fad-checker 2.1.2 → 2.2.1

package/CHANGELOG.md

@@ -3,6 +3,43 @@
 All notable changes to `fad-checker` are documented here.
 This project adheres to [Semantic Versioning](https://semver.org/).
 
+## [Unreleased]
+
+### Added
+- **Custom registries for npm, PyPI, Ruby and Go** (previously Maven-only). Point
+  fad-checker at private Verdaccio/Artifactory/GitHub Packages (npm), devpi (PyPI),
+  Gemfury/Geminabox (Ruby) or a private GOPROXY/Athens (Go). They are tried in
+  declared order, the public registry last; auth via `--auth user:pass` (→ Basic)
+  or `--token TOK` (→ Bearer), inline `https://user:pass@host/` also accepted.
+  CRUD: `--add-repo <eco> <name> <url>`, `--remove-repo <eco> <name>`,
+  `--list-repos` (grouped by ecosystem); one-off repeatable `--repo <eco>=<url>`.
+  New `lib/registries.js`; per-codec fetchers honour `opts.registries`.
+- **Layered configuration.** Defaults can come from a JSON config file
+  (`--config <file.json>`, else auto-discovered `./.fad-env.json`) and from the
+  `FAD_CHECKER_ENV` environment variable (a string of CLI flags). Precedence:
+  **CLI flag > config file > `FAD_CHECKER_ENV` > `~/.fad-checker/config.json` >
+  defaults**; `registries` are unioned across every layer. New `lib/options-env.js`.
+- **`--source` alias** for `-s`/`--src` (and the JSON config key `"source"`/`"src"`).
+- **Vendored-JS inventory (report chapter 1D + JSON `vendoredJs`).** retire.js now
+  runs with `--verbose`, so fad lists **every** identified standalone JS library
+  committed into the tree (jQuery, Bootstrap, PDF.js, …) — **vulnerable or not** —
+  as a cyber-hygiene inventory of unmanaged third-party code (the JS twin of the
+  native-binary chapter 1C). Each entry: component, version, file, detection
+  method, and vulnerability status. Vulnerable libs remain detailed in chapter 2.
+  On by default; `--no-vendored-js-inventory` keeps only the vulnerable findings.
+- **`--exclude-path <glob...>`** — ignore sub-paths during the directory walk,
+  gitignore-style (matched relative to `--src`, prunes the dir + its subtree),
+  across every ecosystem. Repeatable; also `excludePath: [...]` in `.fad-env.json`,
+  unioned across config layers. **`--no-default-excludes`** walks the normally
+  pruned dirs (`node_modules`, `vendor`, `target`, `.git`, …). New `lib/path-filter.js`.
+
+### Changed
+- **BREAKING:** the persisted-registry store moved from the Maven-only
+  `maven_repos` config key + 2-arg `--add-repo <name> <url>` to a per-ecosystem
+  `registries` map + `--add-repo <ecosystem> <name> <url>`. `--repo` now requires
+  the `<ecosystem>=<url>` form (a bare URL is rejected). Re-add any private Maven
+  repos with `--add-repo maven <name> <url>`.
+
 ## [2.1.0]
 
 ### Added

package/README.md

@@ -7,15 +7,16 @@
 
 > **F**ucking **A**utonomous **D**ependency **C**hecker
 
-`fad-checker` scans **Maven**, **npm**, **Yarn**, **Composer (PHP)**, **PyPI (Python)**, **NuGet (C#/.NET)**, **Go**, **Ruby** and **vendored JavaScript** in any source tree — multi-module, monorepo, polyglot, whatever you've got — and produces a single self-contained HTML report with CVE (prioritised by **EPSS + CISA KEV**), EOL, obsolete, outdated and **license** findings, plus per-ecosystem fix recipes. It also exports a **CycloneDX 1.6 SBOM** and a **CSAF 2.0 VEX**.
+`fad-checker` scans **Maven**, **npm**, **Yarn**, **Composer (PHP)**, **PyPI (Python)**, **NuGet (C#/.NET)**, **Go**, **Ruby**, **vendored JavaScript** and **committed native binaries** in any source tree — multi-module, monorepo, polyglot, whatever you've got — and produces a single self-contained HTML report with CVE (prioritised by **EPSS + CISA KEV**), EOL, obsolete, outdated and **license** findings, plus per-ecosystem fix recipes. It also exports a **CycloneDX 1.6 SBOM** and a **CSAF 2.0 VEX**.
+
 
