prodlint 0.9.1 → 0.9.2

package/README.md

@@ -6,18 +6,18 @@
 
 Production readiness for vibe-coded apps.
 
-Static analysis for vibe-coded apps. Flags the security, reliability, performance, and AI quality issues that Cursor, v0, Bolt, and Copilot create — hallucinated imports, missing auth, hardcoded secrets, unvalidated server actions, and more. Zero config, no LLM, 52 rules, under 100ms.
+Static analysis for vibe-coded apps. Flags the security, reliability, performance, and AI quality issues that Cursor, v0, Bolt, and Copilot create — hallucinated imports, missing auth, hardcoded secrets, unvalidated server actions, and more. Zero config, no LLM, 52 rules.
 
 ```bash
 npx prodlint
 ```
 
 ```
-  prodlint v0.9.1
-  Scanned 148 files · 3 critical · 5 warnings
+  prodlint v0.9.2
+  Scanned 148 files · 2 critical · 5 warnings · 1 info
 
   src/app/api/checkout/route.ts
-    12:1  CRIT  No rate limiting — anyone could spam this endpoint and run up your API costs  rate-limiting
+    12:1  INFO  No rate limiting — anyone could spam this endpoint and run up your API costs  rate-limiting
     28:5  WARN  Empty catch block silently swallows error  shallow-catch
 
   src/actions/submit.ts
@@ -35,7 +35,7 @@ npx prodlint
 
   Overall: 82/100 (weighted)
 
-  3 critical · 5 warnings · 3 info
+  2 critical · 5 warnings · 4 info
 ```
 
 ## Why?
@@ -50,6 +50,11 @@ prodlint checks what TypeScript and ESLint don't: **whether your vibe-coded app
 npx prodlint                              # Run directly (no install)
 npx prodlint ./my-app                     # Scan specific path
 npx prodlint --json                       # JSON output for CI
+npx prodlint --sarif                      # SARIF 2.1.0 for GitHub Code Scanning
+npx prodlint --summary                    # Quick pass/fail + top 3 blockers
+npx prodlint --profile startup            # Only critical findings
+npx prodlint --profile strict             # All findings including info
+npx prodlint --baseline .prodlint-baseline.json   # Only new findings
 npx prodlint --ignore "*.test.ts"         # Ignore patterns
 npx prodlint --min-severity warning       # Only warnings and criticals
 npx prodlint --quiet                      # Suppress badge output
@@ -196,13 +201,40 @@ Posts a score breakdown as a PR comment and fails the build if below threshold.
 | `score` | Overall score (0-100) |
 | `critical` | Number of critical findings |
 
+### SARIF + GitHub Code Scanning
+
+Upload prodlint results to GitHub's Security tab:
+
+```yaml
+- name: Run prodlint
+  run: npx prodlint --sarif > prodlint.sarif
+
+- name: Upload SARIF
+  uses: github/codeql-action/upload-sarif@v4
+  with:
+    sarif_file: prodlint.sarif
+    category: prodlint
+```
+
+### Baseline for Existing Projects
+
+Adopt prodlint gradually without drowning in pre-existing findings:
+
+```bash
+# Save current state as baseline
+npx prodlint --baseline-save .prodlint-baseline.json
+
+# CI only fails on NEW findings
+npx prodlint --baseline .prodlint-baseline.json
+```
+
 ## MCP Server
 
 Use prodlint inside Cursor, Claude Code, or any MCP-compatible editor:
 
 **Claude Code:**
 ```bash
-claude mcp add prodlint npx prodlint-mcp
+claude mcp add prodlint -- npx -y prodlint-mcp
 ```
 
 **Cursor / Windsurf:**

package/dist/cli.js

@@ -2,6 +2,7 @@
 
 // src/cli.ts
 import { parseArgs } from "util";
+import { readFileSync as readFileSync2, writeFileSync, existsSync } from "fs";
 
