hullproof 0.0.0-stage → 0.5.0

package/packs/laravel/answer-key.json

@@ -0,0 +1,84 @@
+{
+  "pack": "laravel",
+  "fail_dir": "test/fixtures/map-more/fail",
+  "pass_dir": "test/fixtures/map-more/pass",
+  "stacks": [
+    "laravel"
+  ],
+  "detect_expected": [
+    "laravel",
+    "php"
+  ],
+  "mapped_what": "entry points",
+  "mapped": [
+    "http_route DELETE /notes/:note",
+    "http_route GET /api/export",
+    "http_route GET /api/items",
+    "http_route POST /admin/users/:user/role",
+    "http_route POST /api/import",
+    "http_route POST /api/upload",
+    "http_route POST /login",
+    "http_route POST /notes",
+    "webhook POST /webhooks/pay"
+  ],
+  "flaws": [
+    {
+      "check": "admin-route-without-role",
+      "stack": "laravel"
+    },
+    {
+      "check": "data-read-without-auth",
+      "stack": "laravel"
+    },
+    {
+      "check": "mutating-route-without-auth",
+      "stack": "laravel"
+    },
+    {
+      "check": "privileged-action-without-audit",
+      "stack": "laravel"
+    },
+    {
+      "check": "privileged-field-from-request",
+      "stack": "laravel"
+    },
+    {
+      "check": "redirect-from-request",
+      "stack": "laravel"
+    },
+    {
+      "check": "request-url-fetched",
+      "stack": "laravel"
+    },
+    {
+      "check": "webhook-verify-before-use",
+      "stack": "laravel"
+    },
+    {
+      "check": "write-by-id-without-owner",
+      "stack": "laravel"
+    }
+  ],
+  "notes": [
+    "Synthetic fixture only. No real Laravel application has been measured."
+  ],
+  "recorded": [
+    {
+      "name": "koel/koel (seeded sample of its route registrations)",
+      "kind": "third_party",
+      "blind_key": true,
+      "source": "bench/PHASE6C-MEASURED-2026-10-14.md, recall by bench/phase6c-sample.ts with seed 20261017, three byte identical ci runs",
+      "mapped": {
+        "what": "entry points (real route registrations)",
+        "expected": 25,
+        "matched": 25,
+        "extra": 0
+      },
+      "flaws": null,
+      "stability": {
+        "runs": 3,
+        "identical": true
+      }
+    }
+  ]
+}

package/packs/laravel/fixture-result.json

@@ -0,0 +1,60 @@
+{
+  "detect": {
+    "expected": [
+      "laravel",
+      "php"
+    ],
+    "found": [
+      "laravel",
+      "php"
+    ]
+  },
+  "engine": "0.5.0",
+  "measured": "2026-10-14",
+  "measurements": [
+    {
+      "blind_key": false,
+      "flaws": {
+        "false_findings": 0,
+        "found": 9,
+        "planted": 9
+      },
+      "kind": "synthetic",
+      "mapped": {
+        "expected": 9,
+        "extra": 0,
+        "matched": 9,
+        "what": "entry points"
+      },
+      "name": "test/fixtures/map-more/fail and test/fixtures/map-more/pass",
+      "source": "node bench/packs-measure.ts laravel (key packs/laravel/answer-key.json)",
+      "stability": {
+        "identical": true,
+        "runs": 3
+      }
+    },
+    {
+      "blind_key": true,
+      "flaws": null,
+      "kind": "third_party",
+      "mapped": {
+        "expected": 25,
+        "extra": 0,
+        "matched": 25,
+        "what": "entry points (real route registrations)"
+      },
+      "name": "koel/koel (seeded sample of its route registrations)",
+      "source": "bench/PHASE6C-MEASURED-2026-10-14.md, recall by bench/phase6c-sample.ts with seed 20261017, three byte identical ci runs",
+      "stability": {
+        "identical": true,
+        "runs": 3
+      }
+    }
+  ],
+  "notes": [
+    "Synthetic fixture only. No real Laravel application has been measured."
+  ],
+  "pack": "laravel",
+  "proof": [],
+  "schema": 1
+}

