security-mcp 1.0.5 → 1.1.0

package/dist/gate/checks/crypto.js

@@ -0,0 +1,153 @@
+import { searchRepo } from "../../repo/search.js";
+export async function checkCrypto(_opts) {
+    const findings = [];
+    try {
+        // 1. Weak hash algorithms
+        const weakHashHits = await searchRepo({
+            query: String.raw `createHash\s*\(\s*['"](?:md5|sha1|sha-1)['"]\s*\)|hashlib\.md5|hashlib\.sha1|DigestUtils\.md5`,
+            isRegex: true,
+            maxMatches: 200
+        });
+        if (weakHashHits.length > 0) {
+            findings.push({
+                id: "CRYPTO_WEAK_HASH",
+                title: "Weak hash algorithm (MD5/SHA-1) detected",
+                severity: "HIGH",
+                evidence: weakHashHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(weakHashHits.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Use SHA-256 minimum (SHA-3 recommended for new code).",
+                    "MD5/SHA-1 are broken for security purposes (NIST SP 800-131A Rev 2)."
+                ]
+            });
+        }
+        // 2. Weak symmetric ciphers
+        const weakCipherHits = await searchRepo({
+            query: String.raw `createCipheriv\s*\(\s*['"](?:des|rc4|rc2|blowfish|3des|des-ede)['"]\)|Cipher\.getInstance\(['"](?:DES|RC4|RC2|Blowfish)['"]`,
+            isRegex: true,
+            maxMatches: 200
+        });
+        if (weakCipherHits.length > 0) {
+            findings.push({
+                id: "CRYPTO_WEAK_CIPHER",
+                title: "Weak symmetric cipher (DES/RC4/3DES) detected",
+                severity: "CRITICAL",
+                evidence: weakCipherHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(weakCipherHits.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Use AES-256-GCM for symmetric encryption.",
+                    "DES/RC4/3DES are prohibited by NIST SP 800-131A Rev 2."
+                ]
+            });
+        }
+        // 3. Insecure random for security use
+        const insecureRandomHits = await searchRepo({
+            query: String.raw `Math\.random\(\)|random\.random\(\)|rand\(\)|srand\(`,
+            isRegex: true,
+            maxMatches: 200
+        });
+        const securityContextRe = /token|key|secret|password|nonce|salt|csrf|session/i;
+        const insecureSecRandom = insecureRandomHits.filter((m) => securityContextRe.test(m.preview));
+        if (insecureSecRandom.length > 0) {
+            findings.push({
+                id: "CRYPTO_INSECURE_RANDOM",
+                title: "Non-cryptographic random used in security-sensitive context",
+                severity: "HIGH",
+                evidence: insecureSecRandom.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(insecureSecRandom.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Use crypto.randomBytes() (Node.js) for security-sensitive randomness.",
+                    "Math.random() is not cryptographically secure and must never be used for tokens, keys, or nonces."
+                ]
+            });
+        }
+        // 4. Weak JWT algorithm
+        const weakJwtHits = await searchRepo({
+            query: String.raw `algorithm\s*[:=]\s*['"]HS(?:256|384|512)['"]|sign\(.*['"]HS256['"]`,
+            isRegex: true,
+            maxMatches: 200
+        });
+        if (weakJwtHits.length > 0) {
+            findings.push({
+                id: "CRYPTO_WEAK_JWT_ALGO",
+                title: "HS256/HS384/HS512 JWT algorithm detected — symmetric key shared with all verifiers",
+                severity: "HIGH",
+                evidence: weakJwtHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(weakJwtHits.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Use RS256 or ES256 for stateless JWTs.",
+                    "HS256 requires sharing the secret with every verifier — use asymmetric algorithms instead."
+                ]
+            });
+        }
+        // 5. Low PBKDF2 iterations
+        const pbkdf2Hits = await searchRepo({
+            query: String.raw `pbkdf2(?:Sync)?\s*\(`,
+            isRegex: true,
+            maxMatches: 200
+        });
+        // Check for numeric iteration counts in the context
+        for (const hit of pbkdf2Hits) {
+            const iterMatch = /pbkdf2(?:Sync)?\s*\([^)]*?,\s*[^,]+,\s*(\d+)/.exec(hit.preview);
+            if (iterMatch) {
+                const iters = parseInt(iterMatch[1], 10);
+                if (iters < 600000) {
+                    findings.push({
+                        id: "CRYPTO_LOW_PBKDF2_ITERATIONS",
+                        title: `PBKDF2 iteration count too low (${iters} < 600,000)`,
+                        severity: "HIGH",
+                        evidence: [`${hit.file}:${hit.line}:${hit.preview}`],
+                        files: [hit.file],
+                        requiredActions: [
+                            "Use ≥ 600,000 iterations for PBKDF2-SHA256 (OWASP 2023 recommendation).",
+                            "Prefer bcrypt (cost ≥ 12) or Argon2id instead."
+                        ]
+                    });
+                    break;
+                }
+            }
+        }
+        // 6. Hardcoded IV/nonce
+        const hardcodedIvHits = await searchRepo({
+            query: String.raw `iv\s*[:=]\s*(?:Buffer\.from\(['"][0-9a-fA-F]+['"]\)|['"][0-9a-fA-F]{16,}['"])`,
+            isRegex: true,
+            maxMatches: 200
+        });
+        if (hardcodedIvHits.length > 0) {
+            findings.push({
+                id: "CRYPTO_HARDCODED_IV",
+                title: "Hardcoded IV/nonce detected in cryptographic operation",
+                severity: "CRITICAL",
+                evidence: hardcodedIvHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(hardcodedIvHits.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Always generate a random IV/nonce using crypto.randomBytes(16) for AES-CBC.",
+                    "Use a 12-byte nonce for AES-GCM; never reuse IVs."
+                ]
+            });
+        }
+        // 7. ECB mode
+        const ecbModeHits = await searchRepo({
+            query: String.raw `createCipheriv\s*\(\s*['"][^'"]*-ecb['"]|AES\/ECB|Cipher\.getInstance\(['"][^'"]*ECB['"]`,
+            isRegex: true,
+            maxMatches: 200
+        });
+        if (ecbModeHits.length > 0) {
+            findings.push({
+                id: "CRYPTO_ECB_MODE",
+                title: "ECB cipher mode detected — leaks plaintext patterns",
+                severity: "CRITICAL",
+                evidence: ecbModeHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(ecbModeHits.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Replace ECB mode with AES-256-GCM (authenticated encryption).",
+                    "ECB mode leaks plaintext patterns because identical blocks produce identical ciphertext."
+                ]
+            });
+        }
+    }
+    catch (err) {
+        console.warn("[checkCrypto] Internal error:", err instanceof Error ? err.message : String(err));
+    }
+    return findings;
+}

