hullproof 0.0.0-stage → 0.5.0

package/detectors/mobile.json

@@ -0,0 +1,22 @@
+{
+  "category": "mobile",
+  "entries": [
+    {"id": "android", "signals": [
+      {"files": ["AndroidManifest.xml"]},
+      {"files": ["build.gradle", "build.gradle.kts"], "regex": "com\\.android\\.(application|library)", "confidence": "high"}]},
+    {"id": "capacitor", "deps": {"npm": ["@capacitor/core"]}, "signals": [{"files": ["capacitor.config.json", "capacitor.config.ts", "capacitor.config.js"]}]},
+    {"id": "cordova", "deps": {"npm": ["cordova", "cordova-android", "cordova-ios"]}, "signals": [{"files": ["config.xml"], "regex": "xmlns(:cdv)?=\"http://cordova\\.apache\\.org", "confidence": "high"}]},
+    {"id": "dotnet-maui", "signals": [{"files": ["*.csproj"], "regex": "<UseMaui>\\s*true", "confidence": "high"}]},
+    {"id": "expo", "deps": {"npm": ["expo"]}, "signals": [
+      {"files": ["app.json"], "regex": "^\\s*\"expo\"\\s*:", "confidence": "high"},
+      {"files": ["app.config.js", "app.config.ts"]},
+      {"files": ["eas.json"]}]},
+    {"id": "flutter", "deps": {"pub": ["flutter"]}, "imports": {"dart": ["flutter"]}, "signals": [{"files": ["pubspec.yaml"], "regex": "^\\s+sdk:\\s*flutter\\s*$", "confidence": "high"}]},
+    {"id": "ionic", "deps": {"npm": ["@ionic/*"]}, "signals": [{"files": ["ionic.config.json"]}]},
+    {"id": "ios", "imports": {"swift": ["UIKit", "SwiftUI"]}, "signals": [
+      {"files": ["**/*.xcodeproj/project.pbxproj"]},
+      {"files": ["Podfile"], "regex": "^\\s*platform\\s+:ios", "confidence": "high"},
+      {"files": ["Info.plist"], "regex": "UIApplicationSceneManifest|LSRequiresIPhoneOS|UILaunchStoryboardName", "confidence": "high"}]},
+    {"id": "react-native", "deps": {"npm": ["react-native"]}, "imports": {"js": ["react-native"]}}
+  ]
+}

