@rigour-labs/core 2.16.0 → 2.17.0

package/dist/gates/ast-handlers/python.d.ts

@@ -3,4 +3,5 @@ import { Failure } from '../../types/index.js';
 export declare class PythonHandler extends ASTHandler {
     supports(file: string): boolean;
     run(context: ASTHandlerContext): Promise<Failure[]>;
+    private getSecurityHint;
 }

package/dist/gates/ast-handlers/python.js

@@ -29,16 +29,19 @@ export class PythonHandler extends ASTHandler {
                 input: context.content,
                 cwd: context.cwd
             });
-            const metrics = JSON.parse(stdout);
-            if (metrics.error)
+            const result = JSON.parse(stdout);
+            if (result.error)
                 return [];
             const astConfig = this.config.ast || {};
+            const safetyConfig = this.config.safety || {};
             const maxComplexity = astConfig.complexity || 10;
             const maxParams = astConfig.max_params || 5;
             const maxMethods = astConfig.max_methods || 10;
+            // Process metrics (complexity, params, methods)
+            const metrics = result.metrics || [];
             for (const item of metrics) {
                 if (item.type === 'function') {
-                    if (item.parameters > maxParams) {
+                    if (item.parameters && item.parameters > maxParams) {
                         failures.push({
                             id: 'AST_MAX_PARAMS',
                             title: `Function '${item.name}' has ${item.parameters} parameters (max: ${maxParams})`,
@@ -47,7 +50,7 @@ export class PythonHandler extends ASTHandler {
                             hint: `Reduce number of parameters or use an options object.`
                         });
                     }
-                    if (item.complexity > maxComplexity) {
+                    if (item.complexity && item.complexity > maxComplexity) {
                         failures.push({
                             id: 'AST_COMPLEXITY',
                             title: `Function '${item.name}' has complexity of ${item.complexity} (max: ${maxComplexity})`,
@@ -58,7 +61,7 @@ export class PythonHandler extends ASTHandler {
                     }
                 }
                 else if (item.type === 'class') {
-                    if (item.methods > maxMethods) {
+                    if (item.methods && item.methods > maxMethods) {
                         failures.push({
                             id: 'AST_MAX_METHODS',
                             title: `Class '${item.name}' has ${item.methods} methods (max: ${maxMethods})`,
@@ -69,10 +72,41 @@ export class PythonHandler extends ASTHandler {
                     }
                 }
             }
+            // Process security issues (CSRF, hardcoded secrets, SQL injection, etc.)
+            const securityIssues = result.security || [];
+            for (const issue of securityIssues) {
+                const issueIdMap = {
+                    'hardcoded_secret': 'SECURITY_HARDCODED_SECRET',
+                    'csrf_disabled': 'SECURITY_CSRF_DISABLED',
+                    'code_injection': 'SECURITY_CODE_INJECTION',
+                    'insecure_deserialization': 'SECURITY_INSECURE_DESERIALIZATION',
+                    'command_injection': 'SECURITY_COMMAND_INJECTION',
+                    'sql_injection': 'SECURITY_SQL_INJECTION'
+                };
+                const id = issueIdMap[issue.issue] || 'SECURITY_ISSUE';
+                failures.push({
+                    id,
+                    title: issue.message,
+                    details: `Security issue in ${context.file} at line ${issue.lineno}: ${issue.name}`,
+                    files: [context.file],
+                    hint: this.getSecurityHint(issue.issue)
+                });
+            }
         }
         catch (e) {
             // If python3 is missing, we skip AST but other gates still run
         }
         return failures;
     }
+    getSecurityHint(issueType) {
+        const hints = {
+            'hardcoded_secret': 'Use environment variables: os.environ.get("SECRET_KEY")',
+            'csrf_disabled': 'Enable CSRF protection for all forms handling sensitive data',
+            'code_injection': 'Avoid eval/exec. Use safer alternatives like ast.literal_eval() for data parsing',
+            'insecure_deserialization': 'Use json.loads() instead of pickle for untrusted data',
+            'command_injection': 'Use subprocess with shell=False and pass arguments as a list',
+            'sql_injection': 'Use parameterized queries: cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))'
+        };
+        return hints[issueType] || 'Review and fix the security issue.';
+    }
 }

