safeey-cli 0.6.1 → 0.7.0

package/README.md

@@ -23,40 +23,103 @@ safeey scan . --json > report.json # machine-readable output
 
 Your code never leaves your machine — scanning runs entirely locally.
 
+## Sign in (free)
+
+Safeey is free, but asks you to sign in once so we know who's using it:
+
+```bash
+safeey login     # opens your browser to sign in / sign up
+```
+
+That's it — you're signed in on this machine until you `safeey logout`.
+
+## Fixing issues
+
+After a scan, Safeey can apply safe, mechanical fixes for you (gitignore an
+exposed `.env`, bump a vulnerable dependency to its patched version):
+
+```bash
+safeey fix .            # preview the fixes, then apply
+safeey fix . --dry-run  # just preview
+```
+
+Auto-fix is a paid feature; everything else — scanning, reports, exports — is free.
+Findings you've reviewed can be silenced inline with `// safeey-ignore <rule-id>`.
+
 ## What it checks
 
 - **Dangerous code patterns** (AST-based): `eval`/`Function` code execution,
-  command injection via `child_process`, SQL injection from string-built queries,
-  XSS via `innerHTML`/`dangerouslySetInnerHTML`, disabled TLS verification, weak
-  hashing (MD5/SHA-1), open redirects, permissive CORS, hardcoded secret fallbacks.
+  command injection via `child_process`, SQL & NoSQL injection, XSS via
+  `innerHTML`/`dangerouslySetInnerHTML`, prototype pollution, SSRF, ReDoS,
+  open redirects, permissive CORS, non-constant-time comparisons, disabled TLS
+  verification, weak hashing (MD5/SHA-1), hardcoded secret fallbacks.
+- **Taint tracking** (JS/TS): follows untrusted input from a request to a
+  dangerous sink, so it catches real injections that arrive through a variable —
+  and stays quiet on safe, constant inputs.
+- **Framework rules**: Express, Next.js, Django, Flask, Spring.
+- **Infrastructure**: Dockerfile, Kubernetes, Terraform, and GitHub Actions
+  misconfigurations.
 - **Hardcoded secrets**: AWS keys, private keys, Stripe/Google/GitHub/Slack/OpenAI
-  tokens, JWTs, and generic credential assignments (values are masked in output).
-- **Dependencies**: known-vulnerable and unpinned packages in `package.json`.
+  tokens, JWTs, high-entropy strings, and generic credential assignments (masked
+  in output). Optional `--history` scans your git history for secrets that were
+  committed and are still recoverable.
+- **Dependencies**: unpinned packages, and (with `--osv`) known CVEs from the
+  OSV.dev database, including transitive dependencies.
 
 Every finding includes a plain-English explanation and the fix, plus a **risk grade**
 (A–F) for the whole codebase.
 
+## Reports & exports
+
+Scanning a big codebase? Keep the terminal readable and put the full list in a file.
+
+```bash
+safeey scan . --summary                 # counts, most-affected files, top rules
+safeey scan . --severity critical,high  # show only the severities you care about
+safeey scan . -o report.html            # full report — open in a browser, or Save as PDF
+safeey scan . -o issues.csv             # sort & filter in Excel / Sheets
+safeey scan . -o report.md              # drop into a PR or issue
+```
+
+`--severity` is a **display** filter — your risk grade always reflects *all* findings.
+The output format comes from the file extension (`.html`, `.csv`, `.md`, `.json`,
+`.sarif`), or force it with `--format`. Writing to a file still prints the summary to
+your terminal, so you see the shape at a glance while the file holds everything.
+
+> **Want a PDF?** Open the `.html` report in your browser and use **Save as PDF** —
+> same result without bundling a headless browser into the CLI.
+
 ## Options
 
 | Flag | Description |
 |------|-------------|
 | `--fail-on <sev>` | Exit non-zero if any finding ≥ severity (`critical`/`high`/`medium`/`low`/`off`; default `high`) |
+| `--severity <levels>` | Show only these severities, e.g. `high` or `critical,high` (display only; grade unaffected) |
+| `--confidence <level>` | Show only findings at/above confidence (`low`/`medium`/`high`) |
+| `--summary` | Print a rollup: counts, most-affected files, top rules |
+| `-o, --output <file>` | Write the full report to a file (format from the extension) |
+| `--format <fmt>` | Force output format: `html`/`md`/`csv`/`json`/`sarif` |
+| `--osv` | Check dependencies against known CVEs via OSV.dev (requires network) |
+| `--history` | Scan git history for committed secrets |
+| `--sarif` | SARIF 2.1.0 output (for GitHub code scanning) |
 | `--json` | Output findings as JSON |
+| `--baseline <file>` · `--update-baseline <file>` | Report only findings that are new vs a saved baseline |
 | `--no-secrets` | Skip secret detection |
-| `-h, --help` | Help |
-| `-v, --version` | Version |
+| `-h, --help` · `-v, --version` | Help · version |
 