 // src/utils/file-walker.ts
 import fg from "fast-glob";
@@ -4592,6 +4593,99 @@ function reportPretty(result, opts = {}) {
 function reportJson(result) {
   return JSON.stringify(result, null, 2);
 }
+function reportSummary(result) {
+  const lines = [];
+  const { critical, warning, info } = result.summary;
+  const hasCritical = critical > 0;
+  const verdict = hasCritical ? pc.red(pc.bold("FAIL")) : pc.green(pc.bold("PASS"));
+  const scorePart = scoreColor(result.overallScore)(`${result.overallScore}/100`);
+  const countParts = [];
+  if (critical > 0) countParts.push(`${critical} critical`);
+  if (warning > 0) countParts.push(`${warning} warning`);
+  if (info > 0) countParts.push(`${info} info`);
+  lines.push("");
+  if (countParts.length > 0) {
+    lines.push(`  ${verdict} ${pc.dim("\u2014")} ${countParts.join(", ")} ${pc.dim(`(score: ${scorePart})`)}`);
+  } else {
+    lines.push(`  ${verdict} ${pc.dim("\u2014")} no issues ${pc.dim(`(score: ${scorePart})`)}`);
+  }
+  const topFindings = result.findings.filter((f) => f.severity === "critical" || f.severity === "warning").slice(0, 3);
+  if (topFindings.length > 0) {
+    for (let i = 0; i < topFindings.length; i++) {
+      const f = topFindings[i];
+      const color = SEVERITY_COLORS[f.severity];
+      const label = SEVERITY_LABELS[f.severity];
+      lines.push(`  ${pc.dim(`${i + 1}.`)} ${f.file}:${f.line} ${pc.dim("\u2014")} ${color(label)} ${f.message} ${pc.dim(f.ruleId)}`);
+    }
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+var SARIF_SEVERITY_MAP = {
+  critical: "error",
+  warning: "warning",
+  info: "note"
+};
+function reportSarif(result) {
+  const ruleMap = /* @__PURE__ */ new Map();
+  for (const r of rules) {
+    ruleMap.set(r.id, r);
+  }
+  const usedRuleIds = new Set(result.findings.map((f) => f.ruleId));
+  const sarifRules = [...usedRuleIds].map((id) => {
+    const rule = ruleMap.get(id);
+    return {
+      id,
+      name: rule?.name ?? id,
+      shortDescription: { text: rule?.description ?? id },
+      defaultConfiguration: {
+        level: SARIF_SEVERITY_MAP[rule?.severity ?? "info"] ?? "note"
+      },
+      helpUri: `https://prodlint.com/rules/${id}`
+    };
+  });
+  const sarifResults = result.findings.map((f) => {
+    const sarifResult = {
+      ruleId: f.ruleId,
+      level: SARIF_SEVERITY_MAP[f.severity] ?? "note",
+      message: { text: f.message },
+      locations: [
+        {
+          physicalLocation: {
+            artifactLocation: { uri: f.file.replace(/\\/g, "/") },
+            region: { startLine: f.line, startColumn: f.column }
+          }
+        }
+      ]
+    };
+    if (f.fix) {
+      sarifResult.fixes = [
+        {
+          description: { text: f.fix }
+        }
+      ];
+    }
+    return sarifResult;
+  });
+  const sarif = {
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "prodlint",
+            version: getVersion(),
+            informationUri: "https://prodlint.com",
+            rules: sarifRules
+          }
+        },
+        results: sarifResults
+      }
+    ]
+  };
+  return JSON.stringify(sarif, null, 2);
+}
 function renderBar(score) {
   const width = 20;
   const filled = Math.round(score / 100 * width);
@@ -4642,113 +4736,111 @@ function reportWebPretty(result) {
 }
 
