fullshield 0.1.0 → 0.1.3

package/dist/runtime/register.js

@@ -452,9 +452,25 @@ function sinkTexts(sink) {
   if (typeof sink === "number" || typeof sink === "boolean") return [String(sink)];
   return [];
 }
+function whereJsChangesStructure(sink, ctx) {
+  let code = "";
+  if (typeof sink === "string") code = sink;
+  else if (sink !== null && typeof sink === "object" && !Array.isArray(sink) && "$where" in sink) {
+    const where = sink.$where;
+    if (typeof where === "string") code = where;
+  }
+  if (!code) return false;
+  for (const input of ctx.strings) {
+    if (input && sqlInputChangesStructure(code, input)) return true;
+  }
+  return false;
+}
 function detectStructureChange(kind, sink, ctx, base) {
   if (kind === "proto") return protoPolluted(ctx);
-  if (kind === "nosql") return nosqlUserOperators(sink, ctx);
+  if (kind === "nosql") {
+    if (nosqlUserOperators(sink, ctx)) return true;
+    return whereJsChangesStructure(sink, ctx);
+  }
   for (const text of sinkTexts(sink)) {
     for (const input of ctx.strings) {
       if (!input) continue;
@@ -756,11 +772,38 @@ function patchMethod(obj, key, wrapper) {
     record[key] = orig;
   });
 }
+function sqlTextFrom(sql) {
+  if (typeof sql === "string") return sql;
+  if (Array.isArray(sql)) {
+    return sql.filter((part) => typeof part === "string").join(" ");
+  }
+  if (sql !== null && typeof sql === "object") {
+    const rec = sql;
+    if (typeof rec.text === "string") return rec.text;
+    if (typeof rec.sql === "string") return rec.sql;
+    if (Array.isArray(rec.strings)) {
+      return rec.strings.filter((part) => typeof part === "string").join(" ");
+    }
+  }
+  return "";
+}
 function wrapSqlMethod(obj, key) {
   patchMethod(obj, key, (orig) => {
     return function(sql, ...rest) {
-      const text = typeof sql === "string" ? sql : sql && typeof sql === "object" && "text" in sql && typeof sql.text === "string" ? sql.text : "";
-      return applySink("sql", text, void 0, () => orig.call(this, sql, ...rest));
+      return applySink(
+        "sql",
+        sqlTextFrom(sql),
+        void 0,
+        () => orig.call(this, sql, ...rest)
+      );
+    };
+  });
+}
+function wrapNosqlWhere(obj, key) {
+  patchMethod(obj, key, (orig) => {
+    return function(expr, ...rest) {
+      const sink = typeof expr === "string" ? { $where: expr } : expr ?? {};
+      return applySink("nosql", sink, void 0, () => orig.call(this, expr, ...rest));
     };
   });
 }
@@ -1051,6 +1094,57 @@ function wrapKnownPackage(request, exported) {
     wrappedPackages.add(obj);
     return exported;
   }
+  if (name === "@prisma/client" || name === "prisma" || name.endsWith("/@prisma/client")) {
+    const client = exported.PrismaClient?.prototype;
+    if (client) {
+      wrapSqlMethod(client, "$queryRawUnsafe");
+      wrapSqlMethod(client, "$executeRawUnsafe");
+      wrapSqlMethod(client, "$queryRaw");
+      wrapSqlMethod(client, "$executeRaw");
+    }
+    const Prisma = exported.Prisma;
+    if (Prisma) wrapSqlMethod(Prisma, "raw");
+    wrappedPackages.add(obj);
+    return exported;
+  }
+  if (name === "sequelize" || name.endsWith("/sequelize")) {
+    const rec = exported;
+    const proto = rec.Sequelize?.prototype ?? rec.prototype;
+    if (proto) wrapSqlMethod(proto, "query");
+    if (typeof rec.literal === "function") wrapSqlMethod(rec, "literal");
+    if (rec.Sequelize && typeof rec.Sequelize.literal === "function") wrapSqlMethod(rec.Sequelize, "literal");
+    wrappedPackages.add(obj);
+    return exported;
+  }
+  if (name === "knex" || name.endsWith("/knex")) {
+    if (typeof exported.raw === "function") wrapSqlMethod(obj, "raw");
+    const client = exported.Client?.prototype;
+    if (client) {
+      wrapSqlMethod(client, "raw");
+      wrapSqlMethod(client, "whereRaw");
+      wrapSqlMethod(client, "orderByRaw");
+      wrapSqlMethod(client, "query");
+    }
+    wrappedPackages.add(obj);
+    return exported;
+  }
+  if (name === "typeorm" || name.endsWith("/typeorm")) {
+    const rec = exported;
+    for (const cls of ["DataSource", "EntityManager", "QueryRunner", "Connection"]) {
+      const proto = rec[cls]?.prototype;
+      if (proto) wrapSqlMethod(proto, "query");
+    }
+    const qb = rec.SelectQueryBuilder?.prototype ?? rec.QueryBuilder?.prototype;
+    if (qb) wrapSqlMethod(qb, "where");
+    wrappedPackages.add(obj);
+    return exported;
+  }
+  if (name === "drizzle-orm" || name.endsWith("/drizzle-orm")) {
+    const sql = exported.sql;
+    if (sql) wrapSqlMethod(sql, "raw");
+    wrappedPackages.add(obj);
+    return exported;
+  }
   if (name === "mongodb" || name.includes("mongodb")) {
     const col = exported.Collection?.prototype;
     if (col) {
@@ -1071,7 +1165,10 @@ function wrapKnownPackage(request, exported) {
           return applySink("nosql", query ?? {}, void 0, () => orig.call(this, query, ...rest));
         };
       });
+      wrapNosqlWhere(q, "$where");
     }
+    const model = exported.Model?.prototype;
+    if (model) wrapNosqlWhere(model, "$where");
     wrappedPackages.add(obj);
     return exported;
   }

