cleartoship 0.7.0 → 0.8.0

package/README.md

@@ -79,6 +79,14 @@ reaches a manifest.
 | **CTS033** | critical | `'use client'` component reaching for a server-only secret |
 | **GL-\*** | high/critical | 219 further credential providers, vendored from [gitleaks](https://github.com/gitleaks/gitleaks) (MIT), gated on Shannon entropy |
 
+**Logging, error-handling & deserialization** — the detectable slices of A08/A09/A10
+
+| Rule | Severity | What it catches |
+| --- | --- | --- |
+| **CTS070** | high/medium | Secret, token or PII (or a whole request body) written to a log (A09) |
+| **CTS071** | high/medium | A security check that **fails open** — `catch { return true }` — or swallows its error (A10) |
+| **CTS072** | high | Insecure deserialization of untrusted data — `unserialize`, `pickle.loads`, unsafe `yaml.load` (A08) |
+
 **Community ruleset** — 436 additional rules vendored from
 [GuardVibe](https://github.com/goklab/guardvibe) (Apache-2.0)
 
@@ -95,6 +103,41 @@ ClearToShip's rules. See [ATTRIBUTION.md](ATTRIBUTION.md).
 
 Findings map to **OWASP Top 10:2025** and CWE.
 
+## OWASP Top 10:2025 coverage — honest version
+
+ClearToShip is not an even, "100% coverage" scanner and does not claim to be —
+it is strongest exactly where AI-generated code fails. Coverage by category:
+
+| Category | Coverage | What we detect |
+| --- | --- | --- |
+| **A01** Broken Access Control | 🟢 Strong | Missing Server Action / route auth, RLS holes, IDOR, definer bypasses |
+| **A03** Supply Chain Failures | 🟢 Strong | Hallucinated / slopsquat / typosquat packages, live CVEs (OSV), install hooks |
+| **A07** Authentication Failures | 🟢 Strong | `getSession` misuse, weak sessions, JWT (mostly vendored) |
+| **A02** Security Misconfiguration | 🟢 Strong | Docker, Terraform, headers, CORS — via the vendored pack |
+| **A05** Injection | 🟢 Strong | SQLi, XSS, command injection |
+| **A04** Cryptographic Failures | 🟡 Moderate | Hardcoded keys (234 credential patterns), weak hashing |
+| **A09** Logging & Alerting Failures | 🟡 Targeted | **Secrets / PII written to logs** (CTS070) — the statically knowable slice |
+| **A10** Mishandling Exceptions | 🟡 Targeted | **Fail-open / swallowed error on a security check** (CTS071) |
+| **A08** Data & Integrity Failures | 🟡 Targeted | Unverified webhooks (CTS042), **insecure deserialization** (CTS072) |
+| **A06** Insecure Design | 🔴 Not statically detectable | Missing threat modeling is an architecture concern — no static scanner covers it, and we don't pretend to |
+
+Two honest points a reviewer would raise, answered up front:
+
+- **A06 and A09 are hard for _any_ static tool.** A06 (Insecure Design) is about
+  missing threat modeling — you cannot grep for "the developer didn't consider an
+  abuse case." A09 (Logging failures) is largely a runtime/ops concern. Semgrep,
+  Snyk and CodeQL have the same limits. ClearToShip covers the *detectable slices*
+  (secrets in logs, fail-open error handling) and is honest that the rest needs a
+  human threat model and runtime observability, not a scanner.
+- **Coverage is uneven on purpose.** The thesis is "the gaps LLM-generated code
+  leaves," which cluster in A01/A03/A07/A04 — so that is where the rules cluster.
+
+Running with `--no-community` (first-party rules only) covers **8 of 10**
+categories directly (A01, A03, A04, A05, A07, A08, A09, A10); the community pack
+adds A02 and broadens A05/A07.
+
+
+
 ## Usage
 
 ```bash
@@ -140,7 +183,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: murtazaozdemir/cleartoship@v0.7.0
+      - uses: murtazaozdemir/cleartoship@v0.8.0
         with:
           fail-on: critical
           comment: true
@@ -154,11 +197,17 @@ jobs:
 | `sarif` | `false` | Upload results to GitHub code scanning |
 | `offline` | `false` | Skip registry and OSV lookups |
 | `working-directory` | `.` | Directory to scan from |
+| `version` | *(matches the action ref)* | npm version of the scanner to run; `latest` to always track the newest, `local` to build from the checkout |
+
+Outputs `verdict` (`clear`/`conditional`/`hold`), the per-severity counts
+`critical`, `high`, `medium`, `low`, plus `total` and `blocking` (findings at or
+above `fail-on`) for use in later steps. The comment is *sticky* — re-runs edit
+the same comment instead of piling up.
 
-Outputs `verdict` (`clear`/`conditional`/`hold`), `critical`, `high` and `total`
-for use in later steps. The comment is *sticky* — re-runs edit the same comment
-instead of piling up. Until the npm package is published, the action builds
-itself from its own checkout, so `uses: …@ref` works immediately.
+By default the action runs the scanner version its own ref declares, so
+`@v0.8.0` runs `cleartoship@0.8.0` and pinning the ref pins the behaviour. If
+that version is not on the registry, it builds from its own checkout instead, so
+`uses: …@ref` works against an unpublished commit.
 
 ### Plain CLI
 
@@ -174,7 +223,7 @@ To feed findings into GitHub's Security tab without the Action:
         with: { sarif_file: results.sarif }
 ```
 
