cleartoship 0.4.0

package/dist/vendor/guardvibe/rules/database.d.ts

@@ -0,0 +1,2 @@
+import type { SecurityRule } from "./types.js";
+export declare const databaseRules: SecurityRule[];

package/dist/vendor/guardvibe/rules/database.js

@@ -0,0 +1,173 @@
+/*
+ * Vendored from GuardVibe — https://github.com/goklab/guardvibe
+ * Copyright 2026 GokLab. Licensed under the Apache License, Version 2.0.
+ * Full licence: LICENSES/guardvibe-Apache-2.0.txt
+ *
+ * Modifications by ClearToShip: import paths rewritten for this package
+ * layout. Rule content is unchanged; rules that duplicate ClearToShip's own
+ * AST checks are disabled at runtime in src/scanners/community.ts rather
+ * than deleted here, so this file stays a faithful copy of upstream.
+ */
+// Security rules for Supabase, Prisma, and Drizzle ORM
+export const databaseRules = [
+    {
+        id: "VG430",
+        name: "Supabase Anon Key on Server",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Using the anon/public key server-side with createClient bypasses Row Level Security. Use the service_role key, or use createServerClient from @supabase/ssr for cookie-based auth.",
+        pattern: /(?<!createServer)createClient\s*\([\s\S]{0,200}?(?:NEXT_PUBLIC_SUPABASE_ANON_KEY|supabaseAnonKey)(?![\s\S]{0,300}?cookies)/g,
+        languages: ["javascript", "typescript"],
+        fix: "Use SUPABASE_SERVICE_ROLE_KEY on the server, or use createServerClient from @supabase/ssr for cookie-based auth with the anon key.",
+        fixCode: '// Option 1: Service role key (admin access)\nconst supabase = createClient(\n  process.env.SUPABASE_URL!,\n  process.env.SUPABASE_SERVICE_ROLE_KEY!\n);\n\n// Option 2: SSR client with cookies (RLS-aware)\nimport { createServerClient } from "@supabase/ssr";\nconst supabase = createServerClient(url, anonKey, { cookies: { ... } });',
+        compliance: ["SOC2:CC6.6", "HIPAA:§164.312(a)"],
+    },
+    // VG431 removed — "Supabase Missing RLS Warning" triggered on every single
+    // supabase.from().select() call, creating extreme noise (1000+ hits in real projects).
+    // RLS is a database-level config, not detectable from application code patterns.
+    {
+        id: "VG432",
+        name: "Prisma Raw Query Injection (call-form)",
+        severity: "critical",
+        owasp: "A03:2025 Injection",
+        description: "Prisma $queryRaw / $executeRaw invoked as a function with a non-Prisma.sql backtick string argument. The tagged-template form (prisma.$queryRaw`...${var}...`) is auto-parameterized by Prisma and is safe; the call-form (prisma.$queryRaw(`...${var}...`)) interpolates the variable in JS first and bypasses parameterization. Prisma rejects the non-Prisma.sql call-form at runtime, but if it slipped past review it would be a critical injection vector.",
+        pattern: /\.\$(?:queryRaw|executeRaw)\s*\(\s*`[^`]*\$\{(?!Prisma\.)/g,
+        languages: ["javascript", "typescript"],
+        fix: "Use the tagged-template form (prisma.$queryRaw`SELECT ... ${var}`) or wrap the argument in Prisma.sql (prisma.$queryRaw(Prisma.sql`SELECT ... ${var}`)). Both are auto-parameterized.",
+        fixCode: "// Tagged template (preferred — auto-parameterized)\nconst rows = await prisma.$queryRaw`SELECT * FROM users WHERE id = ${userId}`;\n\n// Or with Prisma.sql wrapper\nimport { Prisma } from \"@prisma/client\";\nconst rows = await prisma.$queryRaw(Prisma.sql`SELECT * FROM users WHERE id = ${userId}`);",
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG433",
+        name: "Prisma queryRawUnsafe Usage",
+        severity: "critical",
+        owasp: "A03:2025 Injection",
+        description: "$queryRawUnsafe and $executeRawUnsafe pass raw SQL strings without parameterization. Extremely dangerous with user input.",
+        pattern: /\.\$(?:queryRawUnsafe|executeRawUnsafe)\s*\(/g,
+        languages: ["javascript", "typescript"],
+        fix: "Replace with $queryRaw using Prisma.sql tagged template.",
+        fixCode: "const result = await prisma.$queryRaw(\n  Prisma.sql`SELECT * FROM users WHERE id = ${userId}`\n);",
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG434",
+        name: "Drizzle sql.raw() Injection",
+        severity: "critical",
+        owasp: "A03:2025 Injection",
+        description: "sql.raw() interpolated into an executed Drizzle query bypasses parameter binding, enabling SQL injection. Drizzle's sql`${value}` tag binds interpolations safely — only sql.raw() escapes that.",
+        pattern: /(?:db\.execute|db\.run|db\.get|db\.all)\s*\(\s*sql`[^`]*\$\{\s*sql\.raw\b/g,
+        languages: ["javascript", "typescript"],
+        fix: "Avoid sql.raw() with dynamic input. Use bound ${value} interpolation, or restrict raw fragments to a hardcoded allowlist of column/table identifiers.",
+        fixCode: 'import { sql } from "drizzle-orm";\n\nconst result = await db.execute(\n  sql`SELECT * FROM users WHERE id = ${sql.placeholder("id")}`,\n  { id: userId }\n);',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG435",
+        name: "Database URL Client Exposure",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "DATABASE_URL or DIRECT_URL is accessed in client-side code. This exposes your database connection string to the browser.",
