cleartoship 0.9.0 → 0.10.0

package/README.md

@@ -21,7 +21,7 @@ npx cleartoship
 | Rule | Severity | What it catches |
 | --- | --- | --- |
 | **CTS001** | critical | Server Action / Route Handler mutates the database with no session check |
-| **CTS002** | high | Action takes caller input and writes it with no runtime schema validation |
+| **CTS002** | high | Caller's payload written to the database as an object — every key they sent becomes a column |
 | **CTS003** | critical | `SUPABASE_SERVICE_ROLE_KEY` client built inside a user-reachable action |
 | **CTS004** | medium | Authenticated mutation keyed only on a caller-supplied id (IDOR) |
 | **CTS040** | high | Client component reads a server-side `process.env` variable |
@@ -97,7 +97,10 @@ Dockerfiles, Terraform, GitHub Actions pinning, prompt injection and MCP tool
 runtimes, React Native, Go and shell.
 
 27 upstream rules are **superseded** where ClearToShip's own AST check is more
-precise, 6 are **withheld** as measurably noisy, and 3 name-heuristic rules are
+precise, 6 are **withheld** as measurably noisy, 5 carry a **match guard** for a
+shape their regex cannot exclude (a `"link": true` lockfile entry has no
+integrity hash by design; `querySelectorAll` is not a SQL call; `eval()` inside
+a sentence about eval is prose), and 3 name-heuristic rules are
 **manifest-only** — they never run over a `package-lock.json`, where they matched
 ordinary transitive packages (`fast-glob`, `core-js`) and named nothing anyone
 could act on. Each list carries a reason per rule in
@@ -153,6 +156,7 @@ npx cleartoship --sarif -o results.sarif # GitHub code scanning
 npx cleartoship --fail-on high           # stricter CI gate (default: critical)
 npx cleartoship --ignore CTS004,CTS022   # skip rules
 npx cleartoship --no-community           # ClearToShip rules only
+npx cleartoship --no-gitignore           # also scan what .gitignore excludes
 npx cleartoship --markdown               # markdown report (PR comments / summaries)
 ```
 
@@ -181,7 +185,7 @@ To feed findings into GitHub's Security tab:
 
 ```yaml
       - run: npx cleartoship --sarif -o results.sarif --fail-on=none
-      - uses: github/codeql-action/upload-sarif@v3
+      - uses: github/codeql-action/upload-sarif@v4
         with: { sarif_file: results.sarif }
 ```
 
@@ -211,8 +215,8 @@ jobs:
   preflight:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: murtazaozdemir/cleartoship@v0.9.0
+      - uses: actions/checkout@v7
+      - uses: murtazaozdemir/cleartoship@v0.10.0
         with:
           fail-on: critical
           comment: true
@@ -234,7 +238,7 @@ above `fail-on`) for use in later steps. The comment is *sticky* — re-runs edi
 the same comment instead of piling up.
 
 By default the action runs the scanner version its own ref declares, so
-`@v0.9.0` runs `cleartoship@0.9.0` and pinning the ref pins the behaviour. If
+`@v0.10.0` runs `cleartoship@0.10.0` and pinning the ref pins the behaviour. If
 that version is not on the registry, it builds from its own checkout instead, so
 `uses: …@ref` works against an unpublished commit.
 
@@ -274,8 +278,33 @@ uploaded, and no database is connected to.
   a network blip must never be reported as a hallucinated dependency.
 - **Test fixtures are not breaches.** Credentials under `tests/`, `fixtures/`, `docs/` or in a
   commented-out line are reported at `low`, never as blocking criticals.
+- **Where a file lives changes what a finding costs.** CTS024 already separated a
+  CVE that ships from one that only ever runs on your machine; the same reasoning
+  now covers the rules that read code. An interpolated query in `scripts/`, a
+  swallowed error in a `*.config.ts` — build and maintenance tooling runs with
+  credentials its author already holds and never answers a request from the
+  internet, so those drop one severity step, with the reason attached to the
+  finding rather than applied silently. `bin/` and `migrations/` are deliberately
+  excluded: one is a published CLI's entry point, the other is production schema.
+  Across five dogfooded repos this moved 21 findings out of `critical` without
+  hiding one of them.
+- **Mass assignment means the payload arrives whole.** CTS002 and CTS043 fire when
+  the object the caller sent reaches the columns — `update(body)`,
+  `data: { ...input }`, including one level down where Prisma and Drizzle put it.
+  Reading named fields into an explicit column list is the safe pattern and is
+  never reported, whether or not a schema library was involved: of 102 findings
+  the old, broader rule produced on one dogfooded app, all 102 were that shape.
 - **Precision over recall on the noisy rules.** Typosquat matching skips exact matches and
   names shorter than five characters, where one-edit neighbours are meaningless.
+- **Your `.gitignore` decides what counts as your project.** Ignored paths are
+  not scanned: they never reach a CI checkout, so a finding there is one nobody
+  can act on and nobody's pipeline would reproduce. This is usually the
+  difference between a usable report and an unreadable one — a repo with a
+  gitignored folder of reference apps went from 1,487 findings to 235, and from
+  84 seconds to 2. `.env` files are the deliberate exception, since a secret on
+  your disk is a secret either way and CTS032 exists to check that the file *is*
+  ignored. `--no-gitignore` scans everything, and the report always says how many
+  paths were skipped.
