devkit-quality 0.1.0

package/dist/rules/hygiene.js

@@ -0,0 +1,102 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runHygieneRules = runHygieneRules;
+const node_path_1 = __importDefault(require("node:path"));
+const typescript_1 = __importDefault(require("typescript"));
+const finding_1 = require("../finding");
+const config_1 = require("../config");
+const discovery_1 = require("../discovery");
+const comments_1 = require("../ast/comments");
+const walk_1 = require("../ast/walk");
+const BACKUP_FILE_PATTERN = /(\.bak|\.orig|\.tmp|~)$/i;
+const ENV_FILE_PATTERN = /^\.env(\..+)?$/i;
+const ENV_SAFE_SUFFIXES = /\.(example|sample|template|dist)$/i;
+function runHygieneRules(context) {
+    const findings = [];
+    for (const file of context.files) {
+        const text = (0, discovery_1.readFileSafe)(file);
+        const sourceFile = context.program.getSourceFile(file);
+        if (!sourceFile)
+            continue;
+        const relativePath = node_path_1.default.relative(context.projectRoot, file).replace(/\\/g, '/');
+        const visit = (node) => {
+            if ((0, config_1.isRuleEnabled)(context.config, 'HYGIENE001') && typescript_1.default.isCallExpression(node) && typescript_1.default.isPropertyAccessExpression(node.expression) &&
+                typescript_1.default.isIdentifier(node.expression.expression) && node.expression.expression.text === 'console' &&
+                ['log', 'debug', 'warn', 'error'].includes(node.expression.name.text)) {
+                const { line, column } = (0, walk_1.lineAndColumn)(sourceFile, node.getStart());
+                findings.push((0, finding_1.buildFinding)({
+                    ruleId: 'HYGIENE001', category: 'hygiene', severity: 'LOW', confidence: 'CERTAIN', file: relativePath, line, column,
+                    message: 'Debug statement found', description: 'Console output remains in source code.', evidence: node.getText().slice(0, 160),
+                    suggestion: 'Remove or gate debug logging before production deployment.', fixAvailable: true
+                }));
+            }
+            if ((0, config_1.isRuleEnabled)(context.config, 'HYGIENE001') && typescript_1.default.isDebuggerStatement(node)) {
+                const { line, column } = (0, walk_1.lineAndColumn)(sourceFile, node.getStart());
+                findings.push((0, finding_1.buildFinding)({
+                    ruleId: 'HYGIENE001', category: 'hygiene', severity: 'LOW', confidence: 'CERTAIN', file: relativePath, line, column,
+                    message: 'Debugger statement found', description: 'Debugger statements are left in code and can leak runtime state.', evidence: node.getText(),
+                    suggestion: 'Remove debugger statements before committing code.', fixAvailable: true
+                }));
+            }
+            typescript_1.default.forEachChild(node, visit);
+        };
+        visit(sourceFile);
+        if ((0, config_1.isRuleEnabled)(context.config, 'HYGIENE002')) {
+            for (const range of (0, comments_1.collectCommentRanges)(sourceFile)) {
+                const comment = text.slice(range.pos, range.end);
+                const markers = /\b(TODO|FIXME|HACK|XXX)\b/g;
+                for (const match of comment.matchAll(markers)) {
+                    const position = range.pos + (match.index ?? 0);
+                    const { line, column } = (0, walk_1.lineAndColumn)(sourceFile, position);
+                    findings.push((0, finding_1.buildFinding)({
+                        ruleId: 'HYGIENE002', category: 'hygiene', severity: 'LOW', confidence: 'MEDIUM', file: relativePath, line, column,
+                        message: 'Temporary marker found', description: 'A marker suggests unresolved work or temporary code remains in the repository.',
+                        evidence: match[0], suggestion: 'Track the issue properly or remove the marker before merge.', fixAvailable: true
+                    }));
+                }
+            }
+        }
+    }
+    if ((0, config_1.isRuleEnabled)(context.config, 'HYGIENE003') || (0, config_1.isRuleEnabled)(context.config, 'HYGIENE004')) {
+        for (const file of context.allFiles) {
+            const basename = node_path_1.default.basename(file);
+            const relativePath = node_path_1.default.relative(context.projectRoot, file).replace(/\\/g, '/');
