cleartoship 0.8.0 → 0.9.0

package/dist/scanners/auth-helpers.js

@@ -0,0 +1,169 @@
+import { read } from '../utils/files.js';
+import { parseSource, calleeName, calleeTail } from '../utils/ast.js';
+/**
+ * Recognising an authenticated caller only when the check is written inline
+ * inside the action is wrong for the way real apps are built: session
+ * verification is factored into `lib/auth.ts` (or a framework helper such as
+ * Shopify's `handleSessionToken`) and every action calls that. Reading only the
+ * action body then reports each of them as unauthenticated — four false
+ * criticals on one dogfooded Shopify app, which is exactly the kind of finding
+ * that teaches people to ignore the tool.
+ *
+ * This module answers the narrower question the scanner actually needs: which
+ * *names*, as spelled in this file, stand for "the caller was authenticated"?
+ * A name qualifies when the function behind it — defined here, or exported by a
+ * first-party module this file imports — itself performs a recognised auth call,
+ * directly or through another such helper. Third-party packages are never
+ * followed, so a call into `node_modules` still proves nothing on its own.
+ */
+/** How many import hops to follow before giving up. */
+const MAX_DEPTH = 3;
+/** Rounds of the same-file fixed point — helpers calling helpers calling helpers. */
+const MAX_ROUNDS = 4;
+const EMPTY = new Set();
+function matchesAny(name, list) {
+    for (const candidate of list) {
+        if (name === candidate || name.endsWith('.' + candidate))
+            return true;
+    }
+    return false;
+}
+/** Every callee name (dotted and bare) reachable inside one function body. */
+function callNamesIn(node, out, depth = 0) {
+    if (!node || typeof node !== 'object' || depth > 400)
+        return;
+    if (Array.isArray(node)) {
+        for (const child of node)
+            callNamesIn(child, out, depth + 1);
+        return;
+    }
+    if (typeof node.type !== 'string')
+        return;
+    if (node.type === 'CallExpression' || node.type === 'OptionalCallExpression') {
+        const full = calleeName(node.callee);
+        if (full) {
+            out.add(full);
+            out.add(calleeTail(node.callee));
+        }
+    }
+    for (const key of Object.keys(node)) {
+        if (key === 'loc' || key === 'leadingComments' || key === 'trailingComments')
+            continue;
+        const value = node[key];
+        if (value && typeof value === 'object')
+            callNamesIn(value, out, depth + 1);
+    }
+}
+/** Top-level `function f()` / `const f = () => {}`, exported or not. */
+function collectFunctions(ast) {
+    const found = new Map();
+    const addFunction = (name, body) => {
+        if (!name || !body)
+            return;
+        const calls = new Set();
+        callNamesIn(body, calls);
+        found.set(name, calls);
+    };
+    const fromDeclaration = (decl) => {
+        if (!decl)
+            return;
+        if (decl.type === 'FunctionDeclaration') {
+            addFunction(decl.id?.name, decl.body);
+            return;
+        }
+        if (decl.type !== 'VariableDeclaration')
+            return;
+        for (const d of decl.declarations ?? []) {
+            if (d?.id?.type !== 'Identifier')
+                continue;
+            const init = d.init;
+            if (init?.type === 'ArrowFunctionExpression' || init?.type === 'FunctionExpression') {
+                addFunction(d.id.name, init.body);
+            }
+        }
+    };
+    for (const stmt of ast.program.body) {
+        if (stmt.type === 'ExportNamedDeclaration')
+            fromDeclaration(stmt.declaration);
+        else
+            fromDeclaration(stmt);
+    }
+    return found;
+}
+/**
+ * Names that mean "authenticated" when used inside `file`. Includes helpers
+ * defined in the file and symbols imported from first-party modules.
+ */
+export function authNamesFor(file, opts, preparsed, depth = 0, stack = new Set()) {
+    const memo = opts.cache.get(file);
+    if (memo)
+        return memo;
+    // A cycle (a imports b imports a) resolves to nothing rather than looping.
