@profullstack/threatcrush 0.11.2 → 0.11.4

package/dist/daemon.js

@@ -2150,6 +2150,9 @@ bus.setMaxListeners(50);
 var import_better_sqlite3 = __toESM(require("better-sqlite3"));
 var db = null;
 var dbUnavailable = false;
+function isStateDbAvailable() {
+  return db !== null;
+}
 function initStateDB(dbPath = "/var/lib/threatcrush/state.db") {
   if (db) return db;
   if (dbUnavailable) {
@@ -2427,7 +2430,8 @@ var IpcServer = class {
             socket: PATHS.socket
           },
           modules: this.moduleHost.summary(),
-          counters: { ...this.counters }
+          counters: { ...this.counters },
+          stateDb: isStateDbAvailable()
         };
         return this.send(client, { id: req.id, ok: true, result: status });
       }
@@ -4789,7 +4793,11 @@ var NODE_RULES = [
     severity: "medium",
     languages: ["javascript", "typescript"],
     pattern: /\bBuffer\s*\.\s*allocUnsafe(?:Slow)?\s*\(|\bnew\s+Buffer\s*\(\s*(?![`'"])[a-zA-Z_$0-9]/,
-    inherent: true
+    inherent: true,
+    // Filling the buffer yourself is the whole reason to call `allocUnsafe`,
+    // so reporting every call reports correct code. What is left reported is
+    // an allocation whose bytes are never written before it escapes.
+    filledBeforeUseGuard: true
   },
   {
     id: "js-oversized-request-body-limit",
@@ -4899,8 +4907,19 @@ var CODE_RULES = [
     // The tail is what distinguishes assembly from parameterisation. A bound
     // query leaves a comma after the closing quote (`"… = $1", [id]`) and
     // matches none of these.
+    //
+    // The clause alternative anchors the keyword to the *start* of the
+    // concatenated fragment, because that is where a clause being appended
+    // actually sits: `sql + "WHERE id = " + id`, `sql + " ORDER BY " + col`.
+    //
+    // Allowing it anywhere in the fragment made the rule read English. `WHERE`
+    // and `SET` are ordinary words, and without a leading `\b` they were not
+    // even required to be whole ones — "any`where`" and "sub`set`" both
+    // matched. A help string reading "lists them anywhere" was reported as
+    // critical SQL injection, which is the kind of finding that teaches a team
+    // the scanner is not worth reading.
     pattern: new RegExp(
-      `${SQL_STRING}\\s*\\+|${SQL_STRING}\\s*%\\s*[\\w(]|${SQL_STRING}\\s*\\.\\s*format\\s*\\(|\\+\\s*(?:"[^"\\n]*|'[^'\\n]*)(?:WHERE|ORDER\\s+BY|VALUES|SET)\\b`,
+      `${SQL_STRING}\\s*\\+|${SQL_STRING}\\s*%\\s*[\\w(]|${SQL_STRING}\\s*\\.\\s*format\\s*\\(|\\+\\s*(?:"|')\\s*\\b(?:WHERE|ORDER\\s+BY|VALUES|SET)\\b`,
       "i"
     )
   },
@@ -4913,7 +4932,26 @@ var CODE_RULES = [
     pattern: new RegExp(
       `\`[^\`\\n]*(?:${SQL_KEYWORDS})\\b[^\`\\n]*\\$\\{|\\bf"[^"\\n]*(?:${SQL_KEYWORDS})\\b[^"\\n]*\\{|\\bf'[^'\\n]*(?:${SQL_KEYWORDS})\\b[^'\\n]*\\{`,
       "i"
-    )
+    ),
+    /**
+     * Interpolating a column list is not interpolating a value.
+     *
+     *     const COLS = `tld, user_id, owner_email, price_usd`;
+     *     get(`SELECT ${COLS} FROM moshpit_tlds WHERE tld = ?`, [tld]);
+     *
+     * That query *is* parameterised: every value the caller supplies rides a
+     * `?`, and the only thing spliced into the text is a constant written a
+     * few lines up. Naming the column list once instead of repeating it in
+     * fourteen queries is ordinary hygiene, and it is the shape this rule met
+     * most often in practice — one repository produced eighteen findings this
+     * way and not one of them could be injected into.
