hullproof 0.0.0-stage → 0.5.0

package/rules/tiers.json

@@ -0,0 +1,427 @@
+{
+  "min_judged": 3,
+  "rules": {
+    "check.map.data-read-without-auth": {
+      "date": "2026-10-11",
+      "evidence": "Juice Shop 0e6d909 and BenchmarkPython f129148, hand checked samples of 20 findings each, seed 20261011, engine a3035af; see bench/PHASE2-MEASURED-2026-10-11.md",
+      "judged": 3,
+      "precision": 0,
+      "tier": "lead"
+    },
+    "check.map.mutating-route-without-auth": {
+      "date": "2026-10-11",
+      "evidence": "Juice Shop 0e6d909 and BenchmarkPython f129148, hand checked samples of 20 findings each, seed 20261011, engine a3035af; see bench/PHASE2-MEASURED-2026-10-11.md",
+      "judged": 27,
+      "precision": 0.44,
+      "tier": "lead"
+    },
+    "check.map.privileged-field-from-request": {
+      "date": "2026-10-11",
+      "evidence": "Juice Shop 0e6d909 and BenchmarkPython f129148, hand checked samples of 20 findings each, seed 20261011, engine a3035af; see bench/PHASE2-MEASURED-2026-10-11.md",
+      "judged": 1,
+      "precision": 0,
+      "tier": "lead"
+    },
+    "check.map.read-by-id-without-owner": {
+      "date": "2026-10-14",
+      "evidence": "hand judged against the route chain: OWASP RailsGoat f5951f1 (6 places, all true), Juice Shop (1 true), hullproof-demo F04 (1 true), WebGoat (1 not the flaw); BenchmarkPython and the other nine real apps had no hit; see bench/PHASE6C-MEASURED-2026-10-14.md",
+      "judged": 9,
+      "needs_judged": 20,
+      "precision": 0.89,
+      "tier": "lead"
+    },
+    "check.map.write-by-id-without-owner": {
+      "date": "2026-10-11",
+      "evidence": "Juice Shop 0e6d909 and BenchmarkPython f129148, hand checked samples of 20 findings each, seed 20261011, engine a3035af; see bench/PHASE2-MEASURED-2026-10-11.md",
+      "judged": 1,
+      "precision": 0,
+      "tier": "lead"
+    },
+    "hullproof-api-route-no-auth": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "gate"
+    },
+    "hullproof-cors-origin-true": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "gate"
+    },
+    "hullproof-cors-reflect-origin": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "gate"
+    },
+    "hullproof-dynamic-module-path": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "gate"
+    },
+    "hullproof-eval-or-new-function": {
+      "date": "2026-10-10",
+      "evidence": "Juice Shop 0e6d909, hand checked records in shipped code, pro run samples with seeds 20261010 and 20261011 (before and after)",
+      "judged": 1,
+      "precision": 0,
+      "tier": "gate"
+    },
+    "hullproof-eval-through-alias": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "gate"
+    },
+    "hullproof-expression-library-eval": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "gate"
+    },
+    "hullproof-log-session-token": {
+      "date": "2026-10-10",
+      "evidence": "Juice Shop 0e6d909, hand checked records in shipped code, pro run samples with seeds 20261010 and 20261011 (before and after)",
+      "judged": 2,
+      "precision": 0,
+      "tier": "gate"
+    },
+    "hullproof-math-random-token": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "gate"
+    },
+    "hullproof-next-public-secret-name": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "gate"
+    },
+    "hullproof-postgrest-filter-string": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "gate"
+    },
+    "hullproof-postgrest-interpolated-filter": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "gate"
+    },
+    "hullproof-raw-sql-concat": {
+      "date": "2026-10-10",
+      "evidence": "Juice Shop 0e6d909, hand checked records in shipped code, pro run samples with seeds 20261010 and 20261011 (before and after)",
+      "judged": 2,
+      "precision": 1,
+      "tier": "gate"
+    },
+    "hullproof-read-by-id-no-owner": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "gate"
+    },
+    "hullproof-server-action-no-auth": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "gate"
+    },
+    "hullproof-sql-built-string-reaches-query": {
+      "date": "2026-10-10",
+      "evidence": "Juice Shop 0e6d909, hand checked records in shipped code, pro run samples with seeds 20261010 and 20261011 (before and after)",
+      "judged": 4,
+      "precision": 1,
+      "tier": "gate"
+    },
+    "hullproof-sql-raw-non-literal": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "gate"
+    },
+    "hullproof-sql-string-built-in-variable": {
+      "date": "2026-10-10",
+      "evidence": "Juice Shop 0e6d909, hand checked records in shipped code, pro run samples with seeds 20261010 and 20261011 (before and after)",
+      "judged": 4,
+      "precision": 1,
+      "tier": "gate"
+    },
+    "hullproof-sql-tagged-template-misuse": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "gate"
+    },
+    "hullproof-ssrf-request-data-to-url": {
+      "date": "2026-10-10",