+    if (stack.has(file) || depth > MAX_DEPTH)
+        return EMPTY;
+    let ast = preparsed ?? null;
+    if (!ast) {
+        const source = read(file);
+        if (source === null)
+            return EMPTY;
+        // Cheap bail-out: a file that mentions none of the auth vocabulary cannot
+        // define an auth helper, and most files in a repo are that file.
+        if (!opts.authCalls.some((c) => source.includes(c.split('.').pop()))) {
+            opts.cache.set(file, EMPTY);
+            return EMPTY;
+        }
+        ast = parseSource(source, file);
+        if (!ast) {
+            opts.cache.set(file, EMPTY);
+            return EMPTY;
+        }
+    }
+    stack.add(file);
+    const credited = new Set();
+    for (const stmt of ast.program.body) {
+        if (stmt.type !== 'ImportDeclaration')
+            continue;
+        const spec = stmt.source?.value;
+        const target = typeof spec === 'string' ? opts.index.resolve(spec, file) : null;
+        if (!target)
+            continue;
+        const exported = authNamesFor(target, opts, null, depth + 1, stack);
+        if (exported.size === 0)
+            continue;
+        for (const s of stmt.specifiers ?? []) {
+            const local = s.local?.name;
+            if (!local)
+                continue;
+            const imported = s.type === 'ImportSpecifier'
+                ? (s.imported.name ?? s.imported.value)
+                : s.type === 'ImportDefaultSpecifier'
+                    ? 'default'
+                    : null;
+            if (imported && exported.has(imported))
+                credited.add(local);
+        }
+    }
+    const functions = collectFunctions(ast);
+    for (let round = 0; round < MAX_ROUNDS; round++) {
+        let changed = false;
+        for (const [name, calls] of functions) {
+            if (credited.has(name))
+                continue;
+            for (const call of calls) {
+                if (matchesAny(call, opts.authCalls) ||
+                    matchesAny(call, opts.authWrappers) ||
+                    credited.has(call)) {
+                    credited.add(name);
+                    changed = true;
+                    break;
+                }
+            }
+        }
+        if (!changed)
+            break;
+    }
+    stack.delete(file);
+    const result = credited;
+    opts.cache.set(file, result);
+    return result;
+}

package/dist/scanners/community.js

@@ -65,12 +65,48 @@ const WITHHELD = new Map([
         'a packaging lint (missing "files" field), not a security finding, and wrong for apps ' +
             'rather than published libraries',
     ],
+    [
+        'VG865',
+        'declares itself a `.npmignore` lint but is registered for the `shell` language, so it ' +
+            'matches almost every line of every shell script — 6 hits on two `scripts/*.sh` files, ' +
+            'all false, and it is a packaging lint rather than a security finding either way',
+    ],
     [
         'VG1004',
         'matches every `use server` module with an exported function; it asserts "no rate limiting" ' +
             'without ever checking for it',
     ],
 ]);
+/**
+ * Machine-generated dependency lockfiles. Their entries describe the *transitive*
+ * graph, which nobody in this repo wrote or can edit directly.
+ */
+const LOCKFILE = /(^|\/)(package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.yaml|bun\.lockb?|composer\.lock|Pipfile\.lock|poetry\.lock)$/i;
+/**
+ * Rules whose signal only exists in a hand-authored manifest. The same JSON
+ * shapes appear all over a lockfile describing packages a dependency chose, so
+ * a hit there is both unactionable and, measured on the dogfooding corpus,
+ * wrong: `fast-glob`, `fast-deep-equal`, `common-tags`, `core-js` and
+ * `simple-statistics` all trip the deceptive-prefix list, and the "wildcard
+ * version" rule fires on transitive `"node": ">=16"` engine constraints.
+ * Declared package names are covered properly by CTS020-CTS027, which ask the
+ * registry rather than matching a prefix.