package/packs/laravel/pack.json

@@ -0,0 +1,91 @@
+{
+  "schema": 1,
+  "id": "laravel",
+  "name": "PHP and Laravel",
+  "summary": "routes/*.php joined to controllers with their middleware, policies and form requests, taint rules and checks.",
+  "edition": "free",
+  "languages": [
+    "php"
+  ],
+  "frameworks": [
+    "laravel"
+  ],
+  "level": "L2",
+  "limits": [
+    "Planted flaws were not measured on a real application."
+  ],
+  "parts": {
+    "detectors": [
+      "php",
+      "laravel"
+    ],
+    "extractors": [
+      {
+        "file": "src/map/laravel.ts"
+      }
+    ],
+    "auth_patterns": [
+      {
+        "file": "src/map/light-profiles.ts"
+      }
+    ],
+    "sources_sinks": [
+      {
+        "file": "rules/semgrep/taint-php.yaml"
+      }
+    ],
+    "rules": [
+      {
+        "file": "rules/semgrep/taint-php.yaml",
+        "tests": [
+          "test/fixtures/rules/taint-php.php"
+        ]
+      }
+    ],
+    "checks": [
+      {
+        "id": "check.map.admin-route-without-role"
+      },
+      {
+        "id": "check.map.data-read-without-auth"
+      },
+      {
+        "id": "check.map.mutating-route-without-auth"
+      },
+      {
+        "id": "check.map.privileged-action-without-audit"
+      },
+      {
+        "id": "check.map.privileged-field-from-request"
+      },
+      {
+        "id": "check.map.redirect-from-request"
+      },
+      {
+        "id": "check.map.request-url-fetched"
+      },
+      {
+        "id": "check.map.webhook-verify-before-use"
+      },
+      {
+        "id": "check.map.write-by-id-without-owner"
+      },
+      {
+        "id": "check.map.read-by-id-without-owner"
+      }
+    ],
+    "mapping": [
+      {
+        "file": "src/checks/map/entry-checks.ts"
+      }
+    ]
+  },
+  "fixture": {
+    "dir": "test/fixtures/map-more/fail",
+    "fixed_dir": "test/fixtures/map-more/pass",
+    "answer_keys": [
+      "in_repo"
+    ],
+    "result": "packs/laravel/fixture-result.json"
+  }
+}