+        pattern: /["']use client["'][\s\S]{0,500}?process\.env\.(?:DATABASE_URL|DIRECT_URL)/g,
+        languages: ["javascript", "typescript"],
+        fix: "Never access database URLs in client components. Use Server Components or API routes.",
+        fixCode: "// Access database only server-side (no 'use client')\nexport default async function Page() {\n  const data = await prisma.user.findMany();\n  return <UserList users={data} />;\n}",
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req2.3", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG436",
+        name: "NEXT_PUBLIC Database URL",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Database URL is prefixed with NEXT_PUBLIC_, exposing it in the client bundle.",
+        pattern: /NEXT_PUBLIC_\w*(?:DATABASE|DB|POSTGRES|MYSQL|MONGO|REDIS|SUPABASE_DB)\w*URL\s*=/gi,
+        languages: ["javascript", "typescript", "shell"],
+        fix: "Remove NEXT_PUBLIC_ prefix. Database URLs must only be server-side.",
+        fixCode: "# WRONG: exposed to client\n# NEXT_PUBLIC_DATABASE_URL=postgresql://...\n\n# CORRECT: server-side only\nDATABASE_URL=postgresql://...",
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req2.3", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG437",
+        name: "Supabase Service Role Key in Client",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "SUPABASE_SERVICE_ROLE_KEY is accessed in client-side code. This key bypasses RLS and grants full database access.",
+        pattern: /["']use client["'][\s\S]{0,500}?(?:SUPABASE_SERVICE_ROLE_KEY|SERVICE_ROLE)/g,
+        languages: ["javascript", "typescript"],
+        fix: "Never use the service role key in client code.",
+        fixCode: '// Server-side only\n"use server";\nconst adminClient = createClient(url, process.env.SUPABASE_SERVICE_ROLE_KEY!);',
+        compliance: ["SOC2:CC6.1", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG438",
+        name: "Supabase Public Storage Bucket",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Supabase storage bucket created with public: true. Without proper RLS policies, all files are accessible to anyone.",
+        pattern: /createBucket\s*\(\s*['"][^'"]+['"]\s*,\s*\{[\s\S]{0,200}?public\s*:\s*true/g,
+        languages: ["javascript", "typescript"],
+        fix: "Add storage RLS policies in Supabase Dashboard. Limit file types and sizes.",
+        fixCode: '// Create bucket with auth requirement\nconst { data } = await supabase.storage.createBucket("avatars", {\n  public: false, // require auth\n  fileSizeLimit: 5 * 1024 * 1024, // 5MB\n  allowedMimeTypes: ["image/png", "image/jpeg"],\n});',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG439",
+        name: "Postgres View Without SECURITY INVOKER",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "PostgreSQL view is created without security_invoker = true. By default, views execute with the permissions of the view creator (SECURITY DEFINER), bypassing Row Level Security policies. In Supabase and any RLS-dependent system, this silently exposes all rows to any user who can query the view.",
+        pattern: /CREATE\s+(?:OR\s+REPLACE\s+)?VIEW\s+(?:(?!security_invoker\s*=\s*true)[\s\S]){5,}?(?:AS\s+SELECT)/gi,
+        languages: ["sql"],
+        fix: "Add WITH (security_invoker = true) to all views that should respect RLS policies.",
+        fixCode: '-- GOOD: view respects RLS\nCREATE VIEW user_orders\n  WITH (security_invoker = true)\n  AS SELECT * FROM orders;\n\n-- BAD: bypasses RLS\n-- CREATE VIEW user_orders AS SELECT * FROM orders;',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG448",
+        name: "Supabase RPC Call May Bypass RLS",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "supabase.rpc() calls execute PostgreSQL functions which may bypass Row Level Security if the function is defined as SECURITY DEFINER or if called with the service role key. Ensure the function uses SECURITY INVOKER or validate permissions manually.",
+        pattern: /supabase\.rpc\s*\(\s*["']\w+["']/g,
+        languages: ["javascript", "typescript"],
+        fix: "Ensure PostgreSQL functions called via rpc() use SECURITY INVOKER, or add explicit permission checks. Never call rpc() with the service role key from client-accessible code.",
+        fixCode: '-- PostgreSQL: use SECURITY INVOKER\nCREATE OR REPLACE FUNCTION get_user_data(user_id uuid)\nRETURNS TABLE (id uuid, name text)\nLANGUAGE sql\nSECURITY INVOKER  -- respects RLS!\nAS $$\n  SELECT id, name FROM users WHERE id = user_id;\n$$;\n\n// TypeScript: call with anon key (not service role)\nconst { data } = await supabase.rpc("get_user_data", { user_id: userId });',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG1002",
+        name: "MongoDB NoSQL Injection via Query Operators",
+        severity: "high",
+        owasp: "A02:2025 Injection",
+        description: "MongoDB query operators ($where, $regex, $gt, $ne, $nin) used in database queries may be vulnerable to NoSQL injection if user input is passed directly without validation. Attackers can manipulate query logic to bypass authentication or extract data.",