 // src/web-scanner/checks.ts
-function make(id, name, description, maxPoints, severity, maturity, status, details) {
+function make(id, name, description, maxPoints, severity, status, details) {
   return {
     id,
     name,
     description,
     status,
     severity,
-    maturity,
     details,
     points: status === "pass" ? maxPoints : status === "warn" ? Math.floor(maxPoints / 2) : 0,
     maxPoints
   };
 }
 function checkRobotsTxt(ctx) {
-  if (!ctx.robotsTxt) return make("robots_txt", "robots.txt", "robots.txt exists and is accessible", 7, "medium", "established", "fail", "No robots.txt found.");
-  return make("robots_txt", "robots.txt", "robots.txt exists and is accessible", 7, "medium", "established", "pass", "robots.txt found.");
+  if (!ctx.robotsTxt) return make("robots_txt", "robots.txt", "robots.txt exists and is accessible", 5, "medium", "fail", "No robots.txt found.");
+  return make("robots_txt", "robots.txt", "robots.txt exists and is accessible", 5, "medium", "pass", "robots.txt found.");
 }
 function checkRobotsAiDirectives(ctx) {
-  if (!ctx.robotsTxt) return make("robots_ai_directives", "AI robots.txt Directives", "AI bot user-agents in robots.txt", 15, "critical", "established", "fail", "No robots.txt found. AI bots have no guidance.");
-  const agents = ["GPTBot", "ChatGPT-User", "ClaudeBot", "Claude-Web", "Google-Extended", "PerplexityBot", "Bytespider", "CCBot", "anthropic-ai", "cohere-ai", "Applebot-Extended", "Grok"];
+  if (!ctx.robotsTxt) return make("robots_ai_directives", "AI robots.txt Directives", "AI bot user-agents in robots.txt", 15, "critical", "fail", "No robots.txt found. AI bots have no guidance.");
+  const agents = ["GPTBot", "ChatGPT-User", "ClaudeBot", "Claude-Web", "Google-Extended", "PerplexityBot", "Bytespider", "CCBot", "anthropic-ai", "cohere-ai"];
   const found = agents.filter((a) => ctx.robotsTxt.toLowerCase().includes(a.toLowerCase()));
-  if (found.length === 0) return make("robots_ai_directives", "AI robots.txt Directives", "AI bot user-agents in robots.txt", 15, "critical", "established", "fail", "No AI-specific user-agent directives found.");
-  if (found.length < 3) return make("robots_ai_directives", "AI robots.txt Directives", "AI bot user-agents in robots.txt", 15, "critical", "established", "warn", `Found ${found.length} AI bot directive(s): ${found.join(", ")}.`);
-  return make("robots_ai_directives", "AI robots.txt Directives", "AI bot user-agents in robots.txt", 15, "critical", "established", "pass", `Found ${found.length} AI bot directive(s): ${found.join(", ")}.`);
+  if (found.length === 0) return make("robots_ai_directives", "AI robots.txt Directives", "AI bot user-agents in robots.txt", 15, "critical", "fail", "No AI-specific user-agent directives found.");
+  if (found.length < 3) return make("robots_ai_directives", "AI robots.txt Directives", "AI bot user-agents in robots.txt", 15, "critical", "warn", `Found ${found.length} AI bot directive(s): ${found.join(", ")}.`);
+  return make("robots_ai_directives", "AI robots.txt Directives", "AI bot user-agents in robots.txt", 15, "critical", "pass", `Found ${found.length} AI bot directive(s): ${found.join(", ")}.`);
 }
 function checkContentUsage(ctx) {
   const hasHeader = ctx.headers["content-usage"] != null;
   const hasInRobots = ctx.robotsTxt?.toLowerCase().includes("content-usage") ?? false;
-  if (!hasHeader && !hasInRobots) return make("content_usage", "Content-Usage (IETF aipref)", "Content-Usage header or directives", 5, "high", "emerging", "fail", "No Content-Usage directives found.");
-  return make("content_usage", "Content-Usage (IETF aipref)", "Content-Usage header or directives", 5, "high", "emerging", "pass", hasHeader ? `Header: ${ctx.headers["content-usage"]}` : "Found in robots.txt.");
+  if (!hasHeader && !hasInRobots) return make("content_usage", "Content-Usage (IETF aipref)", "Content-Usage header or directives", 10, "high", "fail", "No Content-Usage directives found.");
+  return make("content_usage", "Content-Usage (IETF aipref)", "Content-Usage header or directives", 10, "high", "pass", hasHeader ? `Header: ${ctx.headers["content-usage"]}` : "Found in robots.txt.");
 }
 function checkLlmsTxt(ctx) {
-  if (!ctx.llmsTxt) return make("llms_txt", "llms.txt", "LLM-optimized site summary at /llms.txt", 6, "high", "emerging", "fail", "No llms.txt found.");
-  const lines = ctx.llmsTxt.split("\n").filter((l) => l.trim().length > 0 && !l.trim().startsWith("#"));
-  if (lines.length < 3) return make("llms_txt", "llms.txt", "LLM-optimized site summary at /llms.txt", 6, "high", "emerging", "warn", "llms.txt found but appears minimal.");
-  return make("llms_txt", "llms.txt", "LLM-optimized site summary at /llms.txt", 6, "high", "emerging", "pass", `llms.txt found with ${lines.length} content lines.`);
+  if (!ctx.llmsTxt) return make("llms_txt", "llms.txt", "LLM-optimized site summary at /llms.txt", 10, "high", "fail", "No llms.txt found.");
+  const lines = ctx.llmsTxt.split("\n").filter((l) => l.trim().length > 0);
+  if (lines.length < 3) return make("llms_txt", "llms.txt", "LLM-optimized site summary at /llms.txt", 10, "high", "warn", "llms.txt found but appears minimal.");
+  return make("llms_txt", "llms.txt", "LLM-optimized site summary at /llms.txt", 10, "high", "pass", `llms.txt found with ${lines.length} lines.`);
 }
 function checkTdmRep(ctx) {
   const hasWK = ctx.tdmRep != null;
   const hasHeader = ctx.headers["tdm-reservation"] != null;
-  if (!hasWK && !hasHeader) return make("tdmrep", "TDMRep (W3C)", "Text & data mining reservation file or header", 4, "medium", "emerging", "fail", "No TDMRep configuration found.");
-  return make("tdmrep", "TDMRep (W3C)", "Text & data mining reservation file or header", 4, "medium", "emerging", "pass", hasWK ? "/.well-known/tdmrep.json found." : `TDM-Reservation header: ${ctx.headers["tdm-reservation"]}`);
