ikanban 0.3.2 → 0.3.4

package/LICENSE.md

@@ -0,0 +1,26 @@
+# iKanban CLI licence
+
+Copyright © VerBodh Pte. Ltd., Singapore. All rights reserved.
+
+The `ikanban` package (the command-line tool and the scanners it runs) is proprietary software.
+It is not open source.
+
+## What you may do
+- Install and run it to scan your own code, AI endpoints and reports, and to send the results to
+  your own iKanban account.
+- Run it on your own machines and in your own CI.
+- Run it without an iKanban account; publishing results needs one (the server checks your plan).
+
+## What you may not do
+- Copy, change, or share the package or its source, except as needed to run it.
+- Sell, rent, sublicense, or offer it as part of another product or service.
+- Use it to build a product that competes with iKanban.
+- Remove this notice.
+
+## No warranty
+The package is provided "as is", without warranty of any kind. VerBodh Pte. Ltd. is not liable for
+any claim or damage that comes from using it. A scan can miss a vulnerability; a clean report is not
+proof that code is safe.
+
+## Questions
+support@verbodh.com · https://i-kanban.com

package/README.md

@@ -38,3 +38,7 @@ iKanban checks your plan when you publish; a plan that does not include it gets
 
 Nothing, unless you pass `--publish`. With `--publish`, the report and its findings go to iKanban.
 Secrets found in your repo are masked in the report before anything is sent.
+
+## Licence
+
+Proprietary: you may run it for your own code and your own iKanban account. See [LICENSE.md](LICENSE.md).

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "ikanban",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "iKanban CLI: AI and security scans of your own repo, with results filed into iKanban",
   "bin": { "ikanban": "bin/ikanban.js" },
-  "files": ["bin", "lib", "hooks", "scanners", "README.md"],
+  "files": ["bin", "lib", "hooks", "scanners", "README.md", "LICENSE.md"],
   "scripts": {
     "prepack": "node scripts/copy-scanners.js",
     "pretest": "node scripts/copy-scanners.js",
@@ -13,5 +13,5 @@
   "homepage": "https://i-kanban.com",
   "keywords": ["ikanban", "security", "scanner", "ai", "cli"],
   "author": "VerBodh <support@verbodh.com>",
-  "license": "UNLICENSED"
+  "license": "SEE LICENSE IN LICENSE.md"
 }

package/scanners/ikanban-secscan.py

@@ -64,7 +64,7 @@ from pathlib import Path
 # that npm no longer hosts the package. Starting at 1.0.0 rather than continuing
 # the npm package's 0.1.x line: that counter belonged to the wrapper, not to
 # this file, and reusing it would suggest a continuity that does not exist.
-SECSCAN_VERSION = "1.2.1"
+SECSCAN_VERSION = "1.3.0"
 
 SEVERITIES = ["critical", "high", "medium", "low", "info"]
 SEVERITY_RANK = {s: i for i, s in enumerate(SEVERITIES)}
@@ -430,6 +430,50 @@ def git_ignored(root: Path, rels: list) -> set:
     return {l.strip() for l in p.stdout.splitlines() if l.strip()}
 
 
+# Plan 11 G6: test code inside a normal file holds fake keys as often as a test folder
+# does (a Rust #[cfg(test)] module, a #[test] fn, a Python test_ function). Its lines are
+# suppressed and counted like a test path.
+# ponytail: braces are counted without parsing strings or comments, so a brace inside a
+# string can end a Rust block early; a real parser is the upgrade if that misses cases.
+RUST_TEST_ATTR = re.compile(r"^\s*#\[(cfg\(test\)|test)\]")
+PY_TEST_DEF = re.compile(r"^(\s*)(async\s+)?def test_\w*\s*\(")
+
+
+def test_code_lines(rel: str, text: str) -> set:
+    lines = text.splitlines()
+    out = set()
+    if rel.endswith(".rs"):
+        i = 0
+        while i < len(lines):
+            if not RUST_TEST_ATTR.match(lines[i]):
+                i += 1
+                continue
+            depth, opened, j = 0, False, i
+            while j < len(lines):
+                depth += lines[j].count("{") - lines[j].count("}")
+                opened = opened or "{" in lines[j]
+                out.add(j + 1)
+                if opened and depth <= 0:
+                    break
+                j += 1
+            i = j + 1
+    elif rel.endswith(".py"):
+        i = 0
+        while i < len(lines):
+            m = PY_TEST_DEF.match(lines[i])
+            if not m:
+                i += 1
+                continue
+            indent = len(m.group(1))
+            out.add(i + 1)
+            j = i + 1
+            while j < len(lines) and (not lines[j].strip() or len(lines[j]) - len(lines[j].lstrip()) > indent):
+                out.add(j + 1)
+                j += 1
+            i = j
+    return out
+
+
 def scan_secrets(root: Path) -> Section:
     sec = Section("Committed secrets")
     sec.ran.append(f"{len(SECRET_RULES)} high-confidence patterns")
@@ -441,13 +485,16 @@ def scan_secrets(root: Path) -> Section:
             text = path.read_text(errors="ignore")
         except OSError:
             continue
+        in_test = None
         for _id, severity, rx, desc in SECRET_RULES:
             for m in rx.finditer(text):
                 line_no = text.count("\n", 0, m.start()) + 1
                 line = text.splitlines()[line_no - 1] if line_no <= len(text.splitlines()) else ""
                 if EXAMPLE_MARKERS.search(line):
                     continue
-                if is_fixture:
+                if in_test is None:
+                    in_test = test_code_lines(rel, text)
+                if is_fixture or line_no in in_test:
                     suppressed += 1
                     continue
                 hit = m.group(0)
@@ -477,7 +524,7 @@ def scan_secrets(root: Path) -> Section:
 
     if suppressed:
         sec.skipped.append(
-            f"{suppressed} match(es) in test/fixture/doc paths were suppressed "
+            f"{suppressed} match(es) in test code, test/fixture/doc paths were suppressed "
             "as expected fake credentials — re-check by hand if a real secret "
             "could have been committed to a test file")
     return sec