correctover-scan 1.7.0 → 1.7.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/README.md +3 -3
  2. package/core/report.js +36 -0
  3. package/index.js +1 -1
  4. package/package.json +3 -3
package/README.md CHANGED
@@ -159,7 +159,7 @@ The free-tier daily scan allowance applies to bundle scans too (counted the same
159
159
 
160
160
  ### Web Scanner
161
161
 
162
- Try the online version: [correctover.com/scan](https://correctover.com/scan/)
162
+ Try the no-install browser version (files never leave your machine): [in-browser scanner](https://dshcorrectover.github.io/agent-audit/scan.html)
163
163
 
164
164
  ## Standards Compliance
165
165
 
@@ -177,14 +177,14 @@ The free automated scan covers surface-level configuration checks. A manual Corr
177
177
 
178
178
  For first customers, if the manual audit finds no critical-severity issue, you pay nothing.
179
179
 
180
- - Get your free 1-page summary: email [234114134@coze.email](mailto:234114134@coze.email?subject=Free%20audit%20scan%20summary)
180
+ - Get your free 1-page summary: email [wangguigui@correctover.com](mailto:wangguigui@correctover.com?subject=Free%20Scan%20summary%20request)
181
181
  - Learn more about the manual audit: https://correctover.com/agent-audit.html
182
182
 
183
183
  ## Links
184
184
 
185
185
  - [correctover.com](https://correctover.com) — AI Agent Runtime Assurance
186
186
  - [CCS Standard](https://correctover.com/ccs) — Conformance Specification
187
- - [Web Scanner](https://correctover.com/scan/) — Online version
187
+ - [Web Scanner](https://dshcorrectover.github.io/agent-audit/scan.html) — In-browser version, no upload
188
188
  - [GitHub](https://github.com/DSHCorrectover) — Source code
189
189
  - [Conformance test vectors](https://github.com/DSHCorrectover/ccs-conformance-vectors) — 66 signed, reproducible
190
190
  - [EMILIA interoperability](https://github.com/emiliaprotocol/emilia-protocol/pull/693) — merged joint assessment
package/core/report.js CHANGED
@@ -122,9 +122,36 @@ function formatHTMLReport(opts) {
122
122
  details{margin-top:8px}summary{cursor:pointer;color:var(--muted);font-size:13px}
123
123
  .pass-list{font-size:13px;color:var(--muted);columns:2;margin-top:10px}
124
124
  .pass-list div{break-inside:avoid;padding:2px 0}
125
+ .gateway{background:rgba(79,124,255,.08);border:1px solid var(--accent);border-radius:12px;padding:14px 18px;margin-bottom:20px;font-size:14px}
126
+ .gateway a{color:var(--accent);font-weight:700;text-decoration:none;white-space:nowrap}
127
+ .disclaimer{background:rgba(240,185,85,.06);border:1px solid rgba(240,185,85,.4);border-radius:12px;padding:18px 20px;margin:22px 0;font-size:12.5px;color:var(--muted)}
128
+ .disclaimer h2{font-size:14px;color:var(--warn);border:none;margin:0 0 10px;padding:0}
129
+ .disclaimer p{margin-bottom:8px}
130
+ .disclaimer p:last-child{margin-bottom:0}
131
+ .disclaimer strong{color:var(--text)}
132
+ .printbtn{position:fixed;top:14px;right:14px;background:var(--accent);color:#fff;border:none;border-radius:10px;padding:10px 16px;font-size:13px;font-weight:700;cursor:pointer;box-shadow:0 4px 14px rgba(0,0,0,.35);z-index:10}
133
+ @media print{
134
+ :root{--bg:#ffffff;--card:#ffffff;--line:#bbbbbb;--text:#111111;--muted:#333333;--accent:#0a4dd6;--ok:#0a7a52;--warn:#8a6100;--bad:#b32020}
135
+ body{background:#fff;padding:0}
136
+ .printbtn{display:none !important}
137
+ .hero,.finding,.note,.gateway,.disclaimer,.next .card2{break-inside:avoid}
138
+ .disclaimer{background:#fffbe8 !important;border-color:#999 !important;color:#000 !important}
139
+ .disclaimer h2{color:#000 !important}.disclaimer strong{color:#000 !important}
140
+ .f-snip{background:#f6f6f6 !important;color:#111 !important}
141
+ code{background:#f0f0f0 !important}
142
+ .next a{text-decoration:none}
143
+ }
125
144
  </style></head>
126
145
  <body><div class="wrap">
127
146
 
