aura-security 0.4.0 → 0.4.2

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 slopsecurityadmin
+Copyright (c) 2026 aurasecurity
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/dist/cli.js

@@ -24,7 +24,7 @@ import { existsSync, writeFileSync, mkdirSync } from 'fs';
 import { join, resolve, basename } from 'path';
 import { spawnSync } from 'child_process';
 const AURA_URL = process.env.AURA_URL ?? 'http://127.0.0.1:3000';
-const VERSION = '0.3.0';
+const VERSION = '0.4.1';
 // ANSI colors for terminal output
 const colors = {
     reset: '\x1b[0m',
@@ -134,6 +134,15 @@ const SECURITY_TOOLS = [
         install: { gem: 'gem install bundler-audit' },
         license: 'GPLv3 (Free)',
         required: false
+    },
+    {
+        name: 'flawfinder',
+        command: 'flawfinder',
+        description: 'C/C++ source code security scanner',
+        category: 'sast',
+        install: { pip: 'pip install flawfinder', apt: 'apt install flawfinder' },
+        license: 'GPL-2.0 (Free)',
+        required: false
     }
 ];
 function isToolInstalled(command) {
@@ -640,22 +649,28 @@ function displayScanResults(result) {
     const dockerfileCount = result.dockerfileFindings.length;
     const serviceCount = result.discoveredServices.length;
     const moduleCount = result.discoveredModules.length;
+    // Helper to normalize severity (SAST findings use uppercase)
+    const normSev = (sev) => (sev || '').toLowerCase();
     const criticalCount = result.secrets.filter(s => s.severity === 'critical').length +
         result.packages.filter(p => p.severity === 'critical').length +
         result.iacFindings.filter(i => i.severity === 'critical').length +
-        result.dockerfileFindings.filter(d => d.severity === 'critical').length;
+        result.dockerfileFindings.filter(d => d.severity === 'critical').length +
+        result.sastFindings.filter(s => normSev(s.severity) === 'critical').length;
     const highCount = result.secrets.filter(s => s.severity === 'high').length +
         result.packages.filter(p => p.severity === 'high').length +
         result.iacFindings.filter(i => i.severity === 'high').length +
-        result.dockerfileFindings.filter(d => d.severity === 'high').length;
+        result.dockerfileFindings.filter(d => d.severity === 'high').length +
+        result.sastFindings.filter(s => normSev(s.severity) === 'high').length;
     const mediumCount = result.secrets.filter(s => s.severity === 'medium').length +
         result.packages.filter(p => p.severity === 'medium').length +
         result.iacFindings.filter(i => i.severity === 'medium').length +
-        result.dockerfileFindings.filter(d => d.severity === 'medium').length;
+        result.dockerfileFindings.filter(d => d.severity === 'medium').length +
+        result.sastFindings.filter(s => normSev(s.severity) === 'medium').length;
     const lowCount = result.secrets.filter(s => s.severity === 'low').length +
         result.packages.filter(p => p.severity === 'low').length +
         result.iacFindings.filter(i => i.severity === 'low').length +
-        result.dockerfileFindings.filter(d => d.severity === 'low').length;
+        result.dockerfileFindings.filter(d => d.severity === 'low').length +
+        result.sastFindings.filter(s => normSev(s.severity) === 'low').length;
     // Stats bar
     console.log('┌─────────────────────────────────────────────────────────────────┐');
     console.log(`│  ${c('bgRed', ` CRITICAL ${criticalCount} `)}  ${c('red', `HIGH ${highCount}`)}  ${c('yellow', `MEDIUM ${mediumCount}`)}  ${c('dim', `LOW ${lowCount}`)}  │`);
@@ -1343,8 +1358,8 @@ ${c('bold', 'SCAN OPTIONS:')}
   -j, --json        Output results as JSON
   -f, --format      Output format: console, json, sarif, junit, gitlab-sast, gitlab-deps, summary
   -o, --output      Save results to file
-  -l, --languages   Filter by languages: js,py,go,rust,ruby,php,java
-  -S, --scanners    Use specific scanners: grype,trivy,gitleaks,semgrep,checkov,hadolint,pip-audit,govulncheck,cargo-audit,bundle-audit,composer
+  -l, --languages   Filter by languages: js,py,go,rust,ruby,php,java,c,csharp
+  -S, --scanners    Use specific scanners: grype,trivy,gitleaks,semgrep,checkov,hadolint,pip-audit,govulncheck,cargo-audit,bundle-audit,composer,flawfinder
   --fail-on         Exit with error on severity: critical,high,medium (default: critical)
   --no-fail         Never exit with error code
 

