blitzstrike 2.4.62 → 2.4.64

package/dist/index.js

@@ -7409,18 +7409,53 @@ function redactSecrets(text) {
 var SECRET_FIELDS = "api[_-]?key|apikey|api[_-]?secret|access[_-]?key|access[_-]?token|secret[_-]?key|secret[_-]?access[_-]?key|auth[_-]?token|client[_-]?secret|consumer[_-]?secret|consumer[_-]?key|private[_-]?key|db[_-]?password|database[_-]?password|db[_-]?pass|passwd|password|jwt[_-]?secret|encryption[_-]?key|encryption[_-]?password|github[_-]?token|gitlab[_-]?token|stripe[_-]?key|sendgrid[_-]?api[_-]?key|datadog[_-]?api[_-]?key|cloudflare[_-]?api[_-]?key|slack[_-]?token|aws[_-]?access[_-]?key[_-]?id|aws[_-]?secret[_-]?access[_-]?key|aws[_-]?session[_-]?token|bot[_-]?token", SECRET_FORMATS, REDACTION_PATTERNS;
 var init_secrets = __esm(() => {
   SECRET_FORMATS = [
-    { name: "JWT", re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g },
-    { name: "AWS access key", re: /\bAKIA[0-9A-Z]{16}\b/g },
-    { name: "GitHub PAT (classic)", re: /\bghp_[A-Za-z0-9]{20,}\b/g },
-    { name: "GitHub PAT (fine-grained)", re: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g },
-    { name: "OpenAI/Stripe key", re: /\bsk-[A-Za-z0-9]{20,}\b/g },
-    { name: "Stripe live/test key", re: /\b(?:sk|pk|rk)_(?:live|test)_[0-9a-zA-Z]{10,}\b/g },
-    { name: "Slack token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
-    { name: "Google API key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
-    { name: "Twilio account SID", re: /\bAC[0-9a-f]{32}\b/g },
-    { name: "SendGrid API key", re: /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g },
-    { name: "Mailgun API key", re: /\bkey-[0-9a-zA-Z]{32}\b/g },
-    { name: "PEM private key", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g }
+    { name: "AWS access key ID", re: /\bAKIA[0-9A-Z]{16}\b/g, severity: "critical", category: "aws" },
+    { name: "AWS session token (temporary)", re: /\bASIA[0-9A-Z]{16}\b/g, severity: "critical", category: "aws" },
+    { name: "AWS secret access key", re: /aws[_-]?secret[_-]?access[_-]?key['"\s:=]+([A-Za-z0-9/+=]{40})/gi, severity: "critical", category: "aws" },
+    { name: "GCP service account key", re: /"type"\s*:\s*"service_account"/g, severity: "critical", category: "gcp" },
+    { name: "Google API key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g, severity: "high", category: "gcp" },
+    { name: "GitHub PAT (classic)", re: /\bghp_[A-Za-z0-9]{20,}\b/g, severity: "critical", category: "github" },
+    { name: "GitHub PAT (fine-grained)", re: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g, severity: "critical", category: "github" },
+    { name: "GitHub OAuth token", re: /\bgho_[A-Za-z0-9]{20,}\b/g, severity: "high", category: "github" },
+    { name: "GitHub server-to-server token", re: /\bgh[usr]_[A-Za-z0-9]{20,}\b/g, severity: "high", category: "github" },
+    { name: "Stripe live key", re: /\bsk_live_[0-9A-Za-z]{16,}\b/g, severity: "critical", category: "stripe" },
+    { name: "Stripe test key", re: /\bsk_test_[0-9A-Za-z]{16,}\b/g, severity: "low", category: "stripe" },
+    { name: "Stripe publishable key", re: /\bpk_(?:live|test)_[0-9A-Za-z]{16,}\b/g, severity: "low", category: "stripe" },
+    { name: "Slack token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, severity: "high", category: "slack" },
+    { name: "Slack webhook URL", re: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/g, severity: "medium", category: "slack" },
+    { name: "SendGrid API key", re: /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g, severity: "high", category: "email_svc" },
+    { name: "Mailgun API key", re: /\bkey-[0-9a-zA-Z]{32}\b/g, severity: "high", category: "email_svc" },
+    { name: "Twilio API key", re: /\bSK[0-9a-fA-F]{32}\b/g, severity: "high", category: "twilio" },
+    { name: "Twilio account SID", re: /\bAC[0-9a-f]{32}\b/g, severity: "medium", category: "twilio" },
+    { name: "Twilio auth token", re: /twilio(.{0,20})?(auth|token)['"=: ]+([a-f0-9]{32})/gi, severity: "high", category: "twilio" },
+    { name: "Heroku API key", re: /heroku(.{0,20})?api['"=: ]+([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})/gi, severity: "medium", category: "paas" },
+    { name: "Firebase URL", re: /\bhttps?:\/\/[a-z0-9-]+\.firebaseio\.com\b/g, severity: "low", category: "firebase" },
+    { name: "JWT", re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g, severity: "medium", category: "jwt" },
+    { name: "Bearer token", re: /authorization['"=: ]+bearer\s+[A-Za-z0-9._-]{20,}/gi, severity: "medium", category: "bearer" },
+    { name: "Basic auth URL", re: /https?:\/\/[^/\s:@]+:[^/\s:@]+@[^/\s]+/g, severity: "medium", category: "basic_auth" },
+    { name: "RSA private key", re: /-----BEGIN RSA PRIVATE KEY-----/g, severity: "critical", category: "private_key" },
+    { name: "EC private key", re: /-----BEGIN EC PRIVATE KEY-----/g, severity: "critical", category: "private_key" },
+    { name: "OpenSSH private key", re: /-----BEGIN OPENSSH PRIVATE KEY-----/g, severity: "critical", category: "private_key" },
+    { name: "Generic private key", re: /-----BEGIN (DSA |PGP |)PRIVATE KEY-----/g, severity: "critical", category: "private_key" },
+    { name: "Generic API key / token", re: /(?:api[_-]?key|apikey|api_secret|access_token|secret[_-]?token)['"\s:=]+["']([A-Za-z0-9+/=_-]{24,})["']/gi, severity: "medium", category: "generic" },
+    { name: "Anthropic API key", re: /\bsk-ant-(?:api03|admin01)-[A-Za-z0-9_-]{20,}\b/g, severity: "critical", category: "ai_api" },
+    { name: "OpenAI API key (legacy)", re: /\bsk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}\b/g, severity: "critical", category: "ai_api" },
+    { name: "OpenAI project key", re: /\bsk-proj-[A-Za-z0-9_-]{20,}T3BlbkFJ[A-Za-z0-9_-]{20,}\b/g, severity: "critical", category: "ai_api" },
+    { name: "OpenAI session token", re: /\bsess-[A-Za-z0-9]{40}\b/g, severity: "high", category: "ai_api" },
+    { name: "Hugging Face token", re: /\bhf_[A-Za-z0-9]{30,}\b/g, severity: "high", category: "ai_api" },
+    { name: "Cloudflare API key", re: /cf[_-]?api[_-]?key['"\s:=]+([a-f0-9]{37})/gi, severity: "critical", category: "infra_api" },
+    { name: "DigitalOcean token", re: /\bdop_v1_[a-f0-9]{64}\b/g, severity: "high", category: "infra_api" },
+    { name: "npm token", re: /\bnpm_[A-Za-z0-9]{36}\b/g, severity: "high", category: "package_registry" },
+    { name: "PyPI token", re: /\bpypi-AgENdGV[A-Za-z0-9_-]+\b/g, severity: "high", category: "package_registry" },
+    { name: "Docker Hub PAT", re: /\bdckr_pat_[A-Za-z0-9_-]{27,}\b/g, severity: "high", category: "package_registry" },
+    { name: "Atlassian API token", re: /\bATATT3xFfGF0[A-Za-z0-9_-]{20,}\b/g, severity: "high", category: "saas_api" },
+    { name: "Linear API key", re: /\blin_api_[A-Za-z0-9]{40}\b/g, severity: "medium", category: "saas_api" },
+    { name: "New Relic license key", re: /\b(?:NRAA|NRAK|NRBR)-[A-F0-9]{27}\b/g, severity: "medium", category: "observability" },
+    { name: "Datadog API key", re: /dd[_-]?api[_-]?key['"\s:=]+([a-f0-9]{32})/gi, severity: "high", category: "observability" },
