@quantracode/vibecheck 0.0.1 → 0.0.2

package/dist/scanners/auth/middleware-gap.js

@@ -1,203 +0,0 @@
-import { readFileSync, resolvePath } from "../../utils/file-utils.js";
-import { generateFingerprint, generateFindingId } from "../../utils/fingerprint.js";
-const RULE_MW_001 = "VC-MW-001";
-const RULE_AUTH_INFO_001 = "VC-AUTH-INFO-001";
-/**
- * Parse matcher config from middleware file
- *
- * Looks for patterns like:
- * - export const config = { matcher: '/api/:path*' }
- * - export const config = { matcher: ['/api/:path*', '/admin/:path*'] }
- */
-export function parseMatcherConfig(content) {
-    // Look for config export with matcher
-    const configMatch = content.match(/export\s+const\s+config\s*=\s*\{[^}]*matcher\s*:\s*([^}]+)\}/s);
-    if (!configMatch) {
-        return null; // No config export found
-    }
-    const matcherPart = configMatch[1];
-    // Check for array matcher: ['/path1', '/path2']
-    const arrayMatch = matcherPart.match(/\[([^\]]+)\]/);
-    if (arrayMatch) {
-        const items = arrayMatch[1];
-        const paths = [];
-        // Extract string literals
-        const stringMatches = items.matchAll(/['"]([^'"]+)['"]/g);
-        for (const m of stringMatches) {
-            paths.push(m[1]);
-        }
-        return paths;
-    }
-    // Check for single string matcher: '/path'
-    const stringMatch = matcherPart.match(/['"]([^'"]+)['"]/);
-    if (stringMatch) {
-        return [stringMatch[1]];
-    }
-    return null;
-}
-/**
- * Check if any matcher pattern covers /api routes
- */
-export function matcherCoversApi(matchers) {
-    for (const matcher of matchers) {
-        // Direct /api match
-        if (matcher === "/api" || matcher === "/api/:path*") {
-            return true;
-        }
-        // Pattern starts with /api
-        if (matcher.startsWith("/api/") || matcher.startsWith("/api:")) {
-            return true;
-        }
-        // Catch-all that would include /api
-        if (matcher === "/:path*" || matcher === "/(.*)" || matcher === "/(.*)") {
-            return true;
-        }
-        // Negation pattern - check if it's excluding something else but including api
-        // e.g., '/((?!_next/static|_next/image|favicon.ico).*)'
-        if (matcher.includes("(?!") && !matcher.includes("api")) {
-            return true;
-        }
-    }
-    return false;
-}
-/**
- * VC-MW-001: Middleware matcher gap for /api coverage
- * VC-AUTH-INFO-001: Missing middleware with next-auth
- *
- * Checks if middleware properly covers API routes
- */
-export async function scanMiddlewareGap(context) {
-    const { repoRoot, fileIndex, repoMeta } = context;
-    const findings = [];
-    // Only run for Next.js projects
-    if (repoMeta.framework !== "next") {
-        return findings;
-    }
-    const hasApiRoutes = fileIndex.apiRouteFiles.length > 0;
-    if (!hasApiRoutes) {
-        return findings; // No API routes to protect
-    }
-    const middlewarePath = fileIndex.middlewareFile;
-    if (!middlewarePath) {
-        // No middleware file exists
-        if (repoMeta.hasNextAuth) {
-            // Has next-auth but no middleware - likely missing protection
-            const evidence = [
-                {
-                    file: "package.json",
-                    startLine: 1,
-                    endLine: 1,
-                    label: "next-auth dependency present",
-                },
-                ...fileIndex.apiRouteFiles.slice(0, 3).map((route) => ({
-                    file: route,
-                    startLine: 1,
-                    endLine: 1,
-                    label: "API route without middleware protection",
-                })),
-            ];
-            const fingerprint = generateFingerprint({
-                ruleId: RULE_AUTH_INFO_001,
-                file: "middleware.ts",
-                symbol: "missing",
-            });
-            findings.push({
-                id: generateFindingId({
-                    ruleId: RULE_AUTH_INFO_001,
