cleartoship 0.12.0 → 0.12.2

package/README.md

@@ -84,8 +84,8 @@ reaches a manifest.
 | Rule | Severity | What it catches |
 | --- | --- | --- |
 | **CTS080** | high | Caller-supplied text interpolated into the instruction text itself — prompt injection by construction, not by filter (LLM01) |
-| **CTS081** | medium | A request-reachable model call with no `max_tokens` ceiling: the answer's length, and its bill, chosen by whoever wrote the input (LLM10) |
-| **CTS082** | medium | A system prompt in a `'use client'` module — compiled into the bundle, readable in devtools (LLM07) |
+| **CTS081** | medium | A request-reachable model call with no `max_tokens` ceiling: the answer's length, and its bill, chosen by whoever wrote the input (LLM06) |
+| **CTS082** | medium | A system prompt in a `'use client'` module — compiled into the bundle, readable in devtools (LLM08) |
 
 **Logging, error-handling & deserialization** — the detectable slices of A08/A09/A10
 
@@ -147,54 +147,38 @@ A05 112, A04 78, A02 59, A03 32, A07 17, A06 13, A08 11, A09 2. ClearToShip's
 own 45 rules add A01 19, A03 9, A04 7, A08 3, A05 2, and one each for A07, A09
 and A10 — which is the category no vendored rule reaches.
 
-## OWASP Top 10 for LLM Applications — coverage
+## OWASP Top 10 for LLM Applications (2026) — coverage
 
 Worth stating separately, because "we cover the OWASP Top 10" and "we cover the
-LLM Top 10" are different claims and only one of them is usually meant. **41
-vendored rules map to 7 of the 10 LLM categories**, and first-party findings
-join them when the finding itself names a provider — a hardcoded OpenAI key
-(CTS030), an AI client configured to run in the browser (CTS045).
+LLM Top 10" are different claims and only one of them is usually meant. Mapped
+against the **2026 edition**, published 4 August 2026 — which renumbered eight
+of the ten: Excessive Agency moved 06 → 03, Unbounded Consumption 10 → 06,
+Improper Output Handling 05 → 10, and System Prompt Leakage was renamed and
+broadened into **Hidden Context Exposure**.
 
 | Category | Rules | What we detect |
 | --- | --- | --- |
 | **LLM01** Prompt Injection | 12 + **CTS080** | Caller text interpolated into the instruction text itself; fetched pages and query results reaching a prompt unbounded; instructions hidden in a tool description |
 | **LLM02** Sensitive Information Disclosure | 11 (+ CTS030, CTS045) | Provider keys in client code or a `NEXT_PUBLIC_` variable, `dangerouslyAllowBrowser`, a base URL pointed at somebody else's endpoint |
-| **LLM06** Excessive Agency | 9 | MCP servers with permissive tool access, `allowedTools` wildcards, auto-approve bypassing the permission prompt, settings hooks that fetch or pipe |
-| **LLM05** Improper Output Handling | 4 | Model output rendered as raw HTML or markdown images, or used in a dangerous sink |
-| **LLM08** Vector & Embedding Weaknesses | 3 | Retrieval results interpolated into a prompt, unauthenticated vector upserts |
-| **LLM03** Supply Chain | 1 | MCP server pinned to `@latest` |
-| **LLM07** System Prompt Leakage | 1 + **CTS082** | A system prompt held in a `'use client'` module, so it ships in the bundle; a prompt returned in an error response |
-| **LLM10** Unbounded Consumption | **CTS081** | A request-reachable model call with no `max_tokens` ceiling — the answer's length, and its cost, decided by whoever wrote the input |
-| **LLM04** Data & Model Poisoning | — | Needs training-pipeline and dataset provenance. Nothing in a web app's source tree answers it, and a rule that pretended otherwise would be box-checking |
-| **LLM09** Misinformation | — | A property of what the model says, not of the code that calls it. The adjacent detectable case — model output driving a security decision — would be a real rule, and is not written yet |