 🌐 **[Project site & docs →](https://n8tz.github.io/fad-checker/)**
 
-<p align="center"><img src="docs/assets/cli.png" alt="fad-checker terminal output — a [n/N] checklist warming each vulnerability database, then CVE findings coloured by severity" width="760"></p>
+<p align="center"><img src="docs/assets/cli.png" alt="fad-checker terminal output — a [n/N] checklist warming each vulnerability database, then CVE findings coloured by severity" height="760"></p>
 
 It runs against the source files alone. **No `mvn`, no `npm install`, no `composer install`, no `pip`, no `dotnet restore`, no Docker.** It reads `pom.xml`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `composer.lock`, `poetry.lock`/`Pipfile.lock`/`uv.lock`/`pdm.lock`/`pyproject.toml`/`requirements.txt`, and `packages.lock.json`/`*.csproj`/`*.fsproj`/`*.vbproj`/`packages.config` directly.
 
-> **Supported ecosystems: Maven, npm, Yarn (v1 + Berry/v2+), pnpm, Composer, PyPI, NuGet, Go, Ruby.** Each is a self-contained **codec** (`lib/codecs/`) — adding another is adding a codec, no orchestrator surgery. Vendored JS (jQuery, Bootstrap, PDF.js, etc.) is also scanned via retire.js. **Embedded JARs** committed into the tree — vendored libs, Spring-Boot fat-jars, shaded uber-jars inside `.jar`/`.war`/`.ear` — are unzipped in-memory and their Maven coordinates scanned too (disable with `--no-jars`).
+> **Supported ecosystems: Maven, npm, Yarn (v1 + Berry/v2+), pnpm, Composer, PyPI, NuGet, Go, Ruby + committed native binaries.** Each is a self-contained **codec** (`lib/codecs/`) — adding another is adding a codec, no orchestrator surgery. Vendored JS (jQuery, Bootstrap, PDF.js, etc.) is also scanned via retire.js. **Embedded JARs** committed into the tree — vendored libs, Spring-Boot fat-jars, shaded uber-jars inside `.jar`/`.war`/`.ear` — are unzipped in-memory and their Maven coordinates scanned too (disable with `--no-jars`). **Committed native binaries** (`.dll`/`.exe`/`.so`/`.dylib`) are detected (magic-byte confirmed, so images/assets are never picked up) and **identified by checksum** via deps.dev + CIRCL — to flag tampered/unknown files and libraries that ought to be declared dependencies (disable with `--no-binaries`).
 
