codeslick-cli 1.3.0 → 1.4.1

package/dist/src/lib/utils/ignore-patterns.js

@@ -0,0 +1,212 @@
+"use strict";
+/**
+ * CodeSlick Ignore Patterns Utility
+ *
+ * Handles .codeslickignore file processing and pattern matching
+ * to exclude files from security analysis (analyzers, tests, examples, etc.)
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadIgnorePatterns = loadIgnorePatterns;
+exports.shouldIgnoreFile = shouldIgnoreFile;
+exports.hasInlineSuppression = hasInlineSuppression;
+exports.isAnalyzerImplementation = isAnalyzerImplementation;
+exports.isEducationalContent = isEducationalContent;
+exports.isTestFile = isTestFile;
+exports.isLegitimateAPI = isLegitimateAPI;
+exports.filterSuppressedVulnerabilities = filterSuppressedVulnerabilities;
+exports.clearCache = clearCache;
+const minimatch_1 = require("minimatch");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+let cachedPatterns = null;
+/**
+ * Load patterns from .codeslickignore file
+ */
+function loadIgnorePatterns(projectRoot = process.cwd()) {
+    // Return cached patterns if already loaded
+    if (cachedPatterns?.loaded && cachedPatterns.ignoreFile === projectRoot) {
+        return cachedPatterns.patterns;
+    }
+    const ignoreFilePath = path_1.default.join(projectRoot, '.codeslickignore');
+    const patterns = [];
+    try {
+        if (fs_1.default.existsSync(ignoreFilePath)) {
+            const content = fs_1.default.readFileSync(ignoreFilePath, 'utf-8');
+            const lines = content.split('\n');
+            for (const line of lines) {
+                const trimmed = line.trim();
+                // Skip empty lines and comments
+                if (trimmed === '' || trimmed.startsWith('#')) {
+                    continue;
+                }
+                patterns.push(trimmed);
+            }
+        }
+    }
+    catch (error) {
+        console.warn(`Warning: Could not read .codeslickignore file: ${error}`);
+    }
+    // Cache the patterns
+    cachedPatterns = {
+        patterns,
+        loaded: true,
+        ignoreFile: projectRoot,
+    };
+    return patterns;
+}
+/**
+ * Check if a file should be ignored based on .codeslickignore patterns
+ */
+function shouldIgnoreFile(filePath, projectRoot = process.cwd()) {
+    const patterns = loadIgnorePatterns(projectRoot);
+    if (patterns.length === 0) {
+        return false;
+    }
+    // Normalize path to use forward slashes (works on both Windows and Unix)
+    const normalizedPath = filePath.replace(/\\/g, '/');
+    // Get relative path from project root
+    const relativePath = path_1.default.relative(projectRoot, filePath).replace(/\\/g, '/');
+    // Check against each pattern
+    for (const pattern of patterns) {
+        // Test both absolute and relative paths
+        if ((0, minimatch_1.minimatch)(normalizedPath, pattern, { dot: true, matchBase: true }) ||
+            (0, minimatch_1.minimatch)(relativePath, pattern, { dot: true, matchBase: true })) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Check if code contains an inline suppression comment
+ * Supports:
+ *   // codeslick-ignore-next-line: reason  (JavaScript, TypeScript, Java, Go, Terraform)
+ *   # codeslick-ignore-next-line: reason   (Python)
+ *
+ * @param code - The full source code
+ * @param lineNumber - 1-indexed line number where the issue was detected
+ */
+function hasInlineSuppression(code, lineNumber) {
+    const lines = code.split('\n');
+    // Check the line BEFORE the issue
+    // lineNumber is 1-indexed, so line 11 means we want to check line 10
+    // Array is 0-indexed, so line 10 is at index 9, which is lineNumber - 2
+    if (lineNumber > 1 && lineNumber <= lines.length) {
+        const previousLine = lines[lineNumber - 2]; // Fixed: was lineNumber - 1