 ## Languages
 
-JavaScript / TypeScript today (AST-based). Secret and dependency scanning are
-language-agnostic. More languages (Python, Go) are on the roadmap.
+JavaScript / TypeScript get the deepest analysis (AST rules + taint tracking).
+Pattern-based rules also cover Python, Go, PHP, and Java, and secret and
+dependency scanning are language-agnostic. Broader language support is on the
+roadmap.
 
 ## Roadmap
 
-- More languages via tree-sitter grammars
-- Full CVE coverage via the OSV database
+- Deeper language coverage via tree-sitter grammars
+- Interprocedural taint tracking
 - Optional AI layer to explain findings and suggest patches
-- `safeey login` to sync results to your Safeey dashboard
+- Team dashboards and trend tracking on [safeey.io](https://safeey.io)
 
 ## License
 

package/bin/safeey.js

@@ -1,8 +1,11 @@
 #!/usr/bin/env node
 // bin/safeey.js — Safeey CLI entry point.
 const { scan, grade, SEV_ORDER } = require("../src/scan");
-const { printReport } = require("../src/report");
+const { printReport, printSummary } = require("../src/report");
 const { toSarif } = require("../src/report-sarif");
+const { toMarkdown } = require("../src/report-md");
+const { toHtml } = require("../src/report-html");
+const { toCsv } = require("../src/report-csv");
 const { getConfig, setConfig, CONFIG_PATH } = require("../src/config");
 const { syncResults } = require("../src/sync");
 const { loadBaseline, writeBaseline, filterNew } = require("../src/baseline");
@@ -10,6 +13,8 @@ const auth = require("../src/auth");
 const { Spinner, attachProgress } = require("../src/spinner");
 const { planFixes, planEdits, applyEdits } = require("../src/fix");
 const readline = require("readline");
+const fs = require("fs");
+const path = require("path");
 
 const pkg = require("../package.json");
 
@@ -30,8 +35,13 @@ Account
 Options
   --fail-on <severity>          Exit non-zero if any finding >= severity
                                 (critical|high|medium|low|off; default: high)
+  --severity <levels>           Show only these severities (e.g. high or high,critical)
   --confidence <level>          Only show findings at/above confidence
                                 (low|medium|high; default: low)
+  --summary                     Print a rollup (counts, worst files, top rules)
+  -o, --output <file>           Write the full report to a file
+                                (format from extension: .html .md .csv .json .sarif)
+  --format <fmt>                Force output format (html|md|csv|json|sarif)
   --osv                         Check dependencies against known CVEs (OSV.dev; network)
   --history                     Scan git history for committed secrets
   --no-secrets                  Skip secret detection
@@ -51,10 +61,11 @@ Suppress a finding inline:
   // safeey-ignore-next-line <rule-id>
 
 Examples
-  safeey register
   safeey scan ./ --osv
-  safeey scan ./src --fail-on critical --confidence high
-  safeey scan . --sarif > safeey.sarif
+  safeey scan . --severity critical,high
+  safeey scan . --summary
+  safeey scan . -o report.html          # open in a browser, or Save as PDF
+  safeey scan . -o issues.csv           # sort & filter in Excel/Sheets
   safeey fix . --dry-run
 `;
 
@@ -78,6 +89,10 @@ function parseArgs(argv) {
     else if (a === "--no-fix") args.noFix = true;
     else if (a === "--yes" || a === "-y") args.yes = true;
     else if (a === "--dry-run") args.dryRun = true;
+    else if (a === "--severity") args.severity = argv[++i];
+    else if (a === "-o" || a === "--output") args.output = argv[++i];
+    else if (a === "--format") args.format = argv[++i];
+    else if (a === "--summary") args.summary = true;
     else if (a === "-h" || a === "--help") args.help = true;
     else if (a === "-v" || a === "--version") args.version = true;
     else args._.push(a);
@@ -163,12 +178,33 @@ async function main() {
     result.grade = grade(result.findings);
   }
 
