safeey-cli 0.2.1 → 0.6.1

package/src/report-sarif.js

@@ -0,0 +1,67 @@
+// src/report-sarif.js — emit findings as SARIF 2.1.0.
+// SARIF is the format GitHub code scanning ingests, so `safeey scan . --sarif`
+// can be uploaded in CI and findings appear inline on PRs in the Security tab.
+
+const pkg = require("../package.json");
+
+const LEVEL = { critical: "error", high: "error", medium: "warning", low: "note", info: "note" };
+
+function toSarif(result, target) {
+  // One rule descriptor per distinct ruleId that actually fired.
+  const ruleIndex = new Map();
+  const rules = [];
+  for (const f of result.findings) {
+    if (ruleIndex.has(f.ruleId)) continue;
+    ruleIndex.set(f.ruleId, rules.length);
+    rules.push({
+      id: f.ruleId,
+      name: f.ruleId,
+      shortDescription: { text: f.title || f.ruleId },
+      fullDescription: { text: f.message || f.title || f.ruleId },
+      defaultConfiguration: { level: LEVEL[f.severity] || "warning" },
+      properties: {
+        security_severity: f.severity,
+        tags: ["security", f.category].filter(Boolean),
+        ...(f.cwe ? { cwe: f.cwe } : {}),
+      },
+      ...(f.fix ? { help: { text: f.fix } } : {}),
+    });
+  }
+
+  const results = result.findings.map((f) => ({
+    ruleId: f.ruleId,
+    ruleIndex: ruleIndex.get(f.ruleId),
+    level: LEVEL[f.severity] || "warning",
+    message: { text: f.message || f.title || f.ruleId },
+    locations: [{
+      physicalLocation: {
+        artifactLocation: { uri: uri(f.file) },
+        region: { startLine: Math.max(1, f.line || 1), ...(f.column ? { startColumn: f.column } : {}) },
+      },
+    }],
+    properties: { severity: f.severity, confidence: f.confidence, category: f.category },
+  }));
+
+  return JSON.stringify({
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    version: "2.1.0",
+    runs: [{
+      tool: {
+        driver: {
+          name: "safeey-cli",
+          informationUri: "https://safeey.io",
+          version: pkg.version,
+          rules,
+        },
+      },
+      results,
+      properties: { target, filesScanned: result.filesScanned, grade: result.grade },
+    }],
+  }, null, 2);
+}
+
+function uri(p) {
+  return String(p).replace(/\\/g, "/");
+}
+
+module.exports = { toSarif };