package/dist/gates/ast-handlers/typescript.js

@@ -92,6 +92,53 @@ export class TypeScriptHandler extends ASTHandler {
                     });
                 }
             }
+            // === SECURITY CHECKS (Prototype Pollution) ===
+            // Check for direct __proto__ access: obj.__proto__
+            if (ts.isPropertyAccessExpression(node) && ts.isIdentifier(node.name) && node.name.text === '__proto__') {
+                const line = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+                addFailure({
+                    id: 'SECURITY_PROTOTYPE_POLLUTION',
+                    title: `Direct __proto__ access at line ${line}`,
+                    details: `Prototype pollution vulnerability in ${relativePath}:${line}`,
+                    files: [relativePath],
+                    hint: `Use Object.getPrototypeOf() or Object.setPrototypeOf() instead of __proto__.`
+                });
+            }
+            // Check for bracket notation __proto__ access: obj["__proto__"]
+            if (ts.isElementAccessExpression(node) && ts.isStringLiteral(node.argumentExpression)) {
+                const accessKey = node.argumentExpression.text;
+                if (accessKey === '__proto__' || accessKey === 'constructor' || accessKey === 'prototype') {
+                    const line = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+                    addFailure({
+                        id: 'SECURITY_PROTOTYPE_POLLUTION',
+                        title: `Unsafe bracket notation access to '${accessKey}' at line ${line}`,
+                        details: `Potential prototype pollution via bracket notation in ${relativePath}:${line}`,
+                        files: [relativePath],
+                        hint: `Block access to '${accessKey}' property when handling user input. Use allowlist for object keys.`
+                    });
+                }
+            }
+            // Check for Object.assign with user-controllable input (common prototype pollution pattern)
+            if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression)) {
+                const propAccess = node.expression;
+                if (ts.isIdentifier(propAccess.expression) && propAccess.expression.text === 'Object' &&
+                    ts.isIdentifier(propAccess.name) && propAccess.name.text === 'assign') {
+                    // This is Object.assign() - warn if first arg is empty object (merge pattern)
+                    if (node.arguments.length >= 2) {
+                        const firstArg = node.arguments[0];
+                        if (ts.isObjectLiteralExpression(firstArg) && firstArg.properties.length === 0) {
+                            const line = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+                            addFailure({
+                                id: 'SECURITY_PROTOTYPE_POLLUTION_MERGE',
+                                title: `Object.assign() merge pattern at line ${line}`,
+                                details: `Object.assign({}, ...) can propagate prototype pollution in ${relativePath}:${line}`,
+                                files: [relativePath],
+                                hint: `Validate and sanitize source objects before merging. Block __proto__ and constructor keys.`
+                            });
+                        }
+                    }
+                }
+            }
             // === COMPLEXITY CHECKS ===
             if (ts.isFunctionDeclaration(node) || ts.isMethodDeclaration(node) || ts.isArrowFunction(node)) {
                 const name = this.getNodeName(node);

