guardvibe 0.8.2 → 0.9.0

package/build/data/rules/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/data/rules/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAW/C,eAAO,MAAM,UAAU,qCAUtB,CAAC;AAGF,eAAO,MAAM,YAAY,qCAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/data/rules/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAc/C,eAAO,MAAM,UAAU,qCAatB,CAAC;AAGF,eAAO,MAAM,YAAY,qCAAa,CAAC"}

package/build/data/rules/index.js

@@ -7,6 +7,9 @@ import { nextjsRules } from "./nextjs.js";
 import { authRules } from "./auth.js";
 import { databaseRules } from "./database.js";
 import { deploymentRules } from "./deployment.js";
+import { paymentRules } from "./payments.js";
+import { serviceRules } from "./services.js";
+import { webSecurityRules } from "./web-security.js";
 export const owaspRules = [
     ...coreRules,
     ...goRules,
@@ -17,6 +20,9 @@ export const owaspRules = [
     ...authRules,
     ...databaseRules,
     ...deploymentRules,
+    ...paymentRules,
+    ...serviceRules,
+    ...webSecurityRules,
 ];
 // Alias for clarity — these are the built-in rules without plugins
 export const builtinRules = owaspRules;

package/build/data/rules/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/data/rules/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,GAAG,SAAS;IACZ,GAAG,OAAO;IACV,GAAG,eAAe;IAClB,GAAG,SAAS;IACZ,GAAG,cAAc;IACjB,GAAG,WAAW;IACd,GAAG,SAAS;IACZ,GAAG,aAAa;IAChB,GAAG,eAAe;CACnB,CAAC;AAEF,mEAAmE;AACnE,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/data/rules/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,GAAG,SAAS;IACZ,GAAG,OAAO;IACV,GAAG,eAAe;IAClB,GAAG,SAAS;IACZ,GAAG,cAAc;IACjB,GAAG,WAAW;IACd,GAAG,SAAS;IACZ,GAAG,aAAa;IAChB,GAAG,eAAe;IAClB,GAAG,YAAY;IACf,GAAG,YAAY;IACf,GAAG,gBAAgB;CACpB,CAAC;AAEF,mEAAmE;AACnE,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC"}

package/build/data/rules/payments.d.ts

@@ -0,0 +1,3 @@
+import type { SecurityRule } from "./types.js";
+export declare const paymentRules: SecurityRule[];
+//# sourceMappingURL=payments.d.ts.map

package/build/data/rules/payments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payments.d.ts","sourceRoot":"","sources":["../../../src/data/rules/payments.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,eAAO,MAAM,YAAY,EAAE,YAAY,EAiItC,CAAC"}

