securevibe 0.1.0

package/dist/engine/deps/osv.js

@@ -0,0 +1,162 @@
+// packages/cli/src/engine/deps/osv.ts
+/**
+ * `securevibe db update` — the ONLY networked path. Fetches OSV.dev bulk
+ * per-ecosystem dumps, compacts each record to our Advisory shape, and writes
+ * ~/.securevibe/db/<eco>.json. The fetcher is injectable so unit tests stay
+ * offline; the real run is verified manually (the npm dump size is checked then).
+ * Nothing about the user's code or package list leaves the machine.
+ */
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { userDbDir } from "./db.js";
+const OSV_BASE = "https://osv-vulnerabilities.storage.googleapis.com";
+const ECO_FILE = { npm: "npm/all.zip", PyPI: "PyPI/all.zip" };
+export function cvssToSeverity(score) {
+    if (score >= 9.0)
+        return "critical";
+    if (score >= 7.0)
+        return "high";
+    if (score >= 4.0)
+        return "medium";
+    if (score > 0)
+        return "low";
+    return "info";
+}
+function severityOf(rec) {
+    const dbScore = rec?.database_specific?.cvss?.score;
+    if (typeof dbScore === "number")
+        return cvssToSeverity(dbScore);
+    const txt = rec?.database_specific?.severity;
+    if (typeof txt === "string") {
+        const s = txt.toLowerCase();
+        if (s === "critical")
+            return "critical";
+        if (s === "high")
+            return "high";
+        if (s === "moderate" || s === "medium")
+            return "medium";
+        if (s === "low")
+            return "low";
+    }
+    return "medium"; // unknown severity → medium, never silently "info"
+}
+function rangesOf(affected) {
+    const out = [];
+    for (const r of affected?.ranges ?? []) {
+        let introduced;
+        for (const ev of r.events ?? []) {
+            if (ev.introduced !== undefined)
+                introduced = ev.introduced;
+            if (ev.fixed !== undefined)
+                out.push({ introduced, fixed: ev.fixed });
+        }
+        if (introduced !== undefined && !(r.events ?? []).some((e) => e.fixed !== undefined)) {
+            out.push({ introduced });
+        }
+    }
+    return out;
+}
+/** Compact a flat list of OSV records into { lowercaseName: Advisory[] }. */
+export function compactOsvRecords(records) {
+    const byPkg = {};
+    for (const rec of records) {
+        for (const aff of rec.affected ?? []) {
+            const name = aff?.package?.name;
+            if (!name)
+                continue;
+            const advisory = {
+                id: rec.id,
+                aliases: rec.aliases ?? [],
+                severity: severityOf(rec),
+                summary: rec.summary ?? rec.details ?? rec.id,
+                ranges: rangesOf(aff),
+                url: `https://osv.dev/vulnerability/${rec.id}`,
+            };
+            if (advisory.ranges.length === 0)
+                continue;
+            const key = name.toLowerCase();
+            (byPkg[key] ??= []).push(advisory);
+        }
+    }
+    return byPkg;
+}
+export async function updateDb(opts = {}) {
+    const doFetch = opts.fetchImpl ?? fetch;
+    const ecosystems = opts.ecosystems ?? ["npm", "PyPI"];
+    const destDir = opts.destDir ?? userDbDir();
+    await fs.mkdir(destDir, { recursive: true });
+    const date = new Date().toISOString().slice(0, 10);
+    let count = 0;
+    for (const eco of ecosystems) {
+        const url = `${OSV_BASE}/${ECO_FILE[eco]}`;
+        const res = await doFetch(url);
+        if (!res.ok)
+            throw new Error(`OSV fetch failed for ${eco}: ${res.status}`);
+        const buf = Buffer.from(await res.arrayBuffer());
+        // Stream the zip entry-by-entry and compact in batches so the npm dump
+        // (~200MB compressed, multi-GB decompressed) never materializes in full.
+        const byPkg = {};
+        await readOsvZip(buf, (records) => {
+            const part = compactOsvRecords(records);
+            for (const key in part)
+                (byPkg[key] ??= []).push(...part[key]);
+        });
+        count += Object.keys(byPkg).length;
+        const out = { date, ecosystems: { [eco]: byPkg } };
+        await fs.writeFile(path.join(destDir, `${eco}.json`), JSON.stringify(out), "utf8");
+    }
+    return { destDir, count, date };
+}
+/**
+ * Stream an OSV "all.zip" buffer, invoking `onRecords` with batches of parsed
+ * advisory JSON objects. The zip holds one JSON file per advisory and is written
+ * with data descriptors (local headers carry zero sizes), so we read sizes from
+ * the central directory via yauzl rather than scanning local headers. Batching +
+ * discard keeps peak memory at roughly the compressed buffer plus one batch.
