fullshield 0.0.1 → 0.1.1

package/dist/supply.js

@@ -0,0 +1,228 @@
+import { existsSync, statSync, readFileSync, readdirSync } from 'fs';
+import { join, relative } from 'path';
+import { createHash } from 'crypto';
+
+// src/supply/index.ts
+function makeFindingId(ruleId, file, snippet) {
+  const normalized = (snippet ?? "").replace(/\s+/g, " ").trim();
+  return createHash("sha256").update(`${ruleId}\0${file ?? ""}\0${normalized}`).digest("hex").slice(0, 16);
+}
+
+// src/supply/index.ts
+var REGISTRY_HOST = "registry.npmjs.org";
+var INSTALL_SCRIPT_KEYS = ["preinstall", "install", "postinstall"];
+function assertRegistryUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error("supply: registry URL must be https://registry.npmjs.org/...");
+  }
+  if (parsed.protocol !== "https:" || parsed.hostname !== REGISTRY_HOST) {
+    throw new Error(`supply: only ${REGISTRY_HOST} is allowed (got ${parsed.hostname || url})`);
+  }
+}
+function packageNameFromSpec(spec) {
+  if (spec.startsWith("@")) {
+    const slash = spec.indexOf("/");
+    if (slash < 0) return spec;
+    const scope = spec.slice(0, slash);
+    const rest = spec.slice(slash + 1);
+    const name = rest.includes("@") ? rest.slice(0, rest.indexOf("@")) : rest;
+    return `${scope}/${name}`;
+  }
+  const at = spec.indexOf("@");
+  return at > 0 ? spec.slice(0, at) : spec;
+}
+function finding(ruleId, title, message, file, severity = "high") {
+  return {
+    id: makeFindingId(ruleId, file, message),
+    ruleId,
+    module: "deps",
+    title,
+    severity,
+    confidence: "high",
+    file,
+    message,
+    remediation: "Do not install this package until the behavior is reviewed. Use --ignore-scripts."
+  };
+}
+function walkJs(dir, out = []) {
+  if (!existsSync(dir)) return out;
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name === "node_modules") continue;
+      walkJs(full, out);
+    } else if (entry.isFile() && /\.(js|cjs|mjs|ts)$/.test(entry.name)) {
+      out.push(full);
+    }
+  }
+  return out;
+}
+function readJson(path) {
+  return JSON.parse(readFileSync(path, "utf8"));
+}
+function installScriptKeys(scripts) {
+  if (!scripts) return [];
+  return INSTALL_SCRIPT_KEYS.filter((k) => typeof scripts[k] === "string");
+}
+function analyzePackageDir(dir) {
+  const findings = [];
+  const manifestPath = join(dir, "package.json");
+  if (!existsSync(manifestPath) || !statSync(manifestPath).isFile()) return findings;
+  const pkg = readJson(manifestPath);
+  const scripts = pkg.scripts ?? {};
+  const keys = installScriptKeys(scripts);
+  if (keys.length > 0) {
+    findings.push(
+      finding(
+        "SUPPLY-INSTALLSCRIPT-001",
+        "Package declares an install script",
+        `install scripts: ${keys.join(", ")}`,
+        "package.json"
+      )
+    );
+  }
+  const sources = walkJs(dir).map((file) => ({
+    file: relative(dir, file) || file,
+    text: readFileSync(file, "utf8")
+  }));
+  const readsNpmrc = sources.some((s) => s.text.includes(".npmrc") || s.text.includes(".ssh"));
+  const hasNet = sources.some((s) => /https\.request|http\.request|fetch\s*\(|axios\./.test(s.text));
+  if (readsNpmrc && hasNet) {
+    const hit = sources.find((s) => s.text.includes(".npmrc") || s.text.includes(".ssh"));
+    findings.push(
+      finding(
+        "SUPPLY-NPMRC-NET-001",
+        "Install-time code reads npm/ssh credentials and uses the network",
+        "static: credential file read combined with http(s)/fetch",
+        hit?.file,
+        "critical"
+      )
+    );
+  }
+  for (const src of sources) {
+    if (/eval\s*\(\s*(Buffer|atob|fromCharCode|decodeURIComponent)/.test(src.text)) {
+      findings.push(
+        finding(
+          "SUPPLY-OBFUSCATE-001",
+          "Package evals a decoded/obfuscated string",
+          "static: eval of decoded payload",
+          src.file
+        )
+      );
+    }
+  }
+  return findings;
+}
+function diffPackageVersions(oldDir, newDir) {
+  const oldManifest = existsSync(join(oldDir, "package.json")) ? readJson(join(oldDir, "package.json")) : {};