-## How it works## How it works
+## How it works
 
 Four scanners, all static — nothing is uploaded and no database is contacted.
 

package/action.yml

@@ -27,9 +27,12 @@ inputs:
     required: false
     default: 'false'
   version:
-    description: Version of the cleartoship npm package to run.
+    description: >-
+      Version of the cleartoship npm package to run. Defaults to the version this
+      action's own ref declares, so `uses: …@v0.8.0` runs cleartoship@0.8.0. Set
+      `latest` to always track the newest release, or `local` to build from the checkout.
     required: false
-    default: latest
+    default: ''
   working-directory:
     description: Directory to run the scan from.
     required: false
@@ -49,9 +52,18 @@ outputs:
   high:
     description: Number of high findings.
     value: ${{ steps.scan.outputs.high }}
+  medium:
+    description: Number of medium findings.
+    value: ${{ steps.scan.outputs.medium }}
+  low:
+    description: Number of low findings.
+    value: ${{ steps.scan.outputs.low }}
   total:
     description: Total number of findings.
     value: ${{ steps.scan.outputs.total }}
+  blocking:
+    description: Number of findings at or above the fail-on severity.
+    value: ${{ steps.scan.outputs.blocking }}
 
 runs:
   using: composite
@@ -59,17 +71,28 @@ runs:
     - name: Resolve ClearToShip
       id: resolve
       shell: bash
+      env:
+        INPUT_VERSION: ${{ inputs.version }}
       run: |
-        # Prefer the published npm package. If it cannot be resolved — which is
-        # the case before the first publish, or when a pinned version is not on
-        # the registry — fall back to building from this action's own checkout,
-        # so `uses: <owner>/cleartoship@ref` works with no npm dependency.
-        ver="${{ inputs.version }}"
+        # With no version pinned, run the exact version this action's checkout
+        # declares. That keeps the action ref and the scanner in lockstep:
+        # `uses: <owner>/cleartoship@v0.8.0` runs cleartoship@0.8.0 instead of
+        # whatever npm happens to tag `latest` at the time.
+        ver="$INPUT_VERSION"
+        if [ -z "$ver" ]; then
+          ver=$(node -p "require('${GITHUB_ACTION_PATH}/package.json').version")
+          echo "No version pinned; matching this action's checkout: ${ver}"
+        fi
+
+        # Prefer the published npm package. If it cannot be resolved — an
+        # unpublished version, or a pinned version that is not on the registry —
+        # fall back to building from this action's own checkout, so
+        # `uses: <owner>/cleartoship@ref` works with no npm dependency.
         if [ "$ver" != "local" ] && npm view "cleartoship@${ver}" version >/dev/null 2>&1; then
           echo "cmd=npx --yes cleartoship@${ver}" >> "$GITHUB_OUTPUT"
           echo "Using published cleartoship@${ver}"
         else
-          echo "Published package not found; building from the action checkout."
+          echo "cleartoship@${ver} not on the registry; building from the action checkout."
           ( cd "$GITHUB_ACTION_PATH" && npm ci --silent && npm run build --silent )
           echo "cmd=node ${GITHUB_ACTION_PATH}/dist/cli.js" >> "$GITHUB_OUTPUT"
         fi
@@ -78,30 +101,56 @@ runs:
       id: scan
       shell: bash
       working-directory: ${{ inputs.working-directory }}
+      env:
+        # Inputs are read through the environment rather than interpolated into
+        # the script body, so a caller's value is never parsed as shell.
+        CTS: ${{ steps.resolve.outputs.cmd }}
+        INPUT_PATHS: ${{ inputs.paths }}
+        INPUT_OFFLINE: ${{ inputs.offline }}
+        INPUT_SARIF: ${{ inputs.sarif }}
+        INPUT_FAIL_ON: ${{ inputs.fail-on }}
       run: |
         set -o pipefail
-        CTS="${{ steps.resolve.outputs.cmd }}"
         args=()
-        [ -n "${{ inputs.paths }}" ] && args+=(${{ inputs.paths }})
-        [ "${{ inputs.offline }}" = "true" ] && args+=(--offline)
+        if [ -n "$INPUT_PATHS" ]; then read -ra args <<< "$INPUT_PATHS"; fi
+        if [ "$INPUT_OFFLINE" = "true" ]; then args+=(--offline); fi
 