+    { name: "Sentry DSN", re: /https:\/\/[a-f0-9]+@o[0-9]+\.ingest\.sentry\.io\/[0-9]+/g, severity: "low", category: "observability" },
+    { name: "ngrok auth token", re: /\b[12][A-Za-z0-9]{26}_[A-Za-z0-9]{32,}\b/g, severity: "medium", category: "tunneling" },
+    { name: "Discord bot token", re: /\b[MN][A-Za-z\d]{23}\.[\w-]{6}\.[\w-]{27}\b/g, severity: "high", category: "bot_token" },
+    { name: "Telegram bot token", re: /\b\d{8,10}:[A-Za-z0-9_-]{35}\b/g, severity: "high", category: "bot_token" }
   ];
   REDACTION_PATTERNS = [
     [/(authorization\s*[:=]\s*)(bearer\s+)?[A-Za-z0-9._~+/=-]{8,}/gi, "$1$2[REDACTED]"],
@@ -7433,17 +7468,34 @@ var init_secrets = __esm(() => {
     [/(session\s*[:=]\s*)["']?[A-Za-z0-9._-]{12,}["']?/gi, "$1[REDACTED]"],
     [/(cookie\s*[:=]\s*)["']?[A-Za-z0-9._-]{12,}["']?/gi, "$1[REDACTED]"],
     [/(set-cookie\s*:\s*)[^\r\n]+/gi, "$1[REDACTED]"],
-    [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g, "[REDACTED]"],
-    [/AKIA[0-9A-Z]{16}/g, "[REDACTED]"],
-    [/ghp_[A-Za-z0-9]{20,}/g, "[REDACTED]"],
-    [/github_pat_[A-Za-z0-9_]{20,}/g, "[REDACTED]"],
-    [/sk-[A-Za-z0-9]{20,}/g, "[REDACTED]"],
-    [/\b(?:sk|pk|rk)_(?:live|test)_[0-9a-zA-Z]{10,}\b/g, "[REDACTED]"],
+    [/\bAKIA[0-9A-Z]{16}\b/g, "[REDACTED]"],
+    [/\bASIA[0-9A-Z]{16}\b/g, "[REDACTED]"],
+    [/\bghp_[A-Za-z0-9]{20,}\b/g, "[REDACTED]"],
+    [/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g, "[REDACTED]"],
+    [/\bgho_[A-Za-z0-9]{20,}\b/g, "[REDACTED]"],
+    [/\bgh[usr]_[A-Za-z0-9]{20,}\b/g, "[REDACTED]"],
+    [/\bsk_live_[0-9A-Za-z]{16,}\b/g, "[REDACTED]"],
+    [/\bsk_test_[0-9A-Za-z]{16,}\b/g, "[REDACTED]"],
+    [/\bpk_(?:live|test)_[0-9A-Za-z]{16,}\b/g, "[REDACTED]"],
     [/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, "[REDACTED]"],
     [/\bAIza[0-9A-Za-z_-]{35}\b/g, "[REDACTED]"],
     [/\bAC[0-9a-f]{32}\b/g, "[REDACTED]"],
+    [/\bSK[0-9a-fA-F]{32}\b/g, "[REDACTED]"],
     [/\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g, "[REDACTED]"],
     [/\bkey-[0-9a-zA-Z]{32}\b/g, "[REDACTED]"],
+    [/\bsk-ant-(?:api03|admin01)-[A-Za-z0-9_-]{20,}\b/g, "[REDACTED]"],
+    [/\bsk-proj-[A-Za-z0-9_-]{20,}T3BlbkFJ[A-Za-z0-9_-]{20,}\b/g, "[REDACTED]"],
+    [/\bsess-[A-Za-z0-9]{40}\b/g, "[REDACTED]"],
+    [/\bhf_[A-Za-z0-9]{30,}\b/g, "[REDACTED]"],
+    [/\bdop_v1_[a-f0-9]{64}\b/g, "[REDACTED]"],
+    [/\bnpm_[A-Za-z0-9]{36}\b/g, "[REDACTED]"],
+    [/\bpypi-AgENdGV[A-Za-z0-9_-]+\b/g, "[REDACTED]"],
+    [/\bdckr_pat_[A-Za-z0-9_-]{27,}\b/g, "[REDACTED]"],
+    [/\bATATT3xFfGF0[A-Za-z0-9_-]{20,}\b/g, "[REDACTED]"],
+    [/\blin_api_[A-Za-z0-9]{40}\b/g, "[REDACTED]"],
+    [/\b(?:NRAA|NRAK|NRBR)-[A-F0-9]{27}\b/g, "[REDACTED]"],
+    [/\b\d{8,10}:[A-Za-z0-9_-]{35}\b/g, "[REDACTED]"],
+    [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g, "[REDACTED]"],
     [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, "[REDACTED]"]
   ];
 });
@@ -16054,13 +16106,32 @@ function stripCommentsOnly(code) {
   return out.join("");
 }
 function detectDeserialization(code, file, out) {
-  if (!MAGIC_METHODS.test(code))
-    return;
   const ls = lines2(code);
-  const re = /\b(unserialize|maybe_unserialize)\s*\(/g;
-  let m;
-  while ((m = re.exec(code)) !== null) {
-    const ln = lineNo2(code, m.index);
+  if (MAGIC_METHODS.test(code)) {
+    const re = /\b(unserialize|maybe_unserialize)\s*\(/g;
+    let m;
+    while ((m = re.exec(code)) !== null) {
+      const ln = lineNo2(code, m.index);
+      const l = ls[ln - 1] ?? "";
+      const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+      if (!SOURCE_TOKENS3.test(l) && !SOURCE_TOKENS3.test(scope))
+        continue;
+      out.push({
+        file,
+        line: ln,
+        type: "deserialization",
+        category: "Deserialization → POP gadget chain",
+        severity: "high",
+        evidence: l.trim(),
+        detail: `\`${m[1]}()\` of attacker-controlled data AND a magic method is present — object injection can pivot to RCE via the gadget chain.`
+      });
+    }
+  }
+  const unsafeRe = /\b(pickle\.loads?|yaml\.load|yaml\.unsafe_load|ObjectInputStream|\.readObject)\s*\(/g;
+  let u;
+  while ((u = unsafeRe.exec(code)) !== null) {
+    const ln = lineNo2(code, u.index);
     const l = ls[ln - 1] ?? "";
     const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
 `);
@@ -16070,10 +16141,10 @@ function detectDeserialization(code, file, out) {
       file,
       line: ln,
       type: "deserialization",
-      category: "Deserialization → POP gadget chain",
+      category: "Unsafe deserialization",
       severity: "high",
       evidence: l.trim(),
-      detail: `\`${m[1]}()\` of attacker-controlled data AND a magic method is present — object injection can pivot to RCE via the gadget chain.`
+      detail: `\`${u[1]}\` of attacker-controlled data — unsafe deserialization can execute arbitrary code directly (pickle/yaml/Java object streams).`
     });
   }
 }
@@ -16087,7 +16158,7 @@ function detectTypeJuggling(code, file, out) {
     const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
 `);
     const hasSource = SOURCE_TOKENS3.test(l) || SOURCE_TOKENS3.test(scope);
-    const hasHash = /\b(md5|sha1|sha256|hash|crc32|crypt|password_verify|strcmp|hash_equals|secret|token|nonce)\s*\(?/i.test(l) || /\b(secret|token|nonce|hash)\b/i.test(l);
+    const hasHash = /\b(md5|sha1|sha256|hash|crc32|crypt|password_verify|strcmp|hash_equals|secret|token|nonce)\s*\(?/i.test(l) || /(secret|token|nonce|hash)\b/i.test(l);
     if (!hasSource || !hasHash)
       continue;
     out.push({
@@ -16138,6 +16209,34 @@ function detectMassAssignment(code, file, out) {
       detail: "`parse_str()` of user input into the symbol table — variable injection."
     });
   }
+  const bindRe = /foreach\s*\(\s*\$_(POST|GET|REQUEST|COOKIE)\b[^)]*\)\s*\{[^}]*\$this->\$[A-Za-z_]\w*\s*=/g;
+  while ((m = bindRe.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    out.push({
+      file,
+      line: ln,
+      type: "mass_assignment",
+      category: "Mass assignment (dynamic field binding)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: "Request keys are bound to object properties without an allowlist — attacker can set privileged fields (role, is_admin)."
+    });
+  }
+  const createRe = /\.create\s*\(\s*(req\.body|req\.query|request\.body|request\.data|\$_(POST|REQUEST))\b/g;
+  while ((m = createRe.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    out.push({
+      file,
+      line: ln,
+      type: "mass_assignment",
+      category: "Mass assignment (unrestricted model create)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: "A model is created directly from request data without an allowlist — attacker can set privileged fields."
+    });
+  }
 }
 function detectComplexBugs(code, file) {
   const out = [];
@@ -16171,7 +16270,7 @@ function detectComplexBugs(code, file) {
 }
 function detectPrototypePollution(code, file, out) {
   const ls = lines2(code);
-  const mergeRe = /\b(Object\.assign|_\.merge|_\.defaultsDeep|\.extend|\.merge|\.defaultsDeep|mergeDeep|deepMerge|_.set)\s*\(/g;