+| **LLM03** Excessive Agency | 9 | MCP servers with permissive tool access, `allowedTools` wildcards, auto-approve bypassing the permission prompt, settings hooks that fetch or pipe |
+| **LLM04** Supply Chain | 1 | MCP server pinned to `@latest` |
+| **LLM06** Unbounded Consumption | **CTS081** | A request-reachable model call with no `max_tokens` ceiling — the answer's length, and its cost, decided by whoever wrote the input |
+| **LLM08** Hidden Context Exposure | 1 + **CTS082** | A system prompt held in a `'use client'` module, so it ships in the bundle; a prompt returned in an error response |
+| **LLM09** Vector & Embedding Weaknesses | 3 | Retrieval results interpolated into a prompt, unauthenticated vector upserts |
+| **LLM10** Improper Output Handling | 4 | Model output rendered as raw HTML or markdown images, or used in a dangerous sink |
+| **LLM05** Data & Model Poisoning | — | Needs training-pipeline and dataset provenance. Nothing in a web app's source tree answers it, and a rule that pretended otherwise would be box-checking |
+| **LLM07** Misinformation | — | A property of what the model says, not of the code that calls it. The adjacent detectable case — model output driving a security decision — would be a real rule, and is not written yet |
 
 The mapping is derived from each rule's own text rather than a hand-kept list of
 ids, so re-vendoring upstream cannot silently drop it, and it is deliberately
 conservative: a rule that does not clearly belong to a category gets none.
 
 **Eight of ten have first-party or vendored detection. Two do not, and will not
-get a rule for the sake of the table** — LLM04 needs artefacts that are not in
-the repository, and LLM09 is about the truthfulness of an answer. A tool that
+get a rule for the sake of the table** — LLM05 needs artefacts that are not in
+the repository, and LLM07 is about the truthfulness of an answer. A tool that
 claimed those would be lying about what it checked, which is the failure mode
 this project exists to avoid.
 
-Two honest points a reviewer would raise, answered up front:
-
-- **A06 and A09 are hard for _any_ static tool.** A06 (Insecure Design) is about
-  missing threat modeling — you cannot grep for "the developer didn't consider an
-  abuse case." A09 (Logging failures) is largely a runtime/ops concern. Semgrep,
-  Snyk and CodeQL have the same limits. ClearToShip covers the *detectable slices*
-  (secrets in logs, fail-open error handling) and is honest that the rest needs a
-  human threat model and runtime observability, not a scanner.
-- **Coverage is uneven on purpose.** The thesis is "the gaps LLM-generated code
-  leaves," which cluster in A01/A03/A07/A04 — so that is where the rules cluster.
-
-Running with `--no-community` (first-party rules only) covers **8 of 10**
-categories directly (A01, A03, A04, A05, A07, A08, A09, A10); the community pack
-adds A02 and broadens A05/A07.
-
-
-
 ## Usage
 
 ```bash
@@ -267,7 +251,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: murtazaozdemir/cleartoship@v0.12.0
+      - uses: murtazaozdemir/cleartoship@v0.12.2
         with:
           fail-on: critical
           comment: true
@@ -289,7 +273,7 @@ above `fail-on`) for use in later steps. The comment is *sticky* — re-runs edi
 the same comment instead of piling up.
 
 By default the action runs the scanner version its own ref declares, so
-`@v0.12.0` runs `cleartoship@0.12.0` and pinning the ref pins the behaviour. If
+`@v0.12.2` runs `cleartoship@0.12.2` and pinning the ref pins the behaviour. If
 that version is not on the registry, it builds from its own checkout instead, so
 `uses: …@ref` works against an unpublished commit.