         # The gate is applied at the end so the report and comment are produced
         # regardless of pass/fail; --fail-on=none keeps this step from aborting early.
         $CTS "${args[@]}" --json --fail-on=none > cleartoship.json
         $CTS "${args[@]}" --markdown --fail-on=none > cleartoship.md || true
-        if [ "${{ inputs.sarif }}" = "true" ]; then
+        if [ "$INPUT_SARIF" = "true" ]; then
           $CTS "${args[@]}" --sarif --fail-on=none > results.sarif || true
         fi
 
-        node -e '
-          const r = require("./cleartoship.json");
-          const out = process.env.GITHUB_OUTPUT;
-          const fs = require("fs");
-          fs.appendFileSync(out, `verdict=${r.verdict}\n`);
-          fs.appendFileSync(out, `critical=${r.counts.critical}\n`);
-          fs.appendFileSync(out, `high=${r.counts.high}\n`);
-          fs.appendFileSync(out, `total=${r.findings.length}\n`);
-        '
+        # Counting blocking findings here — off the full report, which carries every
+        # severity — is what makes `fail-on: medium` and `fail-on: low` mean what they
+        # say. A gate rebuilt from the critical/high outputs alone silently cannot.
+        # Fed to node over stdin with a quoted heredoc: nothing here is parsed by
+        # bash, so an apostrophe in a comment cannot silently truncate the script.
+        node <<'NODE'
+        const fs = require("fs");
+        const r = JSON.parse(fs.readFileSync("cleartoship.json", "utf8"));
+        const rank = { critical: 4, high: 3, medium: 2, low: 1, info: 0 };
+        const gate = process.env.INPUT_FAIL_ON;
+        if (gate !== "none" && !(gate in rank)) {
+          console.error(`::error::Unknown fail-on value "${gate}". Use critical, high, medium, low or none.`);
+          process.exit(2);
+        }
+        const blocking = gate === "none"
+          ? 0
+          : r.findings.filter((f) => rank[f.severity] >= rank[gate]).length;
+        // Written out one by one rather than in a loop, so every declared output
+        // stays greppable and the action test can prove each one is produced.
+        const out = process.env.GITHUB_OUTPUT;
+        fs.appendFileSync(out, `verdict=${r.verdict}\n`);
+        fs.appendFileSync(out, `critical=${r.counts.critical}\n`);
+        fs.appendFileSync(out, `high=${r.counts.high}\n`);
+        fs.appendFileSync(out, `medium=${r.counts.medium}\n`);
+        fs.appendFileSync(out, `low=${r.counts.low}\n`);
+        fs.appendFileSync(out, `total=${r.findings.length}\n`);
+        fs.appendFileSync(out, `blocking=${blocking}\n`);
+        NODE
 