+  if (!hasWK && !hasHeader) return make("tdmrep", "TDMRep (W3C)", "Text & data mining reservation file or header", 8, "medium", "fail", "No TDMRep configuration found.");
+  return make("tdmrep", "TDMRep (W3C)", "Text & data mining reservation file or header", 8, "medium", "pass", hasWK ? "/.well-known/tdmrep.json found." : `TDM-Reservation header: ${ctx.headers["tdm-reservation"]}`);
 }
 function checkAiDisclosure(ctx) {
-  if (!ctx.headers["ai-disclosure"]) return make("ai_disclosure", "AI-Disclosure Header", "Declares AI involvement in content generation", 2, "low", "emerging", "fail", "No AI-Disclosure header found.");
-  return make("ai_disclosure", "AI-Disclosure Header", "Declares AI involvement in content generation", 2, "low", "emerging", "pass", `Header: ${ctx.headers["ai-disclosure"]}`);
+  if (!ctx.headers["ai-disclosure"]) return make("ai_disclosure", "AI-Disclosure Header", "Declares AI involvement in content generation", 5, "low", "fail", "No AI-Disclosure header found.");
+  return make("ai_disclosure", "AI-Disclosure Header", "Declares AI involvement in content generation", 5, "low", "pass", `Header: ${ctx.headers["ai-disclosure"]}`);
 }
 function checkAgentCard(ctx) {
-  if (!ctx.agentCard) return make("agent_card", "A2A AgentCard", "/.well-known/agent-card.json for agent discovery", 5, "high", "emerging", "fail", "No A2A AgentCard found.");
+  if (!ctx.agentCard) return make("agent_card", "A2A AgentCard", "/.well-known/agent-card.json for agent discovery", 10, "high", "fail", "No A2A AgentCard found.");
   try {
     const card = JSON.parse(ctx.agentCard);
-    if (!card.name || !Array.isArray(card.skills) || card.skills.length === 0) return make("agent_card", "A2A AgentCard", "/.well-known/agent-card.json for agent discovery", 5, "high", "emerging", "warn", "AgentCard found but missing name or skills.");
-    return make("agent_card", "A2A AgentCard", "/.well-known/agent-card.json for agent discovery", 5, "high", "emerging", "pass", `AgentCard found with ${card.skills.length} skill(s).`);
+    if (!card.name || !Array.isArray(card.skills) || card.skills.length === 0) return make("agent_card", "A2A AgentCard", "/.well-known/agent-card.json for agent discovery", 10, "high", "warn", "AgentCard found but missing name or skills.");
+    return make("agent_card", "A2A AgentCard", "/.well-known/agent-card.json for agent discovery", 10, "high", "pass", `AgentCard found with ${card.skills.length} skill(s).`);
   } catch {
-    return make("agent_card", "A2A AgentCard", "/.well-known/agent-card.json for agent discovery", 5, "high", "emerging", "warn", "AgentCard found but contains invalid JSON.");
+    return make("agent_card", "A2A AgentCard", "/.well-known/agent-card.json for agent discovery", 10, "high", "warn", "AgentCard found but contains invalid JSON.");
   }
 }
 function checkAiTxt(ctx) {
-  if (!ctx.aiTxt) return make("ai_txt", "ai.txt", "AI training permissions per Spawning spec", 3, "medium", "emerging", "fail", "No ai.txt found at site root.");
+  if (!ctx.aiTxt) return make("ai_txt", "ai.txt", "AI training permissions per Spawning spec", 5, "medium", "fail", "No ai.txt found at site root.");
   const lines = ctx.aiTxt.split("\n").filter((l) => l.trim().length > 0 && !l.trim().startsWith("#"));
-  if (lines.length < 2) return make("ai_txt", "ai.txt", "AI training permissions per Spawning spec", 3, "medium", "emerging", "warn", "ai.txt found but appears minimal.");
-  return make("ai_txt", "ai.txt", "AI training permissions per Spawning spec", 3, "medium", "emerging", "pass", `ai.txt found with ${lines.length} directive(s).`);
+  if (lines.length < 2) return make("ai_txt", "ai.txt", "AI training permissions per Spawning spec", 5, "medium", "warn", "ai.txt found but appears minimal.");
+  return make("ai_txt", "ai.txt", "AI training permissions per Spawning spec", 5, "medium", "pass", `ai.txt found with ${lines.length} directive(s).`);
 }
 function checkWebMCP(ctx) {
-  if (!ctx.html) return make("webmcp", "WebMCP Tools", "Chrome 146+ WebMCP tool registration", 5, "high", "emerging", "info", "Could not check for WebMCP tools.");
+  if (!ctx.html) return make("webmcp", "WebMCP Tools", "Chrome 146+ WebMCP tool registration", 10, "high", "info", "Could not check for WebMCP tools.");
   const hasToolname = /toolname=/i.test(ctx.html);
   const hasModelContext = /navigator\.modelContext/i.test(ctx.html) || /registerTool/i.test(ctx.html);
-  if (!hasToolname && !hasModelContext) return make("webmcp", "WebMCP Tools", "Chrome 146+ WebMCP tool registration", 5, "high", "emerging", "fail", "No WebMCP tools detected.");
+  if (!hasToolname && !hasModelContext) return make("webmcp", "WebMCP Tools", "Chrome 146+ WebMCP tool registration", 10, "high", "fail", "No WebMCP tools detected.");
   const count = (ctx.html.match(/toolname=/gi) || []).length;
-  return make("webmcp", "WebMCP Tools", "Chrome 146+ WebMCP tool registration", 5, "high", "emerging", "pass", hasToolname ? `${count} form(s) with toolname attributes.` : "registerTool() usage detected.");
+  return make("webmcp", "WebMCP Tools", "Chrome 146+ WebMCP tool registration", 10, "high", "pass", hasToolname ? `${count} form(s) with toolname attributes.` : "registerTool() usage detected.");
 }
 function checkStructuredData(ctx) {
-  if (!ctx.html) return make("structured_data", "Structured Data", "JSON-LD or Schema.org markup", 12, "medium", "established", "info", "Could not fetch page HTML.");
+  if (!ctx.html) return make("structured_data", "Structured Data", "JSON-LD or Schema.org markup", 10, "medium", "info", "Could not fetch page HTML.");
   const jsonLd = ctx.html.match(/<script[^>]*type=["']application\/ld\+json["'][^>]*>/gi);