package/dist/pattern-index/staleness.js

@@ -145,6 +145,128 @@ const BUILT_IN_DEPRECATIONS = [
         replacement: "useRouter from 'next/navigation' in App Router",
         severity: 'info',
         reason: 'Use next/navigation for App Router projects'
+    },
+    // ============================================================
+    // SECURITY PATTERNS - Cross-language security vulnerabilities
+    // ============================================================
+    // Python CSRF disabled
+    {
+        pattern: 'csrf\\s*=\\s*False',
+        deprecatedIn: 'security',
+        replacement: "Never disable CSRF protection. Remove 'csrf = False' and use proper CSRF tokens.",
+        severity: 'error',
+        reason: 'CSRF protection is critical for security. Disabling it exposes users to cross-site request forgery attacks.'
+    },
+    {
+        pattern: 'WTF_CSRF_ENABLED\\s*=\\s*False',
+        deprecatedIn: 'security',
+        replacement: "Never disable CSRF. Remove 'WTF_CSRF_ENABLED = False' from config.",
+        severity: 'error',
+        reason: 'Flask-WTF CSRF protection should never be disabled in production.'
+    },
+    {
+        pattern: "@csrf_exempt",
+        deprecatedIn: 'security',
+        replacement: "Remove @csrf_exempt decorator. Use proper CSRF token handling instead.",
+        severity: 'error',
+        reason: 'csrf_exempt bypasses CSRF protection, creating security vulnerabilities.'
+    },
+    // Python hardcoded secrets
+    {
+        pattern: "SECRET_KEY\\s*=\\s*['\"][^'\"]{1,50}['\"]",
+        deprecatedIn: 'security',
+        replacement: "Use os.environ.get('SECRET_KEY') or secrets.token_hex(32)",
+        severity: 'error',
+        reason: 'Hardcoded secrets are exposed in version control and logs. Use environment variables.'
+    },
+    {
+        pattern: "API_KEY\\s*=\\s*['\"][^'\"]+['\"]",
+        deprecatedIn: 'security',
+        replacement: "Use os.environ.get('API_KEY') for API credentials",
+        severity: 'error',
+        reason: 'Hardcoded API keys are a security risk. Use environment variables.'
+    },
+    {
+        pattern: "PASSWORD\\s*=\\s*['\"][^'\"]+['\"]",
+        deprecatedIn: 'security',
+        replacement: "Never hardcode passwords. Use environment variables or secret managers.",
+        severity: 'error',
+        reason: 'Hardcoded passwords are a critical security vulnerability.'
+    },
+    // JavaScript/TypeScript prototype pollution
+    {
+        pattern: '\\.__proto__',
+        deprecatedIn: 'security',
+        replacement: "Use Object.getPrototypeOf() or Object.setPrototypeOf() instead of __proto__",
+        severity: 'error',
+        reason: 'Direct __proto__ access enables prototype pollution attacks.'
+    },
+    {
+        pattern: '\\[\\s*[\'"]__proto__[\'"]\\s*\\]',
+        deprecatedIn: 'security',
+        replacement: "Never allow user input to access __proto__. Validate and sanitize object keys.",
+        severity: 'error',
+        reason: 'Bracket notation access to __proto__ is a prototype pollution vector.'
+    },
+    {
+        pattern: '\\[\\s*[\'"]constructor[\'"]\\s*\\]\\s*\\[',
+        deprecatedIn: 'security',
+        replacement: "Block access to constructor property from user input.",
+        severity: 'error',
+        reason: 'constructor[constructor] pattern enables prototype pollution.'
+    },
+    // SQL Injection patterns
+    {
+        pattern: 'cursor\\.execute\\s*\\(\\s*f[\'"]',
+        deprecatedIn: 'security',
+        replacement: "Use parameterized queries: cursor.execute('SELECT * FROM users WHERE id = %s', (user_id,))",
+        severity: 'error',
+        reason: 'F-string SQL queries are vulnerable to SQL injection attacks.'
+    },
+    {
+        pattern: '\\.execute\\s*\\([^)]*\\+[^)]*\\)',
+        deprecatedIn: 'security',
+        replacement: "Use parameterized queries instead of string concatenation.",
+        severity: 'error',
+        reason: 'String concatenation in SQL queries enables SQL injection.'
+    },
+    // XSS patterns
+    {
+        pattern: 'dangerouslySetInnerHTML',
+        deprecatedIn: 'security',
+        replacement: "Sanitize HTML with DOMPurify before using dangerouslySetInnerHTML, or use safe alternatives.",
+        severity: 'warning',
+        reason: 'dangerouslySetInnerHTML can lead to XSS vulnerabilities if content is not sanitized.'
+    },
+    {
+        pattern: '\\.innerHTML\\s*=',
+        deprecatedIn: 'security',
+        replacement: "Use textContent for text, or sanitize HTML before setting innerHTML.",
+        severity: 'warning',
+        reason: 'Direct innerHTML assignment can lead to XSS attacks.'
+    },
+    // Insecure session/cookie settings
+    {
+        pattern: 'SESSION_COOKIE_SECURE\\s*=\\s*False',
+        deprecatedIn: 'security',
+        replacement: "Set SESSION_COOKIE_SECURE = True in production",
+        severity: 'error',
+        reason: 'Insecure cookies can be intercepted over HTTP connections.'
+    },
+    {
+        pattern: 'SESSION_COOKIE_HTTPONLY\\s*=\\s*False',
+        deprecatedIn: 'security',
+        replacement: "Set SESSION_COOKIE_HTTPONLY = True to prevent XSS cookie theft",
+        severity: 'error',
+        reason: 'Non-HTTPOnly cookies are accessible via JavaScript, enabling XSS attacks.'
+    },
+    // Debug mode in production
+    {
+        pattern: 'DEBUG\\s*=\\s*True',
+        deprecatedIn: 'security',
+        replacement: "Use DEBUG = os.environ.get('DEBUG', 'False') == 'True'",
+        severity: 'warning',
+        reason: 'Debug mode in production exposes sensitive information and stack traces.'
     }
 ];
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/core",
-  "version": "2.16.0",
+  "version": "2.17.0",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/gates/ast-handlers/python.ts

