cleartoship 0.7.0 → 0.9.0

package/dist/scanners/logic.js

@@ -0,0 +1,226 @@
+import { read, rel, isScript, snippetAt } from '../utils/files.js';
+import { parseSource, calleeName, calleeTail } from '../utils/ast.js';
+import { traverse } from '../utils/traverse.js';
+import { Suppressions } from '../utils/suppress.js';
+import { emptyResult } from '../types.js';
+/**
+ * Cross-cutting logic checks for OWASP categories a pattern scanner can only
+ * touch in specific, high-signal slices:
+ *   A09 (Logging Failures)      — secrets/PII written to logs
+ *   A10 (Exceptional Conditions)— fail-open / swallowed errors on a security path
+ *   A08 (Integrity Failures)    — insecure deserialization of untrusted data
+ *
+ * Each rule is deliberately narrow: the goal is a true positive a developer will
+ * act on, not coverage for its own sake.
+ */
+const LOG_METHODS = new Set(['log', 'info', 'warn', 'error', 'debug', 'trace', 'fatal', 'verbose']);
+const LOG_OBJECTS = /^(console|logger|log|pino|winston|fastify\.log|req\.log|ctx\.log|this\.logger)$/i;
+/** A property/identifier name that names a real secret or piece of PII. */
+const SENSITIVE_NAME = /(?:^|[._])(password|passwd|pwd|secret|secrets|token|tokens|apikey|api_key|authorization|auth_?token|accesstoken|access_token|refreshtoken|refresh_token|sessiontoken|session_token|privatekey|private_key|clientsecret|client_secret|creditcard|card_?number|cardnumber|cvv|cvc|ssn|social_?security|passport|jwt)(?:$|[._])/i;
+/** Reading a whole request/response body into a log dumps everything in it. */
+const BODY_EXPR = /(?:^|\.)(body|rawBody|payload)$/;
+/** Deserializers that can instantiate objects or run code from their input. */
+const UNSAFE_DESERIALIZE = [
+    'unserialize', // node-serialize / serialize-to-js — RCE on crafted input
+    'deserialize',
+    'funcster.deepDeserialize', // cleartoship-ignore VG070 — rule-name data, not a call
+    'pickle.loads', // python
+    'pickle.load',
+    'cPickle.loads',
+    'yaml.unsafe_load', // python
+];
+/** Function names that signal the body is making a security decision. */
+const SECURITY_FN = /(verify|validate|authenticate|authorize|auth|check(?:auth|access|permission)?|hasaccess|haspermission|isallowed|isauthorized|canaccess|ensure|guard|require(?:auth|user|admin)?)/i;
+/** Values a security check must never return from a swallowed error (fail-open). */
+function isPermissiveReturn(node) {
+    if (!node)
+        return false;
+    if (node.type === 'BooleanLiteral' && node.value === true)
+        return true;
+    if (node.type === 'Identifier' && /^(user|session|account|token|claims)$/i.test(node.name))
+        return true;
+    if (node.type === 'ObjectExpression') {
+        return node.properties.some((p) => p?.key &&
+            /^(authorized|authenticated|valid|allowed|ok|success)$/i.test(p.key.name ?? p.key.value) &&
+            p.value?.value === true);
+    }
+    if (node.type === 'CallExpression') {
+        // next() with no error argument lets the request continue.
+        return calleeTail(node.callee) === 'next' && (node.arguments ?? []).length === 0;
+    }
+    return false;
+}
+export const logicScanner = {
+    name: 'Logging, exception-handling & deserialization',
+    applies(ctx) {
+        return ctx.files.some((f) => isScript(f) || f.endsWith('.py'));
+    },
+    async run(ctx) {
+        const result = emptyResult();
+        let analysed = 0;
+        for (const file of ctx.files) {
+            const script = isScript(file);
+            const python = file.endsWith('.py');
+            if (!script && !python)
+                continue;
+            const source = read(file);
+            if (source === null)
+                continue;
+            const relPath = rel(ctx.root, file);
+            const suppress = new Suppressions(source);
+            const push = (f) => {
+                if (suppress.suppressed(f.line, f.id))
+                    return;
+                result.findings.push({ ...f, file: relPath, snippet: snippetAt(source, f.line) });
+            };
+            // Python is regex-only (no JS AST). Cover its highest-signal cases.