+        // Match: // codeslick-ignore-next-line or // codeslick-ignore-next-line: reason
+        const slashMatch = previousLine.match(/\/\/\s*codeslick-ignore-next-line(?::\s*(.+))?/);
+        if (slashMatch) {
+            return {
+                suppressed: true,
+                reason: slashMatch[1]?.trim() || 'Inline suppression',
+            };
+        }
+        // Match: # codeslick-ignore-next-line or # codeslick-ignore-next-line: reason (Python)
+        const hashMatch = previousLine.match(/#\s*codeslick-ignore-next-line(?::\s*(.+))?/);
+        if (hashMatch) {
+            return {
+                suppressed: true,
+                reason: hashMatch[1]?.trim() || 'Inline suppression',
+            };
+        }
+    }
+    return { suppressed: false };
+}
+/**
+ * Check if code is in an analyzer implementation file
+ * (contains detection patterns, not actual vulnerabilities)
+ */
+function isAnalyzerImplementation(filePath) {
+    const normalizedPath = filePath.replace(/\\/g, '/');
+    // Analyzer implementation patterns
+    const analyzerPatterns = [
+        /\/analyzers\/.*-analyzer\.ts$/,
+        /\/analyzers\/.*\/checks\//,
+        /\/analyzers\/.*\/parser\.ts$/,
+    ];
+    return analyzerPatterns.some(pattern => pattern.test(normalizedPath));
+}
+/**
+ * Check if code is educational/example content
+ * (may contain intentional vulnerabilities for demonstration)
+ */
+function isEducationalContent(filePath) {
+    const normalizedPath = filePath.replace(/\\/g, '/').toLowerCase();
+    const educationalPatterns = [
+        /ai-examples\//,
+        /examples\//,
+        /\/security-fixer\.ts$/,
+        /\/pattern-fixer\.ts$/,
+        /docs\/.*\.md$/,
+    ];
+    return educationalPatterns.some(pattern => pattern.test(normalizedPath));
+}
+/**
+ * Check if file is a test file
+ */
+function isTestFile(filePath) {
+    const normalizedPath = filePath.replace(/\\/g, '/');
+    const testPatterns = [
+        /\.test\.(ts|js|tsx|jsx|py|go|java)$/,
+        /\/__tests__\//,
+        /\/__mocks__\//,
+        /\/tests?\//,
+        /^test-.*\.(tf|ts|js|py|go|java)$/,
+    ];
+    return testPatterns.some(pattern => pattern.test(normalizedPath));
+}
+/**
+ * Check if a URL is a known legitimate API endpoint
+ * (whitelisted APIs that should not be flagged as SSRF)
+ */
+function isLegitimateAPI(url) {
+    const legitimateAPIs = [
+        'openrouter.ai',
+        'api.openai.com',
+        'anthropic.com',
+        'api.anthropic.com',
+        'api.deepseek.com',
+        'together.xyz',
+        'api.together.xyz',
+        'replicate.com',
+        'vercel.com',
+        'github.com',
+        'api.github.com',
+    ];
+    try {
+        const parsedUrl = new URL(url);
+        return legitimateAPIs.some(domain => parsedUrl.hostname.includes(domain));
+    }
+    catch {
+        // If URL parsing fails, don't whitelist
+        return false;
+    }
+}
+/**
+ * Filter vulnerabilities based on inline suppression comments
+ * Removes vulnerabilities that have a codeslick-ignore-next-line comment above them
+ */
+function filterSuppressedVulnerabilities(code, vulnerabilities) {
+    return vulnerabilities.filter(vuln => {
+        // Skip if no line number (can't check suppression)
+        if (!vuln.line) {
+            return true;
+        }
+        const { suppressed, reason } = hasInlineSuppression(code, vuln.line);
+        if (suppressed) {
+            // Log suppression for debugging (can be removed in production)
+            console.log(`[CodeSlick] Suppressed vulnerability at line ${vuln.line}: ${reason}`);
+            return false;
+        }
+        return true;
+    });
+}
+/**
+ * Clear cached patterns (useful for testing)
+ */
+function clearCache() {
+    cachedPatterns = null;
+}
+//# sourceMappingURL=ignore-patterns.js.map

