guardvibe 3.1.15 → 3.1.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/build/data/rules/other-services.js +4 -4
  2. package/package.json +1 -1
package/build/data/rules/other-services.js CHANGED
@@ -28,8 +28,8 @@ export const otherServiceRules = [
28
28
  name: "Neon/Postgres Connection String Exposure",
29
29
  severity: "critical",
30
30
  owasp: "A07:2025 Sensitive Data Exposure",
31
- description: "Neon or PostgreSQL connection string hardcoded in source code. Contains hostname, credentials, and database name.",
32
- pattern: /(?:DATABASE_URL|connectionString|connection_string|pgConnectionString)\s*[:=]\s*["']postgres(?:ql)?:\/\/[^"'\s]{10,}["']/gi,
31
+ description: "Neon or PostgreSQL connection string hardcoded in source code with embedded credentials (user:pass@host shape). Local/docker URIs without credentials (e.g. postgres://localhost/db) are not flagged.",
32
+ pattern: /(?:DATABASE_URL|connectionString|connection_string|pgConnectionString)\s*[:=]\s*["']postgres(?:ql)?:\/\/[^"'\s/@]*@[^"'\s]+["']/gi,
33
33
  languages: ["javascript", "typescript"],
34
34
  fix: "Use DATABASE_URL environment variable. Never hardcode connection strings.",
35
35
  fixCode: 'import { neon } from "@neondatabase/serverless";\nconst sql = neon(process.env.DATABASE_URL!);',
@@ -52,8 +52,8 @@ export const otherServiceRules = [
52
52
  name: "MongoDB Connection String Exposure",
53
53
  severity: "critical",
54
54
  owasp: "A07:2025 Sensitive Data Exposure",
55
- description: "MongoDB connection string hardcoded in source code. Contains credentials and cluster information.",
56
- pattern: /(?:MONGODB_URI|MONGO_URL|mongoUri|mongoUrl|connectionString)\s*[:=]\s*["']mongodb(?:\+srv)?:\/\/[^"'\s]{10,}["']/gi,
55
+ description: "MongoDB connection string hardcoded in source code with embedded credentials (user:pass@host shape). Local/docker URIs without credentials (e.g. mongodb://localhost/db) are not flagged.",
56
+ pattern: /(?:MONGODB_URI|MONGO_URL|mongoUri|mongoUrl|connectionString)\s*[:=]\s*["']mongodb(?:\+srv)?:\/\/[^"'\s/@]*@[^"'\s]+["']/gi,
57
57
  languages: ["javascript", "typescript"],
58
58
  fix: "Use MONGODB_URI environment variable. Never hardcode connection strings.",
59
59
  fixCode: 'import { MongoClient } from "mongodb";\nconst client = new MongoClient(process.env.MONGODB_URI!);',
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "guardvibe",
3
- "version": "3.1.15",
3
+ "version": "3.1.16",
4
4
  "mcpName": "io.github.goklab/guardvibe",
5
5
  "description": "Security MCP for vibe coding. 390 rules, 36 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis, +25 AI-native rules (MCP supply-chain, RAG/vector poisoning, agent loop DoS, public-prefix LLM keys, sandbox bypass). Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
6
6
  "type": "module",