+            if ((0, config_1.isRuleEnabled)(context.config, 'HYGIENE003') && BACKUP_FILE_PATTERN.test(basename)) {
+                findings.push((0, finding_1.buildFinding)({
+                    ruleId: 'HYGIENE003',
+                    category: 'hygiene',
+                    severity: 'LOW',
+                    confidence: 'HIGH',
+                    file: relativePath,
+                    line: 1,
+                    column: 1,
+                    message: 'Backup or temporary file committed',
+                    description: 'A backup/temporary file was found in the repository.',
+                    evidence: relativePath,
+                    suggestion: 'Delete the file and add its pattern to .gitignore.',
+                    fixAvailable: false
+                }));
+            }
+            if ((0, config_1.isRuleEnabled)(context.config, 'HYGIENE004') && ENV_FILE_PATTERN.test(basename) && !ENV_SAFE_SUFFIXES.test(basename)) {
+                findings.push((0, finding_1.buildFinding)({
+                    ruleId: 'HYGIENE004',
+                    category: 'hygiene',
+                    severity: 'HIGH',
+                    confidence: 'MEDIUM',
+                    file: relativePath,
+                    line: 1,
+                    column: 1,
+                    message: 'Committed .env file',
+                    description: 'An environment file is present in the repository and may contain secrets.',
+                    evidence: relativePath,
+                    suggestion: 'Remove the file from version control and add it to .gitignore.',
+                    fixAvailable: false
+                }));
+            }
+        }
+    }
+    return findings;
+}

package/dist/rules/javascript.js

@@ -0,0 +1,69 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runJavaScriptRules = runJavaScriptRules;
+const node_path_1 = __importDefault(require("node:path"));
+const typescript_1 = __importDefault(require("typescript"));
+const finding_1 = require("../finding");
+const config_1 = require("../config");
+const walk_1 = require("../ast/walk");
+const LOOSE_EQUALITY_OPERATORS = new Set([typescript_1.default.SyntaxKind.EqualsEqualsToken, typescript_1.default.SyntaxKind.ExclamationEqualsToken]);
+function isNullLiteral(node) {
+    return node.kind === typescript_1.default.SyntaxKind.NullKeyword;
+}
+function runJavaScriptRules(context) {
+    const findings = [];
+    for (const file of context.files) {
+        const sourceFile = context.program.getSourceFile(file);
+        if (!sourceFile)
+            continue;
+        const relativePath = node_path_1.default.relative(context.projectRoot, file).replace(/\\/g, '/');
+        const visit = (node) => {
+            if ((0, config_1.isRuleEnabled)(context.config, 'JS001') &&
+                typescript_1.default.isVariableStatement(node) &&
+                (node.declarationList.flags & typescript_1.default.NodeFlags.BlockScoped) === 0) {
+                const { line, column } = (0, walk_1.lineAndColumn)(sourceFile, node.getStart());
+                findings.push((0, finding_1.buildFinding)({
+                    ruleId: 'JS001',
+                    category: 'hygiene',
+                    severity: 'LOW',
+                    confidence: 'CERTAIN',
+                    file: relativePath,
+                    line,
+                    column,
+                    message: "'var' declaration",
+                    description: 'var is function-scoped and hoisted, which commonly causes bugs.',
+                    evidence: node.getText().slice(0, 160),
+                    suggestion: 'Use let or const instead.',
+                    fixAvailable: false
+                }));
+            }
+            if ((0, config_1.isRuleEnabled)(context.config, 'JS002') &&
+                typescript_1.default.isBinaryExpression(node) &&
+                LOOSE_EQUALITY_OPERATORS.has(node.operatorToken.kind) &&
+                !isNullLiteral(node.left) &&
+                !isNullLiteral(node.right)) {
+                const { line, column } = (0, walk_1.lineAndColumn)(sourceFile, node.getStart());
+                findings.push((0, finding_1.buildFinding)({
+                    ruleId: 'JS002',
+                    category: 'hygiene',
+                    severity: 'LOW',
+                    confidence: 'CERTAIN',
+                    file: relativePath,
+                    line,
+                    column,
