openpitstop 1.1.0 → 1.3.0

package/PRIVACY.md

@@ -0,0 +1,88 @@
+# OpenPitStop Privacy Statement
+
+**Zero telemetry. Zero SaaS. Zero accounts. Nothing leaves your machine unless
+you explicitly ask for it.**
+
+This is not a marketing sentence — it is a guarantee you can verify. OpenPitStop
+is a local CLI: it reads files on your machine, writes reports to
+`.pitstop/` on your machine, and makes network calls only in the exact,
+explicit cases listed below.
+
+## What OpenPitStop never does
+
+- **No telemetry.** No analytics SDK, no anonymous usage stats, no crash
+  reporting, no "phone home" of any kind — not even a version check.
+- **No SaaS, no accounts, no cloud.** There is no OpenPitStop server, no
+  dashboard, no login. Nothing to sign up for.
+- **No code uploads.** `scan`, `try`, `verify`, `gate`, `integrity`, `pen`,
+  `ledger`, `watch`, `trends`, `digest`, `share`, `honesty` — every one of
+  these analyzes your files locally. Your source never leaves your machine.
+- **No third-party processes** are ever spawned that you didn't initiate
+  (`scan` runs the scanners you have installed, e.g. `gitleaks`, `semgrep`,
+  `osv-scanner`, `pip-audit` — or honestly reports them as `skipped`).
+- **The static security pass is fully offline.** It reads files and matches
+  patterns on your machine; it never sends code anywhere. The only network
+  calls in the entire security pipeline are the dependency audits listed
+  below.
+- **No auto-updates.** The CLI never updates itself or checks for updates.
+  You control when you run a newer version (`npx openpitstop@latest`).
+
+## The complete list of network calls
+
+Every outbound connection OpenPitStop (or the tools it invokes) can make:
+
+| When | What connects | What it sends | Where it goes |
+|---|---|---|---|
+| You run `npx openpitstop` or `npm i -g openpitstop` | npm client | package download (standard npm request) | registry.npmjs.org |
+| `scan`/`try` — security category on a JS repo | `npm audit` | your lockfile's dependency list (the standard npm audit payload) | registry.npmjs.org |
+| `scan`/`try` — security category on Python repos | `pip-audit` (if installed) | dependency list | its configured index |
+| `scan`/`try` — security category on other stacks | `osv-scanner` (if installed) | manifest/lockfile data | the OSV API (osv.dev) |
+| `pen` / `scan --ledger` | *nothing external* | — | none |
+
+Everything else — including the entire `pen` and `ledger` dynamic phases — runs
+against **your own app on localhost**: outbound HTTP is intercepted in-process
+(nock) or rerouted to a local recording proxy, raw sockets are blocked, and
+known payment-gateway hosts are answered with mocked receipts. If a request
+cannot be intercepted, the run **aborts** (`exit 77`) rather than letting it
+through. Nothing your app says ever reaches a real payment gateway or any real
+third party.
+
+Audit results (`npm audit`, `osv-scanner`) are cached locally for 24 hours
+(keyed on your lockfile's hash) so repeated scans inside one fix loop don't hit
+the registry again — the cache is a local file, deleted when you delete it.
+
+## What OpenPitStop stores
+
+All local, all in your repo:
+
+- `.pitstop/` — sealed scan/verify/pen/ledger evidence, audit caches, memory
+  notes. Human-readable JSON, signed with a `sha256` fingerprint so the files
+  are tamper-evident (and so *you* can detect any tampering).
+- `PITSTOP_REPORT.md`, `PITSTOP_PEN_REPORT.md`, `PITSTOP_BADGE.svg`,
+  `PITSTOP_CARD.html` — the reports you explicitly asked for.
+- `PITSTOP_BADGE.json` — only with `report --badge-json`; it contains the
+  score, nothing else.
+
+Nothing is written outside your project except the `/pitstop` slash-command
+files that `pitstop install` places in your AI tool's own config directories —
+and `install --uninstall` removes exactly those files and nothing else.
+
+## How to verify all of this
+
+1. **Read the source.** The CLI is fully open (MIT). The network surface is
+   small and greppable: `npm audit`, `osv-scanner`, `pip-audit`, and the
+   localhost-only sandbox in `src/sandbox/` are the entire surface.
+2. **Watch it with a firewall.** Run `npx openpitstop scan` with your
+   firewall in "ask" mode: the only connections you'll be asked about are the
+   npm/osv audits above — and none at all during `pen` or `ledger`.
+3. **Disconnect.** `scan`, `verify`, `gate`, `integrity`, `pen`, `ledger`
+   (ledger replays against your app locally) all run fully offline. Only the
+   dependency-audit categories degrade (to an honest `skipped` with a hint) —
+   they never block or fake anything.
+
+## The short version
+
+> OpenPitStop is a referee that lives on your machine. It keeps score in your
+> repo, ships no data anywhere, and calls out any network at all — because the
+> whole point is that the numbers can't be argued with. If we ever needed a
+> server, the honesty brand would die with it; so we won't.