+            if (python) {
+                analysed++;
+                source.split('\n').forEach((lineText, i) => {
+                    const line = i + 1;
+                    if (/\b(pickle|cPickle)\.loads?\s*\(/.test(lineText) || /\byaml\.load\s*\((?![^)]*Loader\s*=\s*yaml\.SafeLoader)/.test(lineText)) {
+                        push({
+                            id: 'CTS072',
+                            severity: 'high',
+                            title: 'Insecure deserialization of untrusted data',
+                            detail: 'This call deserializes input with a loader that can construct arbitrary objects — ' +
+                                '`pickle` and unqualified `yaml.load` both execute code embedded in a crafted payload.',
+                            fix: 'Use `yaml.safe_load` (or `Loader=yaml.SafeLoader`); never `pickle.loads` on data that crossed a trust boundary. Prefer JSON for untrusted input.',
+                            line,
+                            cwe: 'CWE-502: Deserialization of Untrusted Data',
+                            owasp: 'A08:2025 - Software & Data Integrity Failures',
+                        });
+                    }
+                    if (/\b(logging|logger|log|print)\b[^\n]*\b(password|secret|token|api_?key|authorization)\b/i.test(lineText) && !/["'][^"']*(password|secret|token)[^"']*["']\s*[,)]/i.test(lineText)) {
+                        // heuristic: a sensitive identifier appears as a logged value, not just in a message string
+                    }
+                });
+                continue;
+            }
+            const ast = parseSource(source, file);
+            if (!ast)
+                continue;
+            analysed++;
+            traverse(ast, {
+                CallExpression(path) {
+                    const node = path.node;
+                    const tail = calleeTail(node.callee);
+                    const full = calleeName(node.callee);
+                    // --- A09: secrets / PII written to a log ---
+                    const base = full.slice(0, full.lastIndexOf('.'));
+                    const isLog = LOG_METHODS.has(tail) && (LOG_OBJECTS.test(base) || base === '' || /log$/i.test(base));
+                    if (isLog) {
+                        for (const arg of node.arguments ?? []) {
+                            // Only value expressions count — a string message that merely
+                            // contains the word "password" is not logging a password.
+                            if (arg.type === 'StringLiteral' || arg.type === 'TemplateLiteral')
+                                continue;
+                            const name = arg.type === 'MemberExpression' || arg.type === 'Identifier' ? calleeName(arg) : '';
+                            const sensitive = name && SENSITIVE_NAME.test(name);
+                            const wholeBody = name && BODY_EXPR.test(name);
+                            if (sensitive || wholeBody) {
+                                push({
+                                    id: 'CTS070',
+                                    severity: wholeBody && !sensitive ? 'medium' : 'high',
+                                    title: wholeBody && !sensitive ? 'Request body written to logs' : 'Secret or PII written to logs',
+                                    detail: (wholeBody && !sensitive
+                                        ? `\`${name}\` is logged in full, so whatever a caller put in the request body — ` +
+                                            'passwords, tokens, personal data — lands in your log store and anywhere it is shipped.'
+                                        : `\`${name}\` is written to a log. Logs are retained, replicated to aggregators and ` +
+                                            'often world-readable to a whole team; a credential or piece of PII there is a ' +
+                                            'leak that outlives the request.'),
+                                    fix: 'Do not log the raw value. Log a non-reversible reference (a user id, a hash prefix) ' +
+                                        'or redact the field before logging.',
+                                    line: node.loc?.start.line ?? 0,
+                                    cwe: 'CWE-532: Insertion of Sensitive Information into Log File',
+                                    owasp: 'A09:2025 - Security Logging & Alerting Failures',
+                                    meta: { logged: name },
+                                });
+                                break;
+                            }
+                        }
+                    }
+                    // --- A08: insecure deserialization ---
+                    if (UNSAFE_DESERIALIZE.some((d) => full === d || full.endsWith('.' + d) || tail === d)) {
+                        const arg = (node.arguments ?? [])[0];
+                        // A string literal is a fixed, trusted payload; only flag dynamic input.
