cleartoship 0.4.0

package/dist/vendor/guardvibe/rules/nextjs.d.ts

@@ -0,0 +1,2 @@
+import type { SecurityRule } from "./types.js";
+export declare const nextjsRules: SecurityRule[];

package/dist/vendor/guardvibe/rules/nextjs.js

@@ -0,0 +1,233 @@
+/*
+ * Vendored from GuardVibe — https://github.com/goklab/guardvibe
+ * Copyright 2026 GokLab. Licensed under the Apache License, Version 2.0.
+ * Full licence: LICENSES/guardvibe-Apache-2.0.txt
+ *
+ * Modifications by ClearToShip: import paths rewritten for this package
+ * layout. Rule content is unchanged; rules that duplicate ClearToShip's own
+ * AST checks are disabled at runtime in src/scanners/community.ts rather
+ * than deleted here, so this file stays a faithful copy of upstream.
+ */
+// Security rules for Next.js App Router patterns
+export const nextjsRules = [
+    {
+        id: "VG400",
+        name: "Client Component Secret Exposure",
+        severity: "critical",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Server-side environment variable accessed in a 'use client' component. These values are exposed to the browser. Only NEXT_PUBLIC_ variables are safe in client components.",
+        pattern: /["']use client["'][\s\S]{0,500}?process\.env\.(?!NEXT_PUBLIC_)\w+/g,
+        languages: ["javascript", "typescript"],
+        fix: "Move this logic to a Server Component or Server Action. Only process.env.NEXT_PUBLIC_* variables are available in client components.",
+        fixCode: '// Move to a Server Component (no \'use client\')\nexport default async function Page() {\n  const secret = process.env.SECRET_KEY;\n  return <ClientComponent data={safeData} />;\n}',
+        compliance: ["SOC2:CC6.1", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG401",
+        name: "Server Action Missing Input Validation",
+        severity: "high",
+        owasp: "A03:2025 Injection",
+        description: "Server Action processes form data without schema validation. Unvalidated input can lead to injection attacks.",
+        pattern: /["']use server["'](?![\s\S]{0,500}?(?:z\.object|schema\.parse|\.safeParse|yup\.object|valibot\.|\.validate\s*\())[\s\S]{0,500}?formData\.get\s*\(/g,
+        languages: ["javascript", "typescript"],
+        fix: "Validate all inputs with a schema library (zod, yup, valibot) before processing.",
+        fixCode: '"use server";\nimport { z } from "zod";\n\nconst schema = z.object({ name: z.string().min(1), email: z.string().email() });\n\nexport async function createUser(formData: FormData) {\n  const data = schema.parse(Object.fromEntries(formData));\n}',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG402",
+        name: "Server Action Missing Auth Check",
+        severity: "critical",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Server Action performs data mutations without verifying user authentication. Anyone can invoke Server Actions directly via POST request.",
+        pattern: /["']use server["'][\s\S]{0,500}?export\s+async\s+function\s+\w+\s*\([^)]*\)\s*\{(?![\s\S]{0,800}?(?:auth\s*\(|getServerSession|currentUser|getUser|requireAuth|requireAdmin|clerkClient|verifyAuth|checkPermission|assertAuth|ensureAuth|authorize|withAuth))/g,
+        languages: ["javascript", "typescript"],
+        fix: "Always verify authentication at the start of every Server Action.",
+        fixCode: '"use server";\nimport { auth } from "@clerk/nextjs/server";\n\nexport async function deleteItem(id: string) {\n  const { userId } = await auth();\n  if (!userId) throw new Error("Unauthorized");\n}',
+        compliance: ["SOC2:CC6.6", "PCI-DSS:Req6.5.10", "HIPAA:§164.312(d)"],
+    },
+    {
+        id: "VG403",
+        name: "Route Handler CORS Wildcard",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Route handler sets Access-Control-Allow-Origin to wildcard (*). This allows any website to make requests to your API.",
+        pattern: /(?:GET|POST|PUT|DELETE|PATCH|OPTIONS)\s*\([\s\S]*?["']Access-Control-Allow-Origin["']\s*[,:]\s*["']\*["']/g,
+        languages: ["javascript", "typescript"],
+        fix: "Restrict CORS to specific trusted origins instead of wildcard.",
+        fixCode: '// Restrict to specific origin\nconst allowedOrigin = process.env.ALLOWED_ORIGIN;\nreturn new Response(data, {\n  headers: { "Access-Control-Allow-Origin": allowedOrigin }\n});',
+        compliance: ["SOC2:CC6.6"],
+    },
+    {
+        id: "VG404",
+        name: "Middleware Auth Bypass Risk",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Middleware or proxy has overly broad public path matcher that may accidentally expose protected routes.",