+     *
+     * The guard resolves the interpolations rather than trusting the shape, so
+     * the moment a query mixes a constant with anything else —
+     * `` `SELECT ${COLS} FROM t WHERE id = ${req.query.id}` `` — it is reported
+     * again. `interpolationsAreConstant` requires *every* `${…}` to resolve.
+     */
+    constantInterpolationGuard: true
   },
   {
     id: "sql-format-call",
@@ -4945,7 +4983,12 @@ var CODE_RULES = [
     severity: "critical",
     languages: ["javascript", "typescript"],
     pattern: /\b(?:exec|execSync|spawn|spawnSync)\s*\(\s*(?:`[^`]*\$\{|['"][^'"]*['"]\s*\+|[a-zA-Z_$][\w$]*\s*\+)/,
-    constantInterpolationGuard: true
+    constantInterpolationGuard: true,
+    // Interpolation is common in locally run CLI and installer code. Report
+    // command execution as an injection vulnerability only when the nearby
+    // code shows a caller-controlled source, rather than treating every
+    // internally assembled command as attacker input.
+    needsContext: true
   },
   {
     id: "py-shell-command-string",
@@ -4963,7 +5006,22 @@ var CODE_RULES = [
     cwe: "CWE-78",
     severity: "critical",
     languages: ["go"],
-    pattern: /\bexec\.Command(?:Context)?\s*\(\s*(?:ctx\s*,\s*)?"(?:\/bin\/)?(?:sh|bash|zsh|cmd|powershell)"\s*,\s*"(?:-c|\/c)"/
+    pattern: /\bexec\.Command(?:Context)?\s*\(\s*(?:ctx\s*,\s*)?"(?:\/bin\/)?(?:sh|bash|zsh|cmd|powershell)"\s*,\s*"(?:-c|\/c)"/,
+    // A call whose whole argv is string literals cannot be injected into.
+    // `exec.Command("cmd", "/c", "ver")` reads the Windows version; there is no
+    // value in it for an attacker to reach, and the consequence above — that a
+    // shell will interpret metacharacters — describes metacharacters nobody can
+    // supply. gosec's G204 draws the line in the same place, and this was the
+    // single finding a Go project got out of a whole scan before declining the
+    // offer, which is an expensive way to report nothing.
+    //
+    // The guard has to end at the closing paren, so a literal followed by
+    // anything else still reports: `"ls " + dir` leaves a `+` before the `)`,
+    // `fmt.Sprintf(…)` leaves an identifier, and a bare variable leaves a name.
+    // `(?:[^"\\]|\\.)*` rather than `[^"]*` so an escaped quote inside a
+    // literal — `"echo \"hi\""` — does not end the literal early and drop the
+    // guard on a line it should have covered.
+    lineGuard: /\bexec\.Command(?:Context)?\s*\(\s*(?:ctx\s*,\s*)?"(?:\/bin\/)?(?:sh|bash|zsh|cmd|powershell)"\s*,\s*"(?:-c|\/c)"\s*(?:,\s*"(?:[^"\\]|\\.)*")*\s*,?\s*\)/
   },
   {
     id: "rb-backtick-interpolation",
@@ -5032,17 +5090,44 @@ var CODE_RULES = [
     cwe: "CWE-79",
     severity: "high",
     languages: ["javascript", "typescript"],
-    pattern: /\bdangerouslySetInnerHTML\s*=|\.\s*(?:innerHTML|outerHTML)\s*=\s*(?!\s*['"`]\s*['"`]\s*;?\s*$)|\bdocument\s*\.\s*write(?:ln)?\s*\(|\.\s*insertAdjacentHTML\s*\(/,
     /**
+     * The assignment alternative carries its own exemption, as a lookahead, so
+     * that it is decided per assignment rather than per line.
+     *
      * A whole-statement assignment of a string with no interpolation and no
-     * concatenation carries no data, so it cannot carry attacker data. This
-     * was the single largest source of noise: a codebase that builds its UI
-     * with innerHTML reports every static heading and spinner as XSS, and a
-     * rule that flags 40 safe lines to catch one real one gets switched off.