package/src/rules/framework.js

@@ -0,0 +1,102 @@
+// src/rules/framework.js — framework-aware pattern rules.
+// Most real-world vulnerabilities live at framework boundaries, so these target
+// the specific misuse shapes of popular frameworks. Same line-based format as
+// patterns.js; loaded alongside it by the pattern engine.
+
+const FRAMEWORK_RULES = [
+  // ---- Express / Node ----------------------------------------------------
+  {
+    id: "express/cors-wildcard-credentials", title: "CORS allows any origin with credentials",
+    severity: "high", confidence: "medium", category: "auth", cwe: "CWE-942",
+    languages: ["js", "ts"], re: /origin\s*:\s*(?:true|['"]\*['"])[^}]*credentials\s*:\s*true|credentials\s*:\s*true[^}]*origin\s*:\s*(?:true|['"]\*['"])/,
+    message: "Reflecting any origin while allowing credentials lets any site make authenticated requests on the user's behalf.",
+    fix: "Set an explicit allow-list of trusted origins when credentials:true; never combine credentials with origin '*' or true.",
+  },
+  {
+    id: "express/no-helmet", title: "Express app without security headers (helmet)",
+    severity: "info", confidence: "low", category: "config", cwe: "CWE-693",
+    languages: ["js", "ts"], re: /express\s*\(\s*\)/, unless: /helmet/,
+    message: "This looks like an Express app; without helmet() it ships no security response headers by default.",
+    fix: "Add `app.use(helmet())` to set sensible security headers (CSP, HSTS, X-Frame-Options, etc.).",
+  },
+  {
+    id: "express/body-no-limit", title: "Body parser without size limit",
+    severity: "low", confidence: "low", category: "dos", cwe: "CWE-400",
+    languages: ["js", "ts"], re: /express\.(?:json|urlencoded)\s*\(\s*(?:\)|\{\s*\})/,
+    message: "A body parser with no size limit lets a client send a huge payload and exhaust memory.",
+    fix: "Pass a limit, e.g. express.json({ limit: '100kb' }).",
+  },
+
+  // ---- Next.js -----------------------------------------------------------
+  {
+    id: "next/dangerous-html", title: "dangerouslySetInnerHTML with dynamic value",
+    severity: "high", confidence: "low", category: "xss", cwe: "CWE-79",
+    languages: ["js", "ts"], re: /dangerouslySetInnerHTML\s*=\s*\{\{\s*__html\s*:\s*(?!['"`])/,
+    message: "dangerouslySetInnerHTML with a non-literal value renders unescaped HTML — an XSS sink if the value is user-influenced.",
+    fix: "Render text as children, or sanitise the HTML (e.g. DOMPurify) before passing it to __html.",
+  },
+  {
+    id: "next/public-env-secret", title: "Secret-looking value in NEXT_PUBLIC_ env",
+    severity: "high", confidence: "low", category: "secrets", cwe: "CWE-200",
+    languages: ["js", "ts"], re: /NEXT_PUBLIC_[A-Z0-9_]*(SECRET|KEY|TOKEN|PASSWORD|PRIVATE)/,
+    message: "NEXT_PUBLIC_ variables are inlined into the client bundle; a secret named here is shipped to every browser.",
+    fix: "Keep secrets in server-only env vars (without the NEXT_PUBLIC_ prefix) and access them only in server code.",
+  },
+
+  // ---- Django ------------------------------------------------------------
+  {
+    id: "django/mark-safe", title: "Django mark_safe() on dynamic content",
+    severity: "high", confidence: "low", category: "xss", cwe: "CWE-79",