@@ -6,6 +6,29 @@ import { fileURLToPath } from 'url';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
+interface SecurityIssue {
+    type: string;
+    issue: string;
+    name: string;
+    lineno: number;
+    message: string;
+}
+
+interface MetricItem {
+    type: string;
+    name: string;
+    complexity?: number;
+    parameters?: number;
+    methods?: number;
+    lineno: number;
+}
+
+interface PythonAnalysisResult {
+    metrics?: MetricItem[];
+    security?: SecurityIssue[];
+    error?: string;
+}
+
 export class PythonHandler extends ASTHandler {
     supports(file: string): boolean {
         return /\.py$/.test(file);
@@ -34,17 +57,20 @@ export class PythonHandler extends ASTHandler {
                 cwd: context.cwd
             });
 
-            const metrics = JSON.parse(stdout);
-            if (metrics.error) return [];
+            const result: PythonAnalysisResult = JSON.parse(stdout);
+            if (result.error) return [];
 
             const astConfig = this.config.ast || {};
+            const safetyConfig = this.config.safety || {};
             const maxComplexity = astConfig.complexity || 10;
             const maxParams = astConfig.max_params || 5;
             const maxMethods = astConfig.max_methods || 10;
 
+            // Process metrics (complexity, params, methods)
+            const metrics = result.metrics || [];
             for (const item of metrics) {
                 if (item.type === 'function') {
-                    if (item.parameters > maxParams) {
+                    if (item.parameters && item.parameters > maxParams) {
                         failures.push({
                             id: 'AST_MAX_PARAMS',
                             title: `Function '${item.name}' has ${item.parameters} parameters (max: ${maxParams})`,
@@ -53,7 +79,7 @@ export class PythonHandler extends ASTHandler {
                             hint: `Reduce number of parameters or use an options object.`
                         });
                     }
-                    if (item.complexity > maxComplexity) {
+                    if (item.complexity && item.complexity > maxComplexity) {
                         failures.push({
                             id: 'AST_COMPLEXITY',
                             title: `Function '${item.name}' has complexity of ${item.complexity} (max: ${maxComplexity})`,
@@ -63,7 +89,7 @@ export class PythonHandler extends ASTHandler {
                         });
                     }
                 } else if (item.type === 'class') {
-                    if (item.methods > maxMethods) {
+                    if (item.methods && item.methods > maxMethods) {
                         failures.push({
                             id: 'AST_MAX_METHODS',
                             title: `Class '${item.name}' has ${item.methods} methods (max: ${maxMethods})`,
@@ -75,10 +101,45 @@ export class PythonHandler extends ASTHandler {
                 }
             }
 
