securevibe 0.1.0 → 0.1.1

package/dist/engine/detectors/classic.js

@@ -130,6 +130,87 @@ const codeExecution = (ctx) => {
     });
     return out;
 };
+/**
+ * Path traversal: untrusted input reaches a filesystem path sink. Taint-gated
+ * (a static path is never flagged) and skipped when the argument is visibly
+ * sanitized (path.basename / secure_filename).
+ */
+const FS_SINKS = new Set([
+    "readFile", "readFileSync", "writeFile", "writeFileSync", "appendFile",
+    "appendFileSync", "createReadStream", "createWriteStream", "unlink",
+    "unlinkSync", "rm", "rmSync", "readdir", "readdirSync", "sendFile",
+]);
+const PY_FS_CALLEES = /^(open|os\.remove|os\.unlink|os\.rmdir|send_file)$/;
+const PATH_SANITIZED = /\b(basename|secure_filename)\s*\(/;
+const pathTraversal = (ctx) => {
+    const out = [];
+    walk(ctx.root, (n) => {
+        if (!isCall(n))
+            return;
+        const callee = calleeText(n) ?? "";
+        const last = calleeLastSegment(n) ?? "";
+        const isJsSink = ctx.file.lang !== "python" && FS_SINKS.has(last);
+        const isPySink = ctx.file.lang === "python" && PY_FS_CALLEES.test(callee);
+        if (!isJsSink && !isPySink)
+            return;
+        const argsNode = n.childForFieldName("arguments");
+        const firstArg = argsNode?.namedChild(0)?.text ?? "";
+        if (!firstArg || PATH_SANITIZED.test(firstArg))
+            return;
+        if (!isTainted(firstArg, ctx.taint) && !isUntrustedStringBuild(firstArg, ctx.taint))
+            return;
+        out.push(mkFinding(ctx, {
+            node: n,
+            detector: "path-traversal",
+            title: "Path traversal: untrusted input reaches a filesystem path",
+            category: "classic",
+            severity: "high",
+            confidence: 0.85,
+            reachable: true,
+            cwe: "CWE-22",
+            owasp: "A01:2021 Broken Access Control",
+            why: "A request-controlled value is used as a filesystem path. With ../ sequences an attacker can read or write files outside the intended directory (source code, .env, credentials).",
+            fix: "Never pass user input into a path directly. Resolve against a fixed base directory and verify the result stays inside it, or map ids to filenames and use path.basename / secure_filename on any user-supplied segment.",
+            taint: ["request input", "→ file path", `→ ${callee}()`],
+        }));
+    });
+    return out;
+};
+/** Server-side request forgery: untrusted input becomes the URL of a server-side request. */
+const JS_HTTP_CALLEE = /^(fetch|axios(\.(get|post|put|patch|delete|head|request))?|got(\.(get|post|put|patch|delete|head))?|https?\.(get|request))$/;
+const PY_HTTP_CALLEE = /^(requests\.(get|post|put|patch|delete|head)|httpx\.(get|post|put|patch|delete|head)|urllib\.request\.urlopen|urlopen)$/;
+const ssrf = (ctx) => {
+    const out = [];
+    walk(ctx.root, (n) => {
+        if (!isCall(n))
+            return;
+        const callee = calleeText(n) ?? "";
+        const re = ctx.file.lang === "python" ? PY_HTTP_CALLEE : JS_HTTP_CALLEE;
+        if (!re.test(callee))
+            return;
+        const argsNode = n.childForFieldName("arguments");
+        const firstArg = argsNode?.namedChild(0)?.text ?? "";
+        if (!firstArg)
+            return;
+        if (!isTainted(firstArg, ctx.taint) && !isUntrustedStringBuild(firstArg, ctx.taint))
+            return;
+        out.push(mkFinding(ctx, {
+            node: n,
+            detector: "ssrf",
+            title: "SSRF: untrusted input controls a server-side request URL",
+            category: "classic",
+            severity: "high",
+            confidence: 0.75,
+            reachable: true,
+            cwe: "CWE-918",
+            owasp: "A10:2021 Server-Side Request Forgery",
+            why: "A request-controlled value is used as the URL of a server-side HTTP request. An attacker can make your server call internal services, cloud metadata endpoints, or arbitrary hosts.",
+            fix: "Validate the URL against an allowlist of hosts/schemes before requesting it. Never fetch a raw user-supplied URL; block private IP ranges and metadata endpoints.",
+            taint: ["request input", "→ URL", `→ ${callee}()`],
+        }));
+    });
+    return out;
+};
 /** Cross-site scripting (XSS). */
 const xss = (ctx) => {
     const out = [];
@@ -278,6 +359,8 @@ function lineNumberOf(code, re) {
 export const classicDetectors = [
     sqlInjection,
     codeExecution,
+    pathTraversal,
+    ssrf,
     xss,
     brokenAccessControl,
     insecureConfig,