-                    file: "middleware.ts",
-                    symbol: "missing",
-                }),
-                severity: "medium",
-                confidence: 0.7,
-                category: "auth",
-                ruleId: RULE_AUTH_INFO_001,
-                title: "Next.js middleware missing with next-auth dependency",
-                description: `This Next.js project uses next-auth but has no middleware.ts file. API routes (${fileIndex.apiRouteFiles.length} found) may lack server-side authentication enforcement. While next-auth provides session management, middleware is recommended for edge-level protection.`,
-                evidence,
-                remediation: {
-                    recommendedFix: "Create a middleware.ts file that checks authentication for protected routes. See: https://next-auth.js.org/configuration/nextjs#middleware",
-                    patch: `// middleware.ts
-import { withAuth } from "next-auth/middleware";
-
-export default withAuth({
-  callbacks: {
-    authorized: ({ token }) => !!token,
-  },
-});
-
-export const config = {
-  matcher: ["/api/:path*", "/dashboard/:path*"],
-};`,
-                },
-                links: {
-                    owasp: "https://owasp.org/Top10/A01_2021-Broken_Access_Control/",
-                },
-                fingerprint,
-            });
-        }
-        return findings;
-    }
-    // Middleware exists - check if it covers API routes
-    const middlewareContent = readFileSync(resolvePath(repoRoot, middlewarePath));
-    if (!middlewareContent) {
-        return findings;
-    }
-    const matchers = parseMatcherConfig(middlewareContent);
-    // If no matcher config, middleware applies to all routes (except static)
-    if (matchers === null) {
-        return findings; // Likely covers everything
-    }
-    // Check if matchers cover /api
-    if (!matcherCoversApi(matchers)) {
-        const lines = middlewareContent.split("\n");
-        let configLine = 1;
-        for (let i = 0; i < lines.length; i++) {
-            if (lines[i].includes("config") && lines[i].includes("matcher")) {
-                configLine = i + 1;
-                break;
-            }
-        }
-        const evidence = [
-            {
-                file: middlewarePath,
-                startLine: configLine,
-                endLine: configLine,
-                snippet: `matcher: ${JSON.stringify(matchers)}`,
-                label: "Middleware matcher does not include /api routes",
-            },
-            ...fileIndex.apiRouteFiles.slice(0, 2).map((route) => ({
-                file: route,
-                startLine: 1,
-                endLine: 1,
-                label: "API route not covered by middleware",
-            })),
-        ];
-        const fingerprint = generateFingerprint({
-            ruleId: RULE_MW_001,
-            file: middlewarePath,
-            symbol: "matcher",
-        });
-        findings.push({
-            id: generateFindingId({
-                ruleId: RULE_MW_001,
-                file: middlewarePath,
-                symbol: "matcher",
-            }),
-            severity: "high",
-            confidence: 0.85,
-            category: "middleware",
-            ruleId: RULE_MW_001,
-            title: "Next.js middleware matcher does not cover API routes",
-            description: `The middleware.ts file has a matcher configuration that does not include /api routes. Found ${fileIndex.apiRouteFiles.length} API route(s) that are not protected by middleware. Current matcher: ${JSON.stringify(matchers)}`,
-            evidence,
-            remediation: {
-                recommendedFix: `Update the middleware matcher to include API routes. Example: matcher: ['/((?!_next/static|_next/image|favicon.ico).*)', '/api/:path*']`,
-            },
-            links: {
-                owasp: "https://owasp.org/Top10/A01_2021-Broken_Access_Control/",
-            },
-            fingerprint,
-        });
-    }
-    return findings;
-}