+        pattern: /\.(find|findOne|updateOne|deleteOne|aggregate)\(\s*\{[^}]*(\$where|\$regex|\$gt|\$ne|\$nin)/g,
+        languages: ["javascript", "typescript"],
+        fix: "Validate and sanitize all user input before using it in MongoDB queries. Use a schema validation library (zod, joi) to ensure query parameters match expected types. Never pass raw request body directly to MongoDB queries.",
+        fixCode: 'import { z } from "zod";\n\n// Validate input before query\nconst schema = z.object({ id: z.string().regex(/^[a-f0-9]{24}$/) });\nconst { id } = schema.parse(req.body);\n\n// Safe query — no raw operators from user input\nconst user = await db.collection("users").findOne({ _id: new ObjectId(id) });',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG1011",
+        name: "Drizzle sql.identifier() / .as() with User Input",
+        severity: "critical",
+        owasp: "A02:2025 Injection",
+        description: "Drizzle ORM's sql.identifier() and .as() accept raw strings for table/column names and aliases. Unlike sql`` tagged templates (which parameterize values), these functions interpolate directly into the SQL string. If user input reaches sql.identifier() or .as(), attackers can inject arbitrary SQL fragments — including UNION SELECT, subqueries, or DDL statements — bypassing ORM-level protections entirely.",
+        pattern: /(?:sql\.identifier|\.as)\s*\(\s*(?!["'`])[^)]*(?:req\.|params\.|query\.|body\.|input|args|user|ctx\.|formData|searchParams)/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Never pass user input to sql.identifier() or .as(). Use a strict allowlist of valid table/column names and validate against it.",
+        fixCode: 'import { sql } from "drizzle-orm";\n\n// BAD: user input in identifier\nconst col = req.query.sortBy;\ndb.select().from(sql.identifier(col)); // SQL injection!\n\n// GOOD: allowlist valid identifiers\nconst ALLOWED_COLUMNS = ["name", "email", "created_at"] as const;\nconst col = ALLOWED_COLUMNS.find(c => c === req.query.sortBy);\nif (!col) throw new Error("Invalid column");\ndb.select().from(users).orderBy(users[col]);',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG1073",
+        name: "Drizzle sql.raw / sql.identifier with Interpolation or Concatenation (CVE-2026-39356 follow-on)",
+        severity: "critical",
+        owasp: "A02:2025 Injection",
+        description: "A sql.raw(...) or sql.identifier(...) call receives either a backtick template with ${...} interpolation or a string built with + concatenation. Both bypass Drizzle's parameterizer — the constructed string is fed straight into the executed query, exposing the same identifier-escape gap CVE-2026-39356 patched (drizzle-orm < 0.45.2 / 1.0.0-beta.20). On older builds it is a hard SQL injection; on patched builds sql.raw still has no escape at all. The supported safe shape is the tagged template `sql`... ${value}`` (auto-parameterized) plus a strict allowlist for any identifier the caller must vary. Distinct from VG1011, which catches the variable-name form sql.identifier(req.X) only; this rule covers the template-literal and string-concatenation shapes plus the previously-uncovered sql.raw call.",
+        pattern: /\bsql\s*\.\s*(?:raw|identifier)\s*\(\s*(?:`[^`]{0,400}\$\{|[\s\S]{0,200}?(?<![=!<>])\+(?!\+|=))/g,
+        languages: ["javascript", "typescript"],
+        fix: "Replace sql.raw / sql.identifier interpolation with the tagged-template form sql`... ${value}` (auto-parameterized) for values, and a hardcoded allowlist for any table/column identifier you must vary by request. Upgrade drizzle-orm to 0.45.2+ (stable) or 1.0.0-beta.20+ (beta) to close the escape gap covered by VG1052.",
+        fixCode: "// BAD — template-literal interpolation feeds attacker input straight in\nawait db.execute(sql.raw(`SELECT * FROM ${table} WHERE id = ${id}`));\n\n// BAD — string concatenation into sql.raw\nawait db.execute(sql.raw('SELECT * FROM users WHERE name = \\'' + name + '\\''));\n\n// GOOD — tagged template auto-parameterizes the value\nimport { sql } from 'drizzle-orm';\nawait db.execute(sql`SELECT * FROM users WHERE id = ${id}`);\n\n// GOOD — strict allowlist when the identifier really must vary\nconst ALLOWED_TABLES = ['users', 'orders'] as const;\nif (!ALLOWED_TABLES.includes(table as never)) throw new Error('Invalid table');\nawait db.execute(sql`SELECT * FROM ${sql.identifier(table)}`);",
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
+        exploit: "Attacker controls a request field that becomes the value of `table` or `id`. A payload like `users WHERE 1=1; DROP TABLE users; --` is concatenated into the raw query string; Drizzle hands the whole string to the driver and the driver executes the injected statements with the application's database role.",
+    },
+];

package/dist/vendor/guardvibe/rules/deployment.d.ts

@@ -0,0 +1,2 @@
+import type { SecurityRule } from "./types.js";
+export declare const deploymentRules: SecurityRule[];

package/dist/vendor/guardvibe/rules/deployment.js

@@ -0,0 +1,269 @@
+/*
+ * Vendored from GuardVibe — https://github.com/goklab/guardvibe
+ * Copyright 2026 GokLab. Licensed under the Apache License, Version 2.0.
