openpitstop 1.2.0 → 1.4.0

package/PRIVACY.md

@@ -15,11 +15,17 @@ explicit cases listed below.
 - **No SaaS, no accounts, no cloud.** There is no OpenPitStop server, no
   dashboard, no login. Nothing to sign up for.
 - **No code uploads.** `scan`, `try`, `verify`, `gate`, `integrity`, `pen`,
-  `ledger`, `watch`, `trends`, `digest`, `share`, `honesty` — every one of
-  these analyzes your files locally. Your source never leaves your machine.
+  `ledger`, `watch`, `trends`, `digest`, `share`, `honesty`, `test` — every
+  one of these analyzes your files locally. Your source never leaves your
+  machine.
 - **No third-party processes** are ever spawned that you didn't initiate
   (`scan` runs the scanners you have installed, e.g. `gitleaks`, `semgrep`,
-  `osv-scanner`, `pip-audit` — or honestly reports them as `skipped`).
+  `osv-scanner`, `pip-audit`; `test` runs your own test scripts — or honestly
+  reports them as `skipped`).
+- **The static security pass is fully offline.** It reads files and matches
+  patterns on your machine; it never sends code anywhere. The only network
+  calls in the entire security pipeline are the dependency audits listed
+  below.
 - **No auto-updates.** The CLI never updates itself or checks for updates.
   You control when you run a newer version (`npx openpitstop@latest`).
 

package/README.md

@@ -44,7 +44,7 @@ your agent.
 | [See it in 90 seconds](#see-it-in-90-seconds) | [What OpenPitStop actually does](#what-openpitstop-actually-does) · [Every command](#every-command) |
 | [Architecture](#architecture) | [Known limitations](#known-limitations) · [Contributing](#contributing) · [License](#license) |
 
-**Straight to one feature:** [The scan](#the-scan) · [Verify](#verify) · [Trends](#trends) · [Inspect](#inspect) · [Repro](#repro) · [The pen test](#the-pen-test) · [Report](#report) · [Share](#share) · [Honesty](#honesty) · [Try it on your repo](#try-it-on-your-repo) · [The live shield](#the-live-shield) · [The GitHub Action](#the-github-action) · [The pre-commit hook](#the-pre-commit-hook)
+**Straight to one feature:** [The scan](#the-scan) · [The test pyramid](#the-test-pyramid) · [Verify](#verify) · [Trends](#trends) · [Inspect](#inspect) · [Repro](#repro) · [The pen test](#the-pen-test) · [Report](#report) · [Share](#share) · [Honesty](#honesty) · [Try it on your repo](#try-it-on-your-repo) · [The live shield](#the-live-shield) · [The GitHub Action](#the-github-action) · [The pre-commit hook](#the-pre-commit-hook)
 
 **Receipts:** [Caught in the wild](docs/caught-in-the-wild.md) — real gate output, screenshot-ready.
 
@@ -341,13 +341,39 @@ editing, knowing it's being watched.
 ### The scan
 
 `pitstop scan` runs a bunch of checks on your repo: circular imports, known security
-issues (`npm audit`, plus `pip-audit`/`osv-scanner` for Python and other stacks, and
-`gitleaks`/`semgrep` when installed), duplicated code (`jscpd`), test results
+issues, duplicated code (`jscpd`), test results
 (jest/vitest/pytest plus native suites for Go, Rust, Flutter/Dart, .NET and Java
 (Maven/Gradle) — pass/fail, duration, coverage), build speed, accessibility, flaky-test
 and race-condition heuristics, and developer-experience checks (unused exports, duplicate
 functions).
 
