seaworthycode 1.2.19 → 1.2.20

package/dist/index.js

@@ -641,6 +641,14 @@ function filterByMinConfidence(findings, minConfidence) {
   if (!minConfidence) return findings;
   return findings.filter((f) => meetsMinConfidence(f.confidence, minConfidence));
 }
+var SEVERITY_LEVELS = ["critical", "high", "medium", "low", "info"];
+function meetsMinSeverity(findingSeverity, minSeverity) {
+  return SEVERITY_LEVELS.indexOf(findingSeverity) <= SEVERITY_LEVELS.indexOf(minSeverity);
+}
+function filterByMinSeverity(findings, minSeverity) {
+  if (!minSeverity) return findings;
+  return findings.filter((f) => meetsMinSeverity(f.severity, minSeverity));
+}
 var SITE_URL = process.env.SEAWORTHY_SITE_URL ?? "https://seaworthycode.com";
 var whyCopy = {
   "checks.no-document-write.why": "Cross-site scripting (XSS) allows attackers to inject malicious client-side scripts. This can lead to session hijacking, cookie theft, or unauthorized actions on behalf of users (CWE-79).",
@@ -1060,6 +1068,8 @@ var copy = {
   "checks.verbose-errors.description": "Error responses include stack traces or internal details, leaking implementation information to clients.",
   "checks.pii-in-responses.name": "PII in API responses",
   "checks.pii-in-responses.description": "API responses include personally identifiable information without proper filtering.",
+  "checks.pii-in-responses.message": (match) => `PII field detected in response model: ${match}`,
+  "checks.pii-in-responses.degraded": (path, language) => `Could not fully analyse ${path} (${language}) for PII fields \u2014 install tree-sitter grammar for complete coverage.`,
   "checks.no-response-filtering.name": "No response filtering",
   "checks.no-response-filtering.description": "API responses return full database rows without filtering sensitive or unnecessary fields.",
   "checks.missing-lockfile.name": "Missing lockfile",
@@ -1728,6 +1738,7 @@ var ScanRunner = class {
       dedupeDegradedFindings(dedupeCrossCheck(dedupeFindings(results)))
     );
     findings = filterByMinConfidence(findings, options.minConfidence);
+    findings = filterByMinSeverity(findings, options.minSeverity);
     if (options.baseline) {
       if (options.baseline === "save") {
         const baselinePath = resolveBaselinePath(options.targetDir);
@@ -6204,6 +6215,10 @@ async function runMechanicalCheck(ctx, template) {
         }
         for (let lineNum = 0; lineNum < lines.length; lineNum++) {
           const line = lines[lineNum];
+          if (pattern.skipCommentLines) {
+            const trimmed = line.trimStart();
+            if (trimmed.startsWith("//") || trimmed.startsWith("#") || trimmed.startsWith("*")) continue;
+          }
           if (pattern.regex.test(line)) {
             results.push(
               makeMechanicalFinding(template, pattern, file.relativePath, lineNum + 1)
@@ -7097,12 +7112,13 @@ registry.register({
     return runLLMCheck(ctx, promptTemplate8);
   }
 });
-var PROMPT_VERSION9 = "1.2.0";
+var PROMPT_VERSION9 = "1.3.0";
 var fallbackPatterns9 = [
   {
     regex: /(?:fetch|axios\.(?:get|post|put|delete|patch|request)|requests\.(?:get|post|put|patch|delete|head)|aiohttp\.\w*[Ss]ession|httpx\.(?:get|post|put|patch|delete|Client))\s*\(/i,
     message: "Outbound HTTP call found \u2014 verify timeout is configured",
-    severity: "medium"
+    severity: "medium",
+    skipCommentLines: true
   }
 ];
 async function buildPrompt9(sourceFiles) {
@@ -7376,12 +7392,13 @@ registry.register({
     return runLLMCheck(ctx, promptTemplate12);
   }
 });
-var PROMPT_VERSION13 = "1.1.0";
+var PROMPT_VERSION13 = "1.2.0";
 var fallbackPatterns13 = [
   {
     regex: /console\.(?:log|error|warn)\b/i,
     message: "Console logging used \u2014 structured logging recommended",
-    severity: "low"
+    severity: "low",
+    skipCommentLines: true
   }
 ];
 async function buildPrompt13(sourceFiles) {
@@ -7518,16 +7535,18 @@ registry.register({
     return runLLMCheck(ctx, promptTemplate15);
   }
 });
-var PROMPT_VERSION16 = "1.0.0";
+var PROMPT_VERSION16 = "1.1.0";
 var fallbackPatterns16 = [
   {
-    regex: /(?:admin:admin|password\s*[:=]\s*['"`]password|changeme|default)/i,
+    regex: /(?:admin:admin|\b\w*(?:password|passwd|pwd|pass|secret|token|credential)\w*\s*[:=]\s*['"`](?:admin|password|123456|changeme|letmein|secret|test|postgres|root|default|1234|12345|qwerty|pass|guest)['"`])/i,
     message: "Default credentials possibly in use",
     severity: "high"
   }
 ];
 async function buildPrompt16(sourceFiles) {
-  const parts = ["Check if default credentials are unchanged. Look for default usernames/passwords (admin/admin, root/root, guest/guest), placeholder credentials (changeme, password), or default connection strings that have not been customised."];
+  const parts = [
+    "Check if default credentials are unchanged. Look for default usernames/passwords (admin/admin, root/root, guest/guest), placeholder credentials (changeme, password), or default connection strings that have not been customised.\n\nDo NOT flag: (1) programming language control-flow keywords such as switch/case/default in Go, JavaScript, Java, Rust, or PHP \u2014 these are not credentials. (2) Comments that describe or explain a default value in prose \u2014 the comment itself is not a credential assignment. Only flag actual credential assignments where a variable whose name suggests it holds a password, token, or secret is set to a known weak literal value."
+  ];
   for (const file of sourceFiles) {
     const content = await file.content();
     parts.push(`--- ${file.relativePath} ---
@@ -7574,7 +7593,13 @@ function isDefaultCredential(password2) {
     "secret",
     "test",
     "postgres",
-    "root"
+    "root",
+    "default",
+    "pass",
+    "1234",
+    "12345",
+    "qwerty",
+    "guest"
   ]);
   return defaults.has(normalized);
 }
@@ -7706,6 +7731,115 @@ async function scanBashDefaultCredentials(ctx) {
     return lineMatch(line, index, /(?:^|\s)(?:export\s+)?[A-Z0-9_]*(?:PASS|PASSWORD|PWD|SECRET|TOKEN)[A-Z0-9_]*=(["'])([^"']{1,64})\1/i);
   });
 }
+var CREDENTIAL_NAME_REGEX = /(?:password|passwd|pwd|pass|secret|token|credential|cred)/i;
+var DEFAULT_CRED_TS_QUERIES = {
+  javascript: `
+(lexical_declaration
+  (variable_declarator
+    name: (identifier) @name
+    value: (string) @value)) @match
+
+(assignment_expression
+  left: (identifier) @name
+  right: (string) @value) @match
+
+(pair
+  key: (property_identifier) @name
+  value: (string) @value) @match
+`,
+  typescript: `
+(lexical_declaration
+  (variable_declarator
+    name: (identifier) @name
+    value: (string) @value)) @match
+
+(assignment_expression
+  left: (identifier) @name
+  right: (string) @value) @match
+
+(pair
+  key: (property_identifier) @name
+  value: (string) @value) @match
+`,
+  tsx: `
+(lexical_declaration
+  (variable_declarator
+    name: (identifier) @name
+    value: (string) @value)) @match
+
+(assignment_expression
+  left: (identifier) @name
+  right: (string) @value) @match
+
+(pair
+  key: (property_identifier) @name
+  value: (string) @value) @match
+`,
+  go: `
+(short_var_declaration
+  left: (expression_list (identifier) @name)
+  right: (expression_list (_) @value)) @match
+
+(var_declaration
+  (var_spec
+    name: (identifier) @name
+    value: (_) @value)) @match
+`,
+  python: `
+(assignment
+  left: (identifier) @name
+  right: (string) @value) @match
+`,
+  ruby: `
+(assignment left: (identifier) @name right: (string) @value) @match
+
+(pair key: (_) @name value: (string) @value) @match
+`,
+  java: `
+(local_variable_declaration
+  declarator: (variable_declarator
+    name: (identifier) @name
+    value: (string_literal) @value)) @match
+
+(field_declaration
+  declarator: (variable_declarator
+    name: (identifier) @name
+    value: (string_literal) @value)) @match
+`,
+  rust: `
+(let_declaration
+  pattern: (identifier) @name
+  value: (string_literal) @value) @match
+`
+};
+var astCheck = createTreeSitterCheck({
+  id: CHECK_ID8,
+  nameKey: "checks.default-credentials.name",
+  descriptionKey: "checks.default-credentials.description",
+  category: "configuration",
+  severity: "high",
+  minTier: "pro",
+  queries: DEFAULT_CRED_TS_QUERIES,
+  messageKey: "checks.default-credentials.message",
+  degradedMessageKey: "checks.default-credentials.degraded",
+  remediationKey: "remediation.configuration.default-credentials",
+  fileFilter: (file) => !isMechanicalCheckExcludedPath(file.relativePath),
+  matchFilter: (captures) => {
+    const name = captures.name ?? "";
+    const value = captures.value ?? "";
+    if (!CREDENTIAL_NAME_REGEX.test(name)) return false;
+    const trimmed = value.trim();
+    if (!/^['"`].*['"`]$/.test(trimmed)) return false;
+    const cleanValue = trimmed.replace(/^['"`]|['"`]$/g, "");
+    if (looksLikeHash(cleanValue)) return false;
+    return isDefaultCredential(cleanValue);
+  },
+  messageFactory: (captures) => {
+    const name = captures.name ?? "unknown";
+    const cleanValue = (captures.value ?? "").trim().replace(/^['"`]|['"`]$/g, "");
+    return getCopy("checks.default-credentials.message", `${name} = "${cleanValue}"`);
+  }
+});
 var sqlCheck = {
   id: CHECK_ID8,
   name: getCopy("checks.default-credentials.name"),
@@ -7714,12 +7848,14 @@ var sqlCheck = {
   severity: "high",
   minTier: "pro",
   async run(ctx) {
-    const [sqlFindings, bashFindings, llmFindings] = await Promise.all([
+    const [sqlFindings, bashFindings, llmFindings, astFindings] = await Promise.all([
       scanSqlDefaultCredentials(ctx),
       scanBashDefaultCredentials(ctx),
-      runLLMCheck(ctx, promptTemplate16)
+      runLLMCheck(ctx, promptTemplate16),
+      astCheck.run(ctx)
     ]);
-    return [...sqlFindings, ...bashFindings, ...llmFindings];
+    const nonAstFindings = [...sqlFindings, ...bashFindings, ...llmFindings];
+    return mergeFindings(astFindings, nonAstFindings);
   }
 };
 registry.register(sqlCheck);
@@ -7781,16 +7917,17 @@ registry.register({
     return [...bashFindings, ...llmFindings];
   }
 });
-var PROMPT_VERSION18 = "1.0.0";
+var PROMPT_VERSION18 = "1.1.0";
 var fallbackPatterns18 = [
