cleartoship 0.10.0 → 0.10.1

package/README.md

@@ -97,7 +97,9 @@ Dockerfiles, Terraform, GitHub Actions pinning, prompt injection and MCP tool
 runtimes, React Native, Go and shell.
 
 27 upstream rules are **superseded** where ClearToShip's own AST check is more
-precise, 6 are **withheld** as measurably noisy, 5 carry a **match guard** for a
+precise, 6 are **withheld** as measurably noisy, 10 React Native rules are
+**skipped as inapplicable** on a project that is not React Native, 9 carry a
+**match guard** for a
 shape their regex cannot exclude (a `"link": true` lockfile entry has no
 integrity hash by design; `querySelectorAll` is not a SQL call; `eval()` inside
 a sentence about eval is prose), and 3 name-heuristic rules are
@@ -216,7 +218,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: murtazaozdemir/cleartoship@v0.10.0
+      - uses: murtazaozdemir/cleartoship@v0.10.1
         with:
           fail-on: critical
           comment: true
@@ -238,7 +240,7 @@ above `fail-on`) for use in later steps. The comment is *sticky* — re-runs edi
 the same comment instead of piling up.
 
 By default the action runs the scanner version its own ref declares, so
-`@v0.10.0` runs `cleartoship@0.10.0` and pinning the ref pins the behaviour. If
+`@v0.10.1` runs `cleartoship@0.10.1` and pinning the ref pins the behaviour. If
 that version is not on the registry, it builds from its own checkout instead, so
 `uses: …@ref` works against an unpublished commit.
 
@@ -288,6 +290,19 @@ uploaded, and no database is connected to.
   excluded: one is a published CLI's entry point, the other is production schema.
   Across five dogfooded repos this moved 21 findings out of `critical` without
   hiding one of them.
+- **A bound parameter is not an injection.** `db.prepare(\`UPDATE ${table} SET
+  csv = ? WHERE id = ?\`).bind(...)` interpolates an identifier while its values
+  go through placeholders — the correct pattern, and the one a SQL-injection
+  regex reads as the bug. Both SQL rules now read the whole statement and the
+  call chained to it, and stand down when the values are bound. They still fire
+  when any interpolation reads from the request, so a query that binds one value
+  and concatenates another is reported.
+- **A rule that cannot apply here is not run.** The vendored ruleset covers
+  ground this project may not stand on: certificate pinning and WebView
+  hardening are React Native concerns, and a browser will not let a page pin a
+  certificate at all, so those rules are skipped unless the project actually is
+  React Native. Likewise the "no request-body size limit" rule, whose own text
+  says Next.js already imposes one. The report names what it skipped and why.
 - **Mass assignment means the payload arrives whole.** CTS002 and CTS043 fire when
   the object the caller sent reaches the columns — `update(body)`,
   `data: { ...input }`, including one level down where Prisma and Drizzle put it.

package/action.yml

@@ -29,7 +29,7 @@ inputs:
   version:
     description: >-
       Version of the cleartoship npm package to run. Defaults to the version this
-      action's own ref declares, so `uses: …@v0.10.0` runs cleartoship@0.10.0. Set
+      action's own ref declares, so `uses: …@v0.10.1` runs cleartoship@0.10.1. Set
       `latest` to always track the newest release, or `local` to build from the checkout.
     required: false
     default: ''
@@ -76,7 +76,7 @@ runs:
       run: |
         # With no version pinned, run the exact version this action's checkout
         # declares. That keeps the action ref and the scanner in lockstep:
-        # `uses: <owner>/cleartoship@v0.10.0` runs cleartoship@0.10.0 instead of
+        # `uses: <owner>/cleartoship@v0.10.1` runs cleartoship@0.10.1 instead of
         # whatever npm happens to tag `latest` at the time.
         ver="$INPUT_VERSION"
         if [ -z "$ver" ]; then