+ */
+const MANIFEST_ONLY = new Map([
+    ['VG872', 'internal-name heuristic; in a lockfile it names a transitive dependency'],
+    ['VG873', 'deceptive-prefix heuristic; matches ordinary transitive package names'],
+    ['VG020', 'wildcard version; a transitive range is the dependency author\'s choice'],
+]);
+/**
+ * Per-rule filters for a match shape the upstream regex cannot exclude on its
+ * own. Applied to the matched text, not the whole file.
+ */
+const MATCH_GUARDS = {
+    // A `"link": true` entry is a workspace or pnpm symlink resolved to a path on
+    // disk rather than a tarball, so it has no integrity hash by design. Thirty of
+    // them in one pnpm-managed lockfile, every one reported as a false critical.
+    VG870: (match) => !/"link"\s*:\s*true/.test(match),
+};
 /** Paths where a match is a fixture or documentation rather than shipped code. */
 const NON_PRODUCTION_PATH = /(^|\/)(tests?|__tests__|__mocks__|__fixtures__|fixtures?|spec|specs|examples?|docs?|demo|samples?|e2e|cypress|playwright|stories)(\/|$)|\.(test|spec|stories|fixture)\.[a-z]+$/i;
 /** Regexes over very large files are where catastrophic backtracking bites. */
@@ -100,11 +136,15 @@ export const communityScanner = {
                 continue;
             const relPath = rel(ctx.root, file);
             const fixture = NON_PRODUCTION_PATH.test(relPath);
+            const lockfile = LOCKFILE.test(relPath);
             const suppress = new Suppressions(source);
             filesScanned++;
             for (const rule of active) {
                 if (!rule.languages.some((l) => languages.includes(l)))
                     continue;
+                if (lockfile && MANIFEST_ONLY.has(rule.id))
+                    continue;
+                const guard = MATCH_GUARDS[rule.id];
                 const re = rule.pattern;
                 re.lastIndex = 0;
                 let m;
@@ -115,6 +155,13 @@ export const communityScanner = {
                         re.lastIndex++;
                         continue;
                     }
+                    // Skipping a match must not skip the non-global `break` below, or a
+                    // rule without /g would rescan from zero forever.
+                    if (guard && !guard(m[0])) {
+                        if (!re.global)
+                            break;
+                        continue;
+                    }
                     const line = lineAt(source, m.index);
                     const key = `${relPath}:${line}:${rule.id}`;
                     if (!seen.has(key) && !suppress.suppressed(line, rule.id)) {
@@ -148,7 +195,8 @@ export const communityScanner = {
         result.checks.push({
             label: `Community ruleset (${active.length} rules over ${filesScanned} files)`,
             passed: result.findings.every((f) => f.severity !== 'critical'),
-            note: `${SUPERSEDED.size} superseded by ClearToShip's AST checks, ${WITHHELD.size} withheld as noisy`,
+            note: `${SUPERSEDED.size} superseded by ClearToShip's AST checks, ${WITHHELD.size} withheld as noisy, ` +
+                `${MANIFEST_ONLY.size} manifest-only (not run over lockfiles)`,
         });
         return result;
     },

package/dist/scanners/server-actions.js

@@ -1,6 +1,8 @@
 import { read, rel, isScript, snippetAt } from '../utils/files.js';
 import { parseSource, calleeName, calleeTail, hasDirective } from '../utils/ast.js';
 import { traverse } from '../utils/traverse.js';
+import { buildModuleIndex } from '../utils/modules.js';
+import { authNamesFor } from './auth-helpers.js';
 import { Suppressions } from '../utils/suppress.js';
 import { emptyResult } from '../types.js';
 /**
@@ -14,6 +16,11 @@ const AUTH_CALLS = [
     'getAuth', 'validateRequest', 'verifySession', 'requireUser', 'requireAuth',
     'requireSession', 'assertAuthenticated', 'getCurrentUser', 'getLoggedInUser',
     'getToken', 'verifyToken', 'verifyIdToken', 'protect', 'ensureUser',
+    // Framework primitives that verify a signed session token rather than read
+    // one: Shopify App Bridge's session-token exchange, Shopify Remix's
+    // `authenticate.admin(request)`, and jose's JWT verification.