 

package/action.yml

@@ -29,7 +29,7 @@ inputs:
   version:
     description: >-
       Version of the cleartoship npm package to run. Defaults to the version this
-      action's own ref declares, so `uses: …@v0.12.0` runs cleartoship@0.12.0. Set
+      action's own ref declares, so `uses: …@v0.12.2` runs cleartoship@0.12.2. Set
       `latest` to always track the newest release, or `local` to build from the checkout.
     required: false
     default: ''
@@ -76,7 +76,7 @@ runs:
       run: |
         # With no version pinned, run the exact version this action's checkout
         # declares. That keeps the action ref and the scanner in lockstep:
-        # `uses: <owner>/cleartoship@v0.12.0` runs cleartoship@0.12.0 instead of
+        # `uses: <owner>/cleartoship@v0.12.2` runs cleartoship@0.12.2 instead of
         # whatever npm happens to tag `latest` at the time.
         ver="$INPUT_VERSION"
         if [ -z "$ver" ]; then

package/dist/scanners/community.js

@@ -254,6 +254,20 @@ const MATCH_GUARDS = {
     // cannot tell whether the auth check is already there, and CTS001 can:
     // matching on the module's own vocabulary keeps this from contradicting it.
     VG1025: (_match, source) => !/\b(auth\.getUser|getServerSession|getServerAuthSession|requireUser|requireAuth|requireUserId|currentUser|handleSessionToken|verifyRequest|getSession)\s*\(/.test(source),
+    // `jwt.sign(payload, getJwtSecret(), { expiresIn: TOKEN_EXPIRY })` was
+    // reported as a token without expiry: the pattern's `[^)]` scan for
+    // `expiresIn` stops at the first `)`, which here belongs to `getJwtSecret()`.
+    // Read the whole call before saying the option is absent.
+    VG061: (_match, source, index) => !/\b(expiresIn|exp\s*:|setExpirationTime)\b/.test(source.slice(index, index + 300)),
+    // The "sink" half of the upload rule matched the word *upload* inside a
+    // sentence — "Please upload a CSV file exported from Shopify". A filename
+    // reaching a string is not a filename reaching a filesystem.
+    VG993: (match, source, index, spans) => !isInside(spans, index + match.length - 1, 'string'),
+    // A login endpoint is server code. This fired on `<Link href="/login">Back to
+    // sign in</Link>` in a client page, where "verify" and "login" are words in
+    // markup rather than a password comparison behind an HTTP handler.
+    VG148: (match, source) => !/^\s*(['"])use client\1/m.test(source.slice(0, 400)) &&
+        /(bcrypt\.compare|argon2\.verify|\b(compare|verify|verifyPassword)\s*\()/.test(match),
     // SSRF is a *server* being made to fetch a URL it should not. A module marked
     // `'use client'` runs in the browser, where the request leaves the user's own
     // machine and crosses no trust boundary of yours.
@@ -298,6 +312,25 @@ function inapplicable(ctx) {
         ids.add('VG132');
         why.push('VG132 body-size limit (Next.js sets one by default)');
     }
+    // A rule that names a platform cannot apply to a project that does not use
+    // it. "Supabase Auth Missing Middleware" was reported against an app with no
+    // Supabase dependency at all — advice about a library it does not import.