package/dist/scanners/community.js

@@ -1,7 +1,7 @@
 import { read, rel, lineAt, snippetAt, languagesFor } from '../utils/files.js';
 import { Suppressions } from '../utils/suppress.js';
 import { adjustForPath } from '../utils/paths.js';
-import { GUARDVIBE_RULES, GUARDVIBE_ATTRIBUTION } from '../vendor/guardvibe/index.js';
+import { GUARDVIBE_RULES, GUARDVIBE_ATTRIBUTION, GUARDVIBE_REACT_NATIVE_RULE_IDS, } from '../vendor/guardvibe/index.js';
 import { emptyResult } from '../types.js';
 /**
  * Upstream rules that restate a check ClearToShip already performs against the
@@ -121,6 +121,56 @@ function looksLikeSecretValue(match) {
         return false;
     return true;
 }
+/** Bind placeholders: `?`, `$1`, `:name`, `@name`, anywhere a value may go. */
+const BIND_PLACEHOLDER = /[\s(,=]\?(?=[\s,)`;]|$)|\$\d+\b|[\s(,=]:[A-Za-z_]\w*|[\s(,=]@[A-Za-z_]\w*/;
+/** `${...}` expressions that read straight from the request. */
+const INTERPOLATES_REQUEST = /\$\{[^}]*\b(req|request|body|params|query|searchParams|argv|input|formData|payload)\b/i;
+/**
+ * The whole statement a match sits in. Both SQL rules stop matching at the first
+ * `${`, so the bind placeholders that decide the question are usually *past* the
+ * end of the match — `prepare(\`UPDATE ${table} SET csv_data = ? WHERE id = ?\`)`
+ * matches only as far as `UPDATE ${`.
+ */
+function statementAround(source, index) {
+    const open = source.indexOf('`', index);
+    if (open !== -1 && open - index < 120) {
+        for (let i = open + 1; i < source.length && i < open + 800; i++) {
+            if (source[i] === '\\') {
+                i++;
+                continue;
+            }
+            // A little past the closing backtick, so the chained `.bind(...)` that
+            // decides whether the values are parameterized is inside the window.
+            if (source[i] === '`')
+                return source.slice(index, i + 121);
+        }
+    }
+    return source.slice(index, index + 400);
+}
+/**
+ * Whether the statement passes its values as bound parameters. Interpolating a
+ * table name into an otherwise parameterized query is ordinary; interpolating
+ * `${req.query.id}` is the bug, and a query doing both still fails this test.
+ */
+function isParameterized(statement) {
+    if (INTERPOLATES_REQUEST.test(statement))
+        return false;
+    // Handing the statement to `.bind(...)` is the parameterizing itself, and it
+    // covers the idioms a placeholder scan cannot see: `IN (${ids.map(() =>
+    // '?').join(',')})`, or a constant SQL fragment interpolated beside binds.
+    if (/\.\s*bind\s*\(\s*[^)\s]/.test(statement))
+        return true;
+    // Otherwise look for the placeholders themselves — with interpolations
+    // dropped first, so a JavaScript ternary is not read as a `?` parameter.
+    return BIND_PLACEHOLDER.test(statement.replace(/\$\{[^}]*\}/g, ' '));
+}
+/** The verb has to be a SQL verb, and the statement must not be parameterized. */
+function sqlGuard(match, source, index) {
+    const verb = /^[A-Za-z_]+/.exec(match)?.[0] ?? '';
+    if (!SQL_VERBS.test(verb) && !SQL_KEYWORDS.test(match))
+        return false;
+    return !isParameterized(statementAround(source, index));
+}
 /** Whether `index` falls inside a quoted string on its own line. */
 function insideStringLiteral(source, index) {
     const lineStart = source.lastIndexOf('\n', index - 1) + 1;
@@ -155,10 +205,6 @@ const MATCH_GUARDS = {
     // SQL call. Weak verbs have to be backed by something that looks like SQL;
     // `query`, `execute` and friends stand on their own. A real interpolated
     // `exec(\`INSERT INTO ...\`)` still matches — checked against one.
-    VG010: (match) => {
-        const verb = /^[A-Za-z_]+/.exec(match)?.[0] ?? '';
-        return SQL_VERBS.test(verb) || SQL_KEYWORDS.test(match);
-    },
     // `(?:child_process|cp)[\s\S]*?(?:exec|spawn…)` lets the bridge run to the end
     // of the file: one match measured 3,608 characters and 109 lines, pairing an
     // `import … from "node:child_process"` with an `exec(` far below it and
@@ -175,6 +221,26 @@ const MATCH_GUARDS = {