+    'session.decodeSessionToken', 'decodeSessionToken', 'authenticate.admin',
+    'authenticate.public', 'authenticate.flow', 'jwtVerify', 'verifyJWT', 'verifyJwt',
 ];
 /** Higher-order wrappers that apply auth (and often validation) for the action. */
 const AUTH_WRAPPERS = [
@@ -52,17 +59,93 @@ const SIGNATURE_CHECKS = [
  * "unverified webhook" check.
  */
 const SIGNATURE_HEADERS = /(x-shopify-hmac-sha256|x-hub-signature(-256)?|stripe-signature|svix-signature|svix-id|x-signature|x-webhook-signature|x-slack-signature|x-line-signature|paypal-transmission-sig)/i;
+/**
+ * Headers that exist to carry a caller credential. Reading one *and* comparing
+ * it against a server-side secret is how a cron or machine-to-machine endpoint
+ * authenticates — there is no session to look up.
+ */
+const CREDENTIAL_HEADERS = /^(authorization|proxy-authorization|x-api-key|x-apikey|api-key|x-auth-token|x-access-token|x-cron-secret|x-webhook-secret|x-admin-key|x-internal-token)$/i;
+/** `process.env.SOMETHING_SECRET` and friends — the other half of that check. */
+const SECRET_ENV = /^process\.env\.[A-Z0-9_]*(SECRET|TOKEN|KEY|PASSWORD|PASS)[A-Z0-9_]*$/;
+/**
+ * Calls that only build the HTTP response. A handler whose body contains
+ * nothing else is a static responder — a health check — with no work to trigger.
+ */
+const RESPONSE_CALLS = /^(NextResponse\.(json|redirect|next|rewrite)|Response\.(json|redirect|error)|json|res\.(json|send|status))$/;
+/**
+ * Reading the request body. Anchored on the receiver so `NextResponse.json(...)`
+ * — which writes the response — is not mistaken for reading the request.
+ */
+const REQUEST_INPUT_READ = /(^|\.)(req|request|nextRequest|_req|_request)\??\.(json|text|formData|arrayBuffer|blob)$/i;
 /** Schema escape hatches that make validation decorative. */
 const LOOSE_SCHEMA = /\.passthrough\s*\(|z\s*\.\s*(any|unknown)\s*\(|\.catchall\s*\(/g;
 const SERVICE_ROLE_HINTS = [
     'SUPABASE_SERVICE_ROLE_KEY', 'SUPABASE_SERVICE_KEY', 'SERVICE_ROLE_KEY',
     'SUPABASE_SECRET_KEY',
 ];
-/** Identifiers that plausibly carry the authenticated principal's id. */
+/**
+ * Dotted expressions that plausibly carry the authenticated principal's id.
+ * The principal is not always a person: in a B2B or platform app it is the
+ * tenant — a store, org, workspace or team — and a write scoped to it is
+ * scoped just as tightly as one scoped to a user id.
