getdoorman 1.0.6 → 1.0.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "getdoorman",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "description": "Zero-config security scanner for AI-assisted development. 2000+ rules, 11 languages, 4 detection engines.",
   "main": "src/index.js",
   "exports": {

package/src/rules/bugs/ai-codegen.js

@@ -194,7 +194,7 @@ const rules = [
   {
     id: 'BUG-AI-006',
     category: 'bugs',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'User input used directly in database query',
     check({ files }) {

package/src/rules/bugs/crypto-bugs.js

@@ -161,7 +161,7 @@ const rules = [
   {
     id: 'BUG-CRYPTO-005',
     category: 'bugs',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'Hardcoded encryption key or IV',
     check({ files }) {

package/src/rules/bugs/go-bugs.js

@@ -94,7 +94,7 @@ const rules = [
   {
     id: 'BUG-GO-004',
     category: 'bugs',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'Race condition — shared variable in goroutine without sync',
     check({ files }) {

package/src/rules/compliance/healthcare.js

@@ -23,7 +23,7 @@ function hasHealthContext(files) {
 const rules = [
   // COMP-HIPAA-007: PHI in error messages/stack traces
   {
-    id: 'COMP-HIPAA-007', category: 'compliance', severity: 'critical', confidence: 'likely',
+    id: 'COMP-HIPAA-007', category: 'compliance', severity: 'high', confidence: 'likely',
     title: 'PHI Exposed in Error Messages',
     check({ files }) {
       const findings = [];
@@ -68,7 +68,7 @@ const rules = [
 
   // COMP-HIPAA-009: PHI shared with third-party SDKs
   {
-    id: 'COMP-HIPAA-009', category: 'compliance', severity: 'critical', confidence: 'likely',
+    id: 'COMP-HIPAA-009', category: 'compliance', severity: 'high', confidence: 'likely',
     title: 'PHI Shared with Third-Party Monitoring SDKs',
     check({ files }) {
       const findings = [];
@@ -131,7 +131,7 @@ const rules = [
 
   // COMP-HIPAA-012: Missing access controls on health endpoints
   {
-    id: 'COMP-HIPAA-012', category: 'compliance', severity: 'critical', confidence: 'likely',
+    id: 'COMP-HIPAA-012', category: 'compliance', severity: 'high', confidence: 'likely',
     title: 'Missing Access Controls on Health Endpoints',
     check({ files }) {
       const findings = [];
@@ -384,7 +384,7 @@ const rules = [
 
   // COMP-HIPAA-024: Telehealth without end-to-end encryption
   {
-    id: 'COMP-HIPAA-024', category: 'compliance', severity: 'critical', confidence: 'likely',
+    id: 'COMP-HIPAA-024', category: 'compliance', severity: 'high', confidence: 'likely',
     title: 'Telehealth Without End-to-End Encryption',
     check({ files }) {
       const findings = [];

package/src/rules/compliance/regional-eu.js

@@ -364,7 +364,7 @@ const rules = [
     },
   },
 
-  { id: 'COMP-EUAI-007', category: 'compliance', severity: 'critical', confidence: 'likely',
+  { id: 'COMP-EUAI-007', category: 'compliance', severity: 'high', confidence: 'likely',
     title: 'Emotion Recognition Without Safeguards',
     check({ files }) {
       const findings = [];

package/src/rules/compliance/regional-international.js

@@ -344,7 +344,7 @@ const rules = [
   {
     id: 'COMP-LGPD-006',
     category: 'compliance',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'LGPD: Children\'s Data Without Parental Consent',
     check({ files }) {
@@ -513,7 +513,7 @@ const rules = [
   {
     id: 'COMP-PIPEDA-006',
     category: 'compliance',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'PIPEDA: Sensitive Data Without Explicit Consent',
     check({ files }) {
@@ -720,7 +720,7 @@ const rules = [
   {
     id: 'COMP-DPDPA-003',
     category: 'compliance',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'DPDPA: Children\'s Data Without Verifiable Parental Consent',
     check({ files }) {
@@ -878,7 +878,7 @@ const rules = [
   {
     id: 'COMP-APPI-005',
     category: 'compliance',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'APPI: Sensitive Personal Info Without Explicit Consent',
     check({ files }) {