+ * Full licence: LICENSES/guardvibe-Apache-2.0.txt
+ *
+ * Modifications by ClearToShip: import paths rewritten for this package
+ * layout. Rule content is unchanged; rules that duplicate ClearToShip's own
+ * AST checks are disabled at runtime in src/scanners/community.ts rather
+ * than deleted here, so this file stays a faithful copy of upstream.
+ */
+// Security rules for deployment config files
+export const deploymentRules = [
+    // vercel.json / vercel.ts
+    {
+        id: "VG500",
+        name: "Vercel CORS Wildcard",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Vercel config sets Access-Control-Allow-Origin to wildcard (*), allowing any website to make requests.",
+        pattern: /["']Access-Control-Allow-Origin["'][\s\S]*?["']\*["']/g,
+        languages: ["vercel-config", "json"],
+        fix: "Restrict CORS to specific trusted origins.",
+        fixCode: '// vercel.json\n{\n  "headers": [{\n    "source": "/api/(.*)",\n    "headers": [{ "key": "Access-Control-Allow-Origin", "value": "https://yourdomain.com" }]\n  }]\n}',
+        compliance: ["SOC2:CC6.6"],
+    },
+    {
+        id: "VG501",
+        name: "Vercel Internal Rewrite Exposure",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Vercel rewrites expose internal service URLs to the public internet.",
+        pattern: /["']rewrites["']\s*:\s*\[[\s\S]*?["']destination["']\s*:\s*["']https?:\/\/(?:localhost|127\.0\.0\.1|10\.|172\.(?:1[6-9]|2\d|3[01])\.|192\.168\.)/g,
+        languages: ["vercel-config", "json"],
+        fix: "Do not rewrite to internal network addresses. Use Vercel environment variables for service URLs.",
+        fixCode: '// Use environment variable for backend URL\n{\n  "rewrites": [{\n    "source": "/api/:path*",\n    "destination": "https://api.yourdomain.com/:path*"\n  }]\n}',
+        compliance: ["SOC2:CC6.6"],
+    },
+    {
+        id: "VG503",
+        name: "Vercel Cron Missing Secret Verification",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Cron jobs are configured but the endpoint may not verify CRON_SECRET. Anyone could trigger the cron endpoint manually.",
+        pattern: /["']crons["']\s*:\s*\[[\s\S]*?["']path["']\s*:\s*["'][^"']+["']/g,
+        languages: ["vercel-config", "json"],
+        fix: "Verify the CRON_SECRET header in your cron endpoint.",
+        fixCode: '// app/api/cron/route.ts\nexport async function GET(request: Request) {\n  const authHeader = request.headers.get("authorization");\n  if (authHeader !== `Bearer ${process.env.CRON_SECRET}`) {\n    return new Response("Unauthorized", { status: 401 });\n  }\n}',
+        compliance: ["SOC2:CC6.6"],
+    },
+    {
+        id: "VG504",
+        name: "Excessive Function Duration",
+        severity: "medium",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "Function maxDuration is set very high. Long-running functions increase costs and attack surface.",
+        pattern: /["']maxDuration["']\s*:\s*(?:[3-9]\d{2}|[1-9]\d{3,})/g,
+        languages: ["vercel-config", "json"],
+        fix: "Set maxDuration to the minimum required. Default 300s is sufficient for most use cases.",
+        fixCode: '// Set reasonable maxDuration\nexport const maxDuration = 60; // seconds — adjust to actual need',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG506",
+        name: "Hardcoded Secret in Vercel Config",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Secret or API key hardcoded in vercel.json. This file is committed to git.",
+        pattern: /["'](?:\w+_(?:SECRET|KEY|TOKEN|PASSWORD|CREDENTIAL)|(?:SECRET|PASSWORD|CREDENTIAL)_?\w*)["']\s*:\s*["'][A-Za-z0-9_\-]{12,}["']/gi,
+        languages: ["vercel-config", "json"],
+        fix: "Use Vercel environment variables (vercel env add) instead of hardcoding in config files.",
+        fixCode: '# Store secrets as Vercel env vars\nvercel env add SECRET_KEY production\n\n# Reference in code\nconst key = process.env.SECRET_KEY;',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req2.3"],
+    },
+    // next.config
+    {
+        id: "VG507",
+        name: "Wildcard Remote Image Pattern",
+        severity: "high",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "next.config allows images from any hostname. This enables SSRF and hotlinking attacks.",