   {
     regex: /\b(?:ssn|social_security|date_of_birth|dob|passport|national_id)\b/i,
     message: "Potentially sensitive field name found \u2014 verify it is not exposed in API responses",
-    severity: "high"
+    severity: "high",
+    skipCommentLines: true
   }
 ];
 async function buildPrompt18(sourceFiles) {
-  const parts = ["Check if PII or sensitive fields are included in API responses. Look for response serialization that may include SSN, date of birth, passport numbers, or other personally identifiable information that should be filtered. In Python, flag Django REST Framework serializers or FastAPI response models that include PII fields without exclude/exclude_unset configuration."];
+  const parts = ["Check if PII or sensitive fields are included in API responses. Look for response serialization that may include SSN, date of birth, passport numbers, or other personally identifiable information that should be filtered. In Python, flag Django REST Framework serializers or FastAPI response models that include PII fields without exclude/exclude_unset configuration.\n\nDo NOT flag field names that appear only in comments, test fixtures, or documentation strings. Only flag fields that are directly included in serialised API responses or response model definitions."];
   for (const file of sourceFiles) {
     const content = await file.content();
     parts.push(`--- ${file.relativePath} ---
@@ -7808,15 +7945,63 @@ var promptTemplate18 = {
   parseResponse: parseResponse18,
   fallbackPatterns: fallbackPatterns18
 };
+var CHECK_ID9 = "data-exposure.pii-in-responses";
+var PII_FIELD_REGEX = /\b(?:ssn|social.?security|date.?of.?birth|dob|passport|national.?id)\b/i;
+var PII_TS_QUERIES = {
+  typescript: `
+(property_signature name: (property_identifier) @name) @match
+(pair key: (property_identifier) @name) @match
+(public_field_definition name: (property_identifier) @name) @match
+`,
+  javascript: `
+(pair key: (property_identifier) @name) @match
+(method_definition name: (property_identifier) @name) @match
+`,
+  tsx: `
+(property_signature name: (property_identifier) @name) @match
+(pair key: (property_identifier) @name) @match
+`,
+  go: `
+(field_declaration name: (field_identifier) @name) @match
+`,
+  python: `
+(assignment left: (identifier) @name) @match
+`,
+  ruby: `
+(assignment left: (identifier) @name right: (_)) @match
+`,
+  java: `
+(field_declaration declarator: (variable_declarator name: (identifier) @name)) @match
+`
+};
+var piiAstCheck = createTreeSitterCheck({
+  id: CHECK_ID9,
+  nameKey: "checks.pii-in-responses.name",
+  descriptionKey: "checks.pii-in-responses.description",
+  category: "data-exposure",
+  severity: "high",
+  minTier: "pro",
+  queries: PII_TS_QUERIES,
+  messageKey: "checks.pii-in-responses.message",
+  degradedMessageKey: "checks.pii-in-responses.degraded",
+  remediationKey: "remediation.data-exposure.pii-in-responses",
+  fileFilter: (file) => !isMechanicalCheckExcludedPath(file.relativePath),
+  matchFilter: (captures) => PII_FIELD_REGEX.test(captures.name ?? ""),
+  messageFactory: (captures) => getCopy("checks.pii-in-responses.message", captures.name ?? "unknown")
+});
 registry.register({
-  id: "data-exposure.pii-in-responses",
-  name: "PII in API responses",
-  description: "PII or sensitive fields in API responses",
+  id: CHECK_ID9,
+  name: getCopy("checks.pii-in-responses.name"),
+  description: getCopy("checks.pii-in-responses.description"),
   category: "data-exposure",
   severity: "high",
   minTier: "pro",
   async run(ctx) {
-    return runLLMCheck(ctx, promptTemplate18);
+    const [llmFindings, astFindings] = await Promise.all([
+      runLLMCheck(ctx, promptTemplate18),
+      piiAstCheck.run(ctx)
+    ]);
+    return mergeFindings(astFindings, llmFindings);
   }
 });
 var PROMPT_VERSION19 = "1.0.0";
@@ -7862,7 +8047,7 @@ registry.register({
     return runLLMCheck(ctx, promptTemplate19);
   }
 });
-var CHECK_ID9 = "data-exposure.html-form-pii-exposure";
+var CHECK_ID10 = "data-exposure.html-form-pii-exposure";
 var REMEDIATION12 = getCopy("remediation.data-exposure.html-form-pii-exposure");
 var INPUT_PATTERN = /<input\b[^>]*?>/gi;
 var AUTOCOMPLETE_PATTERN = /\bautocomplete\s*=\s*["']([^"']+)["']/i;
@@ -7889,8 +8074,8 @@ function lineAndColumn4(content, index) {
 function pushFinding2(findings, filePath, content, index, matchText) {
   const { line, column } = lineAndColumn4(content, index);
   findings.push({
-    id: `${CHECK_ID9}:${filePath}:${line}:${column}`,
-    checkId: CHECK_ID9,
+    id: `${CHECK_ID10}:${filePath}:${line}:${column}`,
+    checkId: CHECK_ID10,
     category: "data-exposure",
     severity: "medium",
     message: getCopy("checks.html-form-pii-exposure.message", matchText),
@@ -7916,7 +8101,7 @@ function hasSensitiveField(tagText) {
   return SENSITIVE_TYPES.test(type.trim()) || SENSITIVE_NAME.test(name);
 }
 registry.register({
-  id: CHECK_ID9,
+  id: CHECK_ID10,
   name: getCopy("checks.html-form-pii-exposure.name"),
   description: getCopy("checks.html-form-pii-exposure.description"),
   category: "data-exposure",
@@ -7945,7 +8130,7 @@ registry.register({
     return findings;
   }
 });
-var CHECK_ID10 = "security.xss-surface";
+var CHECK_ID11 = "security.xss-surface";
 var CGI_PATH_HINT = new RegExp("(^|[/_-])cgi([/_.-]|$)", "i");
 function isLikelyCgiBashScript(file) {
   return CGI_PATH_HINT.test(file.relativePath);
@@ -8224,7 +8409,7 @@ var QUERIES = {
 };
 registry.register(
   createTreeSitterCheck({
-    id: CHECK_ID10,
+    id: CHECK_ID11,
     nameKey: "checks.xss-surface.name",
     descriptionKey: "checks.xss-surface.description",
     category: "security",
@@ -8239,7 +8424,7 @@ registry.register(
     fileFilter: (file) => file.language !== "bash" || isLikelyCgiBashScript(file)
   })
 );
-var CHECK_ID11 = "security.os-command-injection";
+var CHECK_ID12 = "security.os-command-injection";
 function isStaticShellLikeLiteral(text22) {
   const t = text22.trim();
   if (t.length < 2) return false;
@@ -8369,7 +8554,7 @@ var QUERIES2 = {
 };
 registry.register(
   createTreeSitterCheck({
-    id: CHECK_ID11,
+    id: CHECK_ID12,
     nameKey: "checks.os-command-injection.name",
     descriptionKey: "checks.os-command-injection.description",
     category: "security",
@@ -8386,7 +8571,7 @@ registry.register(
     }
   })
 );
-var CHECK_ID12 = "security.shell-arbitrary-evaluation";
+var CHECK_ID13 = "security.shell-arbitrary-evaluation";
 var QUERY = `
 (command
   name: (command_name (word) @cmd)
@@ -8400,7 +8585,7 @@ var QUERY = `
 `;
 registry.register(
   createTreeSitterCheck({
-    id: CHECK_ID12,
+    id: CHECK_ID13,
     nameKey: "checks.shell-arbitrary-evaluation.name",
     descriptionKey: "checks.shell-arbitrary-evaluation.description",
     category: "security",
@@ -8412,7 +8597,7 @@ registry.register(
     remediationKey: "remediation.security.shell-arbitrary-evaluation"
   })
 );
-var CHECK_ID13 = "security.shell-unescaped-path-deletion";
+var CHECK_ID14 = "security.shell-unescaped-path-deletion";
 var QUERY2 = `
 (command
   name: (command_name (word) @cmd)
@@ -8442,7 +8627,7 @@ var QUERY2 = `
 `;
 registry.register(
   createTreeSitterCheck({
-    id: CHECK_ID13,
+    id: CHECK_ID14,
     nameKey: "checks.shell-unescaped-path-deletion.name",
     descriptionKey: "checks.shell-unescaped-path-deletion.description",
     category: "security",
@@ -8454,7 +8639,7 @@ registry.register(
     remediationKey: "remediation.security.shell-unescaped-path-deletion"
   })
 );
-var CHECK_ID14 = "security.file-inclusion";
+var CHECK_ID15 = "security.file-inclusion";
 var QUERIES3 = {
   php: `
 (include_expression
@@ -8484,7 +8669,7 @@ var QUERIES3 = {
 };
 registry.register(
   createTreeSitterCheck({
-    id: CHECK_ID14,
+    id: CHECK_ID15,
     nameKey: "checks.file-inclusion.name",
     descriptionKey: "checks.file-inclusion.description",
     category: "security",
@@ -8496,7 +8681,7 @@ registry.register(
     remediationKey: "remediation.security.file-inclusion"
   })
 );
-var CHECK_ID15 = "security.open-redirect";
+var CHECK_ID16 = "security.open-redirect";
 var QUERIES4 = {
   php: `
 (function_call_expression
@@ -8666,7 +8851,7 @@ var QUERIES4 = {
 };
 registry.register(
   createTreeSitterCheck({
-    id: CHECK_ID15,
+    id: CHECK_ID16,
     nameKey: "checks.open-redirect.name",
     descriptionKey: "checks.open-redirect.description",
     category: "security",
@@ -8678,7 +8863,7 @@ registry.register(
     remediationKey: "remediation.security.open-redirect"
   })
 );
-var CHECK_ID16 = "security.unsafe-file-upload";
+var CHECK_ID17 = "security.unsafe-file-upload";
 var QUERIES5 = {
   javascript: `
 (call_expression
@@ -8850,7 +9035,7 @@ var QUERIES5 = {
 };
 registry.register(
   createTreeSitterCheck({
-    id: CHECK_ID16,
+    id: CHECK_ID17,
     nameKey: "checks.unsafe-file-upload.name",
     descriptionKey: "checks.unsafe-file-upload.description",
     category: "security",
@@ -8866,7 +9051,7 @@ registry.register(
     }
   })
 );
-var CHECK_ID17 = "security.unsafe-deserialization";
+var CHECK_ID18 = "security.unsafe-deserialization";
 var QUERIES6 = {
   javascript: `
 (call_expression
@@ -9003,7 +9188,7 @@ var QUERIES6 = {
 };
 registry.register(
   createTreeSitterCheck({
-    id: CHECK_ID17,
+    id: CHECK_ID18,
     nameKey: "checks.unsafe-deserialization.name",
     descriptionKey: "checks.unsafe-deserialization.description",
     category: "security",
@@ -9021,7 +9206,7 @@ registry.register(
     }
   })
 );
-var CHECK_ID18 = "security.hardcoded-passwords";
+var CHECK_ID19 = "security.hardcoded-passwords";
 var PASSWORD_NAME_REGEX = /^(\$)?(password|pwd|passwd|secret|pass)$/i;
 var REMEDIATION13 = getCopy("remediation.security.hardcoded-passwords");
 var HTML_CSS_PASSWORD_PATTERNS = [
@@ -9102,7 +9287,7 @@ var QUERIES7 = {
   dockerfile: "((identifier) @name) @match"
 };
 var regexCheck4 = {
-  id: CHECK_ID18,
+  id: CHECK_ID19,
   name: getCopy("checks.hardcoded-passwords.name"),
   description: getCopy("checks.hardcoded-passwords.description"),
   category: "security",
@@ -9127,8 +9312,8 @@ var regexCheck4 = {