     // is an opaque token, not a sentence and not a placeholder.
     VG001: (match) => looksLikeSecretValue(match),
     VG062: (match) => looksLikeSecretValue(match),
+    // A statement whose values go through bind placeholders is parameterized:
+    // `db.prepare(\`UPDATE ${table} SET csv_data = ? WHERE id = ?\`).bind(...)`
+    // interpolates an identifier, not user input, and both rules read that as
+    // injection. Held to two conditions, so a query that binds one value and
+    // concatenates another still fires: there must be a placeholder, and no
+    // interpolated expression may read from the request.
+    VG010: (match, source, index) => sqlGuard(match, source, index),
+    VG123: (_match, source, index) => !isParameterized(statementAround(source, index)),
+    // SSRF is a *server* being made to fetch a URL it should not. A module marked
+    // `'use client'` runs in the browser, where the request leaves the user's own
+    // machine and crosses no trust boundary of yours.
+    VG120: (_match, source) => !/^\s*(['"])use client\1/m.test(source.slice(0, 400)),
+    // The name list is prefix-matched with `\w*` after it, so `hashPage === 'x'`
+    // and `tokenCount === 3` read as secret comparisons. A timing attack needs the
+    // *secret itself* on one side, so the identifier has to be one of those words,
+    // not merely start with one.
+    VG106: (match) => {
+        const identifier = /^[A-Za-z_$][\w$]*/.exec(match)?.[0] ?? '';
+        return /(secret|token|apikey|api_key|signature|hmac|hash|digest|webhook)$/i.test(identifier);
+    },
     // "An attacker can request the entire table" is the rule's premise, and a
     // query filtered to the caller's own rows does not let them. An unbounded
     // fetch of your own data is a scalability question, not a security finding.
@@ -193,6 +259,27 @@ function severityOf(value) {
         ? value
         : 'medium';
 }
+/**
+ * Rules that only apply on a platform this project is not. Skipping them is not
+ * a judgement about the rule — it is that the advice cannot be followed here.
+ */
+function inapplicable(ctx) {
+    const ids = new Set();
+    const why = [];
+    if (!ctx.framework.reactNative) {
+        for (const id of GUARDVIBE_REACT_NATIVE_RULE_IDS)
+            ids.add(id);
+        why.push(`${GUARDVIBE_REACT_NATIVE_RULE_IDS.size} React Native rules (not a mobile project)`);
+    }
+    // VG132 asks for an explicit request-body size limit and says itself that
+    // Next.js and Vercel already impose one. On a Next.js project it is advice
+    // about a limit the framework has already applied.
+    if (ctx.framework.nextjs !== null) {
+        ids.add('VG132');
+        why.push('VG132 body-size limit (Next.js sets one by default)');
+    }
+    return { ids, why };
+}
 export const communityScanner = {
     name: `Community ruleset (${GUARDVIBE_RULES.length - SUPERSEDED.size - WITHHELD.size} rules)`,
     applies() {
@@ -200,7 +287,8 @@ export const communityScanner = {
     },
     async run(ctx) {
         const result = emptyResult();
-        const active = GUARDVIBE_RULES.filter((r) => !SUPERSEDED.has(r.id) && !WITHHELD.has(r.id));
+        const platform = inapplicable(ctx);
+        const active = GUARDVIBE_RULES.filter((r) => !SUPERSEDED.has(r.id) && !WITHHELD.has(r.id) && !platform.ids.has(r.id));
         const seen = new Set();
         let filesScanned = 0;
         for (const file of ctx.files) {
@@ -271,7 +359,8 @@ export const communityScanner = {
             label: `Community ruleset (${active.length} rules over ${filesScanned} files)`,
             passed: result.findings.every((f) => f.severity !== 'critical'),
             note: `${SUPERSEDED.size} superseded by ClearToShip's AST checks, ${WITHHELD.size} withheld as noisy, ` +
-                `${MANIFEST_ONLY.size} manifest-only (not run over lockfiles)`,
+                `${MANIFEST_ONLY.size} manifest-only (not run over lockfiles)` +
+                (platform.why.length ? `; skipped as inapplicable: ${platform.why.join(', ')}` : ''),
         });
         return result;
     },