 - **Auth is followed into the helper it lives in.** Almost no real app repeats the
   session check inside every action — it resolves in `lib/auth.ts`, or in a
   framework helper such as Shopify's `handleSessionToken`, and each action calls

package/SECURITY.md

@@ -22,7 +22,7 @@ supported one; older versions are not backported.
 | **Never writes to the scanned project** | The only writes in the codebase are the report file you ask for with `--output <path>` and the registry cache. Verify: `grep -rn "writeFileSync\|mkdirSync\|rmSync\|unlink" src/ --exclude-dir=vendor` — five lines, of which two are imports and three are those call sites. Neither path is derived from the scan root. |
 | **Never executes your code** | The scanner has no `child_process`, `exec`, `spawn`, `eval`, `new Function`, or dynamic `import()` of scanned files. Your code is read as text, parsed by Babel into an AST, and matched against regexes. Verify: `grep -rn "child_process\|execSync\|spawn\|eval(\|new Function" src/ --exclude-dir=vendor` — one hit, and it is a *pattern string* in the rule that detects those calls in **your** install hooks. (Drop `--exclude-dir=vendor` and the extra hits are rule text in the vendored ruleset, matched against your code, never run.) |
 | **Never connects to your database** | The Row Level Security scanner replays your `.sql` migration files to model the resulting schema. There is no database driver in the dependency tree and no connection string is ever read. |
-| **Reads only what it scans** | Files are gathered by walking the scan root, skipping `node_modules`, build output and virtualenvs. Nothing outside the root is read except the cache directory. |
+| **Reads only what it scans** | Files are gathered by walking the scan root, skipping `node_modules`, build output, virtualenvs and anything your own `.gitignore` excludes. Ignore rules are read from the scan root downwards only — never from a parent directory — so nothing outside the root is read except the cache directory. |
 
 ## What leaves your machine
 

package/action.yml

@@ -29,7 +29,7 @@ inputs:
   version:
     description: >-
       Version of the cleartoship npm package to run. Defaults to the version this
-      action's own ref declares, so `uses: …@v0.9.0` runs cleartoship@0.9.0. Set
+      action's own ref declares, so `uses: …@v0.10.0` runs cleartoship@0.10.0. Set
       `latest` to always track the newest release, or `local` to build from the checkout.
     required: false
     default: ''
@@ -76,7 +76,7 @@ runs:
       run: |
         # With no version pinned, run the exact version this action's checkout
         # declares. That keeps the action ref and the scanner in lockstep:
-        # `uses: <owner>/cleartoship@v0.9.0` runs cleartoship@0.9.0 instead of
+        # `uses: <owner>/cleartoship@v0.10.0` runs cleartoship@0.10.0 instead of
         # whatever npm happens to tag `latest` at the time.
         ver="$INPUT_VERSION"
         if [ -z "$ver" ]; then
@@ -180,7 +180,7 @@ runs:
 
     - name: Upload SARIF
       if: ${{ inputs.sarif == 'true' && always() }}
-      uses: github/codeql-action/upload-sarif@v3
+      uses: github/codeql-action/upload-sarif@v4
       with:
         sarif_file: ${{ inputs.working-directory }}/results.sarif
 

package/dist/cli.js

@@ -39,6 +39,7 @@ program
     .option('-o, --output <file>', 'write the chosen output to a file instead of stdout')
     .option('--offline', 'skip registry lookups (no network)')
     .option('--no-community', 'run only ClearToShip rules, skipping the vendored community ruleset')
+    .option('--no-gitignore', 'also scan files your .gitignore excludes')
     .option('--ignore <ids>', 'comma-separated rule ids to skip, e.g. CTS004,CTS022')
     .option('--only <ids>', 'comma-separated rule ids to report exclusively')
     .option('--no-banner', 'suppress the ASCII header')
@@ -55,6 +56,8 @@ program
         root: opts.cwd,
         paths,
         offline: opts.offline,
+        // commander maps --no-gitignore to `gitignore: false`.
+        noGitignore: opts.gitignore === false,
         noCommunity: opts.community === false,
         ignore: list(opts.ignore),
         only: list(opts.only),

package/dist/report.js

@@ -117,6 +117,7 @@ export function renderJson(scan) {
         root: scan.root,
         framework: scan.framework,
         fileCount: scan.fileCount,
+        gitIgnoredCount: scan.gitIgnoredCount,
         durationMs: scan.durationMs,
         verdict: scan.counts.critical > 0 ? 'hold' : scan.counts.high > 0 ? 'conditional' : 'clear',
         counts: scan.counts,

package/dist/scan.d.ts

@@ -8,6 +8,8 @@ export interface ScanOptions {
     minSeverity?: Severity;
     /** Skip the vendored community ruleset, leaving only ClearToShip's own checks. */
     noCommunity?: boolean;
+    /** Scan files the repository ignores too. Off by default — see `walk`. */
+    noGitignore?: boolean;
     verbose?: boolean;
     onProgress?: (step: number, total: number, name: string) => void;
 }
@@ -15,6 +17,8 @@ export interface FullScan {
     root: string;
     framework: string;
     fileCount: number;
+    /** Paths left unscanned because the repository's own ignore rules exclude them. */
+    gitIgnoredCount: number;
     findings: Finding[];
     checks: CheckSummary[];
     warnings: string[];

package/dist/scan.js

@@ -10,7 +10,9 @@ export async function scan(options) {
     const started = Date.now();
     const root = resolve(options.root);
     const roots = options.paths?.length ? options.paths.map((p) => resolve(root, p)) : [root];
-    const files = [...new Set(roots.flatMap((r) => walk(r)))];
+    const walked = roots.map((r) => walk(r, { respectGitignore: !options.noGitignore }));