-  if (args.sarif) {
-    console.log(toSarif(result, target));
-  } else if (args.json) {
-    console.log(JSON.stringify({ target, ...result, SEV_ORDER: undefined }, null, 2));
+  // Severity filter is a *display* filter — it never changes the grade, which
+  // always reflects the full set of findings.
+  const sevSet = parseSeverity(args.severity);
+  const dres = displayResult(result, filterBySeverity(result.findings, sevSet));
+
+  const fmt = resolveFormat(args);
+
+  if (args.output) {
+    const useFmt = (fmt && fmt !== "console") ? fmt : "md";
+    const content = render(useFmt, dres, target);
+    if (content == null) {
+      console.error(`  Unknown format for ${args.output}. Use --format md|html|csv|json|sarif.`);
+      process.exit(2);
+    }
+    try { fs.writeFileSync(args.output, content); }
+    catch (e) { console.error(`  Couldn't write ${args.output}: ${e.message}`); process.exit(2); }
+    // Still give the terminal the shape at a glance; the file has everything.
+    printSummary(dres, target);
+    console.log(`  \u2714 Full report written to ${args.output}` + dimNote(dres, sevSet) + "\n");
+  } else if (fmt === "sarif") {
+    console.log(render("sarif", dres, target));
+  } else if (fmt === "json") {
+    console.log(render("json", dres, target));
+  } else if (args.summary) {
+    printSummary(dres, target);
   } else {
-    printReport(result, target);
+    printReport(dres, target);
     if (result.meta && result.meta.osv && result.meta.osv.error) console.log(`  \u26a0 OSV check skipped: ${result.meta.osv.error}\n`);
     if (result.meta && result.meta.history && result.meta.history.error) console.log(`  \u26a0 History scan skipped: ${result.meta.history.error}\n`);
   }
@@ -176,8 +212,8 @@ async function main() {
   // ---- offer to auto-fix (paid) ------------------------------------------
   // On a human-facing run with findings, ask whether Safeey should fix them.
   // Saying no just leaves the results as-is. The `fix` command skips the ask
-  // and goes straight to the (plan-gated) fix flow.
-  if (!quiet && result.findings.length) {
+  // and goes straight to the (plan-gated) fix flow. Skipped when exporting.
+  if (!quiet && !args.output && result.findings.length) {
     const { fixable } = planFixes(result.findings);
     let proceed = false;
     if (isFixCmd) {
@@ -211,6 +247,56 @@ function ask(question) {
   });
 }
 
+const SEV_LEVELS = ["critical", "high", "medium", "low", "info"];
+
+// Parse --severity: a comma-separated list of exact levels (e.g. "high" or
+// "critical,high"). Returns a Set, or null when not filtering.
+function parseSeverity(spec) {
+  if (!spec) return null;
+  const set = new Set(String(spec).toLowerCase().split(",").map((s) => s.trim()).filter(Boolean));
+  for (const s of set) if (!SEV_LEVELS.includes(s)) { console.error(`  Unknown severity "${s}". Use: ${SEV_LEVELS.join(", ")}.`); process.exit(2); }
+  return set.size ? set : null;
+}
+
+function filterBySeverity(findings, set) {
+  return set ? findings.filter((f) => set.has(f.severity)) : findings;
+}
+
+// A result view for display/export: same grade letter/score (the true grade),
+// but counts recomputed to match the (possibly filtered) findings shown.
+function displayResult(result, findings) {
+  if (findings === result.findings) return result;
+  const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+  for (const f of findings) counts[f.severity] = (counts[f.severity] || 0) + 1;
+  return { ...result, findings, grade: { ...result.grade, counts } };
+}
+
+function resolveFormat(args) {
+  if (args.format) return String(args.format).toLowerCase();
+  if (args.output) {
+    const ext = path.extname(args.output).slice(1).toLowerCase();
+    return { md: "md", markdown: "md", html: "html", htm: "html", csv: "csv", json: "json", sarif: "sarif" }[ext] || null;
+  }
+  if (args.sarif) return "sarif";
+  if (args.json) return "json";
+  return "console";
+}
+
+function render(fmt, res, target) {
+  switch (fmt) {
+    case "md": return toMarkdown(res, target, res.findings);
+    case "html": return toHtml(res, target, res.findings);
+    case "csv": return toCsv(res, target, res.findings);
+    case "json": return JSON.stringify({ target, ...res, SEV_ORDER: undefined }, null, 2);
+    case "sarif": return toSarif(res, target);
+    default: return null;
+  }
+}
+
+function dimNote(dres, sevSet) {
+  return `  (${dres.findings.length} finding${dres.findings.length === 1 ? "" : "s"}${sevSet ? ", filtered by severity" : ""})`;
+}
+
 // Plan-gated fix flow: verify the plan, preview the mechanical changes, confirm,
 // apply. Free users get an upgrade nudge; the scan results stay theirs either way.
 async function runFix(result, target, args, fixable) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "safeey-cli",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "Scan your source code for security vulnerabilities — a Safeey product by Noohra Innovate Ltd.",
   "bin": {
     "safeey": "bin/safeey.js"

