guardvibe 3.30.0 → 3.31.0

package/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to GuardVibe are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.31.0] - 2026-07-23
+
+### Added — 6 rules from daily intel: Auth.js critical pair, Next.js/PostCSS July residual windows, AsyncAPI supply-chain IOC, Clerk 5.x gap (456 → 462 rules)
+- **VG1103 — Auth.js v5 beta fail-open + homoglyph (GHSA-8fpg-xm3f-6cx3 / GHSA-7rqj-j65f-68wh, critical, CVSS 9.1).** next-auth 5.0.0-beta.0–beta.31: config errors populate the auth object with a truthy error payload, so `if (req.auth)` grants access to every request (fails open); plus the homoglyph '@' email bypass. Both fixed in beta.32. Exact/= beta pins flagged (caret/tilde prerelease ranges resolve to the fix). 8 tests.
+- **VG1104 — Auth.js homoglyph '@' email normalization bypass (GHSA-7rqj-j65f-68wh, critical, CVSS 9.1).** @auth/core 0.1.0–0.41.2 (fix 0.41.3) + next-auth 4.10.3–4.24.14 (fix 4.24.15) validate email before NFKC normalization — a homoglyph that normalizes to '@' routes magic links to an attacker mailbox (account takeover, no victim interaction). v5 beta window lives in VG1103 (no double-fire). 12 tests.
+- **VG1105 — Next.js July-2026 SSRF cluster residual window (CVE-2026-64649/-64645/-64642/-64641, high).** Server Actions SSRF via untrusted Host header + rewrites()/redirects() hostname SSRF/open-redirect, fixed 15.5.21/16.2.11. Flags exactly the residual exact-pin windows VG1047's advice landed in: 15.5.18–15.5.20 and 16.2.6–16.2.10. 9 tests.
+- **VG1106 — PostCSS sourceMappingURL arbitrary file read residual window (CVE-2026-45623 / GHSA-6g55-p6wh-862q, high).** Unvalidated sourceMappingURL paths (incl. ../ traversal) let attacker-controlled CSS read any Node-readable file; fixed 8.5.12. Flags the residual exact pins 8.5.10–8.5.11 above VG1090's window. 6 tests.
+- **VG1107 — @asyncapi/* compromised releases (July 2026 supply chain, critical).** Five malicious versions across four packages published 2026-07-14 via a CI 'pwn request' bot-credential compromise: @asyncapi/specs 6.11.2-alpha.1 + 6.11.2, generator 3.3.1, generator-components 0.7.1, generator-helpers 1.1.1. Import-time payload → IPFS-staged botnet + credential-stealing RAT. IOC-style, ranges flagged too. 10 tests.
+- **VG1108 — @clerk/nextjs 5.x middleware route-protection bypass (CVE-2026-41248 / GHSA-vqx2-fgx2-5wq9, critical, CVSS 9.1).** Fills the 5.0.0–5.7.5 version-space no existing Clerk rule covers (1.x/2.x = VG925, 4.x = VG1096, 6.x/7.x ⊂ VG1045); 5.x backport fix 5.7.6. 0-FP semver: caret-5.x/tilde-5.7 resolve to the fix. 9 tests.
+
+Skipped from the brief's Section-6 proposals (all covered or FP-prone, verified): GV-AUTHJS-FAILOPEN-001 behavioral truthy-check regex (`if (session)` is the standard, safe pattern on patched versions — version pin covers the CVE); GV-NEXT-SERVERACTION-SSRF-002 (taint-analysis SSRF sink + VG120 cover the behavioral case); GV-AISDK-UPLOAD-MIME-003 (File Upload Without Type Validation rule + the AI SDK version pin cover it). WordPress SQLi/RCE KEV chain and Langflow CVE-2026-0770 KEV are non-JS/out of stack.
+
+CVE version-pin rule count 83 → 89.
+
 ## [3.30.0] - 2026-07-14
 
 ### Added — 3 rules from daily intel: jscrambler + Injective supply-chain IOCs, n8n-mcp cross-tenant (453 → 456 rules)

package/README.md

@@ -9,13 +9,13 @@
 > **Security infrastructure your AI can't be.**
 > No matter how good your coding agent gets, it can't know the CVE published after its training cutoff, it can't deterministically guarantee the same check every run, it can't hold your whole repo in context, and it can't objectively review its own code. GuardVibe does all four — the deterministic, post-cutoff-current, whole-repo, author-independent verification layer for AI-written code.
 