+     * concatenation carries no data, so it cannot carry attacker data. This was
+     * the single largest source of noise: a codebase that builds its UI with
+     * innerHTML reports every static heading and spinner as XSS, and a rule
+     * that flags 40 safe lines to catch one real one gets switched off.
+     *
+     * Two things this has to get right, and a `lineGuard` could get neither:
+     *
+     * A statement ends at its semicolon, not at the newline. Anchoring to `$`
+     * held the exemption for `el.innerHTML = '';` alone on a line and dropped
+     * it the moment anything followed:
+     *
+     *     function hide() { out.hidden = true; out.innerHTML = ''; rendered = null; }
+     *
+     * — the same assignment, clearing a node, reported as high-severity XSS
+     * because two neighbours shared its line.
+     *
+     * And an exemption must not become a line-wide amnesty. A guard is tested
+     * against the whole line, so one safe clear would exonerate a real sink
+     * beside it:
+     *
+     *     a.innerHTML = ''; b.innerHTML = userInput;
+     *
+     * As a lookahead the regex decides at each `=` it reaches, so the first
+     * assignment is exempt and the second is still reported.
      *
-     * Line-scoped on purpose — see `lineGuard`.
+     * The whitespace after `=` is matched *inside* the lookahead rather than
+     * before it. Left outside, `\s*` backtracks to zero width, the lookahead
+     * then starts on the space instead of the quote, fails to see a literal,
+     * and the negative lookahead succeeds — reinstating every finding the
+     * exemption was written to remove.
      */
-    lineGuard: /(?:innerHTML|outerHTML)\s*=\s*(?:'[^'\\]*'|"[^"\\]*"|`[^`$\\]*`)\s*;?\s*$/
+    pattern: /\bdangerouslySetInnerHTML\s*=|\.\s*(?:innerHTML|outerHTML)\s*=(?!\s*(?:'[^'\\\n]*'|"[^"\\\n]*"|`[^`$\\\n]*`)\s*(?:;|$))|\bdocument\s*\.\s*write(?:ln)?\s*\(|\.\s*insertAdjacentHTML\s*\(/,
+    sanitizedHtmlGuard: true
   },
   {
     id: "java-html-writer-concatenation",
@@ -5121,7 +5206,8 @@ var CODE_RULES = [
     severity: "medium",
     languages: ["javascript", "typescript"],
     pattern: /\b(?:res|response)\s*\.\s*redirect\s*\(\s*[a-zA-Z_$][\w$]*\s*\)|\bwindow\s*\.\s*location(?:\s*\.\s*(?:href|replace))?\s*(?:=\s*[a-zA-Z_$]|\(\s*[a-zA-Z_$][\w$]*\s*\))/,
-    needsContext: true
+    needsContext: true,
+    safeRedirectGuard: true
   },
   // ── Deserialisation ──────────────────────────────────────────────────────
   {
@@ -5321,7 +5407,7 @@ var CODE_RULES = [
     // the pattern is written. `other` also covers C++, Rust and Zig, which
     // share the cast-then-deref spelling.
     languages: ["javascript", "typescript", "python", "ruby", "go", "java", "php"],
-    pattern: /\([^)\n]*[+*]\s*\)\s*[+*]|\([^)\n]*\{\d+,\}\s*\)\s*[+*{]/
+    pattern: /(?:^|[=(:,]\s*)\/(?:\\.|[^/\\\n])*\([^()\n]*[+*][^()\n]*\)\s*(?:[+*]|\{\d+,\})|\b(?:new\s+RegExp|RegExp|re\.compile|regexp\.(?:Compile|MustCompile)|Pattern\.compile)\s*\(\s*(?:r)?["'][^"'\n]*\([^()\n]*[+*][^()\n]*\)\s*(?:[+*]|\{\d+,\})/
   },
   // ── Temporary files ──────────────────────────────────────────────────────
   {
@@ -5330,10 +5416,13 @@ var CODE_RULES = [
     consequence: "A predictable name in a world-writable directory is a symlink attack: an attacker pre-creates the path and your process writes through it.",
     cwe: "CWE-377",
     severity: "medium",
-    // A hardcoded path under /tmp is the finding whether or not it is
-    // formatted: `"/tmp/application.log.tmp"` is worse than the PID-based one,
-    // because every process on the host can predict it exactly.