package/build/data/rules/payments.js

@@ -0,0 +1,111 @@
+export const paymentRules = [
+    // Stripe
+    {
+        id: "VG600",
+        name: "Stripe Secret Key Client Exposure",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Stripe secret key (sk_live_ or sk_test_) exposed in client-side code. This key can charge any amount to any card.",
+        pattern: /["']use client["'][\s\S]{0,500}?sk_(?:live|test)_/g,
+        languages: ["javascript", "typescript"],
+        fix: "Never use Stripe secret keys in client code. Use them only in server-side API routes.",
+        fixCode: "// Server-side only (API route or Server Action)\nimport Stripe from 'stripe';\nconst stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);",
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req2.3"],
+    },
+    {
+        id: "VG601",
+        name: "Stripe Webhook Missing Signature Verification",
+        severity: "critical",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Stripe webhook endpoint processes events without verifying the webhook signature. Anyone can send fake payment events.",
+        pattern: /(?:\/api\/webhook|\/api\/stripe|webhook.*stripe)[\s\S]*?(?:req\.body|request\.json|JSON\.parse)[\s\S]{0,300}?(?![\s\S]{0,300}?(?:constructEvent|verifyHeader|stripe\.webhooks))/g,
+        languages: ["javascript", "typescript"],
+        fix: "Always verify Stripe webhook signatures using stripe.webhooks.constructEvent().",
+        fixCode: "// Verify webhook signature\nconst sig = request.headers.get('stripe-signature')!;\nconst event = stripe.webhooks.constructEvent(\n  body, sig, process.env.STRIPE_WEBHOOK_SECRET!\n);",
+        compliance: ["SOC2:CC6.6", "PCI-DSS:Req6.5.10"],
+    },
+    {
+        id: "VG602",
+        name: "Stripe Price Amount Client-Side",
+        severity: "high",
+        owasp: "A04:2025 Insecure Design",
+        description: "Price amount sent from client to server for payment. Users can modify the amount in browser DevTools.",
+        pattern: /(?:amount|price|total)\s*[:=]\s*(?:req\.body|request\.body|body\.)[\s\S]{0,100}?(?:stripe|payment|checkout|charge)/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Always calculate prices server-side. Use Stripe Price IDs or calculate from your database, never trust client-sent amounts.",
+        fixCode: "// Use Stripe Price IDs, not client amounts\nconst session = await stripe.checkout.sessions.create({\n  line_items: [{ price: 'price_xxx', quantity: 1 }], // Price ID from Stripe dashboard\n});",
+        compliance: ["PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG603",
+        name: "Hardcoded Stripe Key",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Stripe API key hardcoded in source code instead of environment variable.",
+        pattern: /(?:stripe|Stripe)\s*\(\s*["']sk_(?:live|test)_[A-Za-z0-9]{10,}["']/g,
+        languages: ["javascript", "typescript"],
+        fix: "Use environment variables for Stripe keys.",
+        fixCode: "const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);",
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req2.3"],
+    },
+    {
+        id: "VG604",
+        name: "NEXT_PUBLIC Stripe Secret Key",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Stripe secret key exposed via NEXT_PUBLIC_ prefix. Only the publishable key (pk_) should be public.",
+        pattern: /NEXT_PUBLIC_\w*STRIPE\w*SECRET/gi,
+        languages: ["javascript", "typescript", "shell"],
+        fix: "Remove NEXT_PUBLIC_ prefix from Stripe secret key. Only NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY should be public.",
+        fixCode: "# .env.local\nSTRIPE_SECRET_KEY=sk_live_xxx          # server only\nNEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_live_xxx  # safe to expose",
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req2.3"],
+    },
+    // LemonSqueezy
+    {
+        id: "VG605",
+        name: "LemonSqueezy API Key Exposure",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "LemonSqueezy API key exposed in client-side code.",
+        pattern: /["']use client["'][\s\S]{0,500}?(?:LEMONSQUEEZY_API_KEY|LEMON_SQUEEZY_API_KEY)/g,
+        languages: ["javascript", "typescript"],
+        fix: "Use LemonSqueezy API key only in server-side code.",
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG606",
+        name: "LemonSqueezy Webhook Missing Signature",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "LemonSqueezy webhook processes events without verifying the X-Signature header.",
+        pattern: /(?:lemonsqueezy|lemon.?squeezy)[\s\S]{0,500}?(?:req\.body|request\.json)[\s\S]{0,300}?(?![\s\S]{0,300}?(?:verify|signature|x-signature|hmac|crypto))/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Verify the X-Signature header using HMAC-SHA256 with your webhook secret.",
+        fixCode: "// Verify LemonSqueezy webhook\nimport crypto from 'crypto';\nconst sig = request.headers.get('x-signature');\nconst hash = crypto.createHmac('sha256', process.env.LEMON_SQUEEZY_WEBHOOK_SECRET!)\n  .update(body).digest('hex');\nif (sig !== hash) return new Response('Invalid', { status: 401 });",
+        compliance: ["SOC2:CC6.6"],
+    },
+    // Polar.sh
+    {
+        id: "VG607",
+        name: "Polar API Key Exposure",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Polar.sh API key or access token exposed in client-side code.",
+        pattern: /["']use client["'][\s\S]{0,500}?(?:POLAR_ACCESS_TOKEN|POLAR_API_KEY|polar.*(?:access_token|api_key))/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Use Polar API keys only in server-side code.",
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG608",
+        name: "Payment Webhook Missing Auth",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Payment webhook endpoint has no signature verification or authentication. Attackers can fake payment confirmations.",
+        pattern: /(?:\/api\/webhook|\/api\/payment|\/api\/checkout)[\s\S]*?export\s+(?:async\s+)?function\s+POST\s*\([^)]*\)\s*\{(?:(?!verify|signature|constructEvent|hmac|crypto\.createHmac|webhookSecret)[\s\S])*?\}/g,
+        languages: ["javascript", "typescript"],
+        fix: "Always verify webhook signatures before processing payment events.",
+        compliance: ["SOC2:CC6.6", "PCI-DSS:Req6.5.10"],
+    },
+];
+//# sourceMappingURL=payments.js.map