package/dist/supply.js

@@ -8,6 +8,11 @@ function makeFindingId(ruleId, file, snippet) {
   return createHash("sha256").update(`${ruleId}\0${file ?? ""}\0${normalized}`).digest("hex").slice(0, 16);
 }
 
+// src/supply/experimental.ts
+function experimentalVex() {
+  return process.env.FULLSHIELD_EXPERIMENTAL_VEX === "1";
+}
+
 // src/supply/index.ts
 var REGISTRY_HOST = "registry.npmjs.org";
 var INSTALL_SCRIPT_KEYS = ["preinstall", "install", "postinstall"];
@@ -114,6 +119,10 @@ function analyzePackageDir(dir) {
       );
     }
   }
+  if (experimentalVex()) {
+    findings.push(...analyzeWormIndicators(dir));
+    findings.push(...analyzeWorkflowTampering(dir));
+  }
   return findings;
 }
 function diffPackageVersions(oldDir, newDir) {
@@ -224,5 +233,82 @@ async function installGuard(spec, opts = {}) {
   }
   return { findings };
 }
+var TOKEN_RE = /(?:~\/)?\.npmrc\b|\bNPM_TOKEN\b|\bGITHUB_TOKEN\b/;
+var PUBLISH_RE = /\bnpm\s+publish\b|\bnpmPublish\b|\blibnpmpublish\b/;
+var REGISTRY_PUT_RE = /registry\.npmjs\.org[\s\S]{0,800}\bPUT\b|\bmethod\s*:\s*['"]PUT['"][\s\S]{0,400}registry\.npmjs\.org/;
+var GITHUB_CREATE_RE = /api\.github\.com\/(?:user\/repos|repos\/)|\/actions\/workflows/;
+var WORKFLOW_PATH_RE = /\.github\/workflows/;
+var CI_WRITE_RE = /\.github\/|\.git\/hooks\/|\.gitlab-ci\.yml|\.travis\.yml|azure-pipelines(?:\.yml)?|Jenkinsfile|\.circleci\//;
+function packageSources(dir) {
+  const manifestPath = join(dir, "package.json");
+  let scripts = "";
+  if (existsSync(manifestPath) && statSync(manifestPath).isFile()) {
+    try {
+      const pkg = readJson(manifestPath);
+      const block = pkg.scripts ?? {};
+      scripts = Object.values(block).join("\n");
+    } catch {
+      scripts = "";
+    }
+  }
+  const sources = walkJs(dir).map((file) => ({
+    file: relative(dir, file) || file,
+    text: readFileSync(file, "utf8")
+  }));
+  return { sources, scripts };
+}
+function analyzeWormIndicators(dir) {
+  const { sources, scripts } = packageSources(dir);
+  if (sources.length === 0 && scripts.length === 0) return [];
+  const text = `${sources.map((s) => s.text).join("\n")}
+${scripts}`;
+  if (!TOKEN_RE.test(text)) return [];
+  const replicates = PUBLISH_RE.test(text) || REGISTRY_PUT_RE.test(text) || GITHUB_CREATE_RE.test(text) || WORKFLOW_PATH_RE.test(text);
+  if (!replicates) return [];
+  const hit = sources.find(
+    (s) => TOKEN_RE.test(s.text) && (PUBLISH_RE.test(s.text) || REGISTRY_PUT_RE.test(s.text) || GITHUB_CREATE_RE.test(s.text) || WORKFLOW_PATH_RE.test(s.text))
+  ) ?? sources.find((s) => TOKEN_RE.test(s.text));
+  return [
+    finding(
+      "SUPPLY-WORM-001",
+      "Self-replicating worm indicators in dependency code",
+      "static: npm/GitHub token read combined with publish, registry PUT, GitHub repo/workflow creation, or writing .github/workflows",
+      hit?.file,
+      "critical"
+    )
+  ];
+}
+function analyzeWorkflowTampering(dir) {
+  const { sources, scripts } = packageSources(dir);
+  const text = `${sources.map((s) => s.text).join("\n")}
+${scripts}`;
+  if (!CI_WRITE_RE.test(text)) return [];
+  const hit = sources.find((s) => CI_WRITE_RE.test(s.text));
+  return [
+    finding(
+      "SUPPLY-WORKFLOW-001",
+      "Dependency writes GitHub workflow, git hooks, or CI config",
+      "static: install script or package code writes .github/, .git/hooks/, or CI configuration",
+      hit?.file ?? (CI_WRITE_RE.test(scripts) ? "package.json" : void 0),
+      "critical"
+    )
+  ];
+}
+function provenanceCoverage(packages, known) {
+  let withProvenance = 0;
+  let unknown = 0;
+  for (const pkg of packages) {
+    const hit = known.get(`${pkg.name}@${pkg.version}`);
+    if (hit === true) withProvenance += 1;
+    else if (hit === void 0) unknown += 1;
+  }
+  const total = packages.length;
+  return {
+    total,
+    withProvenance,
+    unknown,
+    percent: total === 0 ? 0 : withProvenance / total * 100
+  };
+}
 
-export { analyzePackageDir, assertRegistryUrl, checkCooldown, checkDependencyConfusion, checkLockfileIntegrity, checkProvenance, diffPackageVersions, installGuard, packageNameFromSpec };
+export { analyzePackageDir, analyzeWorkflowTampering, analyzeWormIndicators, assertRegistryUrl, checkCooldown, checkDependencyConfusion, checkLockfileIntegrity, checkProvenance, diffPackageVersions, installGuard, packageNameFromSpec, provenanceCoverage };

