guardvibe 1.8.7 → 1.8.8

package/build/data/rules/api-security.js

@@ -33,7 +33,7 @@ export const apiSecurityRules = [
         severity: "high",
         owasp: "API2:2023 Broken Authentication",
         description: "Next.js Route Handler that performs data operations without any authentication check. API routes are publicly accessible by default.",
-        pattern: /export\s+(?:async\s+)?function\s+(?:GET|POST|PUT|DELETE|PATCH)\s*\([^)]*\)\s*\{(?:(?!auth\s*\(|getServerSession|currentUser|getUser|requireAuth|verifyToken|checkAuth|clerkClient|getToken|session|protect)[\s\S]){10,}?(?:prisma|db|supabase|query|fetch|sql)\.\w+/g,
+        pattern: /export\s+(?:async\s+)?function\s+(?:GET|POST|PUT|DELETE|PATCH)\s*\([^)]*\)\s*\{(?:(?!auth\s*\(|getServerSession|currentUser|getUser|requireAuth|requireAdmin|requireRole|isAuthenticated|verifyToken|checkAuth|clerkClient|getToken|session|protect|withAuth)[\s\S]){10,}?(?:prisma|db|supabase|query|fetch|sql)\.\w+/g,
         languages: ["javascript", "typescript"],
         fix: "Add authentication at the start of every Route Handler that reads or writes data.",
         fixCode: 'import { auth } from "@clerk/nextjs/server";\n\nexport async function GET() {\n  const { userId } = await auth();\n  if (!userId) return new Response("Unauthorized", { status: 401 });\n  // ... data access\n}',

package/build/tools/check-code.js

@@ -76,6 +76,9 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
         // Skip npm package rules (VG863/VG864/VG865): only apply to package.json files
         if ((rule.id === "VG863" || rule.id === "VG864" || rule.id === "VG865") && filePath && !filePath.endsWith("package.json"))
             continue;
+        // Skip destructive DDL rules (VG540-VG542) in migration directories
+        if (rule.id.startsWith("VG54") && filePath && /(?:migrations?|seeds?|fixtures)\//i.test(filePath))
+            continue;
         // Skip server-only import rule (VG964) for files that are inherently server-only:
         // Route Handlers (app/api/), middleware, instrumentation, next.config
         if (rule.id === "VG964" && filePath && /(?:\/api\/|middleware\.|instrumentation\.|next\.config\.)/.test(filePath))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "1.8.7",
+  "version": "1.8.8",
   "description": "Security MCP for vibe coding. 277 rules, 22 tools for Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",
   "bin": {