+ */
+export async function readOsvZip(buf, onRecords, batchSize = 2000) {
+    const yauzl = (await import("yauzl")).default;
+    await new Promise((resolve, reject) => {
+        yauzl.fromBuffer(buf, { lazyEntries: true }, (err, zip) => {
+            if (err || !zip)
+                return reject(err ?? new Error("failed to open OSV zip"));
+            let batch = [];
+            const flush = () => {
+                if (batch.length) {
+                    onRecords(batch);
+                    batch = [];
+                }
+            };
+            zip.on("entry", (entry) => {
+                if (!entry.fileName.toLowerCase().endsWith(".json")) {
+                    zip.readEntry();
+                    return;
+                }
+                zip.openReadStream(entry, (streamErr, stream) => {
+                    if (streamErr || !stream)
+                        return reject(streamErr ?? new Error("read stream failed"));
+                    const chunks = [];
+                    stream.on("data", (c) => chunks.push(c));
+                    stream.on("error", reject);
+                    stream.on("end", () => {
+                        try {
+                            batch.push(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+                        }
+                        catch {
+                            /* skip a non-JSON or undecodable entry */
+                        }
+                        if (batch.length >= batchSize)
+                            flush();
+                        zip.readEntry();
+                    });
+                });
+            });
+            zip.on("error", reject);
+            zip.on("end", () => {
+                flush();
+                resolve();
+            });
+            zip.readEntry();
+        });
+    });
+}

package/dist/engine/detectors/aisecurity.js

@@ -0,0 +1,195 @@
+import { walk, isCall, calleeText, calleeLastSegment, argsText, loc, codeWithoutComments } from "../ast.js";
+import { isTainted } from "../taint.js";
+import { mkFinding } from "./util.js";
+const LLM_SDK_RE = /\b(from\s+["']openai["']|require\(["']openai["']\)|@anthropic-ai\/sdk|["']anthropic["']|langchain|@langchain|from\s+["']ai["']|["']cohere-ai["']|google-generative-ai|@modelcontextprotocol\/sdk|llamaindex)\b/;
+const LLM_CALL_RE = /(chat\.completions\.create|completions\.create|messages\.create|responses\.create|generateText|streamText|generateObject|createChatCompletion|\.invoke|\.run|\.generate)\b/;
+const TOOLS_DEFINED_RE = /\btools\s*:\s*\[|\bfunctions\s*:\s*\[|new\s+(DynamicTool|StructuredTool|Tool)\b|\btool\s*\(\s*\{/;
+const TOOL_DISPATCH_RE = /tool_calls|toolCalls|function_call|functionCall|\.function\.name|\.function\.arguments|\btool\.name\b/;
+// Deliberately excludes JSON.parse — parsing tool args is not validating them.
+const VALIDATION_RE = /allow[_ ]?list|\bzod\b|\bz\.\w+\(|schema\.(parse|safeParse)|safeParse|validateArgs|sanitiz|isAllowed|permitted|\bajv\b|\bguard\b|firewall/i;
+const RAG_RE = /vector[_ ]?store|retriever|embeddings|pinecone|qdrant|chroma|weaviate|similaritySearch|as_retriever|\.query\(\s*\{[^}]*vector/i;
+const MCP_RE = /@modelcontextprotocol\/sdk/;
+const DANGEROUS_SINKS = new Set([
+    "readFile",
+    "readFileSync",
+    "writeFile",
+    "writeFileSync",
+    "unlink",
+    "unlinkSync",
+    "exec",
+    "execSync",
+    "spawn",
+    "spawnSync",
+    "system",
+    "query",
+    "fetch",
+    "request",
+]);
+function hasLLM(code) {
+    return LLM_SDK_RE.test(code) || LLM_CALL_RE.test(code);
+}
+/** Find calls into the model (where untrusted text becomes model context). */
+function llmCalls(root) {
+    const out = [];
+    walk(root, (n) => {
+        if (!isCall(n))
+            return;
+        const callee = calleeText(n) ?? "";
+        if (LLM_CALL_RE.test(callee))
+            out.push(n);
+    });
+    return out;
+}
+/** Find dangerous sink calls (the tool implementations / effects). */
+function dangerousSinks(root) {
+    const out = [];
+    walk(root, (n) => {
+        if (!isCall(n))
+            return;
+        const last = calleeLastSegment(n);
+        if (last && DANGEROUS_SINKS.has(last))
+            out.push(n);
+    });
+    return out;
+}
+export const aiSecurityDetector = (ctx) => {
+    // Text heuristics run on comment-stripped source so prose/comments can't
+    // flip a signal (e.g. the word "allowlist" inside a comment).
