safeey-cli 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Noohra Innovate Ltd.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,63 @@
+# Safeey CLI
+
+Scan your source code for security vulnerabilities — locally, in seconds.
+A [Safeey](https://safeey.io) product by Noohra Innovate Ltd.
+
+Where Safeey's web scanner checks your **live site** from the outside, `safeey-cli`
+checks your **source code** from the inside — the two halves of shipping securely.
+
+## Install
+
+```bash
+npm install -g safeey-cli
+```
+
+## Use
+
+```bash
+safeey scan ./              # scan the current project
+safeey scan ./src           # scan a folder
+safeey scan . --fail-on critical   # for CI: exit non-zero on critical findings
+safeey scan . --json > report.json # machine-readable output
+```
+
+Your code never leaves your machine — scanning runs entirely locally.
+
+## What it checks
+
+- **Dangerous code patterns** (AST-based): `eval`/`Function` code execution,
+  command injection via `child_process`, SQL injection from string-built queries,
+  XSS via `innerHTML`/`dangerouslySetInnerHTML`, disabled TLS verification, weak
+  hashing (MD5/SHA-1), open redirects, permissive CORS, hardcoded secret fallbacks.
+- **Hardcoded secrets**: AWS keys, private keys, Stripe/Google/GitHub/Slack/OpenAI
+  tokens, JWTs, and generic credential assignments (values are masked in output).
+- **Dependencies**: known-vulnerable and unpinned packages in `package.json`.
+
+Every finding includes a plain-English explanation and the fix, plus a **risk grade**
+(A–F) for the whole codebase.
+
+## Options
+
+| Flag | Description |
+|------|-------------|
+| `--fail-on <sev>` | Exit non-zero if any finding ≥ severity (`critical`/`high`/`medium`/`low`/`off`; default `high`) |
+| `--json` | Output findings as JSON |
+| `--no-secrets` | Skip secret detection |
+| `-h, --help` | Help |
+| `-v, --version` | Version |
+
+## Languages
+
+JavaScript / TypeScript today (AST-based). Secret and dependency scanning are
+language-agnostic. More languages (Python, Go) are on the roadmap.
+
+## Roadmap
+
+- More languages via tree-sitter grammars
+- Full CVE coverage via the OSV database
+- Optional AI layer to explain findings and suggest patches
+- `safeey login` to sync results to your Safeey dashboard
+
+## License
+
+MIT © Noohra Innovate Ltd.

package/bin/safeey.js

@@ -0,0 +1,98 @@
+#!/usr/bin/env node
+// bin/safeey.js — Safeey CLI entry point.
+const { scan, SEV_ORDER } = require("../src/scan");
+const { printReport } = require("../src/report");
+const { getConfig, setConfig, CONFIG_PATH } = require("../src/config");
+const { syncResults } = require("../src/sync");
+
+const pkg = require("../package.json");
+
+const HELP = `
+Safeey CLI ${pkg.version} — scan your source code for security issues.
+
+Usage
+  safeey scan [path]            Scan a directory or file (default: current dir)
+  safeey login <api-key>        Save your Safeey API key (for --sync)
+  safeey logout                 Remove the saved API key
+
+Options
+  --sync                        Send results to your Safeey dashboard (code stays local)
+  --json                        Output findings as JSON
+  --fail-on <severity>          Exit non-zero if any finding >= severity
+                                (critical|high|medium|low|off; default: high)
+  --no-secrets                  Skip secret detection
+  -h, --help                    Show this help
+  -v, --version                 Show version
+
+Examples
+  safeey scan ./
+  safeey scan ./src --fail-on critical
+  safeey login sk_safeey_xxx && safeey scan . --sync
+`;
+
+function parseArgs(argv) {
+  const args = { _: [], failOn: "high", json: false, secrets: true, sync: false };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--json") args.json = true;
+    else if (a === "--sync") args.sync = true;
+    else if (a === "--no-secrets") args.secrets = false;
+    else if (a === "--fail-on") args.failOn = (argv[++i] || "high").toLowerCase();
+    else if (a === "-h" || a === "--help") args.help = true;
+    else if (a === "-v" || a === "--version") args.version = true;
+    else args._.push(a);
+  }
+  return args;
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  if (args.version) { console.log(pkg.version); return; }
+  if (args.help || args._[0] === "help") { console.log(HELP); return; }
+
+  const command = args._[0];
+
+  if (command === "login") {
+    const key = args._[1];
+    if (!key) { console.error("Usage: safeey login <api-key>"); process.exit(2); }
+    setConfig({ apiKey: key });
+    console.log(`Saved. API key stored in ${CONFIG_PATH}`);
+    return;
+  }
+  if (command === "logout") {
+    setConfig({ apiKey: null });
+    console.log("Logged out. API key removed.");
+    return;
+  }
+
+  const target = (command === "scan" ? args._[1] : command) || ".";
+
+  let result;
+  try {
+    result = scan(target, { secrets: args.secrets });
+  } catch (e) {
+    console.error("Error:", e.message);
+    process.exit(2);
+  }
+
+  if (args.json) {
+    console.log(JSON.stringify({ target, ...result, SEV_ORDER: undefined }, null, 2));
+  } else {
+    printReport(result, target);
+  }
+
+  if (args.sync) {
+    const r = await syncResults(result, target);
+    if (r.ok) console.log(`  \u2191 Synced to your Safeey dashboard${r.url ? `: ${r.url}` : "."}\n`);
+    else console.log(`  \u26a0 Sync skipped: ${r.reason}\n`);
+  }
+
+  if (args.failOn !== "off") {
+    const threshold = SEV_ORDER[args.failOn] ?? SEV_ORDER.high;
+    const worst = Math.max(0, ...result.findings.map((f) => SEV_ORDER[f.severity] || 0));
+    if (worst >= threshold) process.exit(1);
+  }
+  process.exit(0);
+}
+
+main();