package/dist/scanners/auth/unprotected-api-route.d.ts

@@ -1,12 +0,0 @@
-import type { Finding } from "@vibecheck/schema";
-import type { ScanContext } from "../types.js";
-/**
- * VC-AUTH-001: Unprotected state-changing API route
- *
- * Identifies Next.js App Router route handlers that:
- * 1. Export POST/PUT/PATCH/DELETE methods
- * 2. Contain database write/delete operations or export functionality
- * 3. Do NOT contain any server-side auth checks
- */
-export declare function scanUnprotectedApiRoutes(context: ScanContext): Promise<Finding[]>;
-//# sourceMappingURL=unprotected-api-route.d.ts.map

package/dist/scanners/auth/unprotected-api-route.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"unprotected-api-route.d.ts","sourceRoot":"","sources":["../../../src/scanners/auth/unprotected-api-route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAA0B,MAAM,mBAAmB,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAU,MAAM,aAAa,CAAC;AAqCvD;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAqGvF"}

package/dist/scanners/auth/unprotected-api-route.js

@@ -1,126 +0,0 @@
-import { resolvePath } from "../../utils/file-utils.js";
-import { generateFingerprint, generateFindingId } from "../../utils/fingerprint.js";
-const RULE_ID = "VC-AUTH-001";
-/**
- * Methods that modify state and require authentication
- */
-const STATE_CHANGING_METHODS = ["POST", "PUT", "PATCH", "DELETE"];
-/**
- * Extract route path from file path
- * e.g., app/api/users/route.ts -> /api/users
- */
-function extractRoutePath(filePath) {
-    // Normalize slashes
-    const normalized = filePath.replace(/\\/g, "/");
-    // Extract from app/api/... pattern
-    const match = normalized.match(/(?:app|src\/app)(\/api\/[^/]+(?:\/[^/]+)*?)\/route\.[tj]sx?$/);
-    if (match) {
-        return match[1];
-    }
-    // Fallback: just return the file path
-    return normalized;
-}
-/**
- * Determine severity based on sink type
- */
-function getSeverity(sinks) {
-    const hasCritical = sinks.some((s) => s.isCritical);
-    return hasCritical ? "critical" : "high";
-}
-/**
- * VC-AUTH-001: Unprotected state-changing API route
- *
- * Identifies Next.js App Router route handlers that:
- * 1. Export POST/PUT/PATCH/DELETE methods
- * 2. Contain database write/delete operations or export functionality
- * 3. Do NOT contain any server-side auth checks
- */
-export async function scanUnprotectedApiRoutes(context) {
-    const { repoRoot, fileIndex, helpers, repoMeta } = context;
-    const findings = [];
-    // Only scan Next.js projects
-    if (repoMeta.framework !== "next") {
-        return findings;
-    }
-    // Scan API route files
-    for (const relPath of fileIndex.apiRouteFiles) {
-        const absPath = resolvePath(repoRoot, relPath);
-        const sourceFile = helpers.parseFile(absPath);
-        if (!sourceFile)
-            continue;
-        const handlers = helpers.findRouteHandlers(sourceFile);
-        for (const handler of handlers) {
-            // Only check state-changing methods
-            if (!STATE_CHANGING_METHODS.includes(handler.method)) {
-                continue;
-            }
-            // Check for auth
-            const hasAuth = helpers.containsAuthCheck(handler.functionNode);
-            if (hasAuth) {
-                continue;
-            }
-            // Find database sinks
-            const sinks = helpers.findDbSinks(handler.functionNode);
-            // Only flag if there are dangerous sinks
-            if (sinks.length === 0) {
-                continue;
-            }
-            const routePath = extractRoutePath(relPath);
-            const severity = getSeverity(sinks);
-            const evidence = [
-                {
-                    file: relPath,
-                    startLine: handler.startLine,
-                    endLine: handler.endLine,
-                    snippet: helpers.getNodeText(handler.functionNode).slice(0, 200) + "...",
-                    label: `Unprotected ${handler.method} handler`,
-                },
-                ...sinks.slice(0, 2).map((sink) => ({
-                    file: relPath,
-                    startLine: sink.line,
-                    endLine: sink.line,
-                    snippet: sink.snippet,
-                    label: `${sink.kind} ${sink.operation} operation without auth check`,
-                })),
-            ];
-            const fingerprint = generateFingerprint({
-                ruleId: RULE_ID,
-                file: relPath,
-                symbol: handler.method,
-                route: routePath,
-            });
-            const sinkOperations = sinks.map((s) => `${s.kind}.${s.operation}`).join(", ");
-            findings.push({
-                id: generateFindingId({
-                    ruleId: RULE_ID,
-                    file: relPath,
-                    symbol: handler.method,
-                }),
-                ruleId: RULE_ID,
-                title: `Unprotected ${handler.method} route: ${routePath}`,
-                description: `The API route ${routePath} exports a ${handler.method} handler that performs database operations (${sinkOperations}) without any authentication checks. An attacker could invoke this endpoint directly to modify or delete data without authorization.`,
-                severity,
-                confidence: 0.88,
-                category: "auth",
-                evidence,
-                remediation: {
-                    recommendedFix: `Add authentication to the ${handler.method} handler. Check for a valid session using getServerSession(), auth(), or similar before performing database operations.`,
-                    patch: `// Add at the start of your handler:
-const session = await getServerSession(authOptions);
-if (!session) {
-  return new Response(JSON.stringify({ error: "Unauthorized" }), {
-    status: 401,
-    headers: { "Content-Type": "application/json" }
-  });
-}`,
-                },
-                links: {
-                    owasp: "https://owasp.org/Top10/A01_2021-Broken_Access_Control/",
-                    cwe: "https://cwe.mitre.org/data/definitions/306.html",
-                },
-                fingerprint,
-            });
-        }
-    }
-    return findings;
-}