-    pattern: /\btempfile\.mktemp\s*\(|\bos\.tmpnam\s*\(|['"]\/tmp\/[^'"\n]+['"]|['"]\/tmp\/[^'"\n]*\{|\bFile\.createTempFile\s*\(/
+    // `File.createTempFile` is specifically the safe Java API, and a string
+    // containing `/tmp/` is not necessarily a write. Detect unsafe name
+    // generators and actual writes to a literal temp path instead. Shell
+    // redirections are handled by the shell-specific rule below.
+    pattern: new RegExp(
+      String.raw`\btempfile\.mktemp\s*\(|\bos\.tmpnam\s*\(|\b(?:writeFile(?:Sync)?|appendFile(?:Sync)?|createWriteStream|FileOutputStream|FileWriter|os\.OpenFile|open)\s*\([^\n)]*['"]\/tmp\/[^'"\n]+['"]`
+    )
   },
   // ── Information exposure ─────────────────────────────────────────────────
   {
@@ -5386,7 +5475,6 @@ var CODE_RULES = [
   // of privileged work actually happens, and they run as whoever invoked them.
   {
     id: "sh-remote-script-execution",
-    inherent: true,
     title: "network output piped into a shell",
     consequence: "Whatever that URL serves at the moment this runs is executed as the invoking user. There is no version, no signature, and no review \u2014 a compromise of the host, or anyone able to answer for it, is a compromise of every machine that runs the script.",
     cwe: "CWE-494",
@@ -5395,9 +5483,13 @@ var CODE_RULES = [
     // The pipe must be the *next* thing: `curl -o f url && sh f` is a different
     // (and checkable) shape, and `curl url | jq` is not an execution at all.
     pattern: /\b(?:curl|wget)\b[^|\n]*\|\s*(?:sudo\s+(?:-\S+\s+)*)?(?:\/bin\/|\/usr\/bin\/)?(?:ba|da|k|z|a)?sh\b/,
-    // Nothing on this line can exonerate it. Integrity checking happens in a
-    // separate step by construction, so a window guard would only mislead.
-    guard: false
+    // This is a supply-chain review item, not proof that the repository is
+    // compromised. A literal HTTPS installer URL is capped at medium; it only
+    // escalates when nearby evidence shows that input can choose the download.
+    guard: false,
+    // Installer instructions printed by the script do not execute.  Matching
+    // them made a script report its own documentation as a network pipeline.
+    lineGuard: /^\s*(?:echo|printf|say|info|warn|error)\s+["'][^"'\n]*\b(?:curl|wget)\b/
   },
   {
     id: "sh-eval-expansion",
@@ -5973,6 +6065,57 @@ function isConstantString(name, fileText) {
     `\\bconst\\s+${escaped}\\s*(?::[^=\\n]+)?=\\s*(?:'[^'\\n]*'|"[^"\\n]*"|\`[^\`$\\n]*\`)`
   ).test(fileText);
 }
+function hasSanitizedHtmlValue(line, fileText) {
+  const direct = /\b__html\s*:\s*(?:[A-Za-z_$][\w$]*\s*\.\s*)?(?:sanitize\w*|escape\w*|serializeJsonForHtml|renderSanitizedMarkdown)\s*\(/i;
+  if (direct.test(line)) return true;
+  const value = /\b__html\s*:\s*([A-Za-z_$][\w$]*)\b/.exec(line)?.[1];
+  if (!value) return false;