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "safeey-cli",
+  "version": "0.1.0",
+  "description": "Scan your source code for security vulnerabilities — a Safeey product by Noohra Innovate Ltd.",
+  "bin": {
+    "safeey": "./bin/safeey.js"
+  },
+  "files": [
+    "bin",
+    "src",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "security",
+    "sast",
+    "static-analysis",
+    "vulnerability",
+    "scanner",
+    "safeey"
+  ],
+  "author": "Noohra Innovate Ltd.",
+  "license": "MIT",
+  "dependencies": {
+    "@babel/parser": "7.25.6",
+    "@babel/traverse": "7.25.6"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/davolu/safeey-cli.git"
+  },
+  "homepage": "https://safeey.io",
+  "bugs": {
+    "url": "https://github.com/davolu/safeey-cli/issues"
+  },
+  "scripts": {
+    "test": "node bin/safeey.js scan ./test-fixtures --fail-on off",
+    "prepublishOnly": "node -e \"require('./src/scan')\""
+  }
+}

package/src/config.js

@@ -0,0 +1,34 @@
+// src/config.js — local CLI config (~/.safeey/config.json).
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+
+const DIR = path.join(os.homedir(), ".safeey");
+const FILE = path.join(DIR, "config.json");
+const DEFAULT_API_URL = "https://safeey.io";
+
+function read() {
+  try { return JSON.parse(fs.readFileSync(FILE, "utf8")); } catch { return {}; }
+}
+
+function getConfig() {
+  const file = read();
+  return {
+    apiKey: process.env.SAFEEY_API_KEY || file.apiKey || null,
+    apiUrl: process.env.SAFEEY_API_URL || file.apiUrl || DEFAULT_API_URL,
+  };
+}
+
+function setConfig(patch) {
+  const cur = read();
+  const next = { ...cur, ...patch };
+  try {
+    fs.mkdirSync(DIR, { recursive: true });
+    fs.writeFileSync(FILE, JSON.stringify(next, null, 2), { mode: 0o600 });
+  } catch (e) {
+    throw new Error(`Could not write config at ${FILE}: ${e.message}`);
+  }
+  return next;
+}
+
+module.exports = { getConfig, setConfig, CONFIG_PATH: FILE };