+    const code = codeWithoutComments(ctx.root, ctx.file.code);
+    if (!hasLLM(code))
+        return [];
+    const out = [];
+    const calls = llmCalls(ctx.root);
+    const sinks = dangerousSinks(ctx.root);
+    const toolsDefined = TOOLS_DEFINED_RE.test(code);
+    const toolDispatch = TOOL_DISPATCH_RE.test(code);
+    const hasValidation = VALIDATION_RE.test(code);
+    const usedSinkLines = new Set();
+    // (1) Untrusted input -> LLM : direct/indirect prompt-injection surface.
+    for (const call of calls) {
+        const args = argsText(call);
+        if (isTainted(args, ctx.taint)) {
+            out.push(mkFinding(ctx, {
+                node: call,
+                detector: "ai-prompt-injection",
+                title: "Prompt injection surface: untrusted input flows into the LLM",
+                category: "ai",
+                severity: toolsDefined ? "high" : "medium",
+                confidence: 0.7,
+                reachable: true,
+                owasp: "LLM01 Prompt Injection",
+                mitre: "ATLAS AML.T0051",
+                why: toolsDefined
+                    ? "Untrusted user input is passed to a model that can call tools. A crafted prompt can steer the model into invoking those tools (prompt injection → tool execution)."
+                    : "Untrusted user input is passed to the model with no isolation. An attacker can override instructions, leak the system prompt, or manipulate output.",
+                fix: "Isolate untrusted input as data (delimit/spotlight, never as instructions), run an injection classifier, and constrain what the model is allowed to do with tools (see AI Execution Firewall, doc 04).",
+                taint: ["request input", "→ messages/prompt", `→ ${calleeText(call)}()`],
+            }));
+        }
+    }
+    // (2) Prompt injection -> tool execution: model output drives a dangerous sink
+    // with no validation/allowlist/firewall in the file. If a firewall IS present
+    // (allowlist + argument-schema validation), the hijack path is considered
+    // mitigated — this is the doc-04 semantics, and it lets a real fix clear the
+    // finding instead of being flagged forever.
+    if (toolDispatch && sinks.length > 0 && !hasValidation) {
+        for (const sink of sinks) {
+            const { line } = loc(sink);
+            usedSinkLines.add(line);
+            out.push(mkFinding(ctx, {
+                node: sink,
+                detector: "ai-tool-hijack",
+                title: "Prompt injection → tool execution (unvalidated tool call)",
+                category: "ai",
+                severity: "critical",
+                confidence: 0.85,
+                reachable: true,
+                owasp: "LLM01 / LLM08 Excessive Agency",
+                mitre: "ATLAS AML.T0051",
+                why: "The model's tool-call output is dispatched to a powerful sink (filesystem/shell/DB/network) without validation. A prompt-injection attack can make the agent perform arbitrary privileged actions — read secrets, run commands, exfiltrate data.",
+                fix: "Gate every tool call: validate arguments against a strict schema, enforce a tool allowlist, scope each tool to least-privilege credentials, and require human approval for high-risk actions. Insert the AI Execution Firewall middleware (doc 04).",
+                taint: ["untrusted input", "→ LLM", "→ tool_call args", `→ ${calleeText(sink)}() sink`],
+            }));
+        }
+    }
+    // (3) Over-privileged tool: a tool effect touching fs/shell/env without a gate.
+    // Suppressed when a firewall is present (same mitigation signal as above), so a
+    // validated fix doesn't simply trade a critical for a new high (which the fix
+    // loop's regression gate would otherwise reject).
