guardvibe 3.0.12 → 3.0.14

package/build/tools/full-audit.js

@@ -139,8 +139,9 @@ export async function runFullAudit(path, options) {
             filesScanned = parsed.metadata?.filesScanned ?? 0;
             filesSkipped = parsed.metadata?.filesSkipped ?? 0;
             score = parsed.summary?.score ?? 100;
-            grade = parsed.summary?.grade ?? "A";
-            sections.push({ name: "code", status: "ok", ...counts, details: `Grade ${grade} (${score}/100)` });
+            const codeGrade = parsed.summary?.grade ?? "A";
+            const codeScore = parsed.summary?.score ?? 100;
+            sections.push({ name: "code", status: "ok", ...counts, details: `Code ${codeGrade} (${codeScore}/100)` });
             for (const f of parsed.findings ?? []) {
                 allFindings.push({ ruleId: f.id ?? "unknown", severity: f.severity, file: f.file ?? "", line: f.line ?? 0 });
             }
@@ -254,6 +255,15 @@ export async function runFullAudit(path, options) {
     const totalMedium = sections.reduce((s, sec) => s + sec.medium, 0);
     const totalFindings = sections.reduce((s, sec) => s + sec.findings, 0);
     const rulesApplied = rules.length > 0 ? rules.length : 335;
+    // Adjust score to reflect ALL sections, not just code
+    // Each critical finding deducts 5 points, high deducts 3, medium deducts 1
+    // Score from code scan is the baseline, other sections reduce it further
+    const nonCodeCritical = totalCritical - (sections.find(s => s.name === "code")?.critical ?? 0);
+    const nonCodeHigh = totalHigh - (sections.find(s => s.name === "code")?.high ?? 0);
+    const nonCodeMedium = totalMedium - (sections.find(s => s.name === "code")?.medium ?? 0);
+    const deduction = (nonCodeCritical * 5) + (nonCodeHigh * 3) + (nonCodeMedium * 1);
+    score = Math.max(0, score - deduction);
+    grade = score >= 90 ? "A" : score >= 75 ? "B" : score >= 50 ? "C" : score >= 25 ? "D" : "F";
     const verdict = computeVerdict(totalCritical, totalHigh, totalMedium);
     const coverage = computeCoverage(filesScanned, filesSkipped, rulesApplied);
     const resultHash = computeResultHash(allFindings);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "3.0.12",
+  "version": "3.0.14",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 335 rules, 36 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis. Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",