 ---
 
@@ -48,12 +49,14 @@ Exactly **one** runtime dependencies must be on PATH (or installed automatically
 | **0. Warnings** | local heuristics | Missing lockfiles, unresolved Maven versions (BOM-managed), private libs not on Maven Central |
 | **1. CVE (production)** | CVEProject + OSV.dev + NVD + CPE | Public CVE / GHSA in production deps, per ecosystem, per manifest file — each row **prioritised** by CISA KEV + EPSS + CVSS |
 | **1B. Embedded binaries** | same, on coords read from archives | CVEs in libraries **shipped inside committed `.jar`/`.war`/`.ear`** (vendored libs, Spring-Boot fat-jars, shaded uber-jars) — not declared in any `pom.xml`. Grouped by containing archive |
-| **2. CVE in dev deps** | same | Same, but for `test`/`provided` (Maven) and `dev`/`optional`/`peer` (npm) |
-| **3. Vendored JS** | [retire.js](https://retirejs.github.io/) | Old jQuery/Bootstrap/Angular/PDF.js copies sitting in `static/` or `webapp/` with no lockfile |
+| **1C. Unmanaged / vendored binaries** | deps.dev + CIRCL (by checksum) | Committed **native binaries** (`.dll`/`.exe`/`.so`/`.dylib`) no package manager governs — identified by hash, flagged **should-be-managed** (exists in a registry), **name≠checksum** (filename disagrees with the hash), **unknown** (no source knows it) or **malicious** (free CIRCL signal) |
+| **1D. Unmanaged / vendored JavaScript** | [retire.js](https://retirejs.github.io/) (`--verbose`) | **Inventory of every standalone JS lib** committed into the tree (jQuery, Bootstrap, PDF.js, …) that no package manager governs — vulnerable *or not*. A cyber-hygiene constat: unknown provenance/integrity/patch story. `--no-vendored-js-inventory` to skip |
+| **2. Vendored JS (vulnerable)** | [retire.js](https://retirejs.github.io/) | The subset of the above with known CVEs/advisories — old jQuery/Bootstrap/Angular/PDF.js copies with no lockfile |
+| **3. CVE in dev deps** | same | Same as chapter 1, but for `test`/`provided` (Maven) and `dev`/`optional`/`peer` (npm) |
 | **4. EOL frameworks** | endoflife.date | Spring Boot 2.5, Hibernate 4.x, EOL JDKs, AngularJS, Laravel/Symfony, Django, .NET, etc. |
 | **5. Obsolete libraries** | curated list (Maven) + registry maintainer flags | log4j 1.x, jackson-mapper-asl, joda-time, …; npm `deprecated`, Composer `abandoned`, PyPI `yanked`/inactive, NuGet `deprecation` |
 | **6. Outdated libraries** | Maven Central + npm / Packagist / PyPI / NuGet registries | Available newer versions, with release dates |
-| **7. Licenses** | registry metadata + Maven POMs → SPDX policy | Each dep's license normalised to SPDX and classified; copyleft (GPL/AGPL/LGPL/MPL), proprietary and unknown flagged for review |
+| **7. Licenses** *(opt-in: `--licenses`)* | registry metadata + Maven POMs → SPDX policy | Each dep's license normalised to SPDX and classified; copyleft (GPL/AGPL/LGPL/MPL), proprietary and unknown flagged for review |
 | **8. Fix Recommendations** | computed | Per-ecosystem pin recipes: Maven `<dependencyManagement>`, npm `overrides`, yarn `resolutions`, `composer require`, `pip install`, `dotnet add package` |
 
 The HTML report opens in any browser, contains every detail (CVSS vectors, references, full descriptions, CPE configurations, via-paths for transitives) and ships a Word-compatible `.doc` twin. Every match carries a **composite priority** (KEV-exploited > EPSS likelihood > CVSS severity), and the run can additionally emit a **CycloneDX 1.6 SBOM** (`--report-sbom`, vulnerabilities inline) and a **CSAF 2.0 VEX** (`--report-csaf`) for downstream tooling.
@@ -83,9 +86,13 @@ fad-checker --set-nvd-key YOUR_KEY
 # Read-only full scan (default: all sources on)
 fad-checker -s ./proj
 
-# Exclude private/internal libs by groupId regex
+# Exclude private/internal libs by groupId/name regex
 fad-checker -s ./proj -e "^(com\.acme|org\.private)\."
 
+# Ignore whole sub-paths during the walk (gitignore-style glob, relative to -s)
+fad-checker -s ./proj --exclude-path "packages/legacy/**" --exclude-path "**/fixtures/**"
+fad-checker -s ./proj --no-default-excludes          # walk everything (incl. node_modules/.git)
+
 # Also write cleaned POMs (private deps stripped, ready for Snyk)
 fad-checker -s ./proj -t ../proj-clean -e "^com\.acme\."
 
@@ -98,10 +105,19 @@ fad-checker -s ./proj --no-all-libs --no-transitive
 # Fully offline (uses cached data only)
 fad-checker -s ./proj --offline
 
+# License + copyleft-policy chapter (off by default)
+fad-checker -s ./proj --licenses
+
 # Pick ecosystems — --ecosystem is a list: auto (default) | all | comma list
 fad-checker -s ./proj --ecosystem maven            # Maven only
 fad-checker -s ./proj --ecosystem maven,npm,pypi   # several
 fad-checker -s ./proj --no-nuget --no-composer     # or opt out per codec
+fad-checker -s ./proj --no-binaries                # skip the native-binary scan
+
+# Private registry + reusable defaults (see "Configuration file & environment")
+fad-checker --add-repo npm verdaccio https://npm.acme.com/ --token "$NPM_TOKEN"
+fad-checker --config ./ci/fad-env.json             # all options from a JSON file
+fad-checker --source ./proj                        # --source / --src are aliases
 ```
 
 Run `fad-checker --help` for the full flag list.
@@ -115,36 +131,22 @@ Run `fad-checker --help` for the full flag list.
 The console prints a summary; the full detail lives in the self-contained HTML/`.doc`:
 
