hullproof 0.0.0-stage → 0.5.0

package/packs/expo/answer-key.json

@@ -0,0 +1,51 @@
+{
+  "pack": "expo",
+  "fail_dir": "test/fixtures/map-more/fail",
+  "pass_dir": "test/fixtures/map-more/pass",
+  "stacks": [
+    "expo"
+  ],
+  "detect_expected": [
+    "expo"
+  ],
+  "mapped_what": "entry points",
+  "mapped": [
+    "deep_link - Linking url listener",
+    "deep_link - https://notes.example.com/",
+    "deep_link - https://notes.example.com/n",
+    "deep_link - notesapp://",
+    "http_route POST /api/notes",
+    "page - /",
+    "page - /account",
+    "page - /notes/:id",
+    "page - /sign-in"
+  ],
+  "flaws": [
+    {
+      "check": "mutating-route-without-auth",
+      "stack": "expo"
+    }
+  ],
+  "notes": [
+    "Synthetic fixture only. No real Expo application has been measured."
+  ],
+  "recorded": [
+    {
+      "name": "obytes/react-native-template-obytes (seeded sample of its route registrations)",
+      "kind": "third_party",
+      "blind_key": true,
+      "source": "bench/PHASE6C-MEASURED-2026-10-14.md, recall by bench/phase6c-sample.ts with seed 20261017, three byte identical ci runs",
+      "mapped": {
+        "what": "entry points (real route registrations)",
+        "expected": 8,
+        "matched": 8,
+        "extra": 0
+      },
+      "flaws": null,
+      "stability": {
+        "runs": 3,
+        "identical": true
+      }
+    }
+  ]
+}

package/packs/expo/fixture-result.json

@@ -0,0 +1,62 @@
+{
+  "detect": {
+    "expected": [
+      "expo"
+    ],
+    "found": [
+      "expo",
+      "react",
+      "react-native",
+      "supabase-auth",
+      "typescript"
+    ]
+  },
+  "engine": "0.5.0",
+  "measured": "2026-10-14",
+  "measurements": [
+    {
+      "blind_key": false,
+      "flaws": {
+        "false_findings": 0,
+        "found": 1,
+        "planted": 1
+      },
+      "kind": "synthetic",
+      "mapped": {
+        "expected": 9,
+        "extra": 0,
+        "matched": 9,
+        "what": "entry points"
+      },
+      "name": "test/fixtures/map-more/fail and test/fixtures/map-more/pass",
+      "source": "node bench/packs-measure.ts expo (key packs/expo/answer-key.json)",
+      "stability": {
+        "identical": true,
+        "runs": 3
+      }
+    },
+    {
+      "blind_key": true,
+      "flaws": null,
+      "kind": "third_party",
+      "mapped": {
+        "expected": 8,
+        "extra": 0,
+        "matched": 8,
+        "what": "entry points (real route registrations)"
+      },
+      "name": "obytes/react-native-template-obytes (seeded sample of its route registrations)",
+      "source": "bench/PHASE6C-MEASURED-2026-10-14.md, recall by bench/phase6c-sample.ts with seed 20261017, three byte identical ci runs",
+      "stability": {
+        "identical": true,
+        "runs": 3
+      }
+    }
+  ],
+  "notes": [
+    "Synthetic fixture only. No real Expo application has been measured."
+  ],
+  "pack": "expo",
+  "proof": [],
+  "schema": 1
+}

package/packs/expo/pack.json

@@ -0,0 +1,79 @@
+{
+  "schema": 1,
+  "id": "expo",
+  "name": "Expo and React Native",
+  "summary": "Expo Router screens, API routes and deep links read into the code map, with checks.",
+  "edition": "free",
+  "languages": [
+    "typescript",
+    "javascript"
+  ],
+  "frameworks": [
+    "expo"
+  ],
+  "level": "L2",
+  "limits": [
+    "Planted flaws were not measured on a real application. The one real app has 8 screens. A layout guard is a client side redirect."
+  ],
+  "parts": {
+    "detectors": [
+      "expo",
+      "typescript"
+    ],
+    "extractors": [
+      {
+        "file": "src/map/expo.ts"
+      }
+    ],
+    "auth_patterns": [
+      {
+        "file": "src/map/vocab.ts"
+      }
+    ],
+    "checks": [
+      {
+        "id": "check.map.admin-route-without-role"
+      },
+      {
+        "id": "check.map.data-read-without-auth"
+      },
+      {
+        "id": "check.map.mutating-route-without-auth"
+      },
+      {
+        "id": "check.map.privileged-action-without-audit"
+      },
+      {
+        "id": "check.map.privileged-field-from-request"
+      },
+      {
+        "id": "check.map.redirect-from-request"
+      },
+      {
+        "id": "check.map.request-url-fetched"
+      },
+      {
+        "id": "check.map.webhook-verify-before-use"
+      },
+      {
+        "id": "check.map.write-by-id-without-owner"
+      },
+      {
+        "id": "check.map.read-by-id-without-owner"
+      }
+    ],
+    "mapping": [
+      {
+        "file": "src/checks/map/entry-checks.ts"
+      }
+    ]
+  },
+  "fixture": {
+    "dir": "test/fixtures/map-more/fail",
+    "fixed_dir": "test/fixtures/map-more/pass",
+    "answer_keys": [
+      "in_repo"
+    ],
+    "result": "packs/expo/fixture-result.json"
+  }
+}