+Security is two layers:
+
+1. **Dependency audits** — `npm audit`, plus `pip-audit`/`osv-scanner` for Python and
+   other stacks, and `gitleaks`/`semgrep` when installed. A failed audit is reported as
+   `skipped` with a repair hint — deps that were never scanned are never reported as clean.
+2. **The static vulnerability pass** (fully offline, every language, no tooling needed) —
+   the classic classes plus the full posture: **SQL injection** (concatenated/
+   interpolated queries, ORM raw builders, `$where`, Python f-strings), **authentication**
+   (cleartext password compares, missing hashing, `Math.random` tokens, inline JWT
+   secrets), **authorization** (unprotected data routes, admin routes without role
+   checks), **input validation** (unrestricted uploads, unvalidated money fields,
+   `eval`, XSS sinks), **secret management** (known credential formats, inline secret
+   literals, committed `.env` files) — plus command injection, path traversal, SSRF,
+   **rate limiting** (missing limiters on state-changing routes, limits set so high they
+   are decorations), **database lockdown** (privileged accounts in committed connection
+   strings, `GRANT ALL`/`SUPERUSER`, TLS-free connections, missing row-level security),
+   **data exposure** (credentials/PII in API responses, full DB rows shipped to the
+   client, PII in logs), **hidden vulnerabilities** (disabled TLS verification, `alg:
+   none` JWTs, security TODOs, lint/type bypasses, tokens in `localStorage`, committed
+   minified bundles, backup files), CORS+credentials, missing security headers, CSRF
+   exposure, stack leaks and sensitive logging.
+
+Every static finding is labeled `[indicated]` and ships with its exact **fix**; `scan`
+and `try` print the complete identify-and-solve list under the score box, so the report
+is a worklist, not a scare. The full matrix — every detection and every fix — is in
+[docs/security.md](docs/security.md).
+
 Each check either contributes a real number, or prints `skipped` with a one-line hint on
 how to install the tool it needs — it never makes up a number. Everything adds up to one
 box that always opens with the **OpenPitStop Score**: a single 0–100 health number (with an
@@ -358,9 +384,20 @@ Scans are fast by design: the checks run **in parallel**, flaky detection runs t
 (plus `osv-scanner`) results are cached for 24 hours (keyed on the lockfile hash) so
 repeated scans inside one fix loop never hit the registry again.
 
+### The test pyramid
+
+`pitstop test [path] [--unit] [--integration] [--e2e]` runs your **unit, integration and
+e2e** layers the way a senior dev would — it discovers each layer (`test`/`test:unit`,
+`test:integration`/`test:it`, `test:e2e`/`e2e` npm scripts first, then vitest/jest/
+pytest/playwright/cypress by config), executes them, and reports per-layer pass/fail
+counts with the **names of the failing tests**, so the fix list is actionable. Layers it
+cannot find are reported as `skipped — no suite discovered`, never invented; the command
+exits 1 the moment any layer fails, so CI can trust it. (Add `"test:e2e": "playwright
+test"` to a repo and it is picked up automatically on the next run.)
+
 ## Every command
 
-All 23 commands, grouped by job. Run them from inside a repo as `pitstop …` (CLI) or
+All 24 commands, grouped by job. Run them from inside a repo as `pitstop …` (CLI) or
 `npx openpitstop …` (one-off); `/pitstop` in a tool drives the loop, the rest are
 one-shot.
 
@@ -375,6 +412,7 @@ one-shot.
 | `pitstop watch [path] [--interval ms]` | The live shield. Sits in a terminal and re-checks the moment you save a file, printing how the score moved. |
 | `pitstop trends` | Turns your saved scan history into per-category sparklines and a score trend — watch a repo actually improve. |
 | `pitstop budget [path]` | The token bill: how many scans/verifies/pens/repros you've run and the compute-seconds, plus advice on what to reuse in a fix loop. |
+| `pitstop test [path] [--unit] [--integration] [--e2e]` | The test pyramid: discovers and runs the **unit, integration and e2e** layers, reports per-layer pass/fail with the failing test names. Any failing layer → exit 1. See [The test pyramid](#the-test-pyramid). |
 