package/dist/vex.js

@@ -0,0 +1,178 @@
+import { createHash } from 'crypto';
+
+// src/vex/index.ts
+
+// src/sbom/cyclonedx.ts
+function validateCycloneDx15(doc) {
+  const errors = [];
+  if (typeof doc !== "object" || doc === null || Array.isArray(doc)) {
+    return ["CycloneDX document must be an object"];
+  }
+  const root = doc;
+  if (root.bomFormat !== "CycloneDX") errors.push('bomFormat must be "CycloneDX"');
+  if (root.specVersion !== "1.5") errors.push('specVersion must be "1.5"');
+  if (!Array.isArray(root.components)) errors.push("components must be an array");
+  return errors;
+}
+
+// src/vex/index.ts
+var OPENVEX_CONTEXT = "https://openvex.dev/ns/v0.2.0";
+var OPENVEX_NOT_AFFECTED_JUSTIFICATION = "vulnerable_code_not_in_execute_path";
+var CDX_NOT_AFFECTED_JUSTIFICATION = "code_not_reachable";
+var OPENVEX_STATUSES = /* @__PURE__ */ new Set(["not_affected", "affected", "fixed", "under_investigation"]);
+function depFindings(findings) {
+  return findings.filter((f) => f.ruleId === "DEPS-VULN-001");
+}
+function vulnName(finding) {
+  return finding.references?.find((r) => r.startsWith("CVE-") || r.startsWith("GHSA-") || r.startsWith("MAL-")) ?? finding.id;
+}
+function npmPurl(snippet) {
+  const raw = snippet ?? "unknown@0.0.0";
+  let name;
+  let version;
+  if (raw.startsWith("@")) {
+    const second = raw.indexOf("@", 1);
+    name = second === -1 ? raw : raw.slice(0, second);
+    version = second === -1 ? "0.0.0" : raw.slice(second + 1);
+  } else {
+    const at = raw.indexOf("@");
+    name = at <= 0 ? raw : raw.slice(0, at);
+    version = at <= 0 ? "0.0.0" : raw.slice(at + 1);
+  }
+  return `pkg:npm/${encodeURIComponent(name)}@${version}`;
+}
+function notImported(finding) {
+  return finding.reachability === "not-imported";
+}
+function openVexStatement(finding) {
+  const base = {
+    vulnerability: { name: vulnName(finding) },
+    products: [{ "@id": npmPurl(finding.snippet) }]
+  };
+  if (notImported(finding)) {
+    return {
+      ...base,
+      status: "not_affected",
+      justification: OPENVEX_NOT_AFFECTED_JUSTIFICATION
+    };
+  }
+  return { ...base, status: "under_investigation" };
+}
+function buildOpenVex(findings) {
+  const statements = depFindings(findings).map(openVexStatement);
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+  const idSeed = JSON.stringify(statements);
+  const digest = createHash("sha256").update(idSeed).digest("hex").slice(0, 16);
+  return {
+    "@context": OPENVEX_CONTEXT,
+    "@id": `https://openvex.dev/docs/public/fullshield-${digest}`,
+    author: "FullShield",
+    timestamp,
+    version: 1,
+    statements
+  };
+}
+function validateOpenVex(doc) {
+  const errors = [];
+  if (typeof doc !== "object" || doc === null || Array.isArray(doc)) {
+    return ["OpenVEX document must be an object"];
+  }
+  const root = doc;
+  if (typeof root["@context"] !== "string" || !String(root["@context"]).includes("openvex")) {
