openpitstop 1.5.0 → 1.5.2

package/README.md

@@ -50,6 +50,33 @@ your agent.
 
 ---
 
+## OpenPitStop vs Strix — why teams pick the referee
+
+Strix is a great *finder*. OpenPitStop is the *referee*. Both pen-test your app; the
+difference is what happens after a vulnerability is found:
+
+> **Strix finds. OpenPitStop proves.**
+
+| | [Strix](https://github.com/usestrix/strix) | **OpenPitStop** |
+|---|---|---|
+| What it produces | Findings + a PoC *report* | Findings + a **failing-first regression test** (`pitstop pen --fix`) |
+| Trust in the fix | One-click auto-fix PR | **Honesty Score (0–100)** + integrity gate that catches deleted tests, hardcoded passes, reverted baselines |
+| How it runs | Docker + LLM key, non-deterministic | **Zero infra, deterministic, no LLM bill** — runs in any CI |
+| Evidence | `strix_runs/` logs | **Tamper-evident, signed `.pitstop/` artifacts** you can audit |
+| Secret exfiltration | not emphasized | **Ledger mode** proves the app doesn't phone home with your keys |
+| DevSecOps | Cloud platform (paid tiers) | **Free SARIF → GitHub Security tab** + one-number `pitstop gate` |
+| Proof coverage | — | **`PITSTOP_PROOF` badge**: % of findings that ship a permanent repro test |
+| Continuous proof (drift) | report only — re-run and hope | **Drift gate**: every `pitstop pen` compares to the last sealed run, *proves a fix* (finding gone) and *fails the CI gate* on a new high/critical regression or a hypothesis the live attack just confirmed |
+| Prove-my-fix loop | manual | **`pitstop repro <id>`** re-runs the exact attack and asserts the safe outcome — a PASS means the fix is real, a deleted repro test is flagged as a cheat |
+| Bug classes covered | strong general set | **40+ classes** — race/TOCTOU, IDOR/BOLA, price-tampering, XXE, insecure deserialization, JWT alg-confusion/weak-secret, SSRF, SQL/NoSQLi, command-injection, path traversal, XSS, secrets, CORS, missing headers, rate-limit, and more |
+
+The honest pitch: a pen-test that only reports is a list of things to argue about. A
+pen-test that ships the regression test, signs the evidence, and scores the fix on a
+gate your CI can block on is something you can actually ship. That's the OpenPitStop
+loop — and it's the reason to choose the referee over the hacker.
+
+---
+
 ## Feature tour
 
 Every clip below is real opencode output, captured from a live agent session —

package/demo/web-app-broken/.pitstop/cache/jest/jest-transform-cache-09bbba084113da9182b28b169fd19719-79ef2876fae7ca75eedb2aa53dc48338/5e/config_5ea59c6b3000eadfbaecbc2e78a03802