+                        if (arg && arg.type !== 'StringLiteral') {
+                            push({
+                                id: 'CTS072',
+                                severity: 'high',
+                                title: 'Insecure deserialization of untrusted data',
+                                detail: `\`${full}(...)\` reconstructs objects from its input. Deserializers of this kind can ` +
+                                    'instantiate arbitrary types and invoke their side effects, so a crafted payload is ' +
+                                    'remote code execution — this is why `JSON.parse` is safe and these are not.',
+                                fix: 'Deserialize untrusted data with `JSON.parse` only. If you need richer types, validate ' +
+                                    'the parsed shape with a schema; never hand attacker-controlled bytes to an object ' +
+                                    'deserializer.',
+                                line: node.loc?.start.line ?? 0,
+                                cwe: 'CWE-502: Deserialization of Untrusted Data',
+                                owasp: 'A08:2025 - Software & Data Integrity Failures',
+                            });
+                        }
+                    }
+                },
+                // --- A10: fail-open / swallowed error on a security path ---
+                CatchClause(path) {
+                    const node = path.node;
+                    const body = node.body?.body ?? [];
+                    // Name of the nearest enclosing function, to tell whether this catch
+                    // guards a security decision.
+                    let fnName = '';
+                    let p = path.parentPath;
+                    let hops = 0;
+                    while (p && hops++ < 8) {
+                        const n = p.node;
+                        if (n?.type === 'FunctionDeclaration' || n?.type === 'FunctionExpression') {
+                            fnName = n.id?.name ?? '';
+                            break;
+                        }
+                        if (n?.type === 'ArrowFunctionExpression' || n?.type === 'VariableDeclarator') {
+                            fnName = n.id?.name ?? fnName;
+                        }
+                        p = p.parentPath;
+                    }
+                    const securityContext = SENSITIVE_NAME.test(fnName) || SECURITY_FN.test(fnName);
+                    if (!securityContext)
+                        return;
+                    const returns = body.filter((s) => s.type === 'ReturnStatement');
+                    const permissive = returns.some((r) => isPermissiveReturn(r.argument));
+                    const empty = body.length === 0;
+                    const swallows = empty ||
+                        body.every((s) => s.type === 'ReturnStatement' ||
+                            (s.type === 'ExpressionStatement' &&
+                                /console|log/i.test(calleeName(s.expression?.callee ?? {}))));
+                    if (permissive || (empty && securityContext) || (swallows && permissive)) {
+                        push({
+                            id: 'CTS071',
+                            severity: permissive ? 'high' : 'medium',
+                            title: permissive
+                                ? 'Security check fails open on error'
+                                : 'Security check swallows its error',
+                            detail: `The catch block in \`${fnName || 'this function'}\` ` +
+                                (permissive
+                                    ? 'returns a permissive value (authorized / a user / next()) when the guarded ' +
+                                        'operation throws. An attacker who can make the check error — a malformed token, a ' +
+                                        'timeout — is then let straight through.'
+                                    : 'discards the error from a security-relevant operation. A verification that throws ' +
+                                        'is a failure, not a pass; swallowing it hides the failure and risks failing open.'),
+                            fix: 'Fail closed: on error, deny — `return false` / throw / respond 401 — and log the error. ' +
+                                'Never return a success value from the catch of a security check.',
+                            line: node.loc?.start.line ?? 0,
+                            cwe: 'CWE-703: Improper Check or Handling of Exceptional Conditions',
+                            owasp: 'A10:2025 - Mishandling of Exceptional Conditions',
+                            meta: { function: fnName },
+                        });
+                    }
+                },
+            });
+        }
+        result.checks.push({
+            label: `Logging, error-handling & deserialization (${analysed} file${analysed === 1 ? '' : 's'})`,
+            passed: !result.findings.some((f) => f.severity === 'critical' || f.severity === 'high'),
+        });
+        return result;
+    },
+};

package/dist/scanners/server-actions.js

@@ -1,6 +1,8 @@
 import { read, rel, isScript, snippetAt } from '../utils/files.js';
 import { parseSource, calleeName, calleeTail, hasDirective } from '../utils/ast.js';
 import { traverse } from '../utils/traverse.js';
+import { buildModuleIndex } from '../utils/modules.js';
+import { authNamesFor } from './auth-helpers.js';
 import { Suppressions } from '../utils/suppress.js';
 import { emptyResult } from '../types.js';
 /**
@@ -14,6 +16,11 @@ const AUTH_CALLS = [
     'getAuth', 'validateRequest', 'verifySession', 'requireUser', 'requireAuth',
     'requireSession', 'assertAuthenticated', 'getCurrentUser', 'getLoggedInUser',
     'getToken', 'verifyToken', 'verifyIdToken', 'protect', 'ensureUser',
+    // Framework primitives that verify a signed session token rather than read
+    // one: Shopify App Bridge's session-token exchange, Shopify Remix's
+    // `authenticate.admin(request)`, and jose's JWT verification.