-- **🗓️ Knows what your AI doesn't.** CVE rules refreshed **daily** from GHSA / OSV.dev / CISA KEV — GuardVibe flags vulnerable dependencies published *after* your model's training cutoff. (83 CVE rules, `npm run intel` daily triage.)
+- **🗓️ Knows what your AI doesn't.** CVE rules refreshed **daily** from GHSA / OSV.dev / CISA KEV — GuardVibe flags vulnerable dependencies published *after* your model's training cutoff. (89 CVE rules, `npm run intel` daily triage.)
 - **🎯 Deterministic, not probabilistic.** Same code = same result, every run (content-hashed). Your AI guesses; GuardVibe doesn't.
 - **🗺️ Sees the whole repo.** Cross-file taint + auth-coverage across every route — catches the unprotected endpoint your agent's narrow context missed.
 - **🔍 An independent second pair of eyes.** The thing that wrote the code can't review itself. GuardVibe is the outside checker on AI-written code — in the loop *while* your AI codes (real-time edit hook), not after.
 - **⬅️ NEW: Starts before the first line of code.** Every scanner on earth — including your agent reviewing itself — acts *after* the code exists. [`secure_prompt`](#prompt-level-security-shift-left) acts *before*: it analyzes the coding prompt itself, detects the stack and attack surfaces it implies, and embeds severity-ranked GuardVibe requirements into the prompt your AI executes. The vulnerability is prevented, not caught. Deterministic, zero LLM calls — and if the prompt is already secure, it passes through untouched.
 
-**The security MCP built for vibe coding.** 456 security rules, 39 tools covering the entire AI-generated code journey — from the prompt itself to production deployment.
+**The security MCP built for vibe coding.** 462 security rules, 39 tools covering the entire AI-generated code journey — from the prompt itself to production deployment.
 
 Works with **Claude Code, Cursor, Gemini CLI, Codex, VS Code (Copilot), Windsurf**, and any MCP-compatible coding agent.
 
@@ -27,11 +27,11 @@ Works with **Claude Code, Cursor, Gemini CLI, Codex, VS Code (Copilot), Windsurf
 
 Most security tools are built for enterprise security teams. GuardVibe is built for **you** — the developer using AI to build and ship web apps fast.
 
-- **456 security rules, 39 tools** purpose-built for the stacks AI agents generate
+- **462 security rules, 39 tools** purpose-built for the stacks AI agents generate
 - **Zero setup friction** — `npx guardvibe` and you're scanning
 - **No account required** — runs 100% locally, no API keys, no cloud
 - **Understands your stack** — not generic SAST, but rules that know Next.js, Supabase, Stripe, Clerk, and the tools you actually use
-- **CVE version intelligence** — detects 83 known vulnerable package versions in package.json, refreshed every day from GHSA / OSV.dev / CISA KEV
+- **CVE version intelligence** — detects 89 known vulnerable package versions in package.json, refreshed every day from GHSA / OSV.dev / CISA KEV
 - **AI agent & MCP security** — detects MCP server vulnerabilities, tool-description prompt injection (OWASP MCP Top 10), model-controlled sandbox-disable flags, excessive AI permissions, indirect prompt injection
 - **Auto-fix suggestions** — `fix_code` tool returns concrete patches and structured edits the AI agent can apply mechanically. Coverage: hardcoded credentials → env-var migration; public-prefix LLM keys (`NEXT_PUBLIC_/VITE_/EXPO_PUBLIC_/REACT_APP_`) → prefix removal; CORS wildcards → env allowlist; `dangerouslyAllowBrowser` flags → drop; sandbox bypass flags (`unsafe`/`noSandbox`/`allowEval`) → drop; agent loops → add `maxSteps`; raw-HTML React props → `<ReactMarkdown>`; missing auth checks → insert auth guard; SQL injection → parameterized queries; missing rate limiters / CSRF / security headers → snippet templates.
 - **Pre-commit hook** — block insecure code before it reaches your repo
@@ -62,10 +62,10 @@ GuardVibe is purpose-built for the AI coding workflow. Traditional tools are exc
 | AI/LLM security (prompt injection, MCP, tool abuse) | 68 rules | Experimental/None | None |
 | AI host security (CVE-2025-59536, CVE-2026-21852) | `guardvibe doctor` | Not supported | Not supported |
 | Auto-fix suggestions for AI agents | `fix_code` tool | CLI autofix | Not supported |
-| CVE version detection | 83 packages, refreshed daily | Extensive | Extensive |
+| CVE version detection | 89 packages, refreshed daily | Extensive | Extensive |
 | Compliance mapping (SOC2, PCI-DSS, HIPAA) | Built-in | Paid tier | None |
 | SARIF CI/CD export | Yes | Yes | Limited |
-| Rule count | 456 (focused, 68 AI-native) | 5000+ (broad) | N/A |
+| Rule count | 462 (focused, 68 AI-native) | 5000+ (broad) | N/A |
 
