@sphior/scan 0.1.0 → 0.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +11 -9
  2. package/package.json +4 -4
package/README.md CHANGED
@@ -1,10 +1,11 @@
1
1
  # @sphior/scan
2
2
 
3
- Deterministic security scanner for source code — **secrets**, **insecure patterns (CWE)** and
4
- **vulnerable dependencies** — with no AI and no source upload.
3
+ Deterministic security scanner for source code — **hardcoded secrets** and
4
+ **insecure patterns (CWE)** — with no AI, no network and no source upload.
5
5
 
6
- Detection is 100% deterministic (regex + entropy + AST/taint analysis + OSV lookups), so the
7
- same code always produces the same findings. Your source never leaves the machine it runs on.
6
+ Detection is 100% deterministic (regex + entropy + AST/taint analysis), so the same code always
7
+ produces the same findings. The scan makes no network requests at all: your source never leaves
8
+ the machine it runs on, and it works offline.
8
9
 
9
10
  ```bash
10
11
  npx @sphior/scan run ./src
@@ -61,7 +62,10 @@ which is what you want in CI.
61
62
  |---|---|
62
63
  | Hardcoded secrets | Provider-specific patterns + entropy analysis. Well-known documentation placeholders are excluded, so example keys don't create noise. |
63
64
  | Insecure patterns (CWE) | AST-based, including taint tracking from untrusted sources to dangerous sinks (SQL injection, XSS, command injection and similar). |
64
- | Vulnerable dependencies | Lockfile parsing across ecosystems, resolved against the OSV database. |
65
+
66
+ Dependency (SCA) scanning is **not** part of this CLI. The engine accepts SCA input, but the
67
+ `run` command only analyses source files. Dependency vulnerabilities are surfaced by SPHIOR CODE
68
+ on GitHub, which resolves lockfiles against the OSV database.
65
69
 
66
70
  Findings carry a rule id, severity, CWE where applicable, and the exact file and line.
67
71
 
@@ -79,10 +83,8 @@ analysed locally — nothing is sent anywhere.
79
83
 
80
84
  ## Privacy
81
85
 
82
- The scanner reads your files and reports what it found. It does not upload source code,
83
- does not call a language model, and does not require an account. Dependency checks send
84
- package names and versions (never source) to the OSV database to look up known
85
- vulnerabilities.
86
+ The scanner reads your files and reports what it found. It makes no network requests: no source
87
+ upload, no telemetry, no language model, no account. It runs correctly with networking disabled.
86
88
 
87
89
  ## Links
88
90
 
package/package.json CHANGED
@@ -1,10 +1,10 @@
1
1
  {
2
2
  "name": "@sphior/scan",
3
- "version": "0.1.0",
4
- "description": "SPHIOR CODE deterministic scan engine — secrets + insecure-pattern (CWE) + SCA detection with tamper-evident evidence. One engine shared by CLI, LSP (VS Code / JetBrains) and CI.",
3
+ "version": "0.1.1",
4
+ "description": "Deterministic source scanner — hardcoded secrets and insecure patterns (CWE) with AST/taint analysis. No AI, no network, no source upload. CLI + LSP for editors and CI.",
5
5
  "type": "module",
6
6
  "bin": {
7
- "sphior-scan": "./dist/cli.js"
7
+ "sphior-scan": "dist/cli.js"
8
8
  },
9
9
  "files": [
10
10
  "dist",
@@ -12,7 +12,7 @@
12
12
  ],
13
13
  "repository": {
14
14
  "type": "git",
15
- "url": "https://github.com/Toraastrta/Sphior.git",
15
+ "url": "git+https://github.com/Toraastrta/Sphior.git",
16
16
  "directory": "ige-web/packages/sphior-scan"
17
17
  },
18
18
  "homepage": "https://sphior.com/code",