+        pattern: /(?:matcher|config)\s*[=:]\s*[\s\S]*?["']\/\(\.\*\)["']/g,
+        languages: ["javascript", "typescript"],
+        fix: "Use specific path matchers instead of catch-all patterns.",
+        fixCode: '// Be specific with matchers\nexport const config = {\n  matcher: ["/dashboard/:path*", "/api/:path*"]\n};',
+        compliance: ["SOC2:CC6.6"],
+    },
+    {
+        id: "VG405",
+        name: "Missing Security Headers in Next Config",
+        severity: "medium",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "next.config is missing important security headers (Content-Security-Policy, Strict-Transport-Security, X-Frame-Options).",
+        pattern: /(?:async\s+)?headers\s*\(\s*\)\s*\{[\s\S]{0,20}return\s+\[(?![\s\S]*(?:X-Frame-Options|Strict-Transport-Security|Content-Security-Policy))/g,
+        languages: ["javascript", "typescript"],
+        fix: "Add security headers in next.config.ts headers() function.",
+        fixCode: '// next.config.ts\nasync headers() {\n  return [{\n    source: "/(.*)",\n    headers: [\n      { key: "X-Frame-Options", value: "DENY" },\n      { key: "X-Content-Type-Options", value: "nosniff" },\n      { key: "Strict-Transport-Security", value: "max-age=63072000; includeSubDomains" },\n    ]\n  }];\n}',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.5.10"],
+    },
+    {
+        id: "VG406",
+        name: "Unsanitized Dynamic Route Params",
+        severity: "high",
+        owasp: "A03:2025 Injection",
+        description: "Dynamic route parameters (params, searchParams) are used directly in database queries or operations without validation.",
+        pattern: /(?:(?:await\s+)?(?:params|searchParams))\s*[\)\.\[]\s*["']?\w+["']?\s*[\]\)]?\s*(?:;|\))\s*[\s\S]*?(?:query|execute|findUnique|findFirst|findMany|delete|update|create)\s*\(/g,
+        languages: ["javascript", "typescript"],
+        fix: "Always validate and sanitize dynamic route parameters before using them in queries.",
+        fixCode: '// Validate params before use\nimport { z } from "zod";\nconst idSchema = z.string().uuid();\n\nexport default async function Page({ params }: { params: { id: string } }) {\n  const id = idSchema.parse((await params).id);\n  const item = await db.item.findUnique({ where: { id } });\n}',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG407",
+        name: "Server Data Leaked to Client Component",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Sensitive data (tokens, secrets, internal IDs) appears to be passed from server to client component as props.",
+        // Require no-space `=` to match JSX prop syntax (`token={value}`) and exclude JS object
+        // literal assignments (`apiKey = { ... }`, `token = { ... }`) common in test helpers,
+        // default-param destructuring, and config objects.
+        pattern: /(?:(?:^|[^a-zA-Z])(?:secret|token|password|apiKey|api_key|privateKey|private_key|internalId|ssn|creditCard|credit_card))=\{[\s\S]*?\}/g,
+        languages: ["javascript", "typescript"],
+        fix: "Never pass sensitive data as props to client components. Keep secrets server-side.",
+        fixCode: "// Keep sensitive data server-side\nexport default async function Page() {\n  const secret = process.env.API_SECRET;\n  const publicData = await fetchData(secret);\n  return <ClientComponent data={publicData} />;\n}",
+        compliance: ["SOC2:CC6.1", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG408",
+        name: "Unsafe innerHTML Usage",
+        severity: "high",
+        owasp: "A03:2025 Injection",
+        description: "Using dangerouslySetInnerHTML renders unescaped HTML, which can lead to XSS if the content includes user input. This is a security rule detector — it flags vulnerable code patterns.",
+        pattern: /dangerouslySetInnerHTML\s*=\s*\{\s*\{\s*__html\s*:/g,
+        languages: ["javascript", "typescript"],
+        fix: "Sanitize HTML with DOMPurify before rendering, or use a markdown renderer instead.",
+        fixCode: '// Use a sanitizer library\nimport DOMPurify from "dompurify";\nconst clean = DOMPurify.sanitize(content);\n\n// Or use a markdown renderer\nimport ReactMarkdown from "react-markdown";\n<ReactMarkdown>{content}</ReactMarkdown>',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.7"],
+    },
+    {
+        id: "VG409",
+        name: "Open Redirect via User Input",
+        severity: "medium",
+        owasp: "A01:2025 Broken Access Control",