+    languages: ["py"], re: /mark_safe\s*\(\s*(?!['"])/,
+    message: "mark_safe() disables autoescaping; on user-influenced content it produces XSS.",
+    fix: "Avoid mark_safe on dynamic data; use format_html() with escaped args, or sanitise first.",
+  },
+  {
+    id: "django/raw-sql", title: "Django raw()/extra() SQL",
+    severity: "high", confidence: "low", category: "injection", cwe: "CWE-89",
+    languages: ["py"], re: /\.(?:raw|extra)\s*\(\s*(?:f['"]|['"][^'"]*%|['"][^'"]*\{)/,
+    message: ".raw()/.extra() with a formatted string bypasses the ORM's parameterisation and risks SQL injection.",
+    fix: "Use parameterised queries: pass params separately (e.g. Model.objects.raw(sql, [params])), never f-strings.",
+  },
+  {
+    id: "django/debug-true", title: "Django DEBUG=True",
+    severity: "medium", confidence: "medium", category: "config", cwe: "CWE-489",
+    languages: ["py"], re: /^\s*DEBUG\s*=\s*True/m,
+    message: "DEBUG=True in Django exposes detailed error pages with settings and source to any visitor.",
+    fix: "Set DEBUG from an environment variable, defaulting to False in production.",
+  },
+  {
+    id: "django/allowed-hosts-wildcard", title: "ALLOWED_HOSTS = ['*']",
+    severity: "low", confidence: "medium", category: "config", cwe: "CWE-16",
+    languages: ["py"], re: /ALLOWED_HOSTS\s*=\s*\[\s*['"]\*['"]\s*\]/,
+    message: "ALLOWED_HOSTS=['*'] disables host-header validation, enabling host-header poisoning.",
+    fix: "List your real domains explicitly in ALLOWED_HOSTS.",
+  },
+
+  // ---- Flask -------------------------------------------------------------
+  {
+    id: "flask/render-template-string", title: "Flask render_template_string with dynamic input",
+    severity: "high", confidence: "low", category: "injection", cwe: "CWE-94",
+    languages: ["py"], re: /render_template_string\s*\(\s*(?:f['"]|[a-zA-Z_]\w*\s*\+|.*%\s*)/,
+    message: "Passing user input into render_template_string enables server-side template injection (SSTI) → RCE.",
+    fix: "Render a static template file and pass data as context variables; never build the template body from input.",
+  },
+
+  // ---- Spring / Java -----------------------------------------------------
+  {
+    id: "spring/permit-all", title: "Spring Security permitAll() on all requests",
+    severity: "medium", confidence: "low", category: "auth", cwe: "CWE-284",
+    languages: ["java"], re: /anyRequest\s*\(\s*\)\s*\.\s*permitAll\s*\(\s*\)/,
+    message: "permitAll() on anyRequest() leaves every endpoint unauthenticated.",
+    fix: "Require authentication by default (anyRequest().authenticated()) and open up only the specific public routes.",
+  },
+  {
+    id: "spring/csrf-disable", title: "Spring Security CSRF disabled",
+    severity: "medium", confidence: "low", category: "auth", cwe: "CWE-352",
+    languages: ["java"], re: /\.csrf\s*\([^)]*\)\s*\.\s*disable\s*\(\s*\)|csrf\s*\(\s*\)\.disable/,
+    message: "Disabling CSRF protection exposes cookie-authenticated, state-changing endpoints to cross-site request forgery.",
+    fix: "Keep CSRF protection on for browser/session-based flows; disable only for stateless token-authenticated APIs.",
+  },
+];
+
+module.exports = { FRAMEWORK_RULES };