package/dist/scanners/server-actions.js

@@ -655,7 +655,14 @@ export const serverActionsScanner = {
                         meta: { kind, route: relPath },
                     });
                 }
-                if (writes && info.hasAuth && !info.ownerScoped && info.params > 0) {
+                // A Route Handler always has a `request` parameter, so "takes an
+                // argument" says nothing about it — `POST /api/auth/logout`, which
+                // resolves the session and destroys it, was reported as an IDOR. What
+                // the rule needs is a real write keyed on something the caller sent.
+                const idorShaped = isRoute
+                    ? info.hasMutation && info.readsRequestInput
+                    : info.params > 0;
+                if (writes && info.hasAuth && !info.ownerScoped && idorShaped) {
                     push({
                         id: 'CTS004',
                         severity: 'medium',

package/dist/types.d.ts

@@ -53,6 +53,7 @@ export interface FrameworkInfo {
     nextAuth: boolean;
     stripe: boolean;
     python: boolean;
+    reactNative: boolean;
     /** Human-readable one-liner for the CLI header. */
     describe(): string;
 }

package/dist/utils/detect.js

@@ -38,6 +38,13 @@ export function detectFramework(root, files) {
         hasDep(pkg, '@supabase/ssr') ||
         hasDep(pkg, '@supabase/auth-helpers-nextjs') ||
         exists(join(root, 'supabase'));
+    // Expo counts: it is React Native underneath, and the mobile rules apply.
+    const reactNative = hasDep(pkg, 'react-native') ||
+        hasDep(pkg, 'expo') ||
+        exists(join(root, 'metro.config.js')) ||
+        exists(join(root, 'metro.config.ts')) ||
+        exists(join(root, 'app.json')) &&
+            /\b(expo|react-native)\b/.test(read(join(root, 'app.json')) ?? '');
     const info = {
         nextjs,
         supabase,
@@ -48,6 +55,7 @@ export function detectFramework(root, files) {
         stripe: hasDep(pkg, 'stripe'),
         python: exists(join(root, 'requirements.txt')) ||
             exists(join(root, 'pyproject.toml')),
+        reactNative,
         describe() {
             const parts = [];
             if (this.nextjs === 'app-router')
@@ -70,6 +78,8 @@ export function detectFramework(root, files) {
                 parts.push('Stripe');
             if (this.python)
                 parts.push('Python');
+            if (this.reactNative)
+                parts.push('React Native');
             return parts.length ? parts.join(' + ') : 'generic JavaScript/TypeScript';
         },
     };