+    const files = [...new Set(walked.flatMap((w) => w.files))];
+    const gitIgnoredCount = walked.reduce((n, w) => n + w.gitIgnored, 0);
     const framework = detectFramework(root, files);
     const ctx = {
         root,
@@ -65,6 +67,15 @@ export async function scan(options) {
             return byFile;
         return (a.line ?? 0) - (b.line ?? 0);
     });
+    if (gitIgnoredCount > 0) {
+        checks.push({
+            label: `Ignored paths skipped (${gitIgnoredCount} ${gitIgnoredCount === 1 ? 'entry' : 'entries'})`,
+            passed: true,
+            note: 'excluded by your own .gitignore, and a skipped directory takes its whole ' +
+                'subtree with it. They are not part of the project and never reach a CI ' +
+                'checkout. Use --no-gitignore to scan them anyway.',
+        });
+    }
     const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
     for (const f of filtered)
         counts[f.severity]++;
@@ -72,6 +83,7 @@ export async function scan(options) {
         root,
         framework: framework.describe(),
         fileCount: files.length,
+        gitIgnoredCount,
         findings: filtered,
         checks,
         warnings,

package/dist/scanners/community.js

@@ -1,5 +1,6 @@
 import { read, rel, lineAt, snippetAt, languagesFor } from '../utils/files.js';
 import { Suppressions } from '../utils/suppress.js';
+import { adjustForPath } from '../utils/paths.js';
 import { GUARDVIBE_RULES, GUARDVIBE_ATTRIBUTION } from '../vendor/guardvibe/index.js';
 import { emptyResult } from '../types.js';
 /**
@@ -97,18 +98,93 @@ const MANIFEST_ONLY = new Map([
     ['VG873', 'deceptive-prefix heuristic; matches ordinary transitive package names'],
     ['VG020', 'wildcard version; a transitive range is the dependency author\'s choice'],
 ]);
+/** SQL verbs strong enough that the call is about a database by itself. */
+const SQL_VERBS = /^(query|execute|raw|sql|prepare|QueryRow|QueryContext)$/i;
+/** Words that make a string a query rather than a sentence. */
+const SQL_KEYWORDS = /\b(select|insert\s+into|update|delete\s+from|from|where|values|set)\b/i;
+/** Placeholder values that exist to be replaced, not to authenticate. */
+const PLACEHOLDER = /^(your|my|the|a|change|changeme|replace|example|placeholder|dummy|sample|test|todo|none|null|undefined|x{3,}|\.{3}|<.*>|\$\{.*\}|process\.env)/i;
+/**
+ * Whether the quoted value in a `name = "value"` match reads as a credential.
+ * Prose is not: three or more words, or a trailing full stop, is a sentence.
+ */
+function looksLikeSecretValue(match) {
+    const value = /['"]([^'"\n]*)['"]\s*$/.exec(match)?.[1];
+    if (value === undefined)
+        return true;
+    const trimmed = value.trim();
+    if (trimmed === '' || PLACEHOLDER.test(trimmed))
+        return false;
+    if (trimmed.split(/\s+/).length >= 3)
+        return false;
+    if (/[.!?]$/.test(trimmed) && trimmed.includes(' '))
+        return false;
+    return true;
+}
+/** Whether `index` falls inside a quoted string on its own line. */
+function insideStringLiteral(source, index) {
+    const lineStart = source.lastIndexOf('\n', index - 1) + 1;
+    let quote = null;
+    for (let i = lineStart; i < index; i++) {
+        const ch = source[i];
+        if (ch === '\\') {
+            i++;
+            continue;
+        }
+        if (quote) {
+            if (ch === quote)
+                quote = null;
+        }
+        else if (ch === '"' || ch === "'" || ch === '`') {
+            quote = ch;
+        }
+    }
+    return quote !== null;
+}
 /**
  * Per-rule filters for a match shape the upstream regex cannot exclude on its
- * own. Applied to the matched text, not the whole file.
+ * own. Given the matched text plus where it sat, so a guard can look around it.
  */
 const MATCH_GUARDS = {
     // A `"link": true` entry is a workspace or pnpm symlink resolved to a path on
     // disk rather than a tarball, so it has no integrity hash by design. Thirty of
     // them in one pnpm-managed lockfile, every one reported as a false critical.
     VG870: (match) => !/"link"\s*:\s*true/.test(match),
+    // The verb list has no word boundary in front of it and includes `all`, `get`
+    // and `run`, so `querySelectorAll(\`[name="${CSS.escape(k)}"]\`)` reads as a
+    // SQL call. Weak verbs have to be backed by something that looks like SQL;
+    // `query`, `execute` and friends stand on their own. A real interpolated
+    // `exec(\`INSERT INTO ...\`)` still matches — checked against one.
+    VG010: (match) => {
+        const verb = /^[A-Za-z_]+/.exec(match)?.[0] ?? '';
+        return SQL_VERBS.test(verb) || SQL_KEYWORDS.test(match);
+    },
+    // `(?:child_process|cp)[\s\S]*?(?:exec|spawn…)` lets the bridge run to the end
+    // of the file: one match measured 3,608 characters and 109 lines, pairing an
+    // `import … from "node:child_process"` with an `exec(` far below it and
+    // reporting the import as a critical. A real one is a single statement.
+    VG011: (match) => (match.match(/\n/g)?.length ?? 0) <= 1,
+    // `sk-[A-Za-z0-9-_]{20,}` has no boundary in front of it, so the slug
+    // `best-disk-space-analyzer-mac-2026` contains an "OpenAI key" — the `sk-` in
+    // "di*sk-*space...". Real keys start at a token boundary; substrings of a word
+    // do not.
+    VG003: (_match, source, index) => index === 0 || !/[A-Za-z0-9_-]/.test(source[index - 1]),
+    // Both rules key off a *name* — anything called password, secret, apiKey — and
+    // accept any string as its value, so UI copy lands as a critical:
+    // `password: "That password didn't match. Try again."` was one. A credential
+    // is an opaque token, not a sentence and not a placeholder.