+  const mergeRe = /(Object\.assign|_\.merge|_\.defaultsDeep|\.extend|\.merge|\.defaultsDeep|mergeDeep|deepMerge|_\.set)\s*\(/g;
   let m;
   while ((m = mergeRe.exec(code)) !== null) {
     const ln = lineNo2(code, m.index);
@@ -16193,7 +16292,7 @@ function detectPrototypePollution(code, file, out) {
 }
 function detectCrlfInjection(code, file, out) {
   const ls = lines2(code);
-  const headerRe = /\b(header|setHeader|addHeader|writeHead|appendHeader)\s*\(/g;
+  const headerRe = /\b(header|setHeader|addHeader|writeHead|appendHeader|setcookie|setCookie|set_cookie)\s*\(/g;
   let m;
   while ((m = headerRe.exec(code)) !== null) {
     const ln = lineNo2(code, m.index);
@@ -16246,7 +16345,7 @@ function detectPathConfusion(code, file, out) {
 }
 function detectSsrF(code, file, out) {
   const ls = lines2(code);
-  const re = /\b(file_get_contents|fopen|file|readfile|curl_setopt|curl_init|fetch|axios|requests\.(get|post|put)|urllib\.request|http_get|wp_remote_(get|post)|new\s+URL\s*\(|got\(|http\.(get|request))\s*\(/g;
+  const re = /\b(file_get_contents|fopen|file|readfile|curl_setopt|curl_init|fetch|axios\.(get|post|put|request|delete|head)|requests\.(get|post|put)|urllib\.request|http_get|wp_remote_(get|post)|new\s+URL\s*\(|got\(|http\.(get|request))\s*\(/g;
   let m;
   while ((m = re.exec(code)) !== null) {
     const ln = lineNo2(code, m.index);
@@ -16274,7 +16373,7 @@ function detectSsrF(code, file, out) {
 }
 function detectXxe(code, file, out) {
   const ls = lines2(code);
-  const re = /\b(simplexml_load_string|simplexml_load_file|new\s+SimpleXMLElement|->loadXML\s*\(|->load\s*\(|XMLReader\s*->\s*XML\s*\(|libxml_parse)\s*\(?/g;
+  const re = /\b(simplexml_load_string|simplexml_load_file|new\s+SimpleXMLElement|->loadXML\s*\(|->load\s*\(|XMLReader\s*->\s*XML\s*\(|libxml_parse|DocumentBuilderFactory|SAXParserFactory|SAXReader)\s*\(?/g;
   let m;
   while ((m = re.exec(code)) !== null) {
     const ln = lineNo2(code, m.index);
@@ -16299,7 +16398,7 @@ function detectXxe(code, file, out) {
 }
 function detectSsti(code, file, out) {
   const ls = lines2(code);
-  const re = /\b(render_template_string|Template\s*\(|res\.render\s*\(|ejs\.(render|compile)\s*\(|_\.template\s*\(|render_string|twig\.render|Jinja2\(|jinja2\.Template)\s*\(?/g;
+  const re = /(render_template_string|Template\s*\(|res\.render\s*\(|ejs\.(render|compile)\s*\(|_\.template\s*\(|render_string|twig->render|createTemplate\s*\(|Jinja2\(|jinja2\.Template|jinja2\.from_string|jinja2\.Environment)\s*\(?/g;
   let m;
   while ((m = re.exec(code)) !== null) {
     const ln = lineNo2(code, m.index);
@@ -16322,14 +16421,14 @@ function detectSsti(code, file, out) {
 function detectFileUploadRce(code, file, out) {
   code = stripCommentsOnly(code);
   const ls = lines2(code);
-  const re = /\b(move_uploaded_file|wp_upload_bits|->move\s*\(|storeAs\s*\(|->storeAs\s*\(|putFile\s*\()\s*\(/g;
+  const re = /\b(move_uploaded_file|wp_upload_bits|->move|storeAs|->storeAs|putFile|\.save|uploadFile)\s*\(/g;
   let m;
   while ((m = re.exec(code)) !== null) {
     const ln = lineNo2(code, m.index);
     const l = ls[ln - 1] ?? "";
     const scope = ls.slice(Math.max(0, ln - 30), ln + 3).join(`
 `);
-    if (!/\$_FILES\b|tmp_name|getUploadedFile|uploadedFile|\['name'\]/i.test(scope))
+    if (!/\$_FILES\b|tmp_name|getUploadedFile|uploadedFile|req\.files|\['name'\]|\.name/i.test(scope))
       continue;
     if (/(wp_check_filetype|PATHINFO_EXTENSION|wp_get_mime_types|allowed_?(types|extensions|exts)|mime_?(types|extensions)|in_array\s*\([^)]*\$(?:allowed|whitelist|ext)|wp_handle_upload\s*\(\s*[^)]*test_form\s*=>\s*true)/i.test(scope))
       continue;
@@ -16367,7 +16466,7 @@ function detectUnrestrictedUpload(code, file, out) {
 }
 function detectSqlInjection(code, file, out) {
   const ls = lines2(code);
-  const sinkRe = /\$wpdb->(get_results|get_col|get_var|get_row|query)\s*\(|->query\s*\(|DB::unprepared\s*\(|->whereRaw\s*\(|->selectRaw\s*\(/g;
+  const sinkRe = /\$wpdb->(get_results|get_col|get_var|get_row|query)\s*\(|->query\s*\(|->execute\s*\(|mysqli_query\s*\(|pg_query\s*\(|DB::unprepared\s*\(|[->.]whereRaw\s*\(|[->.]selectRaw\s*\(/g;
   let m;
   while ((m = sinkRe.exec(code)) !== null) {
     const ln = lineNo2(code, m.index);
@@ -16378,7 +16477,7 @@ function detectSqlInjection(code, file, out) {
       continue;
     if (SOURCE_TOKENS3.test(scope))
       continue;
-    const inlineConcat = /\.\s*\$[A-Za-z_]\w*/.test(l);
+    const inlineConcat = /(\.\s*\$[A-Za-z_]\w*|\+\s*[A-Za-z_$]\w*)/.test(l);
     const assignConcat = /(?:^|\n)\s*\$[A-Za-z_]\w*\s*(?:\.=|=)\s*[^;\n]*["'][^"']*["']\s*\.\s*\$[A-Za-z_]\w*/.test(scope);
     if (!inlineConcat && !assignConcat)
       continue;
@@ -16440,10 +16539,10 @@ function detectHardcodedSecret(code, file, out) {
         file,
         line: ln,
         type: "hardcoded_secret",
-        category: "Hardcoded secret (known format)",
-        severity: "high",
+        category: `Hardcoded secret (${fmt.category}: ${fmt.name})`,
+        severity: fmt.severity,
         evidence: (ls[ln - 1] ?? "").trim(),
-        detail: `A ${fmt.name} was found hardcoded in source — the credential is exposed to anyone with code access (CWE-798). Rotate it and load from the environment instead.`
+        detail: `${fmt.name} was found hardcoded in source — the credential is exposed to anyone with code access (CWE-798, severity ${fmt.severity}). Rotate it and load from the environment instead.`
       });
     }
   }
@@ -16547,7 +16646,7 @@ function detectOauthMisconfig(code, file, out) {
 function detectGrpcReflection(code, file, out) {
   const ls = lines2(code);
   const clean = stripCommentsOnly(code);
-  const re = /\b(enable_server_reflection|RegisterReflectionService|reflection\.enable|grpc_reflection|reflection\.Register)\b/gi;
+  const re = /grpc_reflection|enable_server_reflection|RegisterReflectionService|reflection\.enable|ServerReflection|ReflectionServicer|reflection\.Register/gi;
   let m;
   while ((m = re.exec(clean)) !== null) {
     const ln = lineNo2(code, m.index);
@@ -16567,7 +16666,7 @@ var init_complex_bugs = __esm(() => {
   init_security_state();
   init_framework_security();
   init_secrets();
-  SOURCE_TOKENS3 = /\$_(GET|POST|REQUEST|COOKIE|FILES|SERVER)\b|\$request->|\$req->|request\.(get|input|query|post|data|body|headers|cookies|params)|getParameter\(|req\.(query|body|params|headers|cookies)/;
+  SOURCE_TOKENS3 = /\$_(GET|POST|REQUEST|COOKIE|FILES|SERVER)\b|\$request->|\$req->|request\.(get|input|query|post|data|body|headers|cookies|params|args|form|values|json)|getParameter\(|req\.(query|body|params|headers|cookies|args|form)|php:\/\/input/;
   MAGIC_METHODS = /\b(__destruct|__wakeup|__toString|__invoke|__call|__get|__set|__isset|__unset|__sleep)\s*\(/;
   SECRET_FIELD_RE = new RegExp(`\\b(${SECRET_FIELDS})\\s*(?:::|=>|=|:)\\s*`, "gi");
   SECRET_PLACEHOLDER_RE = /^(null|true|false|undefined|your_|xxx+|changeme|example|placeholder|test|secret|password|token|key|api|smtp|localhost|root|admin|pass|change|me|none|na|foo|bar|dummy)$/i;
@@ -16747,11 +16846,75 @@ $r = openai.chat.completions.create(['messages' => [['role' => 'user', 'content'
   ];
 });
 