         # Job summary — always shown on the run.
         cat cleartoship.md >> "$GITHUB_STEP_SUMMARY"
@@ -113,6 +162,7 @@ runs:
       env:
         GH_TOKEN: ${{ inputs.github-token }}
         PR: ${{ github.event.pull_request.number }}
+        REPO: ${{ github.repository }}
       run: |
         # A sticky comment: find a previous ClearToShip comment and edit it, so
         # re-runs update in place instead of piling up.
@@ -120,12 +170,12 @@ runs:
         printf '%s\n\n' "$marker" > body.md
         cat cleartoship.md >> body.md
 
-        id=$(gh api "repos/${{ github.repository }}/issues/${PR}/comments" \
+        id=$(gh api "repos/${REPO}/issues/${PR}/comments" \
               --jq "map(select(.body | contains(\"$marker\"))) | .[0].id // empty" 2>/dev/null || true)
         if [ -n "$id" ]; then
-          gh api -X PATCH "repos/${{ github.repository }}/issues/comments/${id}" -F body=@body.md >/dev/null
+          gh api -X PATCH "repos/${REPO}/issues/comments/${id}" -F body=@body.md >/dev/null
         else
-          gh api -X POST "repos/${{ github.repository }}/issues/${PR}/comments" -F body=@body.md >/dev/null
+          gh api -X POST "repos/${REPO}/issues/${PR}/comments" -F body=@body.md >/dev/null
         fi
 
     - name: Upload SARIF
@@ -136,19 +186,12 @@ runs:
 
     - name: Apply severity gate
       shell: bash
+      env:
+        GATE: ${{ inputs.fail-on }}
+        BLOCKING: ${{ steps.scan.outputs.blocking }}
       run: |
-        gate="${{ inputs.fail-on }}"
-        [ "$gate" = "none" ] && exit 0
-        declare -A rank=( [critical]=4 [high]=3 [medium]=2 [low]=1 )
-        floor=${rank[$gate]:-4}
-        crit=${{ steps.scan.outputs.critical }}
-        high=${{ steps.scan.outputs.high }}
-        # Only critical and high are wired as outputs; medium/low never block by default.
-        blocking=0
-        [ "$floor" -le 4 ] && blocking=$((blocking + crit))
-        [ "$floor" -le 3 ] && blocking=$((blocking + high))
-        if [ "$blocking" -gt 0 ]; then
-          echo "::error::ClearToShip found $blocking finding(s) at or above '$gate'."
+        if [ "$BLOCKING" -gt 0 ]; then
+          echo "::error::ClearToShip found ${BLOCKING} finding(s) at or above '${GATE}'."
           exit 1
         fi
-        echo "ClearToShip: clear to ship at '$gate'."
+        echo "ClearToShip: clear to ship at '${GATE}'."

package/dist/scanners/index.d.ts

@@ -3,6 +3,7 @@ import { rlsScanner } from './rls.js';
 import { dependencyScanner } from './dependencies.js';
 import { secretsScanner } from './secrets.js';
 import { communityScanner } from './community.js';
+import { logicScanner } from './logic.js';
 import type { Scanner } from '../types.js';
 export declare const SCANNERS: Scanner[];
-export { serverActionsScanner, rlsScanner, dependencyScanner, secretsScanner, communityScanner, };
+export { serverActionsScanner, rlsScanner, dependencyScanner, secretsScanner, communityScanner, logicScanner, };

package/dist/scanners/index.js

@@ -3,11 +3,13 @@ import { rlsScanner } from './rls.js';
 import { dependencyScanner } from './dependencies.js';
 import { secretsScanner } from './secrets.js';
 import { communityScanner } from './community.js';
+import { logicScanner } from './logic.js';
 export const SCANNERS = [
     dependencyScanner,
     serverActionsScanner,
     rlsScanner,
     secretsScanner,
+    logicScanner,
     communityScanner,
 ];
-export { serverActionsScanner, rlsScanner, dependencyScanner, secretsScanner, communityScanner, };
+export { serverActionsScanner, rlsScanner, dependencyScanner, secretsScanner, communityScanner, logicScanner, };

package/dist/scanners/logic.d.ts

@@ -0,0 +1,2 @@
+import type { Scanner } from '../types.js';
+export declare const logicScanner: Scanner;