package/dist/engine/readiness/scorecard.js

@@ -1,7 +1,7 @@
 const GATES = [
     { id: "secrets", label: "Secrets managed", detectors: ["hardcoded-secret"], crit: "blocker" },
     { id: "deps", label: "Dependencies current", detectors: ["vulnerable-dependency"], crit: "critical-only" },
-    { id: "injection", label: "Injection safe (SQLi/RCE)", detectors: ["sql-injection", "code-execution"], crit: "blocker" },
+    { id: "injection", label: "Injection safe (SQLi/RCE/SSRF)", detectors: ["sql-injection", "code-execution", "path-traversal", "ssrf"], crit: "blocker" },
     { id: "authz", label: "Access control", detectors: ["broken-access-control"], crit: "blocker" },
     { id: "ai", label: "AI agent safety", detectors: ["ai-tool-hijack", "ai-missing-firewall", "ai-prompt-injection", "ai-overprivileged-tool"], crit: "high-blocks" },
     { id: "transport", label: "Transport config (CORS/JWT)", detectors: ["cors-misconfig", "weak-jwt"], crit: "warning" },

package/dist/engine/scan.js

@@ -98,6 +98,7 @@ export async function scan(root, options = {}) {
     const readinessFindings = [];
     let headersSeen = false;
     let headerAnchor;
+    let firstFile;
     progress(`Analyzing ${files.length} files…`);
     for (const abs of files) {
         const rel = path.relative(absRoot, abs).split(path.sep).join("/");
@@ -115,6 +116,8 @@ export async function scan(root, options = {}) {
             parsedCount++;
         findings.push(...(await detectFile(rel, code, { aiOnly: options.aiOnly, depDb })));
         if (fullScan) {
+            if (!firstFile)
+                firstFile = rel;
             readinessFindings.push(...checkDebugExposure(rel, code));
             if (!headersSeen && fileHasSecurityHeader(code))
                 headersSeen = true;
@@ -124,7 +127,10 @@ export async function scan(root, options = {}) {
     }
     progress("Scoring…");
     if (fullScan && isWebApp(inventory) && !(headersSeen || inventory.dependencies.includes("helmet"))) {
-        readinessFindings.push(...checkSecurityHeaders(headerAnchor ?? "package.json"));
+        // Anchor to a real config file when we found one; otherwise to any file we
+        // actually scanned (so `fix` can read it) rather than a name that may not
+        // exist in this project (e.g. package.json in a Python-only repo).
+        readinessFindings.push(...checkSecurityHeaders(headerAnchor ?? firstFile ?? "package.json"));
     }
     findings.push(...readinessFindings);
     const deduped = dedupe(findings);