 **The fix loop — what the agent is told to do**
 

package/dist/analyzers/security.js

@@ -2,11 +2,16 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { commandExists, detectLanguage, safeExecAsync } from "./util.js";
+import { analyzeSecurityStatic } from "./securityStatic.js";
 /** How long an npm-audit result is reused before re-fetching from the registry. */
 const AUDIT_TTL_MS = 24 * 60 * 60 * 1000;
 export async function analyzeSecurity(repo) {
     const lang = detectLanguage(repo);
-    const issues = [];
+    // The offline static pass runs for EVERY language (even "unknown"): it is
+    // deterministic, needs no tooling, and covers the vulnerability classes
+    // that AI-generated code ships most often (SQL injection, secrets, XSS,
+    // authz gaps, money inputs). Its findings are labeled [indicated].
+    const issues = [...analyzeSecurityStatic(repo)];
     let depNote;
     if (lang === "js") {
         // npm audit exits 1 when vulnerabilities exist but still prints the full

package/dist/analyzers/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/analyzers/security.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAGzE,mFAAmF;AACnF,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY;IAChD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,OAA2B,CAAC;IAEhC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,qEAAqE;YACrE,+CAA+C;YAC/C,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC;QACxB,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;YAChE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACzE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC1D,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,qBAAqB,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC;YACvF,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,GAAG,CAAC,KAAK;gBAAE,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC;;gBAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,GAAG,CAAC,KAAK;gBAAE,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC;;gBAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,iGAAiG,IAAI,eAAe,CAAC;QACjI,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACvE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,MAAM,aAAa,CAC3B,UAAU,EACV,CAAC,QAAQ,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,EAC7E,IAAI,EACJ,MAAM,CACP,CAAC;QACF,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACvF,IAAI,CAAC,CAAC,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,4CAA4C;YAClD,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY;IACnB,OAAO,sEAAsE,CAAC;AAChF,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;AAC7F,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,MAAM,aAAa,GAAG,CAAC,mBAAmB,EAAE,qBAAqB,EAAE,cAAc,CAAC,CAAC,IAAI,CACrF,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CACzC,CAAC;IACF,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM;SAChB,UAAU,CAAC,MAAM,CAAC;SAClB,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;SACvD,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEhB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACtD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,IAAI,OAAO,CAAC,CAAC;IAChE,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAG3D,CAAC;YACF,IACE,MAAM;gBACN,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;gBACjC,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;gBAC7B,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,YAAY;gBACjD,mEAAmE;gBACnE,0EAA0E;gBAC1E,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,eAAe,KAAK,QAAQ,EAC9D,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YAChD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;IACH,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,uEAAuE;IACvE,8DAA8D;IAC9D,IAAI,SAAS,GAAQ,IAAI,CAAC;IAC1B,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,IAAI,SAAS,IAAI,OAAO,SAAS,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QAC/D,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CACd,SAAS,EACT,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CACnE,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,GAAG,GACP,SAAS,EAAE,KAAK,EAAE,OAAO;QACzB,SAAS,EAAE,KAAK,EAAE,OAAO;QACzB,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC;QAC/B,cAAc,CAAC;IACjB,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,qBAAqB,GAAG,yBAAyB,YAAY,EAAE,EAAE;KACzE,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,kBAAkB,GAAG;IACzB,QAAQ;IACR,QAAQ;IACR,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,cAAc;IACd,SAAS;IACT,cAAc;IACd,kBAAkB;IAClB,oBAAoB;IACpB,kBAAkB;IAClB,gBAAgB;IAChB,aAAa;CACd,CAAC;AAEF;;;;;GAKG;AACH,KAAK,UAAU,OAAO,CAAC,IAAY;IACjC,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;SAChF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE3F,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACtD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,OAAO,CAAC,CAAC;IAC1D,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAG3D,CAAC;YACF,IACE,MAAM;gBACN,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;gBACjC,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;gBAC7B,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,YAAY,EACjD,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACjE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/F,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CACd,SAAS,EACT,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CACnE,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,MAAM,EAAE,EAAE;QACV,KAAK,EAAE,uBAAuB,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,WAAW,sBAAsB;KACnG,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAW,GAAG,EAAE,OAAO,EAAE,IAAI,IAAI,SAAS,CAAC;YACrD,MAAM,OAAO,GAAW,GAAG,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;YACpD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,eAAe,IAAI,EAAE,EAAE,CAAC;gBAC3C,sEAAsE;gBACtE,+BAA+B;gBAC/B,MAAM,GAAG,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC7B,IAAI,QAAQ,GAAG,QAAQ,CAAC;gBACxB,IAAI,OAAO,GAAG,EAAE,KAAK,KAAK,QAAQ,IAAI,OAAO,GAAG,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACrE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;wBACzB,QAAQ;4BACN,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;oBAClF,CAAC;gBACH,CAAC;gBACD,MAAM,OAAO,GAAG,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC1C,MAAM,IAAI,GAAG,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;gBAC5E,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,YAAY;oBAClB,QAAQ;oBACR,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;iBACrD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,EAAE,eAAe,IAAI,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,IAAI,CAAC,EAAE,CAAC;QAClD,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,CAAC;QACnB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;YACxE,IAAI,QAAQ,EAAE,KAAK;gBAAE,IAAI,GAAG,GAAG,IAAI,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;iBACpD,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ;gBAAE,IAAI,GAAG,GAAG,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,CAAC,EAAE,QAAQ,IAAI,SAAS;YAClC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,GAAU,CAAC;IACf,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,SAAS;YACjC,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,GAAU,CAAC;IACf,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,MAAM;YAC9B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,SAAS;YACjB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,MAAM,IAAI,iBAAiB;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,IAAI,QAAQ;YACvC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI;YACnB,WAAW,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,IAAI,CAAC,CAAC,QAAQ,IAAI,SAAS;SACzD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/analyzers/security.