+ */
 const OWNER_HINTS = [
     'user.id', 'user?.id', 'session.user.id', 'userId', 'user_id', 'auth.uid',
     'currentUser.id', 'ctx.user', 'claims.sub', 'uid',
+    'store.id', 'shop.id', 'org.id', 'organization.id', 'tenant.id', 'workspace.id',
+    'account.id', 'team.id', 'company.id', 'session.shop', 'session.shopDomain',
 ];
+/** Bare identifiers carrying that same principal. */
+const OWNER_IDENTIFIERS = new Set([
+    'userId', 'user_id', 'ownerId', 'owner_id', 'shop', 'shopDomain', 'shop_domain',
+    'storeId', 'store_id', 'orgId', 'org_id', 'organizationId', 'organization_id',
+    'tenantId', 'tenant_id', 'workspaceId', 'workspace_id', 'accountId', 'account_id',
+    'teamId', 'team_id', 'companyId', 'company_id',
+]);
+/** Names bound by a function's own parameter list, destructuring included. */
+function parameterNames(params) {
+    const names = new Set();
+    const visit = (node, depth = 0) => {
+        if (!node || depth > 8)
+            return;
+        switch (node.type) {
+            case 'Identifier':
+                names.add(node.name);
+                return;
+            case 'AssignmentPattern':
+                visit(node.left, depth + 1);
+                return;
+            case 'RestElement':
+                visit(node.argument, depth + 1);
+                return;
+            case 'ObjectPattern':
+                for (const prop of node.properties ?? []) {
+                    visit(prop.type === 'ObjectProperty' ? prop.value : prop, depth + 1);
+                }
+                return;
+            case 'ArrayPattern':
+                for (const el of node.elements ?? [])
+                    visit(el, depth + 1);
+                return;
+            default:
+                return;
+        }
+    };
+    for (const p of params ?? [])
+        visit(p);
+    return names;
+}
+/** Root identifier of `a.b.c` — the binding the expression reads from. */
+function rootObject(node) {
+    let cur = node;
+    let guard = 0;
+    while (cur && guard++ < 16) {
+        if (cur.type === 'Identifier')
+            return cur.name;
+        cur = cur.object ?? cur.expression ?? cur.argument;
+    }
+    return null;
+}
 function matchesAny(name, list) {
     for (const candidate of list) {
         if (name === candidate || name.endsWith('.' + candidate))
@@ -70,7 +153,9 @@ function matchesAny(name, list) {
     }
     return false;
 }
-function analyseFunction(path, name) {
+function analyseFunction(path, name, 
+/** Names that stand for an auth check in this file — see ./auth-helpers.ts. */
+credited) {
     const node = path.node;
     const info = {
         name,
@@ -88,10 +173,27 @@ function analyseFunction(path, name) {
         spreadLine: null,
         looseSchemaLine: null,
         readsAuthHeader: false,
+        readsCredentialHeader: false,
+        readsSecretEnv: false,
+        workCalls: 0,
+        // A Server Action's arguments *are* its input; a Route Handler has to go
+        // and read one, so that is detected below.
+        readsRequestInput: false,
     };
+    // An id the caller passed in is not proof of ownership — it is the IDOR.
+    // Only a principal resolved inside the function counts as scoping.
+    const params = parameterNames(node.params ?? []);
+    // `export async function GET(_req, { params })` — the segment values are
+    // caller-supplied input just as much as a body is.
+    if (params.has('params'))
+        info.readsRequestInput = true;
     const inspect = (inner) => {
         const full = calleeName(inner.node.callee);
         const tail = calleeTail(inner.node.callee);
+        if (!RESPONSE_CALLS.test(full))
+            info.workCalls++;
+        if (REQUEST_INPUT_READ.test(full))
+            info.readsRequestInput = true;
         // `supabase.auth.getSession()` reads the cookie without asking the auth
         // server whether the token is still valid, so it proves nothing on the
         // server. It must not satisfy the auth check via the generic `getSession`
@@ -103,6 +205,14 @@ function analyseFunction(path, name) {
         else if (matchesAny(full, AUTH_CALLS)) {
             info.hasAuth = true;
         }
+        else if (credited.has(full)) {
+            // The check lives in a first-party helper this file imports, or one
+            // defined above in the same file. Matched on the whole callee name, not
+            // its tail: a helper is called by the name this file binds it to, and
+            // crediting `crypto.verify()` because some other module exports a
+            // `verify` helper would hide a real finding.