package/detectors/package_managers.json

@@ -0,0 +1,39 @@
+{
+  "category": "package_managers",
+  "entries": [
+    {"id": "bun", "signals": [
+      {"files": ["bun.lockb", "bun.lock"], "attrs": {"lockfiles": "$file"}},
+      {"files": ["package.json"], "regex": "\"packageManager\"\\s*:\\s*\"bun@", "confidence": "high", "attrs": {"manifests": "$file"}}]},
+    {"id": "bundler", "signals": [{"files": ["Gemfile"], "attrs": {"manifests": "$file"}}, {"files": ["Gemfile.lock"], "attrs": {"lockfiles": "$file"}}]},
+    {"id": "cargo", "signals": [{"files": ["Cargo.toml"], "attrs": {"manifests": "$file"}}, {"files": ["Cargo.lock"], "attrs": {"lockfiles": "$file"}}]},
+    {"id": "carthage", "signals": [{"files": ["Cartfile"], "attrs": {"manifests": "$file"}}, {"files": ["Cartfile.resolved"], "attrs": {"lockfiles": "$file"}}]},
+    {"id": "cocoapods", "signals": [{"files": ["Podfile"], "attrs": {"manifests": "$file"}}, {"files": ["Podfile.lock"], "attrs": {"lockfiles": "$file"}}]},
+    {"id": "composer", "signals": [{"files": ["composer.json"], "attrs": {"manifests": "$file"}}, {"files": ["composer.lock"], "attrs": {"lockfiles": "$file"}}]},
+    {"id": "conda", "signals": [{"files": ["environment.yml", "environment.yaml"], "regex": "^dependencies:", "attrs": {"manifests": "$file"}}]},
+    {"id": "deno", "signals": [{"files": ["deno.json", "deno.jsonc"], "attrs": {"manifests": "$file"}}, {"files": ["deno.lock"], "attrs": {"lockfiles": "$file"}}]},
+    {"id": "go-modules", "signals": [{"files": ["go.mod"], "attrs": {"manifests": "$file"}}, {"files": ["go.sum"], "attrs": {"lockfiles": "$file"}}]},
+    {"id": "gradle", "signals": [{"files": ["build.gradle", "build.gradle.kts", "settings.gradle", "settings.gradle.kts"], "attrs": {"manifests": "$file"}}, {"files": ["gradle.lockfile"], "attrs": {"lockfiles": "$file"}}]},
+    {"id": "hex", "signals": [{"files": ["mix.exs"], "attrs": {"manifests": "$file"}}, {"files": ["mix.lock"], "attrs": {"lockfiles": "$file"}}]},
+    {"id": "maven", "signals": [{"files": ["pom.xml"], "attrs": {"manifests": "$file"}}]},
+    {"id": "npm", "signals": [
+      {"files": ["package-lock.json", "npm-shrinkwrap.json"], "attrs": {"lockfiles": "$file"}},
+      {"files": ["package.json"], "regex": "\"packageManager\"\\s*:\\s*\"npm@", "confidence": "high", "attrs": {"manifests": "$file"}}]},
+    {"id": "nuget", "signals": [{"files": ["*.csproj", "*.fsproj", "*.vbproj", "packages.config"], "attrs": {"manifests": "$file"}}, {"files": ["packages.lock.json"], "attrs": {"lockfiles": "$file"}}]},
+    {"id": "pdm", "signals": [{"files": ["pdm.lock"], "attrs": {"lockfiles": "$file"}}, {"files": ["pyproject.toml"], "regex": "^\\[tool\\.pdm\\b", "confidence": "high", "attrs": {"manifests": "$file"}}]},
+    {"id": "pip", "signals": [{"files": ["requirements*.txt", "**/requirements/*.txt", "requirements*.in"], "attrs": {"manifests": "$file"}}]},
+    {"id": "pipenv", "signals": [{"files": ["Pipfile"], "attrs": {"manifests": "$file"}}, {"files": ["Pipfile.lock"], "attrs": {"lockfiles": "$file"}}]},
+    {"id": "pnpm", "signals": [
+      {"files": ["pnpm-lock.yaml"], "attrs": {"lockfiles": "$file"}},
+      {"files": ["pnpm-workspace.yaml"], "attrs": {"manifests": "$file"}},
+      {"files": ["package.json"], "regex": "\"packageManager\"\\s*:\\s*\"pnpm@", "confidence": "high", "attrs": {"manifests": "$file"}}]},
+    {"id": "poetry", "signals": [{"files": ["poetry.lock"], "attrs": {"lockfiles": "$file"}}, {"files": ["pyproject.toml"], "regex": "^\\[tool\\.poetry\\]", "confidence": "high", "attrs": {"manifests": "$file"}}]},
+    {"id": "pub", "signals": [{"files": ["pubspec.yaml"], "attrs": {"manifests": "$file"}}, {"files": ["pubspec.lock"], "attrs": {"lockfiles": "$file"}}]},
+    {"id": "sbt", "signals": [{"files": ["build.sbt"], "attrs": {"manifests": "$file"}}]},
+    {"id": "swift-package-manager", "signals": [{"files": ["Package.swift"], "attrs": {"manifests": "$file"}}, {"files": ["Package.resolved"], "attrs": {"lockfiles": "$file"}}]},
+    {"id": "uv", "signals": [{"files": ["uv.lock"], "attrs": {"lockfiles": "$file"}}, {"files": ["pyproject.toml"], "regex": "^\\[tool\\.uv\\b", "confidence": "high", "attrs": {"manifests": "$file"}}]},
+    {"id": "yarn", "signals": [
+      {"files": ["yarn.lock"], "attrs": {"lockfiles": "$file"}},
+      {"files": [".yarnrc.yml", ".yarnrc"], "attrs": {"manifests": "$file"}},
+      {"files": ["package.json"], "regex": "\"packageManager\"\\s*:\\s*\"yarn@", "confidence": "high", "attrs": {"manifests": "$file"}}]}
+  ]
+}

package/detectors/payments.json

@@ -0,0 +1,19 @@
+{
+  "category": "payments",
+  "entries": [
+    {"id": "adyen", "deps": {"npm": ["@adyen/*"], "pypi": ["adyen"]}},
+    {"id": "app-store-billing", "deps": {"npm": ["react-native-iap", "expo-in-app-purchases"], "pub": ["in_app_purchase"], "maven": ["com.android.billingclient*"]}, "imports": {"swift": ["StoreKit"]}},
+    {"id": "braintree", "deps": {"npm": ["braintree", "braintree-web"], "pypi": ["braintree"], "rubygems": ["braintree"]}},
+    {"id": "flutterwave", "deps": {"npm": ["flutterwave-node-v3", "flutterwave-react-v3"], "pub": ["flutterwave_standard"]}},
+    {"id": "lemon-squeezy", "deps": {"npm": ["@lemonsqueezy/lemonsqueezy.js"]}},
+    {"id": "mollie", "deps": {"npm": ["@mollie/api-client"], "pypi": ["mollie-api-python"], "composer": ["mollie/mollie-api-php"]}},
+    {"id": "paddle", "deps": {"npm": ["@paddle/*"], "pypi": ["paddle-python-sdk"]}},
+    {"id": "paypal", "deps": {"npm": ["@paypal/*"], "pypi": ["paypalrestsdk", "paypal-server-sdk"]}},
+    {"id": "paystack", "deps": {"npm": ["paystack", "@paystack/*", "react-paystack", "paystack-api"], "pub": ["flutter_paystack"]}, "signals": [{"files": ["*.ts", "*.tsx", "*.js", "*.jsx", "*.mjs", "*.py", "*.php", "*.rb", "*.go", "*.dart"], "regex": "api\\.paystack\\.co"}]},
+    {"id": "polar", "deps": {"npm": ["@polar-sh/*"], "pypi": ["polar-sdk"]}},
+    {"id": "razorpay", "deps": {"npm": ["razorpay"], "pypi": ["razorpay"]}},
+    {"id": "revenuecat", "deps": {"npm": ["react-native-purchases"], "pub": ["purchases_flutter"]}},
+    {"id": "square", "deps": {"npm": ["square"], "pypi": ["squareup"]}},
+    {"id": "stripe", "deps": {"npm": ["stripe", "@stripe/*"], "pypi": ["stripe"], "go": ["github.com/stripe/stripe-go*"], "rubygems": ["stripe"], "composer": ["stripe/stripe-php"], "maven": ["com.stripe:stripe-java"], "nuget": ["Stripe.net"], "pub": ["flutter_stripe"]}, "imports": {"js": ["stripe", "@stripe/stripe-js"], "python": ["stripe"]}}
+  ]
+}