 **When to use GuardVibe:** You're building with AI agents and want security scanning integrated into your coding workflow — no dashboard, no account, no CI setup.
 
@@ -190,7 +190,7 @@ React Native, Expo — AsyncStorage secrets, deep link token exposure, hardcoded
 ### Firebase
 Firestore security rules, Firebase Admin SDK exposure, storage rules, custom token validation
 
-### CVE Version Intelligence (83 CVEs, refreshed daily)
+### CVE Version Intelligence (89 CVEs, refreshed daily)
 **Frameworks:** Next.js (CVE-2024-34351, CVE-2024-46982, CVE-2025-29927, CVE-2026-23869, CVE-2026-44573 / 44574 / 44575 / 44578 / 44579 / 45109 May 2026 cluster), React + react-server-dom-* (CVE-2025-55182, CVE-2026-23870), Express, Hono pre-4.12.18 cluster, @vitejs/plugin-rsc, Strapi content-type-builder (CVE-2026-22599)
 **Auth:** Clerk middleware bypass (GHSA-vqx2), Clerk `has()` org/billing/reverification bypass (GHSA-w24r), Clerk `clerkFrontendApiProxy` SSRF (CVE-2026-34076), NextAuth.js (2 CVEs), jsonwebtoken
 **ORMs / SQL:** Drizzle SQL identifier injection (CVE-2026-39356) + Drizzle `sql.raw` interpolation (VG1073), MikroORM SQL injection (CVE-2026-44680), Prisma raw-query call-form, Kysely JSON-path traversal (CVE-2026-44635)
@@ -302,7 +302,7 @@ The offline tier is also a `full_audit` section (online never runs inside the au
 { "slopscan": { "online": true, "allow": ["@myorg/internal-pkg"] } }
 ```
 
-## Security Rules (456 rules across 25 modules)
+## Security Rules (462 rules across 25 modules)
 
 | Category | Rules | Coverage |
 |----------|-------|----------|
@@ -321,7 +321,7 @@ The offline tier is also a `full_audit` section (online never runs inside the au
 | AI / LLM Security | 33 | Prompt injection, MCP SSRF, excessive agency, indirect injection |
 | **AI Host Security** | **14** | **CVE-2025-59536 hook injection, CVE-2026-21852 base URL hijack, MCP config audit** |
 | **AI Tool Runtime** | **14** | **MCP tool output sanitization, obfuscated descriptions, safety bypass** |
-| CVE Version Intelligence | 81 | Known vulnerable versions in package.json — incl. Vite dev-server cmd injection (CVE-2024-52011), React Router 7 cluster (CVE-2026-33245/42211/42342), DOMPurify XSS (CVE-2026-47423), Better Auth bypass (CVE-2026-45337), Axios supply-chain backdoor |
+| CVE Version Intelligence | 87 | Known vulnerable versions in package.json — incl. Vite dev-server cmd injection (CVE-2024-52011), React Router 7 cluster (CVE-2026-33245/42211/42342), DOMPurify XSS (CVE-2026-47423), Better Auth bypass (CVE-2026-45337), Axios supply-chain backdoor |
 | Shell / Bash | 5 | Pipe to bash, chmod 777, rm -rf, sudo password |
 | SQL | 4 | DROP/DELETE without WHERE, stacked queries, GRANT ALL |
 | Supply Chain | 19 | Malicious install scripts, lockfile integrity, dependency confusion, typosquat detection |

package/build/data/rules/cve-versions.js

@@ -973,4 +973,76 @@ export const cveVersionRules = [
         fixCode: '// package.json\n"n8n-mcp": "^2.56.1"  // or latest',
         compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.5.10", "HIPAA:§164.312(a)"],
     },
+    {
+        id: "VG1103",
+        name: "Auth.js v5 Beta Fail-Open Auth Bypass + Homoglyph Email Bypass (GHSA-8fpg-xm3f-6cx3 / GHSA-7rqj-j65f-68wh)",
+        severity: "critical",
+        owasp: "A07:2025 Authentication Failures",