+    'session.decodeSessionToken', 'decodeSessionToken', 'authenticate.admin',
+    'authenticate.public', 'authenticate.flow', 'jwtVerify', 'verifyJWT', 'verifyJwt',
 ];
 /** Higher-order wrappers that apply auth (and often validation) for the action. */
 const AUTH_WRAPPERS = [
@@ -52,17 +59,93 @@ const SIGNATURE_CHECKS = [
  * "unverified webhook" check.
  */
 const SIGNATURE_HEADERS = /(x-shopify-hmac-sha256|x-hub-signature(-256)?|stripe-signature|svix-signature|svix-id|x-signature|x-webhook-signature|x-slack-signature|x-line-signature|paypal-transmission-sig)/i;
+/**
+ * Headers that exist to carry a caller credential. Reading one *and* comparing
+ * it against a server-side secret is how a cron or machine-to-machine endpoint
+ * authenticates — there is no session to look up.
+ */
+const CREDENTIAL_HEADERS = /^(authorization|proxy-authorization|x-api-key|x-apikey|api-key|x-auth-token|x-access-token|x-cron-secret|x-webhook-secret|x-admin-key|x-internal-token)$/i;
+/** `process.env.SOMETHING_SECRET` and friends — the other half of that check. */
+const SECRET_ENV = /^process\.env\.[A-Z0-9_]*(SECRET|TOKEN|KEY|PASSWORD|PASS)[A-Z0-9_]*$/;
+/**
+ * Calls that only build the HTTP response. A handler whose body contains
+ * nothing else is a static responder — a health check — with no work to trigger.
+ */
+const RESPONSE_CALLS = /^(NextResponse\.(json|redirect|next|rewrite)|Response\.(json|redirect|error)|json|res\.(json|send|status))$/;
+/**
+ * Reading the request body. Anchored on the receiver so `NextResponse.json(...)`
+ * — which writes the response — is not mistaken for reading the request.
+ */
+const REQUEST_INPUT_READ = /(^|\.)(req|request|nextRequest|_req|_request)\??\.(json|text|formData|arrayBuffer|blob)$/i;
 /** Schema escape hatches that make validation decorative. */
 const LOOSE_SCHEMA = /\.passthrough\s*\(|z\s*\.\s*(any|unknown)\s*\(|\.catchall\s*\(/g;
 const SERVICE_ROLE_HINTS = [
     'SUPABASE_SERVICE_ROLE_KEY', 'SUPABASE_SERVICE_KEY', 'SERVICE_ROLE_KEY',
     'SUPABASE_SECRET_KEY',
 ];
-/** Identifiers that plausibly carry the authenticated principal's id. */
+/**
+ * Dotted expressions that plausibly carry the authenticated principal's id.
+ * The principal is not always a person: in a B2B or platform app it is the
+ * tenant — a store, org, workspace or team — and a write scoped to it is
+ * scoped just as tightly as one scoped to a user id.