+        description: "redirect() or NextResponse.redirect() uses user-controlled input (searchParams, query) which can redirect users to malicious sites.",
+        pattern: /(?:(?:redirect|NextResponse\.redirect|res\.redirect|Response\.redirect)\s*\(\s*(?:searchParams|params|req\.query|request\.url|url|query|returnTo|callbackUrl|next|goto|returnUrl|redirectUrl|destination)\b|(?:res|reply)\.setHeader\s*\(\s*['"][Ll]ocation['"]\s*,\s*(?:req\.|request\.|searchParams|params\b|url\b|query\b|returnTo|callbackUrl|returnUrl|redirectUrl|destination))/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Validate redirect URLs against an allowlist of trusted domains.",
+        fixCode: '// Validate redirect URL\nconst ALLOWED_HOSTS = ["example.com"];\nconst target = searchParams.get("next") ?? "/";\ntry {\n  const url = new URL(target, request.url);\n  if (!ALLOWED_HOSTS.includes(url.hostname)) redirect("/");\n  redirect(url.pathname);\n} catch {\n  redirect("/");\n}',
+        compliance: ["SOC2:CC6.6"],
+    },
+    {
+        id: "VG410",
+        name: "Unauthorized Cache Revalidation",
+        severity: "medium",
+        owasp: "A01:2025 Broken Access Control",
+        description: "revalidateTag() or revalidatePath() is called in a route handler without authentication check. Anyone could trigger cache invalidation.",
+        pattern: /(?:GET|POST|PUT|DELETE)\s*\([\s\S]*?(?:revalidateTag|revalidatePath)\s*\([\s\S]*?(?![\s\S]*?(?:auth\s*\(|getServerSession|currentUser))/g,
+        languages: ["javascript", "typescript"],
+        fix: "Protect revalidation endpoints with authentication or a secret token.",
+        fixCode: 'import { auth } from "@clerk/nextjs/server";\n\nexport async function POST(req: Request) {\n  const { userId } = await auth();\n  if (!userId) return new Response("Unauthorized", { status: 401 });\n  revalidateTag("posts");\n  return Response.json({ revalidated: true });\n}',
+        compliance: ["SOC2:CC6.6"],
+    },
+    {
+        id: "VG411",
+        name: "NEXT_PUBLIC_ Secret Leak",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Environment variable prefixed with NEXT_PUBLIC_ contains a secret keyword (SECRET, KEY, PASSWORD, TOKEN). NEXT_PUBLIC_ variables are embedded in the client bundle and visible to anyone.",
+        pattern: /NEXT_PUBLIC_(?!\w*PUBLISHABLE)\w*(?:SECRET|_KEY|PASSWORD|TOKEN|PRIVATE|CREDENTIAL)\w*\s*=/gi,
+        languages: ["javascript", "typescript", "shell"],
+        fix: "Remove NEXT_PUBLIC_ prefix from secret variables. Access them only server-side.",
+        fixCode: "# .env.local — WRONG\n# NEXT_PUBLIC_SECRET_KEY=sk_live_xxx\n\n# .env.local — CORRECT\nSECRET_KEY=sk_live_xxx\n# Access server-side only: process.env.SECRET_KEY",
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req2.3", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG412",
+        name: "Server Action Returns Full Database Object",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Server Action returns a full database query result without field selection. Sensitive fields (passwordHash, internalNotes) get serialized to the client.",
+        pattern: /["']use server["'][\s\S]{0,1500}?\breturn\b[^\n;]{0,80}?(?:findUnique|findFirst|findMany)\s*\((?:(?!select\s*:)[\s\S])*?\)/g,
+        languages: ["javascript", "typescript"],
+        fix: "Always use select to return only needed fields from Server Actions.",
+        fixCode: '"use server";\nexport async function getUser(id: string) {\n  return prisma.user.findUnique({\n    where: { id },\n    select: { id: true, name: true, email: true },\n  });\n}',
+        compliance: ["SOC2:CC6.1", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG413",
+        name: "Next.js Missing serverActions.allowedOrigins",
+        severity: "high",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "Next.js config uses Server Actions but does not set serverActions.allowedOrigins. Without this, CSRF protection relies only on comparing Origin and Host headers — which can be bypassed behind reverse proxies or CDNs that strip or rewrite the Origin header.",
+        pattern: /(?:experimental\s*:\s*\{[\s\S]*?serverActions\s*:\s*\{|serverActions\s*:\s*\{)(?:(?!allowedOrigins)[\s\S]){5,}?\}/g,
+        languages: ["javascript", "typescript"],
+        fix: "Add serverActions.allowedOrigins to your next.config with your production domain(s).",
+        fixCode: '// next.config.ts\nexport default {\n  serverActions: {\n    allowedOrigins: ["myapp.com", "*.myapp.com"],\n  },\n};',