@@ -0,0 +1,113 @@
+b9e26b5a20d1b5508146e54c87fb8c88
+/* istanbul ignore next */
+function cov_e86xmt8qo() {
+  var path = "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\config.js";
+  var hash = "b8ce36803606bd246d8daa8c315e078307e95d46";
+  var global = new Function("return this")();
+  var gcv = "__coverage__";
+  var coverageData = {
+    path: "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\config.js",
+    statementMap: {
+      "0": {
+        start: {
+          line: 4,
+          column: 26
+        },
+        end: {
+          line: 4,
+          column: 62
+        }
+      },
+      "1": {
+        start: {
+          line: 5,
+          column: 26
+        },
+        end: {
+          line: 5,
+          column: 62
+        }
+      },
+      "2": {
+        start: {
+          line: 6,
+          column: 19
+        },
+        end: {
+          line: 6,
+          column: 48
+        }
+      },
+      "3": {
+        start: {
+          line: 7,
+          column: 20
+        },
+        end: {
+          line: 7,
+          column: 50
+        }
+      },
+      "4": {
+        start: {
+          line: 9,
+          column: 0
+        },
+        end: {
+          line: 9,
+          column: 83
+        }
+      }
+    },
+    fnMap: {},
+    branchMap: {},
+    s: {
+      "0": 0,
+      "1": 0,
+      "2": 0,
+      "3": 0,
+      "4": 0
+    },
+    f: {},
+    b: {},
+    _coverageSchema: "1a1c01bbd47fc00a2c39e90264f33305004495a9",
+    hash: "b8ce36803606bd246d8daa8c315e078307e95d46"
+  };
+  var coverage = global[gcv] || (global[gcv] = {});
+  if (!coverage[path] || coverage[path].hash !== hash) {
+    coverage[path] = coverageData;
+  }
+  var actualCoverage = coverage[path];
+  {
+    // @ts-ignore
+    cov_e86xmt8qo = function () {
+      return actualCoverage;
+    };
+  }
+  return actualCoverage;
+}
+cov_e86xmt8qo();
+// Hardcoded secrets in source — flagged by the secret analyzer even without .env.
+// NOTE: values are obvious FAKE placeholders (no real AKIA/sk_live prefixes) so the
+// repo passes GitHub push protection; OpenPitStop still flags them by variable name.
+const AWS_ACCESS_KEY_ID =
+/* istanbul ignore next */
+(cov_e86xmt8qo().s[0]++, "example-aws-access-key-id-not-real");
+const STRIPE_SECRET_KEY =
+/* istanbul ignore next */
+(cov_e86xmt8qo().s[1]++, "example-stripe-secret-key-not-real");
+const JWT_SECRET =
+/* istanbul ignore next */
+(cov_e86xmt8qo().s[2]++, "example-jwt-secret-not-real");
+const DB_PASSWORD =
+/* istanbul ignore next */
+(cov_e86xmt8qo().s[3]++, "example-db-password-not-real");
+/* istanbul ignore next */
+cov_e86xmt8qo().s[4]++;
+module.exports = {
+  AWS_ACCESS_KEY_ID,
+  STRIPE_SECRET_KEY,
+  JWT_SECRET,
+  DB_PASSWORD
+};
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJjb3ZfZTg2eG10OHFvIiwiYWN0dWFsQ292ZXJhZ2UiLCJBV1NfQUNDRVNTX0tFWV9JRCIsInMiLCJTVFJJUEVfU0VDUkVUX0tFWSIsIkpXVF9TRUNSRVQiLCJEQl9QQVNTV09SRCIsIm1vZHVsZSIsImV4cG9ydHMiXSwic291cmNlcyI6WyJjb25maWcuanMiXSwic291cmNlc0NvbnRlbnQiOlsiLy8gSGFyZGNvZGVkIHNlY3JldHMgaW4gc291cmNlIOKAlCBmbGFnZ2VkIGJ5IHRoZSBzZWNyZXQgYW5hbHl6ZXIgZXZlbiB3aXRob3V0IC5lbnYuXG4vLyBOT1RFOiB2YWx1ZXMgYXJlIG9idmlvdXMgRkFLRSBwbGFjZWhvbGRlcnMgKG5vIHJlYWwgQUtJQS9za19saXZlIHByZWZpeGVzKSBzbyB0aGVcbi8vIHJlcG8gcGFzc2VzIEdpdEh1YiBwdXNoIHByb3RlY3Rpb247IE9wZW5QaXRTdG9wIHN0aWxsIGZsYWdzIHRoZW0gYnkgdmFyaWFibGUgbmFtZS5cbmNvbnN0IEFXU19BQ0NFU1NfS0VZX0lEID0gXCJleGFtcGxlLWF3cy1hY2Nlc3Mta2V5LWlkLW5vdC1yZWFsXCI7XG5jb25zdCBTVFJJUEVfU0VDUkVUX0tFWSA9IFwiZXhhbXBsZS1zdHJpcGUtc2VjcmV0LWtleS1ub3QtcmVhbFwiO1xuY29uc3QgSldUX1NFQ1JFVCA9IFwiZXhhbXBsZS1qd3Qtc2VjcmV0LW5vdC1yZWFsXCI7XG5jb25zdCBEQl9QQVNTV09SRCA9IFwiZXhhbXBsZS1kYi1wYXNzd29yZC1ub3QtcmVhbFwiO1xuXG5tb2R1bGUuZXhwb3J0cyA9IHsgQVdTX0FDQ0VTU19LRVlfSUQsIFNUUklQRV9TRUNSRVRfS0VZLCBKV1RfU0VDUkVULCBEQl9QQVNTV09SRCB9O1xuIl0sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztJQWVZO0lBQUFBLGFBQUEsWUFBQUEsQ0FBQTtNQUFBLE9BQUFDLGNBQUE7SUFBQTtFQUFBO0VBQUEsT0FBQUEsY0FBQTtBQUFBO0FBQUFELGFBQUE7QUFmWjtBQUNBO0FBQ0E7QUFDQSxNQUFNRSxpQkFBaUI7QUFBQTtBQUFBLENBQUFGLGFBQUEsR0FBQUcsQ0FBQSxPQUFHLG9DQUFvQztBQUM5RCxNQUFNQyxpQkFBaUI7QUFBQTtBQUFBLENBQUFKLGFBQUEsR0FBQUcsQ0FBQSxPQUFHLG9DQUFvQztBQUM5RCxNQUFNRSxVQUFVO0FBQUE7QUFBQSxDQUFBTCxhQUFBLEdBQUFHLENBQUEsT0FBRyw2QkFBNkI7QUFDaEQsTUFBTUcsV0FBVztBQUFBO0FBQUEsQ0FBQU4sYUFBQSxHQUFBRyxDQUFBLE9BQUcsOEJBQThCO0FBQUM7QUFBQUgsYUFBQSxHQUFBRyxDQUFBO0FBRW5ESSxNQUFNLENBQUNDLE9BQU8sR0FBRztFQUFFTixpQkFBaUI7RUFBRUUsaUJBQWlCO0VBQUVDLFVBQVU7RUFBRUM7QUFBWSxDQUFDIiwiaWdub3JlTGlzdCI6W119