   const hasMicrodata = ctx.html.includes("itemscope") && ctx.html.includes("itemtype");
-  if (!jsonLd && !hasMicrodata) return make("structured_data", "Structured Data", "JSON-LD or Schema.org markup", 12, "medium", "established", "fail", "No structured data found.");
-  return make("structured_data", "Structured Data", "JSON-LD or Schema.org markup", 12, "medium", "established", "pass", `Found ${(jsonLd?.length || 0) + (hasMicrodata ? 1 : 0)} structured data block(s).`);
+  if (!jsonLd && !hasMicrodata) return make("structured_data", "Structured Data", "JSON-LD or Schema.org markup", 10, "medium", "fail", "No structured data found.");
+  return make("structured_data", "Structured Data", "JSON-LD or Schema.org markup", 10, "medium", "pass", `Found ${(jsonLd?.length || 0) + (hasMicrodata ? 1 : 0)} structured data block(s).`);
 }
 function checkOpenGraph(ctx) {
-  if (!ctx.html) return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 10, "low", "established", "info", "Could not fetch HTML.");
+  if (!ctx.html) return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 7, "low", "info", "Could not fetch HTML.");
   const checks = [/og:title/i.test(ctx.html), /og:description/i.test(ctx.html), /og:image/i.test(ctx.html), /name=["']description["']/i.test(ctx.html)];
   const passed = checks.filter(Boolean).length;
-  if (passed === 0) return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 10, "low", "established", "fail", "No OpenGraph tags or meta description.");
-  if (passed < 3) return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 10, "low", "established", "warn", `Found ${passed}/4 meta tags.`);
-  if (passed < 4) return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 10, "low", "established", "pass", `Found ${passed}/4 key meta tags.`);
-  return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 10, "low", "established", "pass", "All 4 key meta tags present.");
+  if (passed === 0) return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 7, "low", "fail", "No OpenGraph tags or meta description.");
+  if (passed < 3) return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 7, "low", "warn", `Found ${passed}/4 meta tags.`);
+  return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 7, "low", "pass", `All ${passed} key meta tags present.`);
 }
 function checkSitemap(ctx) {
-  if (!ctx.sitemapXml) return make("sitemap", "sitemap.xml", "Sitemap exists and is valid", 10, "medium", "established", "fail", "No sitemap.xml found.");
+  if (!ctx.sitemapXml) return make("sitemap", "sitemap.xml", "Sitemap exists and is valid", 5, "medium", "fail", "No sitemap.xml found.");
   const count = Math.max((ctx.sitemapXml.match(/<url>/gi) || []).length, (ctx.sitemapXml.match(/<loc>/gi) || []).length);
-  if (count === 0 && /<sitemapindex/i.test(ctx.sitemapXml)) return make("sitemap", "sitemap.xml", "Sitemap exists and is valid", 10, "medium", "established", "pass", "Sitemap index found.");
-  if (count === 0) return make("sitemap", "sitemap.xml", "Sitemap exists and is valid", 10, "medium", "established", "warn", "sitemap.xml found but appears empty.");
-  return make("sitemap", "sitemap.xml", "Sitemap exists and is valid", 10, "medium", "established", "pass", `sitemap.xml found with ${count} URL(s).`);
+  if (count === 0 && /<sitemapindex/i.test(ctx.sitemapXml)) return make("sitemap", "sitemap.xml", "Sitemap exists and is valid", 5, "medium", "pass", "Sitemap index found.");
+  if (count === 0) return make("sitemap", "sitemap.xml", "Sitemap exists and is valid", 5, "medium", "warn", "sitemap.xml found but appears empty.");
+  return make("sitemap", "sitemap.xml", "Sitemap exists and is valid", 5, "medium", "pass", `sitemap.xml found with ${count} URL(s).`);
 }
 function checkHttpSignatures(ctx) {
   const hasDirectory = ctx.httpSigDirectory != null;
   const hasSignatureHeader = ctx.headers["signature"] != null || ctx.headers["signature-input"] != null;
   const hasSignatureAgent = ctx.headers["signature-agent"] != null;
-  if (!hasDirectory && !hasSignatureHeader && !hasSignatureAgent) return make("http_signatures", "HTTP Message Signatures (RFC 9421)", "Agent identity verification via cryptographic signatures", 3, "medium", "emerging", "fail", "No HTTP signature support detected.");
-  if (hasDirectory) return make("http_signatures", "HTTP Message Signatures (RFC 9421)", "Agent identity verification via cryptographic signatures", 3, "medium", "emerging", "pass", "/.well-known/http-message-signatures-directory found.");
-  return make("http_signatures", "HTTP Message Signatures (RFC 9421)", "Agent identity verification via cryptographic signatures", 3, "medium", "emerging", "pass", hasSignatureAgent ? "Signature-Agent header detected." : "Signature/Signature-Input headers detected.");
+  if (!hasDirectory && !hasSignatureHeader && !hasSignatureAgent) return make("http_signatures", "HTTP Message Signatures (RFC 9421)", "Agent identity verification via cryptographic signatures", 5, "medium", "fail", "No HTTP signature support detected.");
+  if (hasDirectory) return make("http_signatures", "HTTP Message Signatures (RFC 9421)", "Agent identity verification via cryptographic signatures", 5, "medium", "pass", "/.well-known/http-message-signatures-directory found.");
+  return make("http_signatures", "HTTP Message Signatures (RFC 9421)", "Agent identity verification via cryptographic signatures", 5, "medium", "pass", hasSignatureAgent ? "Signature-Agent header detected." : "Signature/Signature-Input headers detected.");
 }
 function checkPageSpeed(ctx) {
-  if (ctx.loadTimeMs == null) return make("page_speed", "Page Load Time", "Response time for AI agent interactions", 8, "low", "established", "info", "Could not measure.");