package/README.md

@@ -213,6 +213,17 @@ verbatim gate output you can screenshot and share: [Caught in the wild](docs/cau
 
 One command, that's it:
 
+```bash
+npx openpitstop
+```
+
+No arguments needed: the CLI detects your AI tools, and asks what you want —
+install `/pitstop` into them, score *this* repo (`try .`), or watch the 90-second
+demo. Pick, and it does it. (In a non-interactive terminal it skips the
+questions and prints the one-line menu instead.)
+
+Or go straight to the files:
+
 ```bash
 npx openpitstop@latest install
 ```
@@ -330,13 +341,33 @@ editing, knowing it's being watched.
 ### The scan
 
 `pitstop scan` runs a bunch of checks on your repo: circular imports, known security
-issues (`npm audit`, plus `pip-audit`/`osv-scanner` for Python and other stacks, and
-`gitleaks`/`semgrep` when installed), duplicated code (`jscpd`), test results
+issues, duplicated code (`jscpd`), test results
 (jest/vitest/pytest plus native suites for Go, Rust, Flutter/Dart, .NET and Java
 (Maven/Gradle) — pass/fail, duration, coverage), build speed, accessibility, flaky-test
 and race-condition heuristics, and developer-experience checks (unused exports, duplicate
 functions).
 
+Security is two layers:
+
+1. **Dependency audits** — `npm audit`, plus `pip-audit`/`osv-scanner` for Python and
+   other stacks, and `gitleaks`/`semgrep` when installed. A failed audit is reported as
+   `skipped` with a repair hint — deps that were never scanned are never reported as clean.
+2. **The static vulnerability pass** (fully offline, every language, no tooling needed) —
+   the five classic classes plus the full posture: **SQL injection** (concatenated/
+   interpolated queries, ORM raw builders, `$where`, Python f-strings), **authentication**
+   (cleartext password compares, missing hashing, `Math.random` tokens, inline JWT
+   secrets, missing rate limits), **authorization** (unprotected data routes, admin
+   routes without role checks), **input validation** (unrestricted uploads, unvalidated
+   money fields, `eval`, XSS sinks), **secret management** (known credential formats,
+   inline secret literals, committed `.env` files) — plus command injection, path
+   traversal, SSRF, CORS+credentials, missing security headers, CSRF exposure, stack
+   leaks and sensitive logging.
+
+Every static finding is labeled `[indicated]` and ships with its exact **fix**; `scan`
+and `try` print the complete identify-and-solve list under the score box, so the report
+is a worklist, not a scare. The full matrix — every detection and every fix — is in
+[docs/security.md](docs/security.md).
+
 Each check either contributes a real number, or prints `skipped` with a one-line hint on
 how to install the tool it needs — it never makes up a number. Everything adds up to one
 box that always opens with the **OpenPitStop Score**: a single 0–100 health number (with an
@@ -403,6 +434,7 @@ one-shot.
 | Command | What it does |
 |---|---|
 | `pitstop install` / `install --uninstall` | Writes `/pitstop` into every supported tool (project + user level). `--uninstall` removes it all. `--hooks` also installs (or with `--uninstall`, removes) the git pre-commit gate. |
+| `pitstop` (no args) | The guided first-run: detects your AI tools and git repo, then offers to install, score this repo (`try .`), or run the demo. Non-TTY prints the one-line menu instead. |
 | `pitstop doctor` | Explains why categories show `skipped`: checks your toolchain (Node, git, jscpd, gitleaks, semgrep, pa11y) and prints copy-paste install hints. |
 | `pitstop prompt [--args …]` | Prints the exact prompt your AI tool expands `/pitstop` into, with your arguments filled in — full transparency into what the agent was told. |
 | `pitstop demo [demo]` | Scaffolds an intentionally-broken demo repo into a fresh temp dir (`demo-repo`, `demo-repo-integrity`, `demo-repo-fintech`, `demo-repo-generators`), initializes git, and scans it immediately. |
@@ -497,8 +529,12 @@ cheat its own referee. That separation is the product.
 
