pinata-security-cli 0.2.0 → 0.2.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +45 -36
- package/dist/cli/index.js +275 -130
- package/dist/cli/index.js.map +1 -1
- package/dist/index.d.ts +1 -1
- package/dist/index.js +1 -1
- package/dist/index.js.map +1 -1
- package/package.json +2 -1
package/README.md
CHANGED
|
@@ -5,48 +5,51 @@ AI-powered security scanner that finds vulnerabilities hiding in your codebase.
|
|
|
5
5
|
## Quick Start
|
|
6
6
|
|
|
7
7
|
```bash
|
|
8
|
+
# Fast scan (pattern matching only, ~2s)
|
|
8
9
|
npx --yes pinata-security-cli@latest analyze .
|
|
9
|
-
```
|
|
10
10
|
|
|
11
|
-
|
|
11
|
+
# AI-verified scan (eliminates false positives, ~2-3min)
|
|
12
|
+
ANTHROPIC_API_KEY=sk-ant-xxx npx --yes pinata-security-cli@latest analyze . --verify
|
|
13
|
+
```
|
|
12
14
|
|
|
13
15
|
## What It Does
|
|
14
16
|
|
|
15
|
-
Pinata scans your code for security gaps and test coverage holes:
|
|
16
|
-
|
|
17
17
|
```
|
|
18
|
-
$ pinata analyze
|
|
18
|
+
$ pinata analyze . --verify
|
|
19
|
+
|
|
20
|
+
Pinata Score: 100/100 (A)
|
|
19
21
|
|
|
20
|
-
|
|
22
|
+
AI Verification: 351 total → 18 pre-filtered → 0 verified, 333 AI-dismissed
|
|
21
23
|
|
|
22
|
-
|
|
23
|
-
🔴 sql-injection src/db/queries.ts:45
|
|
24
|
-
🔴 hardcoded-secrets src/config/api.ts:12
|
|
25
|
-
🔴 missing-timeout src/http/client.ts:89
|
|
24
|
+
No gaps detected! Your codebase has good test coverage.
|
|
26
25
|
```
|
|
27
26
|
|
|
27
|
+
Without `--verify`, you get fast pattern-based detection. With `--verify`, AI analyzes each match to filter false positives.
|
|
28
|
+
|
|
28
29
|
## Installation
|
|
29
30
|
|
|
30
|
-
**npx (recommended)**
|
|
31
31
|
```bash
|
|
32
|
+
# Via npx (no install)
|
|
32
33
|
npx --yes pinata-security-cli@latest analyze .
|
|
33
|
-
```
|
|
34
34
|
|
|
35
|
-
|
|
36
|
-
```bash
|
|
35
|
+
# Global install
|
|
37
36
|
npm install -g pinata-security-cli
|
|
38
37
|
pinata analyze .
|
|
39
38
|
```
|
|
40
39
|
|
|
41
40
|
## Commands
|
|
42
41
|
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
42
|
+
```bash
|
|
43
|
+
pinata analyze . # Fast scan
|
|
44
|
+
pinata analyze . --verify # AI-verified scan
|
|
45
|
+
pinata analyze . --confidence low # Include all matches
|
|
46
|
+
pinata analyze . --output json # JSON output
|
|
47
|
+
pinata analyze . --output sarif # SARIF for GitHub
|
|
48
|
+
pinata generate --gaps # Generate tests for gaps
|
|
49
|
+
pinata explain sql-injection src/db.ts:45 # AI explanation
|
|
50
|
+
pinata dashboard # Interactive TUI
|
|
51
|
+
pinata config set anthropic-api-key sk-ant-xxx
|
|
52
|
+
```
|
|
50
53
|
|
|
51
54
|
## Detection Categories
|
|
52
55
|
|
|
@@ -78,33 +81,39 @@ node_modules/
|
|
|
78
81
|
dist/
|
|
79
82
|
```
|
|
80
83
|
|
|
81
|
-
CLI options
|
|
84
|
+
**CLI options:**
|
|
82
85
|
|
|
83
86
|
```bash
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
87
|
+
--verify # AI verification (requires API key)
|
|
88
|
+
--confidence <level> # high (default), medium, low
|
|
89
|
+
--output <format> # terminal, json, sarif, junit, markdown
|
|
90
|
+
--domain <domain> # security, data, concurrency, etc.
|
|
91
|
+
--severity <level> # critical, high, medium, low
|
|
92
|
+
--exclude <dirs> # Comma-separated directories to skip
|
|
88
93
|
```
|
|
89
94
|
|
|
90
|
-
## AI
|
|
95
|
+
## AI Verification
|
|
91
96
|
|
|
92
|
-
|
|
97
|
+
The `--verify` flag uses AI to analyze each pattern match and filter false positives:
|
|
93
98
|
|
|
94
99
|
```bash
|
|
95
|
-
# Set API key
|
|
100
|
+
# Set API key (one time)
|
|
96
101
|
pinata config set anthropic-api-key sk-ant-xxx
|
|
97
|
-
|
|
98
|
-
# Or via environment
|
|
102
|
+
# Or use environment variable
|
|
99
103
|
export ANTHROPIC_API_KEY=sk-ant-xxx
|
|
100
104
|
|
|
101
|
-
#
|
|
102
|
-
pinata
|
|
103
|
-
|
|
104
|
-
# Generate tests
|
|
105
|
-
pinata generate --gaps
|
|
105
|
+
# Run AI-verified scan
|
|
106
|
+
pinata analyze . --verify
|
|
106
107
|
```
|
|
107
108
|
|
|
109
|
+
**How it works:**
|
|
110
|
+
- Patterns cast a wide net (351 matches)
|
|
111
|
+
- AI analyzes each match in context
|
|
112
|
+
- False positives are dismissed with reasoning
|
|
113
|
+
- Only real vulnerabilities remain (often 0-5)
|
|
114
|
+
|
|
115
|
+
**Performance:** ~2.5 minutes for 350 matches (batched 10/request, 3 concurrent)
|
|
116
|
+
|
|
108
117
|
## CI/CD Integration
|
|
109
118
|
|
|
110
119
|
**GitHub Actions**
|