+        description: "next-auth 5.0.0-beta.0 through 5.0.0-beta.31 is affected by two critical advisories fixed together in 5.0.0-beta.32 (CVSS 9.1 each, disclosed 2026-07-23). Fail-open authorization bypass (GHSA-8fpg-xm3f-6cx3, CWE-636): when Auth.js hits a server-side configuration error (missing provider config, unset AUTH_SECRET), the auth object is populated with a truthy error payload instead of null, so existence checks like `if (req.auth)` grant access to EVERY request — the app fails open when the auth layer is broken. Homoglyph email bypass (GHSA-7rqj-j65f-68wh): email addresses are validated before Unicode NFKC normalization, so a homoglyph that normalizes to '@' becomes a second '@' after mail-library normalization, routing magic links to an attacker mailbox — account takeover without victim interaction. 0-FP semver: caret/tilde prerelease ranges (^/~5.0.0-beta.x) resolve to the fixed beta.32, so only exact/= beta pins (the common form for betas) are flagged.",
+        pattern: /["']next-auth["']\s*:\s*["']=?\s*5\.0\.0-beta\.(?:[0-9]|[12]\d|3[01])(?![0-9])["']/g,
+        languages: ["json"],
+        fix: "Upgrade next-auth to 5.0.0-beta.32 or later: npm install next-auth@beta. As defence-in-depth, never gate on bare object existence — check a concrete session property (req.auth?.user) so a fail-open error payload can never pass an auth check.",
+        fixCode: '// package.json\n"next-auth": "5.0.0-beta.32"  // or later beta / stable\n\n// Defence-in-depth — check a concrete property, not bare truthiness\n// BAD:  if (req.auth) { ... }\nif (req.auth?.user) { /* authenticated */ } else { return unauthorized(); }',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.5.10", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG1104",
+        name: "Auth.js Homoglyph '@' Email Normalization Bypass — @auth/core & next-auth v4 (GHSA-7rqj-j65f-68wh)",
+        severity: "critical",
+        owasp: "A07:2025 Authentication Failures",
+        description: "@auth/core 0.1.0 through 0.41.2 and next-auth 4.10.3 through 4.24.14 validate email addresses BEFORE applying Unicode normalization (CVSS 9.1, disclosed 2026-07-23). An attacker registers an address containing a Unicode homoglyph that visually resembles and NFKC-normalizes to '@': it passes validation as a single-@ address, but mail libraries normalize it into a second '@', routing passwordless/magic-link sign-in emails to an attacker-controlled mailbox instead of the victim — account takeover without victim interaction. Fixed in @auth/core 0.41.3 and next-auth 4.24.15 (the v5 beta window is covered by VG1103, same fix beta.32 — no double-fire). 0-FP semver: @auth/core is on the 0.x line where caret/tilde pin the minor, so any range in 0.1–0.40 stays vulnerable and is flagged, and within 0.41 only exact/= 0.41.0–0.41.2; for next-auth a caret on 4.x resolves to 4.24.15+, so only tilde/exact pins in 4.10.3–4.23.x and exact/= 4.24.0–4.24.14 are flagged (4.10.0–4.10.2 predate the flaw and are excluded).",
+        pattern: /["']@auth\/core["']\s*:\s*["'](?:(?:\^|~|>=?)?\s*0\.(?:[1-9]|[1-3]\d|40)\.\d+|=?\s*0\.41\.[0-2](?![0-9]))["']|["']next-auth["']\s*:\s*["'](?:(?:~|=)?\s*4\.10\.(?:[3-9]|[1-9]\d)(?![0-9])|(?:~|=)?\s*4\.(?:1[1-9]|2[0-3])\.\d+|=?\s*4\.24\.(?:[0-9]|1[0-4])(?![0-9]))["']/g,
+        languages: ["json"],
+        fix: "Upgrade @auth/core to 0.41.3+ and next-auth to 4.24.15+ (or 5.0.0-beta.32+ on the beta line): npm install @auth/core@latest next-auth@latest. As defence-in-depth, NFKC-normalize email input BEFORE validation and reject any address containing more than one '@' after normalization.",
+        fixCode: '// package.json\n"@auth/core": "^0.41.3",  // or latest\n"next-auth": "^4.24.15"  // v4 line\n\n// Defence-in-depth — normalize BEFORE validating\nconst normalized = email.normalize("NFKC");\nif ((normalized.match(/@/g) ?? []).length !== 1) throw new Error("invalid email");',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.5.10", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG1105",