package/build/data/rules/payments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payments.js","sourceRoot":"","sources":["../../../src/data/rules/payments.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,YAAY,GAAmB;IAC1C,SAAS;IACT;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,mCAAmC;QACzC,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EACT,mHAAmH;QACrH,OAAO,EAAE,oDAAoD;QAC7D,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACvC,GAAG,EAAE,uFAAuF;QAC5F,OAAO,EACL,4IAA4I;QAC9I,UAAU,EAAE,CAAC,YAAY,EAAE,gBAAgB,CAAC;KAC7C;IACD;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,+CAA+C;QACrD,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,gCAAgC;QACvC,WAAW,EACT,wHAAwH;QAC1H,OAAO,EACL,kLAAkL;QACpL,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACvC,GAAG,EAAE,iFAAiF;QACtF,OAAO,EACL,wLAAwL;QAC1L,UAAU,EAAE,CAAC,YAAY,EAAE,mBAAmB,CAAC;KAChD;IACD;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,iCAAiC;QACvC,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,0BAA0B;QACjC,WAAW,EACT,uGAAuG;QACzG,OAAO,EACL,sHAAsH;QACxH,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACvC,GAAG,EAAE,6HAA6H;QAClI,OAAO,EACL,mMAAmM;QACrM,UAAU,EAAE,CAAC,kBAAkB,CAAC;KACjC;IACD;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EACT,0EAA0E;QAC5E,OAAO,EAAE,qEAAqE;QAC9E,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACvC,GAAG,EAAE,4CAA4C;QACjD,OAAO,EAAE,4DAA4D;QACrE,UAAU,EAAE,CAAC,YAAY,EAAE,gBAAgB,CAAC;KAC7C;IACD;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,+BAA+B;QACrC,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EACT,qGAAqG;QACvG,OAAO,EAAE,kCAAkC;QAC3C,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,CAAC;QAChD,GAAG,EAAE,8GAA8G;QACnH,OAAO,EACL,sIAAsI;QACxI,UAAU,EAAE,CAAC,YAAY,EAAE,gBAAgB,CAAC;KAC7C;IAED,eAAe;IACf;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,+BAA+B;QACrC,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,mDAAmD;QAChE,OAAO,EACL,iFAAiF;QACnF,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACvC,GAAG,EAAE,oDAAoD;QACzD,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;IACD;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,wCAAwC;QAC9C,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,gCAAgC;QACvC,WAAW,EACT,iFAAiF;QACnF,OAAO,EACL,wJAAwJ;QAC1J,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACvC,GAAG,EAAE,2EAA2E;QAChF,OAAO,EACL,wSAAwS;QAC1S,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;IAED,WAAW;IACX;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,+DAA+D;QAC5E,OAAO,EACL,wGAAwG;QAC1G,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACvC,GAAG,EAAE,8CAA8C;QACnD,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;IACD;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,8BAA8B;QACpC,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,gCAAgC;QACvC,WAAW,EACT,qHAAqH;QACvH,OAAO,EACL,yMAAyM;QAC3M,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACvC,GAAG,EAAE,oEAAoE;QACzE,UAAU,EAAE,CAAC,YAAY,EAAE,mBAAmB,CAAC;KAChD;CACF,CAAC"}

package/build/data/rules/services.d.ts

@@ -0,0 +1,3 @@
+import type { SecurityRule } from "./types.js";
+export declare const serviceRules: SecurityRule[];
+//# sourceMappingURL=services.d.ts.map

package/build/data/rules/services.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../../../src/data/rules/services.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,eAAO,MAAM,YAAY,EAAE,YAAY,EAyItC,CAAC"}