+        compliance: ["SOC2:CC6.6"],
+    },
+    {
+        id: "VG414",
+        name: "Server-Side Template Injection (SSTI)",
+        severity: "critical",
+        owasp: "A02:2025 Injection",
+        description: "User input is rendered using an unescaped template directive (EJS <%- %>, Handlebars {{{ }}}, Pug != operator, Nunjucks | safe filter). These directives bypass HTML escaping, allowing attackers to inject arbitrary HTML and JavaScript that executes server-side or client-side.",
+        pattern: /(?:<%-\s*\w|(?:\{\{\{)\s*\w|\|\s*safe\s*(?:\}\}|\%\}))/gi,
+        languages: ["javascript", "typescript", "html"],
+        fix: "Always use escaped template directives: EJS <%= %>, Handlebars {{ }}, Pug =. Only use unescaped rendering for trusted, developer-controlled content.",
+        fixCode: '<!-- EJS: use escaped output -->\n<p><%= userInput %></p>   <!-- SAFE: HTML-escaped -->\n<!-- NOT: <%- userInput %>  DANGEROUS: raw HTML -->\n\n<!-- Handlebars: use double braces -->\n<p>{{userInput}}</p>      <!-- SAFE: escaped -->\n<!-- NOT: {{{userInput}}}   DANGEROUS: raw HTML -->\n\n<!-- Pug: use = not != -->\np= userInput              //- SAFE: escaped\n//- NOT: p!= userInput    DANGEROUS: raw HTML',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG415",
+        name: "Cached Function Exposes User-Specific Data",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "A function marked with 'use cache' accesses user-specific data (auth, session, cookies, headers) but caches the result. Cached data is shared across all users, leaking one user's data to others.",
+        pattern: /["']use cache["'][\s\S]{0,800}?(?:auth\s*\(|getServerSession|currentUser|getUser|cookies\s*\(|headers\s*\()/g,
+        languages: ["javascript", "typescript"],
+        fix: "Do not access user-specific data inside cached functions. Pass user-independent parameters only, or use cacheTag with user-specific tags.",
+        fixCode: '// BAD: caches user-specific data\n"use cache";\nasync function getData() {\n  const { userId } = await auth(); // WRONG in cached fn!\n  return db.items.findMany({ where: { userId } });\n}\n\n// GOOD: cache only shared data\n"use cache";\nasync function getPublicPosts() {\n  return db.posts.findMany({ where: { published: true } });\n}',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG416",
+        name: "Cached Function Without Revalidation Strategy",
+        severity: "medium",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "A function marked with 'use cache' does not specify a cacheLife or cacheTag for revalidation. Without explicit revalidation, stale data may be served indefinitely, including outdated security-sensitive information.",
+        pattern: /["']use cache["'](?:(?!cacheLife|cacheTag|unstable_cache)[\s\S]){10,}?(?:return|export)/g,
+        languages: ["javascript", "typescript"],
+        fix: "Add cacheLife() or cacheTag() inside cached functions to control revalidation.",
+        fixCode: '"use cache";\nimport { cacheLife, cacheTag } from "next/cache";\n\nasync function getCachedData() {\n  cacheLife("hours");\n  cacheTag("data-feed");\n  return db.posts.findMany();\n}\n\n// Revalidate when data changes:\nimport { revalidateTag } from "next/cache";\nrevalidateTag("data-feed");',
+        compliance: ["SOC2:CC7.1"],
+    },
+    // ── RSC Header Middleware Bypass ─────────────────────────────────
+    {
+        id: "VG417",
+        name: "Next.js RSC/Prefetch Header Bypasses Middleware Auth",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Middleware skips auth checks when RSC: 1 or Next-Router-Prefetch header is present. Attackers can add these headers to any request to bypass authentication on protected routes.",
+        pattern: /(?:headers\.get\s*\(\s*["'](?:RSC|Next-Router-Prefetch|Next-Url)["']\s*\))[\s\S]{0,100}?(?:NextResponse\.next|return\s+NextResponse\.next|continue|return)/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Never skip auth checks based on RSC or prefetch headers. These headers are user-controllable and cannot be trusted for security decisions.",
+        fixCode: '// BAD: attackers can add RSC header to skip auth\nif (request.headers.get("RSC") === "1") {\n  return NextResponse.next(); // Auth bypassed!\n}\n\n// GOOD: always enforce auth regardless of headers\nconst { userId } = await auth();\nif (!userId && isProtectedRoute(pathname)) {\n  return NextResponse.redirect(new URL("/login", request.url));\n}',
+        compliance: ["SOC2:CC6.6"],
+    },
+];