 ```
+╭───────────────────────────────────────────────────╮
+│ fad-checker v2.2.1 · Autonomous Dependency Checker │
+╰───────────────────────────────────────────────────╯
 Executive Summary [CRITICAL] — 1708 dependencies scanned
   • 81 CVE in production deps (critical=5, high=53, medium=12, low=11)
-  • 32 CVE in dev/test deps
-  • 17 vulnerable vendored JS finding(s) (retire.js)
-  • 2 end-of-life frameworks
-  • 13 obsolete / deprecated libs
-  • 172 outdated libs
+  • 32 CVE in dev/test deps · 17 vulnerable vendored JS (retire.js)
+  • 2 EOL frameworks · 13 obsolete/deprecated · 172 outdated
   • 4 scan-completeness alerts — see chapter 0
-
-0. Warnings & scan-completeness (4)
-1. CVE Vulnerabilities — production (81)
-   1.a Maven (49)
-      1.a.0 All (49)
-      By pom.xml (14 files)
-         build/building/pom.xml (17)
-         services/api/pom.xml (17)
-         … 12 more
-   1.b npm (package-lock) (32)
-      1.b.0 All (32)
-      By package-lock.json (1 file)
-         web/package-lock.json (32)
-2. CVE in dev dependencies (32)
-3. Vendored JS scan — retire.js (17)
-4. End-of-Life Frameworks (2)
-5. Obsolete / Deprecated Libraries (13)
-6. Outdated Libraries (172)
-7. Fix Recommendations
 ```
 
-Each CVE row shows: severity badge · CVE / GHSA id · dep coord & version · which manifest file declares it · source(s) (CVEProject / OSV / NVD / Snyk / retire / fad) · fix-version · summary. Click a row for the full panel (CVSS vectors, NVD references categorised by type, transitive paths, CPE configurations).
+The HTML report organises this into chapters (0 Warnings, 1 CVE prod, 1B embedded JARs,
+1C native binaries, 1D vendored-JS inventory, 2 vendored-JS vulns, 3 dev CVE, 4 EOL,
+5 obsolete, 6 outdated, 7 Licenses *(opt-in)*, 8 Fix Recommendations), each grouped by
+ecosystem and manifest. Every CVE row carries: severity badge · CVE/GHSA id · coord &
+version · declaring manifest · source(s) · fix-version · priority (KEV/EPSS) — click for
+the full panel (CVSS vectors, references, transitive paths, CPE configs).
 
 ---
 
@@ -184,52 +186,30 @@ fad-checker --completion zsh  > ~/.zsh/completions/_fad-checker
 
 ## How it scans without any build tool
 
-This is the surprising bit. The whole point is that you can run `fad-checker` against a *checkout* with no build environment.
-
-- **Maven** — `pom.xml` files are parsed with xml2js. Property substitution (`${jackson.version}`), parent inheritance, local BOM imports (`<scope>import</scope>`) and every profile are resolved in-process. Transitive deps are walked by fetching child POMs from Maven Central (cached forever — POMs are immutable). When the project uses an **external BOM** (`spring-boot-dependencies` etc.), the deps whose version comes from that BOM can't be resolved without `mvn` itself — those are surfaced in chapter 0 as "unresolved-versions" so you know what's missing.
-- **npm / Yarn / pnpm** — `package-lock.json` (v1, v2, v3), `yarn.lock` (v1 + Berry/v2+, via `js-yaml`) and `pnpm-lock.yaml` (v5/v6/v9, via `js-yaml`) are parsed directly. Lockfiles already contain every transitive version. No `node_modules/` traversal, no `npm install`.
-- **Composer (PHP)** — `composer.lock` (`packages` + `packages-dev`) gives concrete + transitive versions; `composer.json` alone is best-effort.
-- **PyPI (Python)** — `poetry.lock` / `Pipfile.lock` / `uv.lock` / `pdm.lock` are parsed (TOML via `smol-toml`, or JSON); `pyproject.toml` (PEP 621 `[project]` + `[tool.poetry]`) and `requirements.txt` (following `-r`/`-c` includes recursively, with `-c` constraint pins applied to ranges) are best-effort on exact pins. Package names are PEP 503-normalised (`Flask-SQLAlchemy` → `flask-sqlalchemy`).