package/src/rules/infrastructure/index.js

@@ -702,7 +702,7 @@ const rules = [
   },
 
   // INFRA-TF-005: Public S3 bucket in Terraform
-  { id: 'INFRA-TF-005', category: 'infrastructure', severity: 'critical', confidence: 'likely', title: 'Terraform S3 Bucket Publicly Accessible',
+  { id: 'INFRA-TF-005', category: 'infrastructure', severity: 'high', confidence: 'likely', title: 'Terraform S3 Bucket Publicly Accessible',
     check({ files }) {
       const findings = [];
       for (const [fp, c] of files) {
@@ -1459,7 +1459,7 @@ const rules = [
     },
   },
   // INFRA-CLOUD-029: No S3 bucket public access block
-  { id: 'INFRA-CLOUD-029', category: 'infrastructure', severity: 'critical', confidence: 'likely', title: 'S3 Bucket Without Public Access Block',
+  { id: 'INFRA-CLOUD-029', category: 'infrastructure', severity: 'high', confidence: 'likely', title: 'S3 Bucket Without Public Access Block',
     check({ files }) {
       const findings = [];
       for (const [fp, c] of files) {
@@ -2193,7 +2193,7 @@ rules.push({
 
 // INFRA-TF-039: IAM role with wildcard permissions
 rules.push({
-  id: 'INFRA-TF-039', category: 'infrastructure', severity: 'critical', confidence: 'likely', title: 'IAM role with wildcard action (*) permissions',
+  id: 'INFRA-TF-039', category: 'infrastructure', severity: 'high', confidence: 'likely', title: 'IAM role with wildcard action (*) permissions',
   check({ files }) {
     const findings = [];
     for (const [fp, c] of files) {
@@ -2348,7 +2348,7 @@ rules.push({
 
 // INFRA-TF-044: S3 bucket with public access allowed
 rules.push({
-  id: 'INFRA-TF-044', category: 'infrastructure', severity: 'critical', confidence: 'likely', title: 'Terraform S3 bucket without block public access settings',
+  id: 'INFRA-TF-044', category: 'infrastructure', severity: 'high', confidence: 'likely', title: 'Terraform S3 bucket without block public access settings',
   check({ files }) {
     const findings = [];
     for (const [fp, c] of files) {
@@ -2666,7 +2666,7 @@ rules.push({
 
 // INFRA-064: Cloud storage bucket public access
 rules.push({
-  id: 'INFRA-064', category: 'infrastructure', severity: 'critical', confidence: 'likely', title: 'Cloud storage with public access enabled',
+  id: 'INFRA-064', category: 'infrastructure', severity: 'high', confidence: 'likely', title: 'Cloud storage with public access enabled',
   check({ files }) {
     const findings = [];
     for (const [fp, c] of files) {

package/src/rules/quality/index.js

@@ -381,7 +381,7 @@ const rules = [
   },
 
   // QUAL-SMELL-001: eval() usage
-  { id: 'QUAL-SMELL-001', category: 'quality', severity: 'critical', confidence: 'likely', title: 'eval() Usage',
+  { id: 'QUAL-SMELL-001', category: 'quality', severity: 'high', confidence: 'likely', title: 'eval() Usage',
     check({ files }) {
       const findings = [];
       for (const [fp, c] of files) {
@@ -399,7 +399,7 @@ const rules = [
   },
 
   // QUAL-SMELL-002: new Function() with dynamic string
-  { id: 'QUAL-SMELL-002', category: 'quality', severity: 'critical', confidence: 'likely', title: 'new Function() — Behaves Like eval()',
+  { id: 'QUAL-SMELL-002', category: 'quality', severity: 'high', confidence: 'likely', title: 'new Function() — Behaves Like eval()',
     check({ files }) {
       const findings = [];
       for (const [fp, c] of files) {
@@ -1184,7 +1184,7 @@ const rules = [
   },
 
   // QUAL-SEC-002: Insecure random for tokens
-  { id: 'QUAL-SEC-002', category: 'quality', severity: 'critical', confidence: 'likely', title: 'Math.random() Used for Security Tokens',
+  { id: 'QUAL-SEC-002', category: 'quality', severity: 'high', confidence: 'likely', title: 'Math.random() Used for Security Tokens',
     check({ files }) {
       const findings = [];
       for (const [fp, c] of files) {
@@ -1361,7 +1361,7 @@ const rules = [
   },
 