package/dist/index.js

@@ -14,7 +14,7 @@ const program = new Command();
 program
     .name("securevibe")
     .description("Autonomous AI security engineer for AI-generated applications")
-    .version("0.1.0");
+    .version("0.1.1");
 function addCommon(cmd) {
     return cmd
         .option("--json", "output machine-readable JSON")
@@ -26,22 +26,25 @@ function addCommon(cmd) {
 /**
  * Free beta metering: one use per analysis command against the daily quota.
  * The --staged commit guard is exempt — a quota must never block a commit.
+ * Returns the usage state so callers can show it, or undefined when this run
+ * wasn't metered (--staged).
  */
 async function meter(opts = {}) {
     if (opts.staged)
-        return;
+        return undefined;
     const { recordUse, limitMessage } = await import("./usage.js");
     const r = await recordUse();
     if (!r.allowed) {
         process.stderr.write(limitMessage() + "\n");
         process.exit(1);
     }
+    return r;
 }
 /** Run a scan with stderr progress; honour --json/--sarif/--no-color. */
 async function runScan(pathArg, opts, scanOpts = {}) {
     if (opts.color === false)
         process.env.NO_COLOR = "1";
-    await meter(opts);
+    const usage = await meter(opts);
     const target = pathArg ?? ".";
     const quiet = opts.json || opts.sarif;
     // --staged: analyze only what's about to be committed (the pre-commit guard).
@@ -62,7 +65,7 @@ async function runScan(pathArg, opts, scanOpts = {}) {
         ...scanOpts,
         onProgress: quiet ? undefined : (m) => process.stderr.write(`  · ${m}\n`),
     });
-    return result;
+    return { result, usage };
 }
 /** Emit machine output if requested; returns true if it handled output. */
 function emitMachine(result, opts) {
@@ -87,23 +90,14 @@ function ciExit(result, opts) {
         process.exit(1);
     process.exit(0);
 }
-/** After a human-readable scan, nudge toward `fix` if anything is blocking. */
-function fixHint(result, opts) {
-    if (opts.json || opts.sarif)
-        return;
-    if (result.score.readiness === "ship")
-        return;
-    process.stdout.write(`  → run \`securevibe fix\` to auto-harden the blocking issues (dry run by default)\n\n`);
-}
 addCommon(program
     .command("scan", { isDefault: true })
     .description("Scan a repository for vulnerabilities and AI-agent risks")
     .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
-    const result = await runScan(pathArg, opts);
+    const { result, usage } = await runScan(pathArg, opts);
     if (!emitMachine(result, opts)) {
         const { renderReport } = await import("./ui/report.js");
-        process.stdout.write(renderReport(result) + "\n");
-        fixHint(result, opts);
+        process.stdout.write(renderReport(result, { usage }) + "\n");
     }
     ciExit(result, opts);
 });
@@ -156,10 +150,10 @@ addCommon(program
     .command("ai-audit")
     .description("Focus on the AI-application / agent attack surface (doc 04)")
     .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
-    const result = await runScan(pathArg, opts, { aiOnly: true });
+    const { result, usage } = await runScan(pathArg, opts, { aiOnly: true });
     if (!emitMachine(result, opts)) {
         const { renderReport } = await import("./ui/report.js");
-        process.stdout.write(renderReport(result, { aiFocus: true }) + "\n");
+        process.stdout.write(renderReport(result, { aiFocus: true, usage }) + "\n");
     }
     ciExit(result, opts);
 });
@@ -167,7 +161,7 @@ addCommon(program
     .command("protect")
     .description("Remediation-first view: the fixes for every finding")
     .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
-    const result = await runScan(pathArg, opts);
+    const { result } = await runScan(pathArg, opts);
     if (!emitMachine(result, opts)) {
         const { renderRemediations } = await import("./ui/protect.js");
         process.stdout.write(renderRemediations(result) + "\n");
@@ -178,7 +172,7 @@ addCommon(program
     .command("attack-map")
     .description("Show exploit paths from reachable findings (doc 06)")
     .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
-    const result = await runScan(pathArg, opts);
+    const { result } = await runScan(pathArg, opts);
     if (!emitMachine(result, opts)) {
         const { renderAttackMap } = await import("./ui/attackmap.js");
         process.stdout.write(renderAttackMap(result) + "\n");
@@ -189,7 +183,7 @@ addCommon(program
     .command("score")
     .description("Print the security score and deployment-readiness verdict")
     .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
-    const result = await runScan(pathArg, opts);
+    const { result } = await runScan(pathArg, opts);
     if (!emitMachine(result, opts)) {
         const { renderScoreOnly } = await import("./ui/protect.js");
         process.stdout.write(renderScoreOnly(result) + "\n");
@@ -200,7 +194,7 @@ addCommon(program
     .command("deps")
     .description("Audit dependencies for known CVEs (SCA, offline against the local OSV db)")
     .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
-    const result = await runScan(pathArg, opts);
+    const { result } = await runScan(pathArg, opts);
     if (!emitMachine(result, opts)) {
         const { renderDeps } = await import("./ui/deps.js");
         process.stdout.write(renderDeps(result) + "\n");
@@ -211,10 +205,10 @@ addCommon(program
     .command("ready")
     .description("Launch-readiness scorecard: pass/fail gates + a go/no-go verdict")
     .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
-    const result = await runScan(pathArg, opts);
+    const { result, usage } = await runScan(pathArg, opts);
     if (!emitMachine(result, opts)) {
         const { renderScorecard } = await import("./ui/readiness.js");
-        process.stdout.write(renderScorecard(result) + "\n");
+        process.stdout.write(renderScorecard(result, usage) + "\n");
     }
     ciExit(result, opts);
 });

