@vyuhlabs/dxkit 1.5.0 → 1.6.0

package/dist/analyzers/security/detailed.js

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildSecurityDetailed = buildSecurityDetailed;
+exports.formatSecurityDetailedMarkdown = formatSecurityDetailedMarkdown;
+const remediation_1 = require("../remediation");
+const actions_1 = require("./actions");
+const scoring_1 = require("./scoring");
+function buildSecurityDetailed(report) {
+    const counts = (0, actions_1.countsFromReport)(report);
+    const actions = (0, remediation_1.rank)((0, actions_1.buildSecurityActions)(report), counts, scoring_1.scoreSecurityCounts);
+    return {
+        ...report,
+        schemaVersion: '10c.1',
+        securityScore: (0, scoring_1.scoreSecurityCounts)(counts).score,
+        actions,
+    };
+}
+const SEV_ORDER = { critical: 0, high: 1, medium: 2, low: 3 };
+function formatSecurityDetailedMarkdown(detailed, elapsed) {
+    const L = [];
+    const s = detailed.summary.findings;
+    const d = detailed.summary.dependencies;
+    L.push('# Vulnerability Scan — Detailed');
+    L.push('');
+    L.push(`**Date:** ${detailed.analyzedAt.slice(0, 10)}`);
+    L.push(`**Repository:** ${detailed.repo}`);
+    L.push(`**Branch:** ${detailed.branch} (${detailed.commitSha})`);
+    L.push(`**Security Score:** ${detailed.securityScore}/100`);
+    L.push(`**Schema version:** ${detailed.schemaVersion}`);
+    L.push('');
+    L.push('---');
+    L.push('');
+    // Summary
+    L.push('## Summary');
+    L.push('');
+    L.push(`Code findings: ${s.critical}C ${s.high}H ${s.medium}M ${s.low}L (${s.total} total). ` +
+        (d.tool
+            ? `Dependency vulns: ${d.critical}C ${d.high}H ${d.medium}M ${d.low}L (${d.total}, via ${d.tool}).`
+            : 'No dependency audit data.'));
+    L.push('');
+    L.push('---');
+    L.push('');
+    // Ranked actions
+    L.push('## Recommended Actions');
+    L.push('');
+    if (detailed.actions.length === 0) {
+        L.push('No security findings — nothing to remediate.');
+    }
+    else {
+        L.push('Actions are ranked by projected score improvement.');
+        L.push('');
+        L.push('| # | Action | Score Δ | Projected |');
+        L.push('|---|--------|--------:|----------:|');
+        detailed.actions.forEach((a, i) => {
+            L.push(`| ${i + 1} | ${a.title} | +${a.scoreDelta} | ${a.projectedScore}/100 |`);
+        });
+        L.push('');
+        for (const a of detailed.actions) {
+            L.push(`### ${a.title} (+${a.scoreDelta})`);
+            L.push('');
+            L.push(`- **ID:** \`${a.id}\``);
+            L.push(`- **Baseline:** ${a.baselineScore}/100`);
+            L.push(`- **Projected:** ${a.projectedScore}/100`);
+            if (a.rationale)
+                L.push(`- **Why:** ${a.rationale}`);
+            if (a.evidence.length) {
+                L.push('- **Evidence:**');
+                for (const e of a.evidence.slice(0, 20)) {
+                    const loc = e.line ? `:${e.line}` : '';
+                    L.push(`  - \`${e.file}${loc}\` — ${e.message || e.rule}`);
+                }
+                if (a.evidence.length > 20) {
+                    L.push(`  - … and ${a.evidence.length - 20} more`);
+                }
+            }
+            L.push('');
+        }
+    }
+    L.push('---');
+    L.push('');
+    // Full findings inventory
+    L.push('## Findings Inventory');
+    L.push('');
+    const sorted = [...detailed.findings].sort((a, b) => SEV_ORDER[a.severity] - SEV_ORDER[b.severity] || a.file.localeCompare(b.file));
+    if (sorted.length === 0) {
+        L.push('No code findings.');
+    }
+    else {
+        L.push('| Severity | Rule | File:Line | Tool | CWE |');
+        L.push('|----------|------|-----------|------|-----|');
+        for (const f of sorted) {
+            L.push(`| ${f.severity.toUpperCase()} | \`${f.rule}\` | \`${f.file}${f.line ? ':' + f.line : ''}\` | ${f.tool} | ${f.cwe || '—'} |`);
+        }
+    }
+    L.push('');
+    L.push('---');
+    L.push('');
+    // Dependencies
+    if (d.tool) {
+        L.push('## Dependency Vulnerabilities');
+        L.push('');
+        L.push(`Tool: ${d.tool}`);
+        L.push('');
+        L.push('| Severity | Count |');
+        L.push('|----------|------:|');
+        L.push(`| Critical | ${d.critical} |`);
+        L.push(`| High     | ${d.high} |`);
+        L.push(`| Medium   | ${d.medium} |`);
+        L.push(`| Low      | ${d.low} |`);
+        L.push(`| **Total** | **${d.total}** |`);
+        L.push('');
+        L.push('---');
+        L.push('');
+    }
+    L.push(`**Tools used:** ${detailed.toolsUsed.join(', ')}`);
+    if (detailed.toolsUnavailable.length > 0) {
+        L.push(`**Tools unavailable:** ${detailed.toolsUnavailable.join(', ')}`);
+    }
+    L.push(`**Analysis time:** ${elapsed}s`);
+    L.push('');
+    L.push('*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit) — detailed mode*');
+    return L.join('\n');
+}
+//# sourceMappingURL=detailed.js.map