+                    message: 'Loose equality',
+                    description: 'Loose equality performs implicit type coercion, which can hide bugs.',
+                    evidence: node.getText().slice(0, 160),
+                    suggestion: 'Use === or !== instead.',
+                    fixAvailable: false
+                }));
+            }
+            typescript_1.default.forEachChild(node, visit);
+        };
+        visit(sourceFile);
+    }
+    return findings;
+}

package/dist/rules/redundancy.js

@@ -0,0 +1,75 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runRedundancyRules = runRedundancyRules;
+const node_path_1 = __importDefault(require("node:path"));
+const typescript_1 = __importDefault(require("typescript"));
+const finding_1 = require("../finding");
+const config_1 = require("../config");
+const walk_1 = require("../ast/walk");
+const LOOSE_EQUALITY_OPERATORS = new Set([typescript_1.default.SyntaxKind.EqualsEqualsToken, typescript_1.default.SyntaxKind.ExclamationEqualsToken]);
+const STRICT_EQUALITY_OPERATORS = new Set([typescript_1.default.SyntaxKind.EqualsEqualsEqualsToken, typescript_1.default.SyntaxKind.ExclamationEqualsEqualsToken]);
+function isBooleanLiteral(node) {
+    return node.kind === typescript_1.default.SyntaxKind.TrueKeyword || node.kind === typescript_1.default.SyntaxKind.FalseKeyword;
+}
+function runRedundancyRules(context) {
+    const findings = [];
+    for (const file of context.files) {
+        const sourceFile = context.program.getSourceFile(file);
+        if (!sourceFile)
+            continue;
+        const relativePath = node_path_1.default.relative(context.projectRoot, file).replace(/\\/g, '/');
+        const visit = (node) => {
+            if ((0, config_1.isRuleEnabled)(context.config, 'REDUNDANT001') &&
+                typescript_1.default.isBinaryExpression(node) &&
+                (LOOSE_EQUALITY_OPERATORS.has(node.operatorToken.kind) || STRICT_EQUALITY_OPERATORS.has(node.operatorToken.kind)) &&
+                (isBooleanLiteral(node.left) || isBooleanLiteral(node.right))) {
+                const comparedExpression = isBooleanLiteral(node.left) ? node.right : node.left;
+                const comparedType = context.program.getTypeChecker().getTypeAtLocation(comparedExpression);
+                if (comparedType.isUnion() && comparedType.types.some((member) => (member.flags & typescript_1.default.TypeFlags.BooleanLike) === 0)) {
+                    typescript_1.default.forEachChild(node, visit);
+                    return;
+                }
+                const { line, column } = (0, walk_1.lineAndColumn)(sourceFile, node.getStart());
+                findings.push((0, finding_1.buildFinding)({
+                    ruleId: 'REDUNDANT001',
+                    category: 'redundantLogic',
+                    severity: 'LOW',
+                    confidence: 'CERTAIN',
+                    file: relativePath,
+                    line,
+                    column,
+                    message: 'Redundant boolean comparison',
+                    description: 'Comparing a value directly to true/false is unnecessary.',
+                    evidence: node.getText().slice(0, 160),
+                    suggestion: 'Use the expression directly, negating it with ! if needed.',
+                    fixAvailable: false
+                }));
+            }
+            if ((0, config_1.isRuleEnabled)(context.config, 'REDUNDANT002') &&
+                typescript_1.default.isIfStatement(node) &&
+                (node.expression.kind === typescript_1.default.SyntaxKind.TrueKeyword || node.expression.kind === typescript_1.default.SyntaxKind.FalseKeyword)) {
+                const { line, column } = (0, walk_1.lineAndColumn)(sourceFile, node.getStart());
+                findings.push((0, finding_1.buildFinding)({
+                    ruleId: 'REDUNDANT002',
+                    category: 'redundantLogic',
+                    severity: 'MEDIUM',
+                    confidence: 'CERTAIN',
+                    file: relativePath,
+                    line,
+                    column,
+                    message: 'Impossible condition',
+                    description: `The condition is a literal ${node.expression.kind === typescript_1.default.SyntaxKind.TrueKeyword ? 'true' : 'false'}, so one branch can never execute.`,
+                    evidence: node.getText().slice(0, 160),