package/detectors/runtimes.json

@@ -0,0 +1,17 @@
+{
+  "category": "runtimes",
+  "entries": [
+    {"id": "bun", "signals": [{"files": ["bun.lockb", "bun.lock", "bunfig.toml"]}, {"files": ["package.json"], "regex": "\"packageManager\"\\s*:\\s*\"bun@", "confidence": "high"}]},
+    {"id": "deno", "signals": [{"files": ["deno.json", "deno.jsonc", "deno.lock"]}]},
+    {"id": "dotnet", "signals": [{"files": ["*.csproj", "*.fsproj", "*.vbproj", "*.sln", "global.json"]}]},
+    {"id": "dart", "signals": [{"files": ["pubspec.yaml"]}]},
+    {"id": "elixir", "signals": [{"files": ["mix.exs"]}]},
+    {"id": "go", "signals": [{"files": ["go.mod"]}]},
+    {"id": "jvm", "signals": [{"files": ["pom.xml", "build.gradle", "build.gradle.kts", "build.sbt"]}]},
+    {"id": "node", "signals": [{"files": ["package.json", ".nvmrc", ".node-version"]}]},
+    {"id": "php", "signals": [{"files": ["composer.json"]}]},
+    {"id": "python", "signals": [{"files": ["pyproject.toml", "requirements*.txt", "setup.py", "setup.cfg", "Pipfile", ".python-version"]}]},
+    {"id": "ruby", "signals": [{"files": ["Gemfile", ".ruby-version"]}]},
+    {"id": "rust", "signals": [{"files": ["Cargo.toml"]}]}
+  ]
+}

package/dist/checks/code/admin-role.js

@@ -0,0 +1,46 @@
+// check.authz.admin-role-check: every server handler under an admin path checks an admin role on the server.
+// A session check alone (any signed in user) is not a role check. Middleware or a shared guard that checks the role for
+// the whole admin path is not followed in Phase 1; such a project sees this FAIL and the report says how to confirm it.
+import { fileURLToPath } from 'node:url';
+import { byFileLine, lineOf } from '../context.js';
+import { handlerFiles } from './shared.js';
+const ADMIN_PATH = /(^|\/)(admin|backoffice|staff|superuser)(\/|\.|$)/i;
+const ROLE_CHECK = new RegExp([
+    String.raw `\brole\s*(?:===?|!==?|==)\s*["'\x60](?:admin|owner|superadmin|staff)`,
+    String.raw `["'\x60](?:admin|owner|superadmin|staff)["'\x60]\s*(?:===?|!==?)\s*[\w.?]*role`,
+    String.raw `\b(?:is_?admin|isAdmin|requireAdmin|require_admin|assertAdmin|ensureAdmin|adminOnly|admin_required|requireRole|require_role|checkRole|withRole|hasRole|has_role|hasPermission|has_perm|is_staff|is_superuser|authorize)\b`,
+    String.raw `@(?:PreAuthorize|Secured|RolesAllowed|Roles|staff_member_required|user_passes_test|permission_required)`,
+    String.raw `\bcurrent_user\.admin\?|\buser\.admin\b|roles?\.includes\(\s*["']admin`,
+].join('|'));
+const HANDLER = /export\s+(?:async\s+)?(?:function\s+|const\s+)(GET|POST|PUT|PATCH|DELETE|default|handler)\b|@(?:app|router|api_view|\w+)\.(?:get|post|put|patch|delete|route)\(|\bdef\s+(?:get|post|put|patch|delete|index|show|create|update|destroy)\b|\b(?:router|app)\.(?:get|post|put|patch|delete)\(/g;
+export function run(ctx) {
+    const files = handlerFiles(ctx).filter((f) => ADMIN_PATH.test(f));
+    if (files.length === 0)
+        return { value: 'not_applicable', reason: 'no server handler under an admin path', evidence: [], absence: null };
+    const bad = [];
+    for (const file of files) {
+        const text = ctx.text(file);
+        if (ROLE_CHECK.test(text))
+            continue;
+        const handlers = [...text.matchAll(HANDLER)];
+        const lines = handlers.length ? handlers.map((h) => lineOf(text, h.index)) : [1];
+        for (const line of lines)
+            bad.push({ file, line, note: 'admin handler with no server side admin role check' });
+    }
+    return {
+        value: bad.length === 0,
+        evidence: bad.sort(byFileLine),
+        absence: { pattern: ROLE_CHECK.source, files_searched: files.length, file_globs: ['handler files under an admin path'], matches: files.length - new Set(bad.map((b) => b.file)).size },
+    };
+}
+export const check = {
+    id: 'check.authz.admin-role-check',
+    sec_ids: ['SEC-AUTHZ-020'],
+    applies_when: {},
+    op: 'code',
+    on_true: 'NOT ASSESSED: NEEDS DYNAMIC TEST',
+    on_false: 'FAIL',
+    fixtures: { pass: 'test/fixtures/checks/admin-role-check/pass', fail: 'test/fixtures/checks/admin-role-check/fail' },
+    source: fileURLToPath(import.meta.url),
+    run,
+};