package/src/rules/infra.js

@@ -0,0 +1,120 @@
+// src/rules/infra.js — infrastructure & CI misconfiguration rules.
+// Matched by file *kind* (docker/k8s/terraform/github-actions) rather than by
+// language, because a lot of modern incidents start in infra, not app code.
+// Each rule declares which kinds it applies to.
+
+const INFRA_RULES = [
+  // ---- Dockerfile --------------------------------------------------------
+  {
+    id: "docker/run-as-root", title: "Container runs as root",
+    kinds: ["dockerfile"], severity: "medium", confidence: "low", category: "config", cwe: "CWE-250",
+    re: /^\s*FROM\s/i, whole: true, absentRe: /^\s*USER\s+(?!root\b)/im,
+    message: "No non-root USER is set, so the container runs as root — a container escape then has root on the host namespace.",
+    fix: "Add a `USER` directive with an unprivileged user before the app runs.",
+  },
+  {
+    id: "docker/latest-tag", title: "Base image pinned to :latest",
+    kinds: ["dockerfile"], severity: "low", confidence: "medium", category: "supply-chain", cwe: "CWE-1104",
+    re: /^\s*FROM\s+\S+:latest\b/im,
+    message: "`:latest` makes builds non-reproducible and silently pulls in changed (possibly vulnerable) base images.",
+    fix: "Pin to a specific version tag or, better, a digest (FROM image@sha256:...).",
+  },
+  {
+    id: "docker/secret-in-env", title: "Secret baked into image via ENV/ARG",
+    kinds: ["dockerfile"], severity: "high", confidence: "low", category: "secrets", cwe: "CWE-798",
+    re: /^\s*(?:ENV|ARG)\s+\w*(SECRET|PASSWORD|TOKEN|API_?KEY|PRIVATE_?KEY)\w*\s*[=\s]\s*\S/im,
+    message: "Secrets set via ENV/ARG are baked into image layers and readable by anyone who pulls the image.",
+    fix: "Inject secrets at runtime (orchestrator secrets, --secret mounts) instead of build-time ENV/ARG.",
+  },
+  {
+    id: "docker/curl-pipe-sh", title: "Piping a remote script to a shell",
+    kinds: ["dockerfile"], severity: "medium", confidence: "medium", category: "supply-chain", cwe: "CWE-494",
+    re: /(?:curl|wget)\s[^|]*\|\s*(?:sudo\s+)?(?:sh|bash)/i,
+    message: "curl | sh executes unpinned remote code at build time with no integrity check — a supply-chain risk.",
+    fix: "Download to a file, verify a checksum/signature, then execute.",
+  },
+
+  // ---- Kubernetes --------------------------------------------------------
+  {
+    id: "k8s/privileged", title: "Privileged container",
+    kinds: ["k8s"], severity: "high", confidence: "medium", category: "config", cwe: "CWE-250",
+    re: /privileged\s*:\s*true/i,
+    message: "A privileged container has near-host root; a compromise there is effectively a node compromise.",
+    fix: "Remove privileged:true; grant only the specific capabilities the workload needs.",
+  },
+  {
+    id: "k8s/host-network", title: "Pod uses host network/PID namespace",
+    kinds: ["k8s"], severity: "medium", confidence: "medium", category: "config", cwe: "CWE-668",
+    re: /host(?:Network|PID|IPC)\s*:\s*true/i,
+    message: "Sharing the host network/PID/IPC namespace breaks pod isolation and exposes host resources.",
+    fix: "Avoid hostNetwork/hostPID/hostIPC unless strictly required; prefer proper Services.",
+  },
+  {
+    id: "k8s/allow-privilege-escalation", title: "allowPrivilegeEscalation not disabled",
+    kinds: ["k8s"], severity: "low", confidence: "low", category: "config", cwe: "CWE-250",
+    re: /allowPrivilegeEscalation\s*:\s*true/i,
+    message: "allowPrivilegeEscalation:true lets a process gain more privileges than its parent.",
+    fix: "Set allowPrivilegeEscalation:false in the container securityContext.",
+  },
+