+    VG001: (match) => looksLikeSecretValue(match),
+    VG062: (match) => looksLikeSecretValue(match),
+    // "An attacker can request the entire table" is the rule's premise, and a
+    // query filtered to the caller's own rows does not let them. An unbounded
+    // fetch of your own data is a scalability question, not a security finding.
+    VG955: (match) => !/\bwhere\b[\s\S]{0,200}?\b(userId|user_id|ownerId|owner_id|orgId|org_id|organizationId|tenantId|tenant_id|workspaceId|workspace_id|accountId|account_id|teamId|team_id|shop|shopDomain|storeId|store_id)\b/i.test(match),
+    // `description: 'eval() executes arbitrary code…'` is prose about eval, not a
+    // call to it — and security tooling, which is a good deal of what gets
+    // scanned, is full of that prose. Code held in a string is not code running
+    // here; the eval that would run it is its own match, outside the quotes.
+    VG014: (_match, source, index) => !insideStringLiteral(source, index),
 };
-/** Paths where a match is a fixture or documentation rather than shipped code. */
-const NON_PRODUCTION_PATH = /(^|\/)(tests?|__tests__|__mocks__|__fixtures__|fixtures?|spec|specs|examples?|docs?|demo|samples?|e2e|cypress|playwright|stories)(\/|$)|\.(test|spec|stories|fixture)\.[a-z]+$/i;
 /** Regexes over very large files are where catastrophic backtracking bites. */
 const MAX_BYTES = 400_000;
 /** Upstream severities already use our vocabulary; this just narrows the type. */
@@ -135,7 +211,6 @@ export const communityScanner = {
             if (source === null || source.length > MAX_BYTES)
                 continue;
             const relPath = rel(ctx.root, file);
-            const fixture = NON_PRODUCTION_PATH.test(relPath);
             const lockfile = LOCKFILE.test(relPath);
             const suppress = new Suppressions(source);
             filesScanned++;
@@ -157,7 +232,7 @@ export const communityScanner = {
                     }
                     // Skipping a match must not skip the non-global `break` below, or a
                     // rule without /g would rescan from zero forever.
-                    if (guard && !guard(m[0])) {
+                    if (guard && !guard(m[0], source, m.index)) {
                         if (!re.global)
                             break;
                         continue;
@@ -166,12 +241,12 @@ export const communityScanner = {
                     const key = `${relPath}:${line}:${rule.id}`;
                     if (!seen.has(key) && !suppress.suppressed(line, rule.id)) {
                         seen.add(key);
+                        const placed = adjustForPath(severityOf(rule.severity), relPath);
                         result.findings.push({
                             id: rule.id,
-                            severity: fixture ? 'low' : severityOf(rule.severity),
+                            severity: placed.severity,
                             title: rule.name,
-                            detail: rule.description +
-                                (fixture ? ' (Path looks like tests or docs, so the severity is reduced.)' : ''),
+                            detail: rule.description + placed.note,
                             fix: rule.fixCode ? `${rule.fix}\n\n${rule.fixCode}` : rule.fix,
                             file: relPath,
                             line,

package/dist/scanners/logic.js

@@ -1,4 +1,5 @@
 import { read, rel, isScript, snippetAt } from '../utils/files.js';
+import { adjustForPath } from '../utils/paths.js';
 import { parseSource, calleeName, calleeTail } from '../utils/ast.js';
 import { traverse } from '../utils/traverse.js';
 import { Suppressions } from '../utils/suppress.js';
@@ -67,11 +68,17 @@ export const logicScanner = {
             if (source === null)
                 continue;
             const relPath = rel(ctx.root, file);
+            // A swallowed error or a logged token in a maintenance script is a
+            // smaller problem than the same line inside a request handler.
+            const place = (f) => {
+                const placed = adjustForPath(f.severity, relPath);
+                return { ...f, severity: placed.severity, detail: f.detail + placed.note };
+            };
             const suppress = new Suppressions(source);
             const push = (f) => {
                 if (suppress.suppressed(f.line, f.id))
                     return;
-                result.findings.push({ ...f, file: relPath, snippet: snippetAt(source, f.line) });
+                result.findings.push({ ...place(f), file: relPath, snippet: snippetAt(source, f.line) });
             };
             // Python is regex-only (no JS AST). Cover its highest-signal cases.
             if (python) {

package/dist/scanners/server-actions.js

@@ -179,10 +179,64 @@ credited) {
         // A Server Action's arguments *are* its input; a Route Handler has to go
         // and read one, so that is detected below.
         readsRequestInput: false,
+        wholePayloadLine: null,
     };
     // An id the caller passed in is not proof of ownership — it is the IDOR.
     // Only a principal resolved inside the function counts as scoping.
     const params = parameterNames(node.params ?? []);
+    /**
+     * Names holding the caller's payload as one object: a Server Action's own
+     * parameter, or a variable assigned from a request-body read. Writing one of
+     * these whole is mass assignment; pulling named fields out of it and writing
+     * those is the safe pattern this rule used to report anyway.
+     */
+    const payloads = new Set();
+    for (const p of node.params ?? []) {
+        // Only whole-object parameters. `({ name, role })` is already field by field.
