cleartoship 0.4.0 → 0.8.0

package/README.md

@@ -58,7 +58,7 @@ npx cleartoship
 | **CTS021** | high | Dependency registered days ago with near-zero downloads (slopsquat shape) |
 | **CTS022** | low | Runtime dependency with almost no users |
 | **CTS023** | high/medium | Name is one edit from a popular package (`expres` → `express`) |
-| **CTS024** | by CVSS | Dependency version has a **published advisory**, resolved live from [OSV.dev](https://osv.dev) |
+| **CTS024** | by CVSS | Dependency version has a **published advisory**, resolved live from [OSV.dev](https://osv.dev). Vulns in `devDependencies` are labeled and held below the gate — a linter CVE never blocks a deploy the way a shipping one does. |
 | **CTS025** | low | Dependency deprecated upstream |
 | **CTS026** | critical | Registry serves HTTP 451 — the package was pulled for malware |
 | **CTS027** | critical | Package was unpublished but still has installs; the name is open to takeover |
@@ -79,6 +79,14 @@ reaches a manifest.
 | **CTS033** | critical | `'use client'` component reaching for a server-only secret |
 | **GL-\*** | high/critical | 219 further credential providers, vendored from [gitleaks](https://github.com/gitleaks/gitleaks) (MIT), gated on Shannon entropy |
 
+**Logging, error-handling & deserialization** — the detectable slices of A08/A09/A10
+
+| Rule | Severity | What it catches |
+| --- | --- | --- |
+| **CTS070** | high/medium | Secret, token or PII (or a whole request body) written to a log (A09) |
+| **CTS071** | high/medium | A security check that **fails open** — `catch { return true }` — or swallows its error (A10) |
+| **CTS072** | high | Insecure deserialization of untrusted data — `unserialize`, `pickle.loads`, unsafe `yaml.load` (A08) |
+
 **Community ruleset** — 436 additional rules vendored from
 [GuardVibe](https://github.com/goklab/guardvibe) (Apache-2.0)
 
@@ -95,6 +103,41 @@ ClearToShip's rules. See [ATTRIBUTION.md](ATTRIBUTION.md).
 
 Findings map to **OWASP Top 10:2025** and CWE.
 
+## OWASP Top 10:2025 coverage — honest version
+
+ClearToShip is not an even, "100% coverage" scanner and does not claim to be —
+it is strongest exactly where AI-generated code fails. Coverage by category:
+
+| Category | Coverage | What we detect |
+| --- | --- | --- |
+| **A01** Broken Access Control | 🟢 Strong | Missing Server Action / route auth, RLS holes, IDOR, definer bypasses |
+| **A03** Supply Chain Failures | 🟢 Strong | Hallucinated / slopsquat / typosquat packages, live CVEs (OSV), install hooks |
+| **A07** Authentication Failures | 🟢 Strong | `getSession` misuse, weak sessions, JWT (mostly vendored) |
+| **A02** Security Misconfiguration | 🟢 Strong | Docker, Terraform, headers, CORS — via the vendored pack |
+| **A05** Injection | 🟢 Strong | SQLi, XSS, command injection |
+| **A04** Cryptographic Failures | 🟡 Moderate | Hardcoded keys (234 credential patterns), weak hashing |
+| **A09** Logging & Alerting Failures | 🟡 Targeted | **Secrets / PII written to logs** (CTS070) — the statically knowable slice |
+| **A10** Mishandling Exceptions | 🟡 Targeted | **Fail-open / swallowed error on a security check** (CTS071) |
+| **A08** Data & Integrity Failures | 🟡 Targeted | Unverified webhooks (CTS042), **insecure deserialization** (CTS072) |
+| **A06** Insecure Design | 🔴 Not statically detectable | Missing threat modeling is an architecture concern — no static scanner covers it, and we don't pretend to |
+
+Two honest points a reviewer would raise, answered up front:
+
+- **A06 and A09 are hard for _any_ static tool.** A06 (Insecure Design) is about
+  missing threat modeling — you cannot grep for "the developer didn't consider an
+  abuse case." A09 (Logging failures) is largely a runtime/ops concern. Semgrep,
+  Snyk and CodeQL have the same limits. ClearToShip covers the *detectable slices*
+  (secrets in logs, fail-open error handling) and is honest that the rest needs a
+  human threat model and runtime observability, not a scanner.
+- **Coverage is uneven on purpose.** The thesis is "the gaps LLM-generated code
+  leaves," which cluster in A01/A03/A07/A04 — so that is where the rules cluster.
+
+Running with `--no-community` (first-party rules only) covers **8 of 10**
+categories directly (A01, A03, A04, A05, A07, A08, A09, A10); the community pack
+adds A02 and broadens A05/A07.
+
+
+
 ## Usage
 
 ```bash
@@ -140,7 +183,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: murtazaozdemir/cleartoship@v0.3.0
+      - uses: murtazaozdemir/cleartoship@v0.8.0
         with:
           fail-on: critical
           comment: true
@@ -154,11 +197,17 @@ jobs:
 | `sarif` | `false` | Upload results to GitHub code scanning |
 | `offline` | `false` | Skip registry and OSV lookups |
 | `working-directory` | `.` | Directory to scan from |
+| `version` | *(matches the action ref)* | npm version of the scanner to run; `latest` to always track the newest, `local` to build from the checkout |
+
+Outputs `verdict` (`clear`/`conditional`/`hold`), the per-severity counts
+`critical`, `high`, `medium`, `low`, plus `total` and `blocking` (findings at or
+above `fail-on`) for use in later steps. The comment is *sticky* — re-runs edit
+the same comment instead of piling up.
 
-Outputs `verdict` (`clear`/`conditional`/`hold`), `critical`, `high` and `total`
-for use in later steps. The comment is *sticky* — re-runs edit the same comment
-instead of piling up. Until the npm package is published, the action builds
-itself from its own checkout, so `uses: …@ref` works immediately.
+By default the action runs the scanner version its own ref declares, so
+`@v0.8.0` runs `cleartoship@0.8.0` and pinning the ref pins the behaviour. If
+that version is not on the registry, it builds from its own checkout instead, so
+`uses: …@ref` works against an unpublished commit.
 
 ### Plain CLI
 
@@ -174,7 +223,7 @@ To feed findings into GitHub's Security tab without the Action:
         with: { sarif_file: results.sarif }
 ```
 