package/dist/vendor/guardvibe/rules/other-services.d.ts

@@ -0,0 +1,2 @@
+import type { SecurityRule } from "./types.js";
+export declare const otherServiceRules: SecurityRule[];

package/dist/vendor/guardvibe/rules/other-services.js

@@ -0,0 +1,72 @@
+/*
+ * Vendored from GuardVibe — https://github.com/goklab/guardvibe
+ * Copyright 2026 GokLab. Licensed under the Apache License, Version 2.0.
+ * Full licence: LICENSES/guardvibe-Apache-2.0.txt
+ *
+ * Modifications by ClearToShip: import paths rewritten for this package
+ * layout. Rule content is unchanged; rules that duplicate ClearToShip's own
+ * AST checks are disabled at runtime in src/scanners/community.ts rather
+ * than deleted here, so this file stays a faithful copy of upstream.
+ */
+export const otherServiceRules = [
+    {
+        id: "VG800",
+        name: "Sentry Auth Token Exposure",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Sentry auth token exposed in client-side code or committed to source. Auth tokens grant full org access. Note: Sentry DSN is safe to expose publicly.",
+        pattern: /(?:SENTRY_AUTH_TOKEN\s*[:=]\s*["']?\w{10,}|["']sntrys_[A-Za-z0-9]{20,}["'])/g,
+        languages: ["javascript", "typescript", "shell"],
+        fix: "Use SENTRY_AUTH_TOKEN only in CI/CD environment. DSN is safe to be public.",
+        fixCode: '# .env.local (server only, for source maps upload)\nSENTRY_AUTH_TOKEN=sntrys_xxx\n\n# Safe to expose (DSN)\nNEXT_PUBLIC_SENTRY_DSN=https://abc@sentry.io/123',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG801",
+        name: "Twilio Auth Token Exposure",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Twilio auth token or API key hardcoded or exposed in client-side code. This allows sending SMS/calls from your account.",
+        pattern: /(?:["']use client["'][\s\S]{0,500}?(?:TWILIO_AUTH_TOKEN|TWILIO_API_SECRET)|(?:authToken|apiSecret)\s*[:=]\s*["'][a-f0-9]{32}["'])/g,
+        languages: ["javascript", "typescript"],
+        fix: "Use Twilio credentials server-side only. Validate phone numbers to prevent SMS injection.",
+        fixCode: '// Server-side only\nimport twilio from "twilio";\nconst client = twilio(process.env.TWILIO_ACCOUNT_SID, process.env.TWILIO_AUTH_TOKEN);\n\n// Validate phone number before sending\nconst phoneRegex = /^\\+[1-9]\\d{1,14}$/;\nif (!phoneRegex.test(to)) throw new Error("Invalid phone");',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG802",
+        name: "Neon/Postgres Connection String Exposure",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Neon or PostgreSQL connection string hardcoded in source code with embedded credentials (user:pass@host shape). Local/docker URIs without credentials (e.g. postgres://localhost/db) are not flagged.",
+        pattern: /(?:DATABASE_URL|connectionString|connection_string|pgConnectionString)\s*[:=]\s*["']postgres(?:ql)?:\/\/[^"'\s/@]*@[^"'\s]+["']/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Use DATABASE_URL environment variable. Never hardcode connection strings.",
+        fixCode: 'import { neon } from "@neondatabase/serverless";\nconst sql = neon(process.env.DATABASE_URL!);',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG803",
+        name: "Convex Deploy Key Exposure",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Convex deploy key or admin key hardcoded or exposed in client-side code. Deploy keys grant write access to your Convex backend.",
+        pattern: /(?:CONVEX_DEPLOY_KEY|["']use client["'][\s\S]{0,500}?CONVEX_ADMIN_KEY|(?:deployKey|adminKey)\s*[:=]\s*["'](?:prod|dev):[\w]+:[\w]+["'])/g,
+        languages: ["javascript", "typescript", "shell"],
+        fix: "Use CONVEX_DEPLOY_KEY only in CI/CD. Client-side should only use the public CONVEX_URL.",
+        fixCode: '# Client-safe\nNEXT_PUBLIC_CONVEX_URL=https://xxx.convex.cloud\n\n# Server/CI only\nCONVEX_DEPLOY_KEY=prod:xxx:yyy',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG804",
+        name: "MongoDB Connection String Exposure",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "MongoDB connection string hardcoded in source code with embedded credentials (user:pass@host shape). Local/docker URIs without credentials (e.g. mongodb://localhost/db) are not flagged.",
+        pattern: /(?:MONGODB_URI|MONGO_URL|mongoUri|mongoUrl|connectionString)\s*[:=]\s*["']mongodb(?:\+srv)?:\/\/[^"'\s/@]*@[^"'\s]+["']/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Use MONGODB_URI environment variable. Never hardcode connection strings.",
+        fixCode: 'import { MongoClient } from "mongodb";\nconst client = new MongoClient(process.env.MONGODB_URI!);',
+        compliance: ["SOC2:CC6.1"],
+    },
+];

package/dist/vendor/guardvibe/rules/payments.d.ts

@@ -0,0 +1,2 @@
+import type { SecurityRule } from "./types.js";
+export declare const paymentRules: SecurityRule[];