+        pattern: /remotePatterns\s*:\s*\[[\s\S]*?hostname\s*:\s*["'](?:\*\*|\*)["']/g,
+        languages: ["nextjs-config", "javascript", "typescript"],
+        fix: "Restrict remotePatterns to specific trusted hostnames.",
+        fixCode: '// next.config.ts\nimages: {\n  remotePatterns: [\n    { protocol: "https", hostname: "images.example.com" },\n  ]\n}',
+        compliance: ["SOC2:CC6.6"],
+    },
+    {
+        id: "VG509",
+        name: "Powered By Header Enabled",
+        severity: "low",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "X-Powered-By header reveals Next.js framework. This helps attackers target known vulnerabilities.",
+        pattern: /poweredByHeader\s*:\s*true/g,
+        languages: ["nextjs-config", "javascript", "typescript"],
+        fix: "Set poweredByHeader to false in next.config.ts.",
+        fixCode: "// next.config.ts\nconst config = {\n  poweredByHeader: false,\n};",
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG510",
+        name: "Next Config CORS Wildcard",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Next.js config headers() sets Access-Control-Allow-Origin to wildcard (*).",
+        pattern: /headers\s*\(\s*\)\s*\{[\s\S]*?Access-Control-Allow-Origin[\s\S]*?["']\*["']/g,
+        languages: ["nextjs-config", "javascript", "typescript"],
+        fix: "Restrict CORS to specific trusted origins.",
+        fixCode: '// Restrict to specific origins\nheaders: [\n  { key: "Access-Control-Allow-Origin", value: "https://yourdomain.com" }\n]',
+        compliance: ["SOC2:CC6.6"],
+    },
+    {
+        id: "VG512",
+        name: "Source Maps in Production",
+        severity: "medium",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "Source maps enabled in production expose original source code to attackers.",
+        pattern: /devtool\s*:\s*["'](?:source-map|eval-source-map|cheap-source-map)["']/g,
+        languages: ["nextjs-config", "javascript", "typescript"],
+        fix: "Disable source maps in production.",
+        fixCode: "// next.config.ts\nconst config = {\n  productionBrowserSourceMaps: false,\n};",
+        compliance: ["SOC2:CC6.1"],
+    },
+    // docker-compose.yml
+    {
+        id: "VG513",
+        name: "Docker Compose Public Port Binding",
+        severity: "medium",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "Port bound to 0.0.0.0 exposes the service to all network interfaces.",
+        pattern: /ports\s*:\s*\n\s*-\s*["']?0\.0\.0\.0:/gm,
+        languages: ["docker-compose", "yaml"],
+        fix: "Bind to 127.0.0.1 for local-only access.",
+        fixCode: '# Bind to localhost only\nports:\n  - "127.0.0.1:3000:3000"',
+        compliance: ["SOC2:CC6.6"],
+    },
+    {
+        id: "VG514",
+        name: "Docker Compose Hardcoded Secret",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Secret hardcoded in docker-compose environment section. Use Docker secrets or .env file.",
+        pattern: /environment\s*:\s*\n(?:\s*-\s*|\s*\w+\s*:\s*)[\s\S]*?(?:SECRET|PASSWORD|TOKEN|KEY|CREDENTIAL)\w*\s*[=:]\s*\S{8,}/gi,
+        languages: ["docker-compose", "yaml"],
+        fix: "Use Docker secrets or reference a .env file instead of hardcoding.",
+        fixCode: "# Use .env file\nservices:\n  app:\n    env_file:\n      - .env",
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req2.3"],
+    },
+    {
+        id: "VG515",
+        name: "Docker Compose Privileged Container",
+        severity: "critical",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "Container runs in privileged mode with full host access. This is a severe security risk.",
+        pattern: /privileged\s*:\s*true/g,
+        languages: ["docker-compose", "yaml"],
+        fix: "Remove privileged: true. Use specific capabilities (cap_add) if needed.",
+        fixCode: "# Instead of privileged: true, use specific capabilities\nservices:\n  app:\n    cap_add:\n      - NET_ADMIN",
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG516",
+        name: "Docker Compose Host Volume Mount",
+        severity: "high",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "Mounting the entire host filesystem gives the container excessive access.",