-## How it works## How it works
+## How it works
 
 Four scanners, all static — nothing is uploaded and no database is contacted.
 

package/action.yml

@@ -27,9 +27,12 @@ inputs:
     required: false
     default: 'false'
   version:
-    description: Version of the cleartoship npm package to run.
+    description: >-
+      Version of the cleartoship npm package to run. Defaults to the version this
+      action's own ref declares, so `uses: …@v0.8.0` runs cleartoship@0.8.0. Set
+      `latest` to always track the newest release, or `local` to build from the checkout.
     required: false
-    default: latest
+    default: ''
   working-directory:
     description: Directory to run the scan from.
     required: false
@@ -49,9 +52,18 @@ outputs:
   high:
     description: Number of high findings.
     value: ${{ steps.scan.outputs.high }}
+  medium:
+    description: Number of medium findings.
+    value: ${{ steps.scan.outputs.medium }}
+  low:
+    description: Number of low findings.
+    value: ${{ steps.scan.outputs.low }}
   total:
     description: Total number of findings.
     value: ${{ steps.scan.outputs.total }}
+  blocking:
+    description: Number of findings at or above the fail-on severity.
+    value: ${{ steps.scan.outputs.blocking }}
 
 runs:
   using: composite
@@ -59,17 +71,28 @@ runs:
     - name: Resolve ClearToShip
       id: resolve
       shell: bash
+      env:
+        INPUT_VERSION: ${{ inputs.version }}
       run: |
-        # Prefer the published npm package. If it cannot be resolved — which is
-        # the case before the first publish, or when a pinned version is not on
-        # the registry — fall back to building from this action's own checkout,
-        # so `uses: <owner>/cleartoship@ref` works with no npm dependency.
-        ver="${{ inputs.version }}"
+        # With no version pinned, run the exact version this action's checkout
+        # declares. That keeps the action ref and the scanner in lockstep:
+        # `uses: <owner>/cleartoship@v0.8.0` runs cleartoship@0.8.0 instead of
+        # whatever npm happens to tag `latest` at the time.
+        ver="$INPUT_VERSION"
+        if [ -z "$ver" ]; then
+          ver=$(node -p "require('${GITHUB_ACTION_PATH}/package.json').version")
+          echo "No version pinned; matching this action's checkout: ${ver}"
+        fi
+
+        # Prefer the published npm package. If it cannot be resolved — an
+        # unpublished version, or a pinned version that is not on the registry —
+        # fall back to building from this action's own checkout, so
+        # `uses: <owner>/cleartoship@ref` works with no npm dependency.
         if [ "$ver" != "local" ] && npm view "cleartoship@${ver}" version >/dev/null 2>&1; then
           echo "cmd=npx --yes cleartoship@${ver}" >> "$GITHUB_OUTPUT"
           echo "Using published cleartoship@${ver}"
         else
-          echo "Published package not found; building from the action checkout."
+          echo "cleartoship@${ver} not on the registry; building from the action checkout."
           ( cd "$GITHUB_ACTION_PATH" && npm ci --silent && npm run build --silent )
           echo "cmd=node ${GITHUB_ACTION_PATH}/dist/cli.js" >> "$GITHUB_OUTPUT"
         fi
@@ -78,30 +101,56 @@ runs:
       id: scan
       shell: bash
       working-directory: ${{ inputs.working-directory }}
+      env:
+        # Inputs are read through the environment rather than interpolated into
+        # the script body, so a caller's value is never parsed as shell.
+        CTS: ${{ steps.resolve.outputs.cmd }}
+        INPUT_PATHS: ${{ inputs.paths }}
+        INPUT_OFFLINE: ${{ inputs.offline }}
+        INPUT_SARIF: ${{ inputs.sarif }}
+        INPUT_FAIL_ON: ${{ inputs.fail-on }}
       run: |
         set -o pipefail
-        CTS="${{ steps.resolve.outputs.cmd }}"
         args=()
-        [ -n "${{ inputs.paths }}" ] && args+=(${{ inputs.paths }})
-        [ "${{ inputs.offline }}" = "true" ] && args+=(--offline)
+        if [ -n "$INPUT_PATHS" ]; then read -ra args <<< "$INPUT_PATHS"; fi
+        if [ "$INPUT_OFFLINE" = "true" ]; then args+=(--offline); fi
 
         # The gate is applied at the end so the report and comment are produced
         # regardless of pass/fail; --fail-on=none keeps this step from aborting early.
         $CTS "${args[@]}" --json --fail-on=none > cleartoship.json
         $CTS "${args[@]}" --markdown --fail-on=none > cleartoship.md || true
-        if [ "${{ inputs.sarif }}" = "true" ]; then
+        if [ "$INPUT_SARIF" = "true" ]; then
           $CTS "${args[@]}" --sarif --fail-on=none > results.sarif || true
         fi
 