+    if (toolsDefined && !hasValidation) {
+        for (const sink of sinks) {
+            const { line } = loc(sink);
+            if (usedSinkLines.has(line))
+                continue; // already flagged as hijack
+            const last = calleeLastSegment(sink) ?? "";
+            if (!/readFile|writeFile|unlink|exec|spawn|system|query/i.test(last))
+                continue;
+            usedSinkLines.add(line);
+            out.push(mkFinding(ctx, {
+                node: sink,
+                detector: "ai-overprivileged-tool",
+                title: `Over-privileged AI tool (${last})`,
+                category: "ai",
+                severity: "high",
+                confidence: 0.65,
+                reachable: true,
+                owasp: "LLM07 Insecure Plugin Design",
+                mitre: "ATLAS AML.T0053",
+                why: "A tool exposed to the model performs a high-privilege effect (filesystem/shell/DB). If the model can be influenced, this capability becomes an attacker primitive.",
+                fix: "Scope the tool to the minimum capability needed (e.g. a fixed directory, parameterized query, no shell). Run tool effects with least-privilege, isolated credentials.",
+            }));
+        }
+    }
+    // (4) Missing AI Execution Firewall: tools wired to a model with no guardrails.
+    if (toolsDefined && !hasValidation) {
+        const anchor = calls[0];
+        out.push(mkFinding(ctx, {
+            node: anchor,
+            line: anchor ? undefined : 1,
+            detector: "ai-missing-firewall",
+            title: "AI agent exposes tools with no execution firewall",
+            category: "ai",
+            severity: "high",
+            confidence: 0.6,
+            reachable: true,
+            owasp: "LLM01 / LLM08 Excessive Agency",
+            mitre: "ATLAS AML.T0051",
+            why: "This integration gives the model tools but has no detectable input sanitization, argument validation, allowlist, or human-in-the-loop gate — so there is no defense-in-depth against prompt injection.",
+            fix: "Add the AI Execution Firewall (doc 04): prompt sanitization + injection detection, context isolation, tool allowlist + argument-schema validation, per-tool capability scoping, and a human gate for high-risk actions.",
+        }));
+    }
+    // (5) Indirect injection via RAG / retrieval.
+    if (RAG_RE.test(code) && calls.length > 0) {
+        out.push(mkFinding(ctx, {
+            line: 1,
+            detector: "ai-rag-injection",
+            title: "Retrieval (RAG) content flows into the prompt without provenance",
+            category: "ai",
+            severity: "medium",
+            confidence: 0.55,
+            reachable: true,
+            owasp: "LLM01 Prompt Injection (indirect)",
+            mitre: "ATLAS AML.T0051",
+            why: "Retrieved documents are treated as trusted context. If an attacker can place content in the knowledge base (or a fetched page), they can inject instructions the model will follow (indirect prompt injection).",
+            fix: "Treat retrieved content as untrusted data: tag provenance, isolate it from instructions, and vet/authenticate ingestion sources.",
+        }));
+    }
+    // (6) MCP server without authentication.
+    if (MCP_RE.test(code) && /new\s+(Server|McpServer)\b/.test(code) && !/auth|token|api[_ ]?key|bearer/i.test(code)) {
+        out.push(mkFinding(ctx, {
+            line: 1,
+            detector: "ai-mcp-unauth",
+            title: "MCP server exposes tools without authentication",
+            category: "ai",
+            severity: "medium",
+            confidence: 0.55,
+            reachable: true,
+            owasp: "LLM07 Insecure Plugin Design",
+            mitre: "ATLAS AML.T0053",
+            why: "An unauthenticated MCP server lets any client invoke its tools. Combined with privileged tools, this is a direct path to the underlying system.",
+            fix: "Authenticate MCP transports, allowlist clients, and scope tool permissions per the MCP hardening guidance (doc 04).",
+        }));
+    }
+    return out;
+};
+export const aiDetectors = [aiSecurityDetector];

package/dist/engine/detectors/classic.js

@@ -0,0 +1,284 @@
+import { walk, isCall, calleeText, calleeLastSegment, argsText, codeWithoutComments } from "../ast.js";
+import { isTainted, isUntrustedStringBuild } from "../taint.js";
+import { mkFinding } from "./util.js";
+const SQL_SINKS = ["query", "execute", "exec", "raw", "$queryRawUnsafe", "$executeRawUnsafe"];
+/**
+ * Is this argument node a plain string literal with no interpolation? Such a
+ * first argument means the query string is static and any taint lives only in
+ * a separate params array — i.e. a *parameterized* (safe) query.