+  const nextManifest = existsSync(join(newDir, "package.json")) ? readJson(join(newDir, "package.json")) : {};
+  const oldScripts = oldManifest.scripts ?? {};
+  const nextScripts = nextManifest.scripts ?? {};
+  const added = INSTALL_SCRIPT_KEYS.filter((k) => typeof nextScripts[k] === "string" && oldScripts[k] === void 0);
+  const oldSrc = walkJs(oldDir).map((f) => readFileSync(f, "utf8")).join("\n");
+  const newSrc = walkJs(newDir).map((f) => readFileSync(f, "utf8")).join("\n");
+  const newChild = /child_process/.test(newSrc) && !/child_process/.test(oldSrc);
+  const newNet = /https?\.request|fetch\s*\(/.test(newSrc) && !/https?\.request|fetch\s*\(/.test(oldSrc);
+  if (added.length === 0 && !newChild && !newNet) return [];
+  return [
+    finding(
+      "SUPPLY-BEHAVIOR-001",
+      "Package version adds install-script or process/network behavior",
+      `added scripts=${added.join(",") || "none"} child_process=${newChild} network=${newNet}`,
+      "package.json"
+    )
+  ];
+}
+function checkCooldown(packument, version, minHours = 72, nowMs = Date.now()) {
+  const stamp = packument.time?.[version];
+  if (!stamp) return [];
+  const published = Date.parse(stamp);
+  if (Number.isNaN(published)) return [];
+  const ageHours = (nowMs - published) / 36e5;
+  if (ageHours >= minHours) return [];
+  return [
+    finding(
+      "SUPPLY-COOLDOWN-001",
+      "Package version is younger than the release cooldown",
+      `${version} published ${ageHours.toFixed(1)}h ago (min ${minHours}h)`,
+      void 0,
+      "medium"
+    )
+  ];
+}
+function checkLockfileIntegrity(lock) {
+  const findings = [];
+  for (const [name, entry] of Object.entries(lock.packages ?? {})) {
+    if (name === "") continue;
+    const resolved = entry.resolved;
+    if (!resolved) continue;
+    try {
+      const host = new URL(resolved).hostname;
+      if (host !== REGISTRY_HOST) {
+        findings.push(
+          finding(
+            "SUPPLY-LOCKURL-001",
+            "Lockfile entry resolves from a non-npm registry host",
+            `${name} resolved host ${host}`,
+            "package-lock.json"
+          )
+        );
+      }
+    } catch {
+      findings.push(
+        finding(
+          "SUPPLY-LOCKURL-001",
+          "Lockfile entry has a non-URL resolved field",
+          `${name} resolved ${resolved}`,
+          "package-lock.json"
+        )
+      );
+    }
+  }
+  return findings;
+}
+function checkDependencyConfusion(pkgName, npmrc, publicExists) {
+  const scoped = pkgName.startsWith("@");
+  const privateRegistry = /@[\w-]+\s*:\s*registry\s*=/.test(npmrc) || /registry\s*=\s*https?:\/\/(?!registry\.npmjs\.org)/.test(npmrc);
+  if (scoped && privateRegistry && publicExists) {
+    return [
+      finding(
+        "SUPPLY-CONFUSION-001",
+        "Private-scope name also exists on the public registry",
+        `${pkgName} is configured for a private registry but a public package exists`
+      )
+    ];
+  }
+  return [];
+}
+function checkProvenance(previouslyHad, currentlyHas) {
+  if (previouslyHad && !currentlyHas) {
+    return [
+      finding(
+        "SUPPLY-PROVENANCE-001",
+        "Package dropped npm provenance since the last scan",
+        "previous version had provenance; current version does not"
+      )
+    ];
+  }
+  return [];
+}
+async function installGuard(spec, opts = {}) {
+  if (!opts.experimental && process.env.FULLSHIELD_EXPERIMENTAL_SUPPLY !== "1") {
+    return { findings: [], skipped: true };
+  }
+  const name = packageNameFromSpec(spec);
+  const url = `https://${REGISTRY_HOST}/${encodeURIComponent(name)}`;
+  assertRegistryUrl(url);
+  if (opts.fetchPackument) await opts.fetchPackument(url);
+  const findings = opts.extractDir !== void 0 ? analyzePackageDir(opts.extractDir) : [];
+  if (findings.length === 0 && opts.runNpm) {
+    await opts.runNpm(["install", spec, "--ignore-scripts"]);
+  }
+  return { findings };
+}
+
+export { analyzePackageDir, assertRegistryUrl, checkCooldown, checkDependencyConfusion, checkLockfileIntegrity, checkProvenance, diffPackageVersions, installGuard, packageNameFromSpec };