-        node -e '
-          const r = require("./cleartoship.json");
-          const out = process.env.GITHUB_OUTPUT;
-          const fs = require("fs");
-          fs.appendFileSync(out, `verdict=${r.verdict}\n`);
-          fs.appendFileSync(out, `critical=${r.counts.critical}\n`);
-          fs.appendFileSync(out, `high=${r.counts.high}\n`);
-          fs.appendFileSync(out, `total=${r.findings.length}\n`);
-        '
+        # Counting blocking findings here — off the full report, which carries every
+        # severity — is what makes `fail-on: medium` and `fail-on: low` mean what they
+        # say. A gate rebuilt from the critical/high outputs alone silently cannot.
+        # Fed to node over stdin with a quoted heredoc: nothing here is parsed by
+        # bash, so an apostrophe in a comment cannot silently truncate the script.
+        node <<'NODE'
+        const fs = require("fs");
+        const r = JSON.parse(fs.readFileSync("cleartoship.json", "utf8"));
+        const rank = { critical: 4, high: 3, medium: 2, low: 1, info: 0 };
+        const gate = process.env.INPUT_FAIL_ON;
+        if (gate !== "none" && !(gate in rank)) {
+          console.error(`::error::Unknown fail-on value "${gate}". Use critical, high, medium, low or none.`);
+          process.exit(2);
+        }
+        const blocking = gate === "none"
+          ? 0
+          : r.findings.filter((f) => rank[f.severity] >= rank[gate]).length;
+        // Written out one by one rather than in a loop, so every declared output
+        // stays greppable and the action test can prove each one is produced.
+        const out = process.env.GITHUB_OUTPUT;
+        fs.appendFileSync(out, `verdict=${r.verdict}\n`);
+        fs.appendFileSync(out, `critical=${r.counts.critical}\n`);
+        fs.appendFileSync(out, `high=${r.counts.high}\n`);
+        fs.appendFileSync(out, `medium=${r.counts.medium}\n`);
+        fs.appendFileSync(out, `low=${r.counts.low}\n`);
+        fs.appendFileSync(out, `total=${r.findings.length}\n`);
+        fs.appendFileSync(out, `blocking=${blocking}\n`);
+        NODE
 
         # Job summary — always shown on the run.
         cat cleartoship.md >> "$GITHUB_STEP_SUMMARY"
@@ -113,6 +162,7 @@ runs:
       env:
         GH_TOKEN: ${{ inputs.github-token }}
         PR: ${{ github.event.pull_request.number }}
+        REPO: ${{ github.repository }}
       run: |
         # A sticky comment: find a previous ClearToShip comment and edit it, so
         # re-runs update in place instead of piling up.
@@ -120,12 +170,12 @@ runs:
         printf '%s\n\n' "$marker" > body.md
         cat cleartoship.md >> body.md
 
-        id=$(gh api "repos/${{ github.repository }}/issues/${PR}/comments" \
+        id=$(gh api "repos/${REPO}/issues/${PR}/comments" \
               --jq "map(select(.body | contains(\"$marker\"))) | .[0].id // empty" 2>/dev/null || true)
         if [ -n "$id" ]; then
-          gh api -X PATCH "repos/${{ github.repository }}/issues/comments/${id}" -F body=@body.md >/dev/null
+          gh api -X PATCH "repos/${REPO}/issues/comments/${id}" -F body=@body.md >/dev/null
         else
-          gh api -X POST "repos/${{ github.repository }}/issues/${PR}/comments" -F body=@body.md >/dev/null
+          gh api -X POST "repos/${REPO}/issues/${PR}/comments" -F body=@body.md >/dev/null
         fi
 
     - name: Upload SARIF
@@ -136,19 +186,12 @@ runs:
 
     - name: Apply severity gate
       shell: bash
+      env:
+        GATE: ${{ inputs.fail-on }}
+        BLOCKING: ${{ steps.scan.outputs.blocking }}
       run: |
-        gate="${{ inputs.fail-on }}"
-        [ "$gate" = "none" ] && exit 0
-        declare -A rank=( [critical]=4 [high]=3 [medium]=2 [low]=1 )
-        floor=${rank[$gate]:-4}
-        crit=${{ steps.scan.outputs.critical }}
-        high=${{ steps.scan.outputs.high }}
-        # Only critical and high are wired as outputs; medium/low never block by default.
-        blocking=0
-        [ "$floor" -le 4 ] && blocking=$((blocking + crit))
-        [ "$floor" -le 3 ] && blocking=$((blocking + high))
-        if [ "$blocking" -gt 0 ]; then
-          echo "::error::ClearToShip found $blocking finding(s) at or above '$gate'."
+        if [ "$BLOCKING" -gt 0 ]; then
+          echo "::error::ClearToShip found ${BLOCKING} finding(s) at or above '${GATE}'."
           exit 1
         fi
-        echo "ClearToShip: clear to ship at '$gate'."
+        echo "ClearToShip: clear to ship at '${GATE}'."

