git-cli-scanner 1.4.0 → 1.5.1

package/dist/cli.js

@@ -229,6 +229,20 @@ var init_cloudProviders = __esm({
         pattern: /AIza[0-9A-Za-z\-_]{35}/,
         risk: "Attackers can bypass quotas to abuse GCP services like Maps API or Vertex AI, causing high billing charges.",
         solution: "Restrict the key in Google Cloud Console (APIs & Services > Credentials) to specific IP addresses/apps, or revoke it and use GCP Service Accounts."
+      },
+      {
+        id: "firebase-secret",
+        description: "Firebase API Key or Secret",
+        pattern: /firebase[_-]?(?:api[_-]?key|secret)[\s:=]+["']?[a-zA-Z0-9\-_]{30,}["']?/i,
+        risk: "Attackers can bypass security rules, read/write to your Firebase database, or exhaust quotas.",
+        solution: "Revoke the key in the Firebase console and restrict new keys to specific domains or IP addresses."
+      },
+      {
+        id: "firebase-service-account",
+        description: "Firebase Service Account JSON (Heuristic)",
+        pattern: /"type"\s*:\s*"service_account"|-----BEGIN PRIVATE KEY-----/i,
+        risk: "Service accounts grant full administrative access to your Firebase project, including databases, auth, and storage.",
+        solution: "Delete the service account key in Google Cloud IAM and never commit service account JSON files. Use environment variables."
       }
     ];
     cloudProviderScanner = {
@@ -397,7 +411,7 @@ var init_envFiles = __esm({
       scan(diff) {
         const issues = [];
         const filename = diff.file.split("/").pop() || "";
-        const bannedExtensions = [".pem", ".key", ".sqlite", ".db", ".log", ".p12", ".pfx"];
+        const bannedExtensions = [".pem", ".key", ".sqlite", ".db", ".log", ".p12", ".pfx", ".crt", ".cer", ".keystore"];
         const isEnvFile = /(^|\/)\.env(\..+)?$/.test(diff.file);
         const isNodeModules = diff.file.startsWith("node_modules/");
         if (isEnvFile || isNodeModules || bannedExtensions.some((ext) => diff.file.endsWith(ext))) {
@@ -458,6 +472,20 @@ var init_infrastructure = __esm({
         pattern: /(?:postgres|mysql|mongodb(?:\+srv)?|redis):\/\/[^:\/\s]+:[^@\/\s]+@[^:\/\s]+(?::\d+)?\//,
         risk: "An attacker can directly connect to your database instance, allowing them to steal, modify, or delete all of your user data.",
         solution: "Remove the hardcoded database URL and read it from an environment variable (e.g., process.env.DATABASE_URL) at runtime."
+      },
+      {
+        id: "smtp-credentials",
+        description: "SMTP Email Credentials",
+        pattern: /(?:smtp|mail|sendgrid|mailgun)[\w\-]*(?:password|secret|key)[\s:=]+["']?[^"'\s]+["']?/i,
+        risk: "Attackers can use your SMTP server to send spam or phishing emails, ruining your domain reputation and incurring massive costs.",
+        solution: "Change the SMTP password via your email provider and inject it securely using a secrets manager."
+      },
+      {
+        id: "terraform-helm-secret",
+        description: "Terraform / Helm Variable Secret",
+        pattern: /(?:tf_var|helm_var)_[a-zA-Z0-9_]+[\s:=]+["']?[^"'\s]+["']?/i,
+        risk: "Hardcoded infrastructure secrets can grant access to the underlying platform resources and services.",
+        solution: "Use a proper secrets management backend for Terraform (e.g. Vault) or pass secrets via CI/CD runners."
       }
     ];
     infrastructureScanner = {
@@ -491,6 +519,242 @@ var init_infrastructure = __esm({
   }
 });
 