package/demo/web-app-broken/.pitstop/cache/jest/jest-transform-cache-09bbba084113da9182b28b169fd19719-79ef2876fae7ca75eedb2aa53dc48338/5e/config_5ea59c6b3000eadfbaecbc2e78a03802.map

@@ -0,0 +1 @@
+{"version":3,"names":["cov_e86xmt8qo","actualCoverage","AWS_ACCESS_KEY_ID","s","STRIPE_SECRET_KEY","JWT_SECRET","DB_PASSWORD","module","exports"],"sources":["config.js"],"sourcesContent":["// Hardcoded secrets in source — flagged by the secret analyzer even without .env.\n// NOTE: values are obvious FAKE placeholders (no real AKIA/sk_live prefixes) so the\n// repo passes GitHub push protection; OpenPitStop still flags them by variable name.\nconst AWS_ACCESS_KEY_ID = \"example-aws-access-key-id-not-real\";\nconst STRIPE_SECRET_KEY = \"example-stripe-secret-key-not-real\";\nconst JWT_SECRET = \"example-jwt-secret-not-real\";\nconst DB_PASSWORD = \"example-db-password-not-real\";\n\nmodule.exports = { AWS_ACCESS_KEY_ID, STRIPE_SECRET_KEY, JWT_SECRET, DB_PASSWORD };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAeY;IAAAA,aAAA,YAAAA,CAAA;MAAA,OAAAC,cAAA;IAAA;EAAA;EAAA,OAAAA,cAAA;AAAA;AAAAD,aAAA;AAfZ;AACA;AACA;AACA,MAAME,iBAAiB;AAAA;AAAA,CAAAF,aAAA,GAAAG,CAAA,OAAG,oCAAoC;AAC9D,MAAMC,iBAAiB;AAAA;AAAA,CAAAJ,aAAA,GAAAG,CAAA,OAAG,oCAAoC;AAC9D,MAAME,UAAU;AAAA;AAAA,CAAAL,aAAA,GAAAG,CAAA,OAAG,6BAA6B;AAChD,MAAMG,WAAW;AAAA;AAAA,CAAAN,aAAA,GAAAG,CAAA,OAAG,8BAA8B;AAAC;AAAAH,aAAA,GAAAG,CAAA;AAEnDI,MAAM,CAACC,OAAO,GAAG;EAAEN,iBAAiB;EAAEE,iBAAiB;EAAEC,UAAU;EAAEC;AAAY,CAAC","ignoreList":[]}

package/demo/web-app-broken/.pitstop/cache/jest/perf-cache-09bbba084113da9182b28b169fd19719-da39a3ee5e6b4b0d3255bfef95601890