-- **NuGet (C#/.NET)** — `packages.lock.json` is authoritative; otherwise `*.csproj` / `*.fsproj` / `*.vbproj` `<PackageReference>` (resolving Central Package Management against `Directory.Packages.props`) and legacy `packages.config`. Ids are case-insensitive.
-- **Go** — `go.mod` `require` entries are the selected versions (full pruned graph on Go ≥1.17; `// indirect` → transitive), `go.sum` as fallback. OSV "Go" ecosystem for recall, the Go module proxy for outdated.
-- **Ruby** — `Gemfile.lock` `specs:` give the resolved gem set. OSV "RubyGems" for recall, the RubyGems API for outdated + licenses.
-- **Lockfile-first, best-effort fallback** — when a lockfile is present it wins. When it's absent, the loose manifest (`package.json` / `composer.json` / `pyproject.toml` / `requirements.txt` / `*.csproj`) is still parsed for its **pinned exact versions**, with ranges skipped and a `no-lockfile` warning in chapter 0 flagging the partial coverage.
-- **Vendored JavaScript** — `retire.js` shells out and scans `.js` / `.min.js` files by signature, catching old jQuery / Bootstrap / Angular / PDF.js copies that no lockfile knows about.
-- **Embedded JARs** — committed `.jar` / `.war` / `.ear` archives are unzipped **in memory** (via `fflate` — nested fat-jar libs are recursed without ever touching disk, so there's no zip-slip risk) and each artifact's Maven coordinate is read from `META-INF/maven/.../pom.properties` (authoritative), then `MANIFEST.MF`, then the file name. Those coordinates run through the same CVE/OSV/NVD matching as declared deps but report in their own **Embedded binaries** chapter, grouped by containing archive. An archive whose coordinate can't be resolved is flagged in chapter 0 rather than scanned blindly. Auto when archives are present; disable with `--no-jars`. (Embedded coords don't trigger Maven Central transitive resolution — a fat-jar already ships its dependencies, which the recursion finds directly.)
-- **CVE data** — three independent sources merged:
-  - **CVEProject** (the canonical `cvelistV5` bundle, filtered to Maven-relevant entries)
-  - **OSV.dev** (Google + GitHub Security Lab, multi-ecosystem)
-  - **NVD** (official NIST records, used for enrichment: full CVSS, references, CPE configurations)
-- **CPE refinement** — once a CVE is matched, its NVD CPE configurations are checked against the dep version range. A match outside the vulnerable range is flagged `cpeFiltered: true` (likely false positive). A curated `data/cpe-coord-map.json` maps CPE `vendor:product` to Maven `g:a` (60+ entries seeded: log4j, jackson, spring, tomcat, jetty, netty, …).
-- **Prioritization** — each matched CVE is enriched with **EPSS** (FIRST.org exploit-prediction percentile) and **CISA KEV** (known-exploited catalogue), then scored: KEV (exploited in the wild) outranks EPSS-weighted CVSS. The report sorts by this composite priority and badges KEV/EPSS.
-- **Licenses** — each dependency's license is resolved (registry metadata, no extra request; Maven from cached POMs), normalised to SPDX and classified against a copyleft policy (`data/license-policy.json`) — permissive / weak / strong / network copyleft / proprietary / unknown.
-- **Unified outputs** — one `--report-<type>` flag per output, each with an OPTIONAL path (omit it → a default name under `--report-output`): `--report-html`, `--report-doc`, plus the machine-readable `--report-sbom` (**CycloneDX 1.6**, vulnerabilities inline / VDR), `--report-csaf` (**CSAF 2.0 VEX**), `--report-json` (flat findings, diff-friendly) and `--report-sarif` (**SARIF 2.1.0** for GitHub/GitLab code scanning). With no `--report-*` flag, HTML + `.doc` are written by default; `--no-report` writes nothing (gate-only). purls per ecosystem.