+// src/scans/authentication.ts
+var rules6, authenticationScanner;
+var init_authentication = __esm({
+  "src/scans/authentication.ts"() {
+    "use strict";
+    rules6 = [
+      {
+        id: "jwt-secret",
+        description: "JWT Secret Key",
+        pattern: /(?:jwt[_-]?(?:secret|key)|secret[_-]?key)[\s:=]+["']?[a-zA-Z0-9\-_!@#$%^&*()=+]{16,}["']?/i,
+        risk: "An attacker can forge JWT tokens to impersonate any user, including admins, bypassing all authentication.",
+        solution: "Rotate the secret, ensure all existing JWT sessions are invalidated, and inject it via environment variables."
+      },
+      {
+        id: "oauth-client-secret",
+        description: "OAuth Client Secret",
+        pattern: /(?:oauth|client)[_-]?(?:secret|key)[\s:=]+["']?[a-zA-Z0-9\-_]{16,}["']?/i,
+        risk: "Attackers can hijack the OAuth flow, authenticate on behalf of your users, or exhaust API quotas.",
+        solution: "Revoke the OAuth client secret in the identity provider console and generate a new one."
+      },
+      {
+        id: "session-secret",
+        description: "Session Cookie Secret",
+        pattern: /(?:session)[_-]?(?:secret|key)[\s:=]+["']?[a-zA-Z0-9\-_!@#$%^&*()=+]{16,}["']?/i,
+        risk: "Attackers can forge signed session cookies, allowing them to hijack active user sessions.",
+        solution: "Change the session secret to immediately invalidate all current user sessions."
+      }
+    ];
+    authenticationScanner = {
+      id: "authentication",
+      scan(diff) {
+        const issues = [];
+        const lines = diff.content.split("\n");
+        let lineNumber = 1;
+        for (const line of lines) {
+          if (line.startsWith("+")) {
+            const cleanLine = line.substring(1);
+            for (const rule of rules6) {
+              if (rule.pattern.test(cleanLine)) {
+                issues.push({
+                  type: rule.id,
+                  file: diff.file,
+                  line: lineNumber,
+                  match: cleanLine.trim().substring(0, 50) + "...",
+                  severity: "high",
+                  solution: rule.solution,
+                  risk: rule.risk
+                });
+              }
+            }
+          }
+          lineNumber++;
+        }
+        return issues;
+      }
+    };
+  }
+});
+
+// src/scans/packageRegistries.ts
+var rules7, packageRegistryScanner;
+var init_packageRegistries = __esm({
+  "src/scans/packageRegistries.ts"() {
+    "use strict";
+    rules7 = [
+      {
+        id: "npm-token",
+        description: "NPM Access Token",
+        pattern: /(?:npm|NPM)[_-]?(?:token|TOKEN)[\s:=]+["']?(?:npm_[a-zA-Z0-9]{36})["']?/i,
+        risk: "Attackers can publish malicious versions of your packages (Supply Chain Attack) to compromise all users downloading your code.",
+        solution: "Revoke the token immediately on npmjs.com and check your package versions for unauthorized releases."
+      },
+      {
+        id: "pypi-token",
+        description: "PyPI Access Token",
+        pattern: /pypi-[a-zA-Z0-9_-]{50,}/,
+        risk: "Attackers can upload malicious packages to PyPI under your name, distributing malware to your downstream users.",
+        solution: "Revoke the token in your PyPI account settings immediately and inspect recent package uploads."
+      },
+      {
+        id: "maven-gradle-password",
+        description: "Maven/Gradle Repository Password",
+        pattern: /(?:maven|gradle|nexus|artifactory)[\w\-]*password[\s:=]+["']?[a-zA-Z0-9\-_!@#$%^&*()=+]{8,}["']?/i,
+        risk: "Attackers can access your private artifact repository, steal proprietary code, or inject backdoors into your Java packages.",
+        solution: "Change your repository password and remove it from the hardcoded configuration file (e.g. settings.xml)."
+      }
+    ];
+    packageRegistryScanner = {
+      id: "package-registries",
+      scan(diff) {
+        const issues = [];
+        const lines = diff.content.split("\n");
+        let lineNumber = 1;
+        for (const line of lines) {
+          if (line.startsWith("+")) {
+            const cleanLine = line.substring(1);
+            for (const rule of rules7) {
+              if (rule.pattern.test(cleanLine)) {
+                issues.push({
+                  type: rule.id,
+                  file: diff.file,
+                  line: lineNumber,
+                  match: cleanLine.trim().substring(0, 50) + "...",
+                  severity: "high",
+                  solution: rule.solution,
+                  risk: rule.risk
+                });
+              }
+            }
+          }
+          lineNumber++;
+        }
+        return issues;
+      }
+    };
+  }
+});
+
+// src/scans/cicd.ts
+var rules8, cicdScanner;
+var init_cicd = __esm({
+  "src/scans/cicd.ts"() {
+    "use strict";
+    rules8 = [
+      {
+        id: "gitlab-ci-token",
+        description: "GitLab Personal Access Token",
+        pattern: /glpat-[a-zA-Z0-9\-]{20,}/,
+        risk: "Attackers can access your GitLab repositories, modify CI/CD pipelines, and steal sensitive code or deployment secrets.",