+ */
 const OWNER_HINTS = [
     'user.id', 'user?.id', 'session.user.id', 'userId', 'user_id', 'auth.uid',
     'currentUser.id', 'ctx.user', 'claims.sub', 'uid',
+    'store.id', 'shop.id', 'org.id', 'organization.id', 'tenant.id', 'workspace.id',
+    'account.id', 'team.id', 'company.id', 'session.shop', 'session.shopDomain',
 ];
+/** Bare identifiers carrying that same principal. */
+const OWNER_IDENTIFIERS = new Set([
+    'userId', 'user_id', 'ownerId', 'owner_id', 'shop', 'shopDomain', 'shop_domain',
+    'storeId', 'store_id', 'orgId', 'org_id', 'organizationId', 'organization_id',
+    'tenantId', 'tenant_id', 'workspaceId', 'workspace_id', 'accountId', 'account_id',
+    'teamId', 'team_id', 'companyId', 'company_id',
+]);
+/** Names bound by a function's own parameter list, destructuring included. */
+function parameterNames(params) {
+    const names = new Set();
+    const visit = (node, depth = 0) => {
+        if (!node || depth > 8)
+            return;
+        switch (node.type) {
+            case 'Identifier':
+                names.add(node.name);
+                return;
+            case 'AssignmentPattern':
+                visit(node.left, depth + 1);
+                return;
+            case 'RestElement':
+                visit(node.argument, depth + 1);
+                return;
+            case 'ObjectPattern':
+                for (const prop of node.properties ?? []) {
+                    visit(prop.type === 'ObjectProperty' ? prop.value : prop, depth + 1);
+                }
+                return;
+            case 'ArrayPattern':
+                for (const el of node.elements ?? [])
+                    visit(el, depth + 1);
+                return;
+            default:
+                return;
+        }
+    };
+    for (const p of params ?? [])
+        visit(p);
+    return names;
+}
+/** Root identifier of `a.b.c` — the binding the expression reads from. */
+function rootObject(node) {
+    let cur = node;
+    let guard = 0;
+    while (cur && guard++ < 16) {
+        if (cur.type === 'Identifier')
+            return cur.name;
+        cur = cur.object ?? cur.expression ?? cur.argument;
+    }
+    return null;
+}
 function matchesAny(name, list) {
     for (const candidate of list) {
         if (name === candidate || name.endsWith('.' + candidate))
@@ -70,7 +153,9 @@ function matchesAny(name, list) {
     }
     return false;
 }
-function analyseFunction(path, name) {
+function analyseFunction(path, name, 
+/** Names that stand for an auth check in this file — see ./auth-helpers.ts. */
+credited) {
     const node = path.node;
     const info = {
         name,
@@ -88,10 +173,27 @@ function analyseFunction(path, name) {
         spreadLine: null,
         looseSchemaLine: null,
         readsAuthHeader: false,
+        readsCredentialHeader: false,
+        readsSecretEnv: false,
+        workCalls: 0,
+        // A Server Action's arguments *are* its input; a Route Handler has to go
+        // and read one, so that is detected below.
+        readsRequestInput: false,
     };
+    // An id the caller passed in is not proof of ownership — it is the IDOR.
+    // Only a principal resolved inside the function counts as scoping.
+    const params = parameterNames(node.params ?? []);
+    // `export async function GET(_req, { params })` — the segment values are
+    // caller-supplied input just as much as a body is.
+    if (params.has('params'))
+        info.readsRequestInput = true;
     const inspect = (inner) => {
         const full = calleeName(inner.node.callee);
         const tail = calleeTail(inner.node.callee);
+        if (!RESPONSE_CALLS.test(full))
+            info.workCalls++;
+        if (REQUEST_INPUT_READ.test(full))
+            info.readsRequestInput = true;
         // `supabase.auth.getSession()` reads the cookie without asking the auth
         // server whether the token is still valid, so it proves nothing on the
         // server. It must not satisfy the auth check via the generic `getSession`
@@ -103,6 +205,14 @@ function analyseFunction(path, name) {
         else if (matchesAny(full, AUTH_CALLS)) {
             info.hasAuth = true;
         }
+        else if (credited.has(full)) {
+            // The check lives in a first-party helper this file imports, or one
+            // defined above in the same file. Matched on the whole callee name, not
+            // its tail: a helper is called by the name this file binds it to, and
+            // crediting `crypto.verify()` because some other module exports a
+            // `verify` helper would hide a real finding.