+        name: "Next.js Server Actions / Rewrites SSRF Cluster July 2026 (CVE-2026-64649 / -64645 / -64642 / -64641)",
+        severity: "high",
+        owasp: "A10:2025 Server-Side Request Forgery",
+        description: "Next.js is affected by a 2026-07-22 advisory cluster fixed in 15.5.21 and 16.2.11: SSRF via Server Actions when the app does not enforce a trusted Host header — an attacker controlling Host-associated headers makes Server Actions send outbound requests to attacker hosts, primarily on self-hosted/custom-server deployments without upstream host pinning (CVE-2026-64649 / GHSA-89xv-2m56-2m9x, CVSS 8.3); SSRF/open-redirect via rewrites()/redirects() that build destination hostnames from user-controlled input (CVE-2026-64645, affects from 12.0.0); plus a middleware bypass (CVE-2026-64642) and Server Actions DoS (CVE-2026-64641) from the same wave. Versions below 15.5.18 are already flagged by VG1047 (the May-2026 cluster superset), so this rule covers exactly the residual windows that pin followed VG1047's advice into: exact/= pins 15.5.18–15.5.20 and 16.2.6–16.2.10. Caret/tilde ranges within 15.5/16.2 resolve to the fixed 15.5.21/16.2.11 and are not flagged.",
+        pattern: /["']next["']\s*:\s*["']=?\s*(?:15\.5\.(?:1[89]|20)|16\.2\.(?:[6-9]|10))(?![0-9])["']/g,
+        languages: ["json"],
+        fix: "Upgrade Next.js to 15.5.21+ or 16.2.11+: npm install next@latest. If you cannot upgrade and self-host, validate Host and X-Forwarded-Host at the proxy/edge layer or set __NEXT_PRIVATE_ORIGIN to the deployment's legitimate origin; never build rewrite/redirect destination hostnames from user input.",
+        fixCode: '// package.json\n"next": "^16.2.11"  // or "^15.5.21" for the 15.x line',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.2", "PCI-DSS:Req6.5.10"],
+    },
+    {
+        id: "VG1106",
+        name: "PostCSS sourceMappingURL Arbitrary File Read (CVE-2026-45623 / GHSA-6g55-p6wh-862q)",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "postcss versions through 8.5.11 process sourceMappingURL comments in CSS without path validation (CVSS 7.5, disclosed 2026-07-23): absolute paths, relative paths, and ../ traversal are all accepted, so an attacker who controls CSS input (CMS themes, user-uploaded styles, third-party packages in the build) can make the host process read any file readable by Node — leaking the first ~10 bytes through the JSON.parse SyntaxError message, probing file existence, or causing DoS via large/device files. Triggered by default, no special configuration needed. Fixed in 8.5.12. Versions below 8.5.10 are already flagged by VG1090 (the </style> stringify XSS pin), so this rule covers exactly the residual window that pin recommended into: exact/= pins of 8.5.10 and 8.5.11. Caret/tilde ranges within 8.x/8.5 resolve to the fixed 8.5.12 and are not flagged.",
+        pattern: /["']postcss["']\s*:\s*["']=?\s*8\.5\.1[01](?![0-9])["']/g,
+        languages: ["json"],
+        fix: "Upgrade postcss to 8.5.12 or later: npm install postcss@latest. Treat any pipeline that feeds untrusted CSS into PostCSS as sensitive until upgraded; do not process user-supplied stylesheets with an older version.",
+        fixCode: '// package.json\n"postcss": "^8.5.12"  // or latest',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.2", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG1107",
+        name: "@asyncapi/* Compromised Releases (Supply Chain Attack July 2026)",
+        severity: "critical",
+        owasp: "A03:2025 Software Supply Chain Failures",