package/build/data/rules/services.js

@@ -0,0 +1,135 @@
+export const serviceRules = [
+    // Resend Email
+    {
+        id: "VG620",
+        name: "Resend API Key Client Exposure",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Resend API key exposed in client-side code. This allows anyone to send emails from your account.",
+        pattern: /["']use client["'][\s\S]{0,500}?(?:RESEND_API_KEY|re_[A-Za-z0-9]{20,})/g,
+        languages: ["javascript", "typescript"],
+        fix: "Use Resend API key only in server-side code (API routes or Server Actions).",
+        fixCode: '"use server";\nimport { Resend } from "resend";\nconst resend = new Resend(process.env.RESEND_API_KEY);',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG621",
+        name: "Hardcoded Resend API Key",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Resend API key hardcoded in source code.",
+        pattern: /(?:Resend|resend)\s*\(\s*["']re_[A-Za-z0-9]{10,}["']/g,
+        languages: ["javascript", "typescript"],
+        fix: "Use environment variable for Resend API key.",
+        fixCode: 'const resend = new Resend(process.env.RESEND_API_KEY);',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG622",
+        name: "Email Content Injection",
+        severity: "high",
+        owasp: "A03:2025 Injection",
+        description: "User input directly used in email headers (to, from, subject, cc, bcc) without validation. Can be used for email injection/spam.",
+        pattern: /(?:resend|sendgrid|nodemailer)[\s\S]{0,300}?(?:to|from|cc|bcc|subject)\s*:\s*(?:req\.body|request\.body|body\.|formData\.get|params\.)/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Validate and sanitize all email fields. Use allowlists for recipient addresses when possible.",
+        fixCode: '// Validate email before sending\nimport { z } from "zod";\nconst schema = z.object({ to: z.string().email(), subject: z.string().max(200) });\nconst data = schema.parse(input);',
+        compliance: ["SOC2:CC7.1"],
+    },
+    // Upstash Redis
+    {
+        id: "VG625",
+        name: "Upstash Redis URL Client Exposure",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Upstash Redis REST URL or token exposed in client-side code. This gives full access to your Redis database.",
+        pattern: /["']use client["'][\s\S]{0,500}?(?:UPSTASH_REDIS_REST_URL|UPSTASH_REDIS_REST_TOKEN|KV_REST_API_URL|KV_REST_API_TOKEN)/g,
+        languages: ["javascript", "typescript"],
+        fix: "Use Upstash Redis only in server-side code.",
+        fixCode: '// Server-side only\nimport { Redis } from "@upstash/redis";\nconst redis = Redis.fromEnv(); // reads from env automatically',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG626",
+        name: "Hardcoded Redis Connection String",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Redis connection URL or token hardcoded in source code.",
+        pattern: /(?:redis|Redis|upstash)[\s\S]{0,100}?(?:url|token)\s*[:=]\s*["'](?:https?:\/\/|redis:\/\/|rediss:\/\/)[^"']{10,}["']/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Use environment variables for Redis connection details.",
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG627",
+        name: "NEXT_PUBLIC Redis Credentials",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Redis credentials exposed via NEXT_PUBLIC_ prefix.",
+        pattern: /NEXT_PUBLIC_\w*(?:REDIS|UPSTASH|KV)\w*(?:URL|TOKEN|SECRET)\s*=/gi,
+        languages: ["javascript", "typescript", "shell"],
+        fix: "Remove NEXT_PUBLIC_ prefix from Redis credentials. Access them only server-side.",
+        compliance: ["SOC2:CC6.1"],
+    },
+    // Pinecone
+    {
+        id: "VG630",
+        name: "Pinecone API Key Client Exposure",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Pinecone API key exposed in client-side code. This gives full access to your vector database.",
+        pattern: /["']use client["'][\s\S]{0,500}?PINECONE_API_KEY/g,
+        languages: ["javascript", "typescript"],
+        fix: "Use Pinecone API key only in server-side code.",
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG631",
+        name: "NEXT_PUBLIC Pinecone Key",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Pinecone API key exposed via NEXT_PUBLIC_ prefix.",
+        pattern: /NEXT_PUBLIC_\w*PINECONE\w*(?:KEY|SECRET|TOKEN)\s*=/gi,
+        languages: ["javascript", "typescript", "shell"],
+        fix: "Remove NEXT_PUBLIC_ prefix. Pinecone keys must be server-side only.",
+        compliance: ["SOC2:CC6.1"],
+    },
+    // PostHog
+    {
+        id: "VG635",
+        name: "PostHog Secret API Key Exposure",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "PostHog personal/secret API key exposed in client-side code. The project API key is safe to expose, but personal API keys grant full access.",
+        pattern: /["']use client["'][\s\S]{0,500}?(?:POSTHOG_PERSONAL_API_KEY|phx_[A-Za-z0-9]{20,})/g,
+        languages: ["javascript", "typescript"],
+        fix: "Only the PostHog project API key (phc_) should be in client code. Personal API keys (phx_) must be server-side only.",
+        fixCode: "# Safe to expose (project key)\nNEXT_PUBLIC_POSTHOG_KEY=phc_xxx\n\n# Server-side only (personal key)\nPOSTHOG_PERSONAL_API_KEY=phx_xxx",
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG636",
+        name: "Analytics PII Data Exposure",
+        severity: "high",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Personally identifiable information (email, phone, SSN, credit card) sent to analytics. This violates GDPR/CCPA and platform terms.",
+        pattern: /(?:posthog|analytics|gtag|ga)\s*[\.\(][\s\S]{0,200}?(?:capture|track|identify|event|send)\s*\([\s\S]{0,300}?(?:email|phone|ssn|creditCard|password|socialSecurity)/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Never send PII to analytics. Hash or anonymize user identifiers.",
+        fixCode: "// Anonymize before tracking\nposthog.identify(hashedUserId); // not email\nposthog.capture('purchase', { plan: 'pro', amount: 29 }); // no PII",
+        compliance: ["SOC2:CC6.1", "HIPAA:§164.312(a)"],
+    },
+    // Google Analytics
+    {
+        id: "VG637",
+        name: "Google Analytics PII Tracking",
+        severity: "high",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "PII data sent to Google Analytics. This violates Google's ToS and privacy regulations.",
+        pattern: /(?:gtag|ga|dataLayer\.push)\s*\([\s\S]{0,300}?(?:email|user_email|phone|ssn|password)/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Never send PII to Google Analytics. Use anonymous IDs.",
+        compliance: ["SOC2:CC6.1"],
+    },
+];
+//# sourceMappingURL=services.js.map