+    for (const [name, present, keyword] of [
+        ['Supabase', ctx.framework.supabase, /supabase/i],
+        ['Firebase', ctx.framework.firebase, /firebase|firestore/i],
+    ]) {
+        if (present)
+            continue;
+        let n = 0;
+        for (const rule of GUARDVIBE_RULES) {
+            if (keyword.test(rule.name) || keyword.test(rule.description)) {
+                ids.add(rule.id);
+                n++;
+            }
+        }
+        if (n > 0)
+            why.push(`${n} ${name} rules (no ${name} dependency)`);
+    }
     return { ids, why };
 }
 /**

package/dist/scanners/logic.js

@@ -4,6 +4,7 @@ import { parseSource, calleeName, calleeTail } from '../utils/ast.js';
 import { traverse } from '../utils/traverse.js';
 import { Suppressions } from '../utils/suppress.js';
 import { emptyResult } from '../types.js';
+import { OWASP_LLM } from '../utils/owasp.js';
 /**
  * Cross-cutting logic checks for OWASP categories a pattern scanner can only
  * touch in specific, high-signal slices:
@@ -181,7 +182,7 @@ export const logicScanner = {
                         line: path.node.loc?.start.line ?? 0,
                         cwe: 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor',
                         owasp: 'A04:2025 - Cryptographic Failures',
-                        meta: { llm: 'LLM07:2025 - System Prompt Leakage', binding: name },
+                        meta: { llm: OWASP_LLM.LLM08, binding: name },
                     });
                 },
                 CallExpression(path) {
@@ -209,7 +210,7 @@ export const logicScanner = {
                                 line: node.loc?.start.line ?? 0,
                                 cwe: 'CWE-770: Allocation of Resources Without Limits or Throttling',
                                 owasp: 'A06:2025 - Insecure Design',
-                                meta: { llm: 'LLM10:2025 - Unbounded Consumption', call: full },
+                                meta: { llm: OWASP_LLM.LLM06, call: full },
                             });
                         }
                     }
@@ -243,7 +244,7 @@ export const logicScanner = {
                                     line: expr.loc?.start.line ?? value.loc?.start.line ?? 0,
                                     cwe: 'CWE-1427: Improper Neutralization of Input Used for LLM Prompting',
                                     owasp: 'A05:2025 - Injection',
-                                    meta: { llm: 'LLM01:2025 - Prompt Injection', source: root },
+                                    meta: { llm: OWASP_LLM.LLM01, source: root },
                                 });
                                 return;
                             }

package/dist/types.d.ts

@@ -54,6 +54,7 @@ export interface FrameworkInfo {
     stripe: boolean;
     python: boolean;
     reactNative: boolean;
+    firebase: boolean;
     /** Human-readable one-liner for the CLI header. */
     describe(): string;
 }

package/dist/utils/detect.js

@@ -56,6 +56,10 @@ export function detectFramework(root, files) {
         python: exists(join(root, 'requirements.txt')) ||
             exists(join(root, 'pyproject.toml')),
         reactNative,
+        firebase: hasDep(pkg, 'firebase') ||
+            hasDep(pkg, 'firebase-admin') ||
+            hasDep(pkg, '@firebase/app') ||
+            exists(join(root, 'firebase.json')),
         describe() {
             const parts = [];
             if (this.nextjs === 'app-router')
@@ -80,6 +84,8 @@ export function detectFramework(root, files) {
                 parts.push('Python');
             if (this.reactNative)
                 parts.push('React Native');
+            if (this.firebase)
+                parts.push('Firebase');
             return parts.length ? parts.join(' + ') : 'generic JavaScript/TypeScript';
         },
     };

package/dist/utils/owasp.d.ts

@@ -31,18 +31,28 @@ export declare const OWASP_2025: {
  * would invent a mapping nobody published.
  */
 export declare function normaliseOwasp(raw: string | undefined): string | null;
-/** OWASP Top 10 for LLM Applications (2025). */
+/**
+ * OWASP Top 10 for LLM Applications, **2026 edition** (published 4 August 2026).
+ *
+ * The renumbering is not cosmetic and it is easy to ship stale: Excessive Agency
+ * moved 06 → 03, Unbounded Consumption 10 → 06, Improper Output Handling 05 →
+ * 10, Misinformation 09 → 07, and System Prompt Leakage was renamed and
+ * broadened into **Hidden Context Exposure** at 08. Only LLM01 and LLM02 kept
+ * their numbers. Eight of ten identifiers change between editions, so anything
+ * that hard-codes them dates fast — which is why the mapping below keys off
+ * category *names*, and only the label carries the number.