package/dist/analyzers/security/detailed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detailed.js","sourceRoot":"","sources":["../../../src/analyzers/security/detailed.ts"],"names":[],"mappings":";;AAcA,sDASC;AAID,wEAsHC;AA7ID,gDAAoD;AACpD,uCAAmE;AACnE,uCAAgE;AAQhE,SAAgB,qBAAqB,CAAC,MAAsB;IAC1D,MAAM,MAAM,GAAG,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAA,kBAAI,EAAC,IAAA,8BAAoB,EAAC,MAAM,CAAC,EAAE,MAAM,EAAE,6BAAmB,CAAC,CAAC;IAChF,OAAO;QACL,GAAG,MAAM;QACT,aAAa,EAAE,OAAO;QACtB,aAAa,EAAE,IAAA,6BAAmB,EAAC,MAAM,CAAC,CAAC,KAAK;QAChD,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,SAAS,GAA6B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAExF,SAAgB,8BAA8B,CAC5C,QAAgC,EAChC,OAAe;IAEf,MAAM,CAAC,GAAa,EAAE,CAAC;IACvB,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;IACpC,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC;IAExC,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC1C,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC;IACjE,CAAC,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,aAAa,MAAM,CAAC,CAAC;IAC5D,CAAC,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,UAAU;IACV,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CACJ,kBAAkB,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,WAAW;QACpF,CAAC,CAAC,CAAC,IAAI;YACL,CAAC,CAAC,qBAAqB,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,IAAI;YACnG,CAAC,CAAC,2BAA2B,CAAC,CACnC,CAAC;IACF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,iBAAiB;IACjB,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACjC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QAC7D,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QAC/C,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QAC/C,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAChC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,UAAU,MAAM,CAAC,CAAC,cAAc,QAAQ,CAAC,CAAC;QACnF,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACjC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC;YAC5C,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAChC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,aAAa,MAAM,CAAC,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,cAAc,MAAM,CAAC,CAAC;YACnD,IAAI,CAAC,CAAC,SAAS;gBAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YACrD,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACtB,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAC1B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;oBACxC,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,GAAG,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC7D,CAAC;gBACD,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;oBAC3B,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;YACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,0BAA0B;IAC1B,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAChC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,MAAM,MAAM,GAAsB,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC3D,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CACxF,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,CAAC,CAAC,IAAI,CACJ,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAC7H,CAAC;QACJ,CAAC;IACH,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,eAAe;IACf,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1B,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC/B,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC/B,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QACrC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,CAAC;IAED,CAAC,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3D,IAAI,QAAQ,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC,0BAA0B,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,sBAAsB,OAAO,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CACJ,gGAAgG,CACjG,CAAC;IACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC"}

package/dist/analyzers/security/gather.d.ts

@@ -0,0 +1,12 @@
+import { SecurityFinding, DepVulnSummary } from './types';
+export declare function gatherSecrets(cwd: string): {
+    findings: SecurityFinding[];
+    toolUsed: string | null;
+};
+export declare function gatherFileFindings(cwd: string): SecurityFinding[];
+export declare function gatherCodePatterns(cwd: string): {
+    findings: SecurityFinding[];
+    toolUsed: string | null;
+};
+export declare function gatherDepVulns(cwd: string): DepVulnSummary;
+//# sourceMappingURL=gather.d.ts.map

package/dist/analyzers/security/gather.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gather.d.ts","sourceRoot":"","sources":["../../../src/analyzers/security/gather.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAW1D,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG;IAC1C,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAyCA;AAID,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,EAAE,CAuCjE;AAiCD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG;IAC/C,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CA8CA;AAuCD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAgB1D"}