-- **CI gating & triage** — `--fail-on <low|medium|high|critical|kev>` sets a non-zero exit code (`kev` = fail only on a CISA-known-exploited finding). `--ignore <file>` (CVE/coord/glob rules) and `--vex <file>` (ingest a CSAF VEX) suppress accepted-risk / false-positive findings from the report and the gate, while keeping them flagged in the exports — so re-audits stay signal-rich.
+**TL;DR** — `fad-checker` never runs your build. For each ecosystem it reads the **lockfile** (or, failing that, the manifest's pinned versions) straight off disk to learn the exact dependency versions, then matches those coordinates against vulnerability/EOL/registry data over the network (cached, `--offline`-able). No `mvn`, `npm install`, `pip`, `dotnet restore`, `go build` or `bundle` — and no `node_modules/`.
+
+| Ecosystem | Read directly | Transitive versions come from |
+| --- | --- | --- |
+| Maven | `pom.xml` (+ parents, BOMs, profiles) | child POMs fetched from Maven Central (cached) |
+| npm / Yarn / pnpm | `package-lock.json` · `yarn.lock` (v1+Berry) · `pnpm-lock.yaml` | the lockfile itself |
+| Composer | `composer.lock` (else `composer.json`) | the lockfile |
+| PyPI | `poetry.lock` · `Pipfile.lock` · `uv.lock` · `pdm.lock` (else `pyproject.toml`/`requirements.txt`) | the lockfile |
+| NuGet | `packages.lock.json` (else `*.csproj`/`packages.config`) | the lockfile |
+| Go | `go.mod` (`// indirect` → transitive; `go.sum` fallback) | the module graph in `go.mod` |
+| Ruby | `Gemfile.lock` (`specs:`) | the lockfile |
+| Vendored JS / binaries | the committed `.js` / `.jar` / `.so` files themselves | n/a (read in place) |
+
+Highlights of the matching layer: **three CVE sources merged** (CVEProject + OSV.dev + NVD), **CPE/version cross-check** to drop false positives, **EPSS + CISA KEV** prioritisation, lockfile-first with a **best-effort pinned-version fallback** when no lockfile, in-memory **embedded-JAR** unzip (no disk, no zip-slip), and **checksum identity** for native binaries. Outputs: HTML + `.doc` by default, plus opt-in `--report-sbom`/`-csaf`/`-json`/`-sarif`; CI gating via `--fail-on` with `--ignore`/`--vex` triage.
+
+> Full per-ecosystem and per-stage detail lives in **[`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md)** and **[`docs/USAGE.md`](docs/USAGE.md)**.
 
 ---
 
 ## Caching
 
-All cached data lives in `~/.fad-checker/`:
-
-| Cache | Path | TTL |
-| --- | --- | --- |
-| Maven CVE index (CVEProject bundle, filtered) | `cve-data/maven-cve-index.json` | 24 h |
-| OSV per-dep lookups | `osv-cache/<ecosystem>__<g>__<a>__<v>.json` | 12 h |
-| OSV vuln details | `osv-cache/vuln_<id>.json` | 12 h |
-| NVD CVE records | `nvd-cache/<cveId>.json` | 7 d |
-| EPSS scores (FIRST.org) | `epss-cache.json` | 24 h |
-| CISA KEV catalogue | `kev-cache.json` | 24 h |
-| Go module proxy (latest) | `go-proxy-cache.json` | 24 h |
-| RubyGems (latest + licenses) | `rubygems-cache.json` | 24 h |
-| endoflife.date cycles | `eol-cache.json` | 7 d |
-| Maven Central latest versions | `version-cache.json` | 24 h |
-| Transitive POMs from Maven Central | `poms-cache/<g>__<a>__<v>.pom` | ∞ (immutable) |
-| retire.js findings | `retire-cache/<md5(src)>.json` | 24 h |
-| retire.js signature DB | `retire-signatures/jsrepository-v5.json` | warmed online, used offline |
-| User config (NVD key) | `config.json` (mode 0600) | — |
-
-Export the lot to share between machines:
+All cached data lives in `~/.fad-checker/` — every source is hit at most once per its
+TTL (12 h–7 d, transitive POMs forever as they're immutable). Full per-cache TTL table
+in [`docs/USAGE.md`](docs/USAGE.md). Export the lot to share between machines:
 