+// src/variants.ts
+import { readFileSync as readFileSync19 } from "node:fs";
+import { join as join18, dirname as dirname4 } from "node:path";
+import { fileURLToPath as fileURLToPath10 } from "node:url";
+function loadVariants() {
+  try {
+    const doc = JSON.parse(readFileSync19(join18(__dirname4, "..", "intelligence", "variants.json"), "utf8"));
+    return doc.variants ?? [];
+  } catch {
+    return [];
+  }
+}
+function scanVariants() {
+  const variants = loadVariants().filter((v) => !CROSS_FILE_ONLY.has(v.class));
+  const results = variants.map((v, i) => {
+    const findings = detectComplexBugs(v.code, `variant-${i}.php`).filter((f) => f.type === v.class);
+    return { id: `variant-${i}`, class: v.class, fired: findings.length > 0, note: v.note };
+  });
+  const per_class = {};
+  for (const r of results) {
+    const c = per_class[r.class] ??= { total: 0, fired: 0, missed: 0, coverage: 0 };
+    c.total++;
+    if (r.fired)
+      c.fired++;
+    else
+      c.missed++;
+    c.coverage = c.fired / c.total;
+  }
+  const fired = results.filter((r) => r.fired).length;
+  return {
+    total: results.length,
+    fired,
+    missed: results.length - fired,
+    coverage: results.length > 0 ? fired / results.length : 0,
+    per_class,
+    results
+  };
+}
+function variantCoverageText() {
+  const r = scanVariants();
+  const lines = [];
+  lines.push(`Blitz Strike variant corpus`);
+  lines.push(`  ${r.fired}/${r.total} shapes detected (${(r.coverage * 100).toFixed(0)}%) · ${r.missed} missed`);
+  lines.push(``);
+  for (const [cls, c] of Object.entries(r.per_class)) {
+    const mark = c.missed === 0 ? "OK " : "GAP";
+    lines.push(`  [${mark}] ${cls.padEnd(20)} ${c.fired}/${c.total}`);
+  }
+  if (r.missed > 0) {
+    lines.push(``);
+    for (const res of r.results.filter((x) => !x.fired)) {
+      lines.push(`  missed: ${res.class} — ${res.note}`);
+    }
+  }
+  return lines.join(`
+`);
+}
+var __dirname4, CROSS_FILE_ONLY;
+var init_variants = __esm(() => {
+  init_complex_bugs();
+  __dirname4 = dirname4(fileURLToPath10(import.meta.url));
+  CROSS_FILE_ONLY = new Set(["priv_esc"]);
+});
+
 // src/sync.ts
-import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, readFileSync as readFileSync24, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
-import { join as join21 } from "node:path";
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, readFileSync as readFileSync25, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
+import { join as join22 } from "node:path";
 import { homedir as homedir10 } from "node:os";
-import { fileURLToPath as fileURLToPath11 } from "node:url";
+import { fileURLToPath as fileURLToPath12 } from "node:url";
 import { spawnSync as spawnSync4 } from "node:child_process";
 function dirExists(p) {
   try {
@@ -16766,7 +16929,7 @@ function countFiles(dir) {
     const walk = (d) => {
       for (const e of readdirSync7(d, { withFileTypes: true })) {
         if (e.isDirectory())
-          walk(join21(d, e.name));
+          walk(join22(d, e.name));
         else
           n++;
       }
@@ -16780,8 +16943,8 @@ function countFiles(dir) {
 function syncData() {
   if (!dirExists(DATA_ROOT2))
     mkdirSync9(DATA_ROOT2, { recursive: true });
-  const payloadsPath = join21(DATA_ROOT2, "payloads");
-  const templatesPath = join21(DATA_ROOT2, "templates");
+  const payloadsPath = join22(DATA_ROOT2, "payloads");
+  const templatesPath = join22(DATA_ROOT2, "templates");
   const hasPayloads = dirExists(payloadsPath) && countFiles(payloadsPath) > 0;
   const hasTemplates = dirExists(templatesPath) && countFiles(templatesPath) > 0;
   if (hasPayloads && hasTemplates) {
@@ -16791,8 +16954,8 @@ function syncData() {
       data_root: DATA_ROOT2
     };
   }
-  const localPayloads = join21(ROOT7, "payloads");
-  const localTemplates = join21(ROOT7, "templates");
+  const localPayloads = join22(ROOT7, "payloads");
+  const localTemplates = join22(ROOT7, "templates");
   let payloadsSynced = false;
   let templatesSynced = false;
   if (!hasPayloads && dirExists(localPayloads)) {
@@ -16805,7 +16968,7 @@ function syncData() {
   }
   const gitOk = spawnSync4("git", ["--version"]).status === 0;
   if (gitOk && (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0 || !dirExists(templatesPath) || countFiles(templatesPath) === 0)) {
-    const tmp = join21(DATA_ROOT2, ".tmp-clone");
+    const tmp = join22(DATA_ROOT2, ".tmp-clone");
     if (dirExists(tmp))
       rmSync4(tmp, { recursive: true, force: true });
     const r = spawnSync4("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
@@ -16813,11 +16976,11 @@ function syncData() {
       const sparse = spawnSync4("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
       if (sparse.status === 0) {
         if (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0) {
-          copyDir(join21(tmp, "payloads"), payloadsPath);
+          copyDir(join22(tmp, "payloads"), payloadsPath);
           payloadsSynced = true;
         }
         if (!dirExists(templatesPath) || countFiles(templatesPath) === 0) {
-          copyDir(join21(tmp, "templates"), templatesPath);
+          copyDir(join22(tmp, "templates"), templatesPath);
           templatesSynced = true;
         }
       }
@@ -16839,18 +17002,18 @@ function copyDir(src, dst) {
 function manualCopy(src, dst) {
   mkdirSync9(dst, { recursive: true });
   for (const e of readdirSync7(src, { withFileTypes: true })) {
-    const s = join21(src, e.name);
-    const d = join21(dst, e.name);
+    const s = join22(src, e.name);
+    const d = join22(dst, e.name);
     if (e.isDirectory())
       manualCopy(s, d);
     else
-      writeFileSync8(d, readFileSync24(s));
+      writeFileSync8(d, readFileSync25(s));
   }
 }
 var ROOT7, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
 var init_sync = __esm(() => {
-  ROOT7 = join21(fileURLToPath11(new URL(".", import.meta.url)), "..");
-  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join21(homedir10(), ".blitzstrike", "data");
+  ROOT7 = join22(fileURLToPath12(new URL(".", import.meta.url)), "..");
+  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join22(homedir10(), ".blitzstrike", "data");
 });
 