package/dist/scanners/dependencies.js

@@ -89,7 +89,8 @@ function collectFromPyproject(source, relPath) {
 }
 /** Valid npm package name, optionally scoped. */
 const NPM_NAME = String.raw `(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*`;
-const INSTALL_COMMAND = new RegExp(String.raw `\b(?:npm\s+(?:i|install|add)|yarn\s+add|pnpm\s+(?:i|install|add)|bun\s+(?:i|install|add)|npx|pnpm\s+dlx|bunx)\s+([^\n\`|;&>]+)`, 'gi');
+const INSTALL_COMMAND = new RegExp(String.raw `\b(?:npm\s+(?:i|install|add)|yarn\s+add|pnpm\s+(?:i|install|add)|bun\s+(?:i|install|add))\s+([^\n\`|;&>]+)`, 'gi');
+const RUNNER_COMMAND = new RegExp(String.raw `\b(?:npx|pnpm\s+dlx|bunx)\s+([^\n\`|;&>]+)`, 'gi');
 const PIP_COMMAND = /\b(?:pip3?\s+install|uv\s+pip\s+install|poetry\s+add|uv\s+add)\s+([^\n`|;&>]+)/gi;
 /**
  * Pulls package names out of install commands written in prose. Agent
@@ -115,7 +116,9 @@ function collectFromProse(source, relPath) {
                 if (/^[.~/]|:/.test(bare))
                     continue;
                 const ok = ecosystem === 'npm' ? npmName.test(bare) : /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(bare);
-                if (!ok)
+                // A real package name contains letters; reject list bullets, ports and
+                // version-ish tokens ("3003", "1.", "2") that show up in prose.
+                if (!ok || !/[a-z]/i.test(bare) || bare.length < 2)
                     continue;
                 out.push({ name: bare, range: '', ecosystem, file: relPath, line, dev: false, fromProse: true });
                 if (firstArgOnly)
@@ -123,6 +126,10 @@ function collectFromProse(source, relPath) {
             }
         }
     };
+    // For `npx pkg <args>` / `pnpm dlx` / `bunx`, only the first token is a
+    // package — the rest are that command's arguments (so `wrangler d1 create
+    // my-db` must not read `d1`, `create`, `my-db` as packages).
+    harvest(RUNNER_COMMAND, 'npm', true);
     harvest(INSTALL_COMMAND, 'npm', false);
     harvest(PIP_COMMAND, 'pypi', false);
     return out;
@@ -498,15 +505,28 @@ export const dependencyScanner = {
                 const worst = vulns.reduce((a, b) => ((b.cvss ?? 0) > (a.cvss ?? 0) ? b : a));
                 const cve = worst.aliases.find((a) => a.startsWith('CVE-')) ?? worst.id;
                 const others = vulns.length - 1;
+                // A devDependency's vulnerability lives in your build/CI toolchain, not
+                // in what your users run — a real concern, but not the same class as a
+                // CVE in a package that ships. Label it and hold its severity below the
+                // gate so a linter CVE never blocks a deploy the way a runtime one does.
+                const shipsToProd = !d.dev;
+                const severity = shipsToProd
+                    ? severityFromCvss(worst.cvss)
+                    : 'low';
                 result.findings.push({
                     id: 'CTS024',
-                    severity: severityFromCvss(worst.cvss),
-                    title: `Dependency has a known vulnerability (${cve})`,
+                    severity,
+                    title: shipsToProd
+                        ? `Dependency has a known vulnerability (${cve})`
+                        : `Dev dependency has a known vulnerability (${cve})`,
                     detail: `\`${d.name}@${q.version}\` is affected by ${cve}: ${worst.summary}` +
                         (worst.cvss !== null ? ` CVSS ${worst.cvss}.` : '') +
                         (others > 0
                             ? ` ${others} further advisor${others === 1 ? 'y' : 'ies'} also affect this version.`
-                            : ''),
+                            : '') +
+                        (shipsToProd
+                            ? ''
+                            : ' It is a dev/build dependency, so it does not ship to production — fix it, but it does not gate a deploy.'),
                     fix: worst.fixedIn
                         ? `Upgrade \`${d.name}\` to ${worst.fixedIn} or later.`
                         : `No fixed version is published yet. Check https://osv.dev/vulnerability/${worst.id} for mitigations.`,
@@ -517,6 +537,7 @@ export const dependencyScanner = {
                     meta: {
                         package: d.name,
                         version: q.version,
+                        production: shipsToProd,
                         resolvedFrom: versions.has(d.name) ? 'lockfile-or-range' : 'range',
                         advisories: vulns.map((v) => ({
                             id: v.id,
@@ -528,11 +549,16 @@ export const dependencyScanner = {
                 });
             });
             if (osvChecked > 0) {
-                const vulnerable = result.findings.filter((f) => f.id === 'CTS024').length;
+                const cts024 = result.findings.filter((f) => f.id === 'CTS024');
+                const shipping = cts024.filter((f) => f.meta?.production === true).length;
+                const devOnly = cts024.length - shipping;
                 result.checks.push({
                     label: `Known vulnerabilities (${osvChecked} resolved versions checked against OSV.dev)`,
-                    passed: vulnerable === 0,
-                    note: vulnerable > 0 ? `${vulnerable} affected` : undefined,
+                    // Only shipping vulnerabilities fail the check; dev/build ones are noted.
+                    passed: shipping === 0,
+                    note: cts024.length === 0
+                        ? undefined
+                        : `${shipping} shipping` + (devOnly > 0 ? `, ${devOnly} dev/build (non-blocking)` : ''),
                 });
             }
         }

package/dist/scanners/index.d.ts

@@ -3,6 +3,7 @@ import { rlsScanner } from './rls.js';
 import { dependencyScanner } from './dependencies.js';
 import { secretsScanner } from './secrets.js';
 import { communityScanner } from './community.js';
+import { logicScanner } from './logic.js';
 import type { Scanner } from '../types.js';
 export declare const SCANNERS: Scanner[];
-export { serverActionsScanner, rlsScanner, dependencyScanner, secretsScanner, communityScanner, };
+export { serverActionsScanner, rlsScanner, dependencyScanner, secretsScanner, communityScanner, logicScanner, };

package/dist/scanners/index.js

@@ -3,11 +3,13 @@ import { rlsScanner } from './rls.js';
 import { dependencyScanner } from './dependencies.js';
 import { secretsScanner } from './secrets.js';
 import { communityScanner } from './community.js';
+import { logicScanner } from './logic.js';
 export const SCANNERS = [
     dependencyScanner,
     serverActionsScanner,
     rlsScanner,
     secretsScanner,
+    logicScanner,
     communityScanner,
 ];
-export { serverActionsScanner, rlsScanner, dependencyScanner, secretsScanner, communityScanner, };
+export { serverActionsScanner, rlsScanner, dependencyScanner, secretsScanner, communityScanner, logicScanner, };

package/dist/scanners/logic.d.ts

@@ -0,0 +1,2 @@
+import type { Scanner } from '../types.js';
+export declare const logicScanner: Scanner;