+ */
+function isStaticStringArg(arg) {
+    if (!arg)
+        return false;
+    // A JS template string with no `${}` substitution is static.
+    if (arg.type === "template_string")
+        return !/\$\{/.test(arg.text);
+    if (arg.type === "string") {
+        // Python f-strings are also type "string" but carry interpolation — NOT static.
+        for (let i = 0; i < arg.namedChildCount; i++) {
+            if (arg.namedChild(i)?.type === "interpolation")
+                return false;
+        }
+        const prefix = arg.text.match(/^([a-zA-Z]*)['"]/);
+        if (prefix && /f/i.test(prefix[1]))
+            return false; // f"...{x}..."
+        return true; // plain string literal → parameterized/safe
+    }
+    return false;
+}
+/** SQL / NoSQL injection: untrusted data built into a query string. */
+const sqlInjection = (ctx) => {
+    const out = [];
+    walk(ctx.root, (n) => {
+        if (!isCall(n))
+            return;
+        const last = calleeLastSegment(n);
+        if (!last || !SQL_SINKS.includes(last))
+            return;
+        // Only the FIRST argument is the query string. Taint in later arguments is
+        // a parameter binding (safe) — flagging it would punish the correct fix.
+        const argsNode = n.childForFieldName("arguments");
+        const firstArg = argsNode?.namedChild(0) ?? null;
+        if (isStaticStringArg(firstArg))
+            return; // parameterized query → safe
+        const queryText = firstArg ? firstArg.text : argsText(n);
+        const tainted = isUntrustedStringBuild(queryText, ctx.taint) || isTainted(queryText, ctx.taint);
+        if (!tainted)
+            return;
+        out.push(mkFinding(ctx, {
+            node: n,
+            detector: "sql-injection",
+            title: "SQL injection via untrusted query string",
+            category: "classic",
+            severity: "critical",
+            confidence: 0.9,
+            reachable: true,
+            cwe: "CWE-89",
+            owasp: "A03:2021 Injection",
+            mitre: "T1190",
+            why: "Untrusted input is concatenated/interpolated directly into a database query. An attacker can alter the query to read, modify, or destroy data.",
+            fix: "Use parameterized queries / prepared statements (e.g. db.query(sql, [params])) or a safe ORM API. Never build SQL by string concatenation.",
+            taint: ["request input", "→ query string", `→ ${calleeText(n)}()`],
+        }));
+    });
+    return out;
+};
+/** Command injection / unsafe code execution (RCE). */
+const codeExecution = (ctx) => {
+    const out = [];
+    walk(ctx.root, (n) => {
+        if (!isCall(n))
+            return;
+        const callee = calleeText(n) ?? "";
+        const last = calleeLastSegment(n) ?? "";
+        const lang = ctx.file.lang;
+        // Decide if this is genuinely a code/command execution sink — taking care
+        // NOT to flag the many benign `.exec` methods (regex.exec, ORM query.exec…).
+        let isDangerous = false;
+        let evalLike = false;
+        // Non-shell process APIs (execFile/spawn) are the *safe* alternatives to a
+        // shell: a fixed binary + arg array isn't injectable. Only flag them when an
+        // argument is actually tainted — otherwise they're noise on correct code.
+        let safeUnlessTainted = false;
+        if (last === "eval" || last === "Function") {
+            isDangerous = true;
+            evalLike = true;
+        }
+        else if (callee === "os.system" || /^subprocess\.(call|run|Popen|check_output)$/.test(callee) || callee.endsWith(".Popen")) {
+            isDangerous = true;
+        }
+        else if (lang === "python" && (last === "exec" || last === "eval")) {
+            isDangerous = true;
+            evalLike = last === "eval";
+        }
+        else if (["spawn", "spawnSync", "execFile", "execFileSync", "popen"].includes(last)) {
+            isDangerous = true;
+            safeUnlessTainted = true;
+        }
+        else if (last === "exec" || last === "execSync") {
+            // child_process.exec is RCE; regex.exec / x.re.exec is not.