 - **Windows** is CI-verified on every push (build + smoke on `ubuntu-latest` and
   `windows-latest`), and the Windows-specific bugs were reproduced and fixed on a real
-  Windows host during development — but not every workflow has been exhaustively manually
-  tested on Windows.
+  Windows host during development. `watch`, `pen`, `pen --fix` and `scan --ledger` have
+  additionally been run end-to-end on a real Windows host against the demo repos: a live
+  watch delta, PROVEN ledger double-charges with sealed evidence, and honest pen
+  verdicts (including the honest "0 patches" case) all verified. The one remaining
+  caveat is breadth, not correctness: not every exotic repo shape has been manually
+  exercised on Windows.
 - **Codex App / VS Code extension** isn't supported and won't be until OpenAI ships custom
   slash commands; use Codex CLI for `/pitstop`.
 - **Graceful degradation:** duplication (`jscpd`), secrets/code scanning (`gitleaks`,
@@ -529,6 +565,16 @@ cheat its own referee. That separation is the product.
   after the fix), not from the static score — the static gate has nothing to say about a
   runtime-only finding.
 
+## Privacy
+
+**Zero telemetry, zero SaaS, zero accounts — nothing leaves your machine unless you ask
+it to.** OpenPitStop is a local CLI with no server and no phone-home: scans, gates and
+pen tests run entirely on your machine, and the only network calls in the entire codebase
+are the dependency audits you can see and opt out of (plus the `npx` download you
+initiated). The full, auditable list — every connection, every cache, every file stored —
+is in [PRIVACY.md](PRIVACY.md). The honesty brand is the product; that statement is the
+receipt.
+
 ## Contributing
 
 OpenPitStop is built to be extended — adding a whole new analyzer is a small, well-scoped