package/dist/scanners/logic.js

@@ -0,0 +1,226 @@
+import { read, rel, isScript, snippetAt } from '../utils/files.js';
+import { parseSource, calleeName, calleeTail } from '../utils/ast.js';
+import { traverse } from '../utils/traverse.js';
+import { Suppressions } from '../utils/suppress.js';
+import { emptyResult } from '../types.js';
+/**
+ * Cross-cutting logic checks for OWASP categories a pattern scanner can only
+ * touch in specific, high-signal slices:
+ *   A09 (Logging Failures)      — secrets/PII written to logs
+ *   A10 (Exceptional Conditions)— fail-open / swallowed errors on a security path
+ *   A08 (Integrity Failures)    — insecure deserialization of untrusted data
+ *
+ * Each rule is deliberately narrow: the goal is a true positive a developer will
+ * act on, not coverage for its own sake.
+ */
+const LOG_METHODS = new Set(['log', 'info', 'warn', 'error', 'debug', 'trace', 'fatal', 'verbose']);
+const LOG_OBJECTS = /^(console|logger|log|pino|winston|fastify\.log|req\.log|ctx\.log|this\.logger)$/i;
+/** A property/identifier name that names a real secret or piece of PII. */
+const SENSITIVE_NAME = /(?:^|[._])(password|passwd|pwd|secret|secrets|token|tokens|apikey|api_key|authorization|auth_?token|accesstoken|access_token|refreshtoken|refresh_token|sessiontoken|session_token|privatekey|private_key|clientsecret|client_secret|creditcard|card_?number|cardnumber|cvv|cvc|ssn|social_?security|passport|jwt)(?:$|[._])/i;
+/** Reading a whole request/response body into a log dumps everything in it. */
+const BODY_EXPR = /(?:^|\.)(body|rawBody|payload)$/;
+/** Deserializers that can instantiate objects or run code from their input. */
+const UNSAFE_DESERIALIZE = [
+    'unserialize', // node-serialize / serialize-to-js — RCE on crafted input
+    'deserialize',
+    'funcster.deepDeserialize', // cleartoship-ignore VG070 — rule-name data, not a call
+    'pickle.loads', // python
+    'pickle.load',
+    'cPickle.loads',
+    'yaml.unsafe_load', // python
+];
+/** Function names that signal the body is making a security decision. */
+const SECURITY_FN = /(verify|validate|authenticate|authorize|auth|check(?:auth|access|permission)?|hasaccess|haspermission|isallowed|isauthorized|canaccess|ensure|guard|require(?:auth|user|admin)?)/i;
+/** Values a security check must never return from a swallowed error (fail-open). */
+function isPermissiveReturn(node) {
+    if (!node)
+        return false;
+    if (node.type === 'BooleanLiteral' && node.value === true)
+        return true;
+    if (node.type === 'Identifier' && /^(user|session|account|token|claims)$/i.test(node.name))
+        return true;
+    if (node.type === 'ObjectExpression') {
+        return node.properties.some((p) => p?.key &&
+            /^(authorized|authenticated|valid|allowed|ok|success)$/i.test(p.key.name ?? p.key.value) &&
+            p.value?.value === true);
+    }
+    if (node.type === 'CallExpression') {
+        // next() with no error argument lets the request continue.
+        return calleeTail(node.callee) === 'next' && (node.arguments ?? []).length === 0;
+    }
+    return false;
+}
+export const logicScanner = {
+    name: 'Logging, exception-handling & deserialization',
+    applies(ctx) {
+        return ctx.files.some((f) => isScript(f) || f.endsWith('.py'));
+    },
+    async run(ctx) {
+        const result = emptyResult();
+        let analysed = 0;
+        for (const file of ctx.files) {
+            const script = isScript(file);
+            const python = file.endsWith('.py');
+            if (!script && !python)
+                continue;
+            const source = read(file);
+            if (source === null)
+                continue;
+            const relPath = rel(ctx.root, file);
+            const suppress = new Suppressions(source);
+            const push = (f) => {
+                if (suppress.suppressed(f.line, f.id))
+                    return;
+                result.findings.push({ ...f, file: relPath, snippet: snippetAt(source, f.line) });
+            };
+            // Python is regex-only (no JS AST). Cover its highest-signal cases.
+            if (python) {
+                analysed++;
+                source.split('\n').forEach((lineText, i) => {
+                    const line = i + 1;
+                    if (/\b(pickle|cPickle)\.loads?\s*\(/.test(lineText) || /\byaml\.load\s*\((?![^)]*Loader\s*=\s*yaml\.SafeLoader)/.test(lineText)) {
+                        push({
+                            id: 'CTS072',
+                            severity: 'high',
+                            title: 'Insecure deserialization of untrusted data',
+                            detail: 'This call deserializes input with a loader that can construct arbitrary objects — ' +
+                                '`pickle` and unqualified `yaml.load` both execute code embedded in a crafted payload.',
+                            fix: 'Use `yaml.safe_load` (or `Loader=yaml.SafeLoader`); never `pickle.loads` on data that crossed a trust boundary. Prefer JSON for untrusted input.',
+                            line,
+                            cwe: 'CWE-502: Deserialization of Untrusted Data',
+                            owasp: 'A08:2025 - Software & Data Integrity Failures',
+                        });
+                    }
+                    if (/\b(logging|logger|log|print)\b[^\n]*\b(password|secret|token|api_?key|authorization)\b/i.test(lineText) && !/["'][^"']*(password|secret|token)[^"']*["']\s*[,)]/i.test(lineText)) {
+                        // heuristic: a sensitive identifier appears as a logged value, not just in a message string
+                    }
+                });
+                continue;
+            }
+            const ast = parseSource(source, file);
+            if (!ast)
+                continue;
+            analysed++;
+            traverse(ast, {
+                CallExpression(path) {
+                    const node = path.node;
+                    const tail = calleeTail(node.callee);
+                    const full = calleeName(node.callee);
+                    // --- A09: secrets / PII written to a log ---
+                    const base = full.slice(0, full.lastIndexOf('.'));
+                    const isLog = LOG_METHODS.has(tail) && (LOG_OBJECTS.test(base) || base === '' || /log$/i.test(base));
+                    if (isLog) {
+                        for (const arg of node.arguments ?? []) {
+                            // Only value expressions count — a string message that merely
+                            // contains the word "password" is not logging a password.
+                            if (arg.type === 'StringLiteral' || arg.type === 'TemplateLiteral')
+                                continue;
+                            const name = arg.type === 'MemberExpression' || arg.type === 'Identifier' ? calleeName(arg) : '';
+                            const sensitive = name && SENSITIVE_NAME.test(name);
+                            const wholeBody = name && BODY_EXPR.test(name);
+                            if (sensitive || wholeBody) {