+            const bare = callee === last;
+            const childProc = /child_?process|childProcess|\bcp\b/i.test(callee);
+            const regexLike = /(re|regex|regexp|rx|pattern)\.exec$/i.test(callee);
+            isDangerous = (bare || childProc) && !regexLike;
+        }
+        if (!isDangerous)
+            return;
+        const args = argsText(n);
+        const tainted = isTainted(args, ctx.taint) || isUntrustedStringBuild(args, ctx.taint);
+        if (safeUnlessTainted && !tainted)
+            return; // execFile/spawn with fixed args → safe
+        out.push(mkFinding(ctx, {
+            node: n,
+            detector: "code-execution",
+            title: tainted
+                ? "Remote code execution: untrusted input reaches a command/eval sink"
+                : `Dangerous code-execution sink (${last})`,
+            category: "classic",
+            severity: tainted ? "critical" : "medium",
+            confidence: tainted ? 0.92 : 0.55,
+            reachable: tainted,
+            cwe: evalLike ? "CWE-95" : "CWE-78",
+            owasp: "A03:2021 Injection",
+            mitre: "T1059",
+            why: tainted
+                ? "Untrusted input flows into a command/eval execution sink, allowing arbitrary code or OS command execution."
+                : "Use of a dynamic code/command execution sink. If any argument is ever attacker-influenced this becomes RCE.",
+            fix: "Avoid eval/exec on dynamic input. Use safe APIs, allowlists of permitted commands/args, and never pass user input to a shell. Prefer execFile with a fixed binary + array args.",
+            taint: tainted ? ["request input", `→ ${callee}()`] : undefined,
+        }));
+    });
+    return out;
+};
+/** Cross-site scripting (XSS). */
+const xss = (ctx) => {
+    const out = [];
+    walk(ctx.root, (n) => {
+        // React dangerouslySetInnerHTML
+        if ((n.type === "property_identifier" || n.type === "identifier") &&
+            n.text === "dangerouslySetInnerHTML") {
+            out.push(mkFinding(ctx, {
+                node: n,
+                detector: "xss",
+                title: "Potential XSS via dangerouslySetInnerHTML",
+                category: "classic",
+                severity: "high",
+                confidence: 0.65,
+                reachable: true,
+                cwe: "CWE-79",
+                owasp: "A03:2021 Injection",
+                mitre: "T1059.007",
+                why: "Rendering raw HTML bypasses React's escaping. If the HTML includes untrusted data, an attacker can inject scripts.",
+                fix: "Avoid dangerouslySetInnerHTML. If unavoidable, sanitize with a vetted library (e.g. DOMPurify) before rendering.",
+            }));
+        }
+        // res.send / res.write with tainted content
+        if (isCall(n)) {
+            const callee = calleeText(n) ?? "";
+            if (/\.(send|write|end)$/.test(callee)) {
+                const args = argsText(n);
+                if (isTainted(args, ctx.taint) || isUntrustedStringBuild(args, ctx.taint)) {
+                    out.push(mkFinding(ctx, {
+                        node: n,
+                        detector: "xss",
+                        title: "Reflected XSS: untrusted input written to the response",
+                        category: "classic",
+                        severity: "high",
+                        confidence: 0.7,
+                        reachable: true,
+                        cwe: "CWE-79",
+                        owasp: "A03:2021 Injection",
+                        mitre: "T1059.007",
+                        why: "Untrusted input is written into an HTTP response without encoding, allowing script injection in the victim's browser.",
+                        fix: "Encode/escape output for the correct context, set a strict Content-Type, and apply a Content-Security-Policy.",
+                        taint: ["request input", `→ ${callee}()`],
+                    }));
+                }
+            }
+        }
+    });
+    return out;
+};
+/**
+ * Broken access control / IDOR (heuristic semantic check, doc 03). A route
+ * handler that looks up a resource by a request-supplied id but contains no
+ * authorization/ownership check.
+ */
+const HANDLER_NAMES = new Set(["GET", "POST", "PUT", "PATCH", "DELETE"]);
+const AUTHZ_MARKERS = /\b(session|getServerSession|auth|authorize|currentUser|current_user|userId|user_id|req\.user|verifyToken|requireAuth|getUser|ownerId|owner_id|can\(|ability|policy|rbac)\b/i;
+const brokenAccessControl = (ctx) => {
+    const out = [];
+    walk(ctx.root, (n) => {
+        // Next.js route handlers: exported async function GET/POST/...