+                    suggestion: 'Remove the dead branch or the conditional entirely.',
+                    fixAvailable: false
+                }));
+            }
+            typescript_1.default.forEachChild(node, visit);
+        };
+        visit(sourceFile);
+    }
+    return findings;
+}

package/dist/rules/secretPatterns.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SECRET_PATTERNS = void 0;
+exports.looksHighEntropy = looksHighEntropy;
+exports.SECRET_PATTERNS = [
+    { id: 'aws-access-key', label: 'AWS access key ID', regex: /\bAKIA[0-9A-Z]{16}\b/ },
+    { id: 'stripe-secret-key', label: 'Stripe secret key', regex: /\bsk_(?:live|test)_[A-Za-z0-9]{16,}\b/ },
+    { id: 'github-token', label: 'GitHub token', regex: /\bgh[pousr]_[A-Za-z0-9]{20,}\b/ },
+    { id: 'pem-private-key', label: 'PEM private key', regex: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/ },
+    { id: 'jwt', label: 'JWT token', regex: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/ },
+    { id: 'slack-token', label: 'Slack token', regex: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/ }
+];
+function looksHighEntropy(value, minLength = 20) {
+    if (value.length < minLength)
+        return false;
+    const frequencies = new Map();
+    for (const character of value)
+        frequencies.set(character, (frequencies.get(character) ?? 0) + 1);
+    const entropy = [...frequencies.values()].reduce((sum, count) => {
+        const probability = count / value.length;
+        return sum - probability * Math.log2(probability);
+    }, 0);
+    return entropy >= 3.2;
+}

package/dist/rules/security.js

@@ -0,0 +1,318 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runSecurityRules = runSecurityRules;
+const node_path_1 = __importDefault(require("node:path"));
+const typescript_1 = __importDefault(require("typescript"));
+const finding_1 = require("../finding");
+const config_1 = require("../config");
+const discovery_1 = require("../discovery");
+const walk_1 = require("../ast/walk");
+const secretPatterns_1 = require("./secretPatterns");
+const SECRET_PATTERN = /\b(API_KEY|SECRET|TOKEN|PASSWORD|PRIVATE_KEY)\b\s*[:=]\s*["'`]([^"'`]{4,})["'`]/i;
+const WEAK_HASH_ALGORITHMS = /^(md5|sha1|des|rc4)$/i;
+const EXEC_FUNCTION_NAMES = new Set(['exec', 'execSync']);
+const SHELL_FUNCTION_NAMES = new Set(['spawn', 'spawnSync', 'execFile', 'execFileSync']);
+const FILE_FUNCTION_NAMES = new Set(['readFile', 'readFileSync', 'writeFile', 'writeFileSync', 'appendFile', 'appendFileSync', 'createReadStream', 'createWriteStream', 'unlink', 'unlinkSync', 'open', 'openSync', 'stat', 'statSync', 'access', 'accessSync']);
+function calleeName(expression) {
+    if (typescript_1.default.isIdentifier(expression))
+        return expression.text;
+    if (typescript_1.default.isPropertyAccessExpression(expression))
+        return expression.name.text;
+    return null;
+}
+function isDynamicString(expression) {
+    return typescript_1.default.isTemplateExpression(expression) || typescript_1.default.isBinaryExpression(expression);
+}
+function nearestFunction(node) {
+    return typescript_1.default.findAncestor(node, (ancestor) => typescript_1.default.isFunctionDeclaration(ancestor) || typescript_1.default.isFunctionExpression(ancestor) || typescript_1.default.isArrowFunction(ancestor) || typescript_1.default.isMethodDeclaration(ancestor) || typescript_1.default.isConstructorDeclaration(ancestor));
+}
+function hasShellEnabled(node) {
+    return node.arguments.some((argument) => typescript_1.default.isObjectLiteralExpression(argument) && argument.properties.some((property) => typescript_1.default.isPropertyAssignment(property) && property.name.getText() === 'shell' && property.initializer.kind === typescript_1.default.SyntaxKind.TrueKeyword));
+}
+function isDynamicCommandArgument(node) {
+    const first = node.arguments[0];
+    if (!first)
+        return false;
+    if (isDynamicString(first))
+        return true;
+    if (!typescript_1.default.isIdentifier(first))
+        return false;
+    const enclosingFunction = nearestFunction(node);
+    let nearestDeclaration;
+    const sourceFile = node.getSourceFile();
+    const visit = (current) => {
+        if (current !== sourceFile && current !== enclosingFunction &&
+            (typescript_1.default.isFunctionDeclaration(current) || typescript_1.default.isFunctionExpression(current) || typescript_1.default.isArrowFunction(current) || typescript_1.default.isMethodDeclaration(current)))