+    errors.push("@context must be an OpenVEX context URI");
+  }
+  if (typeof root["@id"] !== "string" || root["@id"].length === 0) errors.push("@id is required");
+  if (typeof root.author !== "string" || root.author.length === 0) errors.push("author is required");
+  if (typeof root.timestamp !== "string" || root.timestamp.length === 0) errors.push("timestamp is required");
+  if (typeof root.version !== "number") errors.push("version must be a number");
+  if (!Array.isArray(root.statements)) {
+    errors.push("statements must be an array");
+    return errors;
+  }
+  for (const [i, raw] of root.statements.entries()) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+      errors.push(`statements[${i}] must be an object`);
+      continue;
+    }
+    const stmt = raw;
+    if (typeof stmt.vulnerability !== "object" || stmt.vulnerability === null) {
+      errors.push(`statements[${i}].vulnerability is required`);
+    }
+    if (!Array.isArray(stmt.products) || stmt.products.length === 0) {
+      errors.push(`statements[${i}].products must be a non-empty array`);
+    }
+    if (typeof stmt.status !== "string" || !OPENVEX_STATUSES.has(stmt.status)) {
+      errors.push(`statements[${i}].status is invalid`);
+      continue;
+    }
+    if (stmt.status === "not_affected") {
+      if (stmt.justification !== OPENVEX_NOT_AFFECTED_JUSTIFICATION) {
+        errors.push(
+          `statements[${i}]: not_affected requires justification ${OPENVEX_NOT_AFFECTED_JUSTIFICATION}`
+        );
+      }
+    }
+  }
+  return errors;
+}
+function cdxAnalysis(finding) {
+  if (notImported(finding)) {
+    return { state: "not_affected", justification: CDX_NOT_AFFECTED_JUSTIFICATION };
+  }
+  return { state: "in_triage" };
+}
+function buildCycloneDxVex(meta, findings) {
+  return {
+    $schema: "http://cyclonedx.org/schema/bom-1.5.schema.json",
+    bomFormat: "CycloneDX",
+    specVersion: "1.5",
+    version: 1,
+    metadata: {
+      component: { type: "application", name: meta.name, version: meta.version }
+    },
+    components: [],
+    vulnerabilities: depFindings(findings).map((f) => ({
+      id: vulnName(f),
+      description: f.message,
+      affects: [{ ref: npmPurl(f.snippet) }],
+      analysis: cdxAnalysis(f)
+    }))
+  };
+}
+function validateCycloneDxVex(doc) {
+  const errors = validateCycloneDx15(doc);
+  if (typeof doc !== "object" || doc === null || Array.isArray(doc)) return errors;
+  const root = doc;
+  if (!Array.isArray(root.vulnerabilities)) {
+    errors.push("vulnerabilities must be an array");
+    return errors;
+  }
+  for (const [i, raw] of root.vulnerabilities.entries()) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+      errors.push(`vulnerabilities[${i}] must be an object`);
+      continue;
+    }
+    const vuln = raw;
+    if (typeof vuln.analysis !== "object" || vuln.analysis === null || Array.isArray(vuln.analysis)) {
+      errors.push(`vulnerabilities[${i}].analysis is required`);
+      continue;