-  if (ctx.loadTimeMs > 5e3) return make("page_speed", "Page Load Time", "Response time for AI agent interactions", 8, "low", "established", "fail", `${(ctx.loadTimeMs / 1e3).toFixed(1)}s \u2014 agents may time out.`);
-  if (ctx.loadTimeMs > 2e3) return make("page_speed", "Page Load Time", "Response time for AI agent interactions", 8, "low", "established", "warn", `${(ctx.loadTimeMs / 1e3).toFixed(1)}s \u2014 consider optimizing.`);
-  return make("page_speed", "Page Load Time", "Response time for AI agent interactions", 8, "low", "established", "pass", `${(ctx.loadTimeMs / 1e3).toFixed(1)}s.`);
+  if (ctx.loadTimeMs == null) return make("page_speed", "Page Load Time", "Response time for AI agent interactions", 5, "low", "info", "Could not measure.");
+  if (ctx.loadTimeMs > 5e3) return make("page_speed", "Page Load Time", "Response time for AI agent interactions", 5, "low", "fail", `${(ctx.loadTimeMs / 1e3).toFixed(1)}s \u2014 agents may time out.`);
+  if (ctx.loadTimeMs > 2e3) return make("page_speed", "Page Load Time", "Response time for AI agent interactions", 5, "low", "warn", `${(ctx.loadTimeMs / 1e3).toFixed(1)}s \u2014 consider optimizing.`);
+  return make("page_speed", "Page Load Time", "Response time for AI agent interactions", 5, "low", "pass", `${(ctx.loadTimeMs / 1e3).toFixed(1)}s.`);
 }
 var allChecks = [
   checkRobotsTxt,
@@ -4787,29 +4879,6 @@ function isPrivateHost(hostname) {
   if (PRIVATE_HOSTNAMES.has(hostname.toLowerCase())) return true;
   const h = hostname.replace(/^\[|\]$/g, "").toLowerCase();
   if (h === "::1" || h.startsWith("fe80:") || h.startsWith("fc") || h.startsWith("fd") || h === "::") return true;
-  const v4mapped = h.match(/^(?:::ffff:)(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-  if (v4mapped) {
-    const [, a, b] = v4mapped.map(Number);
-    if (a === 10 || a === 127 || a === 0) return true;
-    if (a === 172 && b >= 16 && b <= 31) return true;
-    if (a === 192 && b === 168) return true;
-    if (a === 169 && b === 254) return true;
-    return false;
-  }
-  if (/^(0[xX][0-9a-fA-F]+|0[0-7]+)(\.|$)/.test(hostname)) return true;
-  if (/^\d+$/.test(hostname)) {
-    const dec = parseInt(hostname, 10);
-    if (dec >= 0 && dec <= 4294967295) {
-      const a = dec >>> 24 & 255;
-      const b = dec >>> 16 & 255;
-      if (a === 10 || a === 127 || a === 0) return true;
-      if (a === 172 && b >= 16 && b <= 31) return true;
-      if (a === 192 && b === 168) return true;
-      if (a === 169 && b === 254) return true;
-      if (a === 100 && b >= 64 && b <= 127) return true;
-      if (a === 198 && (b === 18 || b === 19)) return true;
-    }
-  }
   const ipv4 = hostname.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
   if (ipv4) {
     const [, a, b] = ipv4.map(Number);
@@ -4822,49 +4891,22 @@ function isPrivateHost(hostname) {
   }
   return false;
 }
-function isAllowedProtocol(url) {
-  try {
-    const p = new URL(url).protocol;
-    return p === "https:" || p === "http:";
-  } catch {
-    return false;
-  }
-}
 function validateRedirectUrl(responseUrl) {
   try {
     const parsed = new URL(responseUrl);
-    if (!isAllowedProtocol(responseUrl)) return false;
     return !isPrivateHost(parsed.hostname);
   } catch {
     return false;
   }
 }
-var MAX_REDIRECTS = 5;
-async function safeFetch(url, timeout, signal) {
-  let current = url;
-  for (let i = 0; i < MAX_REDIRECTS; i++) {
-    const r = await fetch(current, { signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "manual" });
-    const status = r.status;
-    if (status >= 300 && status < 400) {
-      const location = r.headers.get("location");
-      if (!location) return null;
-      const resolved = new URL(location, current).toString();
-      if (!validateRedirectUrl(resolved)) return null;
-      current = resolved;
-      continue;
-    }
-    return r;
-  }
-  return null;
-}
 async function fetchText(url, timeout = 8e3) {
   try {
     const c = new AbortController();
     const t = setTimeout(() => c.abort(), timeout);
-    const r = await safeFetch(url, timeout, c.signal);
+    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
     clearTimeout(t);
-    if (!r || !r.ok) return null;
-    return await r.text();
+    if (r.url && !validateRedirectUrl(r.url)) return null;
+    return r.ok ? await r.text() : null;
   } catch {
     return null;
   }
@@ -4873,9 +4915,9 @@ async function fetchHeaders(url, timeout = 8e3) {
   try {
     const c = new AbortController();
     const t = setTimeout(() => c.abort(), timeout);
-    const r = await safeFetch(url, timeout, c.signal);
+    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
     clearTimeout(t);
-    if (!r) return {};
+    if (r.url && !validateRedirectUrl(r.url)) return {};
     const h = {};
     r.headers.forEach((v, k) => {
       h[k.toLowerCase()] = v;
@@ -4890,18 +4932,20 @@ async function fetchWithTiming(url, timeout = 15e3) {
     const c = new AbortController();
     const t = setTimeout(() => c.abort(), timeout);
     const start = Date.now();
-    const r = await safeFetch(url, timeout, c.signal);
-    clearTimeout(t);
-    if (!r || !r.ok) return { html: null, loadTimeMs: null };
+    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
     const html = await r.text();
-    return { html, loadTimeMs: Date.now() - start };
+    clearTimeout(t);
+    if (r.url && !validateRedirectUrl(r.url)) return { html: null, loadTimeMs: null };
+    return r.ok ? { html, loadTimeMs: Date.now() - start } : { html: null, loadTimeMs: null };
   } catch {
     return { html: null, loadTimeMs: null };
   }
 }
 function normalizeUrl(input) {
   let url = input.trim();
-  if (!/^https?:\/\//i.test(url)) url = `https://${url}`;
+  if (!/^https?:\/\//i.test(url)) {
+    url = `https://${url}`;
+  }
   const parsed = new URL(url);
   return parsed.origin;
 }
@@ -4941,13 +4985,26 @@ async function runWebScan(targetUrl) {
 