package/dist/vendor/guardvibe/rules/payments.js

@@ -0,0 +1,123 @@
+/*
+ * Vendored from GuardVibe — https://github.com/goklab/guardvibe
+ * Copyright 2026 GokLab. Licensed under the Apache License, Version 2.0.
+ * Full licence: LICENSES/guardvibe-Apache-2.0.txt
+ *
+ * Modifications by ClearToShip: import paths rewritten for this package
+ * layout. Rule content is unchanged; rules that duplicate ClearToShip's own
+ * AST checks are disabled at runtime in src/scanners/community.ts rather
+ * than deleted here, so this file stays a faithful copy of upstream.
+ */
+export const paymentRules = [
+    // Stripe
+    {
+        id: "VG600",
+        name: "Stripe Secret Key Client Exposure",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Stripe secret key (sk_live_ or sk_test_) exposed in client-side code. This key can charge any amount to any card.",
+        pattern: /["']use client["'][\s\S]{0,500}?sk_(?:live|test)_/g,
+        languages: ["javascript", "typescript"],
+        fix: "Never use Stripe secret keys in client code. Use them only in server-side API routes.",
+        fixCode: "// Server-side only (API route or Server Action)\nimport Stripe from 'stripe';\nconst stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);",
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req2.3"],
+    },
+    {
+        id: "VG601",
+        name: "Stripe Webhook Missing Signature Verification",
+        severity: "critical",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Stripe webhook endpoint processes events without verifying the webhook signature. Anyone can send fake payment events.",
+        pattern: /(?:\/api\/webhook|\/api\/stripe|webhook.*stripe)[\s\S]*?(?:req\.body|request\.json|JSON\.parse)[\s\S]{0,300}?(?![\s\S]{0,300}?(?:constructEvent|verifyHeader|stripe\.webhooks|svix\.verify|webhook\.verify|verify\w*Webhook|verifyWebhookSignature|wh\.verify|crypto\.timingSafeEqual|verifyQstashSignature|verifyQstash|verifySignature|verifyVercelSignature|Receiver\b|new\s+Webhook\b))/g,
+        languages: ["javascript", "typescript"],
+        fix: "Always verify Stripe webhook signatures using stripe.webhooks.constructEvent().",
+        fixCode: "// Verify webhook signature\nconst sig = request.headers.get('stripe-signature')!;\nconst event = stripe.webhooks.constructEvent(\n  body, sig, process.env.STRIPE_WEBHOOK_SECRET!\n);",
+        compliance: ["SOC2:CC6.6", "PCI-DSS:Req6.5.10"],
+    },
+    {
+        id: "VG602",
+        name: "Stripe Price Amount Client-Side",
+        severity: "high",
+        owasp: "A04:2025 Insecure Design",
+        description: "Price amount sent from client to server for payment. Users can modify the amount in browser DevTools.",
+        pattern: /(?:amount|price|total)\s*[:=]\s*(?:req\.body|request\.body|body\.)[\s\S]{0,100}?(?:stripe|payment|checkout|charge)/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Always calculate prices server-side. Use Stripe Price IDs or calculate from your database, never trust client-sent amounts.",
+        fixCode: "// Use Stripe Price IDs, not client amounts\nconst session = await stripe.checkout.sessions.create({\n  line_items: [{ price: 'price_xxx', quantity: 1 }], // Price ID from Stripe dashboard\n});",
+        compliance: ["PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG603",
+        name: "Hardcoded Stripe Key",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Stripe API key hardcoded in source code instead of environment variable.",
+        pattern: /(?:stripe|Stripe)\s*\(\s*["']sk_(?:live|test)_[A-Za-z0-9]{10,}["']/g,
+        languages: ["javascript", "typescript"],
+        fix: "Use environment variables for Stripe keys.",
+        fixCode: "const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);",
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req2.3"],
+    },
+    {
+        id: "VG604",
+        name: "NEXT_PUBLIC Stripe Secret Key",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Stripe secret key exposed via NEXT_PUBLIC_ prefix. Only the publishable key (pk_) should be public.",
+        pattern: /NEXT_PUBLIC_\w*STRIPE\w*SECRET/gi,
+        languages: ["javascript", "typescript", "shell"],
+        fix: "Remove NEXT_PUBLIC_ prefix from Stripe secret key. Only NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY should be public.",
+        fixCode: "# .env.local\nSTRIPE_SECRET_KEY=sk_live_xxx          # server only\nNEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_live_xxx  # safe to expose",
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req2.3"],
+    },
+    // LemonSqueezy
+    {
+        id: "VG605",
+        name: "LemonSqueezy API Key Exposure",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "LemonSqueezy API key exposed in client-side code.",
+        pattern: /["']use client["'][\s\S]{0,500}?(?:LEMONSQUEEZY_API_KEY|LEMON_SQUEEZY_API_KEY)/g,
+        languages: ["javascript", "typescript"],
+        fix: "Use LemonSqueezy API key only in server-side code.",
+        fixCode: '// Server-side only (API route)\nimport { lemonSqueezySetup } from "@lemonsqueezy/lemonsqueezy.js";\nlemonSqueezySetup({ apiKey: process.env.LEMONSQUEEZY_API_KEY! });',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG606",
+        name: "LemonSqueezy Webhook Missing Signature",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "LemonSqueezy webhook processes events without verifying the X-Signature header.",
+        pattern: /(?:lemonsqueezy|lemon.?squeezy)[\s\S]{0,500}?(?:req\.body|request\.json)[\s\S]{0,300}?(?![\s\S]{0,300}?(?:verify|signature|x-signature|hmac|crypto))/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Verify the X-Signature header using HMAC-SHA256 with your webhook secret.",
+        fixCode: "// Verify LemonSqueezy webhook\nimport crypto from 'crypto';\nconst sig = request.headers.get('x-signature');\nconst hash = crypto.createHmac('sha256', process.env.LEMON_SQUEEZY_WEBHOOK_SECRET!)\n  .update(body).digest('hex');\nif (sig !== hash) return new Response('Invalid', { status: 401 });",
+        compliance: ["SOC2:CC6.6"],
+    },
+    // Polar.sh
+    {
+        id: "VG607",
+        name: "Polar API Key Exposure",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Polar.sh API key or access token exposed in client-side code.",
+        pattern: /["']use client["'][\s\S]{0,500}?(?:POLAR_ACCESS_TOKEN|POLAR_API_KEY|polar.*(?:access_token|api_key))/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Use Polar API keys only in server-side code.",
+        fixCode: '// Server-side only\nimport { Polar } from "@polar-sh/sdk";\nconst polar = new Polar({ accessToken: process.env.POLAR_ACCESS_TOKEN! });',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG608",
+        name: "Payment Webhook Missing Auth",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Payment webhook endpoint has no signature verification or authentication. Attackers can fake payment confirmations.",
+        pattern: /(?:\/api\/webhook|\/api\/payment|\/api\/checkout)[\s\S]*?export\s+(?:async\s+)?function\s+POST\s*\([^)]*\)\s*\{(?:(?!verify|signature|constructEvent|hmac|crypto\.createHmac|webhookSecret)[\s\S])*?\}/g,
+        languages: ["javascript", "typescript"],
+        fix: "Always verify webhook signatures before processing payment events.",
+        fixCode: "// Verify webhook signature\nimport crypto from 'crypto';\nconst sig = request.headers.get('x-webhook-signature');\nconst expected = crypto.createHmac('sha256', process.env.WEBHOOK_SECRET!)\n  .update(body).digest('hex');\nif (sig !== expected) return new Response('Unauthorized', { status: 401 });",
+        compliance: ["SOC2:CC6.6", "PCI-DSS:Req6.5.10"],
+    },
+];