+    }
+    const analysis = vuln.analysis;
+    if (typeof analysis.state !== "string" || analysis.state.length === 0) {
+      errors.push(`vulnerabilities[${i}].analysis.state is required`);
+      continue;
+    }
+    if (analysis.state === "not_affected" && analysis.justification !== CDX_NOT_AFFECTED_JUSTIFICATION) {
+      errors.push(
+        `vulnerabilities[${i}]: not_affected requires justification ${CDX_NOT_AFFECTED_JUSTIFICATION}`
+      );
+    }
+  }
+  return errors;
+}
+function buildVex(findings, format, meta = { name: "app", version: "0.0.0" }) {
+  if (format === "cyclonedx") return buildCycloneDxVex(meta, findings);
+  return buildOpenVex(findings);
+}
+
+export { buildCycloneDxVex, buildOpenVex, buildVex, validateCycloneDxVex, validateOpenVex };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullshield",
-  "version": "0.1.0",
+  "version": "0.1.3",
   "description": "Full-cycle security scanner for Node.js/TypeScript backends: detect, classify, report, notify, fix, prevent.",
   "license": "MIT",
   "type": "module",
@@ -24,6 +24,8 @@
     "./runtime": "./dist/runtime/index.js",
     "./runtime/express": "./dist/runtime/express.js",
     "./runtime/fastify": "./dist/runtime/fastify.js",
+    "./runtime/koa": "./dist/runtime/koa.js",
+    "./runtime/hono": "./dist/runtime/hono.js",
     "./runtime/rasp": "./dist/runtime/rasp.js",
     "./runtime/register": "./dist/runtime/register.js",
     "./runtime/auto": "./dist/runtime/auto.js",
@@ -32,7 +34,11 @@
   },
   "peerDependencies": {
     "express": "*",
-    "fastify": "*"
+    "fastify": "*",
+    "koa": "*",
+    "hono": "*",
+    "@modelcontextprotocol/sdk": "^1.32.1",
+    "zod": "^4.6.7"
   },
   "peerDependenciesMeta": {
     "express": {
@@ -40,6 +46,18 @@
     },
     "fastify": {
       "optional": true
+    },
+    "koa": {
+      "optional": true
+    },
+    "hono": {
+      "optional": true
+    },
+    "@modelcontextprotocol/sdk": {
+      "optional": true
+    },
+    "zod": {
+      "optional": true
     }
   },
   "files": [
@@ -64,18 +82,18 @@
     "test:e2e": "vitest run test/e2e",
     "test:live-ai": "npm run build && node scripts/live-ai.mjs",
     "bench": "node scripts/bench.mjs",
+    "bench:public": "node scripts/bench-public.mjs",
     "verify": "node scripts/verify.mjs",
     "verify:phase": "node scripts/verify.mjs --phase"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.32.1",
     "@typescript-eslint/typescript-estree": "^8.71.2",
     "commander": "^12.1.0",
     "ignore": "^5.3.2",
-    "picocolors": "^1.1.1",
-    "zod": "^4.6.7"
+    "picocolors": "^1.1.1"
   },
   "devDependencies": {
+    "@modelcontextprotocol/sdk": "^1.32.1",
     "@eslint/js": "^9.14.0",
     "@types/node": "^22.9.0",
     "@vitest/coverage-v8": "^2.1.4",
@@ -85,6 +103,7 @@
     "tsup": "^8.3.5",
     "typescript": "^5.6.3",
     "typescript-eslint": "^8.13.0",
-    "vitest": "^2.1.4"
+    "vitest": "^2.1.4",
+    "zod": "^4.6.7"
   }
 }