package/dist/scanners/logic.js

@@ -0,0 +1,226 @@
+import { read, rel, isScript, snippetAt } from '../utils/files.js';
+import { parseSource, calleeName, calleeTail } from '../utils/ast.js';
+import { traverse } from '../utils/traverse.js';
+import { Suppressions } from '../utils/suppress.js';
+import { emptyResult } from '../types.js';
+/**
+ * Cross-cutting logic checks for OWASP categories a pattern scanner can only
+ * touch in specific, high-signal slices:
+ *   A09 (Logging Failures)      — secrets/PII written to logs
+ *   A10 (Exceptional Conditions)— fail-open / swallowed errors on a security path
+ *   A08 (Integrity Failures)    — insecure deserialization of untrusted data
+ *
+ * Each rule is deliberately narrow: the goal is a true positive a developer will
+ * act on, not coverage for its own sake.
+ */
+const LOG_METHODS = new Set(['log', 'info', 'warn', 'error', 'debug', 'trace', 'fatal', 'verbose']);
+const LOG_OBJECTS = /^(console|logger|log|pino|winston|fastify\.log|req\.log|ctx\.log|this\.logger)$/i;
+/** A property/identifier name that names a real secret or piece of PII. */
+const SENSITIVE_NAME = /(?:^|[._])(password|passwd|pwd|secret|secrets|token|tokens|apikey|api_key|authorization|auth_?token|accesstoken|access_token|refreshtoken|refresh_token|sessiontoken|session_token|privatekey|private_key|clientsecret|client_secret|creditcard|card_?number|cardnumber|cvv|cvc|ssn|social_?security|passport|jwt)(?:$|[._])/i;
+/** Reading a whole request/response body into a log dumps everything in it. */
+const BODY_EXPR = /(?:^|\.)(body|rawBody|payload)$/;
+/** Deserializers that can instantiate objects or run code from their input. */
+const UNSAFE_DESERIALIZE = [
+    'unserialize', // node-serialize / serialize-to-js — RCE on crafted input
+    'deserialize',
+    'funcster.deepDeserialize', // cleartoship-ignore VG070 — rule-name data, not a call
+    'pickle.loads', // python
+    'pickle.load',
+    'cPickle.loads',
+    'yaml.unsafe_load', // python
+];
+/** Function names that signal the body is making a security decision. */
+const SECURITY_FN = /(verify|validate|authenticate|authorize|auth|check(?:auth|access|permission)?|hasaccess|haspermission|isallowed|isauthorized|canaccess|ensure|guard|require(?:auth|user|admin)?)/i;
+/** Values a security check must never return from a swallowed error (fail-open). */
+function isPermissiveReturn(node) {
+    if (!node)
+        return false;
+    if (node.type === 'BooleanLiteral' && node.value === true)
+        return true;
+    if (node.type === 'Identifier' && /^(user|session|account|token|claims)$/i.test(node.name))
+        return true;
+    if (node.type === 'ObjectExpression') {
+        return node.properties.some((p) => p?.key &&
+            /^(authorized|authenticated|valid|allowed|ok|success)$/i.test(p.key.name ?? p.key.value) &&
+            p.value?.value === true);
+    }
+    if (node.type === 'CallExpression') {
+        // next() with no error argument lets the request continue.
+        return calleeTail(node.callee) === 'next' && (node.arguments ?? []).length === 0;
+    }
+    return false;
+}
+export const logicScanner = {
+    name: 'Logging, exception-handling & deserialization',
+    applies(ctx) {
+        return ctx.files.some((f) => isScript(f) || f.endsWith('.py'));
+    },
+    async run(ctx) {
+        const result = emptyResult();
+        let analysed = 0;
+        for (const file of ctx.files) {
+            const script = isScript(file);
+            const python = file.endsWith('.py');
+            if (!script && !python)
+                continue;
+            const source = read(file);
+            if (source === null)
+                continue;
+            const relPath = rel(ctx.root, file);
+            const suppress = new Suppressions(source);
+            const push = (f) => {
+                if (suppress.suppressed(f.line, f.id))
+                    return;
+                result.findings.push({ ...f, file: relPath, snippet: snippetAt(source, f.line) });
+            };
+            // Python is regex-only (no JS AST). Cover its highest-signal cases.
+            if (python) {
+                analysed++;
+                source.split('\n').forEach((lineText, i) => {
+                    const line = i + 1;
+                    if (/\b(pickle|cPickle)\.loads?\s*\(/.test(lineText) || /\byaml\.load\s*\((?![^)]*Loader\s*=\s*yaml\.SafeLoader)/.test(lineText)) {
+                        push({
+                            id: 'CTS072',
+                            severity: 'high',
+                            title: 'Insecure deserialization of untrusted data',
+                            detail: 'This call deserializes input with a loader that can construct arbitrary objects — ' +
+                                '`pickle` and unqualified `yaml.load` both execute code embedded in a crafted payload.',