package/src/report-csv.js

@@ -0,0 +1,18 @@
+// src/report-csv.js — findings as CSV (open in Excel/Sheets to sort & filter).
+const COLUMNS = ["severity", "confidence", "category", "cwe", "ruleId", "file", "line", "column", "title", "message", "fix"];
+
+function toCsv(result, target, findings) {
+  const rows = [COLUMNS.join(",")];
+  for (const f of findings) {
+    rows.push(COLUMNS.map((k) => esc(f[k])).join(","));
+  }
+  return rows.join("\n") + "\n";
+}
+
+// RFC-4180-ish escaping: wrap in quotes if the value has a comma, quote or newline.
+function esc(v) {
+  const s = v == null ? "" : String(v);
+  return /[",\n\r]/.test(s) ? '"' + s.replace(/"/g, '""') + '"' : s;
+}
+
+module.exports = { toCsv };

package/src/report-html.js

@@ -0,0 +1,99 @@
+// src/report-html.js — a self-contained, styled HTML report.
+// Opens in any browser; "Save as PDF" from the browser gives a clean PDF with
+// no extra tooling. Includes a small client-side severity filter (which print
+// ignores, so a printed/exported PDF always contains everything).
+const SEV_ORDER = ["critical", "high", "medium", "low", "info"];
+const pkg = require("../package.json");
+
+function toHtml(result, target, findings) {
+  const g = result.grade;
+  const counts = g.counts;
+  const chips = SEV_ORDER.filter((s) => counts[s]).map((s) => `<span class="chip ${s}">${counts[s]} ${s}</span>`).join("");
+  const filterBtns = ["all", ...SEV_ORDER.filter((s) => counts[s])]
+    .map((s) => `<button class="fbtn${s === "all" ? " active" : ""}" data-f="${s}">${s === "all" ? "All" : cap(s)}</button>`).join("");
+
+  const rows = findings.map((f) => `
+    <tr data-sev="${f.severity}">
+      <td><span class="sev ${f.severity}">${f.severity}</span></td>
+      <td class="loc"><code>${esc(f.file)}${f.line ? ":" + f.line : ""}</code></td>
+      <td class="rule"><code>${esc(f.ruleId)}</code></td>
+      <td><div class="title">${esc(f.title)}</div><div class="msg">${esc(f.message)}</div></td>
+      <td class="fix">${esc(f.fix)}</td>
+    </tr>`).join("");
+
+  const body = findings.length
+    ? `<div class="filters">${filterBtns}</div>
+       <table>
+         <thead><tr><th>Severity</th><th>Location</th><th>Rule</th><th>Issue</th><th>Fix</th></tr></thead>
+         <tbody>${rows}</tbody>
+       </table>`
+    : `<p class="clean">✔ No issues found.</p>`;
+
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Safeey report — ${esc(target)}</title>
+<style>
+  :root { --bg:#0b0d10; --card:#15181d; --line:#262b33; --ink:#e7ebf0; --dim:#9aa4b2; }
+  * { box-sizing: border-box; }
+  body { margin:0; background:var(--bg); color:var(--ink); font:15px/1.5 ui-sans-serif,system-ui,-apple-system,sans-serif; }
+  .wrap { max-width: 1100px; margin: 0 auto; padding: 32px 20px 64px; }
+  header { border-bottom:1px solid var(--line); padding-bottom:18px; margin-bottom:20px; }
+  h1 { font-size:20px; margin:0 0 6px; }
+  .meta { color:var(--dim); font-size:13px; }
+  .grade { display:inline-flex; align-items:center; gap:10px; margin:14px 0 8px; }
+  .badge { font-weight:700; font-size:22px; width:40px; height:40px; border-radius:10px; display:flex; align-items:center; justify-content:center; }
+  .badge.A{background:#0f2a1a;color:#39d98a}.badge.B{background:#0e2530;color:#38bdf8}.badge.C{background:#2a2410;color:#eab308}.badge.D{background:#2a1030;color:#c084fc}.badge.F{background:#2a1015;color:#f87171}