package/dist/analyzers/security.js

@@ -2,39 +2,61 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { commandExists, detectLanguage, safeExecAsync } from "./util.js";
+import { analyzeSecurityStatic } from "./securityStatic.js";
 /** How long an npm-audit result is reused before re-fetching from the registry. */
 const AUDIT_TTL_MS = 24 * 60 * 60 * 1000;
 export async function analyzeSecurity(repo) {
     const lang = detectLanguage(repo);
-    const issues = [];
+    // The offline static pass runs for EVERY language (even "unknown"): it is
+    // deterministic, needs no tooling, and covers the vulnerability classes
+    // that AI-generated code ships most often (SQL injection, secrets, XSS,
+    // authz gaps, money inputs). Its findings are labeled [indicated].
+    const issues = [...analyzeSecurityStatic(repo)];
     let depNote;
     if (lang === "js") {
         // npm audit exits 1 when vulnerabilities exist but still prints the full
         // JSON — capture stdout and persist it for parsing either way. The result
         // is cached keyed on the lockfile hash: an unchanged lockfile (the common
         // case inside one fix loop) makes the audit network call disappear.
-        const stdout = await npmAudit(repo);
-        if (stdout) {
+        const audit = await npmAudit(repo);
+        if (audit.error) {
+            // Honesty over numbers: a broken lockfile means dependencies are NOT
+            // scanned — that is never reported as "clean".
+            depNote = audit.error;
+        }
+        else if (audit.stdout) {
             const auditFile = path.join(repo, ".pitstop", "npm-audit.json");
             fs.mkdirSync(path.dirname(auditFile), { recursive: true });
-            fs.writeFileSync(auditFile, stdout);
-            issues.push(...parseNpmAudit(stdout));
+            fs.writeFileSync(auditFile, audit.stdout);
+            issues.push(...parseNpmAudit(audit.stdout));
         }
     }
     else if (lang === "python") {
         if (commandExists("pip-audit")) {
             const r = await safeExecAsync("pip-audit", ["-f", "json"], repo, 120000);
-            if (r.stdout)
+            if (r.stdout && (r.code === 0 || looksLikeJson(r.stdout))) {
                 issues.push(...parsePipAudit(r.stdout));
+            }
+            else {
+                depNote = `pip-audit failed (${firstLine(r.stderr || r.stdout)}) — deps not scanned`;
+            }
         }
         else {
             // pip-audit missing — OSV understands pyproject.toml / poetry.lock etc.
-            issues.push(...(await osvScan(repo)));
+            const osv = await osvScan(repo);
+            if (osv.error)
+                depNote = osv.error;
+            else
+                issues.push(...osv.issues);
         }
     }
     else if (lang !== "unknown") {
         if (commandExists("osv-scanner")) {
-            issues.push(...(await osvScan(repo)));
+            const osv = await osvScan(repo);
+            if (osv.error)
+                depNote = osv.error;
+            else
+                issues.push(...osv.issues);
         }
         else {
             depNote = `install osv-scanner (go install github.com/google/osv-scanner/cmd/osv-scanner@latest) to scan ${lang} dependencies`;
@@ -76,10 +98,26 @@ export async function analyzeSecurity(repo) {
     }
     return { status: "ok", issues };
 }
+/** The lockfile exists but npm refuses to read it — a real finding on its own. */
+function lockfileHint() {
+    return "run `npm i --package-lock-only` to repair the lockfile, then re-scan";
+}
+function looksLikeJson(s) {
+    try {
+        JSON.parse(s);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function firstLine(s) {
+    return (s || "").split(/\r?\n/).map((l) => l.trim()).filter(Boolean)[0] ?? "unknown error";
+}
 async function npmAudit(repo) {
     const lockCandidate = ["package-lock.json", "npm-shrinkwrap.json", "package.json"].find((f) => fs.existsSync(path.join(repo, f)));
     if (!lockCandidate)
-        return null;
+        return { stdout: null, error: null };
     const hash = crypto
         .createHash("sha1")
         .update(fs.readFileSync(path.join(repo, lockCandidate)))
@@ -94,8 +132,12 @@ async function npmAudit(repo) {
             if (cached &&
                 typeof cached.stdout === "string" &&
                 typeof cached.at === "string" &&
-                Date.now() - Date.parse(cached.at) < AUDIT_TTL_MS) {
-                return cached.stdout;
+                Date.now() - Date.parse(cached.at) < AUDIT_TTL_MS &&
+                // Never trust a cached failure: only a parseable audit report is a
+                // valid cache hit (older versions cached stdout even when audit errored).
+                looksLikeJson(cached.stdout) &&
+                typeof JSON.parse(cached.stdout)?.vulnerabilities === "object") {
+                return { stdout: cached.stdout, error: null };
             }
         }
         catch {
@@ -103,15 +145,35 @@ async function npmAudit(repo) {
         }
     }
     const r = await safeExecAsync("npm", ["audit", "--json"], repo, 120000);
-    if (r.stdout) {
+    // Success means a real audit report: JSON that carries a `vulnerabilities`
+    // object. npm exits 0 on a clean audit and 1 when vulnerabilities exist —
+    // but it ALSO exits 1 and prints a JSON `error` payload when the audit
+    // itself fails (e.g. ENOLOCK). Anything without `vulnerabilities` is a
+    // failed audit, and reporting that as "clean" would be lying.
+    let auditJson = null;
+    try {
+        auditJson = JSON.parse(r.stdout || "");
+    }
+    catch {
+        auditJson = null;
+    }
+    if (auditJson && typeof auditJson.vulnerabilities === "object") {
         try {
             fs.writeFileSync(cachePath, JSON.stringify({ at: new Date().toISOString(), stdout: r.stdout }));
         }
         catch {
             /* cache write is best-effort */
         }
+        return { stdout: r.stdout, error: null };
     }
-    return r.stdout || null;
+    const why = auditJson?.error?.message ||
+        auditJson?.error?.summary ||
+        firstLine(r.stderr || r.stdout) ||
+        "audit failed";
+    return {
+        stdout: null,
+        error: `npm audit failed (${why}) — deps not scanned; ${lockfileHint()}`,
+    };
 }
 /** Root-level manifests/lockfiles OSV understands (nested ones are scanned too). */
 const OSV_ROOT_LOCKFILES = [
@@ -157,7 +219,7 @@ async function osvScan(repo) {
                 typeof cached.stdout === "string" &&
                 typeof cached.at === "string" &&
                 Date.now() - Date.parse(cached.at) < AUDIT_TTL_MS) {
-                return parseOsvScanner(cached.stdout);
+                return { issues: parseOsvScanner(cached.stdout), error: null };
             }
         }
         catch {
@@ -165,16 +227,22 @@ async function osvScan(repo) {
         }
     }
     const r = await safeExecAsync("osv-scanner", ["scan", "--format", "json", repo], repo, 180000);
-    if (r.stdout) {
+    // osv-scanner exits 1 when vulnerabilities are found but still prints the
+    // JSON report; any other nonzero exit with unusable output means the scan
+    // failed and deps were NOT checked — say so instead of reporting clean.
+    if (r.stdout && (r.code === 0 || (r.code === 1 && looksLikeJson(r.stdout)))) {
         try {
             fs.writeFileSync(cachePath, JSON.stringify({ at: new Date().toISOString(), stdout: r.stdout }));
         }
         catch {
             /* cache write is best-effort */
         }
-        return parseOsvScanner(r.stdout);
+        return { issues: parseOsvScanner(r.stdout), error: null };
     }
-    return [];
+    return {
+        issues: [],
+        error: `osv-scanner failed (${firstLine(r.stderr || r.stdout) || "no output"}) — deps not scanned`,
+    };
 }
 function parseOsvScanner(stdout) {
     const issues = [];