package/dist/threat.js

@@ -0,0 +1,63 @@
+import { existsSync, statSync, readFileSync, readdirSync } from 'fs';
+import { relative, join } from 'path';
+
+// src/threat/index.ts
+function walk(dir, out = []) {
+  if (!existsSync(dir)) return out;
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (["node_modules", "dist", ".git"].includes(entry.name)) continue;
+      walk(full, out);
+    } else if (entry.isFile() && /\.[cm]?[jt]sx?$/.test(entry.name)) {
+      out.push(full);
+    }
+  }
+  return out;
+}
+function buildThreatModel(dir, opts = {}) {
+  if (!opts.experimental && process.env.FULLSHIELD_EXPERIMENTAL_PLATFORM !== "1") {
+    return { skipped: true, routes: [], stores: [], egress: [], stride: [], mermaid: "" };
+  }
+  const routes = [];
+  const stores = /* @__PURE__ */ new Set();
+  const egress = /* @__PURE__ */ new Set();
+  if (!existsSync(dir) || !statSync(dir).isDirectory()) {
+    return { routes, stores: [], egress: [], stride: [], mermaid: "flowchart LR\n" };
+  }
+  for (const file of walk(dir)) {
+    const rel = relative(dir, file) || file;
+    const text = readFileSync(file, "utf8");
+    const routeRe = /app\.(get|post|put|patch|delete|use)\(\s*['"]([^'"]+)['"]/g;
+    let m;
+    while ((m = routeRe.exec(text)) !== null) {
+      routes.push({
+        method: (m[1] ?? "get").toUpperCase(),
+        path: m[2] ?? "/",
+        file: rel,
+        auth: /auth|requireUser|requireAuth/.test(text)
+      });
+    }
+    if (/sqlite|mongodb|postgres|mysql|createPool|DatabaseSync/.test(text)) stores.add(rel);
+    const urlRe = /https?:\/\/[^\s'"[`]+/g;
+    while ((m = urlRe.exec(text)) !== null) egress.add(m[0] ?? "");
+  }
+  const stride = routes.slice(0, 20).map((r) => ({
+    element: `${r.method} ${r.path}`,
+    spoofing: r.auth ? "auth middleware present" : "no auth seen",
+    tampering: "input reaches handler",
+    repudiation: "check access logs",
+    infoDisclosure: "review response bodies",
+    denialOfService: "no rate-limit inferred",
+    elevation: r.auth ? "review authorization" : "unauthenticated route"
+  }));
+  const mermaid = [
+    "flowchart LR",
+    "  client[Client] --> app[App]",
+    ...routes.slice(0, 12).map((r, i) => `  app --> r${i}["${r.method} ${r.path}"]`),
+    ...[...stores].slice(0, 6).map((s, i) => `  app --> s${i}["store ${s}"]`)
+  ].join("\n");
+  return { routes, stores: [...stores], egress: [...egress], stride, mermaid };
+}
+
+export { buildThreatModel };

package/dist/workspaces.js

@@ -0,0 +1,23 @@
+import { existsSync, readFileSync } from 'fs';
+import { join } from 'path';
+
+// src/workspaces/index.ts
+function listWorkspaces(dir, opts = {}) {
+  if (!opts.experimental && process.env.FULLSHIELD_EXPERIMENTAL_PLATFORM !== "1") return [];
+  const manifestPath = join(dir, "package.json");
+  if (!existsSync(manifestPath)) return [];
+  try {
+    const pkg = JSON.parse(readFileSync(manifestPath, "utf8"));
+    if (Array.isArray(pkg.workspaces)) return pkg.workspaces;
+    if (Array.isArray(pkg.workspaces?.packages)) return pkg.workspaces.packages;
+  } catch {
+    return [];
+  }
+  const pnpm = join(dir, "pnpm-workspace.yaml");
+  if (existsSync(pnpm)) {
+    return readFileSync(pnpm, "utf8").split("\n").map((l) => l.replace(/^-+\s*/, "").trim()).filter((l) => l.length > 0 && !l.startsWith("packages:"));
+  }
+  return [];
+}
+
+export { listWorkspaces };

