt", ecosystem: "PyPI" },
-  { file: "Pipfile.lock", ecosystem: "PyPI" }
-];
+var import_node_fs13 = require("fs");
+var import_node_path8 = require("path");
 var MAX_DEPS_PER_LOCKFILE = 50;
 async function scanDependencies(targetPath) {
   const findings = [];
-  for (const { file, ecosystem } of LOCKFILES) {
-    const lockPath = (0, import_node_path6.join)(targetPath, file);
-    if (!(0, import_node_fs11.existsSync)(lockPath)) continue;
+  for (const { file, ecosystem, parse } of LOCKFILES) {
+    const lockPath = (0, import_node_path8.join)(targetPath, file);
+    if (!(0, import_node_fs13.existsSync)(lockPath)) continue;
     let deps;
     try {
-      deps = parseDependencies(lockPath, file);
+      deps = dedupe(parse((0, import_node_fs13.readFileSync)(lockPath, "utf-8")));
     } catch {
       continue;
     }
+    if (deps.length === 0) {
+      findings.push(incompleteFinding(file, "No dependencies could be read from this lockfile."));
+      continue;
+    }
+    if (deps.length > MAX_DEPS_PER_LOCKFILE) {
+      findings.push(
+        incompleteFinding(
+          file,
+          `Only the first ${MAX_DEPS_PER_LOCKFILE} of ${deps.length} locked packages were checked against OSV.`
+        )
+      );
+    }
     for (const dep of deps.slice(0, MAX_DEPS_PER_LOCKFILE)) {
       let vulns;
       try {
@@ -6353,6 +7254,20 @@ async function scanDependencies(targetPath) {
   }
   return findings;
 }
+function incompleteFinding(file, message) {
+  return {
+    ruleId: "dependency-scan-incomplete",
+    title: "Dependency scan incomplete",
+    file,
+    line: 1,
+    severity: "low",
+    confidence: "evidence",
+    message,
+    consequence: "Advisories affecting the unchecked packages would not appear in this report.",
+    excerpt: file,
+    category: "dependency"
+  };
+}
 function severityFromCvss(score) {
   if (!score) return "medium";
   const value = Number.parseFloat(score);
@@ -6362,26 +7277,131 @@ function severityFromCvss(score) {
   if (value >= 4) return "medium";
   return "low";
 }
-function parseDependencies(lockPath, filename) {
+function dedupe(deps) {
+  const seen = /* @__PURE__ */ new Set();
+  const unique = [];
+  for (const dep of deps) {
+    const key = `${dep.name}@${dep.version}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    unique.push(dep);
+  }
+  return unique;
+}
+function splitNameVersion(spec) {
+  const at = spec.lastIndexOf("@");
+  if (at <= 0) return null;
+  const name = spec.slice(0, at);
+  const version = spec.slice(at + 1);
+  if (!name || !version) return null;
+  return { name, version };
+}
+function exactVersion(raw) {
+  const version = raw.trim().replace(/^[=v]+/, "");
+  return /^[0-9][0-9a-zA-Z.+-]*$/.test(version) ? version : null;
+}
+function parsePackageLock(content) {
+  const lock = JSON.parse(content);
+  const packages = lock.packages ?? lock.dependencies ?? {};
+  const deps = [];
+  for (const [key, value] of Object.entries(packages)) {
+    const name = key.replace(/^.*node_modules\//, "");
+    const version = value?.version;
+    if (name && version && !name.startsWith(".")) deps.push({ name, version });
+  }
+  return deps;
+}
+function parsePnpmLock(content) {
   const deps = [];
-  if (filename === "package-lock.json") {
-    const lock = JSON.parse((0, import_node_fs11.readFileSync)(lockPath, "utf-8"));
-    const packages = lock.packages ?? lock.dependencies ?? {};
-    for (const [key, value] of Object.entries(packages)) {
-      const name = key.replace(/^node_modules\//, "");
-      const version = value?.version;
-      if (name && version && !name.startsWith(".")) deps.push({ name, version });
+  let inPackages = false;
+  for (const line of content.split("\n")) {