package/dist/integrations/local-scanner.js

@@ -36,17 +36,51 @@ const SECRET_SCAN_EXCLUDE_FILES = [
     '.next/',
     'coverage/'
 ];
-// Directories that often contain false positives (test data, scripts, examples)
+// Directories that often contain false positives (test data, vendored deps, examples)
 const FALSE_POSITIVE_DIRS = [
     'node_modules',
     '__tests__',
     '__mocks__',
-    'test/',
-    'tests/',
-    'spec/',
-    'fixtures/',
-    'examples/',
-    'scripts/'
+    '/test/',
+    '/tests/',
+    '/spec/',
+    '/fixtures/',
+    '/examples/',
+    '/example/',
+    '/sample/',
+    '/samples/',
+    '/demo/',
+    '/demos/',
+    '/mock/',
+    '/mocks/',
+    '/testdata/',
+    '/test-data/',
+    '/assets/test/',
+    '/testing/',
+    '/vendor/',
+    '/vendors/',
+    '/bundled/',
+    '/deps/',
+    '/third_party/',
+    '/third-party/',
+    '/thirdparty/',
+    '/external/',
+    '/dummy/',
+    '/fake/'
+];
+// File name patterns that indicate test/example data (not real secrets)
+const TEST_FILE_PATTERNS = [
+    /\.example$/i,
+    /\.sample$/i,
+    /\.test\./i,
+    /\.spec\./i,
+    /example\d*\.(key|pem|jwt|crt|p12|pfx)$/i,
+    /test\d*\.(key|pem|jwt|crt|p12|pfx)$/i,
+    /sample\d*\.(key|pem|jwt|crt|p12|pfx)$/i,
+    /fake[-_]?(key|secret|token|credential)/i,
+    /dummy[-_]?(key|secret|token|credential)/i,
+    /mock[-_]?(key|secret|token|credential)/i,
+    /temporary[-_]?key/i,
 ];
 // Rules to completely skip - too many false positives to be useful
 // aws-secret-access-key matches any 40-char base64 string which catches SHA hashes,
@@ -58,6 +92,14 @@ const SKIP_RULES_ENTIRELY = [
 const FALSE_POSITIVE_RULES = [
     'generic-api-key'
 ];
+// Rules to skip in specific file types (too many false positives)
+const SKIP_RULES_IN_FILE_TYPES = {
+    // generic-api-key matches C macros and function signatures in headers
+    '.h': ['generic-api-key'],
+    '.hpp': ['generic-api-key'],
+    '.c': ['generic-api-key', 'sourcegraph-access-token'],
+    '.cpp': ['generic-api-key'],
+};
 // Run gitleaks for secrets detection
 function runGitleaks(targetPath) {
     const findings = [];
@@ -93,10 +135,17 @@ function runGitleaks(targetPath) {
                 const isExcludedFile = SECRET_SCAN_EXCLUDE_FILES.some(pattern => fileName === pattern || filePath.includes(pattern.toLowerCase()));
                 // Filter out findings from known false positive directories
                 const isInFalsePositiveDir = FALSE_POSITIVE_DIRS.some(dir => filePath.includes(dir.toLowerCase()));
+                // Filter out test/example file names
+                const isTestFile = TEST_FILE_PATTERNS.some(pattern => pattern.test(fileName) || pattern.test(filePath));
                 // Filter out known false positive rules in certain file types
                 const isFalsePositiveRule = FALSE_POSITIVE_RULES.includes(ruleId) &&
                     (isExcludedFile || isInFalsePositiveDir);
-                if (isExcludedFile || isFalsePositiveRule) {
+                // Check if this rule should be skipped for this file type
+                const fileExt = extname(fileName).toLowerCase();
+                const skipRulesForExt = SKIP_RULES_IN_FILE_TYPES[fileExt] || [];
+                const isRuleSkippedForFileType = skipRulesForExt.includes(ruleId);
+                // Skip if any false positive indicator matches
+                if (isExcludedFile || isInFalsePositiveDir || isTestFile || isFalsePositiveRule || isRuleSkippedForFileType) {
                     filteredCount++;
                     continue;
                 }
@@ -114,7 +163,7 @@ function runGitleaks(targetPath) {
             }
             catch { }
             if (filteredCount > 0) {
-                console.log(`[SCANNER] Filtered ${filteredCount} false positives from lock/generated files`);
+                console.log(`[SCANNER] Filtered ${filteredCount} false positives (test files, examples, lock files)`);