package/dist/checks/code/owner-filter.js

@@ -0,0 +1,91 @@
+// Two checks from one detector: a record read by an id that came from the request (or from a model's tool arguments)
+// must also be filtered by its owner. check.authz.owner-filter-on-id-read covers request handlers (SEC-AUTHZ-003);
+// check.ai.tool-owner-filter covers functions handed to a model as tools (SEC-AI-021).
+// Detected read forms: SQL text (any driver), Prisma and Drizzle style where objects, Supabase .eq('id'), Mongoose
+// findById, Django .get(pk=) and get_object_or_404, Rails .find(params[:id]), Laravel ::find / findOrFail.
+// It reads code, so it can FAIL those runtime requirements for the part a file settles and never PASS them.
+import { fileURLToPath } from 'node:url';
+import { byFileLine, lineOf } from '../context.js';
+import { handlerFiles, NOT_HANDLER } from './shared.js';
+const READS = [
+    { re: /\bSELECT\b[^;"'`]*?\bWHERE\s+(?:\w+\.)?(?:id|pk|uuid)\s*=\s*(?:\?|\$\d+|:\w+|%s|@\w+|\$\{)/gi, what: 'SQL read by id' },
+    { re: /\.(?:findUnique|findFirst|findOne|findOneBy|findOneOrFail)\(\s*\{\s*where:\s*\{\s*id\s*[:,}]/g, what: 'ORM read by id' },
+    { re: /\.(?:findById|findByPk|findOneById)\(/g, what: 'ORM read by id' },
+    { re: /\.eq\(\s*["'](?:id|uuid)["']\s*,/g, what: 'Supabase read by id' },
+    { re: /\.objects\.get\(\s*(?:id|pk)\s*=|get_object_or_404\(\s*\w+\s*,\s*(?:id|pk)\s*=/g, what: 'Django read by id' },
+    { re: /\.find\(\s*params\[:id\]\s*\)|::(?:find|findOrFail)\(\s*\$(?:id|request)/g, what: 'Rails or Laravel read by id' },
+];
+// Words that show the read is scoped to the caller.
+const OWNER = /owner|user_?id|userId|tenant|account_?id|accountId|org_?id|orgId|organization|workspace|created_by|createdBy|author|auth\.uid|current_?user|request\.user|session\.user|\.user\.id|ctx\.user|scope|policy/i;
+// Words that show the id came from the request or from model arguments.
+const INPUT = /params|args|arguments|req\.|request\.|query|body|input|searchParams|\$_(GET|POST|REQUEST)|kwargs/;
+const WRITE = /\b(UPDATE|DELETE|INSERT)\b/i;
+// The statement around a match: from the match to the first semicolon or blank line, at most 6 lines.
+function statement(text, at) {
+    const lines = text.slice(at).split('\n').slice(0, 6);
+    const out = [];
+    for (const l of lines) {
+        if (out.length && l.trim() === '')
+            break;
+        out.push(l);
+        if (/;\s*$/.test(l))
+            break;
+    }
+    return out.join('\n');
+}
+function scan(files, ctx) {
+    const bad = [];
+    for (const file of files) {
+        const text = ctx.text(file);
+        for (const { re, what } of READS) {
+            re.lastIndex = 0;
+            for (let m = re.exec(text); m; m = re.exec(text)) {
+                // For SQL, judge only the WHERE clause onward: an owner column in the select list filters nothing.
+                const where = m[0].search(/\bWHERE\b/i);
+                const stmt = statement(text, m.index + Math.max(0, where));
+                if (WRITE.test(m[0]) || OWNER.test(stmt) || !INPUT.test(stmt))
+                    continue;
+                bad.push({ file, line: lineOf(text, m.index), note: `${what} with an id from the request and no owner filter` });
+            }
+        }
+    }
+    return bad.sort(byFileLine);
+}
+const AI_TOOL_GLOBS = ['**/{ai,llm,agent,agents,mcp,tools}/**/*.{ts,js,mjs,py}', '**/*tool*.{ts,js,mjs,py}'];
+const aiToolFiles = (ctx) => ctx.select(AI_TOOL_GLOBS, NOT_HANDLER).filter((f) => /\btools?\b|tool_call|function_call|bind_tools|@tool\b/.test(ctx.text(f)));
+function outcome(files, ctx, none) {
+    if (files.length === 0)
+        return { value: 'not_applicable', reason: none, evidence: [], absence: null };
+    const bad = scan(files, ctx);
+    return {
+        value: bad.length === 0,
+        evidence: bad,
+        absence: { pattern: 'reads by id (SQL, ORM, Supabase, Django, Rails, Laravel) with no owner, user or tenant term in the statement', files_searched: files.length, file_globs: [], matches: bad.length },
+    };
+}
+const source = fileURLToPath(import.meta.url);
+export const ownerFilter = {
+    id: 'check.authz.owner-filter-on-id-read',
+    sec_ids: ['SEC-AUTHZ-003'],
+    applies_when: {},
+    op: 'code',
+    on_true: 'NOT ASSESSED: NEEDS DYNAMIC TEST',
+    on_false: 'FAIL',
+    fixtures: { pass: 'test/fixtures/checks/owner-filter-on-id-read/pass', fail: 'test/fixtures/checks/owner-filter-on-id-read/fail' },
+    source,
+    run: (ctx) => {
+        const ai = new Set(aiToolFiles(ctx));
+        return outcome(handlerFiles(ctx).filter((f) => !ai.has(f)), ctx, 'no request handler found');
+    },
+};
+export const toolOwnerFilter = {
+    id: 'check.ai.tool-owner-filter',
+    sec_ids: ['SEC-AI-021'],
+    applies_when: {},
+    op: 'code',
+    on_true: 'NOT ASSESSED: NEEDS DYNAMIC TEST',
+    on_false: 'FAIL',
+    fixtures: { pass: 'test/fixtures/checks/tool-owner-filter/pass', fail: 'test/fixtures/checks/tool-owner-filter/fail' },
+    source,
+    run: (ctx) => outcome(aiToolFiles(ctx), ctx, 'no file that defines tools for a model was found'),
+};