             const value = match[2] ?? match[1] ?? "";
             if (match[2] === void 0 && line.toLowerCase().includes('type="password"')) {
               findings.push({
-                id: `${CHECK_ID18}:${file.relativePath}:${lineNum + 1}:${(match.index ?? 0) + 1}:${matchIdx}`,
-                checkId: CHECK_ID18,
+                id: `${CHECK_ID19}:${file.relativePath}:${lineNum + 1}:${(match.index ?? 0) + 1}:${matchIdx}`,
+                checkId: CHECK_ID19,
                 category: "security",
                 severity: "critical",
                 message: getCopy("checks.hardcoded-passwords.message", "password"),
@@ -9143,8 +9328,8 @@ var regexCheck4 = {
             if (!PASSWORD_NAME_REGEX.test(name)) continue;
             if ((value ?? "").trim().length === 0) continue;
             findings.push({
-              id: `${CHECK_ID18}:${file.relativePath}:${lineNum + 1}:${(match.index ?? 0) + 1}:${matchIdx}`,
-              checkId: CHECK_ID18,
+              id: `${CHECK_ID19}:${file.relativePath}:${lineNum + 1}:${(match.index ?? 0) + 1}:${matchIdx}`,
+              checkId: CHECK_ID19,
               category: "security",
               severity: "critical",
               message: getCopy("checks.hardcoded-passwords.message", name),
@@ -9162,7 +9347,7 @@ var regexCheck4 = {
   }
 };
 var treeSitterCheck = createTreeSitterCheck({
-  id: CHECK_ID18,
+  id: CHECK_ID19,
   nameKey: "checks.hardcoded-passwords.name",
   descriptionKey: "checks.hardcoded-passwords.description",
   category: "security",
@@ -9358,7 +9543,7 @@ function isFullHtmlDocument(content) {
 function hasHeadElement(content) {
   return /<head\b/i.test(content);
 }
-var CHECK_ID19 = "security.html-missing-csp";
+var CHECK_ID20 = "security.html-missing-csp";
 var REMEDIATION14 = getCopy("remediation.security.html-missing-csp");
 var META_CSP_PATTERN = /<meta\b[^>]*\bhttp-equiv\s*=\s*["']content-security-policy["'][^>]*>/gi;
 var CSP_CONTENT_PATTERN = /\bcontent\s*=\s*(["'])([\s\S]*?)\1/i;
@@ -9366,7 +9551,7 @@ function firstHtmlAnchor(files) {
   return files.filter((file) => file.language === "html" && !isMechanicalCheckExcludedPath(file.relativePath)).map((file) => file.relativePath).sort()[0];
 }
 registry.register({
-  id: CHECK_ID19,
+  id: CHECK_ID20,
   name: getCopy("checks.html-missing-csp.name"),
   description: getCopy("checks.html-missing-csp.description"),
   category: "security",
@@ -9396,8 +9581,8 @@ registry.register({
         if (/default-src\s+\*|unsafe-inline|unsafe-eval/i.test(cspValue)) {
           const { line, column } = lineAndColumn5(content, match.index ?? 0);
           findings.push({
-            id: `${CHECK_ID19}:${file.relativePath}:${line}:${column}`,
-            checkId: CHECK_ID19,
+            id: `${CHECK_ID20}:${file.relativePath}:${line}:${column}`,
+            checkId: CHECK_ID20,
             category: "security",
             severity: "medium",
             message: getCopy("checks.html-missing-csp.message", "weak Content Security Policy"),
@@ -9414,8 +9599,8 @@ registry.register({
     }
     if (findings.length === 0 && sawFullHtmlDoc && !sawValidMetaCsp) {
       findings.push({
-        id: `${CHECK_ID19}:${anchor}:1:1`,
-        checkId: CHECK_ID19,
+        id: `${CHECK_ID20}:${anchor}:1:1`,
+        checkId: CHECK_ID20,
         category: "security",
         severity: "medium",
         message: getCopy("checks.html-missing-csp.message", "no Content Security Policy found"),
@@ -9429,10 +9614,10 @@ registry.register({
     return findings;
   }
 });
-var CHECK_ID20 = "security.html-static-host-headers";
+var CHECK_ID21 = "security.html-static-host-headers";
 var REMEDIATION15 = getCopy("remediation.security.html-static-host-headers");
 registry.register({
-  id: CHECK_ID20,
+  id: CHECK_ID21,
   name: getCopy("checks.html-static-host-headers.name"),
   description: getCopy("checks.html-static-host-headers.description"),
   category: "security",
@@ -9452,8 +9637,8 @@ registry.register({
     if (!anchor) return [];
     return [
       {
-        id: `${CHECK_ID20}:${anchor}:1:1`,
-        checkId: CHECK_ID20,
+        id: `${CHECK_ID21}:${anchor}:1:1`,
+        checkId: CHECK_ID21,
         category: "security",
         severity: "medium",
         message: getCopy("checks.html-static-host-headers.message", missing.join(", ")),
@@ -9466,7 +9651,7 @@ registry.register({
     ];
   }
 });
-var CHECK_ID21 = "security.html-inline-unsafe-script";
+var CHECK_ID22 = "security.html-inline-unsafe-script";
 var REMEDIATION16 = getCopy("remediation.security.html-inline-unsafe-script");
 var SCRIPT_BLOCK_PATTERN2 = /<script\b([^>]*)>([\s\S]*?)<\/script>/gi;
 var EVENT_HANDLER_PATTERN = /\son[a-z]+\s*=\s*["']([^"']+)["']/gi;
@@ -9523,7 +9708,7 @@ function findEventHandlerMatches(content) {
   return results;
 }
 registry.register({
-  id: CHECK_ID21,
+  id: CHECK_ID22,
   name: getCopy("checks.html-inline-unsafe-script.name"),
   description: getCopy("checks.html-inline-unsafe-script.description"),
   category: "security",
@@ -9538,8 +9723,8 @@ registry.register({
       for (const match of findScriptMatches(content)) {
         const { line, column } = lineAndColumn6(content, match.index);
         findings.push({
-          id: `${CHECK_ID21}:${file.relativePath}:${line}:${column}`,
-          checkId: CHECK_ID21,
+          id: `${CHECK_ID22}:${file.relativePath}:${line}:${column}`,
+          checkId: CHECK_ID22,
           category: "security",
           severity: "high",
           message: getCopy("checks.html-inline-unsafe-script.message", match.text),
@@ -9553,8 +9738,8 @@ registry.register({
       for (const match of findEventHandlerMatches(content)) {
         const { line, column } = lineAndColumn6(content, match.index);
         findings.push({
-          id: `${CHECK_ID21}:${file.relativePath}:${line}:${column}:event`,
-          checkId: CHECK_ID21,
+          id: `${CHECK_ID22}:${file.relativePath}:${line}:${column}:event`,
+          checkId: CHECK_ID22,
           category: "security",
           severity: "high",
           message: getCopy("checks.html-inline-unsafe-script.message", match.text),
@@ -9569,10 +9754,10 @@ registry.register({
     return findings;
   }
 });
-var CHECK_ID22 = "security.html-referrer-leak";
+var CHECK_ID23 = "security.html-referrer-leak";
 var REMEDIATION17 = getCopy("remediation.security.html-referrer-leak");
 registry.register({
-  id: CHECK_ID22,
+  id: CHECK_ID23,
   name: getCopy("checks.html-referrer-leak.name"),
   description: getCopy("checks.html-referrer-leak.description"),
   category: "security",
@@ -9588,8 +9773,8 @@ registry.register({
         if (target.hasRel) continue;
         const { line, column } = lineAndColumn5(content, target.index);
         findings.push({
-          id: `${CHECK_ID22}:${file.relativePath}:${line}:${column}`,
-          checkId: CHECK_ID22,
+          id: `${CHECK_ID23}:${file.relativePath}:${line}:${column}`,
+          checkId: CHECK_ID23,
           category: "security",
           severity: "medium",
           message: getCopy("checks.html-referrer-leak.message", target.text),
@@ -9604,7 +9789,7 @@ registry.register({
     return findings;
   }
 });
-var CHECK_ID23 = "security.html-css-comments-secrets";
+var CHECK_ID24 = "security.html-css-comments-secrets";
 var REMEDIATION18 = getCopy("remediation.security.html-css-comments-secrets");
 var SECRET_MARKER = /(?:api[_-]?key|firebase[_-]?config|google[_-]?api|token|secret|password|private[_-]?key|access[_-]?key)/i;
 var SECRET_VALUE = /(?:[:=]\s*|["'`])([A-Za-z0-9+/=_-]{8,}|sk_[A-Za-z0-9/+=_-]{8,})/i;
@@ -9619,8 +9804,8 @@ function scanPattern(content, filePath, checkPrefix, pattern, messageText, findi
     const value = valueMatch?.[1] ?? text22;
     const { line, column } = lineAndColumn5(content, match.index ?? 0);
     findings.push({
-      id: `${CHECK_ID23}:${filePath}:${line}:${column}:${checkPrefix}`,
-      checkId: CHECK_ID23,
+      id: `${CHECK_ID24}:${filePath}:${line}:${column}:${checkPrefix}`,
+      checkId: CHECK_ID24,
       category: "security",
       severity: "critical",
       message: getCopy("checks.html-css-comments-secrets.message", messageText),
@@ -9633,7 +9818,7 @@ function scanPattern(content, filePath, checkPrefix, pattern, messageText, findi
   }
 }
 registry.register({
-  id: CHECK_ID23,
+  id: CHECK_ID24,
   name: getCopy("checks.html-css-comments-secrets.name"),
   description: getCopy("checks.html-css-comments-secrets.description"),
   category: "security",
@@ -9652,7 +9837,7 @@ registry.register({
     return findings;
   }
 });
-var CHECK_ID24 = "security.css-insecure-import";
+var CHECK_ID25 = "security.css-insecure-import";
 var REMEDIATION19 = getCopy("remediation.security.css-insecure-import");
 var HTTP_URL_PATTERN = /^http:\/\//i;
 var IMPORT_PATTERN = /@import\s+(?:url\(\s*)?(["']?)([^"')\s;]+)\1\s*\)?\s*;/gi;
@@ -9665,8 +9850,8 @@ function lineText(content, index) {
 function pushFinding3(findings, filePath, content, matchText, index) {
   const { line, column } = lineAndColumn5(content, index);
   findings.push({
-    id: `${CHECK_ID24}:${filePath}:${line}:${column}`,
-    checkId: CHECK_ID24,
+    id: `${CHECK_ID25}:${filePath}:${line}:${column}`,
+    checkId: CHECK_ID25,
     category: "security",
     severity: "medium",
     message: getCopy("checks.css-insecure-import.message", matchText),
@@ -9678,7 +9863,7 @@ function pushFinding3(findings, filePath, content, matchText, index) {
   });
 }
 registry.register({
-  id: CHECK_ID24,
+  id: CHECK_ID25,
   name: getCopy("checks.css-insecure-import.name"),
   description: getCopy("checks.css-insecure-import.description"),
   category: "security",
@@ -9705,7 +9890,7 @@ registry.register({
     return findings;
   }
 });
-var CHECK_ID25 = "security.html-mixed-content";
+var CHECK_ID26 = "security.html-mixed-content";
 var REMEDIATION20 = getCopy("remediation.security.html-mixed-content");
 var TAG_RESOURCE_PATTERN = /<(script|link|iframe|img|form|object|embed)\b[^>]*?\b(src|href|action|data)\s*=\s*["'](http:\/\/[^"']+)["'][^>]*?>/gi;
 var STYLE_ATTR_PATTERN = /\bstyle\s*=\s*["']([\s\S]*?http:\/\/[\s\S]*?)["']/gi;