+  const escaped = value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(
+    `\\bconst\\s+${escaped}\\s*=[^\\n;]*(?:[A-Za-z_$][\\w$]*\\s*\\.\\s*)?(?:sanitize\\w*|escape\\w*|serializeJsonForHtml|renderSanitizedMarkdown)\\s*\\(`,
+    "i"
+  ).test(fileText);
+}
+function isIdentifierStart(char) {
+  if (!char) return false;
+  const code = char.charCodeAt(0);
+  return char === "$" || char === "_" || code >= 65 && code <= 90 || code >= 97 && code <= 122;
+}
+function isIdentifierPart(char) {
+  if (isIdentifierStart(char)) return true;
+  if (!char) return false;
+  const code = char.charCodeAt(0);
+  return code >= 48 && code <= 57;
+}
+function identifierAfter(text, start) {
+  let index = start;
+  while (text[index] === " " || text[index] === "	") index += 1;
+  if (!isIdentifierStart(text[index])) return null;
+  const from = index;
+  while (isIdentifierPart(text[index])) index += 1;
+  return text.slice(from, index);
+}
+function hasSafeRedirectValue(line, fileText) {
+  const location = line.indexOf("window.location");
+  const redirect = line.indexOf(".redirect");
+  const valueStart = location >= 0 ? line.indexOf("=", location) + 1 : redirect >= 0 ? line.indexOf("(", redirect) + 1 : 0;
+  if (valueStart === 0) return false;
+  const value = identifierAfter(line, valueStart);
+  if (!value) return false;
+  const declaration = `const ${value}`;
+  for (const candidate of fileText.split("\n")) {
+    const at = candidate.indexOf(declaration);
+    if (at === -1 || isIdentifierPart(candidate[at - 1]) || isIdentifierPart(candidate[at + declaration.length])) {
+      continue;
+    }
+    const equals = candidate.indexOf("=", at + declaration.length);
+    const initializer = candidate.slice(equals + 1);
+    if (equals !== -1 && ["safeRedirectPath(", "safeRedirectUrl(", "safeRedirectURL("].some((call) => initializer.includes(call))) {
+      return true;
+    }
+  }
+  return false;
+}
 function interpolationsAreConstant(line, fileText) {
   const found = interpolations(line);
   if (!found) return false;
@@ -5980,6 +6123,45 @@ function interpolationsAreConstant(line, fileText) {
     (expr) => /^[A-Za-z_$][\w$]*$/.test(expr) && isConstantString(expr, fileText)
   );
 }
+var FILL_LOOKAHEAD = 16;
+var NAME = String.raw`(?<![\w$])([A-Za-z_$][\w$]*)`;
+var ALLOCATION_BINDING = new RegExp(
+  `${NAME}\\s*=\\s*(?:new\\s+Buffer\\s*\\(|Buffer\\s*\\.\\s*allocUnsafe(?:Slow)?\\s*\\()`
+);
+function allocationBinding(line) {
+  return ALLOCATION_BINDING.exec(line)?.[1] ?? null;
+}
+var WRITE_SHAPES = [
+  // `src.copy(name, …)` — name is the destination.
+  /\.\s*copy\s*\(\s*([A-Za-z_$][\w$]*)\s*[,)]/g,
+  // `name.fill(…)`, `name.write*(…)`, `name.set(…)`.
+  new RegExp(`${NAME}\\s*\\.\\s*(?:fill|set|write[A-Za-z0-9]*)\\s*\\(`, "g"),
+  // `name[i] = …`, but not `name[i] === …`.