 // src/cli.ts
 var SEVERITY_RANK = { critical: 3, warning: 2, info: 1 };
+var PROFILE_SEVERITY = {
+  startup: "critical",
+  balanced: "warning",
+  strict: "info"
+};
+function fingerprintFinding(f) {
+  return `${f.ruleId}::${f.file}::${f.line}`;
+}
 async function main() {
   const { values, positionals } = parseArgs({
     allowPositionals: true,
     options: {
       json: { type: "boolean", default: false },
+      sarif: { type: "boolean", default: false },
+      summary: { type: "boolean", default: false },
       ignore: { type: "string", multiple: true, default: [] },
       "min-severity": { type: "string", default: "info" },
+      profile: { type: "string" },
+      baseline: { type: "string" },
+      "baseline-save": { type: "string" },
       quiet: { type: "boolean", default: false },
       web: { type: "boolean", default: false },
       help: { type: "boolean", short: "h", default: false },
@@ -4972,15 +5029,66 @@ async function main() {
     return;
   }
   const targetPath = positionals[0] ?? ".";
-  const minSeverity = values["min-severity"] ?? "info";
+  let minSeverity;
+  if (values.profile) {
+    const profileName = values.profile;
+    if (!(profileName in PROFILE_SEVERITY)) {
+      console.error(`Unknown profile: ${profileName}. Available: startup, balanced, strict`);
+      process.exit(2);
+    }
+    minSeverity = PROFILE_SEVERITY[profileName];
+  } else {
+    minSeverity = values["min-severity"] ?? "info";
+  }
   const result = await scan({
     path: targetPath,
     ignore: values.ignore
   });
   const minRank = SEVERITY_RANK[minSeverity] ?? 1;
   result.findings = result.findings.filter((f) => SEVERITY_RANK[f.severity] >= minRank);
-  if (values.json) {
+  result.summary = {
+    critical: result.findings.filter((f) => f.severity === "critical").length,
+    warning: result.findings.filter((f) => f.severity === "warning").length,
+    info: result.findings.filter((f) => f.severity === "info").length
+  };
+  if (values["baseline-save"]) {
+    const baselinePath = values["baseline-save"];
+    const entries = result.findings.map((f) => ({
+      ruleId: f.ruleId,
+      file: f.file,
+      line: f.line,
+      message: f.message
+    }));
+    writeFileSync(baselinePath, JSON.stringify(entries, null, 2));
+    console.log(`Baseline saved: ${entries.length} findings written to ${baselinePath}`);
+    return;
+  }
+  if (values.baseline) {
+    const baselinePath = values.baseline;
+    if (!existsSync(baselinePath)) {
+      console.error(`Baseline file not found: ${baselinePath}`);
+      console.error("Run with --baseline-save first to create a baseline.");
+      process.exit(2);
+    }
+    const baselineData = JSON.parse(readFileSync2(baselinePath, "utf8"));
+    const baselineFingerprints = new Set(
+      baselineData.map((e) => `${e.ruleId}::${e.file}::${e.line}`)
+    );
+    result.findings = result.findings.filter(
+      (f) => !baselineFingerprints.has(fingerprintFinding(f))
+    );
+    result.summary = {
+      critical: result.findings.filter((f) => f.severity === "critical").length,
+      warning: result.findings.filter((f) => f.severity === "warning").length,
+      info: result.findings.filter((f) => f.severity === "info").length
+    };
+  }
+  if (values.sarif) {
+    console.log(reportSarif(result));
+  } else if (values.json) {
     console.log(reportJson(result));
+  } else if (values.summary) {
+    console.log(reportSummary(result));
   } else {
     console.log(reportPretty(result, { quiet: values.quiet }));
   }
@@ -5018,22 +5126,32 @@ function printHelp() {
 