package/src/engine/deps.js

@@ -0,0 +1,65 @@
+// src/engine/deps.js — dependency checks from package.json.
+//
+// Two layers:
+//   1. Hygiene: unpinned / wildcard version ranges (supply-chain risk).
+//   2. Known-bad: a small bundled advisory list for demonstration.
+// A production build would additionally query the OSV.dev batch API for full
+// CVE coverage — see queryOsv() below (network call, disabled by default here).
+
+// Tiny illustrative advisory list. Real coverage comes from OSV (see below).
+const KNOWN_BAD = {
+  "event-stream": { range: "3.3.6", note: "Compromised release (malicious code injected in 2018)." },
+  "flatmap-stream": { range: "*", note: "Malicious package used in the event-stream incident." },
+  "request": { range: "*", note: "Deprecated and unmaintained; known issues, no security fixes." },
+  "lodash": { range: "<4.17.21", note: "Prototype-pollution vulnerabilities in older versions." },
+  "minimist": { range: "<1.2.6", note: "Prototype-pollution vulnerability (CVE-2021-44906)." },
+};
+
+function analyzeDeps(pkgJsonText, file) {
+  const findings = [];
+  let pkg;
+  try { pkg = JSON.parse(pkgJsonText); } catch { return findings; }
+
+  const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
+  for (const [name, range] of Object.entries(deps)) {
+    const ver = String(range);
+
+    if (KNOWN_BAD[name]) {
+      findings.push({
+        ruleId: "deps/known-vulnerable",
+        title: `Known-vulnerable dependency: ${name}`,
+        severity: "high",
+        file,
+        line: 0,
+        column: 0,
+        message: `${name}@${ver} — ${KNOWN_BAD[name].note}`,
+        fix: `Update ${name} to a patched version, or replace it if unmaintained. Run your package manager's audit for details.`,
+      });
+      continue;
+    }
+
+    if (ver === "*" || ver === "latest" || ver === "" || /^>=?\s*0/.test(ver)) {
+      findings.push({
+        ruleId: "deps/unpinned-range",
+        title: `Unpinned dependency version: ${name}`,
+        severity: "low",
+        file,
+        line: 0,
+        column: 0,
+        message: `${name} is pinned to "${ver}", which can pull in unexpected (possibly malicious) versions.`,
+        fix: `Pin ${name} to a specific caret/tilde range and commit a lockfile.`,
+      });
+    }
+  }
+  return findings;
+}
+
+// Optional: full vulnerability coverage via OSV.dev. Enable in the CLI with a
+// flag once you're comfortable making a network call. Left un-wired by default.
+async function queryOsv(deps, ecosystem = "npm") {
+  const body = { queries: Object.entries(deps).map(([name, version]) => ({ package: { name, ecosystem }, version: String(version).replace(/^[^\d]*/, "") })) };
+  const res = await fetch("https://api.osv.dev/v1/querybatch", { method: "POST", body: JSON.stringify(body) });
+  return res.json();
+}
+
+module.exports = { analyzeDeps, queryOsv };

package/src/engine/js.js

@@ -0,0 +1,51 @@
+// src/engine/js.js — parse a JS/TS file and run the AST rules against it.
+const { parse } = require("@babel/parser");
+const traverseModule = require("@babel/traverse");
+const traverse = traverseModule.default || traverseModule;
+const { RULES } = require("../rules/js-rules");
+
+// Index rules by the node types they care about, so we only run relevant ones.
+const BY_TYPE = {};
+for (const rule of RULES) {
+  for (const t of rule.nodeTypes) (BY_TYPE[t] ||= []).push(rule);
+}
+
+const PLUGINS = ["jsx", "typescript", "decorators-legacy", "classProperties", "optionalChaining", "nullishCoalescingOperator", "topLevelAwait"];
+
+function analyzeJs(code, file) {
+  const findings = [];
+  let ast;
+  try {
+    ast = parse(code, { sourceType: "unambiguous", errorRecovery: true, plugins: PLUGINS });
+  } catch {
+    return findings; // unparseable file — skip rather than crash the whole scan
+  }
+
+  const visitor = {};
+  for (const type of Object.keys(BY_TYPE)) {
+    visitor[type] = (path) => {
+      for (const rule of BY_TYPE[type]) {
+        let hit = false;
+        try { hit = rule.test(path.node); } catch { hit = false; }
+        if (hit) {
+          const loc = path.node.loc && path.node.loc.start;
+          findings.push({
+            ruleId: rule.id,
+            title: rule.title,
+            severity: rule.severity,
+            file,
+            line: loc ? loc.line : 0,
+            column: loc ? loc.column + 1 : 0,
+            message: rule.message,
+            fix: rule.fix,
+          });
+        }
+      }
+    };
+  }
+
+  try { traverse(ast, visitor); } catch { /* partial results are fine */ }
+  return findings;
+}
+
+module.exports = { analyzeJs };