+  new RegExp(`${NAME}\\s*\\[[^\\]\\n]*\\]\\s*=(?!=)`, "g")
+];
+function writesInto(text, name) {
+  for (const shape of WRITE_SHAPES) {
+    shape.lastIndex = 0;
+    for (let found = shape.exec(text); found !== null; found = shape.exec(text)) {
+      if (found[1] === name) return true;
+    }
+  }
+  return false;
+}
+function bufferFilledBeforeUse(ctx) {
+  const line = ctx.lines[ctx.index] ?? "";
+  if (/\ballocUnsafe(?:Slow)?\s*\([^)\n]*\)\s*\.\s*fill\s*\(/.test(line)) return true;
+  const name = allocationBinding(line);
+  if (!name) return false;
+  if (writesInto(line.slice(line.indexOf("=") + 1), name)) return true;
+  const last = Math.min(ctx.lines.length - 1, ctx.index + FILL_LOOKAHEAD);
+  for (let i = ctx.index + 1; i <= last; i += 1) {
+    const next = ctx.lines[i] ?? "";
+    if (skippable(next, i, ctx.prose)) continue;
+    if (writesInto(next, name)) return true;
+  }
+  return false;
+}
 function evaluateRule(rule, ctx) {
   if (rule.languages && !rule.languages.includes(ctx.language)) return null;
   const line = ctx.lines[ctx.index] ?? "";
@@ -5998,6 +6180,13 @@ function evaluateRule(rule, ctx) {
   if (rule.constantInterpolationGuard && interpolationsAreConstant(line, fileTextOf(ctx.lines))) {
     return null;
   }
+  if (rule.sanitizedHtmlGuard && hasSanitizedHtmlValue(line, fileTextOf(ctx.lines))) {
+    return null;
+  }
+  if (rule.safeRedirectGuard && hasSafeRedirectValue(line, fileTextOf(ctx.lines))) {
+    return null;
+  }
+  if (rule.filledBeforeUseGuard && bufferFilledBeforeUse(ctx)) return null;
   const guard = rule.guard === void 0 ? GENERIC_GUARD : rule.guard;
   if (guard && (guard.test(line) || guard.test(context))) return null;
   const untrusted = untrustedPatternFor(ctx.language);
@@ -6362,6 +6551,10 @@ function detectTyposquat(name, ecosystem) {
   return null;
 }
 var LIFECYCLE_SCRIPTS = ["preinstall", "install", "postinstall", "prepare", "prepublish"];
+function isRiskyLifecycleScript(body) {
+  if (typeof body !== "string") return false;
+  return /\b(?:curl|wget)\b[^\n|]*\|\s*(?:\w*sh|bash|node|python)\b|\b(?:curl|wget)\b[^\n]*(?:https?:|--upload-file)|\b(?:node|python|ruby|perl)\s+-e\b|\b(?:base64|openssl)\b[^\n]*(?:-d|--decode)|\beval\s+|\bchmod\s+(?:\S+\s+)*(?:777|a\+rwx)\b/i.test(body);
+}
 function scanPackageJson(text) {
   const findings = [];
   const lines = text.split("\n");
@@ -6413,13 +6606,14 @@ function scanPackageJson(text) {
   if (scripts && typeof scripts === "object") {
     for (const [name, body] of Object.entries(scripts)) {
       if (!LIFECYCLE_SCRIPTS.includes(name)) continue;
+      if (!isRiskyLifecycleScript(body)) continue;
       findings.push({
-        ruleId: "manifest-install-lifecycle-script",
-        title: "install-time lifecycle script",
+        ruleId: "manifest-risky-install-lifecycle-script",
+        title: "risky install-time lifecycle script",
         line: lineOf(name),
         severity: "medium",
         cwe: "CWE-506",
-        message: `"${name}" runs automatically on install: ${String(body).slice(0, 120)}`,
+        message: `"${name}" runs automatically on install and contains a network or code-execution primitive: ${String(body).slice(0, 120)}`,
         consequence: "Lifecycle scripts run with the installing user\u2019s privileges and network access, before any code is reviewed. It is the execution vector every notable npm compromise has used.",
         excerpt: (lines[lineOf(name) - 1] ?? "").trim()
       });
@@ -6642,6 +6836,11 @@ var KNOWN_PLACEHOLDERS = [
 function isKnownPlaceholder(text) {
   return KNOWN_PLACEHOLDERS.some((pattern) => pattern.test(text));
 }
+function isPlaceholderAttribute(line, value) {
+  const at = line.lastIndexOf(value);
+  if (at === -1) return false;
+  return /(?:^|\s)(?:aria-)?placeholder\s*=\s*[{("'`]*$/i.test(line.slice(0, at));
+}
 function isVariableReference(value) {
   const trimmed = value.trim();
   const braced = /^\$\{\s*([A-Za-z_][\w.]*)\s*(?::?[-=+?]([\s\S]*))?\}$/.exec(trimmed);
@@ -6684,10 +6883,13 @@ function words(text) {
 function isTestFixtureValue(line, value) {
   const valueWords = words(value);
   if (valueWords.some((word) => FIXTURE_STEMS.some((stem) => word.startsWith(stem)))) return true;
+  return describesItsOwnKey(line, value);
+}