package/build/data/rules/services.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.js","sourceRoot":"","sources":["../../../src/data/rules/services.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,YAAY,GAAmB;IAC1C,eAAe;IACf;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,gCAAgC;QACtC,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,kGAAkG;QAC/G,OAAO,EAAE,yEAAyE;QAClF,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACvC,GAAG,EAAE,6EAA6E;QAClF,OAAO,EAAE,yGAAyG;QAClH,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;IACD;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,0CAA0C;QACvD,OAAO,EAAE,uDAAuD;QAChE,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACvC,GAAG,EAAE,8CAA8C;QACnD,OAAO,EAAE,wDAAwD;QACjE,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;IACD;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,kIAAkI;QAC/I,OAAO,EAAE,0IAA0I;QACnJ,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACvC,GAAG,EAAE,+FAA+F;QACpG,OAAO,EAAE,mLAAmL;QAC5L,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;IAED,gBAAgB;IAChB;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,mCAAmC;QACzC,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,6GAA6G;QAC1H,OAAO,EAAE,wHAAwH;QACjI,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACvC,GAAG,EAAE,6CAA6C;QAClD,OAAO,EAAE,8HAA8H;QACvI,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;IACD;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,mCAAmC;QACzC,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,yDAAyD;QACtE,OAAO,EAAE,wHAAwH;QACjI,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACvC,GAAG,EAAE,yDAAyD;QAC9D,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;IACD;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,+BAA+B;QACrC,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,oDAAoD;QACjE,OAAO,EAAE,kEAAkE;QAC3E,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,CAAC;QAChD,GAAG,EAAE,kFAAkF;QACvF,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;IAED,WAAW;IACX;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,kCAAkC;QACxC,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,+FAA+F;QAC5G,OAAO,EAAE,mDAAmD;QAC5D,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACvC,GAAG,EAAE,gDAAgD;QACrD,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;IACD;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,sDAAsD;QAC/D,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,CAAC;QAChD,GAAG,EAAE,qEAAqE;QAC1E,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;IAED,UAAU;IACV;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,iCAAiC;QACvC,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,8IAA8I;QAC3J,OAAO,EAAE,oFAAoF;QAC7F,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACvC,GAAG,EAAE,sHAAsH;QAC3H,OAAO,EAAE,wIAAwI;QACjJ,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;IACD;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,qIAAqI;QAClJ,OAAO,EAAE,sKAAsK;QAC/K,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACvC,GAAG,EAAE,kEAAkE;QACvE,OAAO,EAAE,iJAAiJ;QAC1J,UAAU,EAAE,CAAC,YAAY,EAAE,mBAAmB,CAAC;KAChD;IAED,mBAAmB;IACnB;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,+BAA+B;QACrC,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,wFAAwF;QACrG,OAAO,EAAE,yFAAyF;QAClG,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACvC,GAAG,EAAE,wDAAwD;QAC7D,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;CACF,CAAC"}

package/build/data/rules/web-security.d.ts

@@ -0,0 +1,3 @@
+import type { SecurityRule } from "./types.js";
+export declare const webSecurityRules: SecurityRule[];
+//# sourceMappingURL=web-security.d.ts.map

package/build/data/rules/web-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-security.d.ts","sourceRoot":"","sources":["../../../src/data/rules/web-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,eAAO,MAAM,gBAAgB,EAAE,YAAY,EA4K1C,CAAC"}