+            return;
+        if (typescript_1.default.isVariableDeclaration(current) && typescript_1.default.isIdentifier(current.name) && current.name.text === first.text &&
+            current.initializer && current.getStart() < node.getStart() && nearestFunction(current) === enclosingFunction &&
+            (!nearestDeclaration || current.getStart() > nearestDeclaration.getStart()))
+            nearestDeclaration = current;
+        typescript_1.default.forEachChild(current, visit);
+    };
+    visit(enclosingFunction ?? sourceFile);
+    return !!nearestDeclaration?.initializer && isDynamicString(nearestDeclaration.initializer);
+}
+function containsUntrustedInput(expression) {
+    return /\.(?:params|query|body)\b/.test(expression.getText());
+}
+function hasPathSanitizer(node) {
+    return /(?:normalize|sanitize|safePath|allowedPaths|allowlist)\s*\(/i.test(node.getText());
+}
+function runSecretScan(context) {
+    if (!(0, config_1.isRuleEnabled)(context.config, 'SEC001'))
+        return [];
+    const findings = [];
+    for (const file of context.files) {
+        const text = (0, discovery_1.readFileSafe)(file);
+        const relativePath = node_path_1.default.relative(context.projectRoot, file).replace(/\\/g, '/');
+        const lines = text.split(/\r\n|\r|\n/);
+        const isTestFixture = (0, discovery_1.isTestFile)(relativePath) || /(?:^|\/)(?:fixtures?|__mocks__)(?:\/|$)/i.test(relativePath);
+        for (let i = 0; i < lines.length; i += 1) {
+            const providerPattern = secretPatterns_1.SECRET_PATTERNS.find((pattern) => pattern.regex.test(lines[i]));
+            const fallbackMatch = !providerPattern && !isTestFixture ? lines[i].match(SECRET_PATTERN) : null;
+            if (providerPattern || (fallbackMatch && (0, secretPatterns_1.looksHighEntropy)(fallbackMatch[2]))) {
+                findings.push((0, finding_1.buildFinding)({
+                    ruleId: 'SEC001',
+                    category: 'security',
+                    severity: 'HIGH',
+                    confidence: providerPattern ? 'HIGH' : 'MEDIUM',
+                    file: relativePath,
+                    line: i + 1,
+                    column: providerPattern ? lines[i].search(providerPattern.regex) + 1 : lines[i].indexOf(fallbackMatch[0]) + 1,
+                    message: providerPattern ? `Potential ${providerPattern.label}` : 'Potential secret in source',
+                    description: providerPattern
+                        ? `A value matches the known format for a ${providerPattern.label}.`
+                        : 'A high-entropy value is assigned to a credential-like variable name.',
+                    evidence: providerPattern ? `${providerPattern.label} pattern matched` : `${fallbackMatch[1]}=[redacted]`,
+                    suggestion: 'Move sensitive values to environment variables or secure secret storage.',
+                    fixAvailable: false
+                }));
+            }
+            if (/NODE_TLS_REJECT_UNAUTHORIZED['"]?\s*[:=]\s*['"]?0/.test(lines[i])) {
+                findings.push((0, finding_1.buildFinding)({
+                    ruleId: 'SEC007',
+                    category: 'security',
+                    severity: 'HIGH',
+                    confidence: 'HIGH',
+                    file: relativePath,
+                    line: i + 1,
+                    column: 1,
+                    message: 'TLS certificate verification disabled',
+                    description: 'NODE_TLS_REJECT_UNAUTHORIZED is set to 0, disabling TLS verification process-wide.',
+                    evidence: lines[i].trim(),
+                    suggestion: 'Remove the override and fix the underlying certificate problem.',
+                    fixAvailable: false
+                }));
+            }
+        }
+    }
+    return findings;
+}
+function runAstSecurityChecks(context) {
+    const findings = [];
+    for (const file of context.files) {
+        const sourceFile = context.program.getSourceFile(file);
+        if (!sourceFile)
+            continue;
+        const relativePath = node_path_1.default.relative(context.projectRoot, file).replace(/\\/g, '/');
+        const imports = context.moduleGraph.importsByFile.get(file) ?? [];