+function describesItsOwnKey(line, value) {
   if (value.length > 48) return false;
   const valueAt = line.lastIndexOf(value);
   const key = valueAt === -1 ? line : line.slice(0, valueAt);
-  const flattened = valueWords.join("");
+  const flattened = words(value).join("");
   return words(key).filter((word) => word.length >= 4 && !KEY_NOISE.has(word)).some((word) => flattened.includes(word));
 }
 function redactSecret(line) {
@@ -6867,9 +7069,9 @@ function languageOfShebang(firstLine) {
 }
 var SUPPRESS_NEXT = /threatcrush-disable-next-line(?:\s+([\w-]+))?/;
 var SUPPRESS_LINE = /threatcrush-disable-line(?:\s+([\w-]+))?/;
-var FOREIGN_CREDENTIAL = /\b(?:nolint:[\w,]*gosec|nosec)\b[^\n]*\bG101\b|\bG101\b[^\n]*\b(?:nolint:[\w,]*gosec|nosec)\b/;
-function foreignCredentialMark(line) {
-  return FOREIGN_CREDENTIAL.test(line);
+var FOREIGN_SECURITY = /\b(?:nolint:[\w,]*gosec|nosec)\b/;
+function foreignSecurityMark(line) {
+  return FOREIGN_SECURITY.test(line);
 }
 function collectSuppressions(lines) {
   const byLine = /* @__PURE__ */ new Map();
@@ -6895,13 +7097,42 @@ function isSuppressed(suppressions, index, ruleId) {
 }
 function isTestPath(relativePath) {
   const p = relativePath.replace(/\\/g, "/");
-  return /(?:^|\/)(?:tests?|__tests__|__mocks__|spec|specs|fixtures?|mocks?|e2e|testdata)\//i.test(p) || /(?:^|\/)(?:test|conftest)_[^/]+$/i.test(p) || /[._-](?:test|spec)\.[a-z]+$/i.test(p) || /_test\.[a-z]+$/i.test(p);
+  return /(?:^|\/)(?:tests?|__tests__|__mocks__|spec|specs|fixtures?|mocks?|e2e|testdata|testutils?|harness)\//i.test(p) || /(?:^|\/)(?:test|conftest)_[^/]+$/i.test(p) || /[._-](?:test|spec)\.[a-z]+$/i.test(p) || /_test\.[a-z]+$/i.test(p);
+}
+function isDocPath(relativePath) {
+  const p = relativePath.replace(/\\/g, "/");
+  return /(?:^|\/)(?:docs?|examples?|samples?)\//i.test(p) || /\.(?:md|mdx|markdown|rst|adoc)$/i.test(p);
 }
+var SOFTENING_ORDER = [
+  "suppressed",
+  "placeholder",
+  "self-describing",
+  "test",
+  "docs"
+];
+function softening(reasons) {
+  return SOFTENING_ORDER.find((reason) => reasons[reason]) ?? null;
+}
+var SECRET_SOFTENING = {
+  test: "in a test file \u2014 usually a fixture, still worth confirming it is not a live credential",
+  docs: "in documentation \u2014 usually an illustrative example, still worth confirming it is not a live credential",
+  suppressed: "on a line already marked as a false positive for another linter's security rule",
+  placeholder: "in example text an empty input field shows, not in data",
+  "self-describing": "in a value that repeats the name of the field holding it \u2014 usually a description of a credential rather than one"
+};
+var CODE_SOFTENING = {
+  test: "in a test file, where the construct is ordinary",
+  docs: "in documentation or example code, which nothing runs",
+  suppressed: "on a line another linter's security suppression already covers",
+  placeholder: "in example text rather than in data",
+  "self-describing": "in a value that describes itself"
+};
 function scanText(relativePath, text, language = languageOf(relativePath)) {
   const findings = [];
   const lines = text.split("\n");
   const suppressions = collectSuppressions(lines);
   const inTests = isTestPath(relativePath);
+  const inDocs = isDocPath(relativePath);
   lines.forEach((line, index) => {
     for (const rule of SECRET_RULES) {
       const match = rule.pattern.exec(line);
@@ -6911,18 +7142,23 @@ function scanText(relativePath, text, language = languageOf(relativePath)) {
       const value = match[1] ?? match[0];
       if (isVariableReference(value)) continue;
       if (inTests && rule.keywordShaped && isTestFixtureValue(line, value)) continue;
-      const marked = foreignCredentialMark(line);
+      const soft = softening({
+        test: inTests,
+        suppressed: foreignSecurityMark(line),
+        placeholder: isPlaceholderAttribute(line, value),
+        "self-describing": rule.keywordShaped === true && describesItsOwnKey(line, value)
+      });
       findings.push({
         ruleId: rule.id,
         title: rule.name,
         file: relativePath,
         line: index + 1,
-        // Reported but not blocking in tests — see isTestPath. The same goes
-        // for a line another linter's credential rule was already told about.