package/dist/scanners/config/index.d.ts

@@ -1,5 +0,0 @@
-import type { ScannerPack } from "../types.js";
-export declare const configPack: ScannerPack;
-export { scanUndocumentedEnv, parseEnvExample, findEnvUsages } from "./undocumented-env.js";
-export { scanInsecureDefaults } from "./insecure-defaults.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/scanners/config/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/scanners/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/C,eAAO,MAAM,UAAU,EAAE,WAIxB,CAAC;AAGF,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC5F,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/scanners/config/index.js

@@ -1,10 +0,0 @@
-import { scanUndocumentedEnv } from "./undocumented-env.js";
-import { scanInsecureDefaults } from "./insecure-defaults.js";
-export const configPack = {
-    id: "config",
-    name: "Configuration & Secrets",
-    scanners: [scanUndocumentedEnv, scanInsecureDefaults],
-};
-// Re-export for testing
-export { scanUndocumentedEnv, parseEnvExample, findEnvUsages } from "./undocumented-env.js";
-export { scanInsecureDefaults } from "./insecure-defaults.js";

package/dist/scanners/config/insecure-defaults.d.ts

@@ -1,12 +0,0 @@
-import type { Finding } from "@vibecheck/schema";
-import type { ScanContext } from "../types.js";
-/**
- * VC-CONFIG-002: Insecure default secret fallback
- *
- * Detects patterns:
- * - process.env.* ?? "dev"
- * - process.env.* || "dev"
- * - Hardcoded secret strings assigned to SECRET/TOKEN/KEY/PASSWORD vars
- */
-export declare function scanInsecureDefaults(context: ScanContext): Promise<Finding[]>;
-//# sourceMappingURL=insecure-defaults.d.ts.map

package/dist/scanners/config/insecure-defaults.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"insecure-defaults.d.ts","sourceRoot":"","sources":["../../../src/scanners/config/insecure-defaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAA0B,MAAM,mBAAmB,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAM/C;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAwEnF"}