package/dist/src/lib/utils/ignore-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ignore-patterns.js","sourceRoot":"","sources":["../../../../../../src/lib/utils/ignore-patterns.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;AAiBH,gDAmCC;AAKD,4CAuBC;AAWD,oDA6BC;AAMD,4DAWC;AAMD,oDAYC;AAKD,gCAYC;AAMD,0CAsBC;AAMD,0EAkBC;AAKD,gCAEC;AArOD,yCAAsC;AACtC,4CAAoB;AACpB,gDAAwB;AAQxB,IAAI,cAAc,GAA0B,IAAI,CAAC;AAEjD;;GAEG;AACH,SAAgB,kBAAkB,CAAC,cAAsB,OAAO,CAAC,GAAG,EAAE;IACpE,2CAA2C;IAC3C,IAAI,cAAc,EAAE,MAAM,IAAI,cAAc,CAAC,UAAU,KAAK,WAAW,EAAE,CAAC;QACxE,OAAO,cAAc,CAAC,QAAQ,CAAC;IACjC,CAAC;IAED,MAAM,cAAc,GAAG,cAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,CAAC;QACH,IAAI,YAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,YAAE,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YACzD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAElC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,gCAAgC;gBAChC,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9C,SAAS;gBACX,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,kDAAkD,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,qBAAqB;IACrB,cAAc,GAAG;QACf,QAAQ;QACR,MAAM,EAAE,IAAI;QACZ,UAAU,EAAE,WAAW;KACxB,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,QAAgB,EAAE,cAAsB,OAAO,CAAC,GAAG,EAAE;IACpF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAEjD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,yEAAyE;IACzE,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEpD,sCAAsC;IACtC,MAAM,YAAY,GAAG,cAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAE9E,6BAA6B;IAC7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,wCAAwC;QACxC,IAAI,IAAA,qBAAS,EAAC,cAAc,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAClE,IAAA,qBAAS,EAAC,YAAY,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,oBAAoB,CAAC,IAAY,EAAE,UAAkB;IACnE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAE/B,kCAAkC;IAClC,qEAAqE;IACrE,wEAAwE;IACxE,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjD,MAAM,YAAY,GAAG,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,4BAA4B;QAExE,gFAAgF;QAChF,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACxF,IAAI,UAAU,EAAE,CAAC;YACf,OAAO;gBACL,UAAU,EAAE,IAAI;gBAChB,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,oBAAoB;aACtD,CAAC;QACJ,CAAC;QAED,uFAAuF;QACvF,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACpF,IAAI,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,UAAU,EAAE,IAAI;gBAChB,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,oBAAoB;aACrD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,SAAgB,wBAAwB,CAAC,QAAgB;IACvD,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEpD,mCAAmC;IACnC,MAAM,gBAAgB,GAAG;QACvB,+BAA+B;QAC/B,2BAA2B;QAC3B,8BAA8B;KAC/B,CAAC;IAEF,OAAO,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,QAAgB;IACnD,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAElE,MAAM,mBAAmB,GAAG;QAC1B,eAAe;QACf,YAAY;QACZ,uBAAuB;QACvB,sBAAsB;QACtB,eAAe;KAChB,CAAC;IAEF,OAAO,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;GAEG;AACH,SAAgB,UAAU,CAAC,QAAgB;IACzC,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEpD,MAAM,YAAY,GAAG;QACnB,qCAAqC;QACrC,eAAe;QACf,eAAe;QACf,YAAY;QACZ,kCAAkC;KACnC,CAAC;IAEF,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,GAAW;IACzC,MAAM,cAAc,GAAG;QACrB,eAAe;QACf,gBAAgB;QAChB,eAAe;QACf,mBAAmB;QACnB,kBAAkB;QAClB,cAAc;QACd,kBAAkB;QAClB,eAAe;QACf,YAAY;QACZ,YAAY;QACZ,gBAAgB;KACjB,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,+BAA+B,CAC7C,IAAY,EACZ,eAAoB;IAEpB,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACnC,mDAAmD;QACnD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,UAAU,EAAE,CAAC;YACf,+DAA+D;YAC/D,OAAO,CAAC,GAAG,CAAC,gDAAgD,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;YACpF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAgB,UAAU;IACxB,cAAc,GAAG,IAAI,CAAC;AACxB,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "codeslick-cli",
-  "version": "1.3.0",
-  "description": "CodeSlick CLI tool for pre-commit security scanning",
+  "version": "1.4.1",
+  "description": "CodeSlick CLI tool for pre-commit security scanning with Terraform IaC support",
   "main": "dist/index.js",
   "bin": {
     "codeslick": "./bin/codeslick.cjs",
@@ -19,7 +19,10 @@
     "static-analysis",
     "pre-commit",
     "git-hook",
-    "vulnerability-scanner"
+    "vulnerability-scanner",
+    "terraform",
+    "iac",
+    "infrastructure-as-code"
   ],
   "author": "CodeSlick <support@codeslick.dev>",
   "license": "MIT",
@@ -36,12 +39,12 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
-    "yargs": "^17.7.2",
     "chalk": "^4.1.2",
-    "ora": "^5.4.1",
     "cli-table3": "^0.6.3",
-    "glob": "^10.3.10",
-    "typescript": "^5.3.3"
+    "glob": "^13.0.1",
+    "ora": "^5.4.1",
+    "typescript": "^5.3.3",
+    "yargs": "^17.7.2"
   },
   "devDependencies": {
     "@types/node": "^20.10.0",