package/packs/node-ts/answer-key.json

@@ -0,0 +1,220 @@
+{
+  "pack": "node-ts",
+  "fail_dir": "test/fixtures/map/fail",
+  "pass_dir": "test/fixtures/map/pass",
+  "stacks": [
+    "express",
+    "nextapp",
+    "nest"
+  ],
+  "detect_expected": [
+    "express",
+    "nextjs",
+    "javascript",
+    "typescript"
+  ],
+  "mapped_what": "entry points",
+  "mapped": [
+    "http_route DELETE /api/notes/:id",
+    "http_route DELETE /api/notes/:id",
+    "http_route DELETE /notes/:id",
+    "http_route GET /api/export",
+    "http_route GET /api/export",
+    "http_route GET /api/items",
+    "http_route GET /api/items",
+    "http_route GET /notes",
+    "http_route GET /notes/export",
+    "http_route POST /admin/users/role",
+    "http_route POST /api/admin/users",
+    "http_route POST /api/admin/users",
+    "http_route POST /api/import",
+    "http_route POST /api/import",
+    "http_route POST /api/login",
+    "http_route POST /api/login",
+    "http_route POST /api/notes",
+    "http_route POST /api/notes",
+    "http_route POST /api/upload",
+    "http_route POST /api/upload",
+    "http_route POST /notes",
+    "http_route POST /notes/upload",
+    "server_action POST updateProfile",
+    "webhook POST /api/webhooks/pay",
+    "webhook POST /webhooks/pay",
+    "webhook POST /webhooks/pay"
+  ],
+  "flaws": [
+    {
+      "check": "admin-route-without-role",
+      "stack": "express"
+    },
+    {
+      "check": "admin-route-without-role",
+      "stack": "nest"
+    },
+    {
+      "check": "admin-route-without-role",
+      "stack": "nextapp"
+    },
+    {
+      "check": "data-read-without-auth",
+      "stack": "express"
+    },
+    {
+      "check": "data-read-without-auth",
+      "stack": "nest"
+    },
+    {
+      "check": "data-read-without-auth",
+      "stack": "nextapp"
+    },
+    {
+      "check": "mutating-route-without-auth",
+      "stack": "express"
+    },
+    {
+      "check": "mutating-route-without-auth",
+      "stack": "nest"
+    },
+    {
+      "check": "mutating-route-without-auth",
+      "stack": "nextapp"
+    },
+    {
+      "check": "privileged-action-without-audit",
+      "stack": "express"
+    },
+    {
+      "check": "privileged-action-without-audit",
+      "stack": "nest"
+    },
+    {
+      "check": "privileged-action-without-audit",
+      "stack": "nextapp"
+    },
+    {
+      "check": "privileged-field-from-request",
+      "stack": "express"
+    },
+    {
+      "check": "privileged-field-from-request",
+      "stack": "nest"
+    },
+    {
+      "check": "privileged-field-from-request",
+      "stack": "nextapp"
+    },
+    {
+      "check": "redirect-from-request",
+      "stack": "express"
+    },
+    {
+      "check": "redirect-from-request",
+      "stack": "nextapp"
+    },
+    {
+      "check": "request-url-fetched",
+      "stack": "express"
+    },
+    {
+      "check": "request-url-fetched",
+      "stack": "nextapp"
+    },
+    {
+      "check": "webhook-verify-before-use",
+      "stack": "express"
+    },
+    {
+      "check": "webhook-verify-before-use",
+      "stack": "nest"
+    },
+    {
+      "check": "webhook-verify-before-use",
+      "stack": "nextapp"
+    },
+    {
+      "check": "write-by-id-without-owner",
+      "stack": "express"
+    },
+    {
+      "check": "write-by-id-without-owner",
+      "stack": "nest"
+    },
+    {
+      "check": "write-by-id-without-owner",
+      "stack": "nextapp"
+    }
+  ],
+  "recorded": [
+    {
+      "name": "hullproof-demo",
+      "kind": "demo",
+      "blind_key": true,
+      "source": "bench/PHASE2-MEASURED-2026-10-11.md sections 2.1 and 2.2 (open core rules, new checks as leads), key from the Pro repository, the whole demo app, which includes flaws in Supabase configuration, infrastructure files and CI as well as in application code, so this recall belongs to the engine on this app and not to this pack alone",
+      "mapped": {
+        "what": "entry points",
+        "expected": 27,
+        "matched": 27,
+        "extra": 0
+      },
+      "flaws": {
+        "planted": 30,
+        "found": 20,
+        "false_findings": 0
+      },
+      "stability": {
+        "runs": 3,
+        "identical": true
+      }
+    },
+    {
+      "name": "mikro-orm/nestjs-realworld-example-app (seeded sample of its route registrations)",
+      "kind": "third_party",
+      "blind_key": true,
+      "source": "bench/PHASE6C-MEASURED-2026-10-14.md, recall by bench/phase6c-sample.ts with seed 20261017, three byte identical ci runs",
+      "mapped": {
+        "what": "entry points (real route registrations)",
+        "expected": 21,
+        "matched": 21,
+        "extra": 0
+      },
+      "flaws": null,
+      "stability": {
+        "runs": 3,
+        "identical": true
+      }
+    },
+    {
+      "name": "vercel/commerce (seeded sample of its route registrations)",
+      "kind": "third_party",
+      "blind_key": true,
+      "source": "bench/PHASE6C-MEASURED-2026-10-14.md, recall by bench/phase6c-sample.ts with seed 20261017, three byte identical ci runs",
+      "mapped": {
+        "what": "entry points (real route registrations)",
+        "expected": 6,
+        "matched": 6,
+        "extra": 0
+      },
+      "flaws": null,
+      "stability": {
+        "runs": 3,
+        "identical": true
+      }
+    }
+  ],
+  "proof": [
+    {
+      "scope": "Express with SQLite",
+      "planted": 4,
+      "proven": 4,
+      "runs": 3,
+      "false_proofs_fixed": 0,
+      "identical": true,
+      "source": "bench/PHASE4-MEASURED-2026-10-14.md (Colima, fixture test/fixtures/prove/express-sqlite)"
+    }
+  ],
+  "notes": [
+    "Entry points and flaws on the synthetic fixture come from a key kept in this repository, so that measurement is not blind. The blind measurement is the demo app, whose key lives in the Pro repository.",
+    "Express with SQLite is the only stack with a start recipe, measured on one fixture app. Next.js and NestJS entry points were measured on the demo and on Juice Shop only.",
+    "The NestJS fixture has no package.json, so NestJS detection is not exercised by it; its entry points are."
+  ]
+}

