guardvibe 3.0.38 → 3.0.39

package/build/tools/check-code.js

@@ -341,6 +341,9 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
         const isWebhookRoute = filePath && /webhook/i.test(filePath);
         const isCronRoute = filePath && /(?:cron|scheduled|jobs?)\//i.test(filePath);
         const isAdminRoute = filePath && /\/admin\//i.test(filePath);
+        // Server-side batch context: scripts, migrations, seeds. These run offline or
+        // on-deploy, not against user requests, so DoS-from-unbounded-results doesn't apply.
+        const isBatchScriptFile = filePath && /\/(?:scripts?|migrations?|seeds?|fixtures?)\//i.test(filePath);
         // Skip rate-limit rules when the file installs a global rate limiter via app.use().
         // Covers `app.use(rateLimit({...}))`, `app.use(limiter)`, `app.use('/api', rateLimit({...}))`,
         // and named middleware vars matching limiter naming conventions.
@@ -370,6 +373,15 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
         // Skip rate limiting for cron and webhook routes
         if (isCronRoute && rateLimitRuleIds.has(rule.id))
             continue;
+        // Skip VG955 (Missing Pagination) in non-user-facing contexts:
+        // scripts, migrations, seeds, cron jobs. These read all records by design
+        // for batch processing, not for serving to clients.
+        if (rule.id === "VG955" && (isBatchScriptFile || isCronRoute))
+            continue;
+        // Skip VG955 in bulk-* server actions (bulk-archive, bulk-approve, bulk-ban etc.)
+        // These intentionally process a caller-provided list of IDs.
+        if (rule.id === "VG955" && filePath && /\/bulk-[\w-]+\.(?:ts|tsx|js|jsx)$/i.test(filePath))
+            continue;
         if (isWebhookRoute && rateLimitRuleIds.has(rule.id))
             continue;
         // Skip rate limiting for admin routes with auth guard
@@ -617,6 +629,18 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
                 if (!hasPublishingFields && !mainPointsToBuild && startsAsApp)
                     continue;
             }
+            // Skip VG955 (Missing Pagination) when the query is bounded by ID(s):
+            // findMany({ where: { id: x } }) returns at most 1; findMany({ where: { id: { in: [...] } } })
+            // is bounded by the caller-provided list. Same applies to *Id fields like partnerId, userId.
+            if (rule.id === "VG955") {
+                const matched = match[0];
+                if (/\bin\s*:\s*\[/i.test(matched))
+                    continue; // where: { x: { in: [...] } }
+                if (/\b(?:id|[a-zA-Z]+Id)\s*:\s*\{?\s*in\s*:/i.test(matched))
+                    continue; // where: { partnerId: { in: ids } }
+                if (/\b(?:id|[a-zA-Z]+Id)\s*:\s*[a-zA-Z_$]/i.test(matched))
+                    continue; // where: { id: someVar }
+            }
             // Skip VG106 for non-secret variable names (TokenCount, tokenBalance, hashMap, etc.)
             // and for comparisons against literals/null/undefined that are emptiness checks,
             // not timing-sensitive secret equality (e.g. token !== '' or apiKey == null).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "3.0.38",
+  "version": "3.0.39",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 365 rules, 38 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis. Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",