package/src/commands/scan.ts

@@ -291,8 +291,10 @@ export async function scanCommand(args: ScanArgs): Promise<void> {
     // Collect unique languages scanned
     const languages = [...new Set(results.map(r => r.language))];
 
-    // Send telemetry (fire-and-forget, won't block exit)
-    trackScan({
+    // Send telemetry — store the promise so we can await it before process.exit.
+    // process.exit() terminates all pending async ops, so fire-and-forget never
+    // completes. The telemetry function has a 3-second timeout built in.
+    const telemetryDone = trackScan({
       filesScanned: results.length,
       languages,
       vulnerabilities: {
@@ -302,7 +304,7 @@ export async function scanCommand(args: ScanArgs): Promise<void> {
         low: totalLow,
       },
       scanDuration: duration,
-    }).catch(() => {}); // Ignore telemetry errors
+    }).catch(() => {}); // Never let telemetry errors surface
 
     // WR2: Build threshold configuration from CLI args or use defaults
     // NOTE: For CLI, thresholds are ENABLED by default (unlike dashboard which is opt-in)
@@ -382,6 +384,7 @@ export async function scanCommand(args: ScanArgs): Promise<void> {
         }
       }
 
+      await telemetryDone; // Wait for telemetry before terminating process
       process.exit(1); // Exit with failure
     } else {
       if (!args.json) {
@@ -391,6 +394,7 @@ export async function scanCommand(args: ScanArgs): Promise<void> {
         }
       }
 
+      await telemetryDone; // Wait for telemetry before terminating process
       process.exit(0); // Exit with success
     }
   } catch (error) {

package/src/reporters/cli-reporter.ts

@@ -59,18 +59,38 @@ export function getSeveritySymbol(severity: string): string {
 
 /**
  * Print scan results summary table
+ *
+ * IMPORTANT: Recalculates counts from actual filtered vulnerabilities
+ * to ensure summary reflects false-positive filtering.
  */
 export function printSummaryTable(results: FileScanResult[]): void {
   const totalFiles = results.length;
-  const totalCritical = results.reduce((sum, r) => sum + r.critical, 0);
-  const totalHigh = results.reduce((sum, r) => sum + r.high, 0);
-  const totalMedium = results.reduce((sum, r) => sum + r.medium, 0);
-  const totalLow = results.reduce((sum, r) => sum + r.low, 0);
-  const totalVulns = totalCritical + totalHigh + totalMedium + totalLow;
 