 // src/update.ts
@@ -16895,15 +17058,15 @@ var init_update = __esm(() => {
 });
 
 // src/release.ts
-import { readFileSync as readFileSync26, existsSync as existsSync12 } from "node:fs";
-import { join as join22 } from "node:path";
-import { fileURLToPath as fileURLToPath12 } from "node:url";
+import { readFileSync as readFileSync27, existsSync as existsSync12 } from "node:fs";
+import { join as join23 } from "node:path";
+import { fileURLToPath as fileURLToPath13 } from "node:url";
 import { execSync as execSync2 } from "node:child_process";
 function validateRelease() {
   const checks = [];
   checks.push({ name: "package.json version", ok: true, detail: VERSION });
   try {
-    const changelog = readFileSync26(join22(ROOT8, "CHANGELOG.md"), "utf8");
+    const changelog = readFileSync27(join23(ROOT8, "CHANGELOG.md"), "utf8");
     const m = changelog.match(/^##\s+\[([0-9]+\.[0-9]+\.[0-9]+)\]/m);
     const changelogVersion = m?.[1] ?? null;
     checks.push({
@@ -16935,22 +17098,22 @@ function validateRelease() {
   return { version: VERSION, checks, consistent: checks.filter((c) => !c.soft).every((c) => c.ok) };
 }
 function lockfilePresent() {
-  return existsSync12(join22(ROOT8, "package-lock.json")) || existsSync12(join22(ROOT8, "bun.lock")) || existsSync12(join22(ROOT8, "bun.lockb"));
+  return existsSync12(join23(ROOT8, "package-lock.json")) || existsSync12(join23(ROOT8, "bun.lock")) || existsSync12(join23(ROOT8, "bun.lockb"));
 }
 var ROOT8;
 var init_release = __esm(() => {
   init_version();
-  ROOT8 = join22(fileURLToPath12(new URL(".", import.meta.url)), "..");
+  ROOT8 = join23(fileURLToPath13(new URL(".", import.meta.url)), "..");
 });
 