+  .chips { margin-top:10px; display:flex; gap:8px; flex-wrap:wrap; }
+  .chip { font-size:12px; padding:3px 9px; border-radius:20px; border:1px solid var(--line); color:var(--dim); }
+  .chip.critical,.chip.high{color:#f87171}.chip.medium{color:#eab308}.chip.low{color:#60a5fa}
+  .filters { display:flex; gap:8px; margin-bottom:14px; flex-wrap:wrap; }
+  .fbtn { background:var(--card); border:1px solid var(--line); color:var(--dim); padding:5px 12px; border-radius:8px; cursor:pointer; font-size:13px; }
+  .fbtn.active { color:var(--ink); border-color:#3a4552; background:#1c2128; }
+  table { width:100%; border-collapse:collapse; font-size:13px; }
+  thead th { position:sticky; top:0; background:var(--bg); text-align:left; color:var(--dim); font-weight:600; padding:8px 10px; border-bottom:1px solid var(--line); }
+  td { padding:10px; border-bottom:1px solid var(--line); vertical-align:top; }
+  code { font-family:ui-monospace,Menlo,monospace; font-size:12px; color:#cbd5e1; }
+  .sev { text-transform:uppercase; font-size:11px; font-weight:700; padding:2px 7px; border-radius:5px; }
+  .sev.critical{background:#f87171;color:#210607}.sev.high{background:#3a1216;color:#f87171}.sev.medium{background:#2a2410;color:#eab308}.sev.low{background:#0e2233;color:#60a5fa}.sev.info{background:#1c2128;color:#9aa4b2}
+  .title { font-weight:600; margin-bottom:3px; }
+  .msg { color:var(--dim); }
+  .fix { color:#a7f3d0; max-width:320px; }
+  .loc,.rule { white-space:nowrap; }
+  .clean { color:#39d98a; font-size:18px; }
+  footer { margin-top:24px; color:var(--dim); font-size:12px; }
+  @media print {
+    :root { --bg:#fff; --card:#fff; --line:#ddd; --ink:#111; --dim:#555; }
+    body { background:#fff; } .filters { display:none !important; }
+    tr[data-sev]{ display:table-row !important; }
+    .sev.high{background:#fde8e8}.fix{color:#065f46}.msg{color:#555} code{color:#334}
+  }
+</style></head>
+<body><div class="wrap">
+  <header>
+    <h1>Safeey security report</h1>
+    <div class="meta">Target <code>${esc(target)}</code> · ${result.filesScanned} files scanned · ${new Date().toISOString().slice(0, 10)}</div>
+    <div class="grade"><span class="badge ${g.letter}">${g.letter}</span><span class="meta">Risk score ${g.score}/100</span></div>
+    <div class="chips">${chips || '<span class="chip">no findings</span>'}</div>
+  </header>
+  ${body}
+  <footer>Generated by safeey-cli ${pkg.version}. Tip: use your browser's “Save as PDF” to export this report.</footer>
+</div>
+<script>
+  document.querySelectorAll('.fbtn').forEach(function(b){
+    b.addEventListener('click', function(){
+      document.querySelectorAll('.fbtn').forEach(function(x){x.classList.remove('active');});
+      b.classList.add('active');
+      var f = b.getAttribute('data-f');
+      document.querySelectorAll('tr[data-sev]').forEach(function(r){
+        r.style.display = (f === 'all' || r.getAttribute('data-sev') === f) ? '' : 'none';
+      });
+    });
+  });
+</script>
+</body></html>`;
+}
+
+function esc(s) { return String(s == null ? "" : s).replace(/[&<>"]/g, (ch) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" }[ch])); }
+function cap(s) { return s.charAt(0).toUpperCase() + s.slice(1); }
+
+module.exports = { toHtml };