+            // Process security issues (CSRF, hardcoded secrets, SQL injection, etc.)
+            const securityIssues = result.security || [];
+            for (const issue of securityIssues) {
+                const issueIdMap: Record<string, string> = {
+                    'hardcoded_secret': 'SECURITY_HARDCODED_SECRET',
+                    'csrf_disabled': 'SECURITY_CSRF_DISABLED',
+                    'code_injection': 'SECURITY_CODE_INJECTION',
+                    'insecure_deserialization': 'SECURITY_INSECURE_DESERIALIZATION',
+                    'command_injection': 'SECURITY_COMMAND_INJECTION',
+                    'sql_injection': 'SECURITY_SQL_INJECTION'
+                };
+
+                const id = issueIdMap[issue.issue] || 'SECURITY_ISSUE';
+
+                failures.push({
+                    id,
+                    title: issue.message,
+                    details: `Security issue in ${context.file} at line ${issue.lineno}: ${issue.name}`,
+                    files: [context.file],
+                    hint: this.getSecurityHint(issue.issue)
+                });
+            }
+
         } catch (e: any) {
             // If python3 is missing, we skip AST but other gates still run
         }
 
         return failures;
     }
+
+    private getSecurityHint(issueType: string): string {
+        const hints: Record<string, string> = {
+            'hardcoded_secret': 'Use environment variables: os.environ.get("SECRET_KEY")',
+            'csrf_disabled': 'Enable CSRF protection for all forms handling sensitive data',
+            'code_injection': 'Avoid eval/exec. Use safer alternatives like ast.literal_eval() for data parsing',
+            'insecure_deserialization': 'Use json.loads() instead of pickle for untrusted data',
+            'command_injection': 'Use subprocess with shell=False and pass arguments as a list',
+            'sql_injection': 'Use parameterized queries: cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))'
+        };
+        return hints[issueType] || 'Review and fix the security issue.';
+    }
 }

package/src/gates/ast-handlers/python_parser.py

@@ -1,6 +1,7 @@
 import ast
 import sys
 import json
+import re
 
 class MetricsVisitor(ast.NodeVisitor):
     def __init__(self):
@@ -33,7 +34,7 @@ class MetricsVisitor(ast.NodeVisitor):
                 complexity += len(n.values) - 1
             elif isinstance(n, ast.IfExp):
                 complexity += 1
-        
+
         params = len(node.args.args) + len(node.args.kwonlyargs)
         if node.args.vararg: params += 1
         if node.args.kwarg: params += 1
@@ -46,12 +47,132 @@ class MetricsVisitor(ast.NodeVisitor):
             "lineno": node.lineno
         })
 