+        description: "Five malicious versions across four @asyncapi packages (3M+ combined weekly downloads) were published on 14 July 2026 within ~90 minutes after the release bot's credentials were compromised through a publicly disclosed GitHub Actions 'pwn request' flaw in the project CI: @asyncapi/specs 6.11.2-alpha.1 and 6.11.2, @asyncapi/generator 3.3.1, @asyncapi/generator-components 0.7.1, and @asyncapi/generator-helpers 1.1.1. The payload executes at IMPORT time (not install), downloads a multi-stage botnet framework over IPFS, and installs a credential-stealing RAT targeting browser passwords, SSH keys, npm/GitHub tokens, cloud credentials, and crypto wallets, with worm-like propagation and multi-channel C2 (HTTP, Nostr, IPFS, BitTorrent, libp2p, Ethereum). All malicious versions were removed from npm, but any lockfile that resolved to them indicates an actively compromised environment; ranges are flagged too because installs during the attack window may have resolved to them.",
+        pattern: /["']@asyncapi\/specs["']\s*:\s*["'](?:\^|~|>=?)?\s*6\.11\.2(?:-alpha\.1)?(?![0-9-])["']|["']@asyncapi\/generator["']\s*:\s*["'](?:\^|~|>=?)?\s*3\.3\.1(?![0-9])["']|["']@asyncapi\/generator-components["']\s*:\s*["'](?:\^|~|>=?)?\s*0\.7\.1(?![0-9])["']|["']@asyncapi\/generator-helpers["']\s*:\s*["'](?:\^|~|>=?)?\s*1\.1\.1(?![0-9])["']/g,
+        languages: ["json"],
+        fix: "Regenerate the lockfile against current registry state (malicious versions are unpublished), upgrade to the latest clean releases, and if a malicious version was ever installed treat the machine as compromised: rotate browser-stored passwords, SSH keys, npm/GitHub tokens, cloud credentials, and move crypto wallets. Add --ignore-scripts / provenance checks in CI (see VG1070).",
+        fixCode: '// COMPROMISED — any lockfile resolution to these is an incident:\n// "@asyncapi/specs": "6.11.2" / "6.11.2-alpha.1"\n// "@asyncapi/generator": "3.3.1"\n// "@asyncapi/generator-components": "0.7.1"\n// "@asyncapi/generator-helpers": "1.1.1"\n\n// Safe — regenerate lockfile, pin current clean releases\n// Post-incident: rotate SSH/npm/GitHub/cloud credentials, move wallets',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2", "PCI-DSS:Req6.5.10"],
+    },
+    {
+        id: "VG1108",
+        name: "Clerk Next.js 5.x Middleware Route Protection Bypass (CVE-2026-41248 / GHSA-vqx2-fgx2-5wq9)",
+        severity: "critical",
+        owasp: "A01:2025 Broken Access Control",
+        description: "@clerk/nextjs versions 5.0.0 through 5.7.5 are vulnerable to the createRouteMatcher middleware route-protection bypass (CVE-2026-41248, CVSS 9.1): crafted requests trick the matcher into mis-validating a route, skipping middleware gating and reaching protected downstream handlers without authentication. Fixed in the 5.x backport 5.7.6. This rule fills the 5.x version-space: the 1.x/2.x windows are VG925, the 4.x auth()/getAuth() IDOR is VG1096, and the 6.x/7.x windows are inside VG1045's flagged space — none of them cover 5.x. 0-FP semver: a caret on 5.x and a tilde within 5.7 resolve to the fixed 5.7.6, so only tilde/exact pins in 5.0–5.6 and exact/= pins 5.7.0–5.7.5 are flagged.",
+        pattern: /["']@clerk\/nextjs["']\s*:\s*["'](?:(?:~|=)?\s*5\.[0-6]\.\d+|=?\s*5\.7\.[0-5](?![0-9]))["']/g,
+        languages: ["json"],
+        fix: "Upgrade @clerk/nextjs to 5.7.6 or later (or migrate to the current 6.x/7.x line): npm install @clerk/nextjs@latest. As defence-in-depth, re-verify auth inside protected route handlers rather than relying solely on middleware gating.",
+        fixCode: '// package.json\n"@clerk/nextjs": "^5.7.6"  // legacy 5.x; prefer migrating to ^6 / ^7\n\n// Defence-in-depth — verify auth in the handler too\nimport { auth } from "@clerk/nextjs/server";\nexport async function GET() {\n  const { userId } = await auth();\n  if (!userId) return new Response("Unauthorized", { status: 401 });\n}',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.5.10", "HIPAA:§164.312(a)"],