package/dist/checks/code/shared.js

@@ -0,0 +1,84 @@
+// Server side request handlers across common stacks. Stack specific globs are marked by the framework they serve.
+export const HANDLER_GLOBS = [
+    '**/app/**/route.{ts,js,mjs,tsx,jsx}', // Next.js App Router
+    '**/pages/api/**/*.{ts,js,mjs}', // Next.js Pages Router
+    '**/app/actions/**/*.{ts,js}', // Next.js Server Actions folder
+    '**/api/**/*.{ts,js,mjs,py,go,php,rb}', // Vercel and Netlify functions, generic api folders
+    '**/routes/**/*.{ts,js,mjs,py,php,rb}', // Express, Remix, SvelteKit, FastAPI routers, Laravel routes
+    '**/routers/**/*.py', '**/views.py', '**/views/**/*.py', '**/app.py', '**/main.py', // Django, Flask, FastAPI
+    '**/controllers/**/*.{ts,js,rb,php}', 'app/Http/Controllers/**/*.php', // Rails, Laravel, Nest, Adonis
+    '**/*Controller.{java,kt,cs}', // Spring, ASP.NET
+    '**/handlers/**/*.{go,ts,js}', '**/*handler*.go', // Go
+    'supabase/functions/**/*.ts', 'netlify/functions/**/*.{ts,js}', 'functions/**/*.{ts,js,py}', // edge and cloud functions
+    '**/server/**/*.{ts,js}', '**/hooks.server.{ts,js}', '**/+server.{ts,js}', '**/+page.server.{ts,js}',
+];
+export const NOT_HANDLER = ['**/*.test.*', '**/*.spec.*', '**/__tests__/**', '**/test/**', '**/tests/**', '**/*.d.ts'];
+// Handler files, without browser only modules ("use client").
+export function handlerFiles(ctx) {
+    return ctx.select(HANDLER_GLOBS, NOT_HANDLER).filter((f) => !/^\s*["']use client["']/.test(ctx.text(f)));
+}
+// The index just past the bracket that closes the one at `open`, or -1. Skips string literals and comments, roughly.
+export function closeOf(text, open) {
+    const pair = { '(': ')', '{': '}', '[': ']' };
+    const stack = [];
+    for (let i = open; i < text.length; i++) {
+        const c = text[i];
+        if (c === '"' || c === "'" || c === '`') {
+            for (i++; i < text.length && text[i] !== c; i++)
+                if (text[i] === '\\')
+                    i++;
+            continue;
+        }
+        if (c === '/' && text[i + 1] === '/') {
+            while (i < text.length && text[i] !== '\n')
+                i++;
+            continue;
+        }
+        if (c === '/' && text[i + 1] === '*') {
+            const e = text.indexOf('*/', i + 2);
+            i = e < 0 ? text.length : e + 1;
+            continue;
+        }
+        if (pair[c])
+            stack.push(pair[c]);
+        else if (c === stack[stack.length - 1]) {
+            stack.pop();
+            if (stack.length === 0)
+                return i + 1;
+        }
+    }
+    return -1;
+}
+// The body of the `if` whose keyword starts at `at`: a braced block, an indented Python block, or the rest of the statement.
+export function ifBody(text, at) {
+    const py = /^if\s+[^\n(]*:\s*(#.*)?$/m.exec(text.slice(at, text.indexOf('\n', at) < 0 ? text.length : text.indexOf('\n', at)));
+    if (py) {
+        const lineEnd = text.indexOf('\n', at);
+        const lineStart = text.lastIndexOf('\n', at) + 1;
+        const indent = /^\s*/.exec(text.slice(lineStart))[0].length;
+        const rest = text.slice(lineEnd + 1).split('\n');
+        const body = [];
+        for (const l of rest) {
+            if (l.trim() === '')
+                continue;
+            if (/^\s*/.exec(l)[0].length <= indent)
+                break;
+            body.push(l);
+        }
+        return text.slice(at, lineEnd) + '\n' + body.join('\n');
+    }
+    const paren = text.indexOf('(', at);
+    const condEnd = paren < 0 ? -1 : closeOf(text, paren);
+    if (condEnd < 0)
+        return text.slice(at, at + 200);
+    const after = text.slice(condEnd).search(/\S/);
+    const start = condEnd + (after < 0 ? 0 : after);
+    if (text[start] === '{') {
+        const e = closeOf(text, start);
+        return text.slice(at, e < 0 ? start + 400 : e);
+    }
+    const end = text.slice(start).search(/[;\n]/);
+    return text.slice(at, end < 0 ? text.length : start + end + 1);
+}
+// A statement that stops the request: return, throw, raise, abort, or an explicit 4xx or 5xx response.
+export const EXITS = /\b(return|throw|raise|abort|panic|exit|die)\b|\bstatus\(\s*[45]\d\d|\bhttp\.Error\b|res\.sendStatus\(\s*[45]/;