package/rules/CONFIG-DIRLIST-001.md

@@ -0,0 +1,9 @@
+# CONFIG-DIRLIST-001
+
+**`serveIndex()` enables HTTP directory listing.** CWE-548.
+
+## Remediation
+
+Remove `serve-index`, or put the route behind authentication. Do not list ftp, logs, or key directories.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/CONFIG-TRUSTPROXY-001.md

@@ -0,0 +1,11 @@
+# CONFIG-TRUSTPROXY-001
+
+**`trust proxy` set to `true` while IP-based rate limiting is used (spoofable `X-Forwarded-For`).** CWE-290.
+
+Experimental (`FULLSHIELD_EXPERIMENTAL_CLASSES=1`).
+
+## Remediation
+
+Set `trust proxy` to a hop count or subnet, not `true`. Key rate limits on a verified identity, not the raw client IP.
+
+See `SECURITY_SCANNER_SPEC.md` §24 Phase 29.

package/rules/DLP-CARD-001.md

@@ -0,0 +1,9 @@
+# DLP-CARD-001
+
+**Outgoing response contains a Luhn-valid card number.** CWE-359. Experimental (`FULLSHIELD_EXPERIMENTAL_DLP=1`).
+
+## Remediation
+
+Never return full PANs. Store tokens; show only the last four digits if needed.
+
+See `SECURITY_SCANNER_SPEC.md` §24 Phase 32 and the fixtures under `test/fixtures/dlp/`.

package/rules/DLP-INTERNAL-001.md

@@ -0,0 +1,9 @@
+# DLP-INTERNAL-001
+
+**Outgoing response contains an internal IP or hostname.** CWE-200. Experimental (`FULLSHIELD_EXPERIMENTAL_DLP=1`).
+
+## Remediation
+
+Do not expose RFC1918 / loopback / `*.internal` addresses in client responses.
+
+See `SECURITY_SCANNER_SPEC.md` §24 Phase 32 and the fixtures under `test/fixtures/dlp/`.

package/rules/DLP-PII-001.md

@@ -0,0 +1,9 @@
+# DLP-PII-001
+
+**Outgoing response contains bulk emails on a route that normally returns one.** CWE-359. Experimental (`FULLSHIELD_EXPERIMENTAL_DLP=1`).
+
+## Remediation
+
+Scope list/export endpoints. Do not dump address books from a single-user route.
+
+See `SECURITY_SCANNER_SPEC.md` §24 Phase 32 and the fixtures under `test/fixtures/dlp/`.

package/rules/DLP-SECRET-001.md

@@ -0,0 +1,9 @@
+# DLP-SECRET-001
+
+**Outgoing response contains a secret pattern** (AWS, Stripe, GitHub, Slack, Google, AI, PEM, DB URL). CWE-200. Experimental (`FULLSHIELD_EXPERIMENTAL_DLP=1`).
+
+## Remediation
+
+Do not send credentials in API responses. Rotate anything that leaked. Prefer `shieldGuard({ dlp: { mode: 'monitor' } })` until the benign corpus is measured.
+
+See `SECURITY_SCANNER_SPEC.md` §24 Phase 32 and the fixtures under `test/fixtures/dlp/`.

package/rules/DLP-STACK-001.md

@@ -0,0 +1,9 @@
+# DLP-STACK-001
+
+**Outgoing response contains a stack trace.** CWE-209. Experimental (`FULLSHIELD_EXPERIMENTAL_DLP=1`).
+
+## Remediation
+
+Log stacks server-side. Return a generic error body to clients.
+
+See `SECURITY_SCANNER_SPEC.md` §24 Phase 32 and the fixtures under `test/fixtures/dlp/`.