 // src/dependency.ts
-import { readFileSync as readFileSync27 } from "node:fs";
-import { join as join23 } from "node:path";
-import { fileURLToPath as fileURLToPath13 } from "node:url";
+import { readFileSync as readFileSync28 } from "node:fs";
+import { join as join24 } from "node:path";
+import { fileURLToPath as fileURLToPath14 } from "node:url";
 function checkDependencies() {
   let pkg = {};
   try {
-    pkg = JSON.parse(readFileSync27(join23(ROOT9, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync28(join24(ROOT9, "package.json"), "utf8"));
   } catch {
     return { install_scripts: [], git_dependencies: [], total_dependencies: 0, safe: false };
   }
@@ -16973,14 +17136,14 @@ function checkDependencies() {
 }
 var ROOT9;
 var init_dependency = __esm(() => {
-  ROOT9 = join23(fileURLToPath13(new URL(".", import.meta.url)), "..");
+  ROOT9 = join24(fileURLToPath14(new URL(".", import.meta.url)), "..");
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync28, existsSync as existsSync13, writeFileSync as writeFileSync9, mkdirSync as mkdirSync10 } from "node:fs";
-import { join as join24, dirname as dirname4 } from "node:path";
+import { readFileSync as readFileSync29, existsSync as existsSync13, writeFileSync as writeFileSync9, mkdirSync as mkdirSync10 } from "node:fs";
+import { join as join25, dirname as dirname5 } from "node:path";
 import { homedir as homedir11 } from "node:os";
-import { fileURLToPath as fileURLToPath14 } from "node:url";
+import { fileURLToPath as fileURLToPath15 } from "node:url";
 import { spawnSync as spawnSync5 } from "node:child_process";
 function which(cmd) {
   return spawnSync5("sh", ["-c", 'command -v "$1" >/dev/null 2>&1', "sh", cmd]).status === 0;
@@ -17023,7 +17186,7 @@ async function runDoctor() {
     detail: h1 ? `X-HackerOne-Research: ${h1}` : "H1_USERNAME not set",
     fix: h1 ? undefined : "export H1_USERNAME=<your-hackerone-username> (adds X-HackerOne-Research to outbound requests)"
   });
-  const dataOk = existsSync13(join24(ROOT10, "chains.json")) && existsSync13(join24(ROOT10, "tools-catalog.json"));
+  const dataOk = existsSync13(join25(ROOT10, "chains.json")) && existsSync13(join25(ROOT10, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
     status: dataOk ? "ok" : "fail",
@@ -17074,28 +17237,28 @@ BlitzStrike — ${verdict}`);
 function resolveCommand() {
   if (which("blitzstrike"))
     return { command: "blitzstrike", args: ["serve", "--mcp"] };
-  const src = join24(ROOT10, "src", "index.ts");
+  const src = join25(ROOT10, "src", "index.ts");
   if (which("bun") && existsSync13(src))
     return { command: "bun", args: ["run", src, "serve", "--mcp"] };
   if (which("npx"))
     return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
   if (which("bunx"))
     return { command: "bunx", args: ["blitzstrike", "serve", "--mcp"] };
-  const dist = join24(ROOT10, "dist", "index.js");
+  const dist = join25(ROOT10, "dist", "index.js");
   if (existsSync13(dist))
     return { command: "bun", args: [dist, "serve", "--mcp"] };
   return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
 }
 function readJson(p) {
   try {
-    return JSON.parse(readFileSync28(p, "utf8"));
+    return JSON.parse(readFileSync29(p, "utf8"));
   } catch {
     return null;
   }
 }
 function jsonMcpServersWrite(p) {
   return (command, args) => {
-    const dir = dirname4(p);
+    const dir = dirname5(p);
     if (!existsSync13(dir))
       mkdirSync10(dir, { recursive: true });
     const existing = readJson(p) ?? {};
@@ -17108,7 +17271,7 @@ function jsonMcpServersWrite(p) {
 }
 function opencodeWrite(p) {
   return (command, args) => {
-    const dir = dirname4(p);
+    const dir = dirname5(p);
     if (!existsSync13(dir))
       mkdirSync10(dir, { recursive: true });
     const existing = readJson(p) ?? {};
@@ -17121,26 +17284,26 @@ function opencodeWrite(p) {
   };
 }
 function copyOpenCodeAgents() {
-  const srcDir = join24(ROOT10, "opencode-agents");
-  const dstDir = join24(homedir11(), ".config", "opencode", "agents");
+  const srcDir = join25(ROOT10, "opencode-agents");
+  const dstDir = join25(homedir11(), ".config", "opencode", "agents");
   if (!existsSync13(srcDir))
     return;
   if (!existsSync13(dstDir))
     mkdirSync10(dstDir, { recursive: true });
   for (const f of ["Blitz Strike.md", "Blitz.md", "Eagle Eye.md", "Strike.md"]) {
-    const src = join24(srcDir, f);
-    const dst = join24(dstDir, f);
+    const src = join25(srcDir, f);
+    const dst = join25(dstDir, f);
     if (existsSync13(src)) {
-      writeFileSync9(dst, readFileSync28(src, "utf8"));
+      writeFileSync9(dst, readFileSync29(src, "utf8"));
     }
   }
 }
 function codexWrite(p) {
   return (command, args) => {
-    const dir = dirname4(p);
+    const dir = dirname5(p);
     if (!existsSync13(dir))
       mkdirSync10(dir, { recursive: true });
-    let existing = existsSync13(p) ? readFileSync28(p, "utf8") : "";
+    let existing = existsSync13(p) ? readFileSync29(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -17156,10 +17319,10 @@ args = ${JSON.stringify(args)}
 }
 function hermesWrite(p) {
   return (command, args) => {
-    const dir = dirname4(p);
+    const dir = dirname5(p);
     if (!existsSync13(dir))
       mkdirSync10(dir, { recursive: true });
-    let existing = existsSync13(p) ? readFileSync28(p, "utf8") : "";
+    let existing = existsSync13(p) ? readFileSync29(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -17186,74 +17349,74 @@ mcp_servers:
 function detectAgents() {
   const home = homedir11();
   const agents = [];
-  const claudeJson = join24(home, ".claude.json");
+  const claudeJson = join25(home, ".claude.json");
   agents.push({
     name: "Claude Code",
     detectPath: claudeJson,
     installed: () => existsSync13(claudeJson) || which("claude"),
     write: jsonMcpServersWrite(claudeJson)
   });
-  const claudeDesktop = join24(home, ".config", "Claude", "claude_desktop_config.json");
+  const claudeDesktop = join25(home, ".config", "Claude", "claude_desktop_config.json");
   agents.push({
     name: "Claude Desktop",
     detectPath: claudeDesktop,
     installed: () => existsSync13(claudeDesktop),
     write: jsonMcpServersWrite(claudeDesktop)
   });
-  const cursor = join24(home, ".cursor", "mcp.json");
+  const cursor = join25(home, ".cursor", "mcp.json");
   agents.push({
     name: "Cursor",
     detectPath: cursor,
-    installed: () => existsSync13(join24(home, ".cursor")) || which("cursor"),
+    installed: () => existsSync13(join25(home, ".cursor")) || which("cursor"),
     write: jsonMcpServersWrite(cursor)
   });
-  const opencode = join24(home, ".config", "opencode", "opencode.jsonc");
+  const opencode = join25(home, ".config", "opencode", "opencode.jsonc");
   agents.push({
     name: "OpenCode",
     detectPath: opencode,
-    installed: () => existsSync13(join24(home, ".config", "opencode")) || which("opencode"),
+    installed: () => existsSync13(join25(home, ".config", "opencode")) || which("opencode"),
     write: opencodeWrite(opencode)
   });
-  const codex = join24(home, ".codex", "config.toml");
+  const codex = join25(home, ".codex", "config.toml");
   agents.push({
     name: "Codex",
     detectPath: codex,
-    installed: () => existsSync13(join24(home, ".codex")) || which("codex"),
+    installed: () => existsSync13(join25(home, ".codex")) || which("codex"),
     write: codexWrite(codex)
   });
-  const hermes = join24(home, ".hermes", "config.yaml");
+  const hermes = join25(home, ".hermes", "config.yaml");
   agents.push({
     name: "Hermes",
     detectPath: hermes,
-    installed: () => existsSync13(join24(home, ".hermes")) || which("hermes"),
+    installed: () => existsSync13(join25(home, ".hermes")) || which("hermes"),
     write: hermesWrite(hermes)
   });
-  const gemini = join24(home, ".gemini", "settings.json");
+  const gemini = join25(home, ".gemini", "settings.json");
   agents.push({
     name: "Gemini CLI",
     detectPath: gemini,
-    installed: () => existsSync13(join24(home, ".gemini")) || which("gemini"),
+    installed: () => existsSync13(join25(home, ".gemini")) || which("gemini"),
     write: jsonMcpServersWrite(gemini)
   });
-  const windsurf = join24(home, ".codeium", "windsurf", "mcp_config.json");
+  const windsurf = join25(home, ".codeium", "windsurf", "mcp_config.json");
   agents.push({
     name: "Windsurf",
     detectPath: windsurf,
-    installed: () => existsSync13(join24(home, ".codeium")) || which("windsurf"),
+    installed: () => existsSync13(join25(home, ".codeium")) || which("windsurf"),
     write: jsonMcpServersWrite(windsurf)
   });
-  const copilot = join24(home, ".copilot", "mcp.json");
+  const copilot = join25(home, ".copilot", "mcp.json");
   agents.push({
     name: "Copilot",
     detectPath: copilot,
-    installed: () => existsSync13(join24(home, ".copilot")),
+    installed: () => existsSync13(join25(home, ".copilot")),
     write: jsonMcpServersWrite(copilot)
   });
-  const cline = join24(home, ".cline", "mcp_settings.json");
+  const cline = join25(home, ".cline", "mcp_settings.json");
   agents.push({
     name: "Cline",
     detectPath: cline,
-    installed: () => existsSync13(join24(home, ".cline")),
+    installed: () => existsSync13(join25(home, ".cline")),
     write: jsonMcpServersWrite(cline)
   });
   return agents;
@@ -17371,7 +17534,7 @@ var init_cli = __esm(() => {
   init_release();
   init_dependency();
   init_mcp_status();
-  ROOT10 = join24(fileURLToPath14(new URL(".", import.meta.url)), "..");
+  ROOT10 = join25(fileURLToPath15(new URL(".", import.meta.url)), "..");
 });
 
