securenow 8.12.2 → 8.12.3

package/cli/threatModel.js

@@ -0,0 +1,80 @@
+'use strict';
+
+// `securenow threat-model <category>` — print the copy-paste threat-modeling prompt for a category,
+// fetched from the published set at securenow.ai (the same prompt shown on securenow.ai/threat-modeling).
+// Pipe it straight into your coding agent:
+//   claude -p "$(npx securenow threat-model authentication)"
+// or save it:  npx securenow threat-model authentication --out prompt.md
+const fs = require('fs');
+const ui = require('./ui');
+
+const BASE = process.env.SECURENOW_THREAT_PROMPTS_URL || 'https://securenow.ai/threat-prompts';
+
+// Published categories (slugs). Aliases map common shorthands to the slug.
+const CATEGORIES = [
+  'authentication', 'authorization', 'xss-csrf-cors', 'client-side-supply-chain', 'injection',
+  'oauth-sso-integrations', 'admin-support-tools', 'payment-business-logic', 'file-upload-download',
+  'messaging-notifications', 'rate-limits-and-abuse', 'legacy-endpoints', 'api-security', 'graphql-security',
+  'webhooks', 'realtime-websocket-sse', 'serverless-and-edge', 'cloud-infrastructure', 'secrets-and-cloud-iam',
+  'dns-tls-certificates', 'supply-chain-cicd', 'storage-and-logs', 'data-privacy-pii', 'ai-llm-features',
+  'secrets-and-api-key-hygiene',
+];
+const ALIASES = { auth: 'authentication', authz: 'authorization', oauth: 'oauth-sso-integrations', sso: 'oauth-sso-integrations', api: 'api-security', graphql: 'graphql-security', uploads: 'file-upload-download', upload: 'file-upload-download', xss: 'xss-csrf-cors', csrf: 'xss-csrf-cors', cors: 'xss-csrf-cors', rate: 'rate-limits-and-abuse', 'rate-limits': 'rate-limits-and-abuse', secrets: 'secrets-and-api-key-hygiene', privacy: 'data-privacy-pii', pii: 'data-privacy-pii', ai: 'ai-llm-features', llm: 'ai-llm-features' };
+
+function resolveSlug(input) {
+  const raw = String(input || '').trim().toLowerCase().replace(/\.md$/, '').replace(/^\d+[-_]/, '');
+  if (!raw) return null;
+  if (CATEGORIES.includes(raw)) return raw;
+  if (ALIASES[raw]) return ALIASES[raw];
+  return null;
+}
+
+function listCategories() {
+  ui.heading('SecureNow threat-modeling prompts');
+  console.log('  Copy-paste a prompt into your coding agent, or run it with the SecureNow CLI.\n');
+  for (const slug of CATEGORIES) console.log('    ' + slug);
+  console.log('\n  Print one:  securenow threat-model authentication');
+  console.log('  Pipe it:    claude -p "$(securenow threat-model authentication)"');
+  console.log('  Save it:    securenow threat-model authentication --out prompt.md');
+  console.log('  On the web: securenow.ai/threat-modeling');
+}
+
+async function run(args, flags = {}) {
+  const category = args[0];
+  if (flags.list || (!category && !flags.all)) {
+    if (!category && !flags.list) ui.info('Pick a category (or --list to see them all):\n');
+    listCategories();
+    return;
+  }
+
+  const slug = resolveSlug(category);
+  if (!slug) {
+    ui.error(`Unknown category "${category}". Run "securenow threat-model --list" to see the ${CATEGORIES.length} categories.`);
+    process.exitCode = 1;
+    return;
+  }
+
+  const url = `${BASE}/${slug}.md`;
+  let text;
+  try {
+    const res = await fetch(url, { headers: { accept: 'text/markdown, text/plain' } });
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    text = await res.text();
+  } catch (err) {
+    ui.error(`Could not fetch the ${slug} prompt (${err.message}). Open securenow.ai/threat-modeling/${slug} in a browser instead.`);
+    process.exitCode = 1;
+    return;
+  }
+
+  if (flags.out) {
+    fs.writeFileSync(flags.out, text);
+    ui.success(`Saved the ${slug} threat-model prompt to ${flags.out} (${text.length.toLocaleString()} chars).`);
+    ui.info('Open it with your coding agent at the root of a project that has the securenow SDK installed.');
+    return;
+  }
+
+  // Default: raw prompt to stdout so it pipes cleanly into an agent.
+  process.stdout.write(text.endsWith('\n') ? text : text + '\n');
+}
+
+module.exports = { run, resolveSlug, CATEGORIES, ALIASES };

package/cli.js

@@ -671,6 +671,12 @@ const COMMANDS = {
     rawArgv: true,
     run: (rawArgs) => require('./cli/run').run(rawArgs),
   },
+  'threat-model': {
+    desc: 'Print a copy-paste threat-modeling prompt for a category (pipe it into your coding agent)',
+    usage: 'securenow threat-model <authentication|authorization|…|--list> [--out prompt.md]',
+    flags: { list: 'List all threat-modeling categories', out: 'Write the prompt to a file instead of stdout' },
+    run: (a, f) => require('./cli/threatModel').run(a, f),
+  },
   redact: {
     desc: 'Redact sensitive fields and OTP codes from a JSON payload',
     usage: "securenow redact '<json>' [--fields f1,f2] [--json]",
@@ -822,7 +828,7 @@ function showHelp(commandName) {
     'Firewall': ['firewall'],
     'Remediation': ['automation', 'ratelimit', 'challenge', 'blocklist', 'revoke', 'allowlist', 'trusted'],
     'Telemetry': ['telemetry', 'log', 'event', 'test-span'],
-    'Utilities': ['redact', 'cidr', 'doctor', 'env', 'mcp'],
+    'Utilities': ['threat-model', 'redact', 'cidr', 'doctor', 'env', 'mcp'],
     'Settings': ['instances', 'config', 'version'],
   };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "8.12.2",
+  "version": "8.12.3",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
   "main": "register.js",