+            info.hasAuth = true;
+        }
         if (matchesAny(full, AUTH_WRAPPERS))
             info.hasAuth = true;
         if (matchesAny(full, SIGNATURE_CHECKS))
@@ -135,8 +245,12 @@ function analyseFunction(path, name) {
         // Reading a webhook-signature header counts as participating in
         // verification (see SIGNATURE_HEADERS).
         for (const arg of inner.node.arguments ?? []) {
-            if (arg?.type === 'StringLiteral' && SIGNATURE_HEADERS.test(arg.value)) {
+            if (arg?.type !== 'StringLiteral')
+                continue;
+            if (SIGNATURE_HEADERS.test(arg.value))
                 info.hasSignatureCheck = true;
+            if (CREDENTIAL_HEADERS.test(arg.value) && /headers\.get$/.test(full)) {
+                info.readsCredentialHeader = true;
             }
         }
         // Raw SQL: db.query(`DELETE FROM ...`) / sql`UPDATE ...`
@@ -175,23 +289,36 @@ function analyseFunction(path, name) {
             const full = calleeName(inner.node);
             if (/headers\.get$/.test(full) || full.endsWith('CRON_SECRET'))
                 info.readsAuthHeader = true;
+            if (SECRET_ENV.test(full))
+                info.readsSecretEnv = true;
+            // `request.url` / `req.nextUrl` are read to get at the query string.
+            if (/(^|\.)searchParams$/.test(full) || /(^|\.)(req|request)\??\.(url|nextUrl)$/i.test(full)) {
+                info.readsRequestInput = true;
+            }
             for (const hint of SERVICE_ROLE_HINTS) {
                 if (full.endsWith(hint)) {
                     info.serviceRoleLine ??= inner.node.loc?.start.line ?? info.line;
                 }
             }
-            for (const hint of OWNER_HINTS) {
-                if (full === hint || full.endsWith('.' + hint))
-                    info.ownerScoped = true;
+            const root = rootObject(inner.node);
+            if (!root || !params.has(root)) {
+                for (const hint of OWNER_HINTS) {
+                    if (full === hint || full.endsWith('.' + hint))
+                        info.ownerScoped = true;
+                }
             }
         },
         Identifier(inner) {
             if (SERVICE_ROLE_HINTS.includes(inner.node.name)) {
                 info.serviceRoleLine ??= inner.node.loc?.start.line ?? info.line;
             }
-            if (inner.node.name === 'userId' || inner.node.name === 'user_id') {
+            if (OWNER_IDENTIFIERS.has(inner.node.name) && !params.has(inner.node.name)) {
                 info.ownerScoped = true;
             }
+            // `const { searchParams } = new URL(request.url)` — destructured, so it
+            // never appears as a member expression.
+            if (inner.node.name === 'searchParams')
+                info.readsRequestInput = true;
         },
     });
     // An action wrapped by an auth HOC inherits the check from its wrapper.
@@ -199,7 +326,8 @@ function analyseFunction(path, name) {
     let hops = 0;
     while (parent && hops++ < 4) {
         if (parent.node?.type === 'CallExpression') {
-            if (matchesAny(calleeName(parent.node.callee), AUTH_WRAPPERS))
+            const wrapper = calleeName(parent.node.callee);
+            if (matchesAny(wrapper, AUTH_WRAPPERS) || credited.has(wrapper))
                 info.hasAuth = true;
             if (VALIDATION_CALLS.has(calleeTail(parent.node.callee)))
                 info.hasValidation = true;
@@ -221,6 +349,14 @@ export const serverActionsScanner = {
         const result = emptyResult();
         let actionCount = 0;
         let routeCount = 0;
+        // Shared across the whole scan: resolving `@/lib/auth` costs one parse of
+        // that helper, however many actions import it.