package/dist/ui/readiness.js

@@ -6,6 +6,7 @@
  */
 import pc from "picocolors";
 import { renderBanner } from "./banner.js";
+import { renderUsageLine } from "./usage.js";
 function verdictBadge(lr) {
     if (lr.verdict === "ready")
         return pc.bgGreen(pc.black(pc.bold(" LAUNCH READY ")));
@@ -26,12 +27,16 @@ function gateLine(g) {
                 : pc.yellow(g.detail);
     return `${sym} ${label} ${detail}`;
 }
-export function renderScorecard(result) {
+export function renderScorecard(result, usage) {
     const lr = result.launchReadiness;
     const L = [];
     L.push(renderBanner({ subtitle: "launch readiness" }));
     L.push(pc.dim(`  ${result.root}`));
     L.push("");
+    if (usage) {
+        L.push(renderUsageLine(usage));
+        L.push("");
+    }
     if (!lr) {
         L.push("  Launch readiness is only evaluated on a full scan.");
         L.push("");

package/dist/ui/report.js

@@ -7,6 +7,7 @@ import pc from "picocolors";
 import { dependencyLine } from "./deps.js";
 import { renderBanner } from "./banner.js";
 import { readinessSummaryLine } from "./readiness.js";
+import { renderUsageLine } from "./usage.js";
 const SEV_LABEL = {
     critical: (s) => pc.bgRed(pc.white(pc.bold(` ${s} `))),
     high: (s) => pc.red(pc.bold(s)),
@@ -67,6 +68,10 @@ export function renderReport(result, opts = {}) {
     lines.push(renderBanner({ subtitle: opts.aiFocus ? "AI application security audit" : "security scan" }));
     lines.push(pc.dim(`  ${result.root}`));
     lines.push("");
+    if (opts.usage) {
+        lines.push(renderUsageLine(opts.usage));
+        lines.push("");
+    }
     // Inventory
     const inv = [
         inventory.languages.length ? `langs: ${inventory.languages.join(", ")}` : "",
@@ -134,8 +139,10 @@ export function renderReport(result, opts = {}) {
     }
     // Footer / next steps
     lines.push(pc.dim("  ─────────────────────────────────────────────────"));
-    lines.push("  " + pc.bold("Next:") + pc.dim(" every finding above carries a fix. ") + "Run " + pc.cyan("securevibe protect") + pc.dim(" to review remediations,"));
-    lines.push("  " + pc.dim("or ") + pc.cyan("securevibe ai-audit") + pc.dim(" to focus on the AI-agent attack surface."));
+    lines.push("  " + pc.bold("Next steps"));
+    lines.push("  " + pc.dim("1.") + " " + pc.cyan("securevibe fix --apply") + pc.dim(" — fix what's mechanical (asks before each change)"));
+    lines.push("  " + pc.dim("2.") + " " + pc.cyan("securevibe ready") + pc.dim("     — see what still blocks launch"));
+    lines.push("  " + pc.dim("3.") + " " + pc.cyan("securevibe init") + pc.dim("      — install the commit/CI gate so this doesn't regress"));
     lines.push("");
     return lines.join("\n");
 }

package/dist/ui/usage.js

@@ -0,0 +1,12 @@
+// packages/cli/src/ui/usage.ts
+/** One-line free-beta daily usage bar, shown at the top of scan-style reports. */
+import pc from "picocolors";
+function bar(fraction, width = 20) {
+    const filled = Math.round(Math.min(1, Math.max(0, fraction)) * width);
+    const color = fraction >= 0.9 ? pc.red : fraction >= 0.7 ? pc.yellow : pc.cyan;
+    return color("█".repeat(filled)) + pc.dim("░".repeat(width - filled));
+}
+export function renderUsageLine(usage) {
+    const fraction = usage.limit > 0 ? usage.used / usage.limit : 0;
+    return pc.dim("  Free beta usage today  ") + bar(fraction) + pc.dim(`  ${usage.used}/${usage.limit}`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securevibe",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Autonomous AI security engineer for AI generated apps: scan, fix, verify, and gate every commit before you launch",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",