-  const filesWithIssues = results.filter(
-    (r) => r.critical > 0 || r.high > 0 || r.medium > 0 || r.low > 0
-  ).length;
+  // Recalculate from actual vulnerabilities (post-filtering)
+  let totalCritical = 0;
+  let totalHigh = 0;
+  let totalMedium = 0;
+  let totalLow = 0;
+  let filesWithIssues = 0;
+
+  results.forEach((r) => {
+    const vulns = r.result.security?.vulnerabilities || [];
+    const crit = vulns.filter((v: any) => v.severity?.toLowerCase() === 'critical').length;
+    const high = vulns.filter((v: any) => v.severity?.toLowerCase() === 'high').length;
+    const med = vulns.filter((v: any) => v.severity?.toLowerCase() === 'medium').length;
+    const low = vulns.filter((v: any) => v.severity?.toLowerCase() === 'low').length;
+
+    totalCritical += crit;
+    totalHigh += high;
+    totalMedium += med;
+    totalLow += low;
+
+    if (crit + high + med + low > 0) {
+      filesWithIssues++;
+    }
+  });
+
+  const totalVulns = totalCritical + totalHigh + totalMedium + totalLow;
 
   console.log('');
   console.log(chalk.bold('Scan Summary'));
@@ -281,6 +301,8 @@ export function printCommitAllowed(): void {
 /**
  * Print summary table grouped by language
  * Shows files scanned, issues found, and critical count per language
+ *
+ * IMPORTANT: Recalculates counts from actual filtered vulnerabilities.
  */
 export function printLanguageSummary(results: FileScanResult[]): void {
   // Group results by language
@@ -289,12 +311,20 @@ export function printLanguageSummary(results: FileScanResult[]): void {
   for (const result of results) {
     const lang = result.language;
     const existing = byLanguage.get(lang) || { files: 0, issues: 0, critical: 0, high: 0, medium: 0, low: 0 };
+
+    // Recalculate from actual vulnerabilities
+    const vulns = result.result.security?.vulnerabilities || [];
+    const crit = vulns.filter((v: any) => v.severity?.toLowerCase() === 'critical').length;
+    const high = vulns.filter((v: any) => v.severity?.toLowerCase() === 'high').length;
+    const med = vulns.filter((v: any) => v.severity?.toLowerCase() === 'medium').length;
+    const low = vulns.filter((v: any) => v.severity?.toLowerCase() === 'low').length;
+
     existing.files++;
-    existing.critical += result.critical;
-    existing.high += result.high;
-    existing.medium += result.medium;
-    existing.low += result.low;
-    existing.issues += result.critical + result.high + result.medium + result.low;
+    existing.critical += crit;
+    existing.high += high;
+    existing.medium += med;
+    existing.low += low;
+    existing.issues += crit + high + med + low;
     byLanguage.set(lang, existing);
   }
 
@@ -478,29 +508,76 @@ function truncateMessage(message: string, maxLength: number): string {
 