package/build/data/rules/web-security.js

@@ -0,0 +1,169 @@
+export const webSecurityRules = [
+    // Webhook Security
+    {
+        id: "VG650",
+        name: "Webhook Missing Signature Verification",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Webhook endpoint processes incoming events without verifying the request signature. Attackers can send forged events.",
+        pattern: /(?:\/api\/webhook|\/webhook)[\s\S]*?export\s+(?:async\s+)?function\s+POST\s*\([^)]*\)\s*\{(?:(?!verify|signature|hmac|crypto|constructEvent|svix|webhookSecret)[\s\S])*?\}/g,
+        languages: ["javascript", "typescript"],
+        fix: "Always verify webhook signatures before processing events.",
+        fixCode: "// Verify webhook signature\nimport crypto from 'crypto';\nconst sig = request.headers.get('x-webhook-signature');\nconst expected = crypto.createHmac('sha256', process.env.WEBHOOK_SECRET!)\n  .update(body).digest('hex');\nif (sig !== expected) return new Response('Unauthorized', { status: 401 });",
+        compliance: ["SOC2:CC6.6"],
+    },
+    {
+        id: "VG651",
+        name: "Webhook Secret Hardcoded",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Webhook signing secret hardcoded in source code.",
+        pattern: /(?:webhook_?secret|signing_?secret|whsec_)\s*[:=]\s*["'][A-Za-z0-9_\-]{12,}["']/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Use environment variables for webhook secrets.",
+        compliance: ["SOC2:CC6.1"],
+    },
+    // .env Security
+    {
+        id: "VG655",
+        name: "Sensitive Env Var in NEXT_PUBLIC",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "A sensitive service credential is exposed via NEXT_PUBLIC_ prefix. NEXT_PUBLIC_ variables are embedded in the client JavaScript bundle.",
+        pattern: /NEXT_PUBLIC_\w*(?:SECRET|PRIVATE|SERVICE_ROLE|API_KEY|ACCESS_TOKEN|AUTH_TOKEN|SIGNING|WEBHOOK)\w*\s*=/gi,
+        languages: ["shell", "javascript", "typescript"],
+        fix: "Remove NEXT_PUBLIC_ prefix from sensitive credentials. Access them only in server-side code.",
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req2.3"],
+    },
+    {
+        id: "VG656",
+        name: ".env File Committed to Git",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: ".env file with secrets appears to be tracked by git. Secrets will be visible in repository history.",
+        pattern: /^(?:SUPABASE_SERVICE_ROLE_KEY|STRIPE_SECRET_KEY|DATABASE_URL|RESEND_API_KEY|OPENAI_API_KEY|ANTHROPIC_API_KEY|CLERK_SECRET_KEY|AUTH_SECRET|NEXTAUTH_SECRET)\s*=\s*\S{10,}/gm,
+        languages: ["shell"],
+        fix: "Add .env* to .gitignore immediately. Rotate any exposed secrets.",
+        fixCode: "# .gitignore\n.env\n.env.*\n.env.local\n!.env.example",
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req2.3", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG657",
+        name: ".env.example Contains Real Secrets",
+        severity: "high",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: ".env.example file contains what appears to be real secret values instead of placeholders.",
+        pattern: /(?:SECRET|KEY|TOKEN|PASSWORD)\w*\s*=\s*(?:sk_live_|sk_test_|re_|whsec_|phx_|AKIA|ghp_|gho_)[A-Za-z0-9]{10,}/g,
+        languages: ["shell"],
+        fix: "Replace real values in .env.example with placeholders.",
+        fixCode: "# .env.example — use placeholders\nSTRIPE_SECRET_KEY=sk_test_your_key_here\nRESEND_API_KEY=re_your_key_here",
+        compliance: ["SOC2:CC6.1"],
+    },
+    // SEO / Meta Security
+    {
+        id: "VG660",
+        name: "Open Redirect in Meta Tags",
+        severity: "medium",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Dynamic user input used in meta refresh or og:url tags. Can be used for phishing via open redirect.",
+        pattern: /(?:meta.*?(?:refresh|og:url)|(?:openGraph|twitter)[\s\S]{0,200}?url)\s*[:=]\s*(?:params|searchParams|query|req\.|request\.)/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Validate and sanitize URLs used in meta tags. Use allowlists for domains.",
+        compliance: ["SOC2:CC6.6"],
+    },
+    {
+        id: "VG661",
+        name: "Sensitive Path in robots.txt",
+        severity: "medium",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "robots.txt disallows sensitive paths, revealing their existence to attackers. Disallow does not prevent access.",