+        if (n.type === "function_declaration") {
+            const nameNode = n.childForFieldName("name");
+            const name = nameNode?.text ?? "";
+            if (!HANDLER_NAMES.has(name))
+                return;
+            const body = n.text;
+            const usesRequestId = /\bparams\.[a-zA-Z_$]|searchParams\.get|req(uest)?\.(params|query)\b/.test(body);
+            const doesDbLookup = /\b(find|findUnique|findFirst|findById|query|select|get|aggregate)\b/i.test(body);
+            const hasAuthz = AUTHZ_MARKERS.test(body);
+            if (usesRequestId && doesDbLookup && !hasAuthz) {
+                out.push(mkFinding(ctx, {
+                    node: n,
+                    detector: "broken-access-control",
+                    title: `IDOR / missing authorization in ${name} handler`,
+                    category: "classic",
+                    severity: "high",
+                    confidence: 0.6,
+                    reachable: true,
+                    cwe: "CWE-639",
+                    owasp: "A01:2021 Broken Access Control",
+                    mitre: "T1190",
+                    why: "This handler fetches a resource using a client-supplied identifier but performs no ownership/authorization check. Any authenticated user can read or modify other users' objects by changing the id.",
+                    fix: "Enforce an ownership/authorization check: load the authenticated principal and verify it owns (or has a role permitting) the requested resource before returning it.",
+                    taint: ["request id (params/query)", "→ resource lookup", "→ returned without authz check"],
+                }));
+            }
+        }
+    });
+    return out;
+};
+/** Insecure CORS / weak JWT configuration (text-aware over the file). */
+const insecureConfig = (ctx) => {
+    const out = [];
+    const code = codeWithoutComments(ctx.root, ctx.file.code);
+    // Permissive CORS with credentials. Handles both cors({origin:'*'}) and the
+    // Next.js header form: { key: "Access-Control-Allow-Origin", value: "*" }.
+    const corsHeaderForm = /["']Access-Control-Allow-Origin["'][\s\S]{0,40}["']\*["']/i.test(code);
+    const corsLibForm = /origin\s*:\s*["']\*["']/i.test(code);
+    const corsStar = corsHeaderForm || corsLibForm;
+    const credsTrue = /["']Access-Control-Allow-Credentials["'][\s\S]{0,40}["']true["']/i.test(code) ||
+        /credentials\s*:\s*true/.test(code);
+    if (corsStar) {
+        const line = lineNumberOf(code, /(Access-Control-Allow-Origin)|(origin\s*:\s*["']\*)/);
+        out.push(mkFinding(ctx, {
+            line,
+            detector: "cors-misconfig",
+            title: credsTrue
+                ? "Insecure CORS: wildcard origin with credentials"
+                : "Permissive CORS: wildcard origin",
+            category: "classic",
+            severity: credsTrue ? "high" : "medium",
+            confidence: credsTrue ? 0.85 : 0.6,
+            reachable: true,
+            cwe: "CWE-942",
+            owasp: "A05:2021 Security Misconfiguration",
+            why: credsTrue
+                ? "A wildcard origin combined with credentials lets any site make authenticated cross-origin requests on behalf of your users."
+                : "A wildcard CORS origin exposes your API to requests from any website.",
+            fix: "Set an explicit allowlist of trusted origins. Never combine `Access-Control-Allow-Origin: *` with credentials.",
+        }));
+    }
+    // Weak JWT
+    if (/alg(orithm)?["'\s:]+["']?none["']?/i.test(code)) {
+        out.push(mkFinding(ctx, {
+            line: lineNumberOf(code, /alg(orithm)?["'\s:]+["']?none/i),
+            detector: "weak-jwt",
+            title: "Insecure JWT: 'none' algorithm permitted",
+            category: "classic",
+            severity: "high",
+            confidence: 0.8,
+            reachable: true,
+            cwe: "CWE-347",
+            owasp: "A02:2021 Cryptographic Failures",
+            why: "Accepting the 'none' algorithm lets an attacker forge tokens with no signature.",
+            fix: "Pin a strong algorithm (e.g. RS256/ES256), pass an explicit `algorithms` allowlist to verify(), and reject 'none'.",
+        }));
+    }
+    return out;
+};
+function lineNumberOf(code, re) {
+    const idx = code.search(re);
+    if (idx < 0)
+        return 1;
+    return code.slice(0, idx).split(/\r?\n/).length;
+}
+export const classicDetectors = [
+    sqlInjection,
+    codeExecution,
+    xss,
+    brokenAccessControl,
+    insecureConfig,
+];