package/src/engine/secrets.js

@@ -0,0 +1,57 @@
+// src/engine/secrets.js — regex-based secret detection, language-agnostic.
+
+const SECRET_RULES = [
+  { id: "secret/aws-access-key", title: "AWS access key ID", severity: "high", re: /\bAKIA[0-9A-Z]{16}\b/ },
+  { id: "secret/aws-secret", title: "AWS secret access key", severity: "critical", re: /aws.{0,20}['"][0-9a-zA-Z/+]{40}['"]/i },
+  { id: "secret/private-key", title: "Private key", severity: "critical", re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/ },
+  { id: "secret/stripe-live", title: "Stripe live secret key", severity: "critical", re: /\bsk_live_[0-9a-zA-Z]{20,}\b/ },
+  { id: "secret/stripe-test", title: "Stripe test secret key", severity: "medium", re: /\bsk_test_[0-9a-zA-Z]{20,}\b/ },
+  { id: "secret/google-api", title: "Google API key", severity: "high", re: /\bAIza[0-9A-Za-z_\-]{35}\b/ },
+  { id: "secret/github-token", title: "GitHub token", severity: "high", re: /\bgh[pousr]_[0-9A-Za-z]{36,}\b/ },
+  { id: "secret/slack-token", title: "Slack token", severity: "high", re: /\bxox[baprs]-[0-9A-Za-z-]{10,}\b/ },
+  { id: "secret/openai", title: "OpenAI API key", severity: "high", re: /\bsk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}\b/ },
+  { id: "secret/jwt", title: "Hardcoded JWT", severity: "medium", re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/ },
+  {
+    id: "secret/generic-assignment",
+    title: "Hardcoded credential",
+    severity: "high",
+    re: /(?:api[_-]?key|secret|passwd|password|token|client[_-]?secret|access[_-]?token|private[_-]?key)\s*[:=]\s*['"][A-Za-z0-9_\-./+=]{12,}['"]/i,
+  },
+];
+
+// Lines we shouldn't flag: obvious placeholders and env-var references.
+const IGNORE = /(process\.env|import\.meta\.env|example|placeholder|your[_-]?(key|token|secret)|xxxx|<[^>]+>|\$\{)/i;
+
+function mask(s) {
+  const t = s.replace(/['"]/g, "");
+  if (t.length <= 10) return t.slice(0, 3) + "****";
+  return t.slice(0, 4) + "…" + t.slice(-3);
+}
+
+function analyzeSecrets(code, file) {
+  const findings = [];
+  const lines = code.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.length > 500) continue;
+    for (const rule of SECRET_RULES) {
+      const m = rule.re.exec(line);
+      if (!m) continue;
+      if (IGNORE.test(line) && rule.id === "secret/generic-assignment") continue;
+      findings.push({
+        ruleId: rule.id,
+        title: rule.title,
+        severity: rule.severity,
+        file,
+        line: i + 1,
+        column: (m.index ?? 0) + 1,
+        message: `A ${rule.title.toLowerCase()} appears to be hardcoded in source (${mask(m[0])}). Anything committed to code is effectively public.`,
+        fix: "Move the value to an environment variable or secret manager, remove it from the code and git history, and rotate the credential.",
+      });
+      break; // one secret finding per line is enough
+    }
+  }
+  return findings;
+}
+
+module.exports = { analyzeSecrets };