+        if (p?.type === 'Identifier' && !/^(req|request|_req|_request|nextRequest)$/i.test(p.name)) {
+            payloads.add(p.name);
+        }
+    }
+    path.traverse({
+        VariableDeclarator(inner) {
+            const id = inner.node.id;
+            if (id?.type !== 'Identifier')
+                return; // destructuring is field by field
+            let init = inner.node.init;
+            while (init && (init.type === 'AwaitExpression' || init.type === 'TSNonNullExpression')) {
+                init = init.argument ?? init.expression;
+            }
+            if (!init)
+                return;
+            if (init.type === 'CallExpression' || init.type === 'OptionalCallExpression') {
+                const callee = calleeName(init.callee);
+                // `await request.json()`, and `JSON.parse(raw)` over one of these.
+                if (REQUEST_INPUT_READ.test(callee)) {
+                    payloads.add(id.name);
+                    return;
+                }
+                // `JSON.parse(raw)` and `Schema.parse(body)` both hand back the
+                // caller's object with its key set intact — a passthrough schema
+                // validates the fields it declares and keeps the rest (CTS044).
+                // A local helper that reads named fields into a literal is NOT this:
+                // its key set is fixed, which is exactly why it is safe to spread.
+                if (/(^|\.)JSON\.parse$/.test(callee) ||
+                    PAYLOAD_PRESERVING_CALLS.has(calleeTail(init.callee))) {
+                    for (const arg of init.arguments ?? []) {
+                        const root = arg?.type === 'Identifier' ? arg.name : rootObject(arg);
+                        if (root && payloads.has(root)) {
+                            payloads.add(id.name);
+                            break;
+                        }
+                    }
+                }
+                return;
+            }
+            // A plain alias: `const input = raw`.
+            if (init.type === 'Identifier' && payloads.has(init.name))
+                payloads.add(id.name);
+        },
+    });
     // `export async function GET(_req, { params })` — the segment values are
     // caller-supplied input just as much as a body is.
     if (params.has('params'))
@@ -224,20 +278,41 @@ credited) {
             if (info.mutationLine === null) {
                 info.mutationLine = inner.node.loc?.start.line ?? info.line;
             }
-            // `.update({ ...body })` writes whatever keys the caller chose to send.
-            for (const arg of inner.node.arguments ?? []) {
-                const props = arg?.type === 'ObjectExpression' ? arg.properties : null;
-                if (!props)
-                    continue;
-                for (const prop of props) {
-                    if (prop?.type !== 'SpreadElement')
+            // What actually reaches the columns: `.update({ ...body })`,
+            // `.insert(body)`, `prisma.x.update({ data: { ...body } })` — the last of
+            // which hides one level down, where a top-level scan never saw it.
+            const inspectWritten = (arg, depth) => {
+                if (!arg || depth > 2)
+                    return;
+                if (arg.type === 'Identifier') {
+                    if (payloads.has(arg.name)) {
+                        info.wholePayloadLine ??= arg.loc?.start.line ?? info.line;
+                    }
+                    return;
+                }
+                if (arg.type !== 'ObjectExpression')
+                    return;
+                for (const prop of arg.properties ?? []) {
+                    if (prop?.type === 'SpreadElement') {
+                        // Only the caller's own object counts. Spreading a locally built
+                        // literal — `...(x && { k: v })`, or an object a helper assembled
+                        // from named fields — writes a key set this code chose, which is
+                        // the safe pattern rather than the bug.
+                        const root = rootObject(prop.argument);
+                        if (!root || !payloads.has(root))
+                            continue;
+                        info.spreadLine ??= prop.loc?.start.line ?? info.line;
                         continue;
-                    const spreadOf = calleeName(prop.argument);
-                    if (/^(this|process|env)\b/.test(spreadOf))
+                    }
+                    if (prop?.type !== 'ObjectProperty')
+                        continue;
+                    if (!WRITE_PAYLOAD_KEYS.has(propertyKey(prop)))
                         continue;
-                    info.spreadLine ??= prop.loc?.start.line ?? info.line;
+                    inspectWritten(prop.value, depth + 1);
                 }
-            }
+            };
+            for (const arg of inner.node.arguments ?? [])
+                inspectWritten(arg, 0);
         }
         if (tail === 'from' || tail === 'select' || tail === 'findMany' || tail === 'findUnique' || tail === 'findFirst') {
             info.hasRead = true;
@@ -336,6 +411,25 @@ credited) {
     }
     return info;
 }
+/**
+ * Keys that hold the columns being written, one level inside the call argument.
+ * `prisma.user.update({ where, data: { ... } })`, `db.insert(t).values({ ... })`.
+ */
+const WRITE_PAYLOAD_KEYS = new Set(['data', 'values', 'set', 'create', 'update', 'insert', 'doc']);
+/**
+ * Calls that return the caller's object with its keys intact. A schema `.parse`
+ * belongs here because a passthrough schema — the CTS044 case — validates what
+ * it declares and hands back everything else untouched.
+ */
+const PAYLOAD_PRESERVING_CALLS = new Set([
+    'parse', 'parseAsync', 'safeParse', 'safeParseAsync', 'validate', 'validateSync', 'cast',
+]);
+function propertyKey(prop) {
+    const key = prop?.key;
+    if (!key)
+        return '';
+    return key.type === 'Identifier' ? key.name : key.type === 'StringLiteral' ? key.value : '';
+}
 const HTTP_MUTATION_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
 function isRouteHandlerFile(relPath) {
     return /(^|\/)(app|src\/app)\/.*\/route\.(t|j)sx?$/.test(relPath);
@@ -446,23 +540,28 @@ export const serverActionsScanner = {
                         meta: { action: name, kind },
                     });
                 }
-                // A Route Handler that never reads a body, query or route param has no
-                // caller input to validate — reporting one is noise, and it was firing
-                // on cron endpoints whose whole body is a secret comparison.