+        const importedPackages = new Set(imports.filter((item) => !item.isRelative).map((item) => item.specifier.startsWith('@') ? item.specifier.split('/').slice(0, 2).join('/') : item.specifier.split('/')[0]));
+        const visit = (node) => {
+            if (typescript_1.default.isCallExpression(node)) {
+                const name = calleeName(node.expression);
+                if ((0, config_1.isRuleEnabled)(context.config, 'SEC002') && name === 'eval') {
+                    const { line, column } = (0, walk_1.lineAndColumn)(sourceFile, node.getStart());
+                    findings.push((0, finding_1.buildFinding)({
+                        ruleId: 'SEC002',
+                        category: 'security',
+                        severity: 'HIGH',
+                        confidence: 'CERTAIN',
+                        file: relativePath,
+                        line,
+                        column,
+                        message: 'Use of eval',
+                        description: 'eval executes arbitrary strings as code and is a common injection vector.',
+                        evidence: node.getText().slice(0, 160),
+                        suggestion: 'Avoid eval; use a safer alternative such as JSON.parse or a dedicated parser.',
+                        fixAvailable: false
+                    }));
+                }
+                if ((0, config_1.isRuleEnabled)(context.config, 'SEC003') && name && EXEC_FUNCTION_NAMES.has(name) && node.arguments.length > 0) {
+                    const isDynamic = isDynamicCommandArgument(node);
+                    if (isDynamic) {
+                        const { line, column } = (0, walk_1.lineAndColumn)(sourceFile, node.getStart());
+                        findings.push((0, finding_1.buildFinding)({
+                            ruleId: 'SEC003',
+                            category: 'security',
+                            severity: 'HIGH',
+                            confidence: 'MEDIUM',
+                            file: relativePath,
+                            line,
+                            column,
+                            message: 'Dangerous command execution',
+                            description: `${name}() is invoked with a dynamically built command string, risking command injection.`,
+                            evidence: node.getText().slice(0, 160),
+                            suggestion: 'Use execFile/spawn with an argument array instead of a concatenated shell string.',
+                            fixAvailable: false
+                        }));
+                    }
+                }
+                if ((0, config_1.isRuleEnabled)(context.config, 'SEC003') && name && SHELL_FUNCTION_NAMES.has(name) && hasShellEnabled(node)) {
+                    const { line, column } = (0, walk_1.lineAndColumn)(sourceFile, node.getStart());
+                    findings.push((0, finding_1.buildFinding)({
+                        ruleId: 'SEC003', category: 'security', severity: 'HIGH', confidence: 'HIGH', file: relativePath, line, column,
+                        message: 'Shell execution enabled',
+                        description: `${name}() enables shell execution with shell: true, so untrusted arguments can become shell commands.`,
+                        evidence: node.getText().slice(0, 160),
+                        suggestion: 'Remove shell: true or ensure every argument is fixed and trusted.', fixAvailable: false
+                    }));
+                }
+                if ((0, config_1.isRuleEnabled)(context.config, 'SEC004') && name === 'insertAdjacentHTML') {
+                    const { line, column } = (0, walk_1.lineAndColumn)(sourceFile, node.getStart());
+                    findings.push((0, finding_1.buildFinding)({
+                        ruleId: 'SEC004', category: 'security', severity: 'MEDIUM', confidence: 'HIGH', file: relativePath, line, column,
+                        message: 'Unsafe HTML insertion',
+                        description: 'insertAdjacentHTML parses a string as HTML and can introduce cross-site scripting when the value is untrusted.',
+                        evidence: node.getText().slice(0, 160),
+                        suggestion: 'Sanitize the HTML or use safe DOM APIs such as textContent.', fixAvailable: false
+                    }));
+                }
+                if ((0, config_1.isRuleEnabled)(context.config, 'SEC008') && name && ['query', 'execute'].includes(name) && node.arguments[0] && isDynamicString(node.arguments[0])) {