+            info.hasAuth = true;
+        }
         if (matchesAny(full, AUTH_WRAPPERS))
             info.hasAuth = true;
         if (matchesAny(full, SIGNATURE_CHECKS))
@@ -135,8 +245,12 @@ function analyseFunction(path, name) {
         // Reading a webhook-signature header counts as participating in
         // verification (see SIGNATURE_HEADERS).
         for (const arg of inner.node.arguments ?? []) {
-            if (arg?.type === 'StringLiteral' && SIGNATURE_HEADERS.test(arg.value)) {
+            if (arg?.type !== 'StringLiteral')
+                continue;
+            if (SIGNATURE_HEADERS.test(arg.value))
                 info.hasSignatureCheck = true;
+            if (CREDENTIAL_HEADERS.test(arg.value) && /headers\.get$/.test(full)) {
+                info.readsCredentialHeader = true;
             }
         }
         // Raw SQL: db.query(`DELETE FROM ...`) / sql`UPDATE ...`
@@ -175,23 +289,36 @@ function analyseFunction(path, name) {
             const full = calleeName(inner.node);
             if (/headers\.get$/.test(full) || full.endsWith('CRON_SECRET'))
                 info.readsAuthHeader = true;
+            if (SECRET_ENV.test(full))
+                info.readsSecretEnv = true;
+            // `request.url` / `req.nextUrl` are read to get at the query string.
+            if (/(^|\.)searchParams$/.test(full) || /(^|\.)(req|request)\??\.(url|nextUrl)$/i.test(full)) {
+                info.readsRequestInput = true;
+            }
             for (const hint of SERVICE_ROLE_HINTS) {
                 if (full.endsWith(hint)) {
                     info.serviceRoleLine ??= inner.node.loc?.start.line ?? info.line;
                 }
             }
-            for (const hint of OWNER_HINTS) {
-                if (full === hint || full.endsWith('.' + hint))
-                    info.ownerScoped = true;
+            const root = rootObject(inner.node);
+            if (!root || !params.has(root)) {
+                for (const hint of OWNER_HINTS) {
+                    if (full === hint || full.endsWith('.' + hint))
+                        info.ownerScoped = true;
+                }
             }
         },
         Identifier(inner) {
             if (SERVICE_ROLE_HINTS.includes(inner.node.name)) {
                 info.serviceRoleLine ??= inner.node.loc?.start.line ?? info.line;
             }
-            if (inner.node.name === 'userId' || inner.node.name === 'user_id') {
+            if (OWNER_IDENTIFIERS.has(inner.node.name) && !params.has(inner.node.name)) {
                 info.ownerScoped = true;
             }
+            // `const { searchParams } = new URL(request.url)` — destructured, so it
+            // never appears as a member expression.
+            if (inner.node.name === 'searchParams')
+                info.readsRequestInput = true;
         },
     });
     // An action wrapped by an auth HOC inherits the check from its wrapper.
@@ -199,7 +326,8 @@ function analyseFunction(path, name) {
     let hops = 0;
     while (parent && hops++ < 4) {
         if (parent.node?.type === 'CallExpression') {
-            if (matchesAny(calleeName(parent.node.callee), AUTH_WRAPPERS))
+            const wrapper = calleeName(parent.node.callee);
+            if (matchesAny(wrapper, AUTH_WRAPPERS) || credited.has(wrapper))
                 info.hasAuth = true;
             if (VALIDATION_CALLS.has(calleeTail(parent.node.callee)))
                 info.hasValidation = true;
@@ -221,6 +349,14 @@ export const serverActionsScanner = {
         const result = emptyResult();
         let actionCount = 0;
         let routeCount = 0;
+        // Shared across the whole scan: resolving `@/lib/auth` costs one parse of
+        // that helper, however many actions import it.