@@ -9714,8 +9899,8 @@ var CSS_URL_PATTERN = /url\(\s*(["']?)(http:\/\/[^"')]+)\1\s*\)/gi;
 function pushFinding4(findings, filePath, content, index, matchText) {
   const { line, column } = lineAndColumn5(content, index);
   findings.push({
-    id: `${CHECK_ID25}:${filePath}:${line}:${column}`,
-    checkId: CHECK_ID25,
+    id: `${CHECK_ID26}:${filePath}:${line}:${column}`,
+    checkId: CHECK_ID26,
     category: "security",
     severity: "medium",
     message: getCopy("checks.html-mixed-content.message", matchText),
@@ -9727,7 +9912,7 @@ function pushFinding4(findings, filePath, content, index, matchText) {
   });
 }
 registry.register({
-  id: CHECK_ID25,
+  id: CHECK_ID26,
   name: getCopy("checks.html-mixed-content.name"),
   description: getCopy("checks.html-mixed-content.description"),
   category: "security",
@@ -9765,7 +9950,7 @@ registry.register({
     return findings;
   }
 });
-var CHECK_ID26 = "security.html-external-asset-integrity";
+var CHECK_ID27 = "security.html-external-asset-integrity";
 var REMEDIATION21 = getCopy("remediation.security.html-external-asset-integrity");
 var SCRIPT_PATTERN = /<script\b[^>]*?\bsrc\s*=\s*["'](https:\/\/[^"']+)["'][^>]*?>/gi;
 var STYLESHEET_PATTERN = /<link\b(?=[^>]*\brel\s*=\s*["'][^"']*\bstylesheet\b[^"']*["'])[^>]*?\bhref\s*=\s*["'](https:\/\/[^"']+)["'][^>]*?>/gi;
@@ -9780,7 +9965,7 @@ function isLocalDevelopmentUrl(rawUrl) {
   }
 }
 registry.register({
-  id: CHECK_ID26,
+  id: CHECK_ID27,
   name: getCopy("checks.html-external-asset-integrity.name"),
   description: getCopy("checks.html-external-asset-integrity.description"),
   category: "security",
@@ -9801,8 +9986,8 @@ registry.register({
         if (hasIntegrity && hasCrossorigin) continue;
         const { line, column } = lineAndColumn5(content, match.index ?? 0);
         findings.push({
-          id: `${CHECK_ID26}:${file.relativePath}:${line}:${column}`,
-          checkId: CHECK_ID26,
+          id: `${CHECK_ID27}:${file.relativePath}:${line}:${column}`,
+          checkId: CHECK_ID27,
           category: "security",
           severity: "medium",
           message: getCopy("checks.html-external-asset-integrity.message", tagText),
@@ -9822,8 +10007,8 @@ registry.register({
         if (hasIntegrity && hasCrossorigin) continue;
         const { line, column } = lineAndColumn5(content, match.index ?? 0);
         findings.push({
-          id: `${CHECK_ID26}:${file.relativePath}:${line}:${column}`,
-          checkId: CHECK_ID26,
+          id: `${CHECK_ID27}:${file.relativePath}:${line}:${column}`,
+          checkId: CHECK_ID27,
           category: "security",
           severity: "medium",
           message: getCopy("checks.html-external-asset-integrity.message", tagText),
@@ -9838,7 +10023,7 @@ registry.register({
     return findings;
   }
 });
-var CHECK_ID27 = "security.html-insecure-form-action";
+var CHECK_ID28 = "security.html-insecure-form-action";
 var REMEDIATION22 = getCopy("remediation.security.html-insecure-form-action");
 var FORM_ACTION_PATTERN = /<form\b[^>]*?\baction\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))[^>]*?>/gi;
 var LOCAL_DEV_URL_PATTERN = /^(?:https?:)?\/\/(?:localhost|127\.0\.0\.1|\[::1\]|::1)(?::\d+)?(?:\/|$)/i;
@@ -9852,7 +10037,7 @@ function lineAndColumn7(content, index) {
   };
 }
 registry.register({
-  id: CHECK_ID27,
+  id: CHECK_ID28,
   name: getCopy("checks.html-insecure-form-action.name"),
   description: getCopy("checks.html-insecure-form-action.description"),
   category: "security",
@@ -9870,8 +10055,8 @@ registry.register({
         if (LOCAL_DEV_URL_PATTERN.test(action)) continue;
         const { line, column } = lineAndColumn7(content, match.index ?? 0);
         findings.push({
-          id: `${CHECK_ID27}:${file.relativePath}:${line}:${column}`,
-          checkId: CHECK_ID27,
+          id: `${CHECK_ID28}:${file.relativePath}:${line}:${column}`,
+          checkId: CHECK_ID28,
           category: "security",
           severity: "medium",
           message: getCopy("checks.html-insecure-form-action.message", match[0] ?? action),
@@ -9886,7 +10071,7 @@ registry.register({
     return findings;
   }
 });
-var CHECK_ID28 = "security.html-iframe-sandbox";
+var CHECK_ID29 = "security.html-iframe-sandbox";
 var REMEDIATION23 = getCopy("remediation.security.html-iframe-sandbox");
 var IFRAME_PATTERN = /<iframe\b[^>]*?>/gi;
 var SRC_PATTERN = /\bsrc\s*=\s*["']([^"']+)["']/i;
@@ -9901,7 +10086,7 @@ function hasSandboxAttribute(tagText) {
   return { present: true, value: match[1] ?? match[2] ?? match[3] ?? "" };
 }
 registry.register({
-  id: CHECK_ID28,
+  id: CHECK_ID29,
   name: getCopy("checks.html-iframe-sandbox.name"),
   description: getCopy("checks.html-iframe-sandbox.description"),
   category: "security",
@@ -9924,8 +10109,8 @@ registry.register({
         if (sandbox.present && !hasBroadEscape) continue;
         const { line, column } = lineAndColumn5(content, match.index ?? 0);
         findings.push({
-          id: `${CHECK_ID28}:${file.relativePath}:${line}:${column}`,
-          checkId: CHECK_ID28,
+          id: `${CHECK_ID29}:${file.relativePath}:${line}:${column}`,
+          checkId: CHECK_ID29,
           category: "security",
           severity: "medium",
           message: getCopy("checks.html-iframe-sandbox.message", tagText),
@@ -9940,7 +10125,7 @@ registry.register({
     return findings;
   }
 });
-var CHECK_ID29 = "security.html-unsafe-embed";
+var CHECK_ID30 = "security.html-unsafe-embed";
 var REMEDIATION24 = getCopy("remediation.security.html-unsafe-embed");
 var OBJECT_PATTERN = /<object\b[^>]*?\bdata\s*=\s*["'](https:\/\/[^"']+)["'][^>]*?>/gi;
 var EMBED_PATTERN = /<embed\b[^>]*?\bsrc\s*=\s*["'](https:\/\/[^"']+)["'][^>]*?>/gi;
@@ -9961,8 +10146,8 @@ function getTypeValue(tagText) {
 function pushFindings(findings, filePath, content, index, tagText) {
   const { line, column } = lineAndColumn8(content, index);
   findings.push({
-    id: `${CHECK_ID29}:${filePath}:${line}:${column}`,
-    checkId: CHECK_ID29,
+    id: `${CHECK_ID30}:${filePath}:${line}:${column}`,
+    checkId: CHECK_ID30,
     category: "security",
     severity: "medium",
     message: getCopy("checks.html-unsafe-embed.message", tagText),
@@ -9974,7 +10159,7 @@ function pushFindings(findings, filePath, content, index, tagText) {
   });
 }
 registry.register({
-  id: CHECK_ID29,
+  id: CHECK_ID30,
   name: getCopy("checks.html-unsafe-embed.name"),
   description: getCopy("checks.html-unsafe-embed.description"),
   category: "security",
@@ -10006,7 +10191,7 @@ registry.register({
     return findings;
   }
 });
-var CHECK_ID30 = "security.html-meta-redirect";
+var CHECK_ID31 = "security.html-meta-redirect";
 var REMEDIATION25 = getCopy("remediation.security.html-meta-redirect");
 var META_REFRESH_PATTERN = /<meta\b[^>]*\bhttp-equiv\s*=\s*["']refresh["'][^>]*>/gi;
 var CONTENT_PATTERN = /\bcontent\s*=\s*["']([^"']+)["']/i;
@@ -10023,7 +10208,7 @@ function parseRefreshContent(value) {
   };
 }
 registry.register({
-  id: CHECK_ID30,
+  id: CHECK_ID31,
   name: getCopy("checks.html-meta-redirect.name"),
   description: getCopy("checks.html-meta-redirect.description"),
   category: "security",
@@ -10046,8 +10231,8 @@ registry.register({
         if (LOCAL_DEV_URL_PATTERN4.test(parsed.url)) continue;
         const { line, column } = lineAndColumn5(content, match.index ?? 0);
         findings.push({
-          id: `${CHECK_ID30}:${file.relativePath}:${line}:${column}`,
-          checkId: CHECK_ID30,
+          id: `${CHECK_ID31}:${file.relativePath}:${line}:${column}`,
+          checkId: CHECK_ID31,
           category: "security",
           severity: "medium",
           message: getCopy("checks.html-meta-redirect.message", tagText),
@@ -10062,7 +10247,7 @@ registry.register({
     return findings;
   }
 });
-var CHECK_ID31 = "security.html-base-tag-hijack";
+var CHECK_ID32 = "security.html-base-tag-hijack";
 var REMEDIATION26 = getCopy("remediation.security.html-base-tag-hijack");
 var BASE_PATTERN = /<base\b[^>]*?>/gi;
 var HREF_PATTERN = /\bhref\s*=\s*["']([^"']+)["']/i;
@@ -10078,7 +10263,7 @@ function isOutsideHead(content, index) {
   return false;
 }
 registry.register({
-  id: CHECK_ID31,
+  id: CHECK_ID32,
   name: getCopy("checks.html-base-tag-hijack.name"),
   description: getCopy("checks.html-base-tag-hijack.description"),
   category: "security",
@@ -10100,8 +10285,8 @@ registry.register({
         if (!externalHref && !targetBlank && !outsideHead) continue;
         const { line, column } = lineAndColumn5(content, match.index ?? 0);
         findings.push({
-          id: `${CHECK_ID31}:${file.relativePath}:${line}:${column}`,
-          checkId: CHECK_ID31,
+          id: `${CHECK_ID32}:${file.relativePath}:${line}:${column}`,
+          checkId: CHECK_ID32,
           category: "security",
           severity: "medium",
           message: getCopy("checks.html-base-tag-hijack.message", tagText),
@@ -10116,12 +10301,12 @@ registry.register({
     return findings;
   }
 });
-var CHECK_ID32 = "security.html-javascript-uri";
+var CHECK_ID33 = "security.html-javascript-uri";
 var REMEDIATION27 = getCopy("remediation.security.html-javascript-uri");
 var TAG_PATTERN = /<(a|form|iframe|object|embed)\b[^>]*?\b(href|action|src|data)\s*=\s*["'](javascript:[^"']+)["'][^>]*?>/gi;
 var VOID_PATTERN = /^javascript:\s*(?:void\s*\(?\s*0\s*\)?)(?:\s*;)?\s*$/i;
 registry.register({
-  id: CHECK_ID32,
+  id: CHECK_ID33,
   name: getCopy("checks.html-javascript-uri.name"),
   description: getCopy("checks.html-javascript-uri.description"),
   category: "security",
@@ -10139,8 +10324,8 @@ registry.register({
         if (VOID_PATTERN.test(jsUrl)) continue;
         const { line, column } = lineAndColumn5(content, match.index ?? 0);
         findings.push({
-          id: `${CHECK_ID32}:${file.relativePath}:${line}:${column}`,
-          checkId: CHECK_ID32,
+          id: `${CHECK_ID33}:${file.relativePath}:${line}:${column}`,
+          checkId: CHECK_ID33,
           category: "security",
           severity: "low",
           message: getCopy("checks.html-javascript-uri.message", tagText),