package/package.json

@@ -1,13 +1,98 @@
 {
   "name": "fullshield",
-  "version": "0.0.1",
-  "description": "Full-cycle security for Node.js - in development",
-  "main": "index.js",
+  "version": "0.1.1",
+  "description": "Full-cycle security scanner for Node.js/TypeScript backends: detect, classify, report, notify, fix, prevent.",
+  "license": "MIT",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kathanp/fullshield.git"
+  },
+  "engines": {
+    "node": ">=22.13"
+  },
+  "bin": {
+    "fullshield": "dist/cli/index.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./runtime": "./dist/runtime/index.js",
+    "./runtime/express": "./dist/runtime/express.js",
+    "./runtime/fastify": "./dist/runtime/fastify.js",
+    "./runtime/rasp": "./dist/runtime/rasp.js",
+    "./runtime/register": "./dist/runtime/register.js",
+    "./runtime/auto": "./dist/runtime/auto.js",
+    "./cli": "./dist/cli/index.js",
+    "./package.json": "./package.json"
+  },
+  "peerDependencies": {
+    "express": "*",
+    "fastify": "*",
+    "@modelcontextprotocol/sdk": "^1.32.1",
+    "zod": "^4.6.7"
+  },
+  "peerDependenciesMeta": {
+    "express": {
+      "optional": true
+    },
+    "fastify": {
+      "optional": true
+    },
+    "@modelcontextprotocol/sdk": {
+      "optional": true
+    },
+    "zod": {
+      "optional": true
+    }
+  },
+  "files": [
+    "dist",
+    "!dist/**/*.map",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md",
+    "templates",
+    "rules"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint . --max-warnings 0",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "test:e2e": "vitest run test/e2e",
+    "test:live-ai": "npm run build && node scripts/live-ai.mjs",
+    "bench": "node scripts/bench.mjs",
+    "verify": "node scripts/verify.mjs",
+    "verify:phase": "node scripts/verify.mjs --phase"
+  },
+  "dependencies": {
+    "@typescript-eslint/typescript-estree": "^8.71.2",
+    "commander": "^12.1.0",
+    "ignore": "^5.3.2",
+    "picocolors": "^1.1.1"
   },
-  "keywords": [],
-  "author": "",
-  "license": "ISC",
-  "type": "commonjs"
+  "devDependencies": {
+    "@modelcontextprotocol/sdk": "^1.32.1",
+    "@eslint/js": "^9.14.0",
+    "@types/node": "^22.9.0",
+    "@vitest/coverage-v8": "^2.1.4",
+    "eslint": "^9.14.0",
+    "express": "^4.22.3",
+    "globals": "^15.12.0",
+    "tsup": "^8.3.5",
+    "typescript": "^5.6.3",
+    "typescript-eslint": "^8.13.0",
+    "vitest": "^2.1.4",
+    "zod": "^4.6.7"
+  }
 }

package/rules/CONFIG-BODYLIMIT-001.md

@@ -0,0 +1,9 @@
+# CONFIG-BODYLIMIT-001
+
+**express.json() without a size limit.** CWE-770.
+
+## Remediation
+
+Pass { limit: '100kb' } (or your budget).
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/CONFIG-CORS-001.md

@@ -0,0 +1,9 @@
+# CONFIG-CORS-001
+
+**cors({ origin:'*', credentials:true }).** CWE-942.
+
+## Remediation
+
+Use an explicit origin allow-list.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/CONFIG-DOCKER-ENV-001.md

@@ -0,0 +1,9 @@
+# CONFIG-DOCKER-ENV-001
+
+**ENV *_SECRET= or *_KEY= in the Dockerfile.** CWE-798.
+
+## Remediation
+
+Pass secrets at runtime, not build time.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/CONFIG-DOCKER-LATEST-001.md

@@ -0,0 +1,9 @@
+# CONFIG-DOCKER-LATEST-001
+
+**FROM image:latest.** CWE-1188.
+
+## Remediation
+
+Pin a digest or a specific tag.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/CONFIG-DOCKER-ROOT-001.md