package/src/report.js

@@ -0,0 +1,52 @@
+// src/report.js — pretty terminal output (and JSON).
+const useColor = process.stdout.isTTY && !process.env.NO_COLOR;
+const c = (code) => (s) => (useColor ? `\x1b[${code}m${s}\x1b[0m` : String(s));
+const bold = c("1"), dim = c("2"), red = c("31"), yellow = c("33"), blue = c("34"), green = c("32"), magenta = c("35"), cyan = c("36");
+
+const SEV_STYLE = {
+  critical: (s) => c("41;97")(` ${s} `),
+  high: red, medium: yellow, low: blue, info: dim,
+};
+const GRADE_STYLE = { A: green, B: cyan, C: yellow, D: magenta, F: red };
+
+function printReport({ findings, filesScanned, grade }, target) {
+  const g = grade;
+  console.log("");
+  console.log(bold(`  Safeey CLI`) + dim(`  ·  scanned ${filesScanned} file(s) in ${target}`));
+  console.log("");
+
+  if (findings.length === 0) {
+    console.log("  " + green("✔ No issues found.") + dim("  (Grade A)"));
+    console.log("");
+    return;
+  }
+
+  let currentFile = "";
+  for (const f of findings) {
+    if (f.file !== currentFile) {
+      currentFile = f.file;
+      console.log("  " + bold(underlineSafe(currentFile)));
+    }
+    const sev = (SEV_STYLE[f.severity] || dim)(f.severity.toUpperCase());
+    const loc = f.line ? dim(`:${f.line}:${f.column}`) : "";
+    console.log(`    ${sev} ${f.title}${loc}  ${dim(f.ruleId)}`);
+    console.log(`      ${f.message}`);
+    console.log(`      ${green("fix")} ${dim(f.fix)}`);
+    console.log("");
+  }
+
+  const { counts } = g;
+  const parts = [];
+  if (counts.critical) parts.push(red(`${counts.critical} critical`));
+  if (counts.high) parts.push(red(`${counts.high} high`));
+  if (counts.medium) parts.push(yellow(`${counts.medium} medium`));
+  if (counts.low) parts.push(blue(`${counts.low} low`));
+
+  console.log("  " + dim("─".repeat(48)));
+  console.log(`  ${bold("Risk grade")} ${(GRADE_STYLE[g.letter] || dim)(bold(g.letter))} ${dim(`(${g.score}/100)`)}   ${parts.join(dim("  ·  "))}`);
+  console.log("");
+}
+
+function underlineSafe(s) { return useColor ? `\x1b[4m${s}\x1b[24m` : s; }
+
+module.exports = { printReport };

package/src/rules/helpers.js

@@ -0,0 +1,59 @@
+// src/rules/helpers.js — small AST helpers shared by the rules.
+
+function memberName(node) {
+  if (!node) return null;
+  if (node.type === "Identifier") return node.name;
+  if (node.type === "ThisExpression") return "this";
+  if (node.type === "MemberExpression") {
+    const obj = memberName(node.object);
+    const prop = node.computed ? null : node.property && node.property.name;
+    return obj && prop ? `${obj}.${prop}` : prop || null;
+  }
+  return null;
+}
+
+function calleeName(call) {
+  return call && call.callee ? memberName(call.callee) : null;
+}
+
+// A value node is "dynamic" if it isn't a plain literal — i.e. it can carry
+// user-controlled data. Interpolated template strings and concatenations count.
+function isDynamic(node) {
+  if (!node) return false;
+  switch (node.type) {
+    case "StringLiteral":
+    case "NumericLiteral":
+    case "BooleanLiteral":
+    case "NullLiteral":
+      return false;
+    case "TemplateLiteral":
+      return node.expressions.length > 0;
+    default:
+      return true;
+  }
+}
+
+// True when the value is built by string interpolation/concatenation (the
+// classic injection shape), as opposed to just being some variable.
+function isStringBuilt(node) {
+  if (!node) return false;
+  if (node.type === "TemplateLiteral") return node.expressions.length > 0;
+  if (node.type === "BinaryExpression" && node.operator === "+") return true;
+  return false;
+}
+
+function containsIdentifier(node, re, depth = 0) {
+  if (!node || typeof node !== "object" || depth > 40) return false;
+  if (node.type === "Identifier" && re.test(node.name)) return true;
+  for (const key of Object.keys(node)) {
+    if (key === "loc" || key === "start" || key === "end" || key === "leadingComments" || key === "trailingComments") continue;
+    const v = node[key];
+    if (Array.isArray(v)) { for (const c of v) if (containsIdentifier(c, re, depth + 1)) return true; }
+    else if (v && typeof v.type === "string") { if (containsIdentifier(v, re, depth + 1)) return true; }
+  }
+  return false;
+}
+
+const USER_INPUT = /^(req|request|query|params|body|args|argv|input|userInput|ctx)$/;
+
+module.exports = { memberName, calleeName, isDynamic, isStringBuilt, containsIdentifier, USER_INPUT };