package/dist/vendor/guardvibe/rules/react-native.d.ts

@@ -0,0 +1,2 @@
+import type { SecurityRule } from "./types.js";
+export declare const reactNativeRules: SecurityRule[];

package/dist/vendor/guardvibe/rules/react-native.js

@@ -0,0 +1,132 @@
+/*
+ * Vendored from GuardVibe — https://github.com/goklab/guardvibe
+ * Copyright 2026 GokLab. Licensed under the Apache License, Version 2.0.
+ * Full licence: LICENSES/guardvibe-Apache-2.0.txt
+ *
+ * Modifications by ClearToShip: import paths rewritten for this package
+ * layout. Rule content is unchanged; rules that duplicate ClearToShip's own
+ * AST checks are disabled at runtime in src/scanners/community.ts rather
+ * than deleted here, so this file stays a faithful copy of upstream.
+ */
+export const reactNativeRules = [
+    {
+        id: "VG700",
+        name: "AsyncStorage Sensitive Data",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Storing secrets, tokens, or passwords in AsyncStorage. AsyncStorage is unencrypted plain text on device. Use expo-secure-store or react-native-keychain instead.",
+        pattern: /AsyncStorage\s*\.\s*(?:setItem|multiSet)\s*\(\s*["'][^"']*(?:token|secret|password|jwt|session|auth|apiKey|api_key|credential|refresh)["']/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Use expo-secure-store (Expo) or react-native-keychain (bare RN) for sensitive data.",
+        fixCode: 'import * as SecureStore from "expo-secure-store";\nawait SecureStore.setItemAsync("authToken", token);',
+        compliance: ["SOC2:CC6.1", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG701",
+        name: "Deep Link Auth Bypass",
+        severity: "high",
+        owasp: "A07:2025 Identification and Authentication Failures",
+        description: "Deep link handler processes authentication parameters (token, code, session) without validation. Attackers can craft malicious deep links to bypass auth.",
+        pattern: /(?:Linking\.addEventListener|useURL|createURL|expo-linking)[\s\S]{0,500}?(?:url|event)[\s\S]{0,300}?(?:token|code|session|auth)/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Validate deep link origin, verify tokens server-side, and never trust URL parameters for auth state.",
+        fixCode: '// Validate token from deep link server-side\nconst { token } = parseURL(url);\nconst res = await fetch("/api/verify-token", { method: "POST", body: JSON.stringify({ token }) });\nif (!res.ok) throw new Error("Invalid deep link token");',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG702",
+        name: "Expo Push Token Exposure",
+        severity: "high",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Expo push token logged or sent to client-side analytics. Push tokens can be abused to send spam notifications.",
+        pattern: /(?:console\.\w+|analytics|posthog|capture|track)\s*[\.\(][\s\S]{0,200}?(?:ExpoPushToken|expoPushToken|pushToken)/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Never log push tokens. Send them only to your own server over HTTPS.",
+        fixCode: '// Send push token securely to your server\nawait fetch("/api/register-push", {\n  method: "POST",\n  headers: { Authorization: `Bearer ${authToken}` },\n  body: JSON.stringify({ pushToken }),\n});',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG703",
+        name: "Hardcoded Secrets in EAS Config",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Hardcoded secrets, API keys, or tokens in eas.json or eas.config. These end up in version control.",
+        pattern: /(?:"env"|env\s*:\s*\{)[\s\S]{0,300}?(?:SECRET|TOKEN|API_KEY|PASSWORD|PRIVATE)\s*["']?\s*[:=]\s*["'][^"']{8,}["']/gi,
+        languages: ["json", "javascript", "typescript"],
+        fix: "Use EAS Secrets (eas secret:create) instead of hardcoding in eas.json.",
+        fixCode: '# Set secrets via EAS CLI\neas secret:create --name API_KEY --value "your-key" --scope project\n\n# Reference in eas.json\n{ "build": { "production": { "env": { "API_KEY": "eas-secret" } } } }',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG704",
+        name: "WebView JavaScript Injection",
+        severity: "critical",
+        owasp: "A03:2025 Injection",
+        description: "WebView loading untrusted URLs or injecting unvalidated JavaScript. This allows XSS and data theft from the app context.",
+        pattern: /(?:WebView|webview)\s*[\s\S]{0,300}?(?:injectedJavaScript|source\s*=\s*\{\s*\{\s*uri\s*:\s*(?:user|params|route|input|req|data|body)[\s\S]{0,100}?\}|javaScriptEnabled\s*=\s*\{?\s*true)/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Validate WebView URLs against an allowlist. Avoid injecting dynamic JavaScript. Disable JavaScript if not needed.",