+    if (/^[a-zA-Z]/.test(line)) {
+      inPackages = line.startsWith("packages:");
+      continue;
+    }
+    if (!inPackages) continue;
+    const match = /^ {2}(?! )(.+):\s*$/.exec(line);
+    if (!match?.[1]) continue;
+    let key = match[1].trim().replace(/^['"]|['"]$/g, "");
+    key = key.replace(/^\//, "");
+    key = key.replace(/\(.*$/, "");
+    let name;
+    let rawVersion;
+    const slashed = /^(@?[^@]+)\/([0-9][^/]*)$/.exec(key);
+    if (slashed?.[1] && slashed[2]) {
+      name = slashed[1];
+      rawVersion = slashed[2];
+    } else {
+      const dep = splitNameVersion(key);
+      if (!dep) continue;
+      name = dep.name;
+      rawVersion = dep.version;
     }
-    return deps;
+    const version = exactVersion(rawVersion.replace(/_.*$/, ""));
+    if (version) deps.push({ name, version });
   }
-  if (filename === "requirements.txt") {
-    for (const line of (0, import_node_fs11.readFileSync)(lockPath, "utf-8").split("\n")) {
-      const match = /^([a-zA-Z0-9_.-]+)==([0-9.]+)/.exec(line);
-      if (match?.[1] && match[2]) deps.push({ name: match[1], version: match[2] });
+  return deps;
+}
+function parseYarnLock(content) {
+  const deps = [];
+  let pendingName = null;
+  for (const line of content.split("\n")) {
+    if (line.startsWith("#") || line.trim() === "") continue;
+    if (!/^\s/.test(line)) {
+      pendingName = null;
+      const header = line.replace(/:\s*$/, "");
+      const first = header.split(",")[0]?.trim().replace(/^['"]|['"]$/g, "");
+      if (!first) continue;
+      if (!first.includes("@") || first === "__metadata") continue;
+      if (/@(?:workspace|file|link|portal|exec|patch):/.test(first)) continue;
+      const dep = splitNameVersion(first.replace(/@npm:/, "@"));
+      if (dep) pendingName = dep.name;
+      continue;
+    }
+    if (!pendingName) continue;
+    const version = /^\s+version:?\s+["']?([^"'\s]+)["']?\s*$/.exec(line);
+    if (!version?.[1]) continue;
+    const exact = exactVersion(version[1]);
+    if (exact) deps.push({ name: pendingName, version: exact });
+    pendingName = null;
+  }
+  return deps;
+}
+function parsePipfileLock(content) {
+  const lock = JSON.parse(content);
+  const deps = [];
+  for (const section of ["default", "develop"]) {
+    const packages = lock[section];
+    if (!packages || typeof packages !== "object") continue;
+    for (const [name, value] of Object.entries(packages)) {
+      const version = exactVersion(String(value?.version ?? "").replace(/^==/, ""));
+      if (name && version) deps.push({ name, version });
     }
   }
   return deps;
 }
+function parseRequirementsTxt(content) {
+  const deps = [];
+  for (const raw of content.split("\n")) {
+    const line = raw.split("#")[0]?.split(";")[0]?.trim();
+    if (!line || line.startsWith("-")) continue;
+    const match = /^([a-zA-Z0-9._-]+)\s*(?:\[[^\]]*\])?\s*==\s*([^\s,]+)/.exec(line);
+    if (!match?.[1] || !match[2]) continue;
+    const version = exactVersion(match[2]);
+    if (version) deps.push({ name: match[1], version });
+  }
+  return deps;
+}
+var LOCKFILES = [
+  { file: "package-lock.json", ecosystem: "npm", parse: parsePackageLock },
+  { file: "pnpm-lock.yaml", ecosystem: "npm", parse: parsePnpmLock },
+  { file: "yarn.lock", ecosystem: "npm", parse: parseYarnLock },
+  { file: "requirements.txt", ecosystem: "PyPI", parse: parseRequirementsTxt },
+  { file: "Pipfile.lock", ecosystem: "PyPI", parse: parsePipfileLock }
+];
+var LOCKFILE_PARSERS = Object.fromEntries(
+  LOCKFILES.map((entry) => [entry.file, entry.parse])
+);
 function isValidPackageName(name) {
   return /^[@a-zA-Z0-9_.\-/]{1,214}$/.test(name);
 }
@@ -6406,17 +7426,17 @@ async function queryOsv(name, version, ecosystem) {
 }
 