+  // ---- Terraform ---------------------------------------------------------
+  {
+    id: "tf/open-security-group", title: "Security group open to the world",
+    kinds: ["terraform"], severity: "high", confidence: "medium", category: "config", cwe: "CWE-284",
+    re: /cidr_blocks\s*=\s*\[\s*['"]0\.0\.0\.0\/0['"]/,
+    message: "0.0.0.0/0 in a security group exposes the port to the entire internet.",
+    fix: "Restrict cidr_blocks to known IP ranges; never expose admin ports (22/3389/database) to 0.0.0.0/0.",
+  },
+  {
+    id: "tf/s3-public-acl", title: "S3 bucket with public ACL",
+    kinds: ["terraform"], severity: "high", confidence: "medium", category: "config", cwe: "CWE-732",
+    re: /acl\s*=\s*['"]public-read(?:-write)?['"]/,
+    message: "A public-read/-write ACL exposes bucket contents (or allows writes) to anyone.",
+    fix: "Use private ACLs and grant access via bucket policies/IAM; enable Block Public Access.",
+  },
+  {
+    id: "tf/unencrypted-storage", title: "Storage encryption disabled",
+    kinds: ["terraform"], severity: "medium", confidence: "low", category: "config", cwe: "CWE-311",
+    re: /(?:encrypted|storage_encrypted)\s*=\s*false/,
+    message: "Encryption at rest is explicitly disabled on a storage resource.",
+    fix: "Set encrypted/storage_encrypted = true (and specify a KMS key where applicable).",
+  },
+
+  // ---- GitHub Actions ----------------------------------------------------
+  {
+    id: "gha/script-injection", title: "Untrusted event data in a run: step",
+    kinds: ["github-actions"], severity: "high", confidence: "medium", category: "injection", cwe: "CWE-94",
+    re: /\$\{\{\s*github\.event\.(?:issue\.title|issue\.body|pull_request\.title|pull_request\.body|comment\.body|head_ref|head_commit\.message|review\.body)\s*\}\}/,
+    message: "Interpolating attacker-controllable github.event fields directly into a run: shell is a script-injection vector.",
+    fix: "Pass the value through an env: var and reference \"$VAR\" in the script, rather than inlining ${{ ... }} into the shell.",
+  },
+  {
+    id: "gha/pull-request-target", title: "pull_request_target with checkout of PR code",
+    kinds: ["github-actions"], severity: "high", confidence: "low", category: "supply-chain", cwe: "CWE-269",
+    re: /pull_request_target/,
+    message: "pull_request_target runs with repo secrets and write token; checking out untrusted PR code here can leak secrets.",
+    fix: "Avoid checking out and running untrusted PR code under pull_request_target; if you must, don't expose secrets to it.",
+  },
+  {
+    id: "gha/unpinned-action", title: "Action pinned to a mutable ref",
+    kinds: ["github-actions"], severity: "low", confidence: "low", category: "supply-chain", cwe: "CWE-1104",
+    re: /uses\s*:\s*[\w.-]+\/[\w.-]+@(?:main|master|v?\d+)\s*$/im,
+    message: "Pinning an action to a branch or major tag lets its code change under you; a compromised tag runs in your pipeline.",
+    fix: "Pin third-party actions to a full commit SHA.",
+  },
+];
+
+// Classify a file into an infra kind (or null). Uses path + a light content sniff.
+function classifyInfraFile(relPath, base, code) {
+  const p = relPath.replace(/\\/g, "/");
+  if (/^Dockerfile$|\.dockerfile$|^Dockerfile\./i.test(base)) return "dockerfile";
+  if (/\.tf$|\.tf\.json$/i.test(base)) return "terraform";
+  if (/\.github\/workflows\/.+\.ya?ml$/i.test(p)) return "github-actions";
+  if (/\.ya?ml$/i.test(base)) {
+    // crude k8s sniff: has both apiVersion and kind at column 0
+    if (/^apiVersion\s*:/m.test(code) && /^kind\s*:/m.test(code)) return "k8s";
+  }
+  return null;
+}
+
+module.exports = { INFRA_RULES, classifyInfraFile };