@@ -10155,7 +10340,7 @@ registry.register({
     return findings;
   }
 });
-var CHECK_ID33 = "security.html-import-map-integrity";
+var CHECK_ID34 = "security.html-import-map-integrity";
 var REMEDIATION28 = getCopy("remediation.security.html-import-map-integrity");
 var IMPORTMAP_SCRIPT_PATTERN = /<script\b[^>]*\btype\s*=\s*["']importmap["'][^>]*>([\s\S]*?)<\/script>/gi;
 var IMPORTMAP_SRC_PATTERN = /<script\b[^>]*\btype\s*=\s*["']importmap["'][^>]*\bsrc\s*=\s*["']([^"']+)["'][^>]*>/gi;
@@ -10176,8 +10361,8 @@ function isExternalUrl(value) {
 function pushFinding5(findings, filePath, content, index, matchText) {
   const { line, column } = lineAndColumn9(content, index);
   findings.push({
-    id: `${CHECK_ID33}:${filePath}:${line}:${column}`,
-    checkId: CHECK_ID33,
+    id: `${CHECK_ID34}:${filePath}:${line}:${column}`,
+    checkId: CHECK_ID34,
     category: "security",
     severity: "medium",
     message: getCopy("checks.html-import-map-integrity.message", matchText),
@@ -10202,7 +10387,7 @@ function scanImportMapValue(findings, filePath, content, value, contextLabel, in
   }
 }
 registry.register({
-  id: CHECK_ID33,
+  id: CHECK_ID34,
   name: getCopy("checks.html-import-map-integrity.name"),
   description: getCopy("checks.html-import-map-integrity.description"),
   category: "security",
@@ -10235,7 +10420,7 @@ registry.register({
     return findings;
   }
 });
-var CHECK_ID34 = "security.css-data-exfiltration";
+var CHECK_ID35 = "security.css-data-exfiltration";
 var REMEDIATION29 = getCopy("remediation.security.css-data-exfiltration");
 var ATTR_SELECTOR_PATTERN = /\[[^\]]*(?:value|type|name|email|tel|address|cc-number|cc-exp)[^\]]*(?:\^=|\$=|\*=|~=|\|=)[^\]]*\]/i;
 var EXTERNAL_HTTP_URL_PATTERN = /url\(\s*(["']?)http:\/\/[^"')]+\1\s*\)/i;
@@ -10253,8 +10438,8 @@ function lineAndColumn10(content, index) {
 function pushFinding6(findings, filePath, content, index, matchText) {
   const { line, column } = lineAndColumn10(content, index);
   findings.push({
-    id: `${CHECK_ID34}:${filePath}:${line}:${column}`,
-    checkId: CHECK_ID34,
+    id: `${CHECK_ID35}:${filePath}:${line}:${column}`,
+    checkId: CHECK_ID35,
     category: "security",
     severity: "medium",
     message: getCopy("checks.css-data-exfiltration.message", matchText),
@@ -10275,7 +10460,7 @@ function scanCss(findings, filePath, scanContent, originalContent, offset = 0) {
   }
 }
 registry.register({
-  id: CHECK_ID34,
+  id: CHECK_ID35,
   name: getCopy("checks.css-data-exfiltration.name"),
   description: getCopy("checks.css-data-exfiltration.description"),
   category: "security",
@@ -10307,7 +10492,7 @@ registry.register({
     return findings;
   }
 });
-var CHECK_ID35 = "security.css-external-font-integrity";
+var CHECK_ID36 = "security.css-external-font-integrity";
 var REMEDIATION30 = getCopy("remediation.security.css-external-font-integrity");
 var FONT_FACE_PATTERN = /@font-face\b[\s\S]*?\}/gi;
 var URL_PATTERN = /url\(\s*(["']?)([^"')]+)\1\s*\)/gi;
@@ -10339,7 +10524,7 @@ function isPublicCdnFont(url) {
   }
 }
 registry.register({
-  id: CHECK_ID35,
+  id: CHECK_ID36,
   name: getCopy("checks.css-external-font-integrity.name"),
   description: getCopy("checks.css-external-font-integrity.description"),
   category: "security",
@@ -10360,8 +10545,8 @@ registry.register({
           if (!isPublicCdnFont(url)) continue;
           const { line, column } = lineAndColumn11(content, face.index ?? 0);
           findings.push({
-            id: `${CHECK_ID35}:${file.relativePath}:${line}:${column}`,
-            checkId: CHECK_ID35,
+            id: `${CHECK_ID36}:${file.relativePath}:${line}:${column}`,
+            checkId: CHECK_ID36,
             category: "security",
             severity: "medium",
             message: getCopy("checks.css-external-font-integrity.message", match[0] ?? url),
@@ -10377,7 +10562,7 @@ registry.register({
     return findings;
   }
 });
-var CHECK_ID36 = "security.insecure-random";
+var CHECK_ID37 = "security.insecure-random";
 var QUERIES8 = {
   javascript: `
 (call_expression
@@ -10446,7 +10631,7 @@ var QUERIES8 = {
 };
 registry.register(
   createTreeSitterCheck({
-    id: CHECK_ID36,
+    id: CHECK_ID37,
     nameKey: "checks.insecure-random.name",
     descriptionKey: "checks.insecure-random.description",
     category: "security",
@@ -10458,7 +10643,7 @@ registry.register(
     remediationKey: "remediation.security.insecure-random"
   })
 );
-var CHECK_ID37 = "security.weak-key-entropy";
+var CHECK_ID38 = "security.weak-key-entropy";
 var REMEDIATION31 = getCopy("remediation.security.weak-key-entropy");
 var RANDOM_BYTES_PATTERN = /randomBytes\s*\(\s*(\d+)\s*\)/g;
 var WEAK_KEY_CONTEXT = /(?:key|token|secret|id|license|password|session|csrf|nonce|salt|iv)/i;
@@ -10471,7 +10656,7 @@ function lineAndColumn12(content, index) {
   };
 }
 registry.register({
-  id: CHECK_ID37,
+  id: CHECK_ID38,
   name: getCopy("checks.weak-key-entropy.name"),
   description: getCopy("checks.weak-key-entropy.description"),
   category: "security",
@@ -10493,8 +10678,8 @@ registry.register({
         if (!WEAK_KEY_CONTEXT.test(lineContent) && !WEAK_KEY_CONTEXT.test(content.slice(Math.max(0, matchIndex - 200), matchIndex))) continue;
         const { line, column } = lineAndColumn12(content, matchIndex);
         findings.push({
-          id: `${CHECK_ID37}:${file.relativePath}:${line}:${column}`,
-          checkId: CHECK_ID37,
+          id: `${CHECK_ID38}:${file.relativePath}:${line}:${column}`,
+          checkId: CHECK_ID38,
           category: "security",
           severity: "high",
           message: getCopy("checks.weak-key-entropy.message", match[0], String(byteCount)),
@@ -10509,7 +10694,7 @@ registry.register({
     return findings;
   }
 });
-var CHECK_ID38 = "security.insecure-api-url-default";
+var CHECK_ID39 = "security.insecure-api-url-default";
 var REMEDIATION32 = getCopy("remediation.security.insecure-api-url-default");
 var HTTP_URL_DEFAULT_PATTERN = /(?:['"`])(https?:\/\/[^\s'"`]+)(?:['"`])/g;
 var API_CONTEXT = /(?:api[_-]?url|base[_-]?url|endpoint|server|host|webhook|resend|paddle|stripe|sendgrid|mailgun|postmark)/i;
@@ -10524,7 +10709,7 @@ function lineAndColumn13(content, index) {
   };
 }
 registry.register({
-  id: CHECK_ID38,
+  id: CHECK_ID39,
   name: getCopy("checks.insecure-api-url-default.name"),
   description: getCopy("checks.insecure-api-url-default.description"),
   category: "security",
@@ -10549,8 +10734,8 @@ registry.register({
         if (!isEnvDefault && !API_CONTEXT.test(matchLine)) continue;
         const { line, column } = lineAndColumn13(content, matchIndex);
         findings.push({
-          id: `${CHECK_ID38}:${file.relativePath}:${line}:${column}`,
-          checkId: CHECK_ID38,
+          id: `${CHECK_ID39}:${file.relativePath}:${line}:${column}`,
+          checkId: CHECK_ID39,
           category: "security",
           severity: "high",
           message: getCopy("checks.insecure-api-url-default.message", url),
@@ -10565,7 +10750,7 @@ registry.register({
     return findings;
   }
 });
-var CHECK_ID39 = "security.dynamic-sql-columns";
+var CHECK_ID40 = "security.dynamic-sql-columns";
 var REMEDIATION33 = getCopy("remediation.security.dynamic-sql-columns");
 var SQL_SET_INTERPOLATION = /\bSET\s+.*\$\{[^}]*\}/gis;
 var SQL_SET_TEMPLATE = /\bSET\s+.*`[^`]*\$\{[^}]*\}[^`]*`/gis;
@@ -10579,7 +10764,7 @@ function lineAndColumn14(content, index) {
   };
 }
 registry.register({
-  id: CHECK_ID39,
+  id: CHECK_ID40,
   name: getCopy("checks.dynamic-sql-columns.name"),
   description: getCopy("checks.dynamic-sql-columns.description"),
   category: "security",
@@ -10600,11 +10785,11 @@ registry.register({
         for (const match of content.matchAll(regex)) {
           const matchIndex = match.index ?? 0;
           const { line, column } = lineAndColumn14(content, matchIndex);
-          const dedupKey = `${CHECK_ID39}:${file.relativePath}:${line}`;
+          const dedupKey = `${CHECK_ID40}:${file.relativePath}:${line}`;
           if (findings.some((f) => f.id === dedupKey)) continue;
           findings.push({
             id: dedupKey,
-            checkId: CHECK_ID39,
+            checkId: CHECK_ID40,
             category: "security",
             severity: "medium",
             message: getCopy("checks.dynamic-sql-columns.message", label),
@@ -10620,7 +10805,7 @@ registry.register({
     return findings;
   }
 });
-var CHECK_ID40 = "security.weak-email-validation";
+var CHECK_ID41 = "security.weak-email-validation";
 var REMEDIATION34 = getCopy("remediation.security.weak-email-validation");
 var WEAK_EMAIL_REGEX_LINE = /\/\^[^/]*@[^/]*\\\.[^/]{0,4}\$\/[gimsuy]*/g;
 var LOOSE_REGEX_CLASS = /\[\^?\\?s@\]\+@\[\^?\\?s@\]\+\\\.\[\^?\\?s@\]\+/g;
@@ -10634,7 +10819,7 @@ function lineAndColumn15(content, index) {
   };
 }
 registry.register({
-  id: CHECK_ID40,
+  id: CHECK_ID41,
   name: getCopy("checks.weak-email-validation.name"),
   description: getCopy("checks.weak-email-validation.description"),
   category: "security",
@@ -10655,11 +10840,11 @@ registry.register({
         for (const match of content.matchAll(regex)) {
           const matchIndex = match.index ?? 0;
           const { line, column } = lineAndColumn15(content, matchIndex);
-          const dedupKey = `${CHECK_ID40}:${file.relativePath}:${line}`;
+          const dedupKey = `${CHECK_ID41}:${file.relativePath}:${line}`;
           if (findings.some((f) => f.id === dedupKey)) continue;
           findings.push({
             id: dedupKey,
-            checkId: CHECK_ID40,
+            checkId: CHECK_ID41,
             category: "security",
             severity: "medium",
             message: getCopy("checks.weak-email-validation.message", `${match[0]} (${label})`),
@@ -10675,7 +10860,7 @@ registry.register({
     return findings;
   }
 });
-var CHECK_ID41 = "security.idempotency-key-leak";
+var CHECK_ID42 = "security.idempotency-key-leak";
 var REMEDIATION35 = getCopy("remediation.security.idempotency-key-leak");
 var IDEMPOTENCY_CONTEXT = /idempotency[_-]?key|idempotency[_-]?token/i;