+      "evidence": "Juice Shop 0e6d909, hand checked records in shipped code, pro run samples with seeds 20261010 and 20261011 (before and after)",
+      "judged": 1,
+      "precision": 1,
+      "tier": "gate"
+    },
+    "hullproof-ssrf-stored-url": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "gate"
+    },
+    "hullproof-ssrf-url-built-from-base": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "gate"
+    },
+    "hullproof-subprocess-arg-no-separator": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "gate"
+    },
+    "hullproof-subprocess-request-data": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "gate"
+    },
+    "hullproof-subprocess-shell-interpreter": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "gate"
+    },
+    "hullproof-subprocess-shell-string": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "gate"
+    },
+    "hullproof-taint-go-command-injection": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "lead"
+    },
+    "hullproof-taint-go-path-traversal": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "lead"
+    },
+    "hullproof-taint-go-sql-injection": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "lead"
+    },
+    "hullproof-taint-go-ssrf": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "lead"
+    },
+    "hullproof-taint-go-xss": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "lead"
+    },
+    "hullproof-taint-java-command-injection": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "lead"
+    },
+    "hullproof-taint-java-path-traversal": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "lead"
+    },
+    "hullproof-taint-java-sql-injection": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "lead"
+    },
+    "hullproof-taint-java-ssrf": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "lead"
+    },
+    "hullproof-taint-java-xss": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "lead"
+    },
+    "hullproof-taint-js-command-injection": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "lead"
+    },
+    "hullproof-taint-js-path-traversal": {
+      "date": "2026-10-10",
+      "evidence": "Juice Shop 0e6d909, hand checked records in shipped code, pro run samples with seeds 20261010 and 20261011 (before and after)",
+      "judged": 3,
+      "precision": 0,
+      "tier": "lead"
+    },
+    "hullproof-taint-js-sql-injection": {
+      "date": "2026-10-10",
+      "evidence": "Juice Shop 0e6d909, hand checked records in shipped code, pro run samples with seeds 20261010 and 20261011 (before and after)",
+      "judged": 2,
+      "precision": 1,
+      "tier": "lead"
+    },
+    "hullproof-taint-js-ssrf": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "lead"
+    },
+    "hullproof-taint-js-xss": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "lead"
+    },
+    "hullproof-taint-php-command-injection": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "lead"
+    },
+    "hullproof-taint-php-path-traversal": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "lead"
+    },
+    "hullproof-taint-php-sql-injection": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "lead"
+    },
+    "hullproof-taint-php-ssrf": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "lead"
+    },
+    "hullproof-taint-php-xss": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "lead"
+    },
+    "hullproof-taint-py-command-injection": {
+      "date": "2026-10-10",
+      "evidence": "BenchmarkPython f129148, cases flagged in the rule's own category",
+      "judged": 7,
+      "precision": 0.71,
+      "tier": "lead"
+    },
+    "hullproof-taint-py-path-traversal": {
+      "date": "2026-10-10",
+      "evidence": "BenchmarkPython f129148, cases flagged in the rule's own category",
+      "judged": 53,
+      "precision": 0.43,
+      "tier": "lead"
+    },
+    "hullproof-taint-py-sql-injection": {
+      "date": "2026-10-10",
+      "evidence": "BenchmarkPython f129148, cases flagged in the rule's own category",
+      "judged": 2,
+      "precision": 1,
+      "tier": "lead"
+    },
+    "hullproof-taint-py-ssrf": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "lead"
+    },
+    "hullproof-taint-py-xss": {
+      "date": "2026-10-10",
+      "evidence": "BenchmarkPython f129148, cases flagged in the rule's own category",
+      "judged": 37,
+      "precision": 0.38,
+      "tier": "lead"
+    },
+    "hullproof-tool-handler-admin-client-no-scope": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "gate"
+    },
+    "hullproof-user-metadata-authz": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "gate"
+    },
+    "hullproof-verify-result-unused": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "gate"
+    },
+    "hullproof-webhook-parse-before-verify": {
+      "date": null,
+      "evidence": "not measured yet",
+      "judged": 0,
+      "precision": null,
+      "tier": "gate"
+    }
+  },
+  "threshold": 0.8
+}