             }
         }
         console.log(`[SCANNER] gitleaks found ${findings.length} secrets`);
@@ -533,6 +582,52 @@ function runComposerAudit(targetPath) {
     }
     return findings;
 }
+function runFlawfinder(targetPath) {
+    const findings = [];
+    if (!isToolAvailable('flawfinder')) {
+        console.log('[SCANNER] flawfinder not available, skipping C/C++ SAST');
+        return findings;
+    }
+    try {
+        console.log('[SCANNER] Running flawfinder...');
+        const result = spawnSync('flawfinder', [
+            '--dataonly',
+            '--quiet',
+            '--csv',
+            targetPath
+        ], { encoding: 'utf-8', timeout: 180000, maxBuffer: 50 * 1024 * 1024 });
+        if (result.stdout) {
+            // Parse CSV output: File,Line,Column,Level,Category,Name,Warning
+            const lines = result.stdout.split('\n').filter(l => l.trim() && !l.startsWith('File,'));
+            for (const line of lines) {
+                const parts = line.split(',');
+                if (parts.length >= 7) {
+                    const level = parseInt(parts[3], 10);
+                    // Map flawfinder levels (0-5) to severity
+                    let severity = 'low';
+                    if (level >= 5)
+                        severity = 'critical';
+                    else if (level >= 4)
+                        severity = 'high';
+                    else if (level >= 2)
+                        severity = 'medium';
+                    findings.push({
+                        file: parts[0],
+                        line: parseInt(parts[1], 10),
+                        rule: `${parts[4]}:${parts[5]}`,
+                        message: parts.slice(6).join(',').replace(/"/g, ''),
+                        severity
+                    });
+                }
+            }
+        }
+        console.log(`[SCANNER] flawfinder found ${findings.length} issues`);
+    }
+    catch (err) {
+        console.error('[SCANNER] flawfinder error:', err);
+    }
+    return findings;
+}
 function runCheckov(targetPath) {
     const findings = [];
     if (!isToolAvailable('checkov')) {
@@ -892,6 +987,13 @@ export class LocalScanner {
         else {
             console.log('[SCANNER] semgrep not available, skipping SAST');
         }
+        // C/C++ SAST with flawfinder
+        if (shouldScanLang('c') && shouldUsescanner('flawfinder') && isToolAvailable('flawfinder')) {
+            console.log('[SCANNER] Using flawfinder for C/C++ SAST analysis');
+            const flawfinderFindings = runFlawfinder(this.config.targetPath);
+            result.sastFindings.push(...flawfinderFindings);
+            toolsUsed.push('flawfinder');
+        }
         // ============ IAC SCANNING ============
         if (this.config.scanIaC !== false) {
             if (shouldUsescanner('checkov') && isToolAvailable('checkov')) {
@@ -948,8 +1050,16 @@ export class LocalScanner {
             languages.add('php');
         if (existsSync(join(dir, 'pom.xml')) || existsSync(join(dir, 'build.gradle')))
             languages.add('java');
-        if (existsSync(join(dir, '*.csproj')) || existsSync(join(dir, '*.sln')))
-            languages.add('csharp');
+        // C# - need to scan directory for .csproj/.sln files (existsSync doesn't support globs)
+        try {
+            const entries = readdirSync(dir);
+            if (entries.some(f => f.endsWith('.csproj') || f.endsWith('.sln')))
+                languages.add('csharp');
+            // C/C++ detection
+            if (entries.some(f => f === 'CMakeLists.txt' || f === 'Makefile' || f.endsWith('.c') || f.endsWith('.cpp') || f.endsWith('.h') || f.endsWith('.hpp')))
+                languages.add('c');
+        }
+        catch { /* ignore */ }
         return Array.from(languages);
     }
     // Merge package findings avoiding duplicates