package/packs/node-ts/fixture-result.json

@@ -0,0 +1,114 @@
+{
+  "detect": {
+    "expected": [
+      "express",
+      "javascript",
+      "nextjs",
+      "typescript"
+    ],
+    "found": [
+      "express",
+      "javascript",
+      "nextjs",
+      "typescript"
+    ]
+  },
+  "engine": "0.5.0",
+  "measured": "2026-10-14",
+  "measurements": [
+    {
+      "blind_key": false,
+      "flaws": {
+        "false_findings": 0,
+        "found": 25,
+        "planted": 25
+      },
+      "kind": "synthetic",
+      "mapped": {
+        "expected": 26,
+        "extra": 0,
+        "matched": 26,
+        "what": "entry points"
+      },
+      "name": "test/fixtures/map/fail and test/fixtures/map/pass",
+      "source": "node bench/packs-measure.ts node-ts (key packs/node-ts/answer-key.json)",
+      "stability": {
+        "identical": true,
+        "runs": 3
+      }
+    },
+    {
+      "blind_key": true,
+      "flaws": {
+        "false_findings": 0,
+        "found": 20,
+        "planted": 30
+      },
+      "kind": "demo",
+      "mapped": {
+        "expected": 27,
+        "extra": 0,
+        "matched": 27,
+        "what": "entry points"
+      },
+      "name": "hullproof-demo",
+      "source": "bench/PHASE2-MEASURED-2026-10-11.md sections 2.1 and 2.2 (open core rules, new checks as leads), key from the Pro repository, the whole demo app, which includes flaws in Supabase configuration, infrastructure files and CI as well as in application code, so this recall belongs to the engine on this app and not to this pack alone",
+      "stability": {
+        "identical": true,
+        "runs": 3
+      }
+    },
+    {
+      "blind_key": true,
+      "flaws": null,
+      "kind": "third_party",
+      "mapped": {
+        "expected": 21,
+        "extra": 0,
+        "matched": 21,
+        "what": "entry points (real route registrations)"
+      },
+      "name": "mikro-orm/nestjs-realworld-example-app (seeded sample of its route registrations)",
+      "source": "bench/PHASE6C-MEASURED-2026-10-14.md, recall by bench/phase6c-sample.ts with seed 20261017, three byte identical ci runs",
+      "stability": {
+        "identical": true,
+        "runs": 3
+      }
+    },
+    {
+      "blind_key": true,
+      "flaws": null,
+      "kind": "third_party",
+      "mapped": {
+        "expected": 6,
+        "extra": 0,
+        "matched": 6,
+        "what": "entry points (real route registrations)"
+      },
+      "name": "vercel/commerce (seeded sample of its route registrations)",
+      "source": "bench/PHASE6C-MEASURED-2026-10-14.md, recall by bench/phase6c-sample.ts with seed 20261017, three byte identical ci runs",
+      "stability": {
+        "identical": true,
+        "runs": 3
+      }
+    }
+  ],
+  "notes": [
+    "Entry points and flaws on the synthetic fixture come from a key kept in this repository, so that measurement is not blind. The blind measurement is the demo app, whose key lives in the Pro repository.",
+    "Express with SQLite is the only stack with a start recipe, measured on one fixture app. Next.js and NestJS entry points were measured on the demo and on Juice Shop only.",
+    "The NestJS fixture has no package.json, so NestJS detection is not exercised by it; its entry points are."
+  ],
+  "pack": "node-ts",
+  "proof": [
+    {
+      "false_proofs_fixed": 0,
+      "identical": true,
+      "planted": 4,
+      "proven": 4,
+      "runs": 3,
+      "scope": "Express with SQLite",
+      "source": "bench/PHASE4-MEASURED-2026-10-14.md (Colima, fixture test/fixtures/prove/express-sqlite)"
+    }
+  ],
+  "schema": 1
+}