+        const helperOptions = {
+            authCalls: AUTH_CALLS,
+            authWrappers: AUTH_WRAPPERS,
+            index: buildModuleIndex(ctx.files, ctx.root),
+            cache: new Map(),
+        };
         for (const file of ctx.files) {
             if (!isScript(file))
                 continue;
@@ -239,6 +375,7 @@ export const serverActionsScanner = {
             }
             const suppress = new Suppressions(source);
             const programUseServer = moduleUseServer || hasDirective(ast.program, 'use server');
+            const credited = authNamesFor(file, helperOptions, ast);
             const push = (f) => {
                 if (suppress.suppressed(f.line, f.id))
                     return;
@@ -255,7 +392,7 @@ export const serverActionsScanner = {
                 const isRoute = Boolean(httpMethod);
                 if (!isAction && !isRoute)
                     return;
-                const info = analyseFunction(path, name);
+                const info = analyseFunction(path, name, credited);
                 if (isAction)
                     actionCount++;
                 if (isRoute)
@@ -273,14 +410,27 @@ export const serverActionsScanner = {
                 // reported at low rather than as a blocking critical.
                 const PUBLIC_BY_DESIGN_ROUTE = /(^|\/|-)(login|signin|sign-in|register|signup|sign-up|forgot-password|reset-password|verify-email|resend-verification|magic-link|contact|lead|leads|waitlist|subscribe|unsubscribe|newsletter)(\/|-|\.|$)/i;
                 const intentionallyPublic = isRoute && PUBLIC_BY_DESIGN_ROUTE.test(relPath);
-                if (writes && !info.hasAuth && info.getSessionLine === null) {
+                // A machine-to-machine endpoint has no session to look up: it proves the
+                // caller by comparing a credential header against a server-side secret.
+                // That is an authorization check, so it must not read as a missing one.
+                const secretAuth = info.readsCredentialHeader && info.readsSecretEnv;
+                // For a webhook, the provider signature *is* the caller's identity.
+                // CTS042 below is the rule for a webhook that verifies nothing.
+                const verifiedWebhook = isWebhook && info.hasSignatureCheck;
+                const authenticated = info.hasAuth || secretAuth || verifiedWebhook;
+                if (writes && !authenticated && info.getSessionLine === null) {
                     push({
                         id: 'CTS001',
-                        severity: intentionallyPublic ? 'low' : 'critical',
+                        severity: intentionallyPublic ? 'low' : info.hasMutation ? 'critical' : 'high',
                         title: intentionallyPublic
                             ? `${kind} is unauthenticated (appears public by design)`
                             : `Missing ${kind} authorization`,
-                        detail: `${kind} \`${name}\` performs a database mutation without verifying the caller. ` +
+                        detail: `${kind} \`${name}\` ` +
+                            (info.hasMutation
+                                ? 'performs a database mutation without verifying the caller. '
+                                : `accepts ${httpMethod ?? 'POST'} and never verifies the caller. No database write ` +
+                                    'is visible in the handler itself, so this is judged on the method alone — a ' +
+                                    'read-only endpoint here is a lower risk than the severity suggests. ') +
                             exposure +
                             (intentionallyPublic
                                 ? ' This route name suggests a sign-in / account-recovery or public-intake endpoint, which is unauthenticated by design — confirm it has rate limiting and does not trust caller-supplied identifiers.'
@@ -296,7 +446,11 @@ export const serverActionsScanner = {
                         meta: { action: name, kind },
                     });
                 }
-                if (info.params > 0 && writes && !info.hasValidation) {
+                // A Route Handler that never reads a body, query or route param has no
+                // caller input to validate — reporting one is noise, and it was firing
+                // on cron endpoints whose whole body is a secret comparison.
+                const hasInput = !isRoute || info.readsRequestInput;
+                if (info.params > 0 && writes && hasInput && !info.hasValidation) {
                     push({
                         id: 'CTS002',
                         severity: 'high',
@@ -383,7 +537,10 @@ export const serverActionsScanner = {
                         meta: { kind, route: relPath },
                     });
                 }
-                if (isCron && !info.readsAuthHeader && !info.hasAuth) {
+                // A cron route's GET health check that returns a constant has nothing to
+                // trigger, so "callable by anyone" is not a finding about it.