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aura-security",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Deterministic security auditing engine with optional AI advisory layer. Run as CLI, CI step, or service. AI does not make enforcement decisions.",
   "type": "module",
   "main": "dist/index.js",

package/visualizer/index.html

@@ -804,8 +804,21 @@
     import { OrbitControls } from 'three/addons/controls/OrbitControls.js';
 
     // ========== CONFIGURATION ==========
-    const AURA_URL = 'http://127.0.0.1:3000';
-    const WS_URL = 'ws://127.0.0.1:3001';
+    // Auto-detect environment based on hostname
+    const hostname = window.location.hostname;
+    const isLocalDev = hostname === '127.0.0.1' || hostname === 'localhost';
+
+    // API URL: local dev uses localhost:3000, production uses same origin (nginx proxies to API)
+    const AURA_URL = isLocalDev ? 'http://127.0.0.1:3000' : '';
+
+    // WebSocket URL: local dev uses localhost:3001, production uses same origin /ws path
+    const WS_URL = isLocalDev
+      ? 'ws://127.0.0.1:3001'
+      : `wss://${hostname}/ws`;
+
+    console.log('[CONFIG] Environment:', isLocalDev ? 'local' : 'production');
+    console.log('[CONFIG] API URL:', AURA_URL || '(same origin)');
+    console.log('[CONFIG] WS URL:', WS_URL);
     const POLL_INTERVAL = 5000; // Slower polling as WebSocket handles real-time
     let wsConnected = false;
     let ws = null;
@@ -2383,7 +2396,19 @@
           })
         });
 
-        const data = await res.json();
+        // Check if response is OK before parsing JSON
+        if (!res.ok) {
+          const errorText = await res.text();
+          throw new Error(`Server error (${res.status}): ${errorText.substring(0, 100)}`);
+        }
+
+        // Safely parse JSON with error handling
+        let data;
+        try {
+          data = await res.json();
+        } catch (parseErr) {
+          throw new Error('Invalid response from server (not JSON)');
+        }
         console.log('Git scan response:', data);
 
         if (data.result && data.result.scan_details) {
@@ -2391,8 +2416,11 @@
         } else if (data.error) {
           statusEl.innerHTML = `<span style="color: #ff4444;">Error: ${data.error}</span>`;
           showToast('Git scan failed', true);
+        } else if (data.result && data.result.error) {
+          statusEl.innerHTML = `<span style="color: #ff4444;">Error: ${data.result.error}</span>`;
+          showToast('Git scan failed', true);
         } else {
-          statusEl.innerHTML = '<span style="color: #ff4444;">Scan failed</span>';
+          statusEl.innerHTML = '<span style="color: #ff4444;">Scan failed - no results</span>';
         }
       } catch (err) {
         console.error('Git scan error:', err);