package/src/rules/js-rules.js

@@ -146,6 +146,120 @@ const RULES = [
     message: "origin: '*' lets any website read responses from this API. On authenticated endpoints, that leaks user data.",
     fix: "Allow-list specific trusted origins instead of using a wildcard, especially for endpoints that use credentials.",
   },
+
+  // ---- added in 0.3: more vulnerability classes --------------------------
+  {
+    id: "js/prototype-pollution",
+    title: "Possible prototype pollution",
+    severity: "high",
+    category: "deserialization",
+    cwe: "CWE-1321",
+    nodeTypes: ["AssignmentExpression"],
+    test: (n) => {
+      // Flag __proto__ anywhere in the target chain (near-zero false positives),
+      // or a direct reassignment of .constructor. We deliberately do NOT flag
+      // `X.prototype.method = ...`, which is normal, everyday code.
+      let node = n.left;
+      let depth = 0;
+      let finalProp = null;
+      while (node && node.type === "MemberExpression" && depth++ < 20) {
+        const prop = node.computed
+          ? (node.property.type === "StringLiteral" ? node.property.value : null)
+          : (node.property && node.property.name);
+        if (depth === 1) finalProp = prop;
+        if (prop === "__proto__") return true;
+        node = node.object;
+      }
+      return finalProp === "constructor";
+    },
+    message: "Writing to __proto__/prototype/constructor can pollute Object.prototype and affect every object in the process.",
+    fix: "Reject these keys when merging/assigning from external data; use a Map, Object.create(null), or a vetted deep-merge that guards prototype keys.",
+  },
+  {
+    id: "js/redos-literal",
+    title: "Regex vulnerable to catastrophic backtracking (ReDoS)",
+    severity: "medium",
+    category: "dos",
+    cwe: "CWE-1333",
+    nodeTypes: ["RegExpLiteral"],
+    test: (n) => typeof n.pattern === "string" && /(\([^)]*[+*][^)]*\)|\[[^\]]+\]|\.[*+]|\\w[*+]|[^\\]\)[*+])[+*]/.test(n.pattern) && /([+*].*){2,}/.test(n.pattern),
+    message: "This regex has nested/adjacent unbounded quantifiers, which can cause exponential backtracking on crafted input (a DoS).",
+    fix: "Rewrite to avoid nested quantifiers, add bounds, or use a linear-time engine (e.g. RE2).",
+  },
+  {
+    id: "js/regexp-from-input",
+    title: "RegExp built from dynamic input (ReDoS)",
+    severity: "medium",
+    category: "dos",
+    cwe: "CWE-1333",
+    nodeTypes: ["NewExpression", "CallExpression"],
+    test: (n) => n.callee.type === "Identifier" && n.callee.name === "RegExp" && n.arguments[0] && containsIdentifier(n.arguments[0], USER_INPUT),
+    message: "Building a RegExp from user input lets an attacker supply a pattern that backtracks catastrophically.",
+    fix: "Don't compile user input into a regex; if unavoidable, validate/escape it and enforce a length limit and timeout.",
+  },
+  {
+    id: "js/ssrf",
+    title: "Possible SSRF (server-side request to a dynamic URL)",
+    severity: "high",
+    category: "ssrf",
+    cwe: "CWE-918",
+    confidence: "low",
+    nodeTypes: ["CallExpression"],
+    test: (n) => {
+      const name = calleeName(n) || "";
+      const isReq = /(^|\.)(fetch|get|post|request|got)$/.test(name) || name === "fetch";
+      return isReq && n.arguments[0] && (isStringBuilt(n.arguments[0]) || containsIdentifier(n.arguments[0], USER_INPUT));
+    },
+    message: "A server-side HTTP request targets a URL built from input. An attacker can point it at internal services or cloud metadata.",
+    fix: "Validate the URL against an allow-list of hosts/schemes; block private/link-local ranges (e.g. 169.254.169.254).",
+  },
+  {
+    id: "js/nosql-injection",
+    title: "Possible NoSQL injection",
+    severity: "high",
+    category: "injection",
+    cwe: "CWE-943",
+    confidence: "low",
+    nodeTypes: ["CallExpression"],
+    test: (n) => {
+      const prop = n.callee.type === "MemberExpression" && !n.callee.computed && n.callee.property.name;
+      const isQuery = ["find", "findOne", "update", "updateOne", "updateMany", "deleteOne", "deleteMany", "remove", "findOneAndUpdate", "aggregate"].includes(prop);
+      return isQuery && n.arguments[0] && containsIdentifier(n.arguments[0], USER_INPUT);
+    },
+    message: "A query object is populated directly from request data. Operator objects (e.g. {$gt:''}, {$where}) let an attacker alter the query.",
+    fix: "Cast and validate expected fields to primitives before querying; reject object-valued fields where a scalar is expected.",
+  },
+  {
+    id: "js/open-redirect",
+    title: "Possible open redirect",
+    severity: "medium",
+    category: "auth",
+    cwe: "CWE-601",
+    confidence: "low",
+    nodeTypes: ["CallExpression"],
+    test: (n) => {
+      const name = calleeName(n) || "";
+      return /(^|\.)redirect$/.test(name) && n.arguments.length > 0 && containsIdentifier(n.arguments[n.arguments.length - 1], USER_INPUT);
+    },
+    message: "A redirect target is derived from user input, letting an attacker bounce victims to an arbitrary external site.",
+    fix: "Redirect only to allow-listed paths, or validate that the target is a relative path / same-origin URL.",
+  },
+  {
+    id: "js/non-constant-time-compare",
+    title: "Non-constant-time comparison of a secret",
+    severity: "low",
+    category: "crypto",
+    cwe: "CWE-208",
+    confidence: "low",
+    nodeTypes: ["BinaryExpression"],
+    test: (n) => {
+      if (!["===", "!==", "==", "!="].includes(n.operator)) return false;
+      const names = [memberName(n.left) || "", memberName(n.right) || ""];
+      return names.some((s) => /(secret|token|password|passwd|hmac|signature|api_?key|digest|mac)\b/i.test(s));
+    },
+    message: "Comparing a secret/token with ===/== leaks timing information that can enable a byte-by-byte guessing attack.",
+    fix: "Compare secrets with a constant-time function such as crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b)).",
+  },
 ];
 