package/src/rules/js-rules.js

@@ -0,0 +1,151 @@
+// src/rules/js-rules.js
+// Data-driven AST rules for JS/TS. Each rule declares the node types it cares
+// about and a test() that returns true when the node is a violation. The engine
+// traverses the file once and runs the matching rules.
+
+const { memberName, calleeName, isDynamic, isStringBuilt, containsIdentifier, USER_INPUT } = require("./helpers");
+
+const RULES = [
+  {
+    id: "js/eval-dynamic",
+    title: "Dynamic code execution via eval()",
+    severity: "critical",
+    nodeTypes: ["CallExpression"],
+    test: (n) => n.callee.type === "Identifier" && n.callee.name === "eval" && isDynamic(n.arguments[0]),
+    message: "eval() is called with a non-literal argument. If any part of it is user-controlled, an attacker can run arbitrary code.",
+    fix: "Remove eval(). Parse data with JSON.parse, use a lookup table, or call the intended function directly.",
+  },
+  {
+    id: "js/function-constructor",
+    title: "Dynamic code execution via Function constructor",
+    severity: "high",
+    nodeTypes: ["NewExpression", "CallExpression"],
+    test: (n) => n.callee.type === "Identifier" && n.callee.name === "Function" && n.arguments.length > 0,
+    message: "The Function constructor compiles a string into code at runtime — the same risk as eval().",
+    fix: "Avoid building functions from strings. Use a normal function or a safe, explicit dispatch.",
+  },
+  {
+    id: "js/command-injection",
+    title: "Possible command injection",
+    severity: "critical",
+    nodeTypes: ["CallExpression"],
+    test: (n) => {
+      const name = calleeName(n) || "";
+      const isExec = /(^|\.)(exec|execSync)$/.test(name);
+      return isExec && (isStringBuilt(n.arguments[0]) || (n.arguments[0] && n.arguments[0].type === "Identifier"));
+    },
+    message: "A shell command is built from dynamic input and passed to exec(). User input in a shell string allows command injection.",
+    fix: "Use execFile()/spawn() with an argument array (no shell), and never concatenate user input into the command.",
+  },
+  {
+    id: "js/sql-injection",
+    title: "Possible SQL injection",
+    severity: "high",
+    nodeTypes: ["CallExpression"],
+    test: (n) => {
+      const prop = n.callee.type === "MemberExpression" && !n.callee.computed && n.callee.property.name;
+      const isQuery = ["query", "execute", "raw", "prepare"].includes(prop);
+      return isQuery && isStringBuilt(n.arguments[0]);
+    },
+    message: "A SQL query is assembled by string interpolation/concatenation. Injected input can change the query's meaning.",
+    fix: "Use parameterised queries (placeholders + a values array), or your ORM's safe query builder. Never interpolate input into SQL.",
+  },
+  {
+    id: "js/innerhtml",
+    title: "Possible XSS via innerHTML",
+    severity: "high",
+    nodeTypes: ["AssignmentExpression"],
+    test: (n) =>
+      n.left.type === "MemberExpression" &&
+      !n.left.computed &&
+      ["innerHTML", "outerHTML"].includes(n.left.property.name) &&
+      isDynamic(n.right),
+    message: "Assigning dynamic content to innerHTML/outerHTML lets injected markup execute as script (XSS).",
+    fix: "Use textContent for text, or sanitise HTML with a library like DOMPurify before inserting it.",
+  },
+  {
+    id: "js/react-dangerous-html",
+    title: "Possible XSS via dangerouslySetInnerHTML",
+    severity: "high",
+    nodeTypes: ["JSXAttribute"],
+    test: (n) => n.name && n.name.name === "dangerouslySetInnerHTML",
+    message: "dangerouslySetInnerHTML bypasses React's built-in escaping. If the HTML contains user input, it's an XSS vector.",