   Options:
     --json                    Output results as JSON
+    --sarif                   Output results as SARIF 2.1.0 (for GitHub Code Scanning)
+    --summary                 Quick pass/fail verdict with top 3 findings
     --ignore <pattern>        Glob patterns to ignore (can be repeated)
-    --min-severity <level>    Minimum severity to show: critical, warning, info (default: info)
+    --min-severity <level>    Minimum severity: critical, warning, info (default: info)
+    --profile <name>          Preset: startup (criticals only), balanced (warnings+), strict (all)
+    --baseline <file>         Only show findings not in baseline file
+    --baseline-save <file>    Save current findings as baseline snapshot
     --quiet                   Suppress badge and summary
     --web                     Get your site's prodlint score (14 AI agent checks)
     -h, --help                Show this help message
     -v, --version             Show version
 
   Examples:
-    npx prodlint                              Scan current directory
-    npx prodlint ./my-app                     Scan specific path
-    npx prodlint --json                       JSON output
-    npx prodlint --ignore "*.test"            Ignore test files
-    npx prodlint --min-severity warning       Only warnings and criticals
-    npx prodlint --quiet                      No badge output
-    npx prodlint --web example.com            Site score
-    npx prodlint --web example.com --json     Site score with JSON output
+    npx prodlint                                  Scan current directory
+    npx prodlint ./my-app                         Scan specific path
+    npx prodlint --json                           JSON output
+    npx prodlint --sarif                          SARIF output for CI integration
+    npx prodlint --summary                        Quick pass/fail + top blockers
+    npx prodlint --profile startup                Only critical findings
+    npx prodlint --baseline .prodlint-baseline.json   Only new findings
+    npx prodlint --baseline-save .prodlint-baseline.json   Save baseline
+    npx prodlint --ignore "*.test"                Ignore test files
+    npx prodlint --min-severity warning           Only warnings and criticals
+    npx prodlint --quiet                          No badge output
+    npx prodlint --web example.com                Site score
+    npx prodlint --web example.com --json         Site score with JSON output
 `);
 }
 main().catch((err) => {