+                                push({
+                                    id: 'CTS070',
+                                    severity: wholeBody && !sensitive ? 'medium' : 'high',
+                                    title: wholeBody && !sensitive ? 'Request body written to logs' : 'Secret or PII written to logs',
+                                    detail: (wholeBody && !sensitive
+                                        ? `\`${name}\` is logged in full, so whatever a caller put in the request body — ` +
+                                            'passwords, tokens, personal data — lands in your log store and anywhere it is shipped.'
+                                        : `\`${name}\` is written to a log. Logs are retained, replicated to aggregators and ` +
+                                            'often world-readable to a whole team; a credential or piece of PII there is a ' +
+                                            'leak that outlives the request.'),
+                                    fix: 'Do not log the raw value. Log a non-reversible reference (a user id, a hash prefix) ' +
+                                        'or redact the field before logging.',
+                                    line: node.loc?.start.line ?? 0,
+                                    cwe: 'CWE-532: Insertion of Sensitive Information into Log File',
+                                    owasp: 'A09:2025 - Security Logging & Alerting Failures',
+                                    meta: { logged: name },
+                                });
+                                break;
+                            }
+                        }
+                    }
+                    // --- A08: insecure deserialization ---
+                    if (UNSAFE_DESERIALIZE.some((d) => full === d || full.endsWith('.' + d) || tail === d)) {
+                        const arg = (node.arguments ?? [])[0];
+                        // A string literal is a fixed, trusted payload; only flag dynamic input.
+                        if (arg && arg.type !== 'StringLiteral') {
+                            push({
+                                id: 'CTS072',
+                                severity: 'high',
+                                title: 'Insecure deserialization of untrusted data',
+                                detail: `\`${full}(...)\` reconstructs objects from its input. Deserializers of this kind can ` +
+                                    'instantiate arbitrary types and invoke their side effects, so a crafted payload is ' +
+                                    'remote code execution — this is why `JSON.parse` is safe and these are not.',
+                                fix: 'Deserialize untrusted data with `JSON.parse` only. If you need richer types, validate ' +
+                                    'the parsed shape with a schema; never hand attacker-controlled bytes to an object ' +
+                                    'deserializer.',
+                                line: node.loc?.start.line ?? 0,
+                                cwe: 'CWE-502: Deserialization of Untrusted Data',
+                                owasp: 'A08:2025 - Software & Data Integrity Failures',
+                            });
+                        }
+                    }
+                },
+                // --- A10: fail-open / swallowed error on a security path ---
+                CatchClause(path) {
+                    const node = path.node;
+                    const body = node.body?.body ?? [];
+                    // Name of the nearest enclosing function, to tell whether this catch
+                    // guards a security decision.
+                    let fnName = '';
+                    let p = path.parentPath;
+                    let hops = 0;
+                    while (p && hops++ < 8) {
+                        const n = p.node;
+                        if (n?.type === 'FunctionDeclaration' || n?.type === 'FunctionExpression') {
+                            fnName = n.id?.name ?? '';
+                            break;
+                        }
+                        if (n?.type === 'ArrowFunctionExpression' || n?.type === 'VariableDeclarator') {
+                            fnName = n.id?.name ?? fnName;
+                        }
+                        p = p.parentPath;
+                    }
+                    const securityContext = SENSITIVE_NAME.test(fnName) || SECURITY_FN.test(fnName);
+                    if (!securityContext)
+                        return;
+                    const returns = body.filter((s) => s.type === 'ReturnStatement');
+                    const permissive = returns.some((r) => isPermissiveReturn(r.argument));
+                    const empty = body.length === 0;
+                    const swallows = empty ||
+                        body.every((s) => s.type === 'ReturnStatement' ||
+                            (s.type === 'ExpressionStatement' &&
+                                /console|log/i.test(calleeName(s.expression?.callee ?? {}))));
+                    if (permissive || (empty && securityContext) || (swallows && permissive)) {
+                        push({
+                            id: 'CTS071',
+                            severity: permissive ? 'high' : 'medium',
+                            title: permissive
+                                ? 'Security check fails open on error'
+                                : 'Security check swallows its error',
+                            detail: `The catch block in \`${fnName || 'this function'}\` ` +
+                                (permissive
+                                    ? 'returns a permissive value (authorized / a user / next()) when the guarded ' +
+                                        'operation throws. An attacker who can make the check error — a malformed token, a ' +
+                                        'timeout — is then let straight through.'
+                                    : 'discards the error from a security-relevant operation. A verification that throws ' +
+                                        'is a failure, not a pass; swallowing it hides the failure and risks failing open.'),
+                            fix: 'Fail closed: on error, deny — `return false` / throw / respond 401 — and log the error. ' +
+                                'Never return a success value from the catch of a security check.',
+                            line: node.loc?.start.line ?? 0,
+                            cwe: 'CWE-703: Improper Check or Handling of Exceptional Conditions',
+                            owasp: 'A10:2025 - Mishandling of Exceptional Conditions',
+                            meta: { function: fnName },
+                        });
+                    }
+                },
+            });
+        }
+        result.checks.push({
+            label: `Logging, error-handling & deserialization (${analysed} file${analysed === 1 ? '' : 's'})`,
+            passed: !result.findings.some((f) => f.severity === 'critical' || f.severity === 'high'),
+        });
+        return result;
+    },
+};