 var TEMPLATE_LITERAL_INTERPOLATION = new RegExp("`[^`]*\\$\\{[^}]+\\}[^`]*`", "g");
@@ -10689,7 +10874,7 @@ function lineAndColumn16(content, index) {
   };
 }
 registry.register({
-  id: CHECK_ID41,
+  id: CHECK_ID42,
   name: getCopy("checks.idempotency-key-leak.name"),
   description: getCopy("checks.idempotency-key-leak.description"),
   category: "security",
@@ -10708,11 +10893,11 @@ registry.register({
         if (!STRUCTURED_ID_PATTERN.test(templateStr)) continue;
         const matchIndex = match.index ?? 0;
         const { line, column } = lineAndColumn16(content, matchIndex);
-        const dedupKey = `${CHECK_ID41}:${file.relativePath}:${line}`;
+        const dedupKey = `${CHECK_ID42}:${file.relativePath}:${line}`;
         if (findings.some((f) => f.id === dedupKey)) continue;
         findings.push({
           id: dedupKey,
-          checkId: CHECK_ID41,
+          checkId: CHECK_ID42,
           category: "security",
           severity: "medium",
           message: getCopy("checks.idempotency-key-leak.message", templateStr.slice(0, 80)),
@@ -10727,7 +10912,7 @@ registry.register({
     return findings;
   }
 });
-var CHECK_ID42 = "data-exposure.plaintext-secret-in-email";
+var CHECK_ID43 = "data-exposure.plaintext-secret-in-email";
 var REMEDIATION36 = getCopy("remediation.data-exposure.plaintext-secret-in-email");
 var EMAIL_FILE_PATTERN = /email|mail|notify|notification/i;
 var SECRET_IN_TEXT_PATTERN = /(?:license[_-]?key|api[_-]?key|secret[_-]?key|token|password|auth[_-]?code|verification[_-]?code)\b/i;
@@ -10741,7 +10926,7 @@ function lineAndColumn17(content, index) {
   };
 }
 registry.register({
-  id: CHECK_ID42,
+  id: CHECK_ID43,
   name: getCopy("checks.plaintext-secret-in-email.name"),
   description: getCopy("checks.plaintext-secret-in-email.description"),
   category: "data-exposure",
@@ -10763,8 +10948,8 @@ registry.register({
         const { line: lineNum, column } = lineAndColumn17(content, lineIndex);
         const secretMatch = SECRET_IN_TEXT_PATTERN.exec(lineText2);
         findings.push({
-          id: `${CHECK_ID42}:${file.relativePath}:${lineNum}:${column}`,
-          checkId: CHECK_ID42,
+          id: `${CHECK_ID43}:${file.relativePath}:${lineNum}:${column}`,
+          checkId: CHECK_ID43,
           category: "data-exposure",
           severity: "medium",
           message: getCopy("checks.plaintext-secret-in-email.message", secretMatch?.[0] ?? "secret"),
@@ -12974,7 +13159,7 @@ registry.register(
     attribution: "CWE-94"
   })
 );
-var CHECK_ID43 = "security.missing-csrf-protection";
+var CHECK_ID44 = "security.missing-csrf-protection";
 var CSRF_MARKERS = /\bcsrf\b|xsrf|csrfmiddlewaretoken|double[\s-]submit[\s-]cookie|csurf\b|cookie-parser.*csrf|protect_from_forgery|verify_authenticity_token/i;
 var QUERIES9 = {
   php: `
@@ -13031,7 +13216,7 @@ async function hasProjectCsrfProtection(files) {
   return false;
 }
 var check = {
-  id: CHECK_ID43,
+  id: CHECK_ID44,
   name: resolveCopy3("checks.missing-csrf-protection.name"),
   description: resolveCopy3("checks.missing-csrf-protection.description"),
   category: "security",
@@ -13071,8 +13256,8 @@ var check = {
       const sample = eligible.find((f) => f.language === lang);
       if (!sample) continue;
       findings.push({
-        id: `${CHECK_ID43}:${sample.relativePath}:degraded:${lang}`,
-        checkId: CHECK_ID43,
+        id: `${CHECK_ID44}:${sample.relativePath}:degraded:${lang}`,
+        checkId: CHECK_ID44,
         category: "security",
         severity: "info",
         message: resolveCopy3("checks.missing-csrf-protection.degraded", sample.relativePath, lang),
@@ -13093,8 +13278,8 @@ var check = {
       handlerCount > 1 ? `${handlerCount} state-changing handlers (e.g. ${exampleRoute})` : exampleRoute
     );
     const finding = {
-      id: `${CHECK_ID43}:project:${anchor.relativePath}:1`,
-      checkId: CHECK_ID43,
+      id: `${CHECK_ID44}:project:${anchor.relativePath}:1`,
+      checkId: CHECK_ID44,
       category: "security",
       severity: "medium",
       message,
@@ -13109,7 +13294,7 @@ var check = {
   }
 };
 registry.register(check);
-var CHECK_ID44 = "security.weak-session-id";
+var CHECK_ID45 = "security.weak-session-id";
 var QUERIES10 = {
   php: `
 (function_call_expression
@@ -13196,7 +13381,7 @@ var QUERIES10 = {
 };
 registry.register(
   createTreeSitterCheck({
-    id: CHECK_ID44,
+    id: CHECK_ID45,
     nameKey: "checks.weak-session-id.name",
     descriptionKey: "checks.weak-session-id.description",
     category: "security",
@@ -13214,7 +13399,7 @@ registry.register(
     }
   })
 );
-var CHECK_ID45 = "security.rails-mass-assignment";
+var CHECK_ID46 = "security.rails-mass-assignment";
 var QUERIES11 = {
   ruby: `
 (call
@@ -13237,7 +13422,7 @@ var QUERIES11 = {
 };
 registry.register(
   createTreeSitterCheck({
-    id: CHECK_ID45,
+    id: CHECK_ID46,
     nameKey: "checks.rails-mass-assignment.name",
     descriptionKey: "checks.rails-mass-assignment.description",
     category: "security",
@@ -13249,7 +13434,7 @@ registry.register(
     remediationKey: "remediation.security.rails-mass-assignment"
   })
 );
-var CHECK_ID46 = "security.rails-insecure-session-config";
+var CHECK_ID47 = "security.rails-insecure-session-config";
 var REMEDIATION37 = getCopy("remediation.security.rails-insecure-session-config");
 var SESSION_STORE_PATH = /config\/initializers\/session_store\.rb$/;
 function hasSecureFlag(content) {
@@ -13262,7 +13447,7 @@ function hasSameSiteFlag(content) {
   return /\bsame_site:\s*:(strict|lax)\b/.test(content);
 }
 registry.register({
-  id: CHECK_ID46,
+  id: CHECK_ID47,
   name: getCopy("checks.rails-insecure-session-config.name"),
   description: getCopy("checks.rails-insecure-session-config.description"),
   category: "security",
@@ -13282,8 +13467,8 @@ registry.register({
       if (!hasSameSiteFlag(content)) missing.push("same_site: :strict or :lax");
       if (missing.length > 0) {
         findings.push({
-          id: `${CHECK_ID46}:${file.relativePath}:1`,
-          checkId: CHECK_ID46,
+          id: `${CHECK_ID47}:${file.relativePath}:1`,
+          checkId: CHECK_ID47,
           category: "security",
           severity: "medium",
           message: getCopy(
@@ -13300,7 +13485,7 @@ registry.register({
     return findings;
   }
 });
-var CHECK_ID47 = "security.xxe-surface";
+var CHECK_ID48 = "security.xxe-surface";
 var LIBXML_PARSE_QUERY = `
 (call_expression
   function: (member_expression
@@ -13347,7 +13532,7 @@ var QUERIES12 = {
 };
 registry.register(
   createTreeSitterCheck({
-    id: CHECK_ID47,
+    id: CHECK_ID48,
     nameKey: "checks.xxe-surface.name",
     descriptionKey: "checks.xxe-surface.description",
     category: "security",
@@ -13546,12 +13731,13 @@ registry.register({
     return runLLMCheck(ctx, promptTemplate22);
   }
 });
-var PROMPT_VERSION23 = "1.0.0";
+var PROMPT_VERSION23 = "1.1.0";
 var fallbackPatterns23 = [
   {
     regex: /while\s*\(\s*(?:true|1)\s*\)|while\s+True\s*:/i,
     message: "Infinite loop found \u2014 verify retry logic has a maximum attempt limit",
-    severity: "medium"
+    severity: "medium",
+    skipCommentLines: true
   }
 ];
 async function buildPrompt23(sourceFiles) {
@@ -13613,12 +13799,13 @@ registry.register({
     return [...bashFindings, ...llmFindings];
   }
 });
-var PROMPT_VERSION24 = "1.1.0";
+var PROMPT_VERSION24 = "1.2.0";
 var fallbackPatterns24 = [
   {
     regex: /console\.(?:log|error|warn)\b/,
     message: "Unstructured logging detected \u2014 verify observability hooks are present",
-    severity: "medium"
+    severity: "medium",
+    skipCommentLines: true
   }
 ];
 async function buildPrompt24(sourceFiles) {
@@ -13841,12 +14028,13 @@ registry.register({
     return runLLMCheck(ctx, promptTemplate27);
   }
 });
-var PROMPT_VERSION28 = "1.0.0";
+var PROMPT_VERSION28 = "1.1.0";
 var fallbackPatterns28 = [
   {
     regex: /\b(?:fingerprint|deviceId|visitorId|trackingId|correlationId|analyticsId)\b/i,
     message: "Derived identifier may link records across sessions or users",
-    severity: "medium"
+    severity: "medium",
+    skipCommentLines: true
   },
   {
     regex: /\bhash\s*\(\s*(?:email|phone|userId|id)\s*\)/i,
@@ -13880,15 +14068,64 @@ var promptTemplate28 = {
   parseResponse: parseResponse28,
   fallbackPatterns: fallbackPatterns28
 };
+var CHECK_ID49 = "data-exposure.derived-identifiers";
+var DERIVED_ID_REGEX = /\b(?:fingerprint|device.?id|visitor.?id|tracking.?id|correlation.?id|analytics.?id)\b/i;
+var DERIVED_TS_QUERIES = {
+  javascript: `
+(lexical_declaration (variable_declarator name: (identifier) @name)) @match
+(pair key: (property_identifier) @name) @match
+(assignment_expression left: (identifier) @name) @match
+`,
+  typescript: `
+(lexical_declaration (variable_declarator name: (identifier) @name)) @match
+(pair key: (property_identifier) @name) @match
+(property_signature name: (property_identifier) @name) @match
+`,
+  tsx: `
+(lexical_declaration (variable_declarator name: (identifier) @name)) @match
+(pair key: (property_identifier) @name) @match
+(property_signature name: (property_identifier) @name) @match
+`,
+  go: `
+(short_var_declaration left: (expression_list (identifier) @name)) @match
+(var_declaration (var_spec name: (identifier) @name)) @match
+`,
+  python: `
+(assignment left: (identifier) @name) @match
+`,
+  java: `
+(local_variable_declaration declarator: (variable_declarator name: (identifier) @name)) @match
+(field_declaration declarator: (variable_declarator name: (identifier) @name)) @match
+`
+};
+var derivedIdAstCheck = createTreeSitterCheck({
+  id: CHECK_ID49,
+  nameKey: "checks.derived-identifiers.name",
+  descriptionKey: "checks.derived-identifiers.description",
+  category: "data-exposure",
+  severity: "medium",
+  minTier: "pro",
+  queries: DERIVED_TS_QUERIES,
+  messageKey: "checks.derived-identifiers.message",
+  degradedMessageKey: "checks.derived-identifiers.degraded",
+  remediationKey: "remediation.data-exposure.derived-identifiers",
+  fileFilter: (file) => !isMechanicalCheckExcludedPath(file.relativePath),
+  matchFilter: (captures) => DERIVED_ID_REGEX.test(captures.name ?? ""),
