guardvibe 3.0.28 → 3.0.29

package/build/data/rules/core.js

@@ -31,7 +31,7 @@ export const coreRules = [
         severity: "high",
         owasp: "A01:2025 Broken Access Control",
         description: "API route handler without authentication middleware or auth check.",
-        pattern: /(?:app|router)\.(get|post|put|delete|patch)\s*\(\s*['"](?!(?:\/(?:api\/)?)?(?:health|status|ping|ready|live|metrics|public|favicon|robots|sitemap)\b)[^'"]*['"]\s*,\s*(?:async\s+)?\(?(?:req|request)/gi,
+        pattern: /(?:app|router)\.(get|post|put|delete|patch)\s*\(\s*['"](?!(?:\/(?:api\/)?)?(?:health|status|ping|ready|live|metrics|public|favicon|robots|sitemap)\b)[^'"]*['"]\s*,\s*(?:async\s+)?\(?\b(?:req|request)\b/gi,
         languages: ["javascript", "typescript"],
         fix: "Add authentication middleware before route handlers: app.get('/api/data', authMiddleware, handler). Use frameworks like Passport.js, Clerk, or Auth0.",
         fixCode: "// Add auth middleware before handler\napp.get('/api/data', authMiddleware, async (req, res) => {\n  // handler code\n});",

package/build/tools/check-code.js

@@ -162,6 +162,16 @@ function hasAuthGuardPattern(code) {
     if (/await\s+(?:\w+\.)*\w*(?:auth|Auth|session|Session|permission|Permission|guard|Guard|verify|Verify|protect|Protect|check|Check|ensure|Ensure|require|Require|assert|Assert|authorize|Authorize)\w*\s*\(/i.test(code)) {
         return true;
     }
+    // Pattern 4: Express-style middleware function with auth-related name (sync, takes req/res/next).
+    // e.g. `function requireAuth(req, res, next)` or `const authMiddleware = (req, res, next) => {`
+    if (/(?:function\s+(?:require|auth|protect|verify|guard|ensure|check|assert|authorize)\w*\s*\(\s*req\b|(?:const|let)\s+(?:require|auth|protect|verify|guard|ensure|check|assert|authorize)\w*\s*=\s*(?:async\s+)?\(\s*req\b)/i.test(code)) {
+        return true;
+    }
+    // Pattern 5: middleware passed inline to express route registration.
+    // e.g. `app.get('/x', requireAuth, handler)` or `router.post('/y', authMiddleware, ...)`.
+    if (/(?:app|router)\.(?:get|post|put|delete|patch|all|use)\s*\([^,)]+,\s*(?:require|auth|protect|verify|guard|ensure|check|assert|authorize|isAuthenticated|isLoggedIn|hasPermission)\w*\s*[,\)]/i.test(code)) {
+        return true;
+    }
     return false;
 }
 /**
@@ -580,6 +590,17 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
                 if (pkgMatch && isLegitimatePackage(pkgMatch[1]))
                     continue;
             }
+            // Skip VG863 for non-publishable apps. Signals that this is an application, not a library:
+            // no publishing fields (bin/exports/module/types), main does not point at a build dir,
+            // and start script runs a runtime/framework directly.
+            if (rule.id === "VG863") {
+                const hasPublishingFields = /"(?:bin|exports|module|types|typings)"\s*:/i.test(code);
+                const mainPointsToBuild = /"main"\s*:\s*"(?:dist|build|lib|out)\//i.test(code);
+                const runtimeNames = "node|nodemon|tsx|ts-node|next|nest|vite|remix|astro";
+                const startsAsApp = new RegExp('"start"\\s*:\\s*"(?:' + runtimeNames + ')\\b', "i").test(code);
+                if (!hasPublishingFields && !mainPointsToBuild && startsAsApp)
+                    continue;
+            }
             // Skip VG106 for non-secret variable names (TokenCount, tokenBalance, hashMap, etc.)
             if (rule.id === "VG106") {
                 const varName = match[0].split(/\s*(?:===|!==|==|!=)/)[0].trim();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "3.0.28",
+  "version": "3.0.29",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 365 rules, 36 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis. Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",