guardvibe 1.8.3 → 1.8.4

package/build/data/rules/api-security.js

@@ -71,7 +71,7 @@ export const apiSecurityRules = [
         severity: "medium",
         owasp: "API4:2023 Unrestricted Resource Consumption",
         description: "Database query returns all records without pagination (no limit/take/top). An attacker can request the entire table, causing DoS or exposing excessive data.",
-        pattern: /(?:findMany|find|select|from)\s*\((?:(?!limit|take|top|pageSize|per_?page|first|last|\.limit|LIMIT)[\s\S]){5,}?\)/gi,
+        pattern: /(?:\.findMany|\.findAll|\.getAll|\.fetchAll)\s*\((?:(?!limit|take|top|pageSize|per_?page|first|last|\.limit|LIMIT)[\s\S]){5,}?\)/gi,
         languages: ["javascript", "typescript"],
         fix: "Always add pagination: use take/limit with a maximum value. Never return unbounded result sets.",
         fixCode: '// Add pagination\nconst items = await prisma.item.findMany({\n  take: Math.min(Number(searchParams.get("limit")) || 20, 100),\n  skip: Number(searchParams.get("offset")) || 0,\n});',

package/build/data/rules/supply-chain.js

@@ -78,7 +78,7 @@ export const supplyChainRules = [
         severity: "critical",
         owasp: "A02:2025 Injection",
         description: "Source code contains invisible Unicode characters (zero-width spaces, variation selectors, PUA codepoints). The GlassWorm attack (2025-2026) used these to encode malicious payloads that are invisible in every code editor, compromising 433+ repositories across GitHub, npm, and VSCode.",
-        pattern: /[\u200B\u200C\u200D\uFEFF\u00AD\u2060\u2061\u2062\u2063\u2064\uFE00-\uFE0F]/g,
+        pattern: /[\u200B\u200C\u200D\uFEFF\u2060\u2061\u2062\u2063\u2064]{2,}/g,
         languages: ["javascript", "typescript", "python", "go"],
         fix: "Remove all invisible Unicode characters from source code. Use a linter rule to prevent them.",
         fixCode: '// Detect invisible characters with a pre-commit hook:\n// grep -rP "[\\x{200B}\\x{200C}\\x{200D}\\x{FEFF}\\x{00AD}\\x{FE00}-\\x{FE0F}]" src/\n\n// Or add an ESLint rule:\n// "no-irregular-whitespace": "error"',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "1.8.3",
+  "version": "1.8.4",
   "description": "Security MCP for vibe coding. 277 rules, 22 tools for Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",
   "bin": {