package/dist/checks/code/webhook-verify.js

@@ -0,0 +1,77 @@
+// check.api.webhook-verified-before-use: a webhook handler checks the sender's signature, and a failed check stops the
+// request before the event is used. Works on any stack whose handlers are found by handlerFiles() (JS, TS, Python, Go,
+// PHP, Ruby). It reads code, so it can FAIL SEC-API-101 for the part a file settles and never PASS it.
+import { fileURLToPath } from 'node:url';
+import { byFileLine, lineOf } from '../context.js';
+import { EXITS, handlerFiles, ifBody } from './shared.js';
+// A file is a webhook handler when its path says webhook or it reads a provider signature header.
+const WEBHOOK_PATH = /webhook/i;
+const SIGNATURE_HEADER = /\b[xX]-[a-zA-Z-]*[sS]ignature\b|stripe-signature|paystack-signature|svix-signature|webhook-signature|HTTP_X_[A-Z_]*SIGNATURE/;
+// Calls that check a signature and return a result the caller must act on.
+const VERIFY_CALL = /\b((?:\w+\.)?(?:verify\w*|validate\w*[sS]ignature\w*|check\w*[sS]ignature\w*|is\w*[vV]alid\w*[sS]ignature\w*|compare_digest|hash_equals|secure_compare|timingSafeEqual|hmac\.Equal|ValidatePayload))\s*\(/g;
+// Calls documented by their providers to throw (or raise) on a bad signature, so code after them runs only when valid.
+const THROWING = /constructEvent|construct_event|webhooks\.verify|wh\.verify|Webhook\.construct|unwrap\(|constructEventAsync|validateRequest/;
+export function scanFile(file, text) {
+    const bad = [];
+    let calls = 0;
+    VERIFY_CALL.lastIndex = 0;
+    for (let m = VERIFY_CALL.exec(text); m; m = VERIFY_CALL.exec(text)) {
+        if (/function\s+$|def\s+$|func\s+(\([^)]*\)\s*)?$/.test(text.slice(Math.max(0, m.index - 30), m.index)))
+            continue; // a definition, not a call
+        calls++;
+        const lineStart = text.lastIndexOf('\n', m.index) + 1;
+        const lineText = text.slice(lineStart, text.indexOf('\n', m.index) < 0 ? text.length : text.indexOf('\n', m.index));
+        if (THROWING.test(m[1]) || THROWING.test(lineText))
+            continue;
+        // The call sits in an if condition: `if (!verify(...)) return ...` or `if not verify(...): raise ...`.
+        const ifAt = /\bif\b/.exec(lineText);
+        if (ifAt && lineStart + ifAt.index < m.index) {
+            const body = ifBody(text, lineStart + ifAt.index);
+            if (!EXITS.test(body.slice(body.indexOf(m[0]) + m[0].length)))
+                bad.push({ file, line: lineOf(text, m.index), note: 'a failed signature check does not stop the request' });
+            continue;
+        }
+        // The result is stored: `const ok = verify(...)`, `ok := verify(...)`, `ok = verify(...)`.
+        const assigned = /(?:const|let|var|val)?\s*([A-Za-z_$][\w$]*)\s*(?::=|=)\s*(?:await\s+)?[\w.$]*$/.exec(text.slice(lineStart, m.index));
+        if (!assigned)
+            continue; // a bare call: its result is not used as a gate, and most such helpers throw
+        const name = assigned[1];
+        const after = text.slice(m.index);
+        const guard = new RegExp(`\\bif\\s*\\(?\\s*(?:!\\s*${name}\\b|not\\s+${name}\\b|${name}\\s*(?:===?|is)\\s*(?:false|False|nil|None)|${name}\\s*!==?\\s*true)`, 'g');
+        const guards = [...after.matchAll(guard)];
+        if (guards.length === 0) {
+            bad.push({ file, line: lineOf(text, m.index), note: `the result ${name} of the signature check is never used to stop the request` });
+            continue;
+        }
+        const stops = guards.some((g) => EXITS.test(ifBody(text, m.index + g.index)));
+        if (!stops)
+            bad.push({ file, line: lineOf(text, m.index + guards[0].index), note: `when ${name} is false the handler carries on and uses the event` });
+    }
+    if (calls === 0 && !THROWING.test(text)) {
+        const handler = /export\s+(?:async\s+)?(?:function|const)\s+(?:POST|PUT|handler|default)\b|@(?:app|router)\.post|\bdef\s+\w*webhook\w*|func\s+\w*[Ww]ebhook\w*/.exec(text);
+        bad.push({ file, line: handler ? lineOf(text, handler.index) : 1, note: 'no call that checks the sender signature was found in this webhook handler' });
+    }
+    return bad;
+}
+export function run(ctx) {
+    const files = handlerFiles(ctx).filter((f) => WEBHOOK_PATH.test(f) || SIGNATURE_HEADER.test(ctx.text(f)));
+    if (files.length === 0)
+        return { value: 'not_applicable', reason: 'no webhook handler found', evidence: [], absence: null };
+    const bad = files.flatMap((f) => scanFile(f, ctx.text(f))).sort(byFileLine);
+    return {
+        value: bad.length === 0,
+        evidence: bad.length ? bad : files.map((file) => ({ file, line: 1, note: 'signature check found and a failure stops the request' })),
+        absence: { pattern: `${VERIFY_CALL.source} followed by a guard that returns or throws`, files_searched: files.length, file_globs: ['handler files whose path says webhook or that read a signature header'], matches: files.length - new Set(bad.map((b) => b.file)).size },
+    };
+}
+export const check = {
+    id: 'check.api.webhook-verified-before-use',
+    sec_ids: ['SEC-API-101', 'SEC-API-126'],
+    applies_when: {},
+    op: 'code',
+    on_true: 'NOT ASSESSED: NEEDS DYNAMIC TEST',
+    on_false: 'FAIL',
+    fixtures: { pass: 'test/fixtures/checks/webhook-verified-before-use/pass', fail: 'test/fixtures/checks/webhook-verified-before-use/fail' },
+    source: fileURLToPath(import.meta.url),
+    run,
+};