 // ../../packages/scan/src/node/sarif.ts
-var import_node_crypto = require("crypto");
-var import_node_path7 = require("path");
+var import_node_crypto3 = require("crypto");
+var import_node_path9 = require("path");
 
 // src/commands/scan.ts
 function readVersion() {
   for (const candidate of [
-    (0, import_node_path8.join)(__dirname, "..", "package.json"),
-    (0, import_node_path8.join)(__dirname, "..", "..", "package.json")
+    (0, import_node_path10.join)(__dirname, "..", "package.json"),
+    (0, import_node_path10.join)(__dirname, "..", "..", "package.json")
   ]) {
     try {
-      return JSON.parse((0, import_node_fs12.readFileSync)(candidate, "utf-8")).version ?? "0.0.0";
+      return JSON.parse((0, import_node_fs14.readFileSync)(candidate, "utf-8")).version ?? "0.0.0";
     } catch {
     }
   }
@@ -6877,8 +7897,8 @@ var RuleEngine = class {
 };
 
 // src/daemon/rules/loader.ts
-var import_node_fs13 = require("fs");
-var import_node_path9 = require("path");
+var import_node_fs15 = require("fs");
+var import_node_path11 = require("path");
 
 // src/daemon/rules/default-rules.ts
 var DEFAULT_RULES = [
@@ -7162,11 +8182,11 @@ var RULES_DIR = "/etc/threatcrush/rules.d";
 function loadAllRules(customDir) {
   const rules = [...DEFAULT_RULES];
   const dir = customDir || RULES_DIR;
-  if ((0, import_node_fs13.existsSync)(dir)) {
-    const files = (0, import_node_fs13.readdirSync)(dir).filter((f) => f.endsWith(".json"));
+  if ((0, import_node_fs15.existsSync)(dir)) {
+    const files = (0, import_node_fs15.readdirSync)(dir).filter((f) => f.endsWith(".json"));
     for (const file of files) {
       try {
-        const raw = (0, import_node_fs13.readFileSync)((0, import_node_path9.join)(dir, file), "utf-8");
+        const raw = (0, import_node_fs15.readFileSync)((0, import_node_path11.join)(dir, file), "utf-8");
         const parsed = JSON.parse(raw);
         const customRules = Array.isArray(parsed) ? parsed : [parsed];
         for (const rule of customRules) {
@@ -7329,7 +8349,7 @@ function detectFirewallAdapter() {
 }
 
 // src/daemon/firewall/remediation.ts
-var import_node_fs14 = require("fs");
+var import_node_fs16 = require("fs");
 var DEFAULT_CONFIG2 = {
   enabled: true,
   dry_run: true,
@@ -7484,7 +8504,7 @@ var RemediationManager = class {
   }
   logLine(line) {
     try {
-      (0, import_node_fs14.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+      (0, import_node_fs16.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
     } catch {
     }
@@ -7540,7 +8560,7 @@ async function flushTelemetry(timeoutMs = 2e3) {
 // src/daemon/index.ts
 function readVersion2() {
   try {
-    const pkg = JSON.parse((0, import_node_fs15.readFileSync)((0, import_node_path10.join)(__dirname, "..", "package.json"), "utf-8"));
+    const pkg = JSON.parse((0, import_node_fs17.readFileSync)((0, import_node_path12.join)(__dirname, "..", "package.json"), "utf-8"));
     return pkg.version || "0.0.0";
   } catch {
     return "0.0.0";
@@ -7548,7 +8568,7 @@ function readVersion2() {
 }
 function logLine(line) {
   try {
-    (0, import_node_fs15.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+    (0, import_node_fs17.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
   } catch {
   }
@@ -7576,7 +8596,7 @@ async function runDaemon() {
   } catch (err) {
     logLine(`[daemon] state db unavailable: ${err.message}`);
   }
-  const config = loadConfig((0, import_node_fs15.existsSync)(PATHS.configFile) ? PATHS.configFile : void 0);
+  const config = loadConfig((0, import_node_fs17.existsSync)(PATHS.configFile) ? PATHS.configFile : void 0);
   bus.on("event", (event) => {
     logLine(`[event] ${event.severity} ${event.module} ${event.message}`);
   });