package/dist/scanners/config/insecure-defaults.js

@@ -1,77 +0,0 @@
-import { resolvePath } from "../../utils/file-utils.js";
-import { generateFingerprint, generateFindingId } from "../../utils/fingerprint.js";
-const RULE_ID = "VC-CONFIG-002";
-/**
- * VC-CONFIG-002: Insecure default secret fallback
- *
- * Detects patterns:
- * - process.env.* ?? "dev"
- * - process.env.* || "dev"
- * - Hardcoded secret strings assigned to SECRET/TOKEN/KEY/PASSWORD vars
- */
-export async function scanInsecureDefaults(context) {
-    const { repoRoot, fileIndex, helpers } = context;
-    const findings = [];
-    // Scan all source files
-    for (const relPath of fileIndex.allSourceFiles) {
-        const absPath = resolvePath(repoRoot, relPath);
-        const sourceFile = helpers.parseFile(absPath);
-        if (!sourceFile)
-            continue;
-        const insecureDefaults = helpers.findInsecureDefaults(sourceFile);
-        for (const def of insecureDefaults) {
-            const severity = def.isCritical ? "critical" : "medium";
-            const evidence = [
-                {
-                    file: relPath,
-                    startLine: def.line,
-                    endLine: def.line,
-                    snippet: def.snippet,
-                    label: def.isCritical
-                        ? `Critical secret with hardcoded fallback: ${def.envVar}`
-                        : `Environment variable with hardcoded fallback: ${def.envVar}`,
-                },
-            ];
-            const fingerprint = generateFingerprint({
-                ruleId: RULE_ID,
-                file: relPath,
-                symbol: def.envVar,
-                startLine: def.line,
-            });
-            findings.push({
-                id: generateFindingId({
-                    ruleId: RULE_ID,
-                    file: relPath,
-                    symbol: def.envVar,
-                    startLine: def.line,
-                }),
-                ruleId: RULE_ID,
-                title: `Insecure default for ${def.envVar}`,
-                description: def.isCritical
-                    ? `The secret ${def.envVar} has a hardcoded fallback value "${def.fallbackValue.slice(0, 20)}${def.fallbackValue.length > 20 ? "..." : ""}". This is a critical security issue as the fallback value may be used in production if the environment variable is not set, potentially exposing a weak or predictable secret.`
-                    : `The environment variable ${def.envVar} has a hardcoded fallback value. While this may be intended for development, it could lead to insecure defaults being used in production.`,
-                severity,
-                confidence: def.isCritical ? 0.95 : 0.8,
-                category: "config",
-                evidence,
-                remediation: {
-                    recommendedFix: `Remove the hardcoded fallback and require the environment variable to be explicitly set. Add validation at startup to fail fast if required secrets are missing.`,
-                    patch: `// Instead of:
-const secret = process.env.${def.envVar} || "hardcoded";
-
-// Do:
-const secret = process.env.${def.envVar};
-if (!secret) {
-  throw new Error("${def.envVar} environment variable is required");
-}`,
-                },
-                links: {
-                    cwe: "https://cwe.mitre.org/data/definitions/798.html",
-                    owasp: "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/",
-                },
-                fingerprint,
-            });
-        }
-    }
-    return findings;
-}

package/dist/scanners/config/undocumented-env.d.ts

@@ -1,24 +0,0 @@
-import type { Finding } from "@vibecheck/schema";
-import type { ScanContext } from "../types.js";
-interface EnvUsage {
-    name: string;
-    file: string;
-    line: number;
-    snippet: string;
-}
-/**
- * Parse .env.example file and extract defined variable names
- */
-export declare function parseEnvExample(content: string): Set<string>;
-/**
- * Find all process.env usages in source files
- */
-export declare function findEnvUsages(sourceFiles: string[], targetDir: string): EnvUsage[];
-/**
- * VC-CONFIG-001: Undocumented environment variable
- *
- * Finds process.env usage and checks if variables are documented in .env.example
- */
-export declare function scanUndocumentedEnv(context: ScanContext): Promise<Finding[]>;
-export {};
-//# sourceMappingURL=undocumented-env.d.ts.map