@@ -1 +1 @@
-{"D:\\OpenPitStop cli\\demo\\web-app-broken\\test\\app.test.js":[0,2024]}
+{"D:\\OpenPitStop cli\\demo\\web-app-broken\\test\\app.test.js":[0,1820]}

package/demo/web-app-broken/.pitstop/pen/run-2026-08-18T06-12-11-576Z/app.out.log

@@ -0,0 +1,22 @@
+node:internal/modules/cjs/loader:1252
+  throw err;
+  ^
+
+Error: Cannot find module 'D:\OpenPitStop'
+Require stack:
+- internal/preload
+    at Function._resolveFilename (node:internal/modules/cjs/loader:1249:15)
+    at Function._load (node:internal/modules/cjs/loader:1075:27)
+    at TracingChannel.traceSync (node:diagnostics_channel:322:14)
+    at wrapModuleLoad (node:internal/modules/cjs/loader:219:24)
+    at Module.require (node:internal/modules/cjs/loader:1340:12)
+    at node:internal/modules/cjs/loader:1843:12
+    at loadPreloadModules (node:internal/process/pre_execution:727:5)
+    at setupUserModules (node:internal/process/pre_execution:206:5)
+    at prepareExecution (node:internal/process/pre_execution:159:5)
+    at prepareMainThreadExecution (node:internal/process/pre_execution:54:10) {
+  code: 'MODULE_NOT_FOUND',
+  requireStack: [ 'internal/preload' ]
+}
+
+Node.js v22.12.0