-                const hasInput = !isRoute || info.readsRequestInput;
-                if (info.params > 0 && writes && hasInput && !info.hasValidation) {
+                // Narrowed deliberately. The old condition — parameters, a write, no
+                // `.parse()` — reported the ordinary safe pattern: pull named fields out
+                // of the payload, write an explicit column list. 92 of 92 hits on one
+                // dogfooded app were that shape. What actually carries the danger is the
+                // payload reaching the columns *as an object*, which is the only case
+                // where a field the caller invented can land in the row. A spread is
+                // that same danger and CTS043 already names it, so it is left to CTS043.
+                const massAssignable = info.wholePayloadLine !== null && info.spreadLine === null;
+                if (info.params > 0 && writes && massAssignable && !info.hasValidation) {
                     push({
                         id: 'CTS002',
                         severity: 'high',
-                        title: `${kind} input is never validated at runtime`,
-                        detail: `\`${name}\` accepts caller-supplied arguments and writes them to the database ` +
-                            'without runtime schema validation. TypeScript types are erased at runtime, so a ' +
-                            'crafted payload can carry extra fields straight into the write (mass assignment).',
+                        title: `${kind} writes caller-supplied data without validating it`,
+                        detail: `\`${name}\` passes an object it received straight into a database write, with no ` +
+                            'runtime schema validation. TypeScript types are erased at runtime, so every key the ' +
+                            'caller chose to send is written — adding `"is_admin": true` to the payload is enough ' +
+                            'to set that column (mass assignment).',
                         fix: 'Parse the input before use:\n' +
                             "  const parsed = MySchema.safeParse(raw)\n" +
                             "  if (!parsed.success) throw new Error('Invalid input')\n" +
                             'and pass `parsed.data` — never the raw argument — to the query.',
-                        line: info.line,
+                        line: info.wholePayloadLine ?? info.line,
                         cwe: 'CWE-20: Improper Input Validation',
                         owasp: 'A05:2025 - Injection',
                         meta: { action: name, kind },
@@ -613,8 +712,6 @@ export const serverActionsScanner = {
                                 return;
                             const name = d.id.name;
                             const method = routeFile && /^(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)$/.test(name) ? name : undefined;
-                            // cleartoship-ignore VG010 — Babel's AST accessor, not a SQL call;
-                            // the rule's verb list includes the generic `get`.
                             const initPath = path.get(`declaration.declarations.${i}.init`);
                             handle(initPath, name, true, method);
                         });

package/dist/utils/ast.js

@@ -15,7 +15,10 @@ export function parseSource(code, filename) {
         'classPrivateMethods',
         'dynamicImport',
         'topLevelAwait',
-        'importAssertions',
+        // `importAssertions` until Babel 8 removed it, which makes every parse
+        // throw and silently costs every AST rule its findings. The replacement
+        // has existed since 7.22, so this is correct on both.
+        'importAttributes',
         'explicitResourceManagement',
     ];
     if (isTs || isTsx)

package/dist/utils/files.d.ts

@@ -1,4 +1,11 @@
-export declare function walk(root: string): string[];
+export interface WalkResult {
+    files: string[];
+    /** How many paths were left out because the repository ignores them. */
+    gitIgnored: number;
+}
+export declare function walk(root: string, options?: {
+    respectGitignore?: boolean;
+}): WalkResult;
 export declare function read(file: string): string | null;
 export declare function rel(root: string, file: string): string;
 export declare function exists(p: string): boolean;

package/dist/utils/files.js

@@ -1,5 +1,6 @@
 import { readdirSync, statSync, readFileSync, existsSync } from 'node:fs';
 import { join, relative, sep } from 'node:path';
+import { Gitignore, extendedAt, repositoryExcludes } from './gitignore.js';
 const SKIP_DIRS = new Set([
     'node_modules', '.git', '.next', '.turbo', '.vercel', '.wrangler',
     'dist', 'build', 'out', 'coverage', '.venv', 'venv', '__pycache__',
@@ -48,11 +49,22 @@ function looksGenerated(fullPath, size) {
         return false;
     }
 }
-export function walk(root) {
+/**
+ * Files a `.gitignore` excludes are still worth reading, because the tool
+ * reasons about them by name: a secret in an ignored `.env` is on your disk
+ * either way, and CTS032 exists to check that the file is ignored at all.
+ */
+const SCAN_EVEN_IF_IGNORED = /(^|\/)\.env(\.|$)/;
+export function walk(root, options = {}) {
+    const respect = options.respectGitignore !== false;
     const found = [];
-    const stack = [root];
+    let gitIgnored = 0;
+    const rootRules = respect
+        ? extendedAt(repositoryExcludes(root, read), root, read)
+        : Gitignore.empty();
+    const stack = [{ dir: root, rules: rootRules }];
     while (stack.length) {
-        const dir = stack.pop();
+        const { dir, rules } = stack.pop();
         let entries;
         try {
             entries = readdirSync(dir);
@@ -72,11 +84,21 @@ export function walk(root) {
             if (st.isDirectory()) {
                 if (SKIP_DIRS.has(entry))
                     continue;
-                stack.push(full);
+                // git never descends into an ignored directory, and neither do we —
+                // which is also where most of the saving comes from.
+                if (respect && rules.ignores(full, true)) {
+                    gitIgnored++;
+                    continue;
+                }
+                stack.push({ dir: full, rules: respect ? extendedAt(rules, full, read) : rules });
                 continue;
             }
             if (!st.isFile() || st.size > MAX_FILE_BYTES)
                 continue;
+            if (respect && !SCAN_EVEN_IF_IGNORED.test(full) && rules.ignores(full, false)) {
+                gitIgnored++;
+                continue;
+            }
             const dot = entry.lastIndexOf('.');
             const ext = dot === -1 ? '' : entry.slice(dot);
             // .env, .env.local, requirements.txt and friends have no useful extension.