+        const helperOptions = {
+            authCalls: AUTH_CALLS,
+            authWrappers: AUTH_WRAPPERS,
+            index: buildModuleIndex(ctx.files, ctx.root),
+            cache: new Map(),
+        };
         for (const file of ctx.files) {
             if (!isScript(file))
                 continue;
@@ -239,6 +375,7 @@ export const serverActionsScanner = {
             }
             const suppress = new Suppressions(source);
             const programUseServer = moduleUseServer || hasDirective(ast.program, 'use server');
+            const credited = authNamesFor(file, helperOptions, ast);
             const push = (f) => {
                 if (suppress.suppressed(f.line, f.id))
                     return;
@@ -255,7 +392,7 @@ export const serverActionsScanner = {
                 const isRoute = Boolean(httpMethod);
                 if (!isAction && !isRoute)
                     return;
-                const info = analyseFunction(path, name);
+                const info = analyseFunction(path, name, credited);
                 if (isAction)
                     actionCount++;
                 if (isRoute)
@@ -273,14 +410,27 @@ export const serverActionsScanner = {
                 // reported at low rather than as a blocking critical.
                 const PUBLIC_BY_DESIGN_ROUTE = /(^|\/|-)(login|signin|sign-in|register|signup|sign-up|forgot-password|reset-password|verify-email|resend-verification|magic-link|contact|lead|leads|waitlist|subscribe|unsubscribe|newsletter)(\/|-|\.|$)/i;
                 const intentionallyPublic = isRoute && PUBLIC_BY_DESIGN_ROUTE.test(relPath);
-                if (writes && !info.hasAuth && info.getSessionLine === null) {
+                // A machine-to-machine endpoint has no session to look up: it proves the
+                // caller by comparing a credential header against a server-side secret.
+                // That is an authorization check, so it must not read as a missing one.
+                const secretAuth = info.readsCredentialHeader && info.readsSecretEnv;
+                // For a webhook, the provider signature *is* the caller's identity.
+                // CTS042 below is the rule for a webhook that verifies nothing.
+                const verifiedWebhook = isWebhook && info.hasSignatureCheck;
+                const authenticated = info.hasAuth || secretAuth || verifiedWebhook;
+                if (writes && !authenticated && info.getSessionLine === null) {
                     push({
                         id: 'CTS001',
-                        severity: intentionallyPublic ? 'low' : 'critical',
+                        severity: intentionallyPublic ? 'low' : info.hasMutation ? 'critical' : 'high',
                         title: intentionallyPublic
                             ? `${kind} is unauthenticated (appears public by design)`
                             : `Missing ${kind} authorization`,
-                        detail: `${kind} \`${name}\` performs a database mutation without verifying the caller. ` +
+                        detail: `${kind} \`${name}\` ` +
+                            (info.hasMutation
+                                ? 'performs a database mutation without verifying the caller. '
+                                : `accepts ${httpMethod ?? 'POST'} and never verifies the caller. No database write ` +
+                                    'is visible in the handler itself, so this is judged on the method alone — a ' +
+                                    'read-only endpoint here is a lower risk than the severity suggests. ') +
                             exposure +
                             (intentionallyPublic
                                 ? ' This route name suggests a sign-in / account-recovery or public-intake endpoint, which is unauthenticated by design — confirm it has rate limiting and does not trust caller-supplied identifiers.'
@@ -296,7 +446,11 @@ export const serverActionsScanner = {
                         meta: { action: name, kind },
                     });
                 }
-                if (info.params > 0 && writes && !info.hasValidation) {
+                // A Route Handler that never reads a body, query or route param has no
+                // caller input to validate — reporting one is noise, and it was firing
+                // on cron endpoints whose whole body is a secret comparison.
+                const hasInput = !isRoute || info.readsRequestInput;
+                if (info.params > 0 && writes && hasInput && !info.hasValidation) {
                     push({
                         id: 'CTS002',
                         severity: 'high',
@@ -383,7 +537,10 @@ export const serverActionsScanner = {
                         meta: { kind, route: relPath },
                     });
                 }
-                if (isCron && !info.readsAuthHeader && !info.hasAuth) {
+                // A cron route's GET health check that returns a constant has nothing to
+                // trigger, so "callable by anyone" is not a finding about it.