package/demo/web-app-broken/.pitstop/pen-2026-08-18T06-12-11-787Z.json

@@ -0,0 +1,162 @@
+{
+  "timestamp": "2026-08-18T06:12:11.785Z",
+  "repo": "D:\\OpenPitStop cli\\demo\\web-app-broken",
+  "mode": "pen",
+  "staticEnabled": true,
+  "dynamicEnabled": true,
+  "dynamic": {
+    "status": "aborted",
+    "note": "app did not come up within 25s (start: \"node src/server.js\")",
+    "routesProbed": 0,
+    "attacks": 0,
+    "bootMs": 198,
+    "durationMs": 209,
+    "outboundEvents": 0
+  },
+  "staticProof": {
+    "proven": 0,
+    "indicated": 0,
+    "unproven": 0,
+    "notTested": 8
+  },
+  "packages": [
+    "express",
+    "lodash",
+    "jsonwebtoken",
+    "mysql2",
+    "cors",
+    "jest"
+  ],
+  "findings": [
+    {
+      "id": "pen-62be9b7b",
+      "source": "pen-static",
+      "type": "sql-injection",
+      "severity": "critical",
+      "confidence": "indicated",
+      "title": "SQL built by string interpolation",
+      "description": "A query string is assembled by concatenating or interpolating variables into SQL. Any route feeding these variables becomes a live injection point. (src/server.js:24)",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\server.js",
+      "line": 24,
+      "repro": "open src/server.js:24",
+      "fix": "Use parameterized queries (?, $1 placeholders) or an ORM. Never interpolate values into SQL text.",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-654abdce",
+      "source": "pen-static",
+      "type": "sql-injection",
+      "severity": "critical",
+      "confidence": "indicated",
+      "title": "SQL built by string interpolation",
+      "description": "A query string is assembled by concatenating or interpolating variables into SQL. Any route feeding these variables becomes a live injection point. (src/users.js:16)",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\users.js",
+      "line": 16,
+      "repro": "open src/users.js:16",
+      "fix": "Use parameterized queries (?, $1 placeholders) or an ORM. Never interpolate values into SQL text.",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-81855543",
+      "source": "pen-static",
+      "type": "command-injection",
+      "severity": "critical",
+      "confidence": "indicated",
+      "title": "child_process called with request-derived input",
+      "description": "exec/spawn/execFile is called with a value that can trace back to request data (query, params, body). If the shell interprets it, that is remote code execution. (src/server.js:24)",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\server.js",
+      "line": 24,
+      "repro": "open src/server.js:24",
+      "fix": "Do not shell out with user input. If unavoidable: execFile with a fixed command, no shell, and validate input against a strict allowlist (e.g. /^[a-z0-9-]{1,64}$/).",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-6d14fd91",
+      "source": "pen-static",
+      "type": "arbitrary-code-execution",
+      "severity": "high",
+      "confidence": "heuristic",
+      "title": "eval / new Function in application code",
+      "description": "`eval` or `new Function` turns attacker-influenced strings into executable code. It is never needed for this; replace with a lookup table or JSON.parse. (src/server.js:59)",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\server.js",
+      "line": 59,
+      "repro": "open src/server.js:59",
+      "fix": "Remove eval/new Function. If a template engine is genuinely required, use a sandboxed one (e.g. a compiled template with no global access).",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-e02320ba",
+      "source": "pen-static",
+      "type": "cookie-without-httponly",
+      "severity": "medium",
+      "confidence": "indicated",
+      "title": "cookie set without httpOnly",
+      "description": "A session/security cookie is being set without `httpOnly` (and likely without `secure`), so an XSS in any page can steal it via document.cookie.",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\auth.js",
+      "line": 31,
+      "fix": "Set `{ httpOnly: true, secure: true, sameSite: \"strict\" }` on every session/auth cookie.",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-c3f2b7cf",
+      "source": "pen-static",
+      "type": "insecure-cors",
+      "severity": "high",
+      "confidence": "indicated",
+      "title": "CORS allows any origin",
+      "description": "CORS is wide open — either a bare `cors()` (defaults to origin: * with credentials off) or an explicit `origin: \"*\"`. Any website can read the responses of this endpoint from a victim's browser.",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\server.js",
+      "line": 13,
+      "fix": "Restrict origins to an explicit allowlist: `cors({ origin: [/^https?:\\/\\/(localhost|127\\.0\\.0\\.1)(:\\d+)?$/, ...] })` — or better, list only your real production origins and never combine `origin: *` with credentials.",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-c55906fe",
+      "source": "pen-static",
+      "type": "missing-security-headers",
+      "severity": "medium",
+      "confidence": "indicated",
+      "title": "no helmet / security headers middleware",
+      "description": "An Express app without helmet() (or manual CSP / X-Frame-Options / X-Content-Type-Options headers). Clickjacking, MIME sniffing and mixed-content protections are all off.",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\server.js",
+      "line": 10,
+      "fix": "Install helmet and `app.use(helmet());` after app creation (deterministic patch generated by `pitstop pen --fix` when helmet is already installed).",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-295619f9",
+      "source": "pen-static",
+      "type": "no-rate-limit",
+      "severity": "medium",
+      "confidence": "heuristic",
+      "title": "no rate limiting on authentication paths",
+      "description": "express-rate-limit is not installed and login-ish routes exist — credential stuffing / brute force is unthrottled. The dynamic phase verifies this live. Login-ish routes: POST /login.",
+      "fix": "Add express-rate-limit and apply a strict limiter to /login /verify /otp /token routes (e.g. 5 requests / 15 min per IP).",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    }
+  ],
+  "summary": {
+    "critical": 3,
+    "high": 2,
+    "medium": 3,
+    "low": 0,
+    "info": 0,
+    "proven": 0,
+    "indicated": 6,
+    "heuristic": 2
+  },
+  "evidence": {
+    "scheme": "pitstop-canonical-sha256-v1",
+    "digest": "e4ce8e1e6534ee152c199374a4de6ca6c2dec036c3a487554c215a9c0fedf2bd",
+    "of": "pitstop pen result for D:\\OpenPitStop cli\\demo\\web-app-broken",
+    "signedAt": "2026-08-18T06:12:11.786Z"
+  }
+}