+                    const queryText = node.arguments[0].getText();
+                    if (/\b(select|insert|update|delete|replace|with)\b/i.test(queryText)) {
+                        const { line, column } = (0, walk_1.lineAndColumn)(sourceFile, node.getStart());
+                        findings.push((0, finding_1.buildFinding)({
+                            ruleId: 'SEC008', category: 'security', severity: 'HIGH', confidence: 'MEDIUM', file: relativePath, line, column,
+                            message: 'Potential SQL injection',
+                            description: 'A query string is dynamically constructed and may include untrusted input.',
+                            evidence: node.getText().slice(0, 160),
+                            suggestion: 'Use parameterized queries and keep user input out of SQL syntax.', fixAvailable: false
+                        }));
+                    }
+                }
+                if ((0, config_1.isRuleEnabled)(context.config, 'SEC009') && name) {
+                    const pathJoin = name === 'join' && typescript_1.default.isPropertyAccessExpression(node.expression) && node.expression.expression.getText() === 'path';
+                    const filesystemCall = FILE_FUNCTION_NAMES.has(name);
+                    const relevantArgs = pathJoin ? node.arguments : node.arguments.slice(0, 1);
+                    if ((pathJoin || filesystemCall) && !hasPathSanitizer(node) && relevantArgs.some(containsUntrustedInput)) {
+                        const { line, column } = (0, walk_1.lineAndColumn)(sourceFile, node.getStart());
+                        findings.push((0, finding_1.buildFinding)({
+                            ruleId: 'SEC009', category: 'security', severity: 'HIGH', confidence: 'LOW', file: relativePath, line, column,
+                            message: 'Potential path traversal',
+                            description: 'A filesystem path is built from request parameters without an obvious normalization or allowlist step.',
+                            evidence: node.getText().slice(0, 160),
+                            suggestion: 'Resolve the path against an allowed root and verify the normalized result stays inside it.', fixAvailable: false
+                        }));
+                    }
+                }
+                if ((0, config_1.isRuleEnabled)(context.config, 'SEC010') && name) {
+                    const unsafeDeserializer = (name === 'unserialize' && (importedPackages.has('node-serialize') || importedPackages.has('serialize-javascript'))) ||
+                        name === 'runInNewContext' || (name === 'load' && importedPackages.has('js-yaml'));
+                    if (unsafeDeserializer) {
+                        const { line, column } = (0, walk_1.lineAndColumn)(sourceFile, node.getStart());
+                        findings.push((0, finding_1.buildFinding)({
+                            ruleId: 'SEC010', category: 'security', severity: 'HIGH', confidence: 'MEDIUM', file: relativePath, line, column,
+                            message: 'Unsafe deserialization or dynamic execution',
+                            description: `${name}() can execute or construct unsafe values from untrusted input.`,
+                            evidence: node.getText().slice(0, 160),
+                            suggestion: 'Use a safe data format and avoid deserializing untrusted objects or executing input.', fixAvailable: false
+                        }));
+                    }
+                }
+                if ((0, config_1.isRuleEnabled)(context.config, 'SEC005') && name === 'createHash' && node.arguments.length > 0) {
+                    const arg = node.arguments[0];
+                    if (typescript_1.default.isStringLiteral(arg) && WEAK_HASH_ALGORITHMS.test(arg.text)) {
+                        const { line, column } = (0, walk_1.lineAndColumn)(sourceFile, node.getStart());
+                        findings.push((0, finding_1.buildFinding)({
+                            ruleId: 'SEC005',
+                            category: 'security',
+                            severity: 'MEDIUM',
+                            confidence: 'HIGH',
+                            file: relativePath,
+                            line,
+                            column,