package/dist/scanners/config/undocumented-env.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"undocumented-env.d.ts","sourceRoot":"","sources":["../../../src/scanners/config/undocumented-env.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAA0B,MAAM,mBAAmB,CAAC;AAGzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAoB/C,UAAU,QAAQ;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAiB5D;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,EAAE,EACrB,SAAS,EAAE,MAAM,GAChB,QAAQ,EAAE,CA6CZ;AASD;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAmFlF"}

package/dist/scanners/config/undocumented-env.js

@@ -1,159 +0,0 @@
-import { readFileSync, resolvePath } from "../../utils/file-utils.js";
-import { generateFingerprint, generateFindingId } from "../../utils/fingerprint.js";
-const RULE_ID = "VC-CONFIG-001";
-/**
- * Patterns that indicate a secret-like environment variable
- */
-const SECRET_PATTERNS = /SECRET|KEY|TOKEN|PASSWORD|PRIVATE|CREDENTIAL|API_KEY|AUTH/i;
-/**
- * Regex to find process.env.VARIABLE_NAME usage
- * Captures the variable name in group 1
- */
-const PROCESS_ENV_REGEX = /process\.env\.([A-Z][A-Z0-9_]*)/g;
-/**
- * Regex to find process.env["VARIABLE"] or process.env['VARIABLE'] usage
- */
-const PROCESS_ENV_BRACKET_REGEX = /process\.env\[['"]([A-Z][A-Z0-9_]*)['"]\]/g;
-/**
- * Parse .env.example file and extract defined variable names
- */
-export function parseEnvExample(content) {
-    const vars = new Set();
-    const lines = content.split("\n");
-    for (const line of lines) {
-        const trimmed = line.trim();
-        // Skip comments and empty lines
-        if (trimmed.startsWith("#") || trimmed === "")
-            continue;
-        // Match VAR_NAME= or VAR_NAME (without value)
-        const match = trimmed.match(/^([A-Z][A-Z0-9_]*)(?:=|$)/);
-        if (match) {
-            vars.add(match[1]);
-        }
-    }
-    return vars;
-}
-/**
- * Find all process.env usages in source files
- */
-export function findEnvUsages(sourceFiles, targetDir) {
-    const usages = [];
-    for (const relFile of sourceFiles) {
-        const absPath = resolvePath(targetDir, relFile);
-        const content = readFileSync(absPath);
-        if (!content)
-            continue;
-        const lines = content.split("\n");
-        // Find dot notation: process.env.VAR_NAME
-        for (const match of content.matchAll(PROCESS_ENV_REGEX)) {
-            const varName = match[1];
-            const index = match.index;
-            // Find line number
-            const beforeMatch = content.slice(0, index);
-            const lineNumber = beforeMatch.split("\n").length;
-            usages.push({
-                name: varName,
-                file: relFile,
-                line: lineNumber,
-                snippet: lines[lineNumber - 1]?.trim() ?? "",
-            });
-        }
-        // Find bracket notation: process.env["VAR_NAME"]
-        for (const match of content.matchAll(PROCESS_ENV_BRACKET_REGEX)) {
-            const varName = match[1];
-            const index = match.index;
-            const beforeMatch = content.slice(0, index);
-            const lineNumber = beforeMatch.split("\n").length;
-            usages.push({
-                name: varName,
-                file: relFile,
-                line: lineNumber,
-                snippet: lines[lineNumber - 1]?.trim() ?? "",
-            });
-        }
-    }
-    return usages;
-}
-/**
- * Determine severity based on variable name
- */
-function getSeverity(varName) {
-    return SECRET_PATTERNS.test(varName) ? "high" : "medium";
-}
-/**
- * VC-CONFIG-001: Undocumented environment variable
- *
- * Finds process.env usage and checks if variables are documented in .env.example
- */
-export async function scanUndocumentedEnv(context) {
-    const { repoRoot, fileIndex } = context;
-    const findings = [];
-    // Check for .env.example
-    const envExamplePath = resolvePath(repoRoot, ".env.example");
