@vibgrate/cli 1.0.26 → 1.0.27

package/DOCS.md

@@ -40,6 +40,7 @@ For a quick overview, see the [README](./README.md). This document covers everyt
   - [Breaking Change Exposure](#breaking-change-exposure)
   - [File Hotspots](#file-hotspots)
   - [Security Posture](#security-posture)
+  - [Security Scanners](#security-scanners)
   - [Service Dependencies](#service-dependencies)
 - [CI Integration](#ci-integration)
   - [GitHub Actions](#github-actions)
@@ -65,7 +66,7 @@ Vibgrate recursively scans your repository for `package.json` (Node/TypeScript)
 4. **Generates** a deterministic Upgrade Drift Score (0–100)
 5. **Produces** findings, a full JSON artifact, and optional SARIF output
 
-No source code is read. No secrets are scanned. The CLI works entirely offline — dashboard upload is optional.
+Core drift analysis does not execute source code. Optional security scanners can run lightweight secret heuristics and local toolchain checks. Dashboard upload remains optional.
 
 ---
 
@@ -274,6 +275,7 @@ const config: VibgrateConfig = {
     breakingChangeExposure: { enabled: true },
     fileHotspots:           { enabled: true },
     securityPosture:        { enabled: true },
+    securityScanners:       { enabled: true },
     serviceDependencies:    { enabled: true },
   },
 };
@@ -398,6 +400,19 @@ Structural security hygiene indicators (not a secret scanner):
 - `.env` files tracked outside `.gitignore`
 - Audit severity counts (via `npm audit --json`)
 
+
+### Security Scanners
+
+Security scanner orchestration and readiness analysis focused on modern SAST and secrets tooling:
+
+- Semgrep support for SAST (version detection + freshness checks)
+- Gitleaks and TruffleHog support for secret scanning readiness
+- Recommended minimum version checks to highlight stale engines/signatures
+- Config discovery (`.semgrep.yml`, `.gitleaks.toml`, `.trufflehog.yml`)
+- Cache-backed heuristic secret signals to add value even when binaries are unavailable
+
+> This scanner does not guarantee full secret detection or rule coverage by itself; it reports toolchain status and lightweight in-repo indicators so teams can decide how to harden CI enforcement.
+
 ### Service Dependencies
 
 Maps external service and platform dependencies by detecting SDK packages:

package/README.md

@@ -162,7 +162,7 @@ Works across **Node.js/TypeScript** and **.NET** projects in the same scan. Dete
 
 Designed to live in your build pipeline. Returns meaningful exit codes, produces SARIF output for GitHub Code Scanning and Azure DevOps, and requires zero configuration to get started.
 
-### Ten Extended Scanners
+### 13 Extended Scanners
 
 Beyond the core drift score, Vibgrate runs a suite of extended scanners — all optional, all privacy-safe:
 
@@ -177,7 +177,10 @@ Beyond the core drift score, Vibgrate runs a suite of extended scanners — all
 | **Breaking Change Exposure** | Packages known to cause upgrade pain, legacy polyfills |
 | **File Hotspots** | Codebase shape — file counts, sizes, depth, shared packages |
 | **Security Posture** | Lockfile hygiene, `.gitignore` coverage, audit severity counts |
+| **Security Scanners** | Semgrep (SAST) + Gitleaks/TruffleHog readiness, version risk checks, heuristic secret signals |
 | **Service Dependencies** | External SDK detection — payment, auth, cloud, databases, messaging |
+| **Code Quality** | Cyclomatic complexity, function length, nesting depth, god files, dead-code estimate, circular imports |
+| **OWASP Category Mapping** | Semgrep OSS findings mapped to OWASP Top 10 categories (fast or cache-input mode) |
 
 ### Baseline & Delta Tracking
 
@@ -284,7 +287,8 @@ export default config;
 
 Vibgrate is designed to be safe to run on any codebase:
 
-- **No source code is read** — only `package.json`, `tsconfig.json`, lockfiles, and project manifests
+- **No source code content is exfiltrated** — code-quality metrics are computed locally and only aggregated numbers are emitted
+- **Source code is only read when explicitly needed** — core drift scanners use manifests/configs; OWASP mapping can inspect source files via Semgrep
 - **No secrets are scanned** — ever
 - **No git history, authors, or commit messages** — only HEAD SHA and branch name for traceability
 - **No data leaves your machine** unless you explicitly run `vibgrate push` or `vibgrate scan --push`

package/dist/{baseline-KXUPTMQ2.js → baseline-B5K5M2XJ.js}

@@ -1,8 +1,8 @@
 import {
   baselineCommand,
   runBaseline
-} from "./chunk-7EEUYKZI.js";
-import "./chunk-27LB7QTA.js";
+} from "./chunk-K4ZGFGP2.js";
+import "./chunk-PROF25OR.js";
 export {
   baselineCommand,
   runBaseline

package/dist/{chunk-7EEUYKZI.js → chunk-K4ZGFGP2.js}

@@ -1,7 +1,7 @@
 import {
   runScan,
   writeJsonFile
-} from "./chunk-27LB7QTA.js";
+} from "./chunk-PROF25OR.js";
 
 // src/commands/baseline.ts
 import * as path from "path";