+        fixCode: 'const ALLOWED_HOSTS = ["example.com", "docs.example.com"];\nconst url = new URL(inputUrl);\nif (!ALLOWED_HOSTS.includes(url.hostname)) throw new Error("Blocked URL");\n\n<WebView source={{ uri: url.toString() }} javaScriptEnabled={false} />',
+        compliance: ["SOC2:CC7.1"],
+    },
+    {
+        id: "VG705",
+        name: "Missing Certificate Pinning",
+        severity: "medium",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Network requests to API without certificate pinning. On mobile, this allows man-in-the-middle attacks on compromised networks.",
+        pattern: /(?:fetch|axios|http)\s*[\.\(][\s\S]{0,200}?(?:api\.|\/api\/)[\s\S]{0,300}?(?:Authorization|Bearer|token)/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Implement certificate pinning using react-native-ssl-pinning or expo-certificate-transparency.",
+        fixCode: '// Use react-native-ssl-pinning\nimport { fetch } from "react-native-ssl-pinning";\nconst res = await fetch("https://api.example.com/data", {\n  sslPinning: { certs: ["api-cert"] },\n  headers: { Authorization: `Bearer ${token}` },\n});',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req4"],
+    },
+    {
+        id: "VG706",
+        name: "Hardcoded API URL",
+        severity: "medium",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "API base URL hardcoded directly in source. This makes it hard to switch environments and may expose staging/internal endpoints.",
+        pattern: /(?:baseURL|apiUrl|API_URL|apiBase|BASE_URL)\s*[:=]\s*["']https?:\/\/(?!localhost)[^"']{5,}["']/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Use environment variables or app config for API URLs.",
+        fixCode: 'import Constants from "expo-constants";\nconst API_URL = Constants.expoConfig?.extra?.apiUrl ?? process.env.EXPO_PUBLIC_API_URL;',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG707",
+        name: "Disabled App Transport Security",
+        severity: "high",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "App Transport Security (ATS) disabled in iOS config, allowing insecure HTTP connections.",
+        pattern: /NSAppTransportSecurity[\s\S]{0,200}?NSAllowsArbitraryLoads[\s\S]{0,50}?(?:true|YES|<true\s*\/>)/gi,
+        languages: ["xml", "json", "javascript", "typescript"],
+        fix: "Do not disable ATS. If specific domains need HTTP, use NSExceptionDomains instead of blanket allow.",
+        fixCode: "<!-- Info.plist — allow HTTP only for specific domains -->\n<key>NSAppTransportSecurity</key>\n<dict>\n  <key>NSExceptionDomains</key>\n  <dict>\n    <key>legacy-api.example.com</key>\n    <dict>\n      <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key>\n      <true/>\n    </dict>\n  </dict>\n</dict>",
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req4"],
+    },
+    {
+        id: "VG708",
+        name: "Sensitive Data in Expo Config",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Secrets or API keys hardcoded in app.json, app.config.js, or app.config.ts. These are embedded in the app bundle and visible to anyone who decompiles the app.",
+        pattern: /(?:app\.json|app\.config\.[jt]s)[\s\S]{0,50}|(?:"extra"|extra\s*:\s*\{)[\s\S]{0,500}?(?:SECRET|PRIVATE_KEY|API_SECRET|DATABASE_URL|SERVICE_ACCOUNT)\s*[:=]\s*["'][^"']{8,}["']/gi,
+        languages: ["json", "javascript", "typescript"],
+        fix: "Use EXPO_PUBLIC_ prefix only for truly public values. Keep secrets server-side or in EAS Secrets.",
+        fixCode: '// app.config.ts — only public values in extra\nexport default {\n  extra: {\n    apiUrl: process.env.EXPO_PUBLIC_API_URL, // OK: public\n    // NEVER: apiSecret: process.env.API_SECRET\n  },\n};',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG709",
+        name: "React Native Bridge Sensitive Data",
+        severity: "high",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Sensitive data (tokens, keys, passwords) passed through React Native bridge/NativeModules without encryption. Bridge data can be intercepted on rooted/jailbroken devices.",
+        pattern: /NativeModules\.\w+\.\w+\s*\([\s\S]{0,200}?(?:token|secret|password|key|credential|jwt|session)/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Encrypt sensitive data before passing through the bridge. Use native secure storage instead.",
+        fixCode: '// Use secure storage instead of passing through bridge\nimport * as SecureStore from "expo-secure-store";\nawait SecureStore.setItemAsync("authToken", token);\n\n// Read securely\nconst token = await SecureStore.getItemAsync("authToken");',
+        compliance: ["SOC2:CC6.1"],
+    },
+];

package/dist/vendor/guardvibe/rules/services.d.ts

@@ -0,0 +1,2 @@
+import type { SecurityRule } from "./types.js";
+export declare const serviceRules: SecurityRule[];