guardvibe 3.0.15 → 3.0.16

package/build/data/rules/nextjs.js

@@ -66,7 +66,7 @@ export const nextjsRules = [
         severity: "medium",
         owasp: "A05:2025 Security Misconfiguration",
         description: "next.config is missing important security headers (Content-Security-Policy, Strict-Transport-Security, X-Frame-Options).",
-        pattern: /(?:async\s+)?headers\s*\(\s*\)(?![\s\S]*(?:X-Frame-Options|Strict-Transport-Security|Content-Security-Policy))/g,
+        pattern: /(?:async\s+)?headers\s*\(\s*\)\s*\{[\s\S]{0,20}return\s+\[(?![\s\S]*(?:X-Frame-Options|Strict-Transport-Security|Content-Security-Policy))/g,
         languages: ["javascript", "typescript"],
         fix: "Add security headers in next.config.ts headers() function.",
         fixCode: '// next.config.ts\nasync headers() {\n  return [{\n    source: "/(.*)",\n    headers: [\n      { key: "X-Frame-Options", value: "DENY" },\n      { key: "X-Content-Type-Options", value: "nosniff" },\n      { key: "Strict-Transport-Security", value: "max-age=63072000; includeSubDomains" },\n    ]\n  }];\n}',

package/build/tools/full-audit.js

@@ -232,18 +232,21 @@ export async function runFullAudit(path, options) {
         const parsed = safeJsonParse(configJson);
         if (parsed) {
             const counts = parseSectionCounts(parsed);
-            const configFindings = (parsed.findings ?? []).map((f) => ({
+            // auditConfig uses "issues" key, not "findings"
+            const rawIssues = parsed.issues ?? parsed.findings ?? [];
+            const configFindings = rawIssues.map((f) => ({
                 ruleId: (f.id ?? f.ruleId ?? "CONFIG"),
                 severity: (f.severity ?? "medium"),
-                file: (f.file ?? ""),
+                file: (Array.isArray(f.files) && f.files.length > 0 ? f.files[0] : (f.file ?? "")),
                 line: (f.line ?? 0),
-                name: (f.name ?? f.description ?? ""),
-                description: (f.description ?? f.details ?? ""),
-                fix: (f.fix ?? f.remediation ?? ""),
+                name: (f.title ?? f.name ?? ""),
+                description: (f.description ?? ""),
+                fix: (f.fix ?? ""),
             }));
             sections.push({ name: "config", status: "ok", ...counts, details: counts.findings === 0 ? "Config secure" : `${counts.findings} config issue(s)`, sectionFindings: configFindings });
-            for (const f of parsed.findings ?? []) {
-                allFindings.push({ ruleId: f.id ?? f.ruleId ?? "CONFIG", severity: f.severity ?? "medium", file: f.file ?? "", line: f.line ?? 0 });
+            for (const f of rawIssues) {
+                const file = Array.isArray(f.files) && f.files.length > 0 ? f.files[0] : (f.file ?? "");
+                allFindings.push({ ruleId: f.id ?? f.ruleId ?? "CONFIG", severity: f.severity ?? "medium", file, line: f.line ?? 0 });
             }
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "3.0.15",
+  "version": "3.0.16",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 335 rules, 36 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis. Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",