 ```bash
 fad-checker --export-cache fad-cache.tar.gz
@@ -288,24 +268,30 @@ DB is warmed online (phase 2) and carried by `--export-cache`.
 
 ---
 
-## Custom Maven repositories
+## Custom repositories & registries
+
+Register private **Nexus / Artifactory / Verdaccio / devpi / GOPROXY** registries (for **`maven`, `npm`, `pypi`, `ruby`, `go`**) so transitive resolution, outdated/deprecation and license lookups reach them:
+
+```bash
+fad-checker --add-repo maven nexus https://nexus.acme.com/repository/maven-public/ --auth alice:s3cr3t
+fad-checker --add-repo npm   verdaccio https://npm.acme.com/ --token "$NPM_TOKEN"
+fad-checker -s ./proj --repo npm=https://npm.acme.com/        # one-off, repeatable
+```
+
+Tried in declared order, public registry last; auth via `--auth user:pass` / `--token TOK` / inline URL; responses cached per coordinate. NuGet/Composer private feeds aren't supported yet. **Full details, the PyPI/Ruby JSON-API caveat and `--list-repos`/`--remove-repo` → [`docs/USAGE.md`](docs/USAGE.md).**
+
+---
+
+## Configuration file & environment
 
-Out of the box `fad-checker` queries Maven Central for transitive POMs and latest versions. If your project depends on artifacts that live on a private Nexus / Artifactory / JBoss repo, add them so transitive resolution and outdated checks work end-to-end.
+Don't retype flags every run. Precedence: **CLI flag > `--config <file.json>` / `./.fad-env.json` (JSON, keys = camelCase options) > `FAD_CHECKER_ENV` (a string of CLI flags) > `~/.fad-checker/config.json` > defaults.** A file/env value only fills an option you didn't pass; **registries are merged across every layer**.
 
 ```bash
-# Persist a repo (lives in ~/.fad-checker/config.json)
-fad-checker --add-repo nexus       https://nexus.acme.com/repository/maven-public/
-fad-checker --add-repo nexus-priv  https://nexus.acme.com/repository/maven-private/  --auth alice:s3cr3t
-fad-checker --list-repos
-fad-checker --remove-repo nexus-priv
-
-# One-off (not persisted) — repeatable
-fad-checker -s ./proj --repo https://nexus.acme.com/repository/maven-public/
-# Inline auth in the URL also works:
-fad-checker -s ./proj --repo https://alice:s3cr3t@nexus.acme.com/repository/maven-public/
+fad-checker --config ./ci/fad-env.json
+FAD_CHECKER_ENV='--fail-on high --no-nuget' fad-checker -s ./proj
 ```
 
-Repos are tried **in declared order, Maven Central last**. Auth is sent as a `Basic <base64>` header. POMs and `maven-metadata.xml` are cached per coord, so subsequent runs are free even against a private repo.
+`-s` / `--src` / `--source` are aliases. **`-e/--exclude`** is a regex on the **coordinate** (drops deps); **`--exclude-path`** is a gitignore-style glob on the **path** (prunes the walk). Full `.fad-env.json` schema → [`docs/USAGE.md`](docs/USAGE.md).
 