+        pattern: /volumes\s*:\s*\n\s*-\s*["']?(?:\/:|\/etc|\/var|\/root|\/home)\s*:/gm,
+        languages: ["docker-compose", "yaml"],
+        fix: "Mount only specific directories needed by the application.",
+        fixCode: "# Mount only what's needed\nvolumes:\n  - ./data:/app/data",
+        compliance: ["SOC2:CC6.1"],
+    },
+    // fly.toml / render.yaml / netlify.toml
+    {
+        id: "VG517",
+        name: "Platform Config Hardcoded Secret",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Secret hardcoded in deployment platform config file. These files are committed to git.",
+        pattern: /\[env\][\s\S]*?(?:SECRET|PASSWORD|TOKEN|KEY|CREDENTIAL)\w*\s*=\s*["']?[A-Za-z0-9_\-]{12,}/gi,
+        languages: ["fly-config", "render-config", "netlify-config", "toml"],
+        fix: "Use your platform's secret management (fly secrets set, Render env groups, Netlify env vars).",
+        fixCode: '# fly.toml — don\'t put secrets here\n# Instead: fly secrets set SECRET_KEY=value\n\n[env]\n  LOG_LEVEL = "info"',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req2.3"],
+    },
+    {
+        id: "VG518",
+        name: "Platform Internal Port Exposed",
+        severity: "medium",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "Internal service port (database, cache) is exposed publicly.",
+        pattern: /internal_port\s*=\s*(?:5432|3306|6379|27017|9200|2379)/g,
+        languages: ["fly-config", "toml"],
+        fix: "Don't expose database or cache ports publicly. Use internal networking.",
+        fixCode: '# fly.toml — only expose your app port\n[[services]]\n  internal_port = 3000  # app port only\n\n# Access database via internal Fly DNS\n# DATABASE_URL=postgres://db.internal:5432/mydb',
+        compliance: ["SOC2:CC6.6"],
+    },
+    {
+        id: "VG520",
+        name: "Missing HTTPS Redirect",
+        severity: "medium",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "No HTTP to HTTPS redirect configured. Traffic may be sent unencrypted.",
+        pattern: /force_https\s*=\s*false/g,
+        languages: ["fly-config", "toml"],
+        fix: "Enable force_https to redirect all HTTP traffic to HTTPS.",
+        fixCode: '# fly.toml\n[[services]]\n  [services.concurrency]\n    hard_limit = 25\n  [[services.ports]]\n    force_https = true\n    port = 80',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req4.1"],
+    },
+    {
+        id: "VG521",
+        name: "Kubernetes Privileged Container",
+        severity: "critical",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "Kubernetes pod runs with privileged: true, granting full access to the host kernel. This is the #1 container escape vector — a compromised pod can access all host devices, mount the host filesystem, and take over the entire node.",
+        pattern: /securityContext:[\s\S]{0,100}?privileged:\s*true/gi,
+        languages: ["yaml"],
+        fix: "Remove privileged: true. Use specific Linux capabilities if needed instead of full privilege escalation.",
+        fixCode: '# BAD: full host access\n# securityContext:\n#   privileged: true\n\n# GOOD: drop all capabilities, add only what\'s needed\nsecurityContext:\n  privileged: false\n  runAsNonRoot: true\n  capabilities:\n    drop: ["ALL"]',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.5.10"],
+    },
+    {
+        id: "VG522",
+        name: "Kubernetes Secrets in ConfigMap",
+        severity: "critical",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Sensitive data (passwords, tokens, API keys, credentials) stored in a Kubernetes ConfigMap instead of a Secret. ConfigMaps are not encrypted at rest and are visible to anyone with basic cluster read access.",
+        pattern: /kind:\s*ConfigMap[\s\S]{0,500}?(?:password|secret|token|api[_-]?key|credential|private[_-]?key|database[_-]?url)\s*:\s*\S+/gi,
+        languages: ["yaml"],
+        fix: "Move sensitive data to Kubernetes Secrets with encryption at rest enabled. Never store credentials in ConfigMaps.",