   // QUAL-SEC-005: Hardcoded JWT secret
-  { id: 'QUAL-SEC-005', category: 'quality', severity: 'critical', confidence: 'likely', title: 'Hardcoded JWT Secret',
+  { id: 'QUAL-SEC-005', category: 'quality', severity: 'high', confidence: 'likely', title: 'Hardcoded JWT Secret',
     check({ files }) {
       const findings = [];
       for (const [fp, c] of files) {
@@ -1520,7 +1520,7 @@ const rules = [
     },
   },
   // QUAL-SEC-007: Command injection via exec
-  { id: 'QUAL-SEC-007', category: 'quality', severity: 'critical', confidence: 'likely', title: 'Command Injection via exec/spawn',
+  { id: 'QUAL-SEC-007', category: 'quality', severity: 'high', confidence: 'likely', title: 'Command Injection via exec/spawn',
     check({ files }) {
       const findings = [];
       for (const [fp, c] of files) {
@@ -1824,7 +1824,7 @@ const rules = [
     },
   },
   // QUAL-SEC-010: Using eval() with user-controlled input
-  { id: 'QUAL-SEC-010', category: 'quality', severity: 'critical', confidence: 'likely', title: 'eval() Used with Potentially User-Controlled Data',
+  { id: 'QUAL-SEC-010', category: 'quality', severity: 'high', confidence: 'likely', title: 'eval() Used with Potentially User-Controlled Data',
     check({ files }) {
       const findings = [];
       for (const [fp, c] of files) {
@@ -1937,7 +1937,7 @@ const rules = [
     },
   },
   // QUAL-SEC-011: Insecure deserialization
-  { id: 'QUAL-SEC-011', category: 'quality', severity: 'critical', confidence: 'likely', title: 'Insecure Deserialization with node-serialize',
+  { id: 'QUAL-SEC-011', category: 'quality', severity: 'high', confidence: 'likely', title: 'Insecure Deserialization with node-serialize',
     check({ files, stack }) {
       const findings = [];
       const allDeps = { ...stack.dependencies, ...stack.devDependencies };
@@ -1953,7 +1953,7 @@ const rules = [
     },
   },
   // QUAL-ARCH-014: No input sanitization before DB queries
-  { id: 'QUAL-ARCH-014', category: 'quality', severity: 'critical', confidence: 'likely', title: 'String Template Used in Database Query',
+  { id: 'QUAL-ARCH-014', category: 'quality', severity: 'high', confidence: 'likely', title: 'String Template Used in Database Query',
     check({ files }) {
       const findings = [];
       for (const [fp, c] of files) {

package/src/rules/scope-rules.js

@@ -577,7 +577,7 @@ const rules = [
   {
     id: 'SCOPE-SEC-001',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'eval/exec Outside Sandboxed Context',
     description: 'eval() or exec() used outside of a sandboxing function (vm.runInNewContext, sandbox, etc.).',

package/src/rules/security/ai-api.js

@@ -116,7 +116,7 @@ const rules = [
   {
     id: 'SEC-AI-004',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'Hardcoded AI provider API key',
     description: 'AI provider API key (Cohere, Mistral, Replicate, HuggingFace, etc.) is hardcoded in source code.',
@@ -137,7 +137,7 @@ const rules = [
   {
     id: 'SEC-AI-005',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'AI API key exposed in client-side code',
     description: 'AI API key is used in frontend/client code, exposing it to end users via browser DevTools or source maps.',
@@ -191,7 +191,7 @@ const rules = [
   {
     id: 'SEC-AI-007',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'Prompt injection vulnerability',
     description: 'User input is directly concatenated or interpolated into AI prompts without sanitization, enabling prompt injection.',
@@ -213,7 +213,7 @@ const rules = [
   {
     id: 'SEC-AI-008',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'User input injected into system prompt',
     description: 'User-controlled data is included in the system prompt, allowing privilege escalation via prompt injection.',
@@ -465,7 +465,7 @@ const rules = [
   {
     id: 'SEC-AI-018',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'Unsafe AI function/tool calling execution',
     description: 'AI function call results are executed without validation, allowing the AI to trigger arbitrary functions.',
@@ -762,7 +762,7 @@ const rules = [
   {
     id: 'SEC-AI-031',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'AI output used in code execution',
     description: 'AI API response is passed to eval(), exec(), or code execution functions, enabling arbitrary code execution.',
@@ -783,7 +783,7 @@ const rules = [
   {
     id: 'SEC-AI-032',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'AI output used in SQL query construction',
     description: 'AI API response is interpolated into SQL queries, enabling SQL injection via AI-generated content.',
@@ -805,7 +805,7 @@ const rules = [
   {
     id: 'SEC-AI-033',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'AI API key embedded in mobile application',
     description: 'AI API key found in mobile app code (React Native, Flutter, Swift, Kotlin) where it can be extracted.',

package/src/rules/security/auth.js

@@ -75,7 +75,7 @@ const rules = [
   {
     id: 'SEC-AUTH-001',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'Plaintext password storage detected',
     check({ files }) {
@@ -615,7 +615,7 @@ const rules = [
   {
     id: 'SEC-AUTH-014',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'OAuth open redirect via unvalidated redirect_uri',
     check({ files }) {
@@ -1012,7 +1012,7 @@ rules.push({
 