+                const doesWork = info.workCalls > 0 || HTTP_MUTATION_METHODS.has(httpMethod ?? '');
+                if (isCron && doesWork && !info.readsAuthHeader && !info.hasAuth && !secretAuth) {
                     push({
                         id: 'CTS046',
                         severity: 'high',

package/dist/utils/modules.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Resolves an import specifier to a first-party file that is already in the
+ * scan set, so a scanner can follow a call into the helper it lands in.
+ *
+ * Deliberately not a real module resolver: it never reads `tsconfig.json`
+ * `paths`, never touches disk beyond the file list it was given, and answers
+ * `null` for anything from `node_modules`. Aliases (`@/lib/auth`, `~/server/db`)
+ * are matched by path suffix instead, which finds the file whether the alias is
+ * rooted at the project or at `src/` — the two shapes that cover essentially
+ * every Next.js app — without pretending to know which.
+ */
+export interface ModuleIndex {
+    /** Absolute path of the file `spec` names when imported from `fromFile`. */
+    resolve(spec: string, fromFile: string): string | null;
+}
+export declare function buildModuleIndex(files: string[], root: string): ModuleIndex;

package/dist/utils/modules.js

@@ -0,0 +1,67 @@
+import { dirname, join } from 'node:path';
+import { isScript, rel } from './files.js';
+/** Alias prefixes that stand for "somewhere in this project", not a package. */
+const ALIAS = /^(@|~|#|\$)\//;
+function stripExt(path) {
+    const slash = path.lastIndexOf('/');
+    const dot = path.lastIndexOf('.');
+    return dot > slash ? path.slice(0, dot) : path;
+}
+export function buildModuleIndex(files, root) {
+    /** Extensionless absolute path -> file. `dir/index.ts` also registers `dir`. */
+    const byAbs = new Map();
+    /**
+     * Every suffix of a file's extensionless project-relative path -> file, for
+     * alias lookups. A suffix shared by two files is recorded as ambiguous
+     * (`null`) so an alias never resolves to an arbitrary one of them.
+     */
+    const bySuffix = new Map();
+    const addSuffix = (key, file) => {
+        const current = bySuffix.get(key);
+        if (current === undefined)
+            bySuffix.set(key, file);
+        else if (current !== file)
+            bySuffix.set(key, null);
+    };
+    for (const file of files) {
+        if (!isScript(file))
+            continue;
+        const noExt = stripExt(file);
+        byAbs.set(noExt, file);
+        if (/\/index$/.test(noExt))
+            byAbs.set(noExt.slice(0, -'/index'.length), file);
+        const relNoExt = stripExt(rel(root, file));
+        const segments = relNoExt.split('/');
+        for (let i = 0; i < segments.length; i++) {
+            addSuffix(segments.slice(i).join('/'), file);
+            // `lib/auth/index.ts` is what `@/lib/auth` names.
+            if (i < segments.length - 1 && segments[segments.length - 1] === 'index') {
+                addSuffix(segments.slice(i, segments.length - 1).join('/'), file);
+            }
+        }
+    }
+    const fromAbsolute = (base) => 
+    // `./auth` and `./auth.js` (the ESM-correct spelling of `auth.ts`) both name
+    // the same file, and `./auth` may also be `auth/index.ts`.
+    byAbs.get(base) ?? byAbs.get(stripExt(base)) ?? null;
+    return {
+        resolve(spec, fromFile) {
+            if (!spec || spec.startsWith('node:') || spec.startsWith('data:'))
+                return null;
+            if (spec.startsWith('./') || spec.startsWith('../')) {
+                return fromAbsolute(join(dirname(fromFile), spec));
+            }
+            const aliased = ALIAS.test(spec)
+                ? spec.slice(spec.indexOf('/') + 1)
+                : // A bare specifier is a package unless it looks like a project path
+                    // that was written without a leading alias (`src/lib/auth`).
+                    /^(src|app|lib|server|utils|components)\//.test(spec)
+                        ? spec
+                        : null;
+            if (!aliased)
+                return null;
+            const hit = bySuffix.get(stripExt(aliased));
+            return hit ?? null;
+        },
+    };
+}