+ */
 export declare const OWASP_LLM: {
-    readonly LLM01: 'LLM01:2025 - Prompt Injection';
-    readonly LLM02: 'LLM02:2025 - Sensitive Information Disclosure';
-    readonly LLM03: 'LLM03:2025 - Supply Chain';
-    readonly LLM04: 'LLM04:2025 - Data and Model Poisoning';
-    readonly LLM05: 'LLM05:2025 - Improper Output Handling';
-    readonly LLM06: 'LLM06:2025 - Excessive Agency';
-    readonly LLM07: 'LLM07:2025 - System Prompt Leakage';
-    readonly LLM08: 'LLM08:2025 - Vector and Embedding Weaknesses';
-    readonly LLM09: 'LLM09:2025 - Misinformation';
-    readonly LLM10: 'LLM10:2025 - Unbounded Consumption';
+    readonly LLM01: 'LLM01:2026 - Prompt Injection';
+    readonly LLM02: 'LLM02:2026 - Sensitive Information Disclosure';
+    readonly LLM03: 'LLM03:2026 - Excessive Agency';
+    readonly LLM04: 'LLM04:2026 - Supply Chain';
+    readonly LLM05: 'LLM05:2026 - Data and Model Poisoning';
+    readonly LLM06: 'LLM06:2026 - Unbounded Consumption';
+    readonly LLM07: 'LLM07:2026 - Misinformation';
+    readonly LLM08: 'LLM08:2026 - Hidden Context Exposure';
+    readonly LLM09: 'LLM09:2026 - Vector and Embedding Weaknesses';
+    readonly LLM10: 'LLM10:2026 - Improper Output Handling';
 };
 /** The LLM category a rule's own words place it in, if any. */
 export declare function llmCategory(text: string): string | null;

package/dist/utils/owasp.js

@@ -64,18 +64,28 @@ export function normaliseOwasp(raw) {
     }
     return null;
 }
-/** OWASP Top 10 for LLM Applications (2025). */
+/**
+ * OWASP Top 10 for LLM Applications, **2026 edition** (published 4 August 2026).
+ *
+ * The renumbering is not cosmetic and it is easy to ship stale: Excessive Agency
+ * moved 06 → 03, Unbounded Consumption 10 → 06, Improper Output Handling 05 →
+ * 10, Misinformation 09 → 07, and System Prompt Leakage was renamed and
+ * broadened into **Hidden Context Exposure** at 08. Only LLM01 and LLM02 kept
+ * their numbers. Eight of ten identifiers change between editions, so anything
+ * that hard-codes them dates fast — which is why the mapping below keys off
+ * category *names*, and only the label carries the number.
+ */
 export const OWASP_LLM = {
-    LLM01: 'LLM01:2025 - Prompt Injection',
-    LLM02: 'LLM02:2025 - Sensitive Information Disclosure',
-    LLM03: 'LLM03:2025 - Supply Chain',
-    LLM04: 'LLM04:2025 - Data and Model Poisoning',
-    LLM05: 'LLM05:2025 - Improper Output Handling',
-    LLM06: 'LLM06:2025 - Excessive Agency',
-    LLM07: 'LLM07:2025 - System Prompt Leakage',
-    LLM08: 'LLM08:2025 - Vector and Embedding Weaknesses',
-    LLM09: 'LLM09:2025 - Misinformation',
-    LLM10: 'LLM10:2025 - Unbounded Consumption',
+    LLM01: 'LLM01:2026 - Prompt Injection',
+    LLM02: 'LLM02:2026 - Sensitive Information Disclosure',
+    LLM03: 'LLM03:2026 - Excessive Agency',
+    LLM04: 'LLM04:2026 - Supply Chain',
+    LLM05: 'LLM05:2026 - Data and Model Poisoning',
+    LLM06: 'LLM06:2026 - Unbounded Consumption',
+    LLM07: 'LLM07:2026 - Misinformation',
+    LLM08: 'LLM08:2026 - Hidden Context Exposure',
+    LLM09: 'LLM09:2026 - Vector and Embedding Weaknesses',
+    LLM10: 'LLM10:2026 - Improper Output Handling',
 };
 /**
  * A second, independent label for the findings that are about an LLM or agent
@@ -89,13 +99,19 @@ const LLM_RULES = [
     // handling the output, even though its description discusses injection.