+        solution: "Revoke the token in your GitLab account (User Settings > Access Tokens) and use environment variables for CI authentication."
+      },
+      {
+        id: "github-actions-token",
+        description: "GitHub Actions Token / Fine-grained PAT",
+        pattern: /gh[p|a|s|r]_[a-zA-Z0-9]{36}/,
+        risk: "Compromised GitHub tokens can allow attackers to push code, trigger malicious Actions workflows, or steal repository secrets.",
+        solution: "Revoke the token immediately in GitHub (Settings > Developer Settings) and switch to short-lived GitHub App tokens if possible."
+      },
+      {
+        id: "jenkins-token",
+        description: "Jenkins Token or API Secret",
+        pattern: /(?:jenkins)[\w\-]*(?:token|secret|password)[\s:=]+["']?[a-zA-Z0-9]{20,}["']?/i,
+        risk: "Attackers can trigger or modify your Jenkins build pipelines, leading to malicious deployments or lateral movement.",
+        solution: "Revoke the API token in the Jenkins User Configuration page and inject secrets using the Jenkins Credentials Manager."
+      }
+    ];
+    cicdScanner = {
+      id: "cicd-secrets",
+      scan(diff) {
+        const issues = [];
+        const lines = diff.content.split("\n");
+        let lineNumber = 1;
+        for (const line of lines) {
+          if (line.startsWith("+")) {
+            const cleanLine = line.substring(1);
+            for (const rule of rules8) {
+              if (rule.pattern.test(cleanLine)) {
+                issues.push({
+                  type: rule.id,
+                  file: diff.file,
+                  line: lineNumber,
+                  match: cleanLine.trim().substring(0, 50) + "...",
+                  severity: "critical",
+                  solution: rule.solution,
+                  risk: rule.risk
+                });
+              }
+            }
+          }
+          lineNumber++;
+        }
+        return issues;
+      }
+    };
+  }
+});
+
+// src/scans/webhooks.ts
+var rules9, webhooksScanner;
+var init_webhooks = __esm({
+  "src/scans/webhooks.ts"() {
+    "use strict";
+    rules9 = [
+      {
+        id: "stripe-secret",
+        description: "Stripe Secret Key / Webhook Secret",
+        pattern: /(?:sk_live|rk_live|whsec)_[a-zA-Z0-9]{24,}/,
+        risk: "Attackers can process fraudulent transactions, issue refunds, or steal customer financial data from your Stripe account.",
+        solution: "Roll the secret key immediately in the Stripe Dashboard (Developers > API keys) and monitor recent charges."
+      },
+      {
+        id: "paypal-secret",
+        description: "PayPal Client Secret",
+        pattern: /paypal[_-]?(?:client[_-]?secret|secret)[\s:=]+["']?[a-zA-Z0-9\-_]{30,}["']?/i,
+        risk: "Attackers can process fraudulent payments, manipulate subscriptions, or steal transaction history.",
+        solution: "Revoke the secret in the PayPal Developer Dashboard and generate a new one."
+      },
+      {
+        id: "generic-webhook",
+        description: "Generic Webhook URL (Slack, Discord, etc)",
+        pattern: /(?:https?:\/\/)?(?:hooks\.slack\.com|discord\.com\/api\/webhooks|maker\.ifttt\.com)[^\s'"]+/i,
+        risk: "Attackers can spam your internal channels, launch phishing attacks on your team, or exhaust rate limits.",
+        solution: "Delete the webhook in the respective service platform and re-generate a new URL. Do not commit webhook URLs directly."
+      }
+    ];
+    webhooksScanner = {
+      id: "webhooks",
+      scan(diff) {
+        const issues = [];
+        const lines = diff.content.split("\n");
+        let lineNumber = 1;
+        for (const line of lines) {
+          if (line.startsWith("+")) {
+            const cleanLine = line.substring(1);
+            for (const rule of rules9) {
+              if (rule.pattern.test(cleanLine)) {
+                issues.push({
+                  type: rule.id,
+                  file: diff.file,
+                  line: lineNumber,
+                  match: cleanLine.trim().substring(0, 50) + "...",
+                  severity: "high",
+                  solution: rule.solution,
+                  risk: rule.risk
+                });
+              }
+            }
+          }
+          lineNumber++;
+        }
+        return issues;
+      }
+    };
+  }
+});
+
 // src/scans/index.ts
 var allScanners;
 var init_scans = __esm({
@@ -502,13 +766,21 @@ var init_scans = __esm({
     init_privateKeys();
     init_envFiles();
     init_infrastructure();
+    init_authentication();
+    init_packageRegistries();
+    init_cicd();
+    init_webhooks();
     allScanners = [
       apiKeyScanner,
       cloudProviderScanner,
       collaborationScanner,
       privateKeyScanner,
       envFileScanner,
-      infrastructureScanner
+      infrastructureScanner,
+      authenticationScanner,
+      packageRegistryScanner,
+      cicdScanner,
+      webhooksScanner
     ];
   }
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-cli-scanner",
-  "version": "1.4.0",
+  "version": "1.5.1",
   "description": "A powerful interactive CLI tool that scans your codebase for hardcoded secrets, API keys, passwords, and private keys before they reach your Git history.",
   "main": "dist/cli.js",
   "scripts": {