package/demo/web-app-broken/.pitstop/pen-latest.json

@@ -0,0 +1,162 @@
+{
+  "timestamp": "2026-08-18T06:12:11.785Z",
+  "repo": "D:\\OpenPitStop cli\\demo\\web-app-broken",
+  "mode": "pen",
+  "staticEnabled": true,
+  "dynamicEnabled": true,
+  "dynamic": {
+    "status": "aborted",
+    "note": "app did not come up within 25s (start: \"node src/server.js\")",
+    "routesProbed": 0,
+    "attacks": 0,
+    "bootMs": 198,
+    "durationMs": 209,
+    "outboundEvents": 0
+  },
+  "staticProof": {
+    "proven": 0,
+    "indicated": 0,
+    "unproven": 0,
+    "notTested": 8
+  },
+  "packages": [
+    "express",
+    "lodash",
+    "jsonwebtoken",
+    "mysql2",
+    "cors",
+    "jest"
+  ],
+  "findings": [
+    {
+      "id": "pen-62be9b7b",
+      "source": "pen-static",
+      "type": "sql-injection",
+      "severity": "critical",
+      "confidence": "indicated",
+      "title": "SQL built by string interpolation",
+      "description": "A query string is assembled by concatenating or interpolating variables into SQL. Any route feeding these variables becomes a live injection point. (src/server.js:24)",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\server.js",
+      "line": 24,
+      "repro": "open src/server.js:24",
+      "fix": "Use parameterized queries (?, $1 placeholders) or an ORM. Never interpolate values into SQL text.",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-654abdce",
+      "source": "pen-static",
+      "type": "sql-injection",
+      "severity": "critical",
+      "confidence": "indicated",
+      "title": "SQL built by string interpolation",
+      "description": "A query string is assembled by concatenating or interpolating variables into SQL. Any route feeding these variables becomes a live injection point. (src/users.js:16)",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\users.js",
+      "line": 16,
+      "repro": "open src/users.js:16",
+      "fix": "Use parameterized queries (?, $1 placeholders) or an ORM. Never interpolate values into SQL text.",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-81855543",
+      "source": "pen-static",
+      "type": "command-injection",
+      "severity": "critical",
+      "confidence": "indicated",
+      "title": "child_process called with request-derived input",
+      "description": "exec/spawn/execFile is called with a value that can trace back to request data (query, params, body). If the shell interprets it, that is remote code execution. (src/server.js:24)",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\server.js",
+      "line": 24,
+      "repro": "open src/server.js:24",
+      "fix": "Do not shell out with user input. If unavoidable: execFile with a fixed command, no shell, and validate input against a strict allowlist (e.g. /^[a-z0-9-]{1,64}$/).",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-6d14fd91",
+      "source": "pen-static",
+      "type": "arbitrary-code-execution",
+      "severity": "high",
+      "confidence": "heuristic",
+      "title": "eval / new Function in application code",
+      "description": "`eval` or `new Function` turns attacker-influenced strings into executable code. It is never needed for this; replace with a lookup table or JSON.parse. (src/server.js:59)",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\server.js",
+      "line": 59,
+      "repro": "open src/server.js:59",
+      "fix": "Remove eval/new Function. If a template engine is genuinely required, use a sandboxed one (e.g. a compiled template with no global access).",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-e02320ba",
+      "source": "pen-static",
+      "type": "cookie-without-httponly",
+      "severity": "medium",
+      "confidence": "indicated",
+      "title": "cookie set without httpOnly",
+      "description": "A session/security cookie is being set without `httpOnly` (and likely without `secure`), so an XSS in any page can steal it via document.cookie.",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\auth.js",
+      "line": 31,
+      "fix": "Set `{ httpOnly: true, secure: true, sameSite: \"strict\" }` on every session/auth cookie.",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-c3f2b7cf",
+      "source": "pen-static",
+      "type": "insecure-cors",
+      "severity": "high",
+      "confidence": "indicated",
+      "title": "CORS allows any origin",
+      "description": "CORS is wide open — either a bare `cors()` (defaults to origin: * with credentials off) or an explicit `origin: \"*\"`. Any website can read the responses of this endpoint from a victim's browser.",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\server.js",
+      "line": 13,
+      "fix": "Restrict origins to an explicit allowlist: `cors({ origin: [/^https?:\\/\\/(localhost|127\\.0\\.0\\.1)(:\\d+)?$/, ...] })` — or better, list only your real production origins and never combine `origin: *` with credentials.",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-c55906fe",
+      "source": "pen-static",
+      "type": "missing-security-headers",
+      "severity": "medium",
+      "confidence": "indicated",
+      "title": "no helmet / security headers middleware",
+      "description": "An Express app without helmet() (or manual CSP / X-Frame-Options / X-Content-Type-Options headers). Clickjacking, MIME sniffing and mixed-content protections are all off.",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\server.js",
+      "line": 10,
+      "fix": "Install helmet and `app.use(helmet());` after app creation (deterministic patch generated by `pitstop pen --fix` when helmet is already installed).",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-295619f9",
+      "source": "pen-static",
+      "type": "no-rate-limit",
+      "severity": "medium",
+      "confidence": "heuristic",
+      "title": "no rate limiting on authentication paths",
+      "description": "express-rate-limit is not installed and login-ish routes exist — credential stuffing / brute force is unthrottled. The dynamic phase verifies this live. Login-ish routes: POST /login.",
+      "fix": "Add express-rate-limit and apply a strict limiter to /login /verify /otp /token routes (e.g. 5 requests / 15 min per IP).",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    }
+  ],
+  "summary": {
+    "critical": 3,
+    "high": 2,
+    "medium": 3,
+    "low": 0,
+    "info": 0,
+    "proven": 0,
+    "indicated": 6,
+    "heuristic": 2
+  },
+  "evidence": {
+    "scheme": "pitstop-canonical-sha256-v1",
+    "digest": "e4ce8e1e6534ee152c199374a4de6ca6c2dec036c3a487554c215a9c0fedf2bd",
+    "of": "pitstop pen result for D:\\OpenPitStop cli\\demo\\web-app-broken",
+    "signedAt": "2026-08-18T06:12:11.786Z"
+  }
+}