+    fix: "Avoid it where possible. If you must render HTML, sanitise it first (e.g. DOMPurify).",
+  },
+  {
+    id: "js/weak-hash",
+    title: "Weak hashing algorithm",
+    severity: "medium",
+    nodeTypes: ["CallExpression"],
+    test: (n) => {
+      const name = calleeName(n) || "";
+      const a = n.arguments[0];
+      return /(^|\.)createHash$/.test(name) && a && a.type === "StringLiteral" && /^(md5|sha1)$/i.test(a.value);
+    },
+    message: "MD5 and SHA-1 are broken for security use (collisions, fast to brute-force).",
+    fix: "Use SHA-256+ for hashing, and a dedicated password hash (bcrypt, scrypt, or Argon2) for passwords.",
+  },
+  {
+    id: "js/tls-verification-disabled",
+    title: "TLS certificate validation disabled",
+    severity: "high",
+    nodeTypes: ["ObjectProperty"],
+    test: (n) =>
+      n.key && (n.key.name === "rejectUnauthorized" || n.key.value === "rejectUnauthorized") &&
+      n.value && n.value.type === "BooleanLiteral" && n.value.value === false,
+    message: "rejectUnauthorized: false turns off TLS certificate checks, exposing the connection to man-in-the-middle attacks.",
+    fix: "Remove this and use valid certificates. If testing locally, trust a local CA instead of disabling verification.",
+  },
+  {
+    id: "js/settimeout-string",
+    title: "String argument to setTimeout/setInterval",
+    severity: "medium",
+    nodeTypes: ["CallExpression"],
+    test: (n) => {
+      const name = n.callee.type === "Identifier" ? n.callee.name : null;
+      const a = n.arguments[0];
+      return ["setTimeout", "setInterval"].includes(name) && a && (a.type === "StringLiteral" || a.type === "TemplateLiteral");
+    },
+    message: "Passing a string to setTimeout/setInterval evaluates it like eval().",
+    fix: "Pass a function reference or arrow function instead of a string.",
+  },
+  {
+    id: "js/open-redirect",
+    title: "Possible open redirect",
+    severity: "medium",
+    nodeTypes: ["CallExpression"],
+    test: (n) => {
+      const name = calleeName(n) || "";
+      return /(^|\.)redirect$/.test(name) && n.arguments[0] && containsIdentifier(n.arguments[0], USER_INPUT);
+    },
+    message: "A redirect target is derived from user input. Attackers can redirect your users to phishing sites via your trusted domain.",
+    fix: "Redirect only to a fixed allow-list of paths, or map an identifier to a known URL server-side.",
+  },
+  {
+    id: "js/hardcoded-secret-fallback",
+    title: "Hardcoded secret fallback",
+    severity: "medium",
+    nodeTypes: ["LogicalExpression"],
+    test: (n) => {
+      if (n.operator !== "||") return false;
+      const left = memberName(n.left) || "";
+      const right = n.right;
+      return /process\.env\./.test(left) && right && right.type === "StringLiteral" && right.value.length >= 8;
+    },
+    message: "A secret falls back to a hardcoded literal when the env var is missing. That literal ships in your code.",
+    fix: "Fail loudly if the env var is missing instead of falling back to a real secret value.",
+  },
+  {
+    id: "js/permissive-cors",
+    title: "Permissive CORS (origin: '*')",
+    severity: "medium",
+    nodeTypes: ["ObjectProperty"],
+    test: (n) =>
+      n.key && (n.key.name === "origin" || n.key.value === "origin") &&
+      n.value && n.value.type === "StringLiteral" && n.value.value === "*",
+    message: "origin: '*' lets any website read responses from this API. On authenticated endpoints, that leaks user data.",
+    fix: "Allow-list specific trusted origins instead of using a wildcard, especially for endpoints that use credentials.",
+  },
+];
+
+module.exports = { RULES };