@@ -0,0 +1,9 @@
+# CONFIG-DOCKER-ROOT-001
+
+**Dockerfile has no USER instruction.** CWE-250.
+
+## Remediation
+
+Add USER node (or another non-root user).
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/CONFIG-ERRSTACK-001.md

@@ -0,0 +1,9 @@
+# CONFIG-ERRSTACK-001
+
+**err.stack sent in a response.** CWE-209.
+
+## Remediation
+
+Log server-side; send a generic body to the client.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/CONFIG-HELMET-001.md

@@ -0,0 +1,9 @@
+# CONFIG-HELMET-001
+
+**express() app never calls helmet().** CWE-693.
+
+## Remediation
+
+app.use(helmet()). Router-only files are not flagged.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/CONFIG-INSTALLSCRIPT-001.md

@@ -0,0 +1,9 @@
+# CONFIG-INSTALLSCRIPT-001
+
+**Lockfile hasInstallScript.** CWE-506.
+
+## Remediation
+
+Info only. Review the install script before trusting it.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/CONFIG-RATELIMIT-001.md

@@ -0,0 +1,9 @@
+# CONFIG-RATELIMIT-001
+
+**Login/signup route with no rate limiter.** CWE-307.
+
+## Remediation
+
+Apply express-rate-limit (or similar) to auth routes.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/DEPS-DEPRECATED-001.md

@@ -0,0 +1,9 @@
+# DEPS-DEPRECATED-001
+
+**Lockfile marks the package deprecated.** CWE-1104.
+
+## Remediation
+
+Replace with a maintained alternative. FullShield does not invent registry data.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/DEPS-NOLOCK-001.md

@@ -0,0 +1,9 @@
+# DEPS-NOLOCK-001
+
+**package.json is present but no lockfile.** Info.
+
+Transitive versions cannot be audited. Exact versions pinned in `package.json` (no `^`/`~` range) are still queried against OSV.
+
+## Remediation
+
+Commit `package-lock.json`, `pnpm-lock.yaml`, or `yarn.lock`.

package/rules/DEPS-TYPOSQUAT-001.md

@@ -0,0 +1,9 @@
+# DEPS-TYPOSQUAT-001
+
+**Direct dependency whose name is 1 edit from a popular package and is not itself in the static top-packages list.** CWE-1357.
+
+## Remediation
+
+Confirm the name is intentional. Transitive names, hyphen-only variants, and packages that appear in the larger top-packages list are not flagged.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/DEPS-VULN-001.md

@@ -0,0 +1,9 @@
+# DEPS-VULN-001
+
+**OSV-known vulnerable package.** CWE-1104.
+
+## Remediation
+
+Bump to the minimum non-vulnerable version from OSV. Same-major bumps are safe fixes.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/README.md