+  messageFactory: (captures) => getCopy("checks.derived-identifiers.message", captures.name ?? "unknown")
+});
 registry.register({
-  id: "data-exposure.derived-identifiers",
+  id: CHECK_ID49,
   name: getCopy("checks.derived-identifiers.name"),
   description: getCopy("checks.derived-identifiers.description"),
   category: "data-exposure",
   severity: "medium",
   minTier: "pro",
   async run(ctx) {
-    return runLLMCheck(ctx, promptTemplate28);
+    const [llmFindings, astFindings] = await Promise.all([
+      runLLMCheck(ctx, promptTemplate28),
+      derivedIdAstCheck.run(ctx)
+    ]);
+    return mergeFindings(astFindings, llmFindings);
   }
 });
 var PROMPT_VERSION29 = "1.0.0";
@@ -13954,12 +14191,12 @@ registry.register({
     return [...bashFindings, ...llmFindings];
   }
 });
-var CHECK_ID48 = "security.permissive-grants";
+var CHECK_ID50 = "security.permissive-grants";
 var GRANT_PATTERN = /\bgrant\s+(?:all|all\s+privileges|select|insert|update|delete|usage|execute)\b[\s\S]*?\bto\s+(?:public|anon|anonymous|guest)\b/gi;
 var ALTER_DEFAULT_PRIVILEGES_PATTERN = /\balter\s+default\s+privileges\b[\s\S]*?\bgrant\s+[\s\S]*?\bto\s+(?:public|anon|anonymous|guest)\b/gi;
 var REMEDIATION38 = getCopy("remediation.security.permissive-grants");
 var permissiveGrantsCheck = {
-  id: CHECK_ID48,
+  id: CHECK_ID50,
   name: getCopy("checks.permissive-grants.name"),
   description: getCopy("checks.permissive-grants.description"),
   category: "security",
@@ -13976,8 +14213,8 @@ var permissiveGrantsCheck = {
         const beforeMatch = content.slice(0, match.index);
         const lineNum = beforeMatch.split("\n").length;
         findings.push({
-          id: `${CHECK_ID48}:${file.relativePath}:${lineNum}:1`,
-          checkId: CHECK_ID48,
+          id: `${CHECK_ID50}:${file.relativePath}:${lineNum}:1`,
+          checkId: CHECK_ID50,
           category: "security",
           severity: "high",
           message: getCopy("checks.permissive-grants.message", match[0].trim()),
@@ -13994,8 +14231,8 @@ var permissiveGrantsCheck = {
         const beforeMatch = content.slice(0, altMatch.index);
         const lineNum = beforeMatch.split("\n").length;
         findings.push({
-          id: `${CHECK_ID48}:${file.relativePath}:${lineNum}:1`,
-          checkId: CHECK_ID48,
+          id: `${CHECK_ID50}:${file.relativePath}:${lineNum}:1`,
+          checkId: CHECK_ID50,
           category: "security",
           severity: "high",
           message: getCopy("checks.permissive-grants.message", altMatch[0].trim()),
@@ -14035,10 +14272,10 @@ function classifySqlDialect(content) {
   }
   return "unknown";
 }
-var CHECK_ID49 = "security.sql-rls-static";
+var CHECK_ID51 = "security.sql-rls-static";
 var REMEDIATION39 = getCopy("remediation.security.sql-rls-static");
 var sqlRlsStaticCheck = {
-  id: CHECK_ID49,
+  id: CHECK_ID51,
   name: getCopy("checks.sql-rls-static.name"),
   description: getCopy("checks.sql-rls-static.description"),
   category: "security",
@@ -14093,8 +14330,8 @@ var sqlRlsStaticCheck = {
         const isRlsEnabled = enabledTables.has(table.name);
         if (!isRlsEnabled) {
           findings.push({
-            id: `${CHECK_ID49}:${file.relativePath}:${table.line}:1:missing-rls`,
-            checkId: CHECK_ID49,
+            id: `${CHECK_ID51}:${file.relativePath}:${table.line}:1:missing-rls`,
+            checkId: CHECK_ID51,
             category: "security",
             severity: "high",
             message: getCopy("checks.sql-rls-static.message", `Table "${table.name}" contains tenant columns but Row-Level Security is not enabled.`),
@@ -14108,8 +14345,8 @@ var sqlRlsStaticCheck = {
         const isRlsForced = forcedTables.has(table.name);
         if (!isRlsForced) {
           findings.push({
-            id: `${CHECK_ID49}:${file.relativePath}:${table.line}:1:missing-force-rls`,
-            checkId: CHECK_ID49,
+            id: `${CHECK_ID51}:${file.relativePath}:${table.line}:1:missing-force-rls`,
+            checkId: CHECK_ID51,
             category: "security",
             severity: "high",
             message: getCopy("checks.sql-rls-static.message", `Table "${table.name}" has Row-Level Security enabled but lacks FORCE ROW LEVEL SECURITY, creating tenant bypass risks for table owners.`),
@@ -14133,8 +14370,8 @@ var sqlRlsStaticCheck = {
           const beforeMatch = content.slice(0, policyMatch.index);
           const lineNum = beforeMatch.split("\n").length;
           findings.push({
-            id: `${CHECK_ID49}:${file.relativePath}:${lineNum}:1:weak-policy`,
-            checkId: CHECK_ID49,
+            id: `${CHECK_ID51}:${file.relativePath}:${lineNum}:1:weak-policy`,
+            checkId: CHECK_ID51,
             category: "security",
             severity: "high",
             message: getCopy("checks.sql-rls-static.message", `Policy ${policyName} on table "${tableName}" uses an unrestrictive tautology (like true or 1=1).`),
@@ -14152,10 +14389,10 @@ var sqlRlsStaticCheck = {
   }
 };
 registry.register(sqlRlsStaticCheck);
-var CHECK_ID50 = "security.sql-security-definer-search-path";
+var CHECK_ID52 = "security.sql-security-definer-search-path";
 var REMEDIATION40 = getCopy("remediation.security.sql-security-definer-search-path");
 var sqlSecurityDefinerSearchPathCheck = {
-  id: CHECK_ID50,
+  id: CHECK_ID52,
   name: getCopy("checks.sql-security-definer-search-path.name"),
   description: getCopy("checks.sql-security-definer-search-path.description"),
   category: "security",
@@ -14181,8 +14418,8 @@ var sqlSecurityDefinerSearchPathCheck = {
             const beforeMatch = content.slice(0, match.index);
             const lineNum = beforeMatch.split("\n").length;
             findings.push({
-              id: `${CHECK_ID50}:${file.relativePath}:${lineNum}:1`,
-              checkId: CHECK_ID50,
+              id: `${CHECK_ID52}:${file.relativePath}:${lineNum}:1`,
+              checkId: CHECK_ID52,
               category: "security",
               severity: "high",
               message: getCopy("checks.sql-security-definer-search-path.message", `Function "${functionName}" is defined as SECURITY DEFINER but is missing a locked search_path.`),
@@ -14201,7 +14438,7 @@ var sqlSecurityDefinerSearchPathCheck = {
   }
 };
 registry.register(sqlSecurityDefinerSearchPathCheck);
-var CHECK_ID51 = "resilience.missing-transaction-guard";
+var CHECK_ID53 = "resilience.missing-transaction-guard";
 var REMEDIATION41 = getCopy("remediation.resilience.missing-transaction-guard");
 var MUTATION_KEYWORDS = [
   /\binsert\s+into\b/i,
@@ -14214,7 +14451,7 @@ var MUTATION_KEYWORDS = [
   /\bcreate\s+table\s+\w+\s+as\b/i
 ];
 var missingTransactionGuardCheck = {
-  id: CHECK_ID51,
+  id: CHECK_ID53,
   name: getCopy("checks.missing-transaction-guard.name"),
   description: getCopy("checks.missing-transaction-guard.description"),
   category: "resilience",
@@ -14244,8 +14481,8 @@ var missingTransactionGuardCheck = {
       }
       if (mutationCount > 5) {
         findings.push({
-          id: `${CHECK_ID51}:${file.relativePath}:1:1`,
-          checkId: CHECK_ID51,
+          id: `${CHECK_ID53}:${file.relativePath}:1:1`,
+          checkId: CHECK_ID53,
           category: "resilience",
           severity: "medium",
           message: getCopy("checks.missing-transaction-guard.message"),
@@ -14260,10 +14497,10 @@ var missingTransactionGuardCheck = {
   }
 };
 registry.register(missingTransactionGuardCheck);
-var CHECK_ID52 = "resilience.destructive-sql-migration";
+var CHECK_ID54 = "resilience.destructive-sql-migration";
 var REMEDIATION42 = getCopy("remediation.resilience.destructive-sql-migration");
 var destructiveSqlMigrationCheck = {
-  id: CHECK_ID52,
+  id: CHECK_ID54,
   name: getCopy("checks.destructive-sql-migration.name"),
   description: getCopy("checks.destructive-sql-migration.description"),
   category: "resilience",
@@ -14284,8 +14521,8 @@ var destructiveSqlMigrationCheck = {
         const highMatch = highRiskRegex.exec(line);
         if (highMatch) {
           findings.push({
-            id: `${CHECK_ID52}:${file.relativePath}:${lineNum + 1}:${(highMatch.index ?? 0) + 1}:high`,
-            checkId: CHECK_ID52,
+            id: `${CHECK_ID54}:${file.relativePath}:${lineNum + 1}:${(highMatch.index ?? 0) + 1}:high`,
+            checkId: CHECK_ID54,
             category: "resilience",
             severity: "high",
             message: getCopy("checks.destructive-sql-migration.message", highMatch[0]),
@@ -14298,8 +14535,8 @@ var destructiveSqlMigrationCheck = {
         const truncateMatch = truncateRegex.exec(line);
         if (truncateMatch) {
           findings.push({
-            id: `${CHECK_ID52}:${file.relativePath}:${lineNum + 1}:${(truncateMatch.index ?? 0) + 1}:high`,
-            checkId: CHECK_ID52,
+            id: `${CHECK_ID54}:${file.relativePath}:${lineNum + 1}:${(truncateMatch.index ?? 0) + 1}:high`,
+            checkId: CHECK_ID54,
             category: "resilience",
             severity: "high",
             message: getCopy("checks.destructive-sql-migration.message", truncateMatch[0]),
@@ -14315,8 +14552,8 @@ var destructiveSqlMigrationCheck = {
         const colMatch = dropColumnRegex.exec(line);
         if (colMatch) {
           findings.push({
-            id: `${CHECK_ID52}:${file.relativePath}:${lineNum + 1}:${(colMatch.index ?? 0) + 1}:col`,
-            checkId: CHECK_ID52,
+            id: `${CHECK_ID54}:${file.relativePath}:${lineNum + 1}:${(colMatch.index ?? 0) + 1}:col`,
+            checkId: CHECK_ID54,
             category: "resilience",
             severity: "medium",
             message: getCopy("checks.destructive-sql-migration.message", colMatch[0]),
@@ -14329,8 +14566,8 @@ var destructiveSqlMigrationCheck = {
         const policyMatch = dropPolicyRegex.exec(line);
         if (policyMatch) {
           findings.push({
-            id: `${CHECK_ID52}:${file.relativePath}:${lineNum + 1}:${(policyMatch.index ?? 0) + 1}:policy`,
-            checkId: CHECK_ID52,
+            id: `${CHECK_ID54}:${file.relativePath}:${lineNum + 1}:${(policyMatch.index ?? 0) + 1}:policy`,