+
+class SecurityVisitor(ast.NodeVisitor):
+    """Detects security issues in Python code via AST analysis."""
+
+    def __init__(self, content):
+        self.issues = []
+        self.content = content
+        self.lines = content.split('\n')
+
+    def visit_Assign(self, node):
+        """Check for hardcoded secrets and CSRF disabled."""
+        for target in node.targets:
+            if isinstance(target, ast.Name):
+                name = target.id
+                # Check for hardcoded SECRET_KEY
+                if name == 'SECRET_KEY':
+                    if isinstance(node.value, ast.Constant) and isinstance(node.value.value, str):
+                        self.issues.append({
+                            "type": "security",
+                            "issue": "hardcoded_secret",
+                            "name": "SECRET_KEY",
+                            "lineno": node.lineno,
+                            "message": "Hardcoded SECRET_KEY detected. Use environment variables instead."
+                        })
+                # Check for hardcoded passwords/tokens
+                if name.upper() in ('PASSWORD', 'API_KEY', 'TOKEN', 'AUTH_TOKEN', 'PRIVATE_KEY', 'AWS_SECRET_KEY'):
+                    if isinstance(node.value, ast.Constant) and isinstance(node.value.value, str):
+                        self.issues.append({
+                            "type": "security",
+                            "issue": "hardcoded_secret",
+                            "name": name,
+                            "lineno": node.lineno,
+                            "message": f"Hardcoded {name} detected. Use environment variables instead."
+                        })
+                # Check for csrf = False
+                if name.lower() in ('csrf', 'csrf_enabled', 'wtf_csrf_enabled'):
+                    if isinstance(node.value, ast.Constant) and node.value.value == False:
+                        self.issues.append({
+                            "type": "security",
+                            "issue": "csrf_disabled",
+                            "name": name,
+                            "lineno": node.lineno,
+                            "message": "CSRF protection is disabled. This is a security vulnerability."
+                        })
+        self.generic_visit(node)
+
+    def visit_Call(self, node):
+        """Check for dangerous function calls."""
+        func_name = None
+        if isinstance(node.func, ast.Name):
+            func_name = node.func.id
+        elif isinstance(node.func, ast.Attribute):
+            func_name = node.func.attr
+
+        # Check for eval/exec usage
+        if func_name in ('eval', 'exec'):
+            self.issues.append({
+                "type": "security",
+                "issue": "code_injection",
+                "name": func_name,
+                "lineno": node.lineno,
+                "message": f"Use of {func_name}() detected. This can lead to code injection vulnerabilities."
+            })
+
+        # Check for pickle usage (insecure deserialization)
+        if func_name in ('loads', 'load') and isinstance(node.func, ast.Attribute):
+            if isinstance(node.func.value, ast.Name) and node.func.value.id == 'pickle':
+                self.issues.append({
+                    "type": "security",
+                    "issue": "insecure_deserialization",
+                    "name": "pickle",
+                    "lineno": node.lineno,
+                    "message": "Pickle deserialization is unsafe. Use json instead for untrusted data."
+                })
+
+        # Check for shell=True in subprocess
+        if func_name in ('run', 'call', 'Popen', 'check_output', 'check_call'):
+            for keyword in node.keywords:
+                if keyword.arg == 'shell' and isinstance(keyword.value, ast.Constant) and keyword.value.value == True:
+                    self.issues.append({
+                        "type": "security",
+                        "issue": "command_injection",
+                        "name": func_name,
+                        "lineno": node.lineno,
+                        "message": "shell=True in subprocess can lead to command injection."
+                    })
+
+        self.generic_visit(node)
+
+    def check_sql_injection(self):
+        """Check for SQL injection patterns using regex on source."""
+        sql_patterns = [
+            (r'execute\s*\(\s*["\'].*%s', 'SQL string formatting with %s'),
+            (r'execute\s*\(\s*f["\']', 'SQL f-string'),
+            (r'execute\s*\(\s*["\'].*\+', 'SQL string concatenation'),
+            (r'cursor\.execute\s*\(\s*["\'].*\.format\s*\(', 'SQL .format()'),
+        ]
+        for pattern, desc in sql_patterns:
+            for i, line in enumerate(self.lines, 1):
+                if re.search(pattern, line, re.IGNORECASE):
+                    self.issues.append({
+                        "type": "security",
+                        "issue": "sql_injection",
+                        "name": desc,
+                        "lineno": i,
+                        "message": f"Potential SQL injection: {desc}. Use parameterized queries."
+                    })
+
+
 def analyze_code(content):
     try:
         tree = ast.parse(content)
+
+        # Collect metrics
         visitor = MetricsVisitor()
         visitor.visit(tree)
-        return visitor.metrics
+
+        # Collect security issues
+        security_visitor = SecurityVisitor(content)
+        security_visitor.visit(tree)
+        security_visitor.check_sql_injection()
+
+        return {
+            "metrics": visitor.metrics,
+            "security": security_visitor.issues
+        }
     except Exception as e:
         return {"error": str(e)}
 

package/src/gates/ast-handlers/typescript.ts

@@ -103,6 +103,57 @@ export class TypeScriptHandler extends ASTHandler {
                 }
             }
 