package/dist/checks/context.js

@@ -0,0 +1,64 @@
+// The read only view of a repository that every check runs against: the file list, file text, stack.json and scan hits.
+import { closeSync, openSync, readSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { LIMITS } from '../discover/discover.js';
+import { walk } from '../discover/walk.js';
+import { cmp, globToRegExp } from '../util.js';
+import { readTracked } from '../scanners/common.js';
+// Folders no check searches: engine output, the kit's own files and the project's security records. The kit folders hold
+// text that names almost every term a check looks for (STANDARD.md, "What the searches leave out").
+export const LEFT_OUT = ['.hullproof/', 'docs/hullproof/', 'tools/hullproof/', '.claude/', 'editors/', 'prompts/', 'docs/security/'];
+function readHead(abs, max) {
+    const fd = openSync(abs, 'r');
+    try {
+        const buf = Buffer.alloc(max);
+        const n = readSync(fd, buf, 0, max, 0);
+        return buf.subarray(0, n).toString('utf8');
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+export function makeContext(repo, stack, hits = [], kitDir = null) {
+    const root = resolve(repo);
+    const files = walk(root, LIMITS.maxFiles).files.filter((f) => !LEFT_OUT.some((p) => f.startsWith(p)));
+    const cache = new Map();
+    const text = (f) => {
+        let t = cache.get(f);
+        if (t === undefined) {
+            try {
+                t = readHead(join(root, f), LIMITS.maxBytesPerFile);
+            }
+            catch {
+                t = '';
+            }
+            cache.set(f, t);
+        }
+        return t;
+    };
+    const select = (globs, exclude = []) => {
+        const inc = globs.map(globToRegExp);
+        const exc = exclude.map(globToRegExp);
+        return files.filter((f) => inc.some((r) => r.test(f)) && !exc.some((r) => r.test(f)));
+    };
+    let trackedList;
+    const tracked = () => {
+        if (trackedList === undefined) {
+            const t = readTracked(root);
+            trackedList = t ? [...t].sort(cmp) : null;
+        }
+        return trackedList;
+    };
+    return { repo: root, files, stack, hits, kitDir, text, select, tracked };
+}
+// 1 based line of a character index.
+export function lineOf(text, index) {
+    let n = 1;
+    for (let i = 0; i < index && i < text.length; i++)
+        if (text.charCodeAt(i) === 10)
+            n++;
+    return n;
+}
+export const byFileLine = (a, b) => a.file < b.file ? -1 : a.file > b.file ? 1 : (a.line ?? 0) - (b.line ?? 0) || (a.note < b.note ? -1 : a.note > b.note ? 1 : 0);
+// The most evidence entries one check result keeps. The count of all matches is kept in absence_search.
+export const MAX_EVIDENCE = 25;