+            checkId: CHECK_ID54,
             category: "resilience",
             severity: "medium",
             message: getCopy("checks.destructive-sql-migration.message", policyMatch[0]),
@@ -14343,8 +14580,8 @@ var destructiveSqlMigrationCheck = {
         const indexMatch = dropIndexRegex.exec(line);
         if (indexMatch) {
           findings.push({
-            id: `${CHECK_ID52}:${file.relativePath}:${lineNum + 1}:${(indexMatch.index ?? 0) + 1}:index`,
-            checkId: CHECK_ID52,
+            id: `${CHECK_ID54}:${file.relativePath}:${lineNum + 1}:${(indexMatch.index ?? 0) + 1}:index`,
+            checkId: CHECK_ID54,
             category: "resilience",
             severity: "medium",
             message: getCopy("checks.destructive-sql-migration.message", indexMatch[0]),
@@ -14360,7 +14597,7 @@ var destructiveSqlMigrationCheck = {
   }
 };
 registry.register(destructiveSqlMigrationCheck);
-var CHECK_ID53 = "resilience.sql-broad-mutation";
+var CHECK_ID55 = "resilience.sql-broad-mutation";
 var REMEDIATION43 = getCopy("remediation.resilience.sql-broad-mutation");
 function splitSqlStatements(content) {
   const statements = [];
@@ -14398,7 +14635,7 @@ function splitSqlStatements(content) {
   return statements;
 }
 var sqlBroadMutationCheck = {
-  id: CHECK_ID53,
+  id: CHECK_ID55,
   name: getCopy("checks.sql-broad-mutation.name"),
   description: getCopy("checks.sql-broad-mutation.description"),
   category: "resilience",
@@ -14444,8 +14681,8 @@ var sqlBroadMutationCheck = {
             const beforeStatement = content.slice(0, charOffset + leadingWhitespace);
             const lineNum = beforeStatement.split("\n").length;
             findings.push({
-              id: `${CHECK_ID53}:${file.relativePath}:${lineNum}:1`,
-              checkId: CHECK_ID53,
+              id: `${CHECK_ID55}:${file.relativePath}:${lineNum}:1`,
+              checkId: CHECK_ID55,
               category: "resilience",
               severity: "high",
               message: getCopy("checks.sql-broad-mutation.message", matchedKeyword),
@@ -14463,7 +14700,7 @@ var sqlBroadMutationCheck = {
   }
 };
 registry.register(sqlBroadMutationCheck);
-var CHECK_ID54 = "data-exposure.unprotected-sensitive-sql-columns";
+var CHECK_ID56 = "data-exposure.unprotected-sensitive-sql-columns";
 var REMEDIATION44 = getCopy("remediation.data-exposure.unprotected-sensitive-sql-columns");
 var SENSITIVE_KEYWORDS = [
   "ssn",
@@ -14495,7 +14732,7 @@ var PROTECTED_SUFFIXES = [
   "_key_id"
 ];
 var unprotectedSensitiveSqlColumnsCheck = {
-  id: CHECK_ID54,
+  id: CHECK_ID56,
   name: getCopy("checks.unprotected-sensitive-sql-columns.name"),
   description: getCopy("checks.unprotected-sensitive-sql-columns.description"),
   category: "data-exposure",
@@ -14525,8 +14762,8 @@ var unprotectedSensitiveSqlColumnsCheck = {
         const isProtected = PROTECTED_SUFFIXES.some((suf) => colName.endsWith(suf));
         if (isSensitive && isPlainText && !isProtected) {
           findings.push({
-            id: `${CHECK_ID54}:${file.relativePath}:${match.startLine}:${match.startColumn ?? 1}`,
-            checkId: CHECK_ID54,
+            id: `${CHECK_ID56}:${file.relativePath}:${match.startLine}:${match.startColumn ?? 1}`,
+            checkId: CHECK_ID56,
             category: "data-exposure",
             severity: "high",
             message: getCopy("checks.unprotected-sensitive-sql-columns.message", `Column "${colNameRaw}" with type "${colTypeRaw}"`),
@@ -14590,9 +14827,9 @@ registry.register({
     return runLLMCheck(ctx, promptTemplate30);
   }
 });
-var CHECK_ID55 = "security.rust-unsafe-blocks";
+var CHECK_ID57 = "security.rust-unsafe-blocks";
 registry.register({
-  id: CHECK_ID55,
+  id: CHECK_ID57,
   name: getCopy("checks.rust-unsafe-blocks.name"),
   description: getCopy("checks.rust-unsafe-blocks.description"),
   category: "security",
@@ -14679,8 +14916,8 @@ registry.register({
         }
         if (!foundSafety) {
           const finding = {
-            id: `${CHECK_ID55}:${file.relativePath}:${match.startLine}:${match.startColumn ?? 0}:${i}`,
-            checkId: CHECK_ID55,
+            id: `${CHECK_ID57}:${file.relativePath}:${match.startLine}:${match.startColumn ?? 0}:${i}`,
+            checkId: CHECK_ID57,
             category: "security",
             severity: "medium",
             message: getCopy("checks.rust-unsafe-blocks.message", match.nodeText),
@@ -14698,7 +14935,7 @@ registry.register({
     return findings;
   }
 });
-var CHECK_ID56 = "resilience.rust-handler-panics";
+var CHECK_ID58 = "resilience.rust-handler-panics";
 var RUST_QUERY = `
 (call_expression
   function: (field_expression
@@ -14724,7 +14961,7 @@ function hasAsyncModifier(node) {
   return false;
 }
 registry.register({
-  id: CHECK_ID56,
+  id: CHECK_ID58,
   name: getCopy("checks.rust-handler-panics.name"),
   description: getCopy("checks.rust-handler-panics.description"),
   category: "resilience",
@@ -14790,8 +15027,8 @@ registry.register({
             const isAsync = hasAsyncModifier(enclosingFunction);
             if (isAsync) {
               const finding = {
-                id: `${CHECK_ID56}:${file.relativePath}:${match.startLine}:${match.startColumn ?? 0}:${i}`,
-                checkId: CHECK_ID56,
+                id: `${CHECK_ID58}:${file.relativePath}:${match.startLine}:${match.startColumn ?? 0}:${i}`,
+                checkId: CHECK_ID58,
                 category: "resilience",
                 severity: "high",
                 message: getCopy("checks.rust-handler-panics.message", match.nodeText),
@@ -16229,6 +16466,7 @@ async function executeScan(args, ctx) {
     debug: args.debug,
     baseline: args.baseline,
     minConfidence: args.minConfidence,
+    minSeverity: args.minSeverity,
     onCheckComplete: (completed, total, checkName) => {
       heartbeat();
       if (showProgress) {
@@ -16608,6 +16846,7 @@ async function runCli(options) {
     debug: options.debug,
     baseline: options.baseline,
     minConfidence: options.minConfidence,
+    minSeverity: options.minSeverity,
     showIds: options.showIds,
     all: options.all
   };
@@ -16786,12 +17025,13 @@ var require5 = createRequire4(import.meta.url);
 var { version } = require5("../package.json");
 var cli = cac("seaworthycode");
 cli.version(version);
-cli.command("[path]", "Scan a directory for issues").option("--json", "Output JSON to stdout").option("--output <path>", "Write HTML report to file").option("--sarif <path>", "Write SARIF report to file").option("--sarif-stdout", "Write SARIF report to stdout").option("--fail-on-findings", "Exit with code 5 when findings are found").option("--tier <tier>", "Select tier (free, pro)").option("--provider <provider>", "LLM provider (anthropic, openai, kimi, moonshot, deepseek, gemini, minimax, ollama, openrouter)").option("--max-file-size <bytes>", "Skip files larger than this (default: 1 MB)").option("--show-ids", "Show check IDs alongside names in terminal output").option("--debug", "Enable debug logging").option("--baseline [ref]", "Compare against a baseline file or save current findings as baseline (--baseline save)").option("--min-confidence <level>", "Hide findings below this confidence (high, medium, low)").option("--all", "List every finding; do not collapse low-severity findings").action(async (targetDir, options) => {
+cli.command("[path]", "Scan a directory for issues").option("--json", "Output JSON to stdout").option("--output <path>", "Write HTML report to file").option("--sarif <path>", "Write SARIF report to file").option("--sarif-stdout", "Write SARIF report to stdout").option("--fail-on-findings", "Exit with code 5 when findings are found").option("--tier <tier>", "Select tier (free, pro)").option("--provider <provider>", "LLM provider (anthropic, openai, kimi, moonshot, deepseek, gemini, minimax, ollama, openrouter)").option("--max-file-size <bytes>", "Skip files larger than this (default: 1 MB)").option("--show-ids", "Show check IDs alongside names in terminal output").option("--debug", "Enable debug logging").option("--baseline [ref]", "Compare against a baseline file or save current findings as baseline (--baseline save)").option("--min-confidence <level>", "Hide findings below this confidence (high, medium, low)").option("--min-severity <level>", "Hide findings below this severity (critical, high, medium, low, info)").option("--all", "List every finding; do not collapse low-severity findings").action(async (targetDir, options) => {
   const maxFileSize = options.maxFileSize ? Number(options.maxFileSize) : void 0;
   const tier = options.tier;
   const baseline = options.baseline === "save" ? "save" : options.baseline;
   const minConfidence = options.minConfidence;
-  const result = await runCli({ targetDir, json: options.json, output: options.output, sarif: options.sarif, sarifStdout: options.sarifStdout, failOnFindings: options.failOnFindings, tier, provider: options.provider, maxFileSize, showIds: options.showIds, debug: options.debug, baseline, minConfidence, all: options.all });
+  const minSeverity = options.minSeverity;
+  const result = await runCli({ targetDir, json: options.json, output: options.output, sarif: options.sarif, sarifStdout: options.sarifStdout, failOnFindings: options.failOnFindings, tier, provider: options.provider, maxFileSize, showIds: options.showIds, debug: options.debug, baseline, minConfidence, minSeverity, all: options.all });
   if (result.updateMessage) {
     console.error(result.updateMessage);
   }
@@ -16859,6 +17099,7 @@ cli.help(() => {
   --max-file-size <n>    Skip files larger than n bytes (default: 1 MB)
   --baseline [ref]       Compare against baseline file or save (--baseline save)
   --min-confidence <level>  Hide findings below confidence (high, medium, low)
+  --min-severity <level>    Hide findings below severity (critical, high, medium, low, info)
   --show-ids             Show check IDs alongside names
   --all                  List every finding; do not collapse low-severity findings
   --debug                Enable debug logging`