package/schemas/check-results.schema.json

@@ -0,0 +1,55 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hullproof.invalid/engine/check-results.schema.json",
+  "title": "Hullproof Engine executable check results (checks.json)",
+  "description": "Results sorted by check_id, evidence by file then line, not_run by check_id. No timestamp.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "commit", "results", "not_run"],
+  "properties": {
+    "schema_version": {"const": "1.0.0"},
+    "commit": {"type": ["string", "null"], "pattern": "^[0-9a-f]{40}$"},
+    "results": {
+      "type": "array",
+      "items": {
+        "type": "object", "additionalProperties": false,
+        "required": ["check_id", "sec_ids", "result", "evidence", "absence_search", "message_key"],
+        "properties": {
+          "check_id": {"type": "string", "pattern": "^check\\.[a-z0-9-]+\\.[a-z0-9-]+$"},
+          "sec_ids": {"type": "array", "minItems": 1, "items": {"type": "string", "pattern": "^SEC-[A-Z]+-[0-9]{3}$"}},
+          "result": {"type": "string", "pattern": "^(FAIL|PASS \\(static\\)|NOT APPLICABLE|NOT ASSESSED: (NEEDS DASHBOARD|NEEDS BUILD|NEEDS DYNAMIC TEST|ASK OWNER|ATTESTATION|UNKNOWN))$"},
+          "evidence": {
+            "type": "array",
+            "items": {
+              "type": "object", "additionalProperties": false, "required": ["file", "note"],
+              "properties": {
+                "file": {"type": "string", "minLength": 1, "maxLength": 300, "pattern": "^[^/\\\\]"},
+                "line": {"type": "integer", "minimum": 1},
+                "key": {"type": "string", "minLength": 1},
+                "note": {"type": "string", "minLength": 1, "maxLength": 300}
+              }
+            }
+          },
+          "absence_search": {
+            "type": ["object", "null"], "additionalProperties": false,
+            "required": ["pattern", "files_searched", "file_globs", "matches"],
+            "properties": {
+              "pattern": {"type": "string", "minLength": 1},
+              "files_searched": {"type": "integer", "minimum": 0},
+              "file_globs": {"type": "array", "items": {"type": "string", "minLength": 1}},
+              "matches": {"type": "integer", "minimum": 0}
+            }
+          },
+          "message_key": {"type": "string", "minLength": 1, "maxLength": 240}
+        }
+      }
+    },
+    "not_run": {
+      "type": "array",
+      "items": {
+        "type": "object", "additionalProperties": false, "required": ["check_id", "reason"],
+        "properties": {"check_id": {"type": "string", "minLength": 1}, "reason": {"type": "string", "minLength": 1}}
+      }
+    }
+  }
+}

package/schemas/check.schema.json

@@ -0,0 +1,41 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hullproof.invalid/engine/check.schema.json",
+  "title": "Hullproof Engine executable check definition (checks/*.json)",
+  "description": "Data only, no code. One interpreter in the engine runs the op. Every check ships a pass fixture and a fail fixture.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["id", "sec_ids", "applies_when", "op", "on_true", "on_false", "fixtures"],
+  "oneOf": [
+    {"description": "A declarative check: one of the ten ops, with its params.", "required": ["params"], "properties": {"op": {"enum": ["file_exists", "file_exists_for_each", "file_absent", "regex_present", "regex_absent", "json_value", "sql_every_table_has", "workflow_uses_pinned_sha", "workflow_permissions", "version_in_table"]}}},
+    {"description": "A code check: op code, module names the TypeScript file in src/checks/code/ that holds run(). No params.", "required": ["module"], "properties": {"op": {"const": "code"}}}
+  ],
+  "properties": {
+    "id": {"type": "string", "pattern": "^check\\.[a-z0-9-]+\\.[a-z0-9-]+$"},
+    "sec_ids": {"type": "array", "minItems": 1, "items": {"type": "string", "pattern": "^SEC-[A-Z]+-[0-9]{3}$"}},
+    "applies_when": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Stack categories from stack.json. The check runs when every named category has an item whose id is listed, or any item when the value is \"*\". An empty object means always.",
+      "properties": {
+        "languages": {"$ref": "#/$defs/match"}, "runtimes": {"$ref": "#/$defs/match"}, "frameworks": {"$ref": "#/$defs/match"},
+        "package_managers": {"$ref": "#/$defs/match"}, "data_stores": {"$ref": "#/$defs/match"}, "auth": {"$ref": "#/$defs/match"},
+        "payments": {"$ref": "#/$defs/match"}, "ai": {"$ref": "#/$defs/match"}, "hosting": {"$ref": "#/$defs/match"},
+        "iac": {"$ref": "#/$defs/match"}, "containers": {"$ref": "#/$defs/match"}, "ci": {"$ref": "#/$defs/match"}, "mobile": {"$ref": "#/$defs/match"}
+      }
+    },
+    "op": {"enum": ["file_exists", "file_exists_for_each", "file_absent", "regex_present", "regex_absent", "json_value", "sql_every_table_has", "workflow_uses_pinned_sha", "workflow_permissions", "version_in_table", "code"]},
+    "params": {"type": "object"},
+    "module": {"type": "string", "pattern": "^src/checks/code/[a-z0-9-]+\\.ts$"},
+    "on_true": {"$ref": "#/$defs/result"},
+    "on_false": {"$ref": "#/$defs/result"},
+    "fixtures": {
+      "type": "object", "additionalProperties": false, "required": ["pass", "fail"],
+      "properties": {"pass": {"type": "string", "minLength": 1}, "fail": {"type": "string", "minLength": 1}}
+    }
+  },
+  "$defs": {
+    "match": {"oneOf": [{"const": "*"}, {"type": "array", "minItems": 1, "items": {"type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$"}}]},
+    "result": {"type": "string", "pattern": "^(FAIL|PASS \\(static\\)|NOT APPLICABLE|NOT ASSESSED: (NEEDS DASHBOARD|NEEDS BUILD|NEEDS DYNAMIC TEST|ASK OWNER|ATTESTATION|UNKNOWN))$"}
+  }
+}