 // SEC-AUTH-026: Session fixation
 rules.push({
-  id: 'SEC-AUTH-026', category: 'security', severity: 'critical', confidence: 'likely',
+  id: 'SEC-AUTH-026', category: 'security', severity: 'high', confidence: 'likely',
   title: 'Session fixation: session not regenerated after login',
   check({ files }) {
     const findings = [];
@@ -1171,7 +1171,7 @@ rules.push({
 
 // SEC-AUTH-034: JWT decoded without verification
 rules.push({
-  id: 'SEC-AUTH-034', category: 'security', severity: 'critical', confidence: 'likely',
+  id: 'SEC-AUTH-034', category: 'security', severity: 'high', confidence: 'likely',
   title: 'JWT decoded without signature verification',
   check({ files }) {
     const findings = [];
@@ -1233,7 +1233,7 @@ rules.push({
 
 // SEC-AUTH-037: Authentication bypass via type coercion
 rules.push({
-  id: 'SEC-AUTH-037', category: 'security', severity: 'critical', confidence: 'likely',
+  id: 'SEC-AUTH-037', category: 'security', severity: 'high', confidence: 'likely',
   title: 'Password comparison with == — type coercion bypass',
   check({ files }) {
     const findings = [];

package/src/rules/security/csharp.js

@@ -50,7 +50,7 @@ const rules = [
   {
     id: 'SEC-CS-001',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'SQL Injection via String Concatenation in SqlCommand',
     description: 'Building SQL queries with string concatenation in SqlCommand allows SQL injection.',
@@ -67,7 +67,7 @@ const rules = [
   {
     id: 'SEC-CS-002',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'SQL Injection via String Interpolation',
     description: 'Using string interpolation ($"...") in SQL commands allows injection.',
@@ -84,7 +84,7 @@ const rules = [
   {
     id: 'SEC-CS-003',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'SQL Injection via String.Format',
     description: 'Using String.Format to build SQL queries enables injection attacks.',
@@ -181,7 +181,7 @@ const rules = [
   {
     id: 'SEC-CS-009',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'Command Injection via Process.Start',
     description: 'Passing user-controlled data to Process.Start enables arbitrary command execution.',
@@ -197,7 +197,7 @@ const rules = [
   {
     id: 'SEC-CS-010',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'Command Injection via ProcessStartInfo',
     description: 'Setting ProcessStartInfo.Arguments with user input enables command injection.',
@@ -245,7 +245,7 @@ const rules = [
   {
     id: 'SEC-CS-013',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'LDAP Injection',
     description: 'Building LDAP filters with string concatenation allows injection attacks.',
@@ -262,7 +262,7 @@ const rules = [
   {
     id: 'SEC-CS-014',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'LDAP Injection via String Interpolation',
     description: 'Using string interpolation in LDAP filters enables injection.',
@@ -278,7 +278,7 @@ const rules = [
   {
     id: 'SEC-CS-015',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'XXE: XmlDocument Without Safe Settings',
     description: 'XmlDocument processes external entities by default, enabling XXE attacks.',
@@ -294,7 +294,7 @@ const rules = [
   {
     id: 'SEC-CS-016',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'XXE: XmlTextReader Without Safe Settings',
     description: 'XmlTextReader processes DTDs and external entities by default.',
@@ -490,7 +490,7 @@ const rules = [
   {
     id: 'SEC-CS-028',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'Hardcoded Connection String',
     description: 'Database connection strings with credentials hardcoded in source code.',
@@ -506,7 +506,7 @@ const rules = [
   {
     id: 'SEC-CS-029',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'Hardcoded Credentials',
     description: 'Passwords or API keys hardcoded in source code risk exposure.',
@@ -651,7 +651,7 @@ const rules = [
   {
     id: 'SEC-CS-038',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'Dynamic Assembly Loading with User Input',
     description: 'Loading assemblies from user-controlled paths enables arbitrary code execution.',
@@ -667,7 +667,7 @@ const rules = [
   {
     id: 'SEC-CS-039',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'Dynamic Type Instantiation with User Input',
     description: 'Activator.CreateInstance with user-controlled type names can instantiate malicious types.',
@@ -764,7 +764,7 @@ const rules = [
   {
     id: 'SEC-CS-045',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'Hardcoded Encryption Key',
     description: 'Encryption keys hardcoded in source code can be extracted from assemblies.',
@@ -845,7 +845,7 @@ const rules = [
   {
     id: 'SEC-CS-050',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'SQL Injection via Entity Framework Raw SQL',
     description: 'Using FromSqlRaw or ExecuteSqlRaw with string interpolation bypasses EF parameterization.',