package/rules/HOST-SSH-001.md

@@ -0,0 +1,13 @@
+# HOST-SSH-001
+
+**OpenSSH package version is in the CVE-2024-6387 (regreSSHion) range.** CWE-364.
+
+Uses the distro package version (`dpkg-query` / `rpm` / `apk`), not `ssh -V`. Distro OSV advisories win so backported fixes are not flagged. Upstream fallback: 8.5p1 ≤ v < 9.8p1, or v < 4.4p1.
+
+Severity is **critical** only when the version is vulnerable, `LoginGraceTime` is not 0, and sshd is listening on a non-loopback address.
+
+## Remediation
+
+Upgrade `openssh-server` via the distro package manager. Temporary mitigation: `LoginGraceTime 0` (enables a connection-exhaustion DoS). FullShield does not auto-patch or stop OS/SSH exploits.
+
+Experimental: `fullshield host --experimental-host`.

package/rules/HOST-SSH-002.md

@@ -0,0 +1,11 @@
+# HOST-SSH-002
+
+**Vulnerable OpenSSH without the `LoginGraceTime 0` mitigation.** CWE-693.
+
+Emitted only when HOST-SSH-001 applies and effective sshd config (`sshd -T`, or `/etc/ssh/sshd_config` plus `Include` files if `sshd -T` is not permitted) does not have `logingracetime 0`.
+
+## Remediation
+
+Set `LoginGraceTime 0` and reload sshd as a temporary mitigation. Note: this enables a connection-exhaustion DoS. Prefer upgrading `openssh-server`. FullShield does not change sshd configuration.
+
+Experimental: `fullshield host --experimental-host`.

package/rules/HOST-SSH-003.md

@@ -0,0 +1,11 @@
+# HOST-SSH-003
+
+**Possible SSH authentication-timeout exploitation attempts.** CWE-307.
+
+Counts `Timeout before authentication` lines per source IP in the last 24h from `journalctl -u ssh*` or `/var/log/auth.log` when those files are readable **without sudo**. Never a confirmed attack.
+
+## Remediation
+
+Use fail2ban or CrowdSec to block abusive sources. FullShield does not install firewall rules or block IPs.
+
+Experimental: `fullshield host --experimental-host`.

package/rules/MCP-001.md

@@ -0,0 +1,7 @@
+# MCP-001
+
+**Secret inlined in an MCP client config env block.** CWE-798. Experimental (`FULLSHIELD_EXPERIMENTAL_MCPCFG=1`). High.
+
+## Remediation
+
+Replace the value with an environment-variable reference (`${GITHUB_TOKEN}`) and rotate the exposed credential. Removing it from the file is not enough: it remains in git history.

package/rules/MCP-002.md

@@ -0,0 +1,7 @@
+# MCP-002
+
+**MCP server launched via unpinned `npx <pkg>` or `@latest`.** CWE-494. Experimental (`FULLSHIELD_EXPERIMENTAL_MCPCFG=1`). Medium.
+
+## Remediation
+
+Pin the package to an exact version (`@scope/pkg@1.2.3`). Do not use `@latest` or a bare package name.

package/rules/MCP-003.md

@@ -0,0 +1,7 @@
+# MCP-003
+
+**MCP server exposes shell/exec or unrestricted filesystem-write tools without an allowlist.** CWE-250. Experimental (`FULLSHIELD_EXPERIMENTAL_MCPCFG=1`). Medium.
+
+## Remediation
+
+Restrict filesystem roots to project directories. Do not register shell/exec/write tools unless an allowlist (and a confirm step) is enforced. See `guardTools`.

package/rules/MCP-004.md

@@ -0,0 +1,7 @@
+# MCP-004
+
+**MCP tool description contains instruction-injection text, hidden markup, or zero-width characters.** CWE-74. Experimental (`FULLSHIELD_EXPERIMENTAL_MCPCFG=1`). High.
+
+## Remediation
+
+Keep descriptions literal and user-facing. Strip zero-width / bidi-override characters and any text aimed at the model ("ignore previous", hidden HTML comments).

package/rules/MCP-005.md

@@ -0,0 +1,7 @@
+# MCP-005
+
+**Remote MCP server configured over plaintext `http://`.** CWE-319. Experimental (`FULLSHIELD_EXPERIMENTAL_MCPCFG=1`). Medium.
+
+## Remediation
+
+Use `https://` so tokens and tool traffic are not sent in the clear.