package/dist/analyzers/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/analyzers/security.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAGzE,mFAAmF;AACnF,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY;IAChD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,OAA2B,CAAC;IAEhC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;YAChE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACzE,IAAI,CAAC,CAAC,MAAM;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,iGAAiG,IAAI,eAAe,CAAC;QACjI,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACvE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,MAAM,aAAa,CAC3B,UAAU,EACV,CAAC,QAAQ,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,EAC7E,IAAI,EACJ,MAAM,CACP,CAAC;QACF,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACvF,IAAI,CAAC,CAAC,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,4CAA4C;YAClD,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,MAAM,aAAa,GAAG,CAAC,mBAAmB,EAAE,qBAAqB,EAAE,cAAc,CAAC,CAAC,IAAI,CACrF,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CACzC,CAAC;IACF,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM;SAChB,UAAU,CAAC,MAAM,CAAC;SAClB,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;SACvD,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEhB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACtD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,IAAI,OAAO,CAAC,CAAC;IAChE,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAG3D,CAAC;YACF,IACE,MAAM;gBACN,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;gBACjC,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;gBAC7B,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,YAAY,EACjD,CAAC;gBACD,OAAO,MAAM,CAAC,MAAM,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;IACH,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACxE,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACb,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CACd,SAAS,EACT,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CACnE,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC;AAC1B,CAAC;AAED,oFAAoF;AACpF,MAAM,kBAAkB,GAAG;IACzB,QAAQ;IACR,QAAQ;IACR,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,cAAc;IACd,SAAS;IACT,cAAc;IACd,kBAAkB;IAClB,oBAAoB;IACpB,kBAAkB;IAClB,gBAAgB;IAChB,aAAa;CACd,CAAC;AAEF;;;;;GAKG;AACH,KAAK,UAAU,OAAO,CAAC,IAAY;IACjC,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;SAChF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE3F,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACtD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,OAAO,CAAC,CAAC;IAC1D,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAG3D,CAAC;YACF,IACE,MAAM;gBACN,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;gBACjC,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;gBAC7B,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,YAAY,EACjD,CAAC;gBACD,OAAO,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/F,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACb,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CACd,SAAS,EACT,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CACnE,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QACD,OAAO,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAW,GAAG,EAAE,OAAO,EAAE,IAAI,IAAI,SAAS,CAAC;YACrD,MAAM,OAAO,GAAW,GAAG,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;YACpD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,eAAe,IAAI,EAAE,EAAE,CAAC;gBAC3C,sEAAsE;gBACtE,+BAA+B;gBAC/B,MAAM,GAAG,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC7B,IAAI,QAAQ,GAAG,QAAQ,CAAC;gBACxB,IAAI,OAAO,GAAG,EAAE,KAAK,KAAK,QAAQ,IAAI,OAAO,GAAG,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACrE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;wBACzB,QAAQ;4BACN,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;oBAClF,CAAC;gBACH,CAAC;gBACD,MAAM,OAAO,GAAG,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC1C,MAAM,IAAI,GAAG,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;gBAC5E,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,YAAY;oBAClB,QAAQ;oBACR,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;iBACrD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,EAAE,eAAe,IAAI,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,IAAI,CAAC,EAAE,CAAC;QAClD,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,CAAC;QACnB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;YACxE,IAAI,QAAQ,EAAE,KAAK;gBAAE,IAAI,GAAG,GAAG,IAAI,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;iBACpD,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ;gBAAE,IAAI,GAAG,GAAG,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,CAAC,EAAE,QAAQ,IAAI,SAAS;YAClC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,GAAU,CAAC;IACf,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,SAAS;YACjC,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,GAAU,CAAC;IACf,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,MAAM;YAC9B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,SAAS;YACjB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,MAAM,IAAI,iBAAiB;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,IAAI,QAAQ;YACvC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI;YACnB,WAAW,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,IAAI,CAAC,CAAC,QAAQ,IAAI,SAAS;SACzD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/analyzers/security.