package/dist/analyzers/security/gather.js

@@ -0,0 +1,195 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gatherSecrets = gatherSecrets;
+exports.gatherFileFindings = gatherFileFindings;
+exports.gatherCodePatterns = gatherCodePatterns;
+exports.gatherDepVulns = gatherDepVulns;
+/**
+ * Security finding gatherers — one function per tool, no overlap.
+ *
+ * Tool boundaries:
+ *   gitleaks  → secrets (hardcoded credentials, API keys, private keys in source)
+ *   find/git  → private key files on disk (.key, .pem), .env tracked in git
+ *   semgrep   → code patterns (eval, exec, TLS, CORS, SQLi, XSS, SSRF, etc.)
+ *   npm audit → dependency CVEs
+ */
+const detect_1 = require("../../detect");
+const runner_1 = require("../tools/runner");
+const tool_registry_1 = require("../tools/tool-registry");
+const exclusions_1 = require("../tools/exclusions");
+function gatherSecrets(cwd) {
+    const status = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS.gitleaks, cwd);
+    if (!status.available || !status.path)
+        return { findings: [], toolUsed: null };
+    const reportPath = `/tmp/dxkit-gitleaks-${Date.now()}.json`;
+    (0, runner_1.run)(`${status.path} detect --source '${cwd}' --report-format json --report-path '${reportPath}' --no-git --exit-code 0 2>/dev/null`, cwd, 120000);
+    const raw = (0, runner_1.run)(`cat '${reportPath}' 2>/dev/null`, cwd);
+    (0, runner_1.run)(`rm -f '${reportPath}'`, cwd);
+    if (!raw)
+        return { findings: [], toolUsed: 'gitleaks' };
+    try {
+        const entries = JSON.parse(raw);
+        if (!Array.isArray(entries))
+            return { findings: [], toolUsed: 'gitleaks' };
+        // Post-filter via the centralized exclusions predicate so we never drift
+        // between tools on what counts as "ignored".
+        const findings = entries
+            .filter((e) => {
+            const relPath = e.File.replace(cwd + '/', '').replace(cwd, '');
+            return !(0, exclusions_1.isExcludedPath)(cwd, relPath);
+        })
+            .map((e) => ({
+            severity: e.RuleID === 'private-key' ? 'critical' : 'high',
+            category: 'secret',
+            cwe: 'CWE-798',
+            rule: e.RuleID,
+            title: e.Description,
+            file: e.File.replace(cwd + '/', '').replace(cwd, ''),
+            line: e.StartLine,
+            tool: 'gitleaks',
+        }));
+        return { findings, toolUsed: 'gitleaks' };
+    }
+    catch {
+        return { findings: [], toolUsed: 'gitleaks' };
+    }
+}
+// ─── find/git: private key files, .env in git ───────────────────────────────
+function gatherFileFindings(cwd) {
+    const findings = [];
+    const EXCLUDE = (0, exclusions_1.getFindExcludeFlags)(cwd, false); // don't exclude source paths for security scanning
+    // Private key / cert files on disk
+    const keyFiles = (0, runner_1.run)(`find . \\( -name "*.key" -o -name "*.pem" \\) ${EXCLUDE} 2>/dev/null`, cwd);
+    if (keyFiles) {
+        for (const f of keyFiles.split('\n').filter((l) => l.trim())) {
+            findings.push({
+                severity: 'critical',
+                category: 'secret',
+                cwe: 'CWE-798',
+                rule: 'private-key-file',
+                title: `Private key or certificate file: ${f.replace('./', '')}`,
+                file: f.replace('./', ''),
+                line: 0,
+                tool: 'find',
+            });
+        }
+    }
+    // .env tracked in git
+    const envFiles = (0, runner_1.run)('git ls-files .env .env.* 2>/dev/null', cwd);
+    if (envFiles) {
+        for (const f of envFiles.split('\n').filter((l) => l.trim())) {
+            findings.push({
+                severity: 'high',
+                category: 'config',
+                cwe: 'CWE-798',
+                rule: 'env-in-git',
+                title: `.env file tracked in git: ${f}`,
+                file: f,
+                line: 0,
+                tool: 'git',
+            });
+        }
+    }