 module.exports = { RULES };

package/src/scan.js

@@ -5,7 +5,12 @@ const { analyzeJs } = require("./engine/js");
 const { analyzeSecrets } = require("./engine/secrets");
 const { analyzeDeps } = require("./engine/deps");
 const { analyzePatterns } = require("./engine/patterns");
+const { analyzeTaint } = require("./engine/taint");
+const { analyzeInfra } = require("./engine/infra");
 const { makeIgnoreChecker } = require("./engine/gitignore");
+const { fileSuppressions, isSuppressed, loadPathIgnores } = require("./engine/suppress");
+const { analyzeDependenciesOSV } = require("./engine/osv");
+const { analyzeGitHistory } = require("./engine/githistory");
 
 // Any .env-style file. `.env.example` / `.env.sample` / `.env.template` / .dist
 // are meant to be committed and hold placeholders, so they're scanned normally
@@ -46,17 +51,27 @@ function envNotIgnoredFinding(rel, hasSecret, unknown) {
 
 const IGNORE_DIRS = new Set(["node_modules", ".git", "dist", "build", ".next", "out", "vendor", "coverage", ".turbo", ".cache"]);
 const JS_EXT = new Set([".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs"]);
-const TEXT_EXT = new Set([".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".json", ".env", ".yml", ".yaml", ".py", ".rb", ".go", ".php", ".java", ".txt", ".sh", ".config"]);
+const TEXT_EXT = new Set([".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".json", ".env", ".yml", ".yaml", ".py", ".rb", ".go", ".php", ".java", ".txt", ".sh", ".config", ".tf"]);
 const MAX_FILE_BYTES = 1_500_000;
+const CONF_RANK = { low: 1, medium: 2, high: 3 };
 
 const SEV_WEIGHT = { critical: 25, high: 12, medium: 5, low: 1, info: 0 };
 const SEV_ORDER = { critical: 4, high: 3, medium: 2, low: 1, info: 0 };
 
+// Files that should be scanned even without a known text extension.
+function isScannable(base, ext, envClass) {
+  if (TEXT_EXT.has(ext)) return true;
+  if (base === "package.json") return true;
+  if (envClass) return true;
+  if (/^Dockerfile($|\.)/i.test(base)) return true; // Dockerfile, Dockerfile.prod
+  return false;
+}
+
 function walk(dir, files = []) {
   let entries = [];
   try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return files; }
   for (const e of entries) {
-    if (e.name.startsWith(".") && e.name !== ".env") { if (e.isDirectory()) continue; }
+    if (e.name.startsWith(".") && e.name !== ".env" && !e.name.startsWith(".env")) { if (e.isDirectory() && e.name !== ".github") continue; }
     const full = path.join(dir, e.name);
     if (e.isDirectory()) { if (!IGNORE_DIRS.has(e.name)) walk(full, files); }
     else files.push(full);
@@ -73,17 +88,40 @@ function grade(findings) {
   return { score, letter, counts };
 }
 
-function scan(target, opts = {}) {
+function dedupeSort(findings) {
+  const seen = new Set();
+  const unique = findings.filter((f) => {
+    const k = `${f.ruleId}|${f.file}|${f.line}|${f.column}`;
+    if (seen.has(k)) return false; seen.add(k); return true;
+  });
+  unique.sort((a, b) =>
+    (SEV_ORDER[b.severity] - SEV_ORDER[a.severity]) ||
+    a.file.localeCompare(b.file) || (a.line - b.line));
+  return unique;
+}
+
+async function scan(target, opts = {}) {
   const root = path.resolve(target);
   const stat = fs.existsSync(root) && fs.statSync(root);
   if (!stat) throw new Error(`Path not found: ${root}`);
 
   const files = stat.isDirectory() ? walk(root) : [root];
-  const findings = [];
+  let findings = [];
   let scanned = 0;
+  const meta = {};
+  const report = typeof opts.onProgress === "function" ? opts.onProgress : () => {};
+  report({ phase: "discover", total: files.length });
 
-  // Used to decide whether a .env's secrets are safely ignored or exposed.
+  // Decide whether a .env's secrets are safely ignored or exposed.
   const ignore = makeIgnoreChecker(root);
+  // .safeeyignore: skip whole paths the user has opted out of.
+  const pathIgnored = loadPathIgnores(
+    (p) => { try { return fs.readFileSync(p, "utf8"); } catch { return null; } },
+    (name) => path.join(root, name)
+  );
+
+  const minConf = CONF_RANK[opts.confidence] || 0;
+  const keepConf = (f) => !minConf || (CONF_RANK[f.confidence || "medium"] >= minConf);
 
   for (const file of files) {
     const ext = path.extname(file).toLowerCase();
@@ -92,44 +130,65 @@ function scan(target, opts = {}) {
     try { size = fs.statSync(file).size; } catch { continue; }
     if (size > MAX_FILE_BYTES) continue;
     const envClass = classifyEnvFile(base);
-    if (!TEXT_EXT.has(ext) && base !== "package.json" && !envClass) continue;
+    if (!isScannable(base, ext, envClass)) continue;
+
+    const rel = path.relative(root, file) || base;
+    if (pathIgnored(rel)) continue;
 
     let code = "";
     try { code = fs.readFileSync(file, "utf8"); } catch { continue; }
     scanned++;
-    const rel = path.relative(root, file) || base;
+    report({ phase: "scan", current: scanned, total: files.length, file: rel });
+
+    // Collect this file's findings, then apply inline suppressions once.
+    const fileFindings = [];
 