package/demo/web-app-broken/.pitstop/verify-2026-08-18T06-11-59-327Z.json

@@ -0,0 +1,73 @@
+{
+  "timestamp": "2026-08-18T06:11:59.328Z",
+  "repo": "D:\\OpenPitStop cli\\demo\\web-app-broken",
+  "baselineTimestamp": "2026-08-18T04:07:42.300Z",
+  "risk": "Low",
+  "blocked": false,
+  "stale": true,
+  "staleNote": "baseline is STALE — .env changed 2026-08-18T05:21:00.275Z, after the baseline scan (2026-08-18T04:07:42.300Z). Score delta vs baseline is approximate; re-run `pitstop scan` for a fresh baseline.",
+  "evidence": {
+    "scheme": "pitstop-canonical-sha256-v1",
+    "digest": "297e93ba61700be8a7614c9abb32a888cc07a59008a57e60cc729efd444feb29",
+    "of": "pitstop verify result for D:\\OpenPitStop cli\\demo\\web-app-broken",
+    "signedAt": "2026-08-18T06:11:59.328Z"
+  },
+  "status": "OK",
+  "exitCode": 0,
+  "integrity": {
+    "verdict": "CLEAN",
+    "findings": [],
+    "summary": {
+      "confirmed": 0,
+      "suspicious": 0,
+      "total": 0
+    }
+  },
+  "deltas": {
+    "passed": 0,
+    "failed": 0,
+    "durationMs": -2912,
+    "coverage": 0,
+    "buildTimeMs": 0,
+    "bundleSizeBytes": 0,
+    "security": -2,
+    "duplication": 0
+  },
+  "baseline": {
+    "tests": {
+      "total": 5,
+      "passed": 0,
+      "failed": 5,
+      "durationMs": 6283,
+      "coverage": 62.02
+    },
+    "perf": {},
+    "securityCount": 45,
+    "duplicationCount": 0
+  },
+  "current": {
+    "tests": {
+      "total": 5,
+      "passed": 0,
+      "failed": 5,
+      "durationMs": 3371,
+      "coverage": 62.02
+    },
+    "perf": {},
+    "securityCount": 43,
+    "duplicationCount": 0
+  },
+  "score": {
+    "baseline": 35,
+    "current": 35,
+    "delta": 0,
+    "grade": "F"
+  },
+  "honesty": {
+    "score": 90,
+    "rating": "TRUSTWORTHY",
+    "reasons": [
+      "baseline is stale — the score delta is approximate, not exact"
+    ]
+  }
+}