+    return findings;
+}
+function mapSeverity(sgSeverity, impact) {
+    // Primary: use semgrep's impact field (most meaningful)
+    const imp = (impact || '').toUpperCase();
+    if (imp === 'HIGH')
+        return sgSeverity === 'ERROR' ? 'critical' : 'high';
+    if (imp === 'MEDIUM')
+        return 'medium';
+    if (imp === 'LOW')
+        return 'low';
+    // Fallback: semgrep severity
+    if (sgSeverity === 'ERROR')
+        return 'high';
+    if (sgSeverity === 'WARNING')
+        return 'medium';
+    return 'low';
+}
+function gatherCodePatterns(cwd) {
+    const status = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS.semgrep ?? {}, cwd);
+    if (!status.available || !status.path)
+        return { findings: [], toolUsed: null };
+    // Derive rulesets from detected stack — not hardcoded
+    const stack = (0, detect_1.detect)(cwd);
+    const rulesets = (0, tool_registry_1.getSemgrepRulesets)(stack.languages);
+    const configs = rulesets.map((r) => `--config ${r}`).join(' ');
+    const excludes = (0, exclusions_1.getSemgrepExcludeFlags)(cwd);
+    const reportPath = `/tmp/dxkit-semgrep-${Date.now()}.json`;
+    (0, runner_1.run)(`${status.path} scan ${configs} --json --quiet --output '${reportPath}' ${excludes} '${cwd}' 2>/dev/null`, cwd, 300000);
+    const raw = (0, runner_1.run)(`cat '${reportPath}' 2>/dev/null`, cwd);
+    (0, runner_1.run)(`rm -f '${reportPath}'`, cwd);
+    if (!raw)
+        return { findings: [], toolUsed: 'semgrep' };
+    try {
+        const data = JSON.parse(raw);
+        if (!Array.isArray(data.results))
+            return { findings: [], toolUsed: 'semgrep' };
+        const findings = data.results
+            .filter((r) => {
+            // Skip LOW confidence to cut false positives
+            const conf = (r.extra.metadata?.confidence || '').toUpperCase();
+            return conf !== 'LOW';
+        })
+            .map((r) => ({
+            severity: mapSeverity(r.extra.severity, r.extra.metadata?.impact),
+            category: 'code',
+            cwe: r.extra.metadata?.cwe?.[0]?.split(':')[0] || '',
+            rule: r.check_id.split('.').slice(-1)[0],
+            title: r.extra.message.split('\n')[0].slice(0, 200),
+            file: r.path.replace(cwd + '/', '').replace(cwd, ''),
+            line: r.start.line,
+            tool: 'semgrep',
+        }));
+        return { findings, toolUsed: 'semgrep' };
+    }
+    catch {
+        return { findings: [], toolUsed: 'semgrep' };
+    }
+}
+function parseAuditJson(raw) {
+    try {
+        const data = JSON.parse(raw);
+        if (data.metadata?.vulnerabilities) {
+            const v = data.metadata.vulnerabilities;
+            return { c: v.critical || 0, h: v.high || 0, m: v.moderate || 0, l: v.low || 0 };
+        }
+        if (data.vulnerabilities) {
+            let c = 0, h = 0, m = 0, l = 0;
+            for (const v of Object.values(data.vulnerabilities)) {
+                if (v.severity === 'critical')
+                    c++;
+                else if (v.severity === 'high')
+                    h++;
+                else if (v.severity === 'moderate')
+                    m++;
+                else if (v.severity === 'low')
+                    l++;
+            }
+            return { c, h, m, l };
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+function gatherDepVulns(cwd) {
+    if (!(0, runner_1.fileExists)(cwd, 'package.json'))
+        return { critical: 0, high: 0, medium: 0, low: 0, total: 0, tool: null };
+    const raw = (0, runner_1.run)('npm audit --json 2>&1', cwd, 60000);
+    const result = raw ? parseAuditJson(raw) : null;
+    if (!result)
+        return { critical: 0, high: 0, medium: 0, low: 0, total: 0, tool: null };
+    return {
+        critical: result.c,
+        high: result.h,
+        medium: result.m,
+        low: result.l,
+        total: result.c + result.h + result.m + result.l,
+        tool: 'npm-audit',
+    };
+}
+//# sourceMappingURL=gather.js.map