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAG5D,mFAAmF;AACnF,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY;IAChD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAClC,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,mEAAmE;IACnE,MAAM,MAAM,GAAgB,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,IAAI,OAA2B,CAAC;IAEhC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,qEAAqE;YACrE,+CAA+C;YAC/C,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC;QACxB,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;YAChE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACzE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC1D,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,qBAAqB,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC;YACvF,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,GAAG,CAAC,KAAK;gBAAE,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC;;gBAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,GAAG,CAAC,KAAK;gBAAE,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC;;gBAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,iGAAiG,IAAI,eAAe,CAAC;QACjI,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACvE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,MAAM,aAAa,CAC3B,UAAU,EACV,CAAC,QAAQ,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,EAC7E,IAAI,EACJ,MAAM,CACP,CAAC;QACF,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACvF,IAAI,CAAC,CAAC,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,4CAA4C;YAClD,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY;IACnB,OAAO,sEAAsE,CAAC;AAChF,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;AAC7F,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,MAAM,aAAa,GAAG,CAAC,mBAAmB,EAAE,qBAAqB,EAAE,cAAc,CAAC,CAAC,IAAI,CACrF,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CACzC,CAAC;IACF,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM;SAChB,UAAU,CAAC,MAAM,CAAC;SAClB,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;SACvD,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEhB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACtD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,IAAI,OAAO,CAAC,CAAC;IAChE,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAG3D,CAAC;YACF,IACE,MAAM;gBACN,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;gBACjC,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;gBAC7B,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,YAAY;gBACjD,mEAAmE;gBACnE,0EAA0E;gBAC1E,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,eAAe,KAAK,QAAQ,EAC9D,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YAChD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;IACH,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,uEAAuE;IACvE,8DAA8D;IAC9D,IAAI,SAAS,GAAQ,IAAI,CAAC;IAC1B,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,IAAI,SAAS,IAAI,OAAO,SAAS,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QAC/D,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CACd,SAAS,EACT,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CACnE,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,GAAG,GACP,SAAS,EAAE,KAAK,EAAE,OAAO;QACzB,SAAS,EAAE,KAAK,EAAE,OAAO;QACzB,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC;QAC/B,cAAc,CAAC;IACjB,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,qBAAqB,GAAG,yBAAyB,YAAY,EAAE,EAAE;KACzE,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,kBAAkB,GAAG;IACzB,QAAQ;IACR,QAAQ;IACR,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,cAAc;IACd,SAAS;IACT,cAAc;IACd,kBAAkB;IAClB,oBAAoB;IACpB,kBAAkB;IAClB,gBAAgB;IAChB,aAAa;CACd,CAAC;AAEF;;;;;GAKG;AACH,KAAK,UAAU,OAAO,CAAC,IAAY;IACjC,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;SAChF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE3F,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACtD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,OAAO,CAAC,CAAC;IAC1D,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAG3D,CAAC;YACF,IACE,MAAM;gBACN,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;gBACjC,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;gBAC7B,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,YAAY,EACjD,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACjE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/F,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CACd,SAAS,EACT,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CACnE,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,MAAM,EAAE,EAAE;QACV,KAAK,EAAE,uBAAuB,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,WAAW,sBAAsB;KACnG,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAW,GAAG,EAAE,OAAO,EAAE,IAAI,IAAI,SAAS,CAAC;YACrD,MAAM,OAAO,GAAW,GAAG,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;YACpD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,eAAe,IAAI,EAAE,EAAE,CAAC;gBAC3C,sEAAsE;gBACtE,+BAA+B;gBAC/B,MAAM,GAAG,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC7B,IAAI,QAAQ,GAAG,QAAQ,CAAC;gBACxB,IAAI,OAAO,GAAG,EAAE,KAAK,KAAK,QAAQ,IAAI,OAAO,GAAG,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACrE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;wBACzB,QAAQ;4BACN,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;oBAClF,CAAC;gBACH,CAAC;gBACD,MAAM,OAAO,GAAG,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC1C,MAAM,IAAI,GAAG,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;gBAC5E,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,YAAY;oBAClB,QAAQ;oBACR,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;iBACrD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,EAAE,eAAe,IAAI,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,IAAI,CAAC,EAAE,CAAC;QAClD,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,CAAC;QACnB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;YACxE,IAAI,QAAQ,EAAE,KAAK;gBAAE,IAAI,GAAG,GAAG,IAAI,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;iBACpD,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ;gBAAE,IAAI,GAAG,GAAG,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,CAAC,EAAE,QAAQ,IAAI,SAAS;YAClC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,GAAU,CAAC;IACf,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,SAAS;YACjC,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,GAAU,CAAC;IACf,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,MAAM;YAC9B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,SAAS;YACjB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,MAAM,IAAI,iBAAiB;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,IAAI,QAAQ;YACvC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI;YACnB,WAAW,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,IAAI,CAAC,CAAC,QAAQ,IAAI,SAAS;SACzD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/analyzers/securityStatic.d.ts