package/dist/scanners/rls.js

@@ -56,7 +56,25 @@ function parseColumns(body) {
 export const rlsScanner = {
     name: 'Supabase / PostgreSQL Row Level Security',
     applies(ctx) {
-        return ctx.files.some(isSql);
+        if (!ctx.files.some(isSql))
+            return false;
+        // Row Level Security is a PostgreSQL feature that Supabase builds on. This
+        // scanner must not fire on SQLite / Cloudflare D1 / Prisma-sqlite schemas,
+        // which have no RLS concept at all — doing so turns every CREATE TABLE into
+        // a false "RLS disabled" critical. Require a genuine Postgres/Supabase
+        // signal: the dependency set, a supabase/ directory, or RLS/auth idioms in
+        // the SQL itself.
+        if (ctx.framework.supabase)
+            return true;
+        for (const file of ctx.files) {
+            if (!isSql(file))
+                continue;
+            const src = read(file);
+            if (src && /\brow\s+level\s+security\b|\bauth\.(uid|jwt|role)\s*\(|\bto\s+(anon|authenticated)\b|\bcreate\s+policy\b/i.test(src)) {
+                return true;
+            }
+        }
+        return false;
     },
     async run(ctx) {
         const result = emptyResult();

package/dist/scanners/secrets.js

@@ -82,7 +82,7 @@ const HEX_DIGEST = /^[a-f0-9]{40}$|^[a-f0-9]{64}$/i;
  */
 const NON_PRODUCTION_PATH = /(^|\/)(tests?|__tests__|__mocks__|__fixtures__|fixtures?|spec|specs|examples?|docs?|demo|samples?|e2e|cypress|playwright|stories)(\/|$)|\.(test|spec|stories|fixture)\.[a-z]+$|(^|\/)(README|CHANGELOG|CONTRIBUTING)/i;
 /** Env var names that are meant to be public even though they read like secrets. */
-const PUBLIC_BY_DESIGN = /(ANON_KEY|PUBLISHABLE_KEY|PUBLIC_KEY|CLIENT_ID|MEASUREMENT_ID|PROJECT_ID|APP_ID|SENDER_ID|FIREBASE_API_KEY|MAPBOX_TOKEN|POSTHOG_KEY|SENTRY_DSN)$/;
+const PUBLIC_BY_DESIGN = /(ANON_KEY|PUBLISHABLE_KEY|PUBLIC_KEY|CLIENT_ID|MEASUREMENT_ID|PROJECT_ID|APP_ID|SENDER_ID|FIREBASE_API_KEY|MAPBOX_TOKEN|POSTHOG_KEY|SENTRY_DSN|SHOPIFY_API_KEY)$/;
 const SECRETY_NAME = /(SECRET|SERVICE_ROLE|PRIVATE|PASSWORD|PASSWD|_TOKEN|API_KEY|ACCESS_KEY|CREDENTIAL)/;
 const LOCKFILES = new Set([
     'package-lock.json', 'pnpm-lock.yaml', 'yarn.lock', 'bun.lock', 'bun.lockb',
@@ -153,6 +153,8 @@ export const secretsScanner = {
                     if (pattern.id === 'supabase-anon')
                         continue; // informational only, not reported
                     const line = lineAt(source, m.index);
+                    if (isCommentedOut(source, m.index))
+                        continue; // documented example, not a live secret
                     if (suppress.suppressed(line, 'CTS030'))
                         continue;
                     const key = `${relPath}:${line}:${pattern.id}`;