+        pattern: /Disallow:\s*\/(?:admin|dashboard|internal|staging|debug|phpMyAdmin|\.env|backup|api\/internal)/gi,
+        languages: ["shell"],
+        fix: "Don't rely on robots.txt for security. Use authentication to protect sensitive paths. robots.txt is publicly readable.",
+        compliance: ["SOC2:CC6.6"],
+    },
+    {
+        id: "VG662",
+        name: "Source Map Publicly Accessible",
+        severity: "medium",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "Source maps are generated for production builds, exposing original source code.",
+        pattern: /productionBrowserSourceMaps\s*:\s*true/g,
+        languages: ["javascript", "typescript"],
+        fix: "Set productionBrowserSourceMaps to false in next.config.",
+        fixCode: "// next.config.ts\nmodule.exports = {\n  productionBrowserSourceMaps: false,\n};",
+        compliance: ["SOC2:CC6.1"],
+    },
+    // GitHub / Git Security
+    {
+        id: "VG665",
+        name: "GitHub Token Hardcoded",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "GitHub personal access token or app token hardcoded in source code.",
+        pattern: /(?:github_?token|gh_?token|GITHUB_TOKEN)\s*[:=]\s*["'](?:ghp_|gho_|ghu_|ghs_|ghr_|github_pat_)[A-Za-z0-9_]{10,}["']/gi,
+        languages: ["javascript", "typescript", "python", "shell"],
+        fix: "Use environment variables for GitHub tokens.",
+        compliance: ["SOC2:CC6.1"],
+    },
+    // Cloudflare
+    {
+        id: "VG670",
+        name: "Cloudflare API Token Client Exposure",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Cloudflare API token or key exposed in client-side code.",
+        pattern: /["']use client["'][\s\S]{0,500}?(?:CLOUDFLARE_API_TOKEN|CF_API_TOKEN|CLOUDFLARE_API_KEY)/g,
+        languages: ["javascript", "typescript"],
+        fix: "Use Cloudflare API tokens only in server-side code.",
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG671",
+        name: "NEXT_PUBLIC Cloudflare Credentials",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Cloudflare API credentials exposed via NEXT_PUBLIC_ prefix.",
+        pattern: /NEXT_PUBLIC_\w*(?:CLOUDFLARE|CF)\w*(?:API|TOKEN|KEY|SECRET)\s*=/gi,
+        languages: ["javascript", "typescript", "shell"],
+        fix: "Remove NEXT_PUBLIC_ prefix from Cloudflare credentials.",
+        compliance: ["SOC2:CC6.1"],
+    },
+    // OpenAI / AI Keys
+    {
+        id: "VG675",
+        name: "AI API Key Client Exposure",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "AI provider API key (OpenAI, Anthropic, Google AI) exposed in client-side code. These keys have direct cost implications.",
+        pattern: /["']use client["'][\s\S]{0,500}?(?:OPENAI_API_KEY|ANTHROPIC_API_KEY|GOOGLE_AI_API_KEY|GOOGLE_GENERATIVE_AI_API_KEY)/g,
+        languages: ["javascript", "typescript"],
+        fix: "Use AI API keys only in server-side code. Use API routes to proxy AI requests.",
+        fixCode: "// Server-side only (API route)\nimport OpenAI from 'openai';\nconst openai = new OpenAI(); // reads OPENAI_API_KEY from env",
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG676",
+        name: "NEXT_PUBLIC AI API Key",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "AI provider API key exposed via NEXT_PUBLIC_ prefix. Anyone can use your AI credits.",
+        pattern: /NEXT_PUBLIC_\w*(?:OPENAI|ANTHROPIC|GOOGLE_AI|GEMINI|COHERE|REPLICATE)\w*(?:KEY|TOKEN|SECRET)\s*=/gi,
+        languages: ["javascript", "typescript", "shell"],
+        fix: "Remove NEXT_PUBLIC_ prefix from AI API keys. Route AI requests through server-side API routes.",
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG677",
+        name: "Hardcoded AI API Key",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "AI provider API key hardcoded in source code.",
+        pattern: /(?:openai|OpenAI|anthropic|Anthropic)\s*\(\s*\{\s*apiKey\s*:\s*["'](?:sk-|sk-ant-)[A-Za-z0-9\-]{10,}["']/g,
+        languages: ["javascript", "typescript"],
+        fix: "Use environment variables for AI API keys.",
+        fixCode: "// Reads from OPENAI_API_KEY env automatically\nconst openai = new OpenAI();",
+        compliance: ["SOC2:CC6.1"],
+    },
+];
+//# sourceMappingURL=web-security.js.map