@@ -91,7 +113,7 @@ export function walk(root) {
             }
         }
     }
-    return found.sort();
+    return { files: found.sort(), gitIgnored };
 }
 export function read(file) {
     try {

package/dist/utils/gitignore.d.ts

@@ -0,0 +1,21 @@
+export declare class Gitignore {
+    private readonly layers;
+    private constructor();
+    static empty(): Gitignore;
+    /** A copy of this matcher with one more `.gitignore`'s worth of rules. */
+    extend(base: string, content: string): Gitignore;
+    get isEmpty(): boolean;
+    /**
+     * Whether git would ignore `absPath`. Deepest layer first, and inside a layer
+     * the last matching pattern decides — both are git's own rules.
+     */
+    ignores(absPath: string, isDir: boolean): boolean;
+}
+/** The ignore rules that apply at `dir`, given those inherited from above. */
+export declare function extendedAt(parent: Gitignore, dir: string, read: (path: string) => string | null): Gitignore;
+/**
+ * Repository-local excludes. Same syntax, same precedence as a root
+ * `.gitignore`, but kept out of version control — so a machine-specific
+ * scratch directory is invisible here without appearing in anyone's diff.
+ */
+export declare function repositoryExcludes(root: string, read: (path: string) => string | null): Gitignore;

package/dist/utils/gitignore.js

@@ -0,0 +1,140 @@
+import { join } from 'node:path';
+function escapeLiteral(ch) {
+    return /[.*+?^${}()|[\]\\]/.test(ch) ? '\\' + ch : ch;
+}
+/** Translates one gitignore pattern body into a regex source. */
+function translate(pattern) {
+    let out = '';
+    for (let i = 0; i < pattern.length; i++) {
+        const ch = pattern[i];
+        if (ch === '\\' && i + 1 < pattern.length) {
+            out += escapeLiteral(pattern[++i]);
+            continue;
+        }
+        if (ch === '*') {
+            const doubled = pattern[i + 1] === '*';
+            if (doubled) {
+                const atStart = i === 0 || pattern[i - 1] === '/';
+                const slashAfter = pattern[i + 2] === '/';
+                if (atStart && slashAfter) {
+                    // `**/` matches zero or more leading directories.
+                    out += '(?:[^/]+/)*';
+                    i += 2;
+                    continue;
+                }
+                // A trailing or embedded `**` crosses directory boundaries.
+                out += '.*';
+                i += 1;
+                continue;
+            }
+            out += '[^/]*';
+            continue;
+        }
+        if (ch === '?') {
+            out += '[^/]';
+            continue;
+        }
+        if (ch === '[') {
+            const close = pattern.indexOf(']', i + 1);
+            if (close === -1) {
+                out += '\\[';
+                continue;
+            }
+            let body = pattern.slice(i + 1, close);
+            if (body.startsWith('!'))
+                body = '^' + body.slice(1);
+            out += '[' + body + ']';
+            i = close;
+            continue;
+        }
+        out += escapeLiteral(ch);
+    }
+    return out;
+}
+function compile(line) {
+    // Trailing whitespace is not part of the pattern unless it was escaped.
+    let pattern = line.replace(/(?<!\\)\s+$/, '');
+    if (pattern === '' || pattern.startsWith('#'))
+        return null;
+    let negated = false;
+    if (pattern.startsWith('!')) {
+        negated = true;
+        pattern = pattern.slice(1);
+    }
+    else if (pattern.startsWith('\\!') || pattern.startsWith('\\#')) {
+        pattern = pattern.slice(1);
+    }
+    let dirOnly = false;
+    if (pattern.endsWith('/')) {
+        dirOnly = true;
+        pattern = pattern.slice(0, -1);
+    }
+    if (pattern === '')
+        return null;
+    // A slash anywhere but the end anchors the pattern to this file's directory;
+    // otherwise it matches a basename at any depth.
+    const anchored = pattern.includes('/');
+    if (pattern.startsWith('/'))
+        pattern = pattern.slice(1);
+    const body = translate(pattern);
+    const source = anchored ? `^${body}(?:/.*)?$` : `(?:^|/)${body}(?:/.*)?$`;
+    return { re: new RegExp(source), negated, dirOnly };
+}
+export class Gitignore {
+    layers;
+    constructor(layers) {
+        this.layers = layers;
+    }
+    static empty() {
+        return new Gitignore([]);
+    }
+    /** A copy of this matcher with one more `.gitignore`'s worth of rules. */
+    extend(base, content) {
+        const rules = [];
+        for (const line of content.split(/\r?\n/)) {
+            const rule = compile(line);
+            if (rule)
+                rules.push(rule);
+        }
+        if (rules.length === 0)
+            return this;
+        return new Gitignore([...this.layers, { base: base.replace(/\/+$/, ''), rules }]);
+    }
+    get isEmpty() {
+        return this.layers.length === 0;
+    }
+    /**
+     * Whether git would ignore `absPath`. Deepest layer first, and inside a layer
+     * the last matching pattern decides — both are git's own rules.