package/dist/analyzers/security/gather.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gather.js","sourceRoot":"","sources":["../../../src/analyzers/security/gather.ts"],"names":[],"mappings":";;AAwBA,sCA4CC;AAID,gDAuCC;AAiCD,gDAiDC;AAuCD,wCAgBC;AAxPD;;;;;;;;GAQG;AACH,yCAAsC;AACtC,4CAAkD;AAClD,0DAAiF;AACjF,oDAAkG;AAYlG,SAAgB,aAAa,CAAC,GAAW;IAIvC,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAE/E,MAAM,UAAU,GAAG,uBAAuB,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC;IAC5D,IAAA,YAAG,EACD,GAAG,MAAM,CAAC,IAAI,qBAAqB,GAAG,yCAAyC,UAAU,sCAAsC,EAC/H,GAAG,EACH,MAAM,CACP,CAAC;IACF,MAAM,GAAG,GAAG,IAAA,YAAG,EAAC,QAAQ,UAAU,eAAe,EAAE,GAAG,CAAC,CAAC;IACxD,IAAA,YAAG,EAAC,UAAU,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC;IAElC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IAExD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;QAE3E,yEAAyE;QACzE,6CAA6C;QAC7C,MAAM,QAAQ,GAAsB,OAAO;aACxC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACZ,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAA,2BAAc,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,QAAQ,EAAE,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAE,UAAoB,CAAC,CAAC,CAAE,MAAgB;YAChF,QAAQ,EAAE,QAAiB;YAC3B,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,CAAC,CAAC,MAAM;YACd,KAAK,EAAE,CAAC,CAAC,WAAW;YACpB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;YACpD,IAAI,EAAE,CAAC,CAAC,SAAS;YACjB,IAAI,EAAE,UAAU;SACjB,CAAC,CAAC,CAAC;QAEN,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IAChD,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E,SAAgB,kBAAkB,CAAC,GAAW;IAC5C,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,IAAA,gCAAmB,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,mDAAmD;IAEpG,mCAAmC;IACnC,MAAM,QAAQ,GAAG,IAAA,YAAG,EAAC,iDAAiD,OAAO,cAAc,EAAE,GAAG,CAAC,CAAC;IAClG,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7D,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,SAAS;gBACd,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,oCAAoC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE;gBAChE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;gBACzB,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,MAAM,QAAQ,GAAG,IAAA,YAAG,EAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;IAClE,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7D,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,SAAS;gBACd,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,6BAA6B,CAAC,EAAE;gBACvC,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAqBD,SAAS,WAAW,CAAC,UAAkB,EAAE,MAAe;IACtD,wDAAwD;IACxD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;IACxE,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACtC,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAChC,6BAA6B;IAC7B,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IAC1C,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC9C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,kBAAkB,CAAC,GAAW;IAI5C,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,OAAO,IAAK,EAAY,EAAE,GAAG,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAE/E,sDAAsD;IACtD,MAAM,KAAK,GAAG,IAAA,eAAM,EAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAA,kCAAkB,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,IAAA,mCAAsB,EAAC,GAAG,CAAC,CAAC;IAE7C,MAAM,UAAU,GAAG,sBAAsB,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC;IAC3D,IAAA,YAAG,EACD,GAAG,MAAM,CAAC,IAAI,SAAS,OAAO,6BAA6B,UAAU,KAAK,QAAQ,KAAK,GAAG,eAAe,EACzG,GAAG,EACH,MAAM,CACP,CAAC;IACF,MAAM,GAAG,GAAG,IAAA,YAAG,EAAC,QAAQ,UAAU,eAAe,EAAE,GAAG,CAAC,CAAC;IACxD,IAAA,YAAG,EAAC,UAAU,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC;IAElC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAEvD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QAE/E,MAAM,QAAQ,GAAsB,IAAI,CAAC,OAAO;aAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACZ,6CAA6C;YAC7C,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAChE,OAAO,IAAI,KAAK,KAAK,CAAC;QACxB,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC;YACjE,QAAQ,EAAE,MAAe;YACzB,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YACpD,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACnD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;YACpD,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI;YAClB,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC,CAAC;QAEN,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC/C,CAAC;AACH,CAAC;AAaD,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QACxD,IAAI,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;YACxC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;QACnF,CAAC;QACD,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,EACP,CAAC,GAAG,CAAC,EACL,CAAC,GAAG,CAAC,EACL,CAAC,GAAG,CAAC,CAAC;YACR,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;gBACpD,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU;oBAAE,CAAC,EAAE,CAAC;qBAC9B,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM;oBAAE,CAAC,EAAE,CAAC;qBAC/B,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU;oBAAE,CAAC,EAAE,CAAC;qBACnC,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK;oBAAE,CAAC,EAAE,CAAC;YACrC,CAAC;YACD,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,cAAc,CAAC;QAClC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAE3E,MAAM,GAAG,GAAG,IAAA,YAAG,EAAC,uBAAuB,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAEtF,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC,CAAC;QACd,MAAM,EAAE,MAAM,CAAC,CAAC;QAChB,GAAG,EAAE,MAAM,CAAC,CAAC;QACb,KAAK,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;QAChD,IAAI,EAAE,WAAW;KAClB,CAAC;AACJ,CAAC"}