package/readme.md

@@ -1,20 +1,6 @@
 # Git CLI Scanner
 
-A powerful CLI tool that scans your codebase for hardcoded secrets, API keys, passwords, private keys, database credentials, and Docker infrastructure tokens before they reach your Git history.
-
----
-
-## What Does It Scan For?
-
-Git CLI Scanner uses regex heuristics and pattern matching to detect:
-
-- **Cloud Provider Keys**: AWS Access/Secret Keys, Google Cloud API Keys.
-- **Infrastructure & Databases**: Database Connection Strings (MongoDB, PostgreSQL, MySQL, Redis), Docker Hub Personal Access Tokens.
-- **Collaboration Tools**: Slack Tokens, Slack Webhooks, GitHub PATs, OAuth Tokens, Discord Webhooks.
-- **Private Keys**: RSA, DSA, EC, OpenSSH, PGP Private Keys.
-- **Banned Files**: Accidental commits of `.env`, `.pem`, `.sqlite`, `.log` files (unless they are explicitly added to `.gitignore`).
-
-It features an intelligent **Ignore System** (Dummy Detection) that automatically downgrades the severity of fake, dummy, or test secrets commonly used in unit tests (e.g., `1234567890abcdef`, `dummy_token`).
+A powerful CLI tool that scans your codebase for hardcoded secrets, API keys, passwords, private keys, database credentials, Docker tokens, CI/CD secrets, and infrastructure configs before they reach your Git history.
 
 ---
 
@@ -30,26 +16,18 @@ npx git-cli-scanner <command>
 
 ---
 
-## 🚀 Usage & Commands
-
-### Commands Overview
+## 🚀 Commands
 
 | Command | Description | Arguments & Flags | Example Usage |
 |---------|-------------|-------------------|---------------|
 | `init` | Installs the pre-commit hook to automatically scan files on `git commit`. | None | `npx git-cli-scanner init` |
 | `disable` | Removes the pre-commit hook to stop automatic scanning. | None | `npx git-cli-scanner disable` |
-| `scan` | Manually scans the currently staged files (files added via `git add`). | `--show-sol` (Shows suggested solutions) | `npx git-cli-scanner scan`<br>`npx git-cli-scanner scan --show-sol` |
-| `scan-all` | Recursively scans an entire directory for secrets. | `<dir>` (The directory to scan)<br>`--show-sol` (Shows solutions) | `npx git-cli-scanner scan-all .`<br>`npx git-cli-scanner scan-all ./src --show-sol` |
-| `scan-history`| Scans Git commit history for leaked secrets (Time Travel). | `--id <hash>` (Scan a specific commit)<br>`--since="<time>"` (Scan from a time)<br>`--all` (Scan entire history)<br>`--show-sol` (Shows solutions) | `npx git-cli-scanner scan-history`<br>`npx git-cli-scanner scan-history --id 3a4b5c6`<br>`npx git-cli-scanner scan-history --since="30 days ago"`<br>`npx git-cli-scanner scan-history --all` |
-| `explore` | Launches an interactive Terminal User Interface (TUI) to navigate and scan files. | None | `npx git-cli-scanner explore` |
-
-### 6. Interactive File Explorer (TUI)
-
-Launch an interactive Terminal User Interface (TUI) to navigate your project directory and manually select files to scan.
+| `scan` | Manually scans the currently staged files (files added via `git add`). | `--show-sol` — Show suggested fixes for each finding | `npx git-cli-scanner scan`<br>`npx git-cli-scanner scan --show-sol` |
+| `scan-all` | Recursively scans an entire directory for secrets. | `<dir>` — The directory to scan<br>`--show-sol` — Show suggested fixes | `npx git-cli-scanner scan-all .`<br>`npx git-cli-scanner scan-all ./src --show-sol` |
+| `scan-history` | Scans Git commit history for leaked secrets (Time Travel). Defaults to the last commit. | `--id <hash>` — Scan a specific commit<br>`--since="<time>"` — Scan commits from a time range<br>`--all` — Scan entire history across all branches<br>`--show-sol` — Show fixes | `npx git-cli-scanner scan-history`<br>`npx git-cli-scanner scan-history --id 3a4b5c6`<br>`npx git-cli-scanner scan-history --since="30 days ago"`<br>`npx git-cli-scanner scan-history --all --show-sol` |
+| `explore` | Launches an interactive Terminal User Interface (TUI) to browse and scan files. | None | `npx git-cli-scanner explore` |
 