+                const doesWork = info.workCalls > 0 || HTTP_MUTATION_METHODS.has(httpMethod ?? '');
+                if (isCron && doesWork && !info.readsAuthHeader && !info.hasAuth && !secretAuth) {
                     push({
                         id: 'CTS046',
                         severity: 'high',

package/dist/utils/modules.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Resolves an import specifier to a first-party file that is already in the
+ * scan set, so a scanner can follow a call into the helper it lands in.
+ *
+ * Deliberately not a real module resolver: it never reads `tsconfig.json`
+ * `paths`, never touches disk beyond the file list it was given, and answers
+ * `null` for anything from `node_modules`. Aliases (`@/lib/auth`, `~/server/db`)
+ * are matched by path suffix instead, which finds the file whether the alias is
+ * rooted at the project or at `src/` — the two shapes that cover essentially
+ * every Next.js app — without pretending to know which.
+ */
+export interface ModuleIndex {
+    /** Absolute path of the file `spec` names when imported from `fromFile`. */
+    resolve(spec: string, fromFile: string): string | null;
+}
+export declare function buildModuleIndex(files: string[], root: string): ModuleIndex;

package/dist/utils/modules.js

@@ -0,0 +1,67 @@
+import { dirname, join } from 'node:path';
+import { isScript, rel } from './files.js';
+/** Alias prefixes that stand for "somewhere in this project", not a package. */
+const ALIAS = /^(@|~|#|\$)\//;
+function stripExt(path) {
+    const slash = path.lastIndexOf('/');
+    const dot = path.lastIndexOf('.');
+    return dot > slash ? path.slice(0, dot) : path;
+}
+export function buildModuleIndex(files, root) {
+    /** Extensionless absolute path -> file. `dir/index.ts` also registers `dir`. */
+    const byAbs = new Map();
+    /**
+     * Every suffix of a file's extensionless project-relative path -> file, for
+     * alias lookups. A suffix shared by two files is recorded as ambiguous
+     * (`null`) so an alias never resolves to an arbitrary one of them.
+     */
+    const bySuffix = new Map();
+    const addSuffix = (key, file) => {
+        const current = bySuffix.get(key);
+        if (current === undefined)
+            bySuffix.set(key, file);
+        else if (current !== file)
+            bySuffix.set(key, null);
+    };
+    for (const file of files) {
+        if (!isScript(file))
+            continue;
+        const noExt = stripExt(file);
+        byAbs.set(noExt, file);
+        if (/\/index$/.test(noExt))
+            byAbs.set(noExt.slice(0, -'/index'.length), file);
+        const relNoExt = stripExt(rel(root, file));
+        const segments = relNoExt.split('/');
+        for (let i = 0; i < segments.length; i++) {
+            addSuffix(segments.slice(i).join('/'), file);
+            // `lib/auth/index.ts` is what `@/lib/auth` names.
+            if (i < segments.length - 1 && segments[segments.length - 1] === 'index') {
+                addSuffix(segments.slice(i, segments.length - 1).join('/'), file);
+            }
+        }
+    }
+    const fromAbsolute = (base) => 
+    // `./auth` and `./auth.js` (the ESM-correct spelling of `auth.ts`) both name
+    // the same file, and `./auth` may also be `auth/index.ts`.
+    byAbs.get(base) ?? byAbs.get(stripExt(base)) ?? null;
+    return {
+        resolve(spec, fromFile) {
+            if (!spec || spec.startsWith('node:') || spec.startsWith('data:'))
+                return null;
+            if (spec.startsWith('./') || spec.startsWith('../')) {
+                return fromAbsolute(join(dirname(fromFile), spec));
+            }
+            const aliased = ALIAS.test(spec)
+                ? spec.slice(spec.indexOf('/') + 1)
+                : // A bare specifier is a package unless it looks like a project path
+                    // that was written without a leading alias (`src/lib/auth`).
+                    /^(src|app|lib|server|utils|components)\//.test(spec)
+                        ? spec
+                        : null;
+            if (!aliased)
+                return null;
+            const hit = bySuffix.get(stripExt(aliased));
+            return hit ?? null;
+        },
+    };
+}