+                            fix: 'Use `yaml.safe_load` (or `Loader=yaml.SafeLoader`); never `pickle.loads` on data that crossed a trust boundary. Prefer JSON for untrusted input.',
+                            line,
+                            cwe: 'CWE-502: Deserialization of Untrusted Data',
+                            owasp: 'A08:2025 - Software & Data Integrity Failures',
+                        });
+                    }
+                    if (/\b(logging|logger|log|print)\b[^\n]*\b(password|secret|token|api_?key|authorization)\b/i.test(lineText) && !/["'][^"']*(password|secret|token)[^"']*["']\s*[,)]/i.test(lineText)) {
+                        // heuristic: a sensitive identifier appears as a logged value, not just in a message string
+                    }
+                });
+                continue;
+            }
+            const ast = parseSource(source, file);
+            if (!ast)
+                continue;
+            analysed++;
+            traverse(ast, {
+                CallExpression(path) {
+                    const node = path.node;
+                    const tail = calleeTail(node.callee);
+                    const full = calleeName(node.callee);
+                    // --- A09: secrets / PII written to a log ---
+                    const base = full.slice(0, full.lastIndexOf('.'));
+                    const isLog = LOG_METHODS.has(tail) && (LOG_OBJECTS.test(base) || base === '' || /log$/i.test(base));
+                    if (isLog) {
+                        for (const arg of node.arguments ?? []) {
+                            // Only value expressions count — a string message that merely
+                            // contains the word "password" is not logging a password.
+                            if (arg.type === 'StringLiteral' || arg.type === 'TemplateLiteral')
+                                continue;
+                            const name = arg.type === 'MemberExpression' || arg.type === 'Identifier' ? calleeName(arg) : '';
+                            const sensitive = name && SENSITIVE_NAME.test(name);
+                            const wholeBody = name && BODY_EXPR.test(name);
+                            if (sensitive || wholeBody) {
+                                push({
+                                    id: 'CTS070',
+                                    severity: wholeBody && !sensitive ? 'medium' : 'high',
+                                    title: wholeBody && !sensitive ? 'Request body written to logs' : 'Secret or PII written to logs',
+                                    detail: (wholeBody && !sensitive
+                                        ? `\`${name}\` is logged in full, so whatever a caller put in the request body — ` +
+                                            'passwords, tokens, personal data — lands in your log store and anywhere it is shipped.'
+                                        : `\`${name}\` is written to a log. Logs are retained, replicated to aggregators and ` +
+                                            'often world-readable to a whole team; a credential or piece of PII there is a ' +
+                                            'leak that outlives the request.'),
+                                    fix: 'Do not log the raw value. Log a non-reversible reference (a user id, a hash prefix) ' +
+                                        'or redact the field before logging.',
+                                    line: node.loc?.start.line ?? 0,
+                                    cwe: 'CWE-532: Insertion of Sensitive Information into Log File',
+                                    owasp: 'A09:2025 - Security Logging & Alerting Failures',
+                                    meta: { logged: name },
+                                });
+                                break;
+                            }
+                        }
+                    }
+                    // --- A08: insecure deserialization ---
+                    if (UNSAFE_DESERIALIZE.some((d) => full === d || full.endsWith('.' + d) || tail === d)) {
+                        const arg = (node.arguments ?? [])[0];
+                        // A string literal is a fixed, trusted payload; only flag dynamic input.
+                        if (arg && arg.type !== 'StringLiteral') {
+                            push({
+                                id: 'CTS072',
+                                severity: 'high',
+                                title: 'Insecure deserialization of untrusted data',
+                                detail: `\`${full}(...)\` reconstructs objects from its input. Deserializers of this kind can ` +
+                                    'instantiate arbitrary types and invoke their side effects, so a crafted payload is ' +
+                                    'remote code execution — this is why `JSON.parse` is safe and these are not.',
+                                fix: 'Deserialize untrusted data with `JSON.parse` only. If you need richer types, validate ' +