package/build/data/rules/web-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-security.js","sourceRoot":"","sources":["../../../src/data/rules/web-security.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,gBAAgB,GAAmB;IAC9C,mBAAmB;IACnB;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,wCAAwC;QAC9C,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,gCAAgC;QACvC,WAAW,EAAE,uHAAuH;QACpI,OAAO,EAAE,6KAA6K;QACtL,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACvC,GAAG,EAAE,4DAA4D;QACjE,OAAO,EAAE,4SAA4S;QACrT,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;IACD;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE,mFAAmF;QAC5F,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACvC,GAAG,EAAE,gDAAgD;QACrD,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;IAED,gBAAgB;IAChB;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,kCAAkC;QACxC,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,yIAAyI;QACtJ,OAAO,EAAE,yGAAyG;QAClH,SAAS,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,CAAC;QAChD,GAAG,EAAE,8FAA8F;QACnG,UAAU,EAAE,CAAC,YAAY,EAAE,gBAAgB,CAAC;KAC7C;IACD;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,qGAAqG;QAClH,OAAO,EAAE,4KAA4K;QACrL,SAAS,EAAE,CAAC,OAAO,CAAC;QACpB,GAAG,EAAE,kEAAkE;QACvE,OAAO,EAAE,uDAAuD;QAChE,UAAU,EAAE,CAAC,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,CAAC;KAClE;IACD;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,oCAAoC;QAC1C,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,2FAA2F;QACxG,OAAO,EAAE,8GAA8G;QACvH,SAAS,EAAE,CAAC,OAAO,CAAC;QACpB,GAAG,EAAE,wDAAwD;QAC7D,OAAO,EAAE,6GAA6G;QACtH,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;IAED,sBAAsB;IACtB;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,gCAAgC;QACvC,WAAW,EAAE,qGAAqG;QAClH,OAAO,EAAE,+HAA+H;QACxI,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACvC,GAAG,EAAE,2EAA2E;QAChF,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;IACD;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,8BAA8B;QACpC,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,oCAAoC;QAC3C,WAAW,EAAE,iHAAiH;QAC9H,OAAO,EAAE,kGAAkG;QAC3G,SAAS,EAAE,CAAC,OAAO,CAAC;QACpB,GAAG,EAAE,wHAAwH;QAC7H,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;IACD;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,gCAAgC;QACtC,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,oCAAoC;QAC3C,WAAW,EAAE,iFAAiF;QAC9F,OAAO,EAAE,yCAAyC;QAClD,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACvC,GAAG,EAAE,0DAA0D;QAC/D,OAAO,EAAE,kFAAkF;QAC3F,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;IAED,wBAAwB;IACxB;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,qEAAqE;QAClF,OAAO,EAAE,uHAAuH;QAChI,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC;QAC1D,GAAG,EAAE,8CAA8C;QACnD,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;IAED,aAAa;IACb;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,sCAAsC;QAC5C,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,0DAA0D;QACvE,OAAO,EAAE,2FAA2F;QACpG,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACvC,GAAG,EAAE,qDAAqD;QAC1D,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;IACD;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,oCAAoC;QAC1C,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,6DAA6D;QAC1E,OAAO,EAAE,mEAAmE;QAC5E,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,CAAC;QAChD,GAAG,EAAE,yDAAyD;QAC9D,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;IAED,mBAAmB;IACnB;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,2HAA2H;QACxI,OAAO,EAAE,sHAAsH;QAC/H,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACvC,GAAG,EAAE,gFAAgF;QACrF,OAAO,EAAE,8HAA8H;QACvI,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;IACD;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,sFAAsF;QACnG,OAAO,EAAE,oGAAoG;QAC7G,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,CAAC;QAChD,GAAG,EAAE,gGAAgG;QACrG,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;IACD;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,+CAA+C;QAC5D,OAAO,EAAE,2GAA2G;QACpH,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACvC,GAAG,EAAE,4CAA4C;QACjD,OAAO,EAAE,8EAA8E;QACvF,UAAU,EAAE,CAAC,YAAY,CAAC;KAC3B;CACF,CAAC"}

package/build/index.js

@@ -18,7 +18,7 @@ import { builtinRules } from "./data/rules/index.js";
 import { loadConfig } from "./utils/config.js";
 const server = new McpServer({
     name: "guardvibe",
-    version: "0.8.2",
+    version: "0.9.0",
 });
 // Tool 1: Analyze code for security vulnerabilities
 server.tool("check_code", "Analyze code for security vulnerabilities (OWASP Top 10, XSS, SQL injection, insecure patterns). Use this when reviewing or writing code to catch security issues early.", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "0.8.2",
+  "version": "0.9.0",
   "description": "Local-first security MCP for vibe coding. Focused on TypeScript, JavaScript, Python, Go, Dockerfile, YAML, and Terraform.",
   "type": "module",
   "bin": {