     [
         /(llm|ai|model) output[^.]{0,60}(unescaped|innerhtml|dangerouslysetinnerhtml|render|eval|exec|sink|shell|command|markdown)|(unescaped|unsanitised|unsanitized)[^.]{0,30}(llm|ai|model) output/i,
-        OWASP_LLM.LLM05,
+        OWASP_LLM.LLM10,
     ],
     [
         /prompt injection|injected instruction|hidden instruction|jailbreak|(tool|skill) (description|definition)[^.]{0,40}(instruction|encoded|obfuscat|inject)|untrusted content into (the )?prompt/i,
         OWASP_LLM.LLM01,
     ],
-    [/system prompt[^.]{0,40}(leak|expos|client|bundle|browser)/i, OWASP_LLM.LLM07],
+    // 2026 broadened "System Prompt Leakage" into Hidden Context Exposure: the
+    // guidance is that nothing in the context window is a secret, so retrieved
+    // context and tool output belong here alongside the system prompt.
+    [
+        /(system prompt|hidden context|context window)[^.]{0,40}(leak|expos|client|bundle|browser|discoverab)/i,
+        OWASP_LLM.LLM08,
+    ],
     [
         // A hardcoded provider key is disclosure wherever it sits, so no exposure
         // word is required after a *named* provider. The generic "llm"/"ai" wording
@@ -103,23 +119,23 @@ const LLM_RULES = [
         /(openai|anthropic|gemini|claude|mistral|cohere|huggingface|replicate|groq|perplexity|xai|pinecone)[^.]{0,40}(api[ _-]?key|token|secret)|(llm|\bai\b)[^.]{0,40}(api[ _-]?key|token|secret)[^.]{0,40}(expos|public|client|browser|bundle)|base_?url[^.]{0,40}(non-|redirect)|dangerouslyallowbrowser/i,
         OWASP_LLM.LLM02,
     ],
-    [/(mcp|model|agent)[^.]{0,40}(@latest|unpinned|unverified|untrusted (source|registry))/i, OWASP_LLM.LLM03],
+    [/(mcp|model|agent)[^.]{0,40}(@latest|unpinned|unverified|untrusted (source|registry))/i, OWASP_LLM.LLM04],
     [
         // "Hook" is overloaded: an npm `postinstall` hook that shells out is a
         // supply-chain finding, not an agent given too much authority. The AI
         // context has to be in the text.
         /auto[- ]?approve|allowedtools|excessive agency|(mcp|agent|assistant|settings|claude|ai)[- ]?(config|hook|tool)[^.]{0,60}(execut|pipes|network|write|permissive|broad|access)|permission prompt[^.]{0,40}(bypass|skip)|overly (broad|permissive)[^.]{0,30}tool/i,
-        OWASP_LLM.LLM06,
+        OWASP_LLM.LLM03,
     ],
     // "Embedding media" is not a vector embedding — matching the bare word put a
     // TinyMCE XSS rule in this category.
     [
         /vector (store|database|db|index|search)\b|\bembeddings\b|embedding (vector|model|store)|\brag\b[^.]{0,30}(poison|inject)/i,
-        OWASP_LLM.LLM08,
+        OWASP_LLM.LLM09,
     ],
     [
         /(llm|ai|model|token)[^.]{0,40}(unbounded|no (rate|token) limit|runaway|budget)|unbounded consumption/i,
-        OWASP_LLM.LLM10,
+        OWASP_LLM.LLM06,
     ],
 ];
 /** The LLM category a rule's own words place it in, if any. */

package/examples/security.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: murtazaozdemir/cleartoship@v0.12.0
+      - uses: murtazaozdemir/cleartoship@v0.12.2
         with:
           fail-on: critical   # block the PR only on criticals
           comment: true        # post a summary comment on the PR

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cleartoship",
-  "version": "0.12.0",
+  "version": "0.12.2",
   "description": "The 30-second pre-launch security clearance for AI-built & vibe-coded apps. Catches missing Server Action auth, Supabase RLS holes, hallucinated npm packages and leaked keys.",
   "keywords": [
     "security",