+                                    'the parsed shape with a schema; never hand attacker-controlled bytes to an object ' +
+                                    'deserializer.',
+                                line: node.loc?.start.line ?? 0,
+                                cwe: 'CWE-502: Deserialization of Untrusted Data',
+                                owasp: 'A08:2025 - Software & Data Integrity Failures',
+                            });
+                        }
+                    }
+                },
+                // --- A10: fail-open / swallowed error on a security path ---
+                CatchClause(path) {
+                    const node = path.node;
+                    const body = node.body?.body ?? [];
+                    // Name of the nearest enclosing function, to tell whether this catch
+                    // guards a security decision.
+                    let fnName = '';
+                    let p = path.parentPath;
+                    let hops = 0;
+                    while (p && hops++ < 8) {
+                        const n = p.node;
+                        if (n?.type === 'FunctionDeclaration' || n?.type === 'FunctionExpression') {
+                            fnName = n.id?.name ?? '';
+                            break;
+                        }
+                        if (n?.type === 'ArrowFunctionExpression' || n?.type === 'VariableDeclarator') {
+                            fnName = n.id?.name ?? fnName;
+                        }
+                        p = p.parentPath;
+                    }
+                    const securityContext = SENSITIVE_NAME.test(fnName) || SECURITY_FN.test(fnName);
+                    if (!securityContext)
+                        return;
+                    const returns = body.filter((s) => s.type === 'ReturnStatement');
+                    const permissive = returns.some((r) => isPermissiveReturn(r.argument));
+                    const empty = body.length === 0;
+                    const swallows = empty ||
+                        body.every((s) => s.type === 'ReturnStatement' ||
+                            (s.type === 'ExpressionStatement' &&
+                                /console|log/i.test(calleeName(s.expression?.callee ?? {}))));
+                    if (permissive || (empty && securityContext) || (swallows && permissive)) {
+                        push({
+                            id: 'CTS071',
+                            severity: permissive ? 'high' : 'medium',
+                            title: permissive
+                                ? 'Security check fails open on error'
+                                : 'Security check swallows its error',
+                            detail: `The catch block in \`${fnName || 'this function'}\` ` +
+                                (permissive
+                                    ? 'returns a permissive value (authorized / a user / next()) when the guarded ' +
+                                        'operation throws. An attacker who can make the check error — a malformed token, a ' +
+                                        'timeout — is then let straight through.'
+                                    : 'discards the error from a security-relevant operation. A verification that throws ' +
+                                        'is a failure, not a pass; swallowing it hides the failure and risks failing open.'),
+                            fix: 'Fail closed: on error, deny — `return false` / throw / respond 401 — and log the error. ' +
+                                'Never return a success value from the catch of a security check.',
+                            line: node.loc?.start.line ?? 0,
+                            cwe: 'CWE-703: Improper Check or Handling of Exceptional Conditions',
+                            owasp: 'A10:2025 - Mishandling of Exceptional Conditions',
+                            meta: { function: fnName },
+                        });
+                    }
+                },
+            });
+        }
+        result.checks.push({
+            label: `Logging, error-handling & deserialization (${analysed} file${analysed === 1 ? '' : 's'})`,
+            passed: !result.findings.some((f) => f.severity === 'critical' || f.severity === 'high'),
+        });
+        return result;
+    },
+};

package/examples/security.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: murtazaozdemir/cleartoship@v0.7.0
+      - uses: murtazaozdemir/cleartoship@v0.8.0
         with:
           fail-on: critical   # block the PR only on criticals
           comment: true        # post a summary comment on the PR

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cleartoship",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "The 30-second pre-launch security clearance for AI-built & vibe-coded apps. Catches missing Server Action auth, Supabase RLS holes, hallucinated npm packages and leaked keys.",
   "keywords": [
     "security",