 ---
 
@@ -328,6 +314,8 @@ Repos are tried **in declared order, Maven Central last**. Auth is sent as a `Ba
 | [NuGet](https://www.nuget.org/) | Latest stable + per-version `deprecation` | Free public service | `GET api.nuget.org/v3/registration5-gz-semver2/<id>/index.json` |
 | [Go module proxy](https://proxy.golang.org/) | Latest module version (outdated) | Free public service | `GET proxy.golang.org/<module>/@latest` |
 | [RubyGems](https://rubygems.org/) | Latest stable + licenses | Free public service | `GET rubygems.org/api/v1/gems/<gem>.json` |
+| [deps.dev](https://deps.dev/) | Native-binary identity by checksum (→ package coordinate) | Free public API (CC-BY) | `GET api.deps.dev/v3/query?hash.type=SHA1&hash.value=<base64>` |
+| [CIRCL hashlookup](https://hashlookup.circl.lu/) | Known-good file identity (NSRL/distro/CDN) + KnownMalicious | Free public service | `GET hashlookup.circl.lu/lookup/sha256/<hash>` |
 | [retire.js](https://retirejs.github.io/retire.js/) | Vendored-JS signature DB + scanner | Apache-2.0 | npm package `retire`, executed locally |
 | [Snyk](https://snyk.io/) (optional) | Additional CVE source via `snyk test --all-projects --json` | Per Snyk EULA; needs a Snyk account | Local CLI `snyk` |
 | [MITRE CWE](https://cwe.mitre.org/) | Weakness category links in the report | Free public reference | Linked by URL only, no API call |
@@ -355,7 +343,7 @@ of thing a security consultant or an ANSSI-PASSI engagement needs.
 
 | | **fad-checker** | OSV-Scanner | Trivy | Grype + Syft | OWASP DC | Snyk OSS |
 | --- | --- | --- | --- | --- | --- | --- |
-| Ecosystems it targets¹ | Maven, npm, Yarn, **pnpm**, Composer, PyPI, NuGet, Go, Ruby + vendored JS | 11+ langs / 19+ lockfiles | 20+ | 20+ | Java/.NET (others exp.) | many |
+| Ecosystems it targets¹ | Maven, npm, Yarn, **pnpm**, Composer, PyPI, NuGet, Go, Ruby + vendored JS + **native binaries** | 11+ langs / 19+ lockfiles | 20+ | 20+ | Java/.NET (others exp.) | many |
 | Reads lockfiles without `install`/build | ✅ | ✅ | ✅ | ✅ | ⚠️ Java needs Maven Central/build | ❌ build required |
 | Best-effort when **no lockfile** (pinned versions) | ✅ | ❌ | ❌ | ❌ | ⚠️ | ⚠️ |
 | Vulnerability sources | CVEProject + OSV + NVD + EPSS + KEV + retire.js (+ Snyk), merged | OSV.dev | Aqua DB | Anchore DB | NVD / CPE | Snyk DB |

package/completions/fad-checker.bash

@@ -6,7 +6,7 @@ _fad_check_complete() {
 	COMPREPLY=()
 	cur="${COMP_WORDS[COMP_CWORD]}"
 	prev="${COMP_WORDS[COMP_CWORD-1]}"
-	opts="--src --target --exclude --verbose --no-report --no-transitive --no-all-libs --no-osv --no-nvd --no-epss --no-kev --no-licenses --no-retire --retire-refresh --report-output --report-html --report-doc --report-sbom --report-csaf --report-json --report-sarif --fail-on --ignore --vex --ignore-test --cve-refresh --cve-offline --snyk --transitive-depth --offline --ecosystem --no-maven --no-npm --no-yarn --no-nuget --no-composer --no-pypi --no-go --no-ruby --no-jars --no-js --set-nvd-key --show-config --completion --help --version -s -t -e -v"
+	opts="--src --target --exclude --verbose --no-report --no-transitive --no-all-libs --no-osv --no-nvd --no-epss --no-kev --licenses --no-retire --retire-refresh --report-output --report-html --report-doc --report-sbom --report-csaf --report-json --report-sarif --fail-on --ignore --vex --ignore-test --cve-refresh --cve-offline --snyk --transitive-depth --offline --ecosystem --no-maven --no-npm --no-yarn --no-nuget --no-composer --no-pypi --no-go --no-ruby --no-jars --no-js --set-nvd-key --show-config --completion --help --version -s -t -e -v"
 	case "$prev" in
 		--src|-s|--target|-t|--report-output)
 			COMPREPLY=( $(compgen -d -- "$cur") )

package/completions/fad-checker.zsh

@@ -42,6 +42,7 @@ _fad_check() {
 		'--no-pypi[skip the PyPI codec]'
 		'--no-js[alias: skip JS/npm/yarn]'
 		'--no-retire[skip retire.js vendored-JS scan]'
+		'--licenses[run license detection + copyleft policy (off by default)]'
 		'--completion[print shell completion]:shell:(bash zsh)'
 	)
 	_arguments $opts