@@ -0,0 +1,60 @@
+# FullShield rules
+
+Each Core rule has a positive fixture in `test/fixtures/vulnerable-app` and a
+negative counterpart in `test/fixtures/clean-app`.
+
+## Secrets
+
+| ID | What |
+|---|---|
+| [SECRET-AWS-001](SECRET-AWS-001.md) | AWS access key id |
+| [SECRET-STRIPE-001](SECRET-STRIPE-001.md) | Stripe secret key |
+| [SECRET-GITHUB-001](SECRET-GITHUB-001.md) | GitHub token |
+| [SECRET-SLACK-001](SECRET-SLACK-001.md) | Slack token |
+| [SECRET-GOOGLE-001](SECRET-GOOGLE-001.md) | Google API key |
+| [SECRET-AIKEY-001](SECRET-AIKEY-001.md) | OpenAI/Anthropic-style key |
+| [SECRET-PRIVKEY-001](SECRET-PRIVKEY-001.md) | PEM private key |
+| [SECRET-DBURL-001](SECRET-DBURL-001.md) | DB URL with inline password |
+| [SECRET-JWT-001](SECRET-JWT-001.md) | Hardcoded JWT secret |
+| [SECRET-ENTROPY-001](SECRET-ENTROPY-001.md) | High-entropy assignment (low confidence) |
+| [SECRET-ENVFILE-001](SECRET-ENVFILE-001.md) | Committed `.env` file |
+
+## Dependencies
+
+| ID | What |
+|---|---|
+| [DEPS-VULN-001](DEPS-VULN-001.md) | OSV-known vulnerable package |
+| [DEPS-TYPOSQUAT-001](DEPS-TYPOSQUAT-001.md) | Direct dep 1 edit from a popular name |
+| [DEPS-DEPRECATED-001](DEPS-DEPRECATED-001.md) | Lockfile `deprecated` field |
+| [DEPS-NOLOCK-001](DEPS-NOLOCK-001.md) | package.json without a lockfile |
+
+## SAST
+
+| ID | What |
+|---|---|
+| [SAST-SQLI-001](SAST-SQLI-001.md) | Tainted SQL concatenation |
+| [SAST-NOSQLI-001](SAST-NOSQLI-001.md) | Raw `req.body`/`query` as Mongo filter |
+| [SAST-CMDI-001](SAST-CMDI-001.md) | Tainted shell `exec` |
+| [SAST-PATH-001](SAST-PATH-001.md) | Tainted path without resolve+prefix |
+| [SAST-EVAL-001](SAST-EVAL-001.md) | `eval` / `new Function` / `vm` / `*.eval` |
+| [SAST-SSRF-001](SAST-SSRF-001.md) | Tainted URL to HTTP client |
+| [SAST-REDIRECT-001](SAST-REDIRECT-001.md) | Tainted `res.redirect` |
+| [SAST-JWT-001](SAST-JWT-001.md) | `jwt.decode` / `algorithms: none` |
+| [SAST-CRYPTO-001](SAST-CRYPTO-001.md) | `Math.random` tokens / md5 passwords |
+| [SAST-PROTO-001](SAST-PROTO-001.md) | Unguarded recursive merge |
+| [SAST-XSS-001](SAST-XSS-001.md) | HTML `res.send` or `<%-` / `{{{` |
+| [SAST-AUTH-001](SAST-AUTH-001.md) | Data route with no auth middleware |
+
+## Config
+
+| ID | What |
+|---|---|
+| [CONFIG-HELMET-001](CONFIG-HELMET-001.md) | `express()` without `helmet()` |
+| [CONFIG-BODYLIMIT-001](CONFIG-BODYLIMIT-001.md) | `express.json()` without `limit` |
+| [CONFIG-CORS-001](CONFIG-CORS-001.md) | `origin:'*'` + `credentials:true` |
+| [CONFIG-RATELIMIT-001](CONFIG-RATELIMIT-001.md) | Auth route without a limiter |
+| [CONFIG-ERRSTACK-001](CONFIG-ERRSTACK-001.md) | `err.stack` sent to the client |
+| [CONFIG-DOCKER-LATEST-001](CONFIG-DOCKER-LATEST-001.md) | `FROM *:latest` |
+| [CONFIG-DOCKER-ROOT-001](CONFIG-DOCKER-ROOT-001.md) | Dockerfile with no `USER` |
+| [CONFIG-DOCKER-ENV-001](CONFIG-DOCKER-ENV-001.md) | `ENV *_SECRET=` / `*_KEY=` |
+| [CONFIG-INSTALLSCRIPT-001](CONFIG-INSTALLSCRIPT-001.md) | Lockfile `hasInstallScript` |

package/rules/SAST-AUTH-001.md

@@ -0,0 +1,9 @@
+# SAST-AUTH-001
+
+**Route handler that touches DB data with no auth-named middleware.** CWE-862.
+
+## Remediation
+
+Low confidence. Add requireAuth (or similar) to the chain.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/SAST-CMDI-001.md

@@ -0,0 +1,9 @@
+# SAST-CMDI-001
+
+**Tainted input reaching exec/execSync/spawn({shell:true}).** CWE-78.
+
+## Remediation
+
+Use execFile with an argument array and validate input.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/SAST-CRYPTO-001.md

@@ -0,0 +1,9 @@
+# SAST-CRYPTO-001
+
+**Math.random for tokens, or md5/sha1 near a password.** CWE-327.
+
+## Remediation
+
+Use crypto.randomUUID / randomBytes and a modern KDF.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/SAST-EVAL-001.md

@@ -0,0 +1,9 @@
+# SAST-EVAL-001
+
+**eval, new Function, vm.runInNewContext, or lib.eval of a non-literal.** CWE-95.
+
+## Remediation
+
+Do not evaluate user input. Use a parser or allow-list.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/SAST-JWT-001.md

@@ -0,0 +1,9 @@
+# SAST-JWT-001
+
+**jwt.decode used as auth, algorithms includes none, or verify without an allow-list.** CWE-347.
+
+## Remediation
+
+Call jwt.verify with algorithms: ['HS256'] (or your real list).
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.