package/src/rules/security/dart.js

@@ -55,7 +55,7 @@ const rules = [
   {
     id: 'SEC-DART-002',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'Hardcoded API Key or Secret',
     description: 'API keys or secrets hardcoded in Dart code can be extracted from the compiled app.',
@@ -175,7 +175,7 @@ const rules = [
   {
     id: 'SEC-DART-008',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'SQL Injection in sqflite',
     description: 'String interpolation in rawQuery/rawInsert/rawUpdate/rawDelete enables SQL injection.',
@@ -375,7 +375,7 @@ const rules = [
   {
     id: 'SEC-DART-018',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'Disabled Certificate Verification in HttpClient',
     description: 'Setting SecurityContext with allowLegacyUnsafeRenegotiation disables TLS protections.',
@@ -395,7 +395,7 @@ const rules = [
   {
     id: 'SEC-DART-019',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'Dynamic Code Execution',
     description: 'Using dart:mirrors or evaluateJavascript with user input can lead to code injection.',
@@ -455,7 +455,7 @@ const rules = [
   {
     id: 'SEC-DART-022',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'Hardcoded OAuth Client Secret',
     description: 'OAuth client secrets embedded in mobile apps can be extracted and used to impersonate the app.',
@@ -575,7 +575,7 @@ const rules = [
   {
     id: 'SEC-DART-028',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'Process Execution with User Input',
     description: 'Process.run or Process.start with unsanitized input can lead to command injection.',

package/src/rules/security/deserialization.js

@@ -204,7 +204,7 @@ const rules = [
   {
     id: 'SEC-DES-008',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'XML Parser Without XXE Protection',
     description:

package/src/rules/security/go.js

@@ -50,7 +50,7 @@ const rules = [
   {
     id: 'SEC-GO-001',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'SQL Injection via fmt.Sprintf in Query',
     description: 'Using fmt.Sprintf to build SQL queries passed to db.Query or db.Exec allows SQL injection.',
@@ -66,7 +66,7 @@ const rules = [
   {
     id: 'SEC-GO-002',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'SQL Injection via String Concatenation',
     description: 'Concatenating strings to build SQL queries allows injection attacks.',
@@ -82,7 +82,7 @@ const rules = [
   {
     id: 'SEC-GO-003',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'Command Injection via exec.Command',
     description: 'Passing user-controlled input to exec.Command can lead to arbitrary command execution.',
@@ -98,7 +98,7 @@ const rules = [
   {
     id: 'SEC-GO-004',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'Command Injection via Shell Execution',
     description: 'Using exec.Command with bash/sh -c and string interpolation enables command injection.',
@@ -290,7 +290,7 @@ const rules = [
   {
     id: 'SEC-GO-016',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'Hardcoded Password',
     description: 'Passwords hardcoded in source code can be extracted and used to compromise systems.',
@@ -306,7 +306,7 @@ const rules = [
   {
     id: 'SEC-GO-017',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'Hardcoded API Key',
     description: 'API keys hardcoded in source code can be extracted from binaries or repositories.',
@@ -466,7 +466,7 @@ const rules = [
   {
     id: 'SEC-GO-027',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'JWT Parsing Without Proper Validation',
     description: 'Using jwt.Parse without specifying valid signing methods allows algorithm substitution attacks.',
@@ -738,7 +738,7 @@ const rules = [
   {
     id: 'SEC-GO-044',
     category: 'security',
-    severity: 'critical',
+    severity: 'high',
     confidence: 'likely',
     title: 'SQL Injection in GORM Raw Query',
     description: 'Using db.Raw with fmt.Sprintf allows SQL injection through GORM.',