-```bash
-git-cli-scanner explore
-```
+### Interactive Explorer Keys
 
 | Key | Action |
 |-----|--------|
@@ -60,41 +38,98 @@ git-cli-scanner explore
 
 ---
 
-## Severity Levels
+## 🔍 What Does It Scan For?
+
+### Scanners & Detection Rules
+
+| Category | Rule ID | What It Detects | Severity |
+|----------|---------|-----------------|----------|
+| ☁️ Cloud Providers | `aws-access-key` | AWS Access Key IDs (`AKIA...`) | High |
+| ☁️ Cloud Providers | `aws-secret-key` | AWS Secret Access Keys (heuristics) | High |
+| ☁️ Cloud Providers | `gcp-api-key` | Google Cloud API Keys (`AIza...`) | High |
+| 🔥 Firebase | `firebase-secret` | Firebase API Keys / Secrets | High |
+| 🔥 Firebase | `firebase-service-account` | Firebase Service Account JSON (`"type": "service_account"`) | Critical |
+| 🪪 Authentication | `jwt-secret` | JWT Secret Keys (quoted or unquoted) | High |
+| 🪪 Authentication | `oauth-client-secret` | OAuth Client Secrets | High |
+| 🪪 Authentication | `session-secret` | Session Cookie Secrets | High |
+| 🔑 API Keys & Tokens | `generic-api-key` | Generic `api_key`, `api-key`, `API_KEY` patterns | High |
+| 🔑 API Keys & Tokens | `stripe-key` | Stripe API Keys (`sk_live_...`, `rk_live_...`) | High |
+| 🔑 API Keys & Tokens | `github-pat` | GitHub Personal Access Tokens | High |
+| 🔑 API Keys & Tokens | `slack-token` | Slack Bot/User Tokens (`xoxb-...`, `xoxp-...`) | High |
+| 🔑 API Keys & Tokens | `slack-webhook` | Slack Incoming Webhook URLs | High |
+| 🔑 API Keys & Tokens | `discord-webhook` | Discord Webhook URLs | High |
+| 📦 Package Registries | `npm-token` | NPM Access Tokens (`npm_...`) | High |
+| 📦 Package Registries | `pypi-token` | PyPI Access Tokens (`pypi-...`) | High |
+| 📦 Package Registries | `maven-gradle-password` | Maven/Gradle/Nexus/Artifactory Repository Passwords | High |
+| 🧰 CI/CD | `gitlab-ci-token` | GitLab Personal Access Tokens (`glpat-...`) | Critical |
+| 🧰 CI/CD | `github-actions-token` | GitHub Actions Runner Tokens (`ghp_...`, `ghs_...`) | Critical |
+| 🧰 CI/CD | `jenkins-token` | Jenkins API Tokens / Secrets | High |
+| 🏠 Infrastructure | `docker-hub-token` | Docker Hub Personal Access Tokens (`dckr_pat_...`) | High |
+| 🏠 Infrastructure | `database-connection-string` | Database Connection Strings (MongoDB, PostgreSQL, MySQL, Redis with credentials) | High |
+| 🏠 Infrastructure | `smtp-credentials` | SMTP / SendGrid / Mailgun email passwords | High |
+| 🏠 Infrastructure | `terraform-helm-secret` | Terraform (`tf_var_...`) and Helm (`helm_var_...`) variable secrets | High |
+| 🔌 Webhooks | `stripe-secret` | Stripe Secret Keys and Webhook Secrets (`sk_live_`, `whsec_`) | High |
+| 🔌 Webhooks | `paypal-secret` | PayPal Client Secrets | High |
+| 🔌 Webhooks | `generic-webhook` | Generic Webhook URLs (Slack, Discord, IFTTT) | High |
+| 🔒 Private Keys | `rsa-private-key` | RSA Private Key blocks (`-----BEGIN RSA PRIVATE KEY-----`) | High |
+| 🔒 Private Keys | `dsa-private-key` | DSA Private Key blocks | High |
+| 🔒 Private Keys | `ec-private-key` | EC Private Key blocks | High |
+| 🔒 Private Keys | `openssh-private-key` | OpenSSH Private Key blocks | High |
+| 🔒 Private Keys | `pgp-private-key` | PGP Private Key blocks | High |
+| 🔒 Certificates | `banned-file-type` | Banned file extensions: `.pem`, `.key`, `.p12`, `.pfx`, `.crt`, `.cer`, `.keystore`, `.sqlite`, `.db`, `.log`, `.env` | Medium |
+
+---
+
+## 🛡️ Intelligent Dummy Detection
+
+The scanner features an **Intelligent Ignore System** that automatically downgrades the severity of fake, dummy, or test secrets commonly used in unit tests and example files. This avoids blocking your commits with false positives.
+
+**Patterns recognized as dummy:**
+- Sequential characters: `1234567890abcdef`, `abcdefghijklmnop`
+- Common placeholders: `EXAMPLE`, `dummy`, `test`, `fake`, `placeholder`
+- Repetitive patterns: `aaaa`, `0000`
 