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAG5D,mFAAmF;AACnF,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY;IAChD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAClC,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,mEAAmE;IACnE,MAAM,MAAM,GAAgB,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,IAAI,OAA2B,CAAC;IAEhC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,qEAAqE;YACrE,+CAA+C;YAC/C,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC;QACxB,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;YAChE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACzE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC1D,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,qBAAqB,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC;YACvF,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,GAAG,CAAC,KAAK;gBAAE,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC;;gBAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,GAAG,CAAC,KAAK;gBAAE,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC;;gBAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,iGAAiG,IAAI,eAAe,CAAC;QACjI,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACvE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,MAAM,aAAa,CAC3B,UAAU,EACV,CAAC,QAAQ,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,EAC7E,IAAI,EACJ,MAAM,CACP,CAAC;QACF,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACvF,IAAI,CAAC,CAAC,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,4CAA4C;YAClD,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY;IACnB,OAAO,sEAAsE,CAAC;AAChF,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;AAC7F,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,MAAM,aAAa,GAAG,CAAC,mBAAmB,EAAE,qBAAqB,EAAE,cAAc,CAAC,CAAC,IAAI,CACrF,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CACzC,CAAC;IACF,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM;SAChB,UAAU,CAAC,MAAM,CAAC;SAClB,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;SACvD,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEhB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACtD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,IAAI,OAAO,CAAC,CAAC;IAChE,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAG3D,CAAC;YACF,IACE,MAAM;gBACN,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;gBACjC,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;gBAC7B,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,YAAY;gBACjD,mEAAmE;gBACnE,0EAA0E;gBAC1E,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,eAAe,KAAK,QAAQ,EAC9D,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YAChD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;IACH,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,uEAAuE;IACvE,8DAA8D;IAC9D,IAAI,SAAS,GAAQ,IAAI,CAAC;IAC1B,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,IAAI,SAAS,IAAI,OAAO,SAAS,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QAC/D,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CACd,SAAS,EACT,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CACnE,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,GAAG,GACP,SAAS,EAAE,KAAK,EAAE,OAAO;QACzB,SAAS,EAAE,KAAK,EAAE,OAAO;QACzB,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC;QAC/B,cAAc,CAAC;IACjB,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,qBAAqB,GAAG,yBAAyB,YAAY,EAAE,EAAE;KACzE,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,kBAAkB,GAAG;IACzB,QAAQ;IACR,QAAQ;IACR,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,cAAc;IACd,SAAS;IACT,cAAc;IACd,kBAAkB;IAClB,oBAAoB;IACpB,kBAAkB;IAClB,gBAAgB;IAChB,aAAa;CACd,CAAC;AAEF;;;;;GAKG;AACH,KAAK,UAAU,OAAO,CAAC,IAAY;IACjC,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;SAChF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE3F,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACtD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,OAAO,CAAC,CAAC;IAC1D,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAG3D,CAAC;YACF,IACE,MAAM;gBACN,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;gBACjC,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;gBAC7B,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,YAAY,EACjD,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACjE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/F,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CACd,SAAS,EACT,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CACnE,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,MAAM,EAAE,EAAE;QACV,KAAK,EAAE,uBAAuB,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,WAAW,sBAAsB;KACnG,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAW,GAAG,EAAE,OAAO,EAAE,IAAI,IAAI,SAAS,CAAC;YACrD,MAAM,OAAO,GAAW,GAAG,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;YACpD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,eAAe,IAAI,EAAE,EAAE,CAAC;gBAC3C,sEAAsE;gBACtE,+BAA+B;gBAC/B,MAAM,GAAG,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC7B,IAAI,QAAQ,GAAG,QAAQ,CAAC;gBACxB,IAAI,OAAO,GAAG,EAAE,KAAK,KAAK,QAAQ,IAAI,OAAO,GAAG,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACrE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;wBACzB,QAAQ;4BACN,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;oBAClF,CAAC;gBACH,CAAC;gBACD,MAAM,OAAO,GAAG,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC1C,MAAM,IAAI,GAAG,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;gBAC5E,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,YAAY;oBAClB,QAAQ;oBACR,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;iBACrD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,EAAE,eAAe,IAAI,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,IAAI,CAAC,EAAE,CAAC;QAClD,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,CAAC;QACnB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;YACxE,IAAI,QAAQ,EAAE,KAAK;gBAAE,IAAI,GAAG,GAAG,IAAI,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;iBACpD,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ;gBAAE,IAAI,GAAG,GAAG,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,CAAC,EAAE,QAAQ,IAAI,SAAS;YAClC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,GAAU,CAAC;IACf,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,SAAS;YACjC,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,GAAU,CAAC;IACf,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,MAAM;YAC9B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,SAAS;YACjB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,MAAM,IAAI,iBAAiB;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,IAAI,QAAQ;YACvC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI;YACnB,WAAW,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,IAAI,CAAC,CAAC,QAAQ,IAAI,SAAS;SACzD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/analyzers/securityStatic.d.ts