+    },
 ];

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "guardvibe",
-  "version": "3.30.0",
+  "version": "3.31.0",
   "mcpName": "io.github.goklab/guardvibe",
-  "description": "Security infrastructure your AI can't be — deterministic, current past your model's training cutoff, whole-repo-aware, author-independent. Security MCP for vibe coding. 456 rules, 39 tools, CLI + doctor. Prompt-level shift-left security (secure_prompt — embed security requirements BEFORE code generation), host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis. 83 CVE rules refreshed daily from GHSA/OSV/CISA KEV — jscrambler infostealer compromise, @injectivelabs/sdk-ts wallet-key backdoor, n8n-mcp cross-tenant isolation, js-cookie cookie-attribute injection, PostCSS </style> stringify XSS, Axios proxy prototype-pollution gadget, Vite dev-server RCE, React Router 7 cluster, DOMPurify XSS, Better Auth bypass, Miasma @redhat-cloud-services compromise, Next.js May 2026 13-advisory cluster, Drizzle/MikroORM/Kysely SQL injection, Axios proxy-auth redirect leak, Hono setCookie attribute injection, Clerk SSRF, tRPC prototype pollution, @tanstack supply-chain, node-ipc protestware, OpenClaude sandbox bypass, plus the full AI-generated stack (Supabase, Stripe, Prisma, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK). 68 AI-native rules including OWASP MCP Top 10 tool-description prompt injection (VG1068), model-controlled sandbox-disable flag detection (VG1063), Session messenger exfil endpoint IOC (VG1075), and CI/CD supply-chain hardening (VG1070 npm --expect-provenance / --ignore-scripts enforcement).",
+  "description": "Security infrastructure your AI can't be — deterministic, current past your model's training cutoff, whole-repo-aware, author-independent. Security MCP for vibe coding. 462 rules, 39 tools, CLI + doctor. Prompt-level shift-left security (secure_prompt — embed security requirements BEFORE code generation), host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis. 89 CVE rules refreshed daily from GHSA/OSV/CISA KEV — jscrambler infostealer compromise, @injectivelabs/sdk-ts wallet-key backdoor, n8n-mcp cross-tenant isolation, js-cookie cookie-attribute injection, PostCSS </style> stringify XSS, Axios proxy prototype-pollution gadget, Vite dev-server RCE, React Router 7 cluster, DOMPurify XSS, Better Auth bypass, Miasma @redhat-cloud-services compromise, Next.js May 2026 13-advisory cluster, Drizzle/MikroORM/Kysely SQL injection, Axios proxy-auth redirect leak, Hono setCookie attribute injection, Clerk SSRF, tRPC prototype pollution, @tanstack supply-chain, node-ipc protestware, OpenClaude sandbox bypass, plus the full AI-generated stack (Supabase, Stripe, Prisma, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK). 68 AI-native rules including OWASP MCP Top 10 tool-description prompt injection (VG1068), model-controlled sandbox-disable flag detection (VG1063), Session messenger exfil endpoint IOC (VG1075), and CI/CD supply-chain hardening (VG1070 npm --expect-provenance / --ignore-scripts enforcement).",
   "type": "module",
   "bin": {
     "guardvibe": "build/cli.js",
@@ -111,9 +111,12 @@
     "zod": "^3.25.0"
   },
   "overrides": {
-    "hono": "^4.12.25",
-    "fast-uri": "^3.1.2",
-    "ip-address": "^10.2.0"
+    "hono": "^4.12.31",
+    "fast-uri": "^4.1.1",
+    "ip-address": "^10.2.0",
+    "@hono/node-server": "^1.19.15 || ^2.0.11",
+    "body-parser": "^2.3.0",
+    "brace-expansion": "^5.0.8"
   },
   "devDependencies": {
     "@types/node": "^25.5.2",