package/packs/node-ts/pack.json

@@ -0,0 +1,134 @@
+{
+  "schema": 1,
+  "id": "node-ts",
+  "name": "Node and TypeScript",
+  "summary": "Next.js, Express and Fastify family, NestJS and tRPC: entry points, protections, taint rules and checks. L4 for Express with a local SQLite file.",
+  "edition": "free",
+  "languages": [
+    "javascript",
+    "typescript"
+  ],
+  "frameworks": [
+    "nextjs",
+    "express",
+    "fastify",
+    "koa",
+    "hono",
+    "nestjs",
+    "trpc"
+  ],
+  "level": "L3",
+  "scopes": [
+    {
+      "where": "Express with SQLite",
+      "level": "L4"
+    }
+  ],
+  "limits": [
+    "Planted flaws were not measured on a real application. Routes that a library creates at run time and socket.io handlers are not read. A handler that passes the request to a helper which checks a secret is not followed."
+  ],
+  "parts": {
+    "detectors": [
+      "javascript",
+      "typescript",
+      "nextjs",
+      "express",
+      "fastify",
+      "koa",
+      "hono",
+      "nestjs",
+      "trpc"
+    ],
+    "extractors": [
+      {
+        "file": "src/map/js-express.ts"
+      },
+      {
+        "file": "src/map/js-next.ts"
+      },
+      {
+        "file": "src/map/js-misc.ts"
+      }
+    ],
+    "auth_patterns": [
+      {
+        "file": "src/map/vocab.ts"
+      }
+    ],
+    "sources_sinks": [
+      {
+        "file": "rules/semgrep/taint-javascript.yaml"
+      }
+    ],
+    "rules": [
+      {
+        "file": "rules/semgrep/taint-javascript.yaml",
+        "tests": [
+          "test/fixtures/rules/taint-javascript.js",
+          "test/fixtures/rules/taint-javascript.tsx"
+        ]
+      }
+    ],
+    "checks": [
+      {
+        "id": "check.map.admin-route-without-role"
+      },
+      {
+        "id": "check.map.data-read-without-auth"
+      },
+      {
+        "id": "check.map.mutating-route-without-auth"
+      },
+      {
+        "id": "check.map.privileged-action-without-audit"
+      },
+      {
+        "id": "check.map.privileged-field-from-request"
+      },
+      {
+        "id": "check.map.redirect-from-request"
+      },
+      {
+        "id": "check.map.request-url-fetched"
+      },
+      {
+        "id": "check.map.webhook-verify-before-use"
+      },
+      {
+        "id": "check.map.write-by-id-without-owner"
+      },
+      {
+        "id": "check.map.read-by-id-without-owner"
+      },
+      {
+        "id": "check.web.cors-no-reflected-origin"
+      },
+      {
+        "id": "check.api.webhook-verified-before-use"
+      },
+      {
+        "id": "check.authz.owner-filter-on-id-read"
+      },
+      {
+        "id": "check.authz.admin-role-check"
+      }
+    ],
+    "mapping": [
+      {
+        "file": "src/checks/map/entry-checks.ts"
+      }
+    ],
+    "start_recipe": {
+      "file": "src/prove/recipe.ts",
+      "recipe": "node-express"
+    }
+  },
+  "fixture": {
+    "dir": "test/fixtures/map/fail",
+    "fixed_dir": "test/fixtures/map/pass",
+    "answer_keys": [
+      "in_repo"
+    ],
+    "result": "packs/node-ts/fixture-result.json"
+  }
+}