package/demo/web-app-broken/PITSTOP_BADGE.svg

@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="139" height="20" role="img" aria-label="OpenPitStop score 35/100 (F)">
+  <linearGradient id="g" x1="0" y1="0" x2="1" y2="0">
+    <stop offset="0%" stop-color="#5c5c5c" stop-opacity="0.95"/>
+    <stop offset="100%" stop-color="#3a3a3a" stop-opacity="0.95"/>
+  </linearGradient>
+  <rect width="139" height="20" rx="3" fill="url(#g)"/>
+  <rect x="66" width="73" height="20" fill="#E53935"/>
+  <g fill="#fff" font-family="Verdana,DejaVu Sans,sans-serif" font-size="11" text-anchor="middle">
+    <text x="33" y="14">PITSTOP</text>
+    <text x="102.5" y="14">35/100 F</text>
+  </g>
+</svg>

package/dist/commands/pen.js

@@ -5,7 +5,8 @@ import fs from "node:fs";
 import { analyzeStatic } from "../pen/static.js";
 import { runDynamic } from "../pen/dynamic.js";
 import { applyStaticProof } from "../pen/proof.js";
-import { persistPen } from "../pen/store.js";
+import { loadPenLatest, persistPen } from "../pen/store.js";
+import { computePenDrift } from "../pen/drift.js";
 import { runFixes } from "../pen/fix.js";
 import { renderPenBox, renderPenMarkdown, renderPenHtml } from "../pen/report.js";
 import { summarizeFindings } from "../pen/types.js";
@@ -20,6 +21,8 @@ export async function runPen(repo, opts) {
     const staticStart = Date.now();
     const staticOutcome = analyzeStatic(repo);
     const staticMs = Date.now() - staticStart;
+    // Previous sealed run, for drift detection (read before we overwrite it).
+    const prev = loadPenLatest(repo);
     const staticFindings = [...staticOutcome.findings];
     let dynamicEnabled = !opts.staticOnly;
     let staticProof;
@@ -111,6 +114,10 @@ export async function runPen(repo, opts) {
     else {
         findings.push(...staticFindings);
     }
+    // Drift vs the previously sealed run — only when the two runs are comparable
+    // (same dynamic phase status), so an aborted run never fabricates resolutions.
+    const comparable = prev && prev.dynamic && dynamic.status === prev.dynamic.status;
+    const drift = comparable ? computePenDrift(prev.findings, findings, prev.timestamp) : undefined;
     return {
         timestamp: new Date().toISOString(),
         repo,
@@ -119,6 +126,7 @@ export async function runPen(repo, opts) {
         dynamicEnabled,
         dynamic,
         staticProof,
+        drift,
         packages: staticOutcome.packages,
         findings,
         summary: summarizeFindings(findings),
@@ -199,6 +207,26 @@ export const pen = new Command("pen")
     else if (result.dynamicEnabled && result.dynamic.status === "aborted" && result.findings.length === 0) {
         process.exitCode = 2;
     }
+    // A regression (new high/critical, or a hypothesis the live attack just
+    // confirmed) since the last sealed run always fails the gate.
+    if (result.drift?.regression)
+        process.exitCode = 1;
+    if (result.drift) {
+        const d = result.drift;
+        const parts = [];
+        if (d.new.length)
+            parts.push(`${d.new.length} NEW${d.regression ? " (regression)" : ""}`);
+        if (d.resolved.length)
+            parts.push(`${d.resolved.length} resolved`);
+        if (d.escalations.length)
+            parts.push(`${d.escalations.length} escalated`);
+        if (parts.length) {
+            console.log(chalk.dim(`Drift vs last run${d.baselineTimestamp ? ` (${d.baselineTimestamp})` : ""}: ${parts.join(" · ")}`));
+        }
+        else {
+            console.log(chalk.dim("Drift vs last run: no change"));
+        }
+    }
 });
 export default pen;
 //# sourceMappingURL=pen.js.map