@@ -0,0 +1,35 @@
+import type { ScanIssue } from "./types.js";
+export interface StaticRule {
+    category: string;
+    severity: string;
+    /** Optional path filter: only flag routes/paths matching this. */
+    pathFilter?: RegExp;
+    /** Optional guard words: when any appears inside the match window, the route is NOT flagged. */
+    guard?: RegExp;
+    /** Optional: when the match span contains this, the fix is already applied — skip. */
+    skipWhenInMatch?: RegExp;
+    /** Optional: extra predicate — false means the match is a false positive. */
+    accept?: (m: RegExpExecArray, content: string) => boolean;
+    re: RegExp;
+    describe: (m: RegExpExecArray) => string;
+    fix: string;
+}
+/**
+ * Rules are tried per file, in order. Match offsets are mapped to line
+ * numbers; matches are deduped by (category, file, line) so overlapping
+ * patterns never double-report the same line.
+ */
+export declare const STATIC_SECURITY_RULES: StaticRule[];
+/**
+ * Repo-level findings that only make sense over the whole tree (e.g. "no
+ * rate limiter anywhere"). Cheap to compute, always honest about being
+ * indicated.
+ */
+export declare function analyzeSecurityRepoLevel(repo: string): ScanIssue[];
+/**
+ * Scan a repo for the static vulnerability classes. Deterministic: files are
+ * walked in sorted order, findings are ordered by (severity, file, line),
+ * deduped by (category, file, line), capped. All findings are labeled
+ * `[indicated]` — static analysis points, it does not prove.
+ */
+export declare function analyzeSecurityStatic(repo: string): ScanIssue[];