 // node_modules/zod/v3/helpers/util.js
@@ -32009,7 +32172,7 @@ class StdioServerTransport {
 
 // src/server.ts
 init_scanner();
-import { readFileSync as readFileSync25 } from "node:fs";
+import { readFileSync as readFileSync26 } from "node:fs";
 
 // src/recon.ts
 var TIMEOUT_MS = 25000;
@@ -57675,20 +57838,21 @@ function dataRefresh() {
 
 // src/server.ts
 init_verify_harness();
+init_variants();
 
 // src/benchmark.ts
-import { readFileSync as readFileSync19, readdirSync as readdirSync5, writeFileSync as writeFileSync6, rmSync as rmSync3, mkdirSync as mkdirSync7 } from "node:fs";
-import { join as join18 } from "node:path";
-import { fileURLToPath as fileURLToPath10 } from "node:url";
+import { readFileSync as readFileSync20, readdirSync as readdirSync5, writeFileSync as writeFileSync6, rmSync as rmSync3, mkdirSync as mkdirSync7 } from "node:fs";
+import { join as join19 } from "node:path";
+import { fileURLToPath as fileURLToPath11 } from "node:url";
 import { tmpdir as tmpdir3, homedir as homedir8 } from "node:os";
 init_complex_bugs();
-var ROOT5 = join18(fileURLToPath10(new URL(".", import.meta.url)), "..");
-var CORPUS = join18(ROOT5, "bench", "corpus");
-var CAPTURED_CORPUS_DIR = process.env.BLITZSTRIKE_CORPUS_DIR ?? join18(homedir8(), ".blitzstrike", "corpus");
+var ROOT5 = join19(fileURLToPath11(new URL(".", import.meta.url)), "..");
+var CORPUS = join19(ROOT5, "bench", "corpus");
+var CAPTURED_CORPUS_DIR = process.env.BLITZSTRIKE_CORPUS_DIR ?? join19(homedir8(), ".blitzstrike", "corpus");
 function parseCorpusFile(path) {
   let text;
   try {
-    text = readFileSync19(path, "utf8");
+    text = readFileSync20(path, "utf8");
   } catch {
     return null;
   }
@@ -57744,7 +57908,7 @@ function loadDir(dir) {
     for (const f of readdirSync5(dir)) {
       if (!f.endsWith(".md"))
         continue;
-      const e = parseCorpusFile(join18(dir, f));
+      const e = parseCorpusFile(join19(dir, f));
       if (e)
         entries.push(e);
     }
@@ -57771,7 +57935,7 @@ function captureFalsePositive(input) {
     input.code,
     "```"
   ].filter((l) => l !== null);
-  const path = join18(CAPTURED_CORPUS_DIR, `${id}.md`);
+  const path = join19(CAPTURED_CORPUS_DIR, `${id}.md`);
   writeFileSync6(path, lines.join(`
 `) + `
 `, "utf8");
@@ -57793,7 +57957,7 @@ function detect(entry) {
   }
   const lang = entry.language;
   if (lang === "php") {
-    const tmp = join18(tmpdir3(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
+    const tmp = join19(tmpdir3(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
     writeFileSync6(tmp, entry.code);
     const r = analyzeDataFlow2(tmp);
     rmSync3(tmp, { force: true });
@@ -57862,12 +58026,12 @@ function runBenchmark() {
 }
 
 // src/obligations.ts
-import { readFileSync as readFileSync20, appendFileSync as appendFileSync4, mkdirSync as mkdirSync8, existsSync as existsSync10, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join19 } from "node:path";
+import { readFileSync as readFileSync21, appendFileSync as appendFileSync4, mkdirSync as mkdirSync8, existsSync as existsSync10, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join20 } from "node:path";
 import { createHash as createHash6 } from "node:crypto";
 import { homedir as homedir9 } from "node:os";
-var HOME_DIR4 = process.env.BLITZSTRIKE_HOME ?? join19(homedir9(), ".blitzstrike");
-var OBLIGATION_PATH = join19(HOME_DIR4, "obligations.jsonl");
+var HOME_DIR4 = process.env.BLITZSTRIKE_HOME ?? join20(homedir9(), ".blitzstrike");
+var OBLIGATION_PATH = join20(HOME_DIR4, "obligations.jsonl");
 function ensureDir3() {
   if (!existsSync10(HOME_DIR4))
     mkdirSync8(HOME_DIR4, { recursive: true });
@@ -57880,7 +58044,7 @@ function loadObligations() {
     return [];
   try {
     const out = [];
-    for (const line of readFileSync20(OBLIGATION_PATH, "utf8").split(`
+    for (const line of readFileSync21(OBLIGATION_PATH, "utf8").split(`
 `)) {
       const t = line.trim();
       if (!t)
@@ -57984,11 +58148,11 @@ init_framework_security();
 // src/variant-scan.ts
 init_scanner();
 init_complex_bugs();
-import { readFileSync as readFileSync22 } from "node:fs";
+import { readFileSync as readFileSync23 } from "node:fs";
 
 // src/cross-file.ts
 init_scanner();
-import { readFileSync as readFileSync21 } from "node:fs";
+import { readFileSync as readFileSync22 } from "node:fs";
 var PUBLIC_HOOK_RE = /(?:wp_ajax_nopriv_\w+|admin_post_nopriv_\w+|init|template_redirect|wp_loaded|parse_request|user_register|um_user_register|register_new_user|authenticate)/;
 var PRIV_SINK_RE = /\b(set_role|add_role|remove_role|set_user_role|wp_set_current_user|wp_set_auth_cookie|wp_insert_user|wp_create_user|wp_update_user)\s*\(/;
 var ROLE_META_RE = /update_user_meta\s*\(\s*[^,]+,\s*['"](wp_capabilities|role|roles|capabilities|wp_user_level)['"]/;
@@ -58040,7 +58204,7 @@ function detectCrossFilePrivesc(root) {
   for (const file of files) {
     let code;
     try {
-      code = stripComments(readFileSync21(file, "utf8"));
+      code = stripComments(readFileSync22(file, "utf8"));
     } catch {
       continue;
     }
@@ -58081,7 +58245,7 @@ function detectCrossFilePrivesc(root) {
   for (const file of files) {
     let code;
     try {
-      code = stripComments(readFileSync21(file, "utf8"));
+      code = stripComments(readFileSync22(file, "utf8"));
     } catch {
       continue;
     }
@@ -58104,7 +58268,7 @@ function detectCrossFilePrivesc(root) {
   for (const file of files) {
     let code;
     try {
-      code = stripComments(readFileSync21(file, "utf8"));
+      code = stripComments(readFileSync22(file, "utf8"));
     } catch {
       continue;
     }
@@ -58219,7 +58383,7 @@ function variantScan(root, opts = {}) {
   for (const file of files) {
     let code;
     try {
-      code = readFileSync22(file, "utf8");
+      code = readFileSync23(file, "utf8");
     } catch {
       continue;
     }
@@ -58879,17 +59043,17 @@ function analyzeJwt(token, opts = {}) {
 }
 