+            // === SECURITY CHECKS (Prototype Pollution) ===
+
+            // Check for direct __proto__ access: obj.__proto__
+            if (ts.isPropertyAccessExpression(node) && ts.isIdentifier(node.name) && node.name.text === '__proto__') {
+                const line = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+                addFailure({
+                    id: 'SECURITY_PROTOTYPE_POLLUTION',
+                    title: `Direct __proto__ access at line ${line}`,
+                    details: `Prototype pollution vulnerability in ${relativePath}:${line}`,
+                    files: [relativePath],
+                    hint: `Use Object.getPrototypeOf() or Object.setPrototypeOf() instead of __proto__.`
+                });
+            }
+
+            // Check for bracket notation __proto__ access: obj["__proto__"]
+            if (ts.isElementAccessExpression(node) && ts.isStringLiteral(node.argumentExpression)) {
+                const accessKey = node.argumentExpression.text;
+                if (accessKey === '__proto__' || accessKey === 'constructor' || accessKey === 'prototype') {
+                    const line = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+                    addFailure({
+                        id: 'SECURITY_PROTOTYPE_POLLUTION',
+                        title: `Unsafe bracket notation access to '${accessKey}' at line ${line}`,
+                        details: `Potential prototype pollution via bracket notation in ${relativePath}:${line}`,
+                        files: [relativePath],
+                        hint: `Block access to '${accessKey}' property when handling user input. Use allowlist for object keys.`
+                    });
+                }
+            }
+
+            // Check for Object.assign with user-controllable input (common prototype pollution pattern)
+            if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression)) {
+                const propAccess = node.expression;
+                if (ts.isIdentifier(propAccess.expression) && propAccess.expression.text === 'Object' &&
+                    ts.isIdentifier(propAccess.name) && propAccess.name.text === 'assign') {
+                    // This is Object.assign() - warn if first arg is empty object (merge pattern)
+                    if (node.arguments.length >= 2) {
+                        const firstArg = node.arguments[0];
+                        if (ts.isObjectLiteralExpression(firstArg) && firstArg.properties.length === 0) {
+                            const line = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+                            addFailure({
+                                id: 'SECURITY_PROTOTYPE_POLLUTION_MERGE',
+                                title: `Object.assign() merge pattern at line ${line}`,
+                                details: `Object.assign({}, ...) can propagate prototype pollution in ${relativePath}:${line}`,
+                                files: [relativePath],
+                                hint: `Validate and sanitize source objects before merging. Block __proto__ and constructor keys.`
+                            });
+                        }
+                    }
+                }
+            }
+
             // === COMPLEXITY CHECKS ===
 
             if (ts.isFunctionDeclaration(node) || ts.isMethodDeclaration(node) || ts.isArrowFunction(node)) {