+        fixCode: '# BAD: secret in ConfigMap\n# kind: ConfigMap\n# data:\n#   database-password: "s3cret"\n\n# GOOD: use a Secret\napiVersion: v1\nkind: Secret\nmetadata:\n  name: db-credentials\ntype: Opaque\nstringData:\n  database-password: "s3cret"',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req2.3", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG523",
+        name: "Kubernetes Host Namespace Sharing",
+        severity: "critical",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "Pod uses hostNetwork, hostPID, or hostIPC. This breaks container isolation — the pod can see all host processes, sniff network traffic, and communicate with host-level IPC, enabling trivial container escapes.",
+        pattern: /(?:hostNetwork|hostPID|hostIPC):\s*true/gi,
+        languages: ["yaml"],
+        fix: "Remove hostNetwork, hostPID, and hostIPC unless absolutely required (e.g., CNI plugins). Use NetworkPolicies for inter-pod communication.",
+        fixCode: '# BAD: breaks container isolation\n# hostNetwork: true\n# hostPID: true\n\n# GOOD: use pod networking\nspec:\n  hostNetwork: false\n  hostPID: false\n  hostIPC: false\n  containers:\n    - name: app\n      securityContext:\n        runAsNonRoot: true',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.5.10"],
+    },
+    {
+        id: "VG524",
+        name: "Data URL or Blob URL in User-Controlled src/href",
+        severity: "high",
+        owasp: "A07:2025 Cross-Site Scripting",
+        description: "User-controlled input is used in src or href attributes without blocking data: and blob: URL schemes. data:text/html URLs can embed full HTML pages with scripts, and javascript: URLs execute code — bypassing same-origin restrictions.",
+        pattern: /(?:src|href|action|srcDoc)\s*=\s*\{[^}]*?(?:data\s*:|blob\s*:|javascript\s*:)[^}]*\}/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Validate URL scheme against an allowlist (https: only). Block data:, blob:, and javascript: URLs from user input.",
+        fixCode: '// Validate URL scheme\nfunction isSafeUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    return ["https:", "http:"].includes(parsed.protocol);\n  } catch {\n    return false;\n  }\n}\n\n// Usage\n<img src={isSafeUrl(userUrl) ? userUrl : "/placeholder.png"} />',
+        compliance: ["SOC2:CC7.1"],
+    },
+    {
+        id: "VG1001",
+        name: "Kubernetes Secret Hardcoded Value",
+        severity: "critical",
+        owasp: "A07:2025 Identification and Authentication Failures",
+        description: "Kubernetes Secret manifest contains hardcoded base64-encoded values in the data field. These secrets are only base64-encoded (not encrypted) and will be exposed in version control. Use External Secrets, Sealed Secrets, or a secrets manager instead.",
+        pattern: /kind:\s*Secret[\s\S]*?data:[\s\S]*?(?!\s*\{\{)[\w+/=]{8,}/g,
+        languages: ["yaml"],
+        fix: "Never commit Secret manifests with hardcoded values. Use External Secrets Operator, Sealed Secrets, or inject secrets via CI/CD pipeline. Store sensitive values in a secrets manager (Vault, AWS Secrets Manager, etc.).",
+        fixCode: '# Use External Secrets Operator\napiVersion: external-secrets.io/v1beta1\nkind: ExternalSecret\nmetadata:\n  name: my-secret\nspec:\n  refreshInterval: 1h\n  secretStoreRef:\n    name: vault-backend\n    kind: SecretStore\n  target:\n    name: my-secret\n  data:\n    - secretKey: password\n      remoteRef:\n        key: secret/data/myapp\n        property: password',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.5.3", "HIPAA:§164.312(a)"],
+    },
+];

package/dist/vendor/guardvibe/rules/dockerfile.d.ts

@@ -0,0 +1,2 @@
+import type { SecurityRule } from "./types.js";
+export declare const dockerfileRules: SecurityRule[];

package/dist/vendor/guardvibe/rules/dockerfile.js

@@ -0,0 +1,99 @@
+/*
+ * Vendored from GuardVibe — https://github.com/goklab/guardvibe
+ * Copyright 2026 GokLab. Licensed under the Apache License, Version 2.0.
+ * Full licence: LICENSES/guardvibe-Apache-2.0.txt
+ *
+ * Modifications by ClearToShip: import paths rewritten for this package
+ * layout. Rule content is unchanged; rules that duplicate ClearToShip's own
+ * AST checks are disabled at runtime in src/scanners/community.ts rather
+ * than deleted here, so this file stays a faithful copy of upstream.