147
+ <button class="printbtn" onclick="window.print()">🖨 Print / Save as PDF</button>
148
+
149
+ <div class="gateway">
150
+ This automated scan maps surface patterns to <strong>OWASP AISVS 1.0</strong> controls — it is not a certification or an audit opinion.
151
+ Need an <strong>official compliance report for vendor acceptance</strong>, an AISVS mapping workbook, or signed version-provenance records?
152
+ 👉 <a href="https://dshcorrectover.github.io/agent-audit/scan.html#enterprise">Enterprise report &amp; provenance options (official entry)</a>
153
+ </div>
154
+
128
155
  <div class="hero">
129
156
  <div class="brand">Correctover <span>· AI Reliability™ — Agent Runtime Assurance</span></div>
130
157
  <h1>Agent Security Scan Report</h1>
@@ -157,6 +184,15 @@ function formatHTMLReport(opts) {
157
184
  of compromise. Nothing in this scan leaves your machine — no network calls, no telemetry.
158
185
  </div>
159
186
 
187
+ <div class="disclaimer">
188
+ <h2>⚠ Important notice — read before sharing or filing this report</h2>
189
+ <p><strong>1. Not an audit, certification, or compliance attestation.</strong> This document is output of an automated static signal scan (${esc(checksLabel)}). It is <strong>not</strong> a security audit, penetration test, certification, or statement of compliance with any standard or regulation. A score of 100 or the absence of critical findings does <strong>not</strong> mean the code is vulnerability-free, secure, or compliant — it means only that the listed patterns were not detected in the scanned snapshot. Static analysis cannot prove the absence of reachable vulnerabilities; semantic intent, reachability, exploitability, and runtime behavior are not determined.</p>
190
+ <p><strong>2. AISVS mapping is navigational only.</strong> OWASP® and AISVS are trademarks of the OWASP Foundation. Correctover is not affiliated with or endorsed by OWASP. References such as <code>C10.1</code> are our own mapping of checks to control families in OWASP AISVS v1.0 (June 2026), provided as a navigation aid; OWASP does not certify products or vendors, and this report must not be presented as an OWASP or AISVS certification.</p>
191
+ <p><strong>3. Not a substitute for professional review.</strong> Do not rely on this document as the sole basis for acceptance, procurement, release, insurance, regulatory, or other consequential decisions. High-assurance use cases require an engagement performed by qualified personnel under an agreed scope and terms (such as Correctover's 116-check manual deep audit, delivered under a signed agreement).</p>
192
+ <p><strong>4. Transparency-log anchors prove existence, not safety.</strong> Sigstore Rekor entries and any content-addressed manifest attest only that a byte-for-byte snapshot existed at a point in time. They make no statement about code safety, quality, ownership, or legal rights.</p>
193
+ <p><strong>5. AS-IS.</strong> The scan and report are provided "as is", without warranty of any kind, express or implied, including merchantability or fitness for a particular purpose. To the maximum extent permitted by law, Correctover shall not be liable for any damages arising from their use. You are responsible for independently verifying findings before acting on them. Automated results may include false positives and false negatives.</p>
194
+ </div>
195
+
160
196
  <h2>Go further</h2>
161
197
  <div class="next">
162
198
  <a href="https://dshcorrectover.github.io/agent-audit/scan.html"><div class="card2">
package/index.js CHANGED
@@ -14,7 +14,7 @@ const { runBundleScan, discoverBundleFiles } = require('./core/bundle-scanner');
14
14
  const { recordCall, getUpgradeMessage } = require('./core/license');
15
15
  const { formatHTMLReport, normalizeConfigFindings, normalizeBundleFindings, failHint } = require('./core/report');
16
16
 
17
- const VERSION = '1.7.0';
17
+ const VERSION = '1.7.1';
18
18
  const PRODUCT = 'correctover-scan';
19
19
  const JS_EXT = new Set(['.js', '.mjs', '.cjs', '.ts']);
20
20
 
package/package.json CHANGED
@@ -1,10 +1,10 @@
1
1
  {
2
2
  "name": "correctover-scan",
3
- "version": "1.7.0",
3
+ "version": "1.7.2",
4
4
  "description": "Correctover Security Scanner — CCS audit for MCP configurations AND published JS bundles/npm packages. Detects hardcoded secrets, RCE, SSRF, credential hijacking against OWASP AISVS 1.0.",
5
5
  "main": "index.js",
6
6
  "bin": {
7
- "correctover-scan": "./index.js"
7
+ "correctover-scan": "index.js"
8
8
  },
9
9
  "scripts": {
10
10
  "test": "node test.js",
@@ -47,7 +47,7 @@
47
47
  "license": "MIT",
48
48
  "repository": {
49
49
  "type": "git",
50
- "url": "https://github.com/DSHCorrectover/correctover-scan"
50
+ "url": "git+https://github.com/DSHCorrectover/correctover-scan.git"
51
51
  },
52
52
  "homepage": "https://correctover.com/scan",
53
53
  "bugs": {