 /**
  * Output results as JSON
+ *
+ * IMPORTANT: Summary counts are calculated from ACTUAL filtered vulnerabilities,
+ * not from pre-calculated counts. This ensures the summary reflects
+ * false-positive filtering applied during analysis.
  */
 export function printJSONResults(results: FileScanResult[]): void {
+  // Recalculate counts from actual filtered vulnerabilities
+  // This ensures summary matches the vulnerabilities array after false-positive filtering
+  const recalculateCountsFromVulnerabilities = (r: FileScanResult) => {
+    const vulns = r.result.security?.vulnerabilities || [];
+    const counts = {
+      critical: vulns.filter((v: any) => v.severity?.toLowerCase() === 'critical').length,
+      high: vulns.filter((v: any) => v.severity?.toLowerCase() === 'high').length,
+      medium: vulns.filter((v: any) => v.severity?.toLowerCase() === 'medium').length,
+      low: vulns.filter((v: any) => v.severity?.toLowerCase() === 'low').length,
+    };
+
+    // Debug first file
+    if (process.env.DEBUG_COUNTS && r.relativePath === 'scripts/reset-quota.ts') {
+      console.error(`[DEBUG] ${r.relativePath}: old_high=${r.high}, new_high=${counts.high}, total_vulns=${vulns.length}`);
+    }
+
+    return counts;
+  };
+
+  // Calculate accurate summary from filtered vulnerabilities
+  let totalCritical = 0;
+  let totalHigh = 0;
+  let totalMedium = 0;
+  let totalLow = 0;
+  let filesWithIssues = 0;
+
+  const filesOutput = results.map((r) => {
+    const counts = recalculateCountsFromVulnerabilities(r);
+
+    // Debug: Log first mismatch
+    if (counts.high !== r.high && process.env.DEBUG_COUNTS) {
+      console.error(`[DEBUG] Mismatch in ${r.relativePath}: old=${r.high}, new=${counts.high}, vulns=${r.result.security?.vulnerabilities?.length || 0}`);
+    }
+
+    // Accumulate totals
+    totalCritical += counts.critical;
+    totalHigh += counts.high;
+    totalMedium += counts.medium;
+    totalLow += counts.low;
+
+    // Count files with issues
+    if (counts.critical + counts.high + counts.medium + counts.low > 0) {
+      filesWithIssues++;
+    }
+
+    return {
+      path: r.relativePath,
+      language: r.language,
+      vulnerabilities: r.result.security?.vulnerabilities || [],
+      counts,
+    };
+  });
+
   const output = {
     summary: {
       filesScanned: results.length,
-      filesWithIssues: results.filter((r) => r.critical > 0 || r.high > 0 || r.medium > 0 || r.low > 0).length,
-      totalVulnerabilities: results.reduce((sum, r) => r.critical + r.high + r.medium + r.low + sum, 0),
-      critical: results.reduce((sum, r) => sum + r.critical, 0),
-      high: results.reduce((sum, r) => sum + r.high, 0),
-      medium: results.reduce((sum, r) => sum + r.medium, 0),
-      low: results.reduce((sum, r) => sum + r.low, 0),
+      filesWithIssues,
+      totalVulnerabilities: totalCritical + totalHigh + totalMedium + totalLow,
+      critical: totalCritical,
+      high: totalHigh,
+      medium: totalMedium,
+      low: totalLow,
     },
-    files: results.map((r) => ({
-      path: r.relativePath,
-      language: r.language,
-      vulnerabilities: r.result.security?.vulnerabilities || [],
-      counts: {
-        critical: r.critical,
-        high: r.high,
-        medium: r.medium,
-        low: r.low,
-      },
-    })),
+    files: filesOutput,
   };
 
   console.log(JSON.stringify(output, null, 2));
@@ -520,28 +597,48 @@ export function generateMarkdownReport(
   const filename = `codeslick-report-${timestamp}.md`;
   const filepath = join(process.cwd(), filename);
 
-  // Calculate totals
+  // Calculate totals from actual vulnerabilities (post-filtering)
   const totalFiles = results.length;
-  const totalCritical = results.reduce((sum, r) => sum + r.critical, 0);
-  const totalHigh = results.reduce((sum, r) => sum + r.high, 0);
-  const totalMedium = results.reduce((sum, r) => sum + r.medium, 0);
-  const totalLow = results.reduce((sum, r) => sum + r.low, 0);
-  const totalVulns = totalCritical + totalHigh + totalMedium + totalLow;
-  const filesWithIssues = results.filter(r => r.critical + r.high + r.medium + r.low > 0).length;
+  let totalCritical = 0;
+  let totalHigh = 0;
+  let totalMedium = 0;
+  let totalLow = 0;
+  let filesWithIssues = 0;
 