package/dist/scanners/server-actions.js

@@ -40,7 +40,18 @@ const SIGNATURE_CHECKS = [
     'webhooks.constructEvent', 'constructEvent', 'constructEventAsync', 'verifyHeader',
     'verify', 'verifySignature', 'createHmac', 'timingSafeEqual', 'Webhook', 'validateRequest',
     'verifyWebhook', 'verifyWebhookSignature',
+    // Framework webhook handlers that verify the signature internally, so the
+    // route body delegates rather than calling an hmac primitive directly.
+    'authenticate.webhook', 'webhooks.process', 'webhooks.validate', 'processWebhook',
+    'handleWebhook', 'validateWebhook', 'wh.verify', 'svix.verify',
 ];
+/**
+ * Request headers that only exist to carry a webhook signature. A handler that
+ * reads one is participating in signature verification — a route that genuinely
+ * forgot it would not reference the header at all — so reading one clears the
+ * "unverified webhook" check.
+ */
+const SIGNATURE_HEADERS = /(x-shopify-hmac-sha256|x-hub-signature(-256)?|stripe-signature|svix-signature|svix-id|x-signature|x-webhook-signature|x-slack-signature|x-line-signature|paypal-transmission-sig)/i;
 /** Schema escape hatches that make validation decorative. */
 const LOOSE_SCHEMA = /\.passthrough\s*\(|z\s*\.\s*(any|unknown)\s*\(|\.catchall\s*\(/g;
 const SERVICE_ROLE_HINTS = [
@@ -121,6 +132,13 @@ function analyseFunction(path, name) {
         if (tail === 'from' || tail === 'select' || tail === 'findMany' || tail === 'findUnique' || tail === 'findFirst') {
             info.hasRead = true;
         }
+        // Reading a webhook-signature header counts as participating in
+        // verification (see SIGNATURE_HEADERS).
+        for (const arg of inner.node.arguments ?? []) {
+            if (arg?.type === 'StringLiteral' && SIGNATURE_HEADERS.test(arg.value)) {
+                info.hasSignatureCheck = true;
+            }
+        }
         // Raw SQL: db.query(`DELETE FROM ...`) / sql`UPDATE ...`
         if (tail === 'query' || tail === 'execute' || tail === 'unsafe' || tail === 'raw') {
             for (const arg of inner.node.arguments ?? []) {
@@ -249,13 +267,24 @@ export const serverActionsScanner = {
                 const writes = info.hasMutation || (isRoute && HTTP_MUTATION_METHODS.has(httpMethod));
                 const isWebhook = isRoute && httpMethod === 'POST' && /webhook|\bhooks?\b|stripe|clerk|svix/i.test(relPath);
                 const isCron = isRoute && /(^|\/)(cron|scheduled|jobs?)(\/|$)/i.test(relPath);
+                // Some endpoints are unauthenticated by design — the sign-in and
+                // account-recovery flow (you have no session yet), and public intake
+                // forms. Flagging "missing auth" there is a false positive, so it is
+                // reported at low rather than as a blocking critical.
+                const PUBLIC_BY_DESIGN_ROUTE = /(^|\/|-)(login|signin|sign-in|register|signup|sign-up|forgot-password|reset-password|verify-email|resend-verification|magic-link|contact|lead|leads|waitlist|subscribe|unsubscribe|newsletter)(\/|-|\.|$)/i;
+                const intentionallyPublic = isRoute && PUBLIC_BY_DESIGN_ROUTE.test(relPath);
                 if (writes && !info.hasAuth && info.getSessionLine === null) {
                     push({
                         id: 'CTS001',
-                        severity: 'critical',
-                        title: `Missing ${kind} authorization`,
+                        severity: intentionallyPublic ? 'low' : 'critical',
+                        title: intentionallyPublic
+                            ? `${kind} is unauthenticated (appears public by design)`
+                            : `Missing ${kind} authorization`,
                         detail: `${kind} \`${name}\` performs a database mutation without verifying the caller. ` +
-                            exposure,
+                            exposure +
+                            (intentionallyPublic
+                                ? ' This route name suggests a sign-in / account-recovery or public-intake endpoint, which is unauthenticated by design — confirm it has rate limiting and does not trust caller-supplied identifiers.'
+                                : ''),
                         fix: 'Resolve and check the session before touching the database, e.g.\n' +
                             '  const { data: { user } } = await supabase.auth.getUser()\n' +
                             "  if (!user) throw new Error('Unauthorized')\n" +

package/dist/utils/files.js

@@ -3,8 +3,9 @@ import { join, relative, sep } from 'node:path';
 const SKIP_DIRS = new Set([
     'node_modules', '.git', '.next', '.turbo', '.vercel', '.wrangler',
     'dist', 'build', 'out', 'coverage', '.venv', 'venv', '__pycache__',
+    '.open-next', '.sst', '.vercel',
     '.cache', '.pnpm-store', 'vendor', 'target', '.svelte-kit', '.nuxt',
-    '.cts-cache', '_reference',
+    '.cts-cache', '_reference', 'site',
 ]);
 const SCAN_EXTS = new Set([
     '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.mts', '.cts', '.sql',
@@ -24,6 +25,29 @@ const AGENT_FILES = new Set([
 ]);
 /** Files bigger than this are almost certainly bundles or fixtures, not source. */
 const MAX_FILE_BYTES = 2_000_000;
+/**
+ * Precise generated-code detection — deliberately NOT a blanket skip of any
+ * `generated/` directory, which can legitimately hold hand-written code. Matches
+ * the codegen outputs that produce false positives (a Prisma client ships its
+ * own credentials, queryRawUnsafe and dynamic requires that are safe in vendor
+ * code but read as findings), and files carrying a generated banner.
+ */
+const GENERATED_PATH = /(^|\/)(generated|__generated__)\/(prisma|graphql|gql|client)(\/|$)|(^|\/)\.prisma(\/|$)|\.(generated|gen)\.[cm]?[jt]sx?$/i;
+const GENERATED_BANNER = /(^|\n).{0,4}(@generated\b|this (file|code) (is|was) (auto[- ]?)?generated|code generated by|do not edit|prisma client js|autogenerated)/i;
+function looksGenerated(fullPath, size) {
+    if (GENERATED_PATH.test(fullPath))
+        return true;
+    // Cheap banner check on the first chunk for the ambiguous cases only.
+    if (!/(^|\/)(generated|gen|__generated__|codegen)(\/|$)/i.test(fullPath))
+        return false;
+    try {
+        const head = readFileSync(fullPath, 'utf8').slice(0, 400);
+        return GENERATED_BANNER.test(head);
+    }
+    catch {
+        return false;
+    }
+}
 export function walk(root) {
     const found = [];
     const stack = [root];
@@ -56,12 +80,13 @@ export function walk(root) {
             const dot = entry.lastIndexOf('.');
             const ext = dot === -1 ? '' : entry.slice(dot);
             // .env, .env.local, requirements.txt and friends have no useful extension.
-            if (SCAN_EXTS.has(ext) ||
+            const scannable = SCAN_EXTS.has(ext) ||
                 AGENT_FILES.has(entry) ||
                 NAMED_FILES.has(entry) ||
                 entry.startsWith('Dockerfile') ||
                 entry.startsWith('.env') ||
-                entry === 'requirements.txt') {
+                entry === 'requirements.txt';
+            if (scannable && !looksGenerated(full, st.size)) {
                 found.push(full);
             }
         }

package/examples/security.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: murtazaozdemir/cleartoship@v0.3.0
+      - uses: murtazaozdemir/cleartoship@v0.8.0
         with:
           fail-on: critical   # block the PR only on criticals
           comment: true        # post a summary comment on the PR

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cleartoship",
-  "version": "0.4.0",
+  "version": "0.8.0",
   "description": "The 30-second pre-launch security clearance for AI-built & vibe-coded apps. Catches missing Server Action auth, Supabase RLS holes, hallucinated npm packages and leaked keys.",
   "keywords": [
     "security",