package/dist/checks/map/config-checks.js

@@ -0,0 +1,74 @@
+// Checks that read the configuration maps: Supabase tables (grants and policies) and Firebase rules. Start as leads.
+import { fileURLToPath } from 'node:url';
+import { PRIVILEGED } from '../../map/vocab.js';
+import { mapCheck } from './shared.js';
+const source = fileURLToPath(import.meta.url);
+const NATIVE_FIXTURES = { pass: 'test/fixtures/map-native/pass', fail: 'test/fixtures/map-native/fail' };
+const CLIENT_ROLES = new Set(['anon', 'authenticated', 'public']);
+const tables = (m) => m.config.supabase?.tables ?? [];
+const alwaysTrue = (e) => e !== null && /^\(?\s*true\s*\)?$/i.test(e.trim());
+const WRITE_PRIVS = new Set(['insert', 'update', 'delete', 'all', 'truncate']);
+export const supabaseOpenTable = mapCheck({
+    id: 'check.map.supabase-open-table', sec_ids: ['SEC-DB-001', 'SEC-DB-003'], name: 'supabase-open-table', source,
+    pattern: 'a table granted to anon without row level security, or with a policy for anon or public that is always true',
+    none: 'the code map has no Supabase table',
+    candidates: (m) => tables(m).length,
+    fails: (m) => tables(m).flatMap((t) => {
+        const out = [];
+        const anon = t.grants.filter((g) => g.role === 'anon' || g.role === 'public');
+        if (t.rls_enabled !== true && anon.length)
+            out.push({ file: t.file, line: anon[0].line, note: `${t.name} has no row level security and ${anon[0].role} holds ${[...new Set(anon.flatMap((g) => g.privileges))].join(', ')}` });
+        for (const p of t.policies) {
+            if (p.roles.some((r) => r === 'anon' || r === 'public') && (alwaysTrue(p.using) || (p.using === null && alwaysTrue(p.check)) || alwaysTrue(p.check)))
+                out.push({ file: t.file, line: p.line, note: `${t.name} policy ${p.name} lets ${p.roles.join(', ')} ${p.op} with an expression that is always true` });
+        }
+        return out;
+    }),
+});
+export const supabasePrivilegedColumnGrant = mapCheck({
+    id: 'check.map.supabase-privileged-column-grant', sec_ids: ['SEC-DB-033'], name: 'supabase-privileged-column-grant', source,
+    pattern: 'a client role holding insert or update on a table that has a role, plan, admin or similar column, without a column list that leaves it out',
+    none: 'the code map has no Supabase table with a role, plan or admin column',
+    candidates: (m) => tables(m).filter((t) => t.columns.some((c) => PRIVILEGED.test(c))).length,
+    fails: (m) => tables(m).flatMap((t) => {
+        const priv = t.columns.filter((c) => PRIVILEGED.test(c) && !/^(?:owner_?id|org_?id|tenant_?id)$/i.test(c));
+        if (!priv.length)
+            return [];
+        const lines = new Map();
+        for (const g of t.grants.filter((x) => CLIENT_ROLES.has(x.role) && x.privileges.some((p) => p === 'update' || p === 'insert' || p === 'all'))) {
+            const k = `${g.role}|${g.line}|${(g.columns ?? ['*']).join(',')}`;
+            const cur = lines.get(k) ?? { role: g.role, privileges: new Set(), columns: g.columns, line: g.line };
+            for (const p of g.privileges)
+                cur.privileges.add(p);
+            lines.set(k, cur);
+        }
+        return [...lines.values()].flatMap((g) => {
+            const reach = g.columns === null ? priv : priv.filter((c) => g.columns.includes(c));
+            return reach.length ? [{ file: t.file, line: g.line, note: `${t.name}: ${g.role} can ${[...g.privileges].sort().join(', ')} ${g.columns === null ? 'every column' : 'the listed columns'} including ${reach.join(', ')}` }] : [];
+        });
+    }),
+});
+export const supabasePolicyTrustsClaims = mapCheck({
+    id: 'check.map.supabase-policy-trusts-claims', sec_ids: ['SEC-DB-006'], name: 'supabase-policy-trusts-claims', source,
+    pattern: 'a policy expression that reads user_metadata or raw_user_meta_data',
+    none: 'the code map has no Supabase policy',
+    candidates: (m) => tables(m).reduce((n, t) => n + t.policies.length, 0),
+    fails: (m) => tables(m).flatMap((t) => t.policies.filter((p) => /user_metadata|raw_user_meta_data/i.test(`${p.using ?? ''} ${p.check ?? ''}`)).map((p) => ({ file: t.file, line: p.line, note: `${t.name} policy ${p.name} trusts user_metadata, which the signed in user can edit` }))),
+});
+export const firebaseAuthOnlyRule = mapCheck({
+    id: 'check.map.firebase-auth-only-rule', sec_ids: ['SEC-AUTHZ-010'], name: 'firebase-auth-only-rule', source,
+    pattern: 'a rule on a path with an owner wildcard whose only condition is that the caller is signed in',
+    none: 'the code map has no Firebase rule on a path with an owner wildcard',
+    candidates: (m) => (m.config.firebase?.rules ?? []).filter((r) => r.owner_wildcard).length,
+    fails: (m) => (m.config.firebase?.rules ?? []).filter((r) => r.owner_wildcard && r.uses_auth && !r.owner_bound && !r.always_true).map((r) => ({
+        file: r.file, line: r.line, note: `${r.service} ${r.path} allows ${r.ops.join(', ')} to any signed in user, not to the owner named in the path`,
+    })),
+});
+export const mobileSecretInConfig = mapCheck({
+    id: 'check.map.mobile-secret-in-config', sec_ids: ['SEC-MOBILE-001'], name: 'mobile-secret-in-config', source, fixtures: NATIVE_FIXTURES,
+    pattern: 'a value written in AndroidManifest.xml, an Android strings file or an iOS Info.plist under a name that says secret, password or private key',
+    none: 'the code map has no Android or iOS configuration file',
+    candidates: (m) => (m.config.android?.manifests.length ?? 0) + (m.config.ios?.plists.length ?? 0),
+    fails: (m) => m.config.secrets.map((x) => ({ file: x.file, line: x.line, note: `${x.where}: the name ${x.key} holds a value written into the file, and this file ships inside the app` })),
+});
+export const CONFIG_CHECKS = [supabaseOpenTable, supabasePrivilegedColumnGrant, supabasePolicyTrustsClaims, firebaseAuthOnlyRule, mobileSecretInConfig];