 // src/enterprise-benchmark.ts
-import { existsSync as existsSync11, readFileSync as readFileSync23, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
-import { join as join20, resolve } from "node:path";
+import { existsSync as existsSync11, readFileSync as readFileSync24, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
+import { join as join21, resolve } from "node:path";
 init_complex_bugs();
 var ROOT6 = resolve(process.cwd(), "bench", "enterprise");
 var ENTERPRISE_FIXTURES = [
-  { id: "php-laravel", dir: join20(ROOT6, "php-laravel"), expected_vulns: 4 },
-  { id: "js-express", dir: join20(ROOT6, "js-express"), expected_vulns: 2 },
-  { id: "py-django", dir: join20(ROOT6, "py-django"), expected_vulns: 2 },
-  { id: "java-spring", dir: join20(ROOT6, "java-spring"), expected_vulns: 2 },
-  { id: "wp-batch-route", dir: join20(ROOT6, "wp-batch-route"), expected_vulns: 3 },
-  { id: "php-complex", dir: join20(ROOT6, "php-complex"), expected_vulns: 4 }
+  { id: "php-laravel", dir: join21(ROOT6, "php-laravel"), expected_vulns: 4 },
+  { id: "js-express", dir: join21(ROOT6, "js-express"), expected_vulns: 2 },
+  { id: "py-django", dir: join21(ROOT6, "py-django"), expected_vulns: 2 },
+  { id: "java-spring", dir: join21(ROOT6, "java-spring"), expected_vulns: 2 },
+  { id: "wp-batch-route", dir: join21(ROOT6, "wp-batch-route"), expected_vulns: 3 },
+  { id: "php-complex", dir: join21(ROOT6, "php-complex"), expected_vulns: 4 }
 ];
 function sourceFiles(root) {
   const out = [];
@@ -58901,7 +59065,7 @@ function sourceFiles(root) {
       return;
     }
     for (const e of entries) {
-      const p = join20(dir, e);
+      const p = join21(dir, e);
       let st;
       try {
         st = statSync3(p);
@@ -58922,7 +59086,7 @@ function detectFixture(dir) {
   for (const f of sourceFiles(dir)) {
     let code;
     try {
-      code = readFileSync23(f, "utf8");
+      code = readFileSync24(f, "utf8");
     } catch {
       continue;
     }
@@ -59542,6 +59706,13 @@ ${statusLine}` : statusLine },
   }, async () => {
     return { content: [{ type: "text", text: JSON.stringify(runVerificationHarness()) }] };
   });
+  server.registerTool("scan_variants", {
+    title: "Variant corpus coverage scan",
+    description: "VERIFY: sweep every real-world code shape (intelligence/variants.json) against its class's detector and report per-class coverage. A shape that does not fire is a coverage gap (false negative) — use this to find detector blind spots, then fix the detector.",
+    inputSchema: {}
+  }, async () => {
+    return { content: [{ type: "text", text: JSON.stringify(scanVariants()) }] };
+  });
   server.registerTool("fofa_search", {
     title: "FOFA asset search",
     description: "STRIKE: search the FOFA asset index (needs FOFA_EMAIL + FOFA_KEY).",
@@ -59926,7 +60097,7 @@ ${statusLine}` : statusLine },
     let src = code;
     if (!src && path) {
       try {
-        src = readFileSync25(path, "utf8");
+        src = readFileSync26(path, "utf8");
       } catch {
         return { content: [{ type: "text", text: JSON.stringify({ error: "unreadable path" }) }] };
       }
@@ -60544,7 +60715,7 @@ ${statusLine}` : statusLine },
     description: "Route confusion (separate class from source→sink taint): detect attacker-controlled dispatch (call_user_func/forward/dispatch), dynamic method calls ($obj->$m()), dynamic include (LFI), batch/proxy forwarding without per-route auth re-check, and route matching without path normalization.",
     inputSchema: { path: string2().describe("Source file path (PHP)") }
   }, async ({ path }) => {
-    const code = readFileSync25(path, "utf8");
+    const code = readFileSync26(path, "utf8");
     const findings = detectRouteConfusion(code, path);
     return {
       content: [{
@@ -60558,7 +60729,7 @@ ${statusLine}` : statusLine },
     description: "Complex-bug detection beyond taint: deserialization→POP gadget chain (unserialize + magic method), type juggling (loose ==/!= vs hash/secret), mass assignment (extract/parse_str without a safe flag), prototype pollution (unsafe merge of request data), CRLF/header injection (user input into a header), path confusion (user input into a file path without canonicalization), SSRF (user-controlled URL with no host allowlist), XXE (user XML parsed without disabling entities), SSTI (user input into a template render with no sandbox), wrong-context sanitization (sanitize_text_field() into a SQL query), and missing authorization/nonce on WordPress entry points (wp_ajax_* / admin_post_* / register_rest_route without current_user_can, nonce verification, or permission_callback).",
     inputSchema: { path: string2().describe("Source file path") }
   }, async ({ path }) => {
-    const code = readFileSync25(path, "utf8");
+    const code = readFileSync26(path, "utf8");
     const findings = detectComplexBugs(code, path);
     return {
       content: [{
@@ -60644,7 +60815,7 @@ ${statusLine}` : statusLine },
     let lang = language;
     if (path && !code) {
       try {
-        src = readFileSync25(path, "utf8");
+        src = readFileSync26(path, "utf8");
       } catch {
         return { content: [{ type: "text", text: JSON.stringify({ error: `cannot read ${path}` }) }] };
       }
@@ -60885,15 +61056,15 @@ async function serve() {
 
 // src/index.ts
 init_cli();
-import { readFileSync as readFileSync29, existsSync as existsSync14 } from "node:fs";
-import { join as join25 } from "node:path";
-import { fileURLToPath as fileURLToPath15 } from "node:url";
-var ROOT11 = join25(fileURLToPath15(new URL(".", import.meta.url)), "..");
+import { readFileSync as readFileSync30, existsSync as existsSync14 } from "node:fs";
+import { join as join26 } from "node:path";
+import { fileURLToPath as fileURLToPath16 } from "node:url";
+var ROOT11 = join26(fileURLToPath16(new URL(".", import.meta.url)), "..");
 function readVersion() {
   try {
-    const p = join25(ROOT11, "package.json");
+    const p = join26(ROOT11, "package.json");
     if (existsSync14(p))
-      return JSON.parse(readFileSync29(p, "utf8")).version ?? "1.0.0";
+      return JSON.parse(readFileSync30(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";
 }
@@ -60964,9 +61135,13 @@ async function main() {
   }
   if (args[0] === "verify") {
     await Promise.resolve().then(() => init_verify_harness());
+    await Promise.resolve().then(() => init_variants());
     console.log(verificationReportText());
+    console.log(`
+` + variantCoverageText());
     const r = runVerificationHarness();
-    if (r.failed > 0)
+    const v = scanVariants();
+    if (r.failed > 0 || v.missed > 0)
       process.exit(1);
     return;
   }