package/packs/firebase/answer-key.json

@@ -0,0 +1,27 @@
+{
+  "pack": "firebase",
+  "fail_dir": "test/fixtures/map/fail",
+  "pass_dir": "test/fixtures/map/pass",
+  "stacks": [
+    "firebase"
+  ],
+  "detect_expected": [
+    "firestore",
+    "firebase-realtime-database"
+  ],
+  "mapped_what": "rules",
+  "mapped": [
+    "rule firestore /databases/{database}/documents/users/{userId}/notes/{noteId} read,write",
+    "rule realtime /users/$uid read",
+    "rule realtime /users/$uid write"
+  ],
+  "flaws": [
+    {
+      "check": "firebase-auth-only-rule",
+      "stack": "firebase"
+    }
+  ],
+  "notes": [
+    "Synthetic fixture with a key kept in this repository. No blind measurement yet, so Firebase stays at L2. Hosted, so never L4."
+  ]
+}

package/packs/firebase/fixture-result.json

@@ -0,0 +1,43 @@
+{
+  "detect": {
+    "expected": [
+      "firebase-realtime-database",
+      "firestore"
+    ],
+    "found": [
+      "firebase-realtime-database",
+      "firestore"
+    ]
+  },
+  "engine": "0.5.0",
+  "measured": "2026-10-14",
+  "measurements": [
+    {
+      "blind_key": false,
+      "flaws": {
+        "false_findings": 0,
+        "found": 1,
+        "planted": 1
+      },
+      "kind": "synthetic",
+      "mapped": {
+        "expected": 3,
+        "extra": 0,
+        "matched": 3,
+        "what": "rules"
+      },
+      "name": "test/fixtures/map/fail and test/fixtures/map/pass",
+      "source": "node bench/packs-measure.ts firebase (key packs/firebase/answer-key.json)",
+      "stability": {
+        "identical": true,
+        "runs": 3
+      }
+    }
+  ],
+  "notes": [
+    "Synthetic fixture with a key kept in this repository. No blind measurement yet, so Firebase stays at L2. Hosted, so never L4."
+  ],
+  "pack": "firebase",
+  "proof": [],
+  "schema": 1
+}

package/packs/firebase/pack.json

@@ -0,0 +1,58 @@
+{
+  "schema": 1,
+  "id": "firebase",
+  "name": "Firebase",
+  "summary": "Firestore, Storage and Realtime Database rules read into the code map, with checks for open rules and rules that only require a sign in.",
+  "edition": "free",
+  "languages": [
+    "json"
+  ],
+  "frameworks": [
+    "firestore",
+    "firebase-realtime-database"
+  ],
+  "level": "L2",
+  "limits": [
+    "Rules are read from files, not from a live project."
+  ],
+  "parts": {
+    "detectors": [
+      "firestore",
+      "firebase-realtime-database"
+    ],
+    "extractors": [
+      {
+        "file": "src/map/config.ts"
+      }
+    ],
+    "auth_patterns": [
+      {
+        "file": "src/map/config.ts"
+      }
+    ],
+    "checks": [
+      {
+        "id": "check.map.firebase-auth-only-rule"
+      },
+      {
+        "id": "check.db.firebase-rules-not-open"
+      },
+      {
+        "id": "check.storage.firebase-rules-not-open"
+      }
+    ],
+    "mapping": [
+      {
+        "file": "src/checks/map/config-checks.ts"
+      }
+    ]
+  },
+  "fixture": {
+    "dir": "test/fixtures/map/fail",
+    "fixed_dir": "test/fixtures/map/pass",
+    "answer_keys": [
+      "in_repo"
+    ],
+    "result": "packs/firebase/fixture-result.json"
+  }
+}