+                            message: 'Weak cryptographic hash',
+                            description: `"${arg.text}" is not a cryptographically strong hash algorithm.`,
+                            evidence: node.getText().slice(0, 160),
+                            suggestion: 'Use a modern algorithm such as sha256 or stronger.',
+                            fixAvailable: false
+                        }));
+                    }
+                }
+            }
+            if ((0, config_1.isRuleEnabled)(context.config, 'SEC004')) {
+                if (typescript_1.default.isBinaryExpression(node) &&
+                    node.operatorToken.kind === typescript_1.default.SyntaxKind.EqualsToken &&
+                    typescript_1.default.isPropertyAccessExpression(node.left) &&
+                    (node.left.name.text === 'innerHTML' || node.left.name.text === 'outerHTML')) {
+                    const { line, column } = (0, walk_1.lineAndColumn)(sourceFile, node.getStart());
+                    findings.push((0, finding_1.buildFinding)({
+                        ruleId: 'SEC004',
+                        category: 'security',
+                        severity: 'MEDIUM',
+                        confidence: 'MEDIUM',
+                        file: relativePath,
+                        line,
+                        column,
+                        message: 'Unsafe HTML assignment',
+                        description: `Assigning to ${node.left.name.text} can introduce cross-site scripting if the value is not sanitized.`,
+                        evidence: node.getText().slice(0, 160),
+                        suggestion: 'Sanitize the value or use safe DOM APIs such as textContent.',
+                        fixAvailable: false
+                    }));
+                }
+                if (typescript_1.default.isJsxAttribute(node) && node.name.getText() === 'dangerouslySetInnerHTML') {
+                    const { line, column } = (0, walk_1.lineAndColumn)(sourceFile, node.getStart());
+                    findings.push((0, finding_1.buildFinding)({
+                        ruleId: 'SEC004',
+                        category: 'security',
+                        severity: 'MEDIUM',
+                        confidence: 'MEDIUM',
+                        file: relativePath,
+                        line,
+                        column,
+                        message: 'Unsafe HTML assignment',
+                        description: 'dangerouslySetInnerHTML can introduce cross-site scripting if the value is not sanitized.',
+                        evidence: node.getText().slice(0, 160),
+                        suggestion: 'Sanitize the HTML before rendering, or avoid raw HTML injection.',
+                        fixAvailable: false
+                    }));
+                }
+            }
+            typescript_1.default.forEachChild(node, visit);
+        };
+        visit(sourceFile);
+    }
+    return findings;
+}
+function scanTemplateFilesForUnsafeBindings(context) {
+    if (!(0, config_1.isRuleEnabled)(context.config, 'SEC004'))
+        return [];
+    const findings = [];
+    for (const file of context.allFiles) {
+        if (!/\.(?:vue|html)$/i.test(file))
+            continue;
+        const text = (0, discovery_1.readFileSafe)(file);
+        const lines = text.split(/\r\n|\r|\n/);
+        const relativePath = node_path_1.default.relative(context.projectRoot, file).replace(/\\/g, '/');
+        for (let index = 0; index < lines.length; index += 1) {
+            const match = /(?:\bv-html\s*=|\[innerHTML\]\s*=)/i.exec(lines[index]);
+            if (!match)
+                continue;
+            findings.push((0, finding_1.buildFinding)({
+                ruleId: 'SEC004', category: 'security', severity: 'MEDIUM', confidence: 'LOW', file: relativePath,
+                line: index + 1, column: match.index + 1, message: 'Unsafe template HTML binding',
+                description: 'A template uses a raw HTML binding; the text scan cannot verify whether the value is sanitized.',
+                evidence: match[0], suggestion: 'Sanitize the bound value or render it as text.', fixAvailable: false
+            }));
+        }
+    }
+    return findings;
+}
+function runSecurityRules(context) {
+    return [...runSecretScan(context), ...runAstSecurityChecks(context), ...scanTemplateFilesForUnsafeBindings(context)];
+}