-    // A real .env file is *meant* to hold secrets. The question isn't "are
-    // there secrets in it" but "is it protected from being committed". So we
-    // suppress its secret findings when it's properly ignored, and raise a
-    // single clear finding when it isn't.
     if (envClass === "real") {
+      // A real .env is *meant* to hold secrets — the question is whether it's
+      // protected from being committed. Suppress when ignored; flag when not.
       const secretFindings = opts.secrets !== false ? analyzeSecrets(code, rel) : [];
       const ignored = ignore.isIgnored(file); // true | false | null(unknown)
       if (ignored !== true && hasEnvAssignment(code)) {
-        findings.push(envNotIgnoredFinding(rel, secretFindings.length > 0, ignored === null));
-        for (const f of secretFindings) findings.push(f); // exposure is real — show what's inside
+        fileFindings.push(envNotIgnoredFinding(rel, secretFindings.length > 0, ignored === null));
+        for (const f of secretFindings) fileFindings.push(f);
       }
-      // ignored === true -> secrets stay local and protected; report nothing.
-      continue;
+    } else {
+      if (JS_EXT.has(ext)) {
+        for (const f of analyzeJs(code, rel)) fileFindings.push(f);
+        for (const f of analyzeTaint(code, rel)) fileFindings.push(f); // dataflow-backed
+      }
+      if (base === "package.json") for (const f of analyzeDeps(code, rel)) fileFindings.push(f);
+      if (opts.secrets !== false) for (const f of analyzeSecrets(code, rel)) fileFindings.push(f);
+      for (const f of analyzePatterns(code, rel, ext)) fileFindings.push(f);   // + framework rules
+      for (const f of analyzeInfra(code, rel, base)) fileFindings.push(f);      // docker/k8s/tf/gha
     }
 
-    if (JS_EXT.has(ext)) for (const f of analyzeJs(code, rel)) findings.push(f);
-    if (base === "package.json") for (const f of analyzeDeps(code, rel)) findings.push(f);
-    if (opts.secrets !== false) for (const f of analyzeSecrets(code, rel)) findings.push(f);
-    // Regex/source-pattern rules run on every text file, gated by language tag.
-    for (const f of analyzePatterns(code, rel, ext)) findings.push(f);
+    // Inline suppressions (// safeey-ignore ...) for this file.
+    const sup = fileSuppressions(code);
+    for (const f of fileFindings) {
+      if (f.line && isSuppressed(sup, f.line, f.ruleId)) continue;
+      if (!keepConf(f)) continue;
+      findings.push(f);
+    }
   }
 
-  // De-duplicate identical findings (same rule at the same spot).
-  const seen = new Set();
-  const unique = findings.filter((f) => { const k = `${f.ruleId}|${f.file}|${f.line}|${f.column}`; if (seen.has(k)) return false; seen.add(k); return true; });
-  findings.length = 0; findings.push(...unique);
-
-  // Sort worst-first, then by file/line.
-  findings.sort((a, b) => (SEV_ORDER[b.severity] - SEV_ORDER[a.severity]) || a.file.localeCompare(b.file) || a.line - b.line);
+  // ---- opt-in engines that aren't per-file --------------------------------
+  if (opts.osv) {
+    report({ phase: "osv" });
+    const r = await analyzeDependenciesOSV(root);
+    meta.osv = { checked: r.checked, error: r.error };
+    for (const f of r.findings) if (keepConf(f)) findings.push(f);
+  }
+  if (opts.history) {
+    report({ phase: "history" });
+    const r = analyzeGitHistory(root);
+    meta.history = { scannedBlobs: r.scannedBlobs, error: r.error };
+    for (const f of r.findings) if (keepConf(f)) findings.push(f);
+  }
 
-  return { findings, filesScanned: scanned, filesTotal: files.length, grade: grade(findings), SEV_ORDER };
+  report({ phase: "grade" });
+  findings = dedupeSort(findings);
+  return { findings, filesScanned: scanned, filesTotal: files.length, grade: grade(findings), meta, SEV_ORDER };
 }
 
-module.exports = { scan, grade, SEV_ORDER };
+module.exports = { scan, grade, dedupeSort, SEV_ORDER };