package/packs/go/answer-key.json

@@ -0,0 +1,101 @@
+{
+  "pack": "go",
+  "fail_dir": "test/fixtures/map-more/fail",
+  "pass_dir": "test/fixtures/map-more/pass",
+  "stacks": [
+    "go",
+    "gin"
+  ],
+  "detect_expected": [
+    "go",
+    "chi",
+    "gin"
+  ],
+  "mapped_what": "entry points",
+  "mapped": [
+    "http_route DELETE /api/notes/:id",
+    "http_route DELETE /api/notes/:id",
+    "http_route GET /api/export",
+    "http_route GET /api/items",
+    "http_route POST /api/admin/users/role",
+    "http_route POST /api/import",
+    "http_route POST /api/login",
+    "http_route POST /api/notes",
+    "http_route POST /api/notes",
+    "http_route POST /api/upload",
+    "http_route PUT /api/profile/:id",
+    "webhook POST /webhooks/pay"
+  ],
+  "flaws": [
+    {
+      "check": "admin-route-without-role",
+      "stack": "go"
+    },
+    {
+      "check": "data-read-without-auth",
+      "stack": "go"
+    },
+    {
+      "check": "mutating-route-without-auth",
+      "stack": "gin"
+    },
+    {
+      "check": "mutating-route-without-auth",
+      "stack": "go"
+    },
+    {
+      "check": "privileged-action-without-audit",
+      "stack": "go"
+    },
+    {
+      "check": "privileged-field-from-request",
+      "stack": "gin"
+    },
+    {
+      "check": "privileged-field-from-request",
+      "stack": "go"
+    },
+    {
+      "check": "redirect-from-request",
+      "stack": "go"
+    },
+    {
+      "check": "request-url-fetched",
+      "stack": "go"
+    },
+    {
+      "check": "webhook-verify-before-use",
+      "stack": "go"
+    },
+    {
+      "check": "write-by-id-without-owner",
+      "stack": "gin"
+    },
+    {
+      "check": "write-by-id-without-owner",
+      "stack": "go"
+    }
+  ],
+  "notes": [
+    "Synthetic fixtures only. No real Go application has been measured."
+  ],
+  "recorded": [
+    {
+      "name": "gotify/server (seeded sample of its route registrations)",
+      "kind": "third_party",
+      "blind_key": true,
+      "source": "bench/PHASE6C-MEASURED-2026-10-14.md, recall by bench/phase6c-sample.ts with seed 20261017, three byte identical ci runs",
+      "mapped": {
+        "what": "entry points (real route registrations)",
+        "expected": 25,
+        "matched": 25,
+        "extra": 0
+      },
+      "flaws": null,
+      "stability": {
+        "runs": 3,
+        "identical": true
+      }
+    }
+  ]
+}

package/packs/go/fixture-result.json

@@ -0,0 +1,64 @@
+{
+  "detect": {
+    "expected": [
+      "chi",
+      "gin",
+      "go"
+    ],
+    "found": [
+      "chi",
+      "gin",
+      "go",
+      "gorm",
+      "jwt"
+    ]
+  },
+  "engine": "0.5.0",
+  "measured": "2026-10-14",
+  "measurements": [
+    {
+      "blind_key": false,
+      "flaws": {
+        "false_findings": 0,
+        "found": 12,
+        "planted": 12
+      },
+      "kind": "synthetic",
+      "mapped": {
+        "expected": 12,
+        "extra": 0,
+        "matched": 12,
+        "what": "entry points"
+      },
+      "name": "test/fixtures/map-more/fail and test/fixtures/map-more/pass",
+      "source": "node bench/packs-measure.ts go (key packs/go/answer-key.json)",
+      "stability": {
+        "identical": true,
+        "runs": 3
+      }
+    },
+    {
+      "blind_key": true,
+      "flaws": null,
+      "kind": "third_party",
+      "mapped": {
+        "expected": 25,
+        "extra": 0,
+        "matched": 25,
+        "what": "entry points (real route registrations)"
+      },
+      "name": "gotify/server (seeded sample of its route registrations)",
+      "source": "bench/PHASE6C-MEASURED-2026-10-14.md, recall by bench/phase6c-sample.ts with seed 20261017, three byte identical ci runs",
+      "stability": {
+        "identical": true,
+        "runs": 3
+      }
+    }
+  ],
+  "notes": [
+    "Synthetic fixtures only. No real Go application has been measured."
+  ],
+  "pack": "go",
+  "proof": [],
+  "schema": 1
+}