-  // Group by language
+  // Group by language and recalculate counts
   const byLanguage = new Map<string, { files: number; critical: number; high: number; medium: number; low: number }>();
   for (const result of results) {
     const lang = result.language;
     const existing = byLanguage.get(lang) || { files: 0, critical: 0, high: 0, medium: 0, low: 0 };
+
+    // Recalculate from actual vulnerabilities
+    const vulns = result.result.security?.vulnerabilities || [];
+    const crit = vulns.filter((v: any) => v.severity?.toLowerCase() === 'critical').length;
+    const high = vulns.filter((v: any) => v.severity?.toLowerCase() === 'high').length;
+    const med = vulns.filter((v: any) => v.severity?.toLowerCase() === 'medium').length;
+    const low = vulns.filter((v: any) => v.severity?.toLowerCase() === 'low').length;
+
     existing.files++;
-    existing.critical += result.critical;
-    existing.high += result.high;
-    existing.medium += result.medium;
-    existing.low += result.low;
+    existing.critical += crit;
+    existing.high += high;
+    existing.medium += med;
+    existing.low += low;
     byLanguage.set(lang, existing);
+
+    // Accumulate totals
+    totalCritical += crit;
+    totalHigh += high;
+    totalMedium += med;
+    totalLow += low;
+
+    // Count files with issues
+    if (crit + high + med + low > 0) {
+      filesWithIssues++;
+    }
   }
 
+  const totalVulns = totalCritical + totalHigh + totalMedium + totalLow;
+
   // Collect all vulnerabilities for Top 10
   const allVulns: Array<{ file: string; line: number; vuln: SecurityVulnerability }> = [];
   for (const result of results) {
@@ -656,8 +753,25 @@ export function generateMarkdownReport(
     md += `\n*Supported: .js, .jsx, .ts, .tsx, .py, .java*\n`;
   }
 
-  // Files with issues (detailed)
-  const filesWithProblems = results.filter(r => r.critical + r.high + r.medium + r.low > 0);
+  // Files with issues (detailed) - recalculate counts from actual vulnerabilities
+  const filesWithProblems = results
+    .map((r) => {
+      const vulns = r.result.security?.vulnerabilities || [];
+      const crit = vulns.filter((v: any) => v.severity?.toLowerCase() === 'critical').length;
+      const high = vulns.filter((v: any) => v.severity?.toLowerCase() === 'high').length;
+      const med = vulns.filter((v: any) => v.severity?.toLowerCase() === 'medium').length;
+      const low = vulns.filter((v: any) => v.severity?.toLowerCase() === 'low').length;
+      return {
+        relativePath: r.relativePath,
+        critical: crit,
+        high,
+        medium: med,
+        low,
+        total: crit + high + med + low,
+      };
+    })
+    .filter((f) => f.total > 0);
+
   if (filesWithProblems.length > 0) {
     md += `
 ---
@@ -693,16 +807,28 @@ export function generateMarkdownReport(
 
 /**
  * Print brief summary for screen (when report is generated)
+ *
+ * IMPORTANT: Recalculates counts from actual filtered vulnerabilities.
  */
 export function printBriefSummary(
   results: FileScanResult[],
   reportPath: string,
   duration: number
 ): void {
-  const totalCritical = results.reduce((sum, r) => sum + r.critical, 0);
-  const totalHigh = results.reduce((sum, r) => sum + r.high, 0);
-  const totalMedium = results.reduce((sum, r) => sum + r.medium, 0);
-  const totalLow = results.reduce((sum, r) => sum + r.low, 0);
+  // Recalculate from actual vulnerabilities (post-filtering)
+  let totalCritical = 0;
+  let totalHigh = 0;
+  let totalMedium = 0;
+  let totalLow = 0;
+
+  results.forEach((r) => {
+    const vulns = r.result.security?.vulnerabilities || [];
+    totalCritical += vulns.filter((v: any) => v.severity?.toLowerCase() === 'critical').length;
+    totalHigh += vulns.filter((v: any) => v.severity?.toLowerCase() === 'high').length;
+    totalMedium += vulns.filter((v: any) => v.severity?.toLowerCase() === 'medium').length;
+    totalLow += vulns.filter((v: any) => v.severity?.toLowerCase() === 'low').length;
+  });
+
   const totalVulns = totalCritical + totalHigh + totalMedium + totalLow;
 
   console.log('');