package/src/scan.js

@@ -0,0 +1,75 @@
+// src/scan.js — walk a directory, run the analyzers, grade the result.
+const fs = require("fs");
+const path = require("path");
+const { analyzeJs } = require("./engine/js");
+const { analyzeSecrets } = require("./engine/secrets");
+const { analyzeDeps } = require("./engine/deps");
+
+const IGNORE_DIRS = new Set(["node_modules", ".git", "dist", "build", ".next", "out", "vendor", "coverage", ".turbo", ".cache"]);
+const JS_EXT = new Set([".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs"]);
+const TEXT_EXT = new Set([".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".json", ".env", ".yml", ".yaml", ".py", ".rb", ".go", ".php", ".java", ".txt", ".sh", ".config"]);
+const MAX_FILE_BYTES = 1_500_000;
+
+const SEV_WEIGHT = { critical: 25, high: 12, medium: 5, low: 1, info: 0 };
+const SEV_ORDER = { critical: 4, high: 3, medium: 2, low: 1, info: 0 };
+
+function walk(dir, files = []) {
+  let entries = [];
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return files; }
+  for (const e of entries) {
+    if (e.name.startsWith(".") && e.name !== ".env") { if (e.isDirectory()) continue; }
+    const full = path.join(dir, e.name);
+    if (e.isDirectory()) { if (!IGNORE_DIRS.has(e.name)) walk(full, files); }
+    else files.push(full);
+  }
+  return files;
+}
+
+function grade(findings) {
+  const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+  let penalty = 0;
+  for (const f of findings) { counts[f.severity] = (counts[f.severity] || 0) + 1; penalty += SEV_WEIGHT[f.severity] || 0; }
+  const score = Math.max(0, 100 - penalty);
+  const letter = score >= 90 ? "A" : score >= 80 ? "B" : score >= 70 ? "C" : score >= 55 ? "D" : "F";
+  return { score, letter, counts };
+}
+
+function scan(target, opts = {}) {
+  const root = path.resolve(target);
+  const stat = fs.existsSync(root) && fs.statSync(root);
+  if (!stat) throw new Error(`Path not found: ${root}`);
+
+  const files = stat.isDirectory() ? walk(root) : [root];
+  const findings = [];
+  let scanned = 0;
+
+  for (const file of files) {
+    const ext = path.extname(file).toLowerCase();
+    const base = path.basename(file);
+    let size = 0;
+    try { size = fs.statSync(file).size; } catch { continue; }
+    if (size > MAX_FILE_BYTES) continue;
+    if (!TEXT_EXT.has(ext) && base !== "package.json" && base !== ".env") continue;
+
+    let code = "";
+    try { code = fs.readFileSync(file, "utf8"); } catch { continue; }
+    scanned++;
+    const rel = path.relative(root, file) || base;
+
+    if (JS_EXT.has(ext)) for (const f of analyzeJs(code, rel)) findings.push(f);
+    if (base === "package.json") for (const f of analyzeDeps(code, rel)) findings.push(f);
+    if (opts.secrets !== false) for (const f of analyzeSecrets(code, rel)) findings.push(f);
+  }
+
+  // De-duplicate identical findings (same rule at the same spot).
+  const seen = new Set();
+  const unique = findings.filter((f) => { const k = `${f.ruleId}|${f.file}|${f.line}|${f.column}`; if (seen.has(k)) return false; seen.add(k); return true; });
+  findings.length = 0; findings.push(...unique);
+
+  // Sort worst-first, then by file/line.
+  findings.sort((a, b) => (SEV_ORDER[b.severity] - SEV_ORDER[a.severity]) || a.file.localeCompare(b.file) || a.line - b.line);
+
+  return { findings, filesScanned: scanned, filesTotal: files.length, grade: grade(findings), SEV_ORDER };
+}
+
+module.exports = { scan, grade, SEV_ORDER };

package/src/sync.js

@@ -0,0 +1,55 @@
+// src/sync.js — push scan *results* (never source code) to the Safeey dashboard.
+const fs = require("fs");
+const path = require("path");
+const { getConfig } = require("./config");
+
+function projectName(target) {
+  const root = path.resolve(target);
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
+    if (pkg.name) return pkg.name;
+  } catch { /* no package.json */ }
+  return path.basename(root) || "project";
+}
+
+// We deliberately send only metadata: rule id, severity, file path, line —
+// enough to show the report in the dashboard. No source code ever leaves the machine.
+async function syncResults(result, target) {
+  const { apiKey, apiUrl } = getConfig();
+  if (!apiKey) {
+    return { ok: false, reason: "Not logged in. Run `safeey login <api-key>` first (get a key from your Safeey dashboard)." };
+  }
+
+  const payload = {
+    project: projectName(target),
+    grade: result.grade.letter,
+    score: result.grade.score,
+    counts: result.grade.counts,
+    filesScanned: result.filesScanned,
+    findings: result.findings.map((f) => ({
+      ruleId: f.ruleId,
+      title: f.title,
+      severity: f.severity,
+      file: f.file,
+      line: f.line,
+      column: f.column,
+    })),
+    cliVersion: require("../package.json").version,
+  };
+
+  try {
+    const res = await fetch(`${apiUrl}/api/cli/ingest`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
+      body: JSON.stringify(payload),
+    });
+    if (res.status === 401) return { ok: false, reason: "Invalid or expired API key. Run `safeey login <api-key>` again." };
+    if (!res.ok) return { ok: false, reason: `Sync failed (HTTP ${res.status}).` };
+    const data = await res.json().catch(() => ({}));
+    return { ok: true, url: data.url };
+  } catch (e) {
+    return { ok: false, reason: `Could not reach ${apiUrl}: ${e.message}` };
+  }
+}
+
+module.exports = { syncResults };