package/packs/go/pack.json

@@ -0,0 +1,99 @@
+{
+  "schema": 1,
+  "id": "go",
+  "name": "Go",
+  "summary": "net/http, chi, gin, echo, fiber and gorilla/mux routes with group and route middleware, taint rules and checks.",
+  "edition": "free",
+  "languages": [
+    "go"
+  ],
+  "frameworks": [
+    "chi",
+    "echo",
+    "fiber",
+    "gin",
+    "gorilla-mux"
+  ],
+  "level": "L2",
+  "limits": [
+    "Planted flaws were not measured on a real application. Routes that a Go library builds at run time are not read."
+  ],
+  "parts": {
+    "detectors": [
+      "go",
+      "chi",
+      "echo",
+      "fiber",
+      "gin",
+      "gorilla-mux"
+    ],
+    "extractors": [
+      {
+        "file": "src/map/go.ts"
+      }
+    ],
+    "auth_patterns": [
+      {
+        "file": "src/map/light-profiles.ts"
+      }
+    ],
+    "sources_sinks": [
+      {
+        "file": "rules/semgrep/taint-go.yaml"
+      }
+    ],
+    "rules": [
+      {
+        "file": "rules/semgrep/taint-go.yaml",
+        "tests": [
+          "test/fixtures/rules/taint-go.go"
+        ]
+      }
+    ],
+    "checks": [
+      {
+        "id": "check.map.admin-route-without-role"
+      },
+      {
+        "id": "check.map.data-read-without-auth"
+      },
+      {
+        "id": "check.map.mutating-route-without-auth"
+      },
+      {
+        "id": "check.map.privileged-action-without-audit"
+      },
+      {
+        "id": "check.map.privileged-field-from-request"
+      },
+      {
+        "id": "check.map.redirect-from-request"
+      },
+      {
+        "id": "check.map.request-url-fetched"
+      },
+      {
+        "id": "check.map.webhook-verify-before-use"
+      },
+      {
+        "id": "check.map.write-by-id-without-owner"
+      },
+      {
+        "id": "check.map.read-by-id-without-owner"
+      }
+    ],
+    "mapping": [
+      {
+        "file": "src/checks/map/entry-checks.ts"
+      }
+    ]
+  },
+  "fixture": {
+    "dir": "test/fixtures/map-more/fail",
+    "fixed_dir": "test/fixtures/map-more/pass",
+    "answer_keys": [
+      "in_repo"
+    ],
+    "result": "packs/go/fixture-result.json"
+  }
+}

package/packs/ios/fixture-result.json

@@ -0,0 +1,43 @@
+{
+  "detect": {
+    "expected": [
+      "ios",
+      "swift"
+    ],
+    "found": [
+      "ios",
+      "swift"
+    ]
+  },
+  "engine": "0.5.0",
+  "measured": "2026-10-14",
+  "measurements": [
+    {
+      "blind_key": true,
+      "flaws": {
+        "false_findings": 0,
+        "found": 1,
+        "planted": 2
+      },
+      "kind": "synthetic",
+      "mapped": {
+        "expected": 2,
+        "extra": 0,
+        "matched": 2,
+        "what": "entry points"
+      },
+      "name": "test/fixtures/packs/ios/fail and test/fixtures/packs/ios/pass",
+      "source": "node bench/packs-measure.ts ios (key kept outside the repository)",
+      "stability": {
+        "identical": true,
+        "runs": 3
+      }
+    }
+  ],
+  "notes": [
+    "iOS app in Swift: two planted configuration flaws and a fixed copy. One of the two is settled by a check that belongs to the Pro edition. Written before the iOS extractor existed."
+  ],
+  "pack": "ios",
+  "proof": [],
+  "schema": 1
+}

package/packs/ios/pack.json

@@ -0,0 +1,55 @@
+{
+  "schema": 1,
+  "id": "ios",
+  "name": "Swift and iOS",
+  "summary": "Info.plist (App Transport Security, URL schemes), the entitlements (associated domains) and the deep links they open, with a check for secrets written into Info.plist. Swift source is not read.",
+  "edition": "free",
+  "languages": [
+    "swift"
+  ],
+  "frameworks": [
+    "ios"
+  ],
+  "level": "L2",
+  "limits": [
+    "Swift source is not read, so what a handler does with an incoming URL is not in the map."
+  ],
+  "parts": {
+    "detectors": [
+      "swift",
+      "ios"
+    ],
+    "extractors": [
+      {
+        "file": "src/map/mobile.ts"
+      }
+    ],
+    "auth_patterns": [
+      {
+        "file": "src/map/mobile.ts"
+      }
+    ],
+    "checks": [
+      {
+        "id": "check.map.mobile-secret-in-config"
+      }
+    ],
+    "mapping": [
+      {
+        "file": "src/checks/map/config-checks.ts"
+      },
+      {
+        "file": "src/checks/map/entry-checks.ts"
+      }
+    ]
+  },
+  "fixture": {
+    "dir": "test/fixtures/packs/ios/fail",
+    "fixed_dir": "test/fixtures/packs/ios/pass",
+    "internal": true,
+    "answer_keys": [
+      "outside_repo"
+    ],
+    "result": "packs/ios/fixture-result.json"
+  }
+}