package/dist/analyzers/security/index.d.ts

@@ -0,0 +1,8 @@
+import { SecurityReport } from './types';
+export type { SecurityReport, SecurityFinding } from './types';
+export interface AnalyzeSecurityOptions {
+    verbose?: boolean;
+}
+export declare function analyzeSecurity(repoPath: string, options?: AnalyzeSecurityOptions): SecurityReport;
+export declare function formatSecurityReport(report: SecurityReport, elapsed: string): string;
+//# sourceMappingURL=index.d.ts.map

package/dist/analyzers/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/analyzers/security/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,cAAc,EAA6B,MAAM,SAAS,CAAC;AAEpE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/D,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAQD,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,sBAA2B,GACnC,cAAc,CAwChB;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAqFpF"}

package/dist/analyzers/security/index.js

@@ -0,0 +1,173 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeSecurity = analyzeSecurity;
+exports.formatSecurityReport = formatSecurityReport;
+/**
+ * Security analyzer — public API.
+ */
+const path = __importStar(require("path"));
+const detect_1 = require("../../detect");
+const runner_1 = require("../tools/runner");
+const timing_1 = require("../tools/timing");
+const gather_1 = require("./gather");
+function countBySeverity(findings) {
+    const counts = { critical: 0, high: 0, medium: 0, low: 0 };
+    for (const f of findings)
+        counts[f.severity]++;
+    return counts;
+}
+function analyzeSecurity(repoPath, options = {}) {
+    const verbose = !!options.verbose;
+    const stack = (0, detect_1.detect)(repoPath);
+    const toolsUsed = ['find', 'git'];
+    const toolsUnavailable = [];
+    // 1. Secrets (gitleaks)
+    const secrets = (0, timing_1.timed)('gitleaks', verbose, () => (0, gather_1.gatherSecrets)(repoPath));
+    if (secrets.toolUsed)
+        toolsUsed.push(secrets.toolUsed);
+    else
+        toolsUnavailable.push('gitleaks');
+    // 2. File findings (private keys, .env)
+    const files = (0, timing_1.timed)('file-findings', verbose, () => (0, gather_1.gatherFileFindings)(repoPath));
+    // 3. Code patterns (semgrep)
+    const code = (0, timing_1.timed)('semgrep', verbose, () => (0, gather_1.gatherCodePatterns)(repoPath));
+    if (code.toolUsed)
+        toolsUsed.push(code.toolUsed);
+    else
+        toolsUnavailable.push('semgrep');
+    // 4. Dependency CVEs (npm audit)
+    const deps = (0, timing_1.timed)('dep-audit', verbose, () => (0, gather_1.gatherDepVulns)(repoPath));
+    if (deps.tool)
+        toolsUsed.push(deps.tool);
+    else
+        toolsUnavailable.push('npm-audit');
+    const allFindings = [...secrets.findings, ...files, ...code.findings];
+    const counts = countBySeverity(allFindings);
+    return {
+        repo: stack.projectName || path.basename(repoPath),
+        analyzedAt: new Date().toISOString(),
+        commitSha: (0, runner_1.run)('git rev-parse --short HEAD 2>/dev/null', repoPath),
+        branch: (0, runner_1.run)('git rev-parse --abbrev-ref HEAD 2>/dev/null', repoPath),
+        summary: {
+            findings: { ...counts, total: allFindings.length },
+            dependencies: deps,
+        },
+        findings: allFindings,
+        toolsUsed,
+        toolsUnavailable,
+    };
+}
+function formatSecurityReport(report, elapsed) {
+    const L = [];
+    L.push('# Vulnerability Scan Report');
+    L.push('');
+    L.push(`**Date:** ${report.analyzedAt.slice(0, 10)}`);
+    L.push(`**Repository:** ${report.repo}`);
+    L.push(`**Branch:** ${report.branch} (${report.commitSha})`);
+    L.push('');
+    L.push('---');
+    L.push('');
+    // Executive summary
+    const s = report.summary.findings;
+    L.push('## Executive Summary');
+    L.push('');
+    L.push('| Severity | Count |');
+    L.push('|----------|-------|');
+    L.push(`| CRITICAL | ${s.critical} |`);
+    L.push(`| HIGH     | ${s.high} |`);
+    L.push(`| MEDIUM   | ${s.medium} |`);
+    L.push(`| LOW      | ${s.low} |`);
+    L.push(`| **Total** | **${s.total}** |`);
+    L.push('');
+    const d = report.summary.dependencies;
+    if (d.tool) {
+        L.push(`Dependency audit: ${d.critical}C ${d.high}H ${d.medium}M ${d.low}L (${d.total} total, via ${d.tool}).`);
+    }
+    L.push('');
+    L.push('---');
+    L.push('');
+    // Findings grouped by category
+    const categories = [
+        { key: 'secret', title: '1. Secrets & Credentials' },
+        { key: 'code', title: '2. Code Vulnerability Patterns' },
+        { key: 'config', title: '3. Configuration Issues' },
+    ];
+    const SORDER = { critical: 0, high: 1, medium: 2, low: 3 };
+    for (const cat of categories) {
+        const items = report.findings
+            .filter((f) => f.category === cat.key)
+            .sort((a, b) => SORDER[a.severity] - SORDER[b.severity]);
+        if (items.length === 0)
+            continue;
+        L.push(`## ${cat.title}`);
+        L.push('');
+        for (const f of items) {
+            L.push(`### ${f.severity.toUpperCase()}: ${f.title}`);
+            L.push(`- **File:** \`${f.file}${f.line ? ':' + f.line : ''}\``);
+            if (f.cwe)
+                L.push(`- **CWE:** ${f.cwe}`);
+            L.push(`- **Tool:** ${f.tool} / ${f.rule}`);
+            L.push('');
+        }
+        L.push('---');
+        L.push('');
+    }
+    // Dependencies
+    if (d.tool) {
+        L.push('## 4. Dependency Vulnerabilities');
+        L.push('');
+        L.push('| Severity | Count |');
+        L.push('|----------|-------|');
+        L.push(`| Critical | ${d.critical} |`);
+        L.push(`| High     | ${d.high} |`);
+        L.push(`| Medium   | ${d.medium} |`);
+        L.push(`| Low      | ${d.low} |`);
+        L.push(`| **Total** | **${d.total}** |`);
+        L.push('');
+        L.push('---');
+        L.push('');
+    }
+    // Footer
+    L.push(`**Tools used:** ${report.toolsUsed.join(', ')}`);
+    if (report.toolsUnavailable.length > 0) {
+        L.push(`**Tools unavailable:** ${report.toolsUnavailable.join(', ')}`);
+    }
+    L.push(`**Analysis time:** ${elapsed}s`);
+    L.push('');
+    L.push('*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit)*');
+    return L.join('\n');
+}
+//# sourceMappingURL=index.js.map