-        severity: inTests || marked ? "low" : rule.severity,
+        // Reported but not blocking wherever context weakens the claim — see
+        // `softening`. Never dropped: the count is the same either way.
+        severity: soft ? "low" : rule.severity,
         // A matched credential format is the finding, not a proxy for one.
         confidence: "evidence",
-        message: inTests ? `Possible ${rule.name} detected in a test file \u2014 usually a fixture, still worth confirming it is not a live credential` : marked ? `Possible ${rule.name} detected on a line already marked as a false positive for another linter's credential rule` : `Possible ${rule.name} detected`,
+        message: soft ? `Possible ${rule.name} detected ${SECRET_SOFTENING[soft]}` : `Possible ${rule.name} detected`,
         consequence: rule.consequence,
         cwe: rule.cwe,
         excerpt: redactSecret(line.trim()).slice(0, 200),
@@ -6937,14 +7173,19 @@ function scanText(relativePath, text, language = languageOf(relativePath)) {
       if (isSuppressed(suppressions, index, rule.id)) continue;
       const match = evaluateRule(rule, { lines, index, language, prose });
       if (!match) continue;
+      const soft = softening({
+        test: inTests,
+        docs: inDocs,
+        suppressed: foreignSecurityMark(lines[index] ?? "")
+      });
       findings.push({
         ruleId: rule.id,
         title: rule.title,
         file: relativePath,
         line: index + 1,
-        severity: match.severity,
+        severity: soft ? "low" : match.severity,
         confidence: match.confidence,
-        message: `${rule.title} (${rule.cwe})`,
+        message: soft ? `${rule.title} (${rule.cwe}) \u2014 ${CODE_SOFTENING[soft]}` : `${rule.title} (${rule.cwe})`,
         consequence: rule.consequence,
         cwe: rule.cwe,
         excerpt: (lines[index] ?? "").trim().slice(0, 200),
@@ -6955,14 +7196,19 @@ function scanText(relativePath, text, language = languageOf(relativePath)) {
   for (const match of evaluateTemplateRules(extensionOf(relativePath), lines)) {
     const index = match.line - 1;
     if (isSuppressed(suppressions, index, match.rule.id)) continue;
+    const soft = softening({
+      test: inTests,
+      docs: inDocs,
+      suppressed: foreignSecurityMark(lines[index] ?? "")
+    });
     findings.push({
       ruleId: match.rule.id,
       title: match.rule.title,
       file: relativePath,
       line: match.line,
-      severity: match.severity,
+      severity: soft ? "low" : match.severity,
       confidence: "pattern",
-      message: `${match.rule.title} (${match.rule.cwe})`,
+      message: soft ? `${match.rule.title} (${match.rule.cwe}) \u2014 ${CODE_SOFTENING[soft]}` : `${match.rule.title} (${match.rule.cwe})`,
       consequence: match.rule.consequence,
       cwe: match.rule.cwe,
       excerpt: (lines[index] ?? "").trim().slice(0, 200),