+ */
+export const dockerfileRules = [
+    {
+        id: "VG200",
+        name: "Container running as root",
+        severity: "high",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "Dockerfile has no USER instruction. Container will run as root, increasing attack surface.",
+        pattern: /^FROM\s+\S+(?:(?!^USER\s)[\s\S])*$/gim,
+        languages: ["dockerfile"],
+        fix: "Add a USER instruction after installing dependencies: USER node (or appropriate non-root user).",
+        fixCode: "FROM node:20-alpine\nRUN addgroup -S app && adduser -S app -G app\n# ... install dependencies ...\nUSER app\nCMD [\"node\", \"server.js\"]",
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG201",
+        name: "COPY all before dependency install",
+        severity: "medium",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "COPY . . before RUN install copies everything including secrets into the image layer history.",
+        pattern: /COPY\s+\.\s+\.\s*\n[\s\S]*?RUN\s+.*(?:npm|pip|go|bundle|cargo)\s+install/gi,
+        languages: ["dockerfile"],
+        fix: "Copy only dependency files first (package.json, requirements.txt), then install, then copy source.",
+        fixCode: "# Copy dependency files first\nCOPY package.json package-lock.json ./\nRUN npm ci --production\n# Then copy source\nCOPY . .",
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG202",
+        name: "Using latest or untagged image",
+        severity: "medium",
+        owasp: "A03:2025 Software Supply Chain Failures",
+        description: "Using :latest tag or no tag makes builds non-reproducible and vulnerable to supply chain attacks.",
+        pattern: /^FROM\s+[^\s:@]+(?::latest)?(?=\s)/gim,
+        languages: ["dockerfile"],
+        fix: "Pin to a specific version tag: FROM node:20-alpine instead of FROM node:latest.",
+        fixCode: "# Pin to specific version\nFROM node:20-alpine\n# Not: FROM node:latest\n# Not: FROM node",
+        compliance: ["SOC2:CC7.1"],
+    },
+    {
+        id: "VG203",
+        name: "Secrets in ENV instruction",
+        severity: "critical",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Secrets hardcoded in ENV instruction are visible in image history and to anyone with image access.",
+        pattern: /ENV\s+\S*(?:KEY|SECRET|PASSWORD|TOKEN|CREDENTIAL)\S*\s*=?\s*\S+/gi,
+        languages: ["dockerfile"],
+        fix: "Use runtime environment variables or Docker secrets instead of baking secrets into the image.",
+        fixCode: "# Don't bake secrets in image\n# Instead, pass at runtime:\n# docker run -e SECRET_KEY=xxx myapp\n# Or use Docker secrets / .env file",
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req2.3"],
+    },
+    {
+        id: "VG204",
+        name: "Using ADD instead of COPY",
+        severity: "medium",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "ADD has extra features (URL fetch, tar extraction) that can introduce unexpected behavior. Use COPY for local files.",
+        // Anchor to start of line + case-sensitive: Docker `ADD` instruction is uppercase and
+        // begins a line. Matching `add` case-insensitive caught `RUN pnpm add`, `apk add`,
+        // `yarn add`, etc. — package-manager subcommands inside RUN, not Docker instructions.
+        pattern: /^ADD\s+(?!https?:\/\/)\S+\s+\S+/gm,
+        languages: ["dockerfile"],
+        fix: "Use COPY instead of ADD for local files. Only use ADD for URLs or tar extraction.",
+        fixCode: "# Use COPY for local files\nCOPY ./src /app/src\n# Only use ADD for remote files or tar extraction\n# ADD https://example.com/file.tar.gz /app/",
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG205",
+        name: "Docker Socket Mount",
+        severity: "critical",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "Docker socket (/var/run/docker.sock) is mounted into a container. This grants the container full control over the Docker daemon — equivalent to root access on the host. CVE-2025-9074 and numerous container escape attacks exploit this.",
+        pattern: /(?:-v|--volume|volumes:)\s*.*\/var\/run\/docker\.sock/gi,
+        languages: ["yaml", "dockerfile", "shell"],
+        fix: "Never mount the Docker socket into application containers. Use Docker-in-Docker (dind) with TLS for CI runners that need Docker access.",
+        fixCode: '# BAD: full host Docker access\n# -v /var/run/docker.sock:/var/run/docker.sock\n\n# GOOD: use Docker-in-Docker with TLS for CI\nservices:\n  dind:\n    image: docker:dind\n    privileged: true\n    environment:\n      DOCKER_TLS_CERTDIR: /certs',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.5.10"],
+    },
+    {
+        id: "VG206",
+        name: "Dockerfile Missing HEALTHCHECK",
+        severity: "medium",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "Dockerfile has CMD or ENTRYPOINT but no HEALTHCHECK instruction. Without health checks, orchestrators cannot detect when the application is unresponsive, leading to silent failures and stale container routing.",
+        pattern: /^FROM\s+\S+[\s\S]*?(?:CMD|ENTRYPOINT)\s+(?:(?!HEALTHCHECK)[\s\S])*$/gim,
+        languages: ["dockerfile"],
+        fix: "Add a HEALTHCHECK instruction to verify the application is responding.",
+        fixCode: 'HEALTHCHECK --interval=30s --timeout=3s --retries=3 \\\n  CMD curl -f http://localhost:3000/health || exit 1\n\nCMD ["node", "server.js"]',
+        compliance: ["SOC2:CC7.1"],
+    },
+];

package/dist/vendor/guardvibe/rules/firebase.d.ts

@@ -0,0 +1,2 @@
+import type { SecurityRule } from "./types.js";
+export declare const firebaseRules: SecurityRule[];