@@ -0,0 +1,35 @@
+import type { ScanIssue } from "./types.js";
+export interface StaticRule {
+    category: string;
+    severity: string;
+    /** Optional path filter: only flag routes/paths matching this. */
+    pathFilter?: RegExp;
+    /** Optional guard words: when any appears inside the match window, the route is NOT flagged. */
+    guard?: RegExp;
+    /** Optional: when the match span contains this, the fix is already applied — skip. */
+    skipWhenInMatch?: RegExp;
+    /** Optional: extra predicate — false means the match is a false positive. */
+    accept?: (m: RegExpExecArray, content: string) => boolean;
+    re: RegExp;
+    describe: (m: RegExpExecArray) => string;
+    fix: string;
+}
+/**
+ * Rules are tried per file, in order. Match offsets are mapped to line
+ * numbers; matches are deduped by (category, file, line) so overlapping
+ * patterns never double-report the same line.
+ */
+export declare const STATIC_SECURITY_RULES: StaticRule[];
+/**
+ * Repo-level findings that only make sense over the whole tree (e.g. "no
+ * rate limiter anywhere"). Cheap to compute, always honest about being
+ * indicated.
+ */
+export declare function analyzeSecurityRepoLevel(repo: string): ScanIssue[];
+/**
+ * Scan a repo for the static vulnerability classes. Deterministic: files are
+ * walked in sorted order, findings are ordered by (severity, file, line),
+ * deduped by (category, file, line), capped. All findings are labeled
+ * `[indicated]` — static analysis points, it does not prove.
+ */
+export declare function analyzeSecurityStatic(repo: string): ScanIssue[];