-    const envExampleContent = readFileSync(envExamplePath);
-    // Get documented env vars (empty set if no .env.example)
-    const documentedVars = envExampleContent
-        ? parseEnvExample(envExampleContent)
-        : new Set();
-    // Find all env usages
-    const usages = findEnvUsages(fileIndex.allSourceFiles, repoRoot);
-    // Group usages by variable name
-    const usagesByVar = new Map();
-    for (const usage of usages) {
-        const existing = usagesByVar.get(usage.name) ?? [];
-        existing.push(usage);
-        usagesByVar.set(usage.name, existing);
-    }
-    // Check each variable
-    for (const [varName, varUsages] of usagesByVar) {
-        if (documentedVars.has(varName)) {
-            continue; // Variable is documented, no finding
-        }
-        const severity = getSeverity(varName);
-        const firstUsage = varUsages[0];
-        const evidence = varUsages.slice(0, 3).map((u) => ({
-            file: u.file,
-            startLine: u.line,
-            endLine: u.line,
-            snippet: u.snippet,
-            label: `Usage of process.env.${varName}`,
-        }));
-        if (varUsages.length > 3) {
-            evidence.push({
-                file: varUsages[3].file,
-                startLine: varUsages[3].line,
-                endLine: varUsages[3].line,
-                label: `...and ${varUsages.length - 3} more usages`,
-            });
-        }
-        const fingerprint = generateFingerprint({
-            ruleId: RULE_ID,
-            file: firstUsage.file,
-            symbol: varName,
-        });
-        const hasEnvExample = envExampleContent !== null;
-        findings.push({
-            id: generateFindingId({
-                ruleId: RULE_ID,
-                file: firstUsage.file,
-                symbol: varName,
-            }),
-            severity,
-            confidence: 0.85,
-            category: "config",
-            ruleId: RULE_ID,
-            title: `Undocumented environment variable: ${varName}`,
-            description: hasEnvExample
-                ? `The environment variable "${varName}" is used in the codebase but is not listed in .env.example. This can lead to deployment issues or confusion for other developers.`
-                : `The environment variable "${varName}" is used but no .env.example file exists. Consider creating one to document required configuration.`,
-            evidence,
-            remediation: {
-                recommendedFix: hasEnvExample
-                    ? `Add "${varName}=" to .env.example with an appropriate default or placeholder value.`
-                    : `Create a .env.example file and add "${varName}=" with documentation.`,
-            },
-            fingerprint,
-        });
-    }
-    return findings;
-}

package/dist/scanners/crypto/index.d.ts

@@ -1,6 +0,0 @@
-import type { ScannerPack } from "../types.js";
-export declare const cryptoPack: ScannerPack;
-export { scanMathRandomTokens } from "./math-random-tokens.js";
-export { scanJwtDecodeUnverified } from "./jwt-decode-unverified.js";
-export { scanWeakHashing } from "./weak-hashing.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/scanners/crypto/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/scanners/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAK/C,eAAO,MAAM,UAAU,EAAE,WAIxB,CAAC;AAEF,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/scanners/crypto/index.js

@@ -1,11 +0,0 @@
-import { scanMathRandomTokens } from "./math-random-tokens.js";
-import { scanJwtDecodeUnverified } from "./jwt-decode-unverified.js";
-import { scanWeakHashing } from "./weak-hashing.js";
-export const cryptoPack = {
-    id: "crypto",
-    name: "Cryptography Security",
-    scanners: [scanMathRandomTokens, scanJwtDecodeUnverified, scanWeakHashing],
-};
-export { scanMathRandomTokens } from "./math-random-tokens.js";
-export { scanJwtDecodeUnverified } from "./jwt-decode-unverified.js";
-export { scanWeakHashing } from "./weak-hashing.js";