-The scanner categorizes findings into different severity levels:
+When a dummy value is detected, the finding is downgraded from `● HIGH` to `○ IGNORED (DUMMY)` and **will not block** your commit.
+
+---
+
+## Severity Levels
 
 | Indicator | Level | Color | Meaning |
 |-----------|-------|-------|---------|
-| `●` | HIGH | Red | Hardcoded secrets that pose a critical risk and must be removed. |
-| `●` | MEDIUM | Yellow | Risky files or configurations not safely ignored in `.gitignore`. |
-| `○` | IGNORED | Dim | Test/example values (auto-detected dummy values that pose no risk). |
+| `●` | CRITICAL | Red | CI/CD and service account secrets that grant admin-level access |
+| `●` | HIGH | Red | Hardcoded secrets that pose a critical risk and must be removed |
+| `●` | MEDIUM | Yellow | Risky files or configurations not safely ignored in `.gitignore` |
+| `○` | IGNORED | Dim | Test/example values (auto-detected dummy values that pose no risk) |
 
 ---
 
 ## Example Output
 
 ```
-✖ Found 2 vulnerabilities! (2 blockers)
+✖ Found 3 potential vulnerabilities! (3 blockers)
 
 Scan Results:
 
-  ● HIGH · aws-secret-key
-    File:  src/config/aws.ts:12
-    Match: aws_secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEX...
-    Risk:  Compromised AWS Secret Keys grant direct access to your entire cloud infrastructure.
+  ● HIGH · jwt-secret
+    File:  src/config/auth.ts:5
+    Match: JWT_SECRET=xJk9Lp2Rm5Qw8Yz1Xv4Bn7Cm...
+    Risk:  An attacker can forge JWT tokens to impersonate any user, including admins.
 
   ● HIGH · database-connection-string
-    File:  src/db/connection.ts:5
-    Match: mongodb+srv://admin:supersecret123@cluster0.mongo...
-    Risk:  An attacker can directly connect to your database instance, allowing them to steal user data.
+    File:  src/db/connection.ts:3
+    Match: mongodb+srv://admin:supersecret@cluster0.mongo...
+    Risk:  An attacker can directly connect to your database instance.
+
+  ○ IGNORED (DUMMY) · aws-access-key
+    File:  tests/mock.ts:10
+    Match: AKIAIOSFODNN7EXAMPLE...
+    Risk:  (auto-downgraded — recognized as a test/example value)
 ```
 
 ---
 
-## Running Tests Locally
-
-If you are contributing to the project, you can run the test suite using Vitest:
+## Running Tests
 
 ```bash
 npm test