package/dist/utils/paths.js

@@ -1,6 +1,15 @@
 import { SEVERITY_ORDER } from '../types.js';
-/** Tests, fixtures, examples and docs: the code is there to be read, not run. */
-const NON_PRODUCTION = /(^|\/)(tests?|__tests__|__mocks__|__fixtures__|fixtures?|spec|specs|examples?|docs?|demo|samples?|e2e|cypress|playwright|stories)(\/|$)|\.(test|spec|stories|fixture)\.[a-z]+$/i;
+/**
+ * Tests, fixtures, examples and docs: the code is there to be read, not run.
+ *
+ * The test family accepts an affix — `transfer-tests/`, `integration_test/` —
+ * because that is how those directories get named. The rest are matched whole
+ * on purpose: `demo` is a fixture directory, but `demo-billing/` may well be a
+ * shipped feature, and quietly downgrading it would be the worse mistake.
+ * Every segment must be followed by a slash — these are directories. A file
+ * named `spec-parser.ts` is production code that happens to parse specs.
+ */
+const NON_PRODUCTION = /(^|\/)(?:(?:[\w.]+[-_])?(?:tests?|specs?|e2e|fixtures?|mocks?)(?:[-_][\w.]+)?|__tests__|__mocks__|__fixtures__|examples?|docs?|demo|samples?|cypress|playwright|stories)\/|\.(test|spec|stories|fixture)\.[a-z]+$/i;
 /**
  * Build and maintenance tooling. It runs on a developer's machine or in CI,
  * with credentials its author already holds, and never answers a request from
@@ -10,7 +19,7 @@ const NON_PRODUCTION = /(^|\/)(tests?|__tests__|__mocks__|__fixtures__|fixtures?
  * `bin/` is deliberately absent: for a published CLI that is the shipped entry
  * point. So is `migrations/`, which is the production schema.
  */
-const DEV_TOOLING = /(^|\/)(scripts?|tools?|tooling|\.github|\.husky|\.circleci|seeds?|benchmarks?|codegen)(\/|$)|(^|\/)[^/]*\.config\.[cm]?[jt]s$|(^|\/)(Makefile|Dockerfile[^/]*|docker-compose[^/]*\.ya?ml)$/i;
+const DEV_TOOLING = /(^|\/)(scripts?|tools?|tooling|\.github|\.husky|\.circleci|seeds?|benchmarks?|codegen)\/|(^|\/)[^/]*\.config\.[cm]?[jt]s$|(^|\/)(Makefile|Dockerfile[^/]*|docker-compose[^/]*\.ya?ml)$/i;
 export function pathClass(relPath) {
     if (NON_PRODUCTION.test(relPath))
         return 'non-production';

package/dist/vendor/guardvibe/index.d.ts

@@ -8,4 +8,11 @@ export declare const GUARDVIBE_RULES: SecurityRule[];
  * running with --offline.
  */
 export declare const GUARDVIBE_CVE_RULE_IDS: ReadonlySet<string>;
+/**
+ * Ids of the React Native ruleset. Certificate pinning, WebView hardening and
+ * AsyncStorage hygiene are mobile concerns; on a web or server project they are
+ * not weaker advice, they are inapplicable — a browser will not let a page pin a
+ * certificate at all. Skipped unless the project actually is React Native.
+ */
+export declare const GUARDVIBE_REACT_NATIVE_RULE_IDS: ReadonlySet<string>;
 export declare const GUARDVIBE_ATTRIBUTION = "GuardVibe (github.com/goklab/guardvibe), Copyright 2026 GokLab, Apache-2.0";

package/dist/vendor/guardvibe/index.js

@@ -57,4 +57,11 @@ export const GUARDVIBE_RULES = [
  * running with --offline.
  */
 export const GUARDVIBE_CVE_RULE_IDS = new Set(cveVersionRules.map((r) => r.id));
+/**
+ * Ids of the React Native ruleset. Certificate pinning, WebView hardening and
+ * AsyncStorage hygiene are mobile concerns; on a web or server project they are
+ * not weaker advice, they are inapplicable — a browser will not let a page pin a
+ * certificate at all. Skipped unless the project actually is React Native.
+ */
+export const GUARDVIBE_REACT_NATIVE_RULE_IDS = new Set(reactNativeRules.map((r) => r.id));
 export const GUARDVIBE_ATTRIBUTION = 'GuardVibe (github.com/goklab/guardvibe), Copyright 2026 GokLab, Apache-2.0';

package/examples/security.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: murtazaozdemir/cleartoship@v0.10.0
+      - uses: murtazaozdemir/cleartoship@v0.10.1
         with:
           fail-on: critical   # block the PR only on criticals
           comment: true        # post a summary comment on the PR

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cleartoship",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "The 30-second pre-launch security clearance for AI-built & vibe-coded apps. Catches missing Server Action auth, Supabase RLS holes, hallucinated npm packages and leaked keys.",
   "keywords": [
     "security",