package/dist/analyzers/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/analyzers/security/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,0CA2CC;AAED,oDAqFC;AAxJD;;GAEG;AACH,2CAA6B;AAC7B,yCAAsC;AACtC,4CAAsC;AACtC,4CAAwC;AACxC,qCAAiG;AASjG,SAAS,eAAe,CAAC,QAA2B;IAClD,MAAM,MAAM,GAA6B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACrF,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,eAAe,CAC7B,QAAgB,EAChB,UAAkC,EAAE;IAEpC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAClC,MAAM,KAAK,GAAG,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,gBAAgB,GAAa,EAAE,CAAC;IAEtC,wBAAwB;IACxB,MAAM,OAAO,GAAG,IAAA,cAAK,EAAC,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAA,sBAAa,EAAC,QAAQ,CAAC,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,QAAQ;QAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;;QAClD,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAEvC,wCAAwC;IACxC,MAAM,KAAK,GAAG,IAAA,cAAK,EAAC,eAAe,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAA,2BAAkB,EAAC,QAAQ,CAAC,CAAC,CAAC;IAElF,6BAA6B;IAC7B,MAAM,IAAI,GAAG,IAAA,cAAK,EAAC,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAA,2BAAkB,EAAC,QAAQ,CAAC,CAAC,CAAC;IAC3E,IAAI,IAAI,CAAC,QAAQ;QAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;;QAC5C,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEtC,iCAAiC;IACjC,MAAM,IAAI,GAAG,IAAA,cAAK,EAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAA,uBAAc,EAAC,QAAQ,CAAC,CAAC,CAAC;IACzE,IAAI,IAAI,CAAC,IAAI;QAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;QACpC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAExC,MAAM,WAAW,GAAG,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAE5C,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClD,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,SAAS,EAAE,IAAA,YAAG,EAAC,wCAAwC,EAAE,QAAQ,CAAC;QAClE,MAAM,EAAE,IAAA,YAAG,EAAC,6CAA6C,EAAE,QAAQ,CAAC;QACpE,OAAO,EAAE;YACP,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE;YAClD,YAAY,EAAE,IAAI;SACnB;QACD,QAAQ,EAAE,WAAW;QACrB,SAAS;QACT,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB,CAAC,MAAsB,EAAE,OAAe;IAC1E,MAAM,CAAC,GAAa,EAAE,CAAC;IACvB,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACtC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC;IAC7D,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,oBAAoB;IACpB,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;IAClC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC/B,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC/B,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC/B,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;IACrC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC;IACzC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;IACtC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACX,CAAC,CAAC,IAAI,CACJ,qBAAqB,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,IAAI,IAAI,CACxG,CAAC;IACJ,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,+BAA+B;IAC/B,MAAM,UAAU,GAA0C;QACxD,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,0BAA0B,EAAE;QACpD,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,gCAAgC,EAAE;QACxD,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,yBAAyB,EAAE;KACpD,CAAC;IACF,MAAM,MAAM,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAEnF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ;aAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,GAAG,CAAC;aACrC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEjC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1B,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACtD,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACjE,IAAI,CAAC,CAAC,GAAG;gBAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YACzC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5C,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,CAAC;IAED,eAAe;IACf,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC/B,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC/B,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QACrC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,CAAC;IAED,SAAS;IACT,CAAC,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,sBAAsB,OAAO,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;IACzF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC"}