+     */
+    ignores(absPath, isDir) {
+        for (let i = this.layers.length - 1; i >= 0; i--) {
+            const layer = this.layers[i];
+            if (!absPath.startsWith(layer.base + '/'))
+                continue;
+            const relative = absPath.slice(layer.base.length + 1);
+            for (let j = layer.rules.length - 1; j >= 0; j--) {
+                const rule = layer.rules[j];
+                if (rule.dirOnly && !isDir)
+                    continue;
+                if (rule.re.test(relative))
+                    return !rule.negated;
+            }
+        }
+        return false;
+    }
+}
+/** The ignore rules that apply at `dir`, given those inherited from above. */
+export function extendedAt(parent, dir, read) {
+    const content = read(join(dir, '.gitignore'));
+    return content === null ? parent : parent.extend(dir, content);
+}
+/**
+ * Repository-local excludes. Same syntax, same precedence as a root
+ * `.gitignore`, but kept out of version control — so a machine-specific
+ * scratch directory is invisible here without appearing in anyone's diff.
+ */
+export function repositoryExcludes(root, read) {
+    const content = read(join(root, '.git', 'info', 'exclude'));
+    return content === null ? Gitignore.empty() : Gitignore.empty().extend(root, content);
+}

package/dist/utils/paths.d.ts

@@ -0,0 +1,21 @@
+import type { Severity } from '../types.js';
+/**
+ * Where a file sits decides how much a finding in it matters. A dependency CVE
+ * already gets this treatment — CTS024 separates what ships from what only ever
+ * runs on a developer's machine — and the same reasoning applies to the rules
+ * that read code: an interpolated query in a migration script you run by hand is
+ * a different risk from one behind a public HTTP endpoint, and neither is the
+ * same as one in a test fixture.
+ */
+export type PathClass = 'production' | 'dev-tooling' | 'non-production';
+export declare function pathClass(relPath: string): PathClass;
+/** One step down the scale, floored at `low`. */
+export declare function demote(severity: Severity): Severity;
+/**
+ * The severity a finding should carry once you know where it lives, plus the
+ * sentence explaining the adjustment — always stated, never silent.
+ */
+export declare function adjustForPath(severity: Severity, relPath: string): {
+    severity: Severity;
+    note: string;
+};

package/dist/utils/paths.js

@@ -0,0 +1,48 @@
+import { SEVERITY_ORDER } from '../types.js';
+/** Tests, fixtures, examples and docs: the code is there to be read, not run. */
+const NON_PRODUCTION = /(^|\/)(tests?|__tests__|__mocks__|__fixtures__|fixtures?|spec|specs|examples?|docs?|demo|samples?|e2e|cypress|playwright|stories)(\/|$)|\.(test|spec|stories|fixture)\.[a-z]+$/i;
+/**
+ * Build and maintenance tooling. It runs on a developer's machine or in CI,
+ * with credentials its author already holds, and never answers a request from
+ * the internet — so nothing here is reachable by an attacker who is not already
+ * inside the repository.
+ *
+ * `bin/` is deliberately absent: for a published CLI that is the shipped entry
+ * point. So is `migrations/`, which is the production schema.
+ */
+const DEV_TOOLING = /(^|\/)(scripts?|tools?|tooling|\.github|\.husky|\.circleci|seeds?|benchmarks?|codegen)(\/|$)|(^|\/)[^/]*\.config\.[cm]?[jt]s$|(^|\/)(Makefile|Dockerfile[^/]*|docker-compose[^/]*\.ya?ml)$/i;
+export function pathClass(relPath) {
+    if (NON_PRODUCTION.test(relPath))
+        return 'non-production';
+    if (DEV_TOOLING.test(relPath))
+        return 'dev-tooling';
+    return 'production';
+}
+const ORDER = ['info', 'low', 'medium', 'high', 'critical'];
+/** One step down the scale, floored at `low`. */
+export function demote(severity) {
+    const index = SEVERITY_ORDER[severity];
+    return ORDER[Math.max(1, index - 1)];
+}
+/**
+ * The severity a finding should carry once you know where it lives, plus the
+ * sentence explaining the adjustment — always stated, never silent.
+ */
+export function adjustForPath(severity, relPath) {
+    switch (pathClass(relPath)) {
+        case 'non-production':
+            return {
+                severity: 'low',
+                note: ' (Path looks like tests, fixtures or docs, so the severity is reduced.)',
+            };
+        case 'dev-tooling':
+            return {
+                severity: demote(severity),
+                note: ' (Path is build or maintenance tooling rather than shipped code — it runs on a ' +
+                    'developer machine or in CI, not in response to a request — so the severity is one ' +
+                    'step lower than it would be in the app itself.)',
+            };
+        default:
+            return { severity, note: '' };
+    }
+}

package/examples/security-cli.yml

@@ -20,8 +20,8 @@ jobs:
   preflight:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
 
@@ -29,7 +29,7 @@ jobs:
       # the gate is the second run, so a finding is visible in the UI even when
       # it blocks the build.
       - run: npx cleartoship --sarif -o cleartoship.sarif --fail-on=none
-      - uses: github/codeql-action/upload-sarif@v3
+      - uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: cleartoship.sarif
 

package/examples/security.yml

@@ -21,8 +21,8 @@ jobs:
   preflight:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: murtazaozdemir/cleartoship@v0.9.0
+      - uses: actions/checkout@v7
+      - uses: murtazaozdemir/cleartoship@v0.10.0
         with:
           fail-on: critical   # block the PR only on criticals
           comment: true        # post a summary comment on the PR

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cleartoship",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "The 30-second pre-launch security clearance for AI-built & vibe-coded apps. Catches missing Server Action auth, Supabase RLS holes, hallucinated npm packages and leaked keys.",
   "keywords": [
     "security",
@@ -55,8 +55,8 @@
   },
   "devDependencies": {
     "@types/babel__traverse": "^7.20.6",
-    "@types/node": "^22.5.0",
-    "typescript": "^5.6.0"
+    "@types/node": "^26.4.0",
+    "typescript": "^7.0.2"
   },
   "repository": {
     "type": "git",