package/src/report-md.js

@@ -0,0 +1,43 @@
+// src/report-md.js — findings as Markdown (great for PRs / issues).
+const SEV_ORDER = ["critical", "high", "medium", "low", "info"];
+
+function toMarkdown(result, target, findings) {
+  const g = result.grade;
+  const out = [];
+  out.push(`# Safeey security report`);
+  out.push("");
+  out.push(`**Target:** \`${target}\`  ·  **Files scanned:** ${result.filesScanned}  ·  **Grade:** ${g.letter} (${g.score}/100)`);
+  out.push("");
+  out.push(countsLine(g.counts));
+  out.push("");
+
+  if (!findings.length) { out.push("_No issues to report._"); return out.join("\n") + "\n"; }
+
+  const bySev = groupBy(findings, (f) => f.severity);
+  for (const sev of SEV_ORDER) {
+    const list = bySev[sev];
+    if (!list || !list.length) continue;
+    out.push(`## ${cap(sev)} (${list.length})`);
+    out.push("");
+    out.push("| File | Rule | Issue | Fix |");
+    out.push("| --- | --- | --- | --- |");
+    for (const f of list) {
+      const loc = f.line ? `${f.file}:${f.line}` : f.file;
+      out.push(`| \`${loc}\` | ${f.ruleId} | ${md(f.title)} | ${md(f.fix)} |`);
+    }
+    out.push("");
+  }
+  out.push(`<sub>Generated by safeey-cli</sub>`);
+  return out.join("\n") + "\n";
+}
+
+function countsLine(counts) {
+  const parts = [];
+  for (const s of SEV_ORDER) if (counts[s]) parts.push(`${counts[s]} ${s}`);
+  return parts.length ? parts.join("  ·  ") : "no findings";
+}
+function groupBy(arr, fn) { const o = {}; for (const x of arr) (o[fn(x)] ||= []).push(x); return o; }
+function cap(s) { return s.charAt(0).toUpperCase() + s.slice(1); }
+function md(s) { return String(s || "").replace(/\|/g, "\\|").replace(/\n/g, " "); }
+
+module.exports = { toMarkdown };

package/src/report.js

@@ -49,4 +49,42 @@ function printReport({ findings, filesScanned, grade }, target) {
 
 function underlineSafe(s) { return useColor ? `\x1b[4m${s}\x1b[24m` : s; }
 
-module.exports = { printReport };
+// Compact rollup for big scans: severity counts, worst files, top rules.
+function printSummary({ findings, filesScanned, grade }, target) {
+  const g = grade;
+  console.log("");
+  console.log(bold(`  Safeey CLI`) + dim(`  ·  scanned ${filesScanned} file(s) in ${target}`));
+  console.log("");
+
+  if (!findings.length) { console.log("  " + green("✔ No issues found.") + dim("  (Grade A)")); console.log(""); return; }
+
+  const { counts } = g;
+  const parts = [];
+  if (counts.critical) parts.push(red(`${counts.critical} critical`));
+  if (counts.high) parts.push(red(`${counts.high} high`));
+  if (counts.medium) parts.push(yellow(`${counts.medium} medium`));
+  if (counts.low) parts.push(blue(`${counts.low} low`));
+  if (counts.info) parts.push(dim(`${counts.info} info`));
+  console.log(`  ${bold("Risk grade")} ${(GRADE_STYLE[g.letter] || dim)(bold(g.letter))} ${dim(`(${g.score}/100)`)}   ${parts.join(dim("  ·  "))}`);
+  console.log("");
+
+  const topFiles = tally(findings, (f) => f.file).slice(0, 10);
+  const topRules = tally(findings, (f) => f.ruleId).slice(0, 10);
+
+  console.log("  " + bold("Most affected files"));
+  for (const [file, n] of topFiles) console.log(`    ${dim(String(n).padStart(4))}  ${file}`);
+  console.log("");
+  console.log("  " + bold("Most common issues"));
+  for (const [rule, n] of topRules) console.log(`    ${dim(String(n).padStart(4))}  ${rule}`);
+  console.log("");
+  console.log("  " + dim(`${findings.length} findings total. Write the full list with `) + cyan("-o report.html") + dim(" (or .csv / .md)."));
+  console.log("");
+}
+
+function tally(findings, keyFn) {
+  const m = new Map();
+  for (const f of findings) m.set(keyFn(f), (m.get(keyFn(f)) || 0) + 1);
+  return [...m.entries()].sort((a, b) => b[1] - a[1]);
+}
+
+module.exports = { printReport, printSummary };