package/src/pattern-index/staleness.ts

@@ -159,6 +159,136 @@ const BUILT_IN_DEPRECATIONS: DeprecationEntry[] = [
         replacement: "useRouter from 'next/navigation' in App Router",
         severity: 'info',
         reason: 'Use next/navigation for App Router projects'
+    },
+
+    // ============================================================
+    // SECURITY PATTERNS - Cross-language security vulnerabilities
+    // ============================================================
+
+    // Python CSRF disabled
+    {
+        pattern: 'csrf\\s*=\\s*False',
+        deprecatedIn: 'security',
+        replacement: "Never disable CSRF protection. Remove 'csrf = False' and use proper CSRF tokens.",
+        severity: 'error',
+        reason: 'CSRF protection is critical for security. Disabling it exposes users to cross-site request forgery attacks.'
+    },
+    {
+        pattern: 'WTF_CSRF_ENABLED\\s*=\\s*False',
+        deprecatedIn: 'security',
+        replacement: "Never disable CSRF. Remove 'WTF_CSRF_ENABLED = False' from config.",
+        severity: 'error',
+        reason: 'Flask-WTF CSRF protection should never be disabled in production.'
+    },
+    {
+        pattern: "@csrf_exempt",
+        deprecatedIn: 'security',
+        replacement: "Remove @csrf_exempt decorator. Use proper CSRF token handling instead.",
+        severity: 'error',
+        reason: 'csrf_exempt bypasses CSRF protection, creating security vulnerabilities.'
+    },
+
+    // Python hardcoded secrets
+    {
+        pattern: "SECRET_KEY\\s*=\\s*['\"][^'\"]{1,50}['\"]",
+        deprecatedIn: 'security',
+        replacement: "Use os.environ.get('SECRET_KEY') or secrets.token_hex(32)",
+        severity: 'error',
+        reason: 'Hardcoded secrets are exposed in version control and logs. Use environment variables.'
+    },
+    {
+        pattern: "API_KEY\\s*=\\s*['\"][^'\"]+['\"]",
+        deprecatedIn: 'security',
+        replacement: "Use os.environ.get('API_KEY') for API credentials",
+        severity: 'error',
+        reason: 'Hardcoded API keys are a security risk. Use environment variables.'
+    },
+    {
+        pattern: "PASSWORD\\s*=\\s*['\"][^'\"]+['\"]",
+        deprecatedIn: 'security',
+        replacement: "Never hardcode passwords. Use environment variables or secret managers.",
+        severity: 'error',
+        reason: 'Hardcoded passwords are a critical security vulnerability.'
+    },
+
+    // JavaScript/TypeScript prototype pollution
+    {
+        pattern: '\\.__proto__',
+        deprecatedIn: 'security',
+        replacement: "Use Object.getPrototypeOf() or Object.setPrototypeOf() instead of __proto__",
+        severity: 'error',
+        reason: 'Direct __proto__ access enables prototype pollution attacks.'
+    },
+    {
+        pattern: '\\[\\s*[\'"]__proto__[\'"]\\s*\\]',
+        deprecatedIn: 'security',
+        replacement: "Never allow user input to access __proto__. Validate and sanitize object keys.",
+        severity: 'error',
+        reason: 'Bracket notation access to __proto__ is a prototype pollution vector.'
+    },
+    {
+        pattern: '\\[\\s*[\'"]constructor[\'"]\\s*\\]\\s*\\[',
+        deprecatedIn: 'security',
+        replacement: "Block access to constructor property from user input.",
+        severity: 'error',
+        reason: 'constructor[constructor] pattern enables prototype pollution.'
+    },
+
+    // SQL Injection patterns
+    {
+        pattern: 'cursor\\.execute\\s*\\(\\s*f[\'"]',
+        deprecatedIn: 'security',
+        replacement: "Use parameterized queries: cursor.execute('SELECT * FROM users WHERE id = %s', (user_id,))",
+        severity: 'error',
+        reason: 'F-string SQL queries are vulnerable to SQL injection attacks.'
+    },
+    {
+        pattern: '\\.execute\\s*\\([^)]*\\+[^)]*\\)',
+        deprecatedIn: 'security',
+        replacement: "Use parameterized queries instead of string concatenation.",
+        severity: 'error',
+        reason: 'String concatenation in SQL queries enables SQL injection.'
+    },
+
+    // XSS patterns
+    {
+        pattern: 'dangerouslySetInnerHTML',
+        deprecatedIn: 'security',
+        replacement: "Sanitize HTML with DOMPurify before using dangerouslySetInnerHTML, or use safe alternatives.",
+        severity: 'warning',
+        reason: 'dangerouslySetInnerHTML can lead to XSS vulnerabilities if content is not sanitized.'
+    },
+    {
+        pattern: '\\.innerHTML\\s*=',
+        deprecatedIn: 'security',
+        replacement: "Use textContent for text, or sanitize HTML before setting innerHTML.",
+        severity: 'warning',
+        reason: 'Direct innerHTML assignment can lead to XSS attacks.'
+    },
+
+    // Insecure session/cookie settings
+    {
+        pattern: 'SESSION_COOKIE_SECURE\\s*=\\s*False',
+        deprecatedIn: 'security',
+        replacement: "Set SESSION_COOKIE_SECURE = True in production",
+        severity: 'error',
+        reason: 'Insecure cookies can be intercepted over HTTP connections.'
+    },
+    {
+        pattern: 'SESSION_COOKIE_HTTPONLY\\s*=\\s*False',
+        deprecatedIn: 'security',
+        replacement: "Set SESSION_COOKIE_HTTPONLY = True to prevent XSS cookie theft",
+        severity: 'error',
+        reason: 'Non-HTTPOnly cookies are accessible via JavaScript, enabling XSS attacks.'
+    },
+
+    // Debug mode in production
+    {
+        pattern: 'DEBUG\\s*=\\s*True',
+        deprecatedIn: 'security',
+        replacement: "Use DEBUG = os.environ.get('DEBUG', 'False') == 'True'",
+        severity: 'warning',
+        reason: 'Debug mode in production exposes sensitive information and stack traces.'
     }
 ];