package/dist/analyzers/security/scoring.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Security scoring — internal scorer over finding+dep counts, used for
+ * RemediationAction ranking in detailed reports.
+ *
+ * Distinct from src/analyzers/scoring.ts scoreSecurity() which operates on
+ * HealthMetrics for the health dimension rollup. This scorer is scoped to
+ * SecurityReport's own shape so remediation actions can simulate deltas
+ * without going through HealthMetrics.
+ */
+/** Counts summarized from a SecurityReport. Patches produce a new snapshot. */
+export interface SecurityCounts {
+    critical: number;
+    high: number;
+    medium: number;
+    low: number;
+    depCritical: number;
+    depHigh: number;
+    depMedium: number;
+    depLow: number;
+}
+/**
+ * 0-100 security score from finding + dep counts.
+ * Mirrors the health-side scoreSecurity() thresholds so projected values stay
+ * intuitive to users who also read the health report.
+ */
+export declare function scoreSecurityCounts(c: SecurityCounts): {
+    score: number;
+};
+//# sourceMappingURL=scoring.d.ts.map

package/dist/analyzers/security/scoring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoring.d.ts","sourceRoot":"","sources":["../../../src/analyzers/security/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,cAAc,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAiBxE"}

package/dist/analyzers/security/scoring.js

@@ -0,0 +1,40 @@
+"use strict";
+/**
+ * Security scoring — internal scorer over finding+dep counts, used for
+ * RemediationAction ranking in detailed reports.
+ *
+ * Distinct from src/analyzers/scoring.ts scoreSecurity() which operates on
+ * HealthMetrics for the health dimension rollup. This scorer is scoped to
+ * SecurityReport's own shape so remediation actions can simulate deltas
+ * without going through HealthMetrics.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scoreSecurityCounts = scoreSecurityCounts;
+/**
+ * 0-100 security score from finding + dep counts.
+ * Mirrors the health-side scoreSecurity() thresholds so projected values stay
+ * intuitive to users who also read the health report.
+ */
+function scoreSecurityCounts(c) {
+    let score = 100;
+    if (c.critical > 10)
+        score -= 25;
+    else if (c.critical > 5)
+        score -= 20;
+    else if (c.critical > 0)
+        score -= 15;
+    if (c.high > 5)
+        score -= 10;
+    else if (c.high > 0)
+        score -= 5;
+    if (c.medium > 10)
+        score -= 5;
+    if (c.depCritical > 0)
+        score -= 15;
+    if (c.depHigh > 5)
+        score -= 10;
+    else if (c.depHigh > 0)
+        score -= 5;
+    return { score: Math.max(0, Math.min(100, score)) };
+}
+//# sourceMappingURL=scoring.js.map

package/dist/analyzers/security/scoring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoring.js","sourceRoot":"","sources":["../../../src/analyzers/security/scoring.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAmBH,kDAiBC;AAtBD;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,CAAiB;IACnD,IAAI,KAAK,GAAG,GAAG,CAAC;IAEhB,IAAI,CAAC,CAAC,QAAQ,GAAG,EAAE;QAAE,KAAK,IAAI,EAAE,CAAC;SAC5B,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC;QAAE,KAAK,IAAI,EAAE,CAAC;SAChC,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC;QAAE,KAAK,IAAI,EAAE,CAAC;IAErC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;QAAE,KAAK,IAAI,EAAE,CAAC;SACvB,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IAEhC,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE;QAAE,KAAK,IAAI,CAAC,CAAC;IAE9B,IAAI,CAAC,CAAC,WAAW,GAAG,CAAC;QAAE,KAAK,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC;QAAE,KAAK,IAAI,EAAE,CAAC;SAC1B,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IAEnC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;AACtD,CAAC"}

package/dist/analyzers/security/shallow.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Security dimension — shallow score for health aggregation.
+ *
+ * Computes the DimensionScore using the same formula as scoring.ts
+ * (delegating to it), but Phase 4b+ can switch to using the deep
+ * analyzer's findings for more accurate scoring.
+ */
+import { HealthMetrics, DimensionScore } from '../types';
+export declare function scoreSecurityDimension(m: HealthMetrics): DimensionScore;
+//# sourceMappingURL=shallow.d.ts.map