package/dist/gate/checks/database.js

@@ -0,0 +1,144 @@
+import { searchRepo } from "../../repo/search.js";
+export async function checkDatabase(_opts) {
+    const findings = [];
+    try {
+        // 1. SSL/TLS disabled in connection strings
+        const tlsDisabledHits = await searchRepo({
+            query: String.raw `sslmode=disable|ssl=false|ssl:\s*false|useSSL=false|TrustServerCertificate=true`,
+            isRegex: true,
+            maxMatches: 200
+        });
+        if (tlsDisabledHits.length > 0) {
+            findings.push({
+                id: "DB_TLS_DISABLED",
+                title: "Database connection with TLS/SSL disabled detected",
+                severity: "CRITICAL",
+                evidence: tlsDisabledHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(tlsDisabledHits.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Always use sslmode=require or sslmode=verify-full for PostgreSQL.",
+                    "Never disable TLS for database connections — transmits credentials and data in plaintext."
+                ]
+            });
+        }
+        // 2. Root/admin credentials in connection strings
+        const adminCredHits = await searchRepo({
+            query: String.raw `postgresql://root:|mysql://root:|mongodb://admin:|mongodb://root:|postgres://postgres:|//sa:`,
+            isRegex: true,
+            maxMatches: 200
+        });
+        if (adminCredHits.length > 0) {
+            findings.push({
+                id: "DB_ADMIN_CREDENTIALS",
+                title: "Root/admin database credentials detected in connection strings",
+                severity: "CRITICAL",
+                evidence: adminCredHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(adminCredHits.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Create a least-privilege DB user scoped to only required tables and operations.",
+                    "Never use root/admin/sa/postgres superuser credentials in application code."
+                ]
+            });
+        }
+        // 3. Plaintext credentials in ORM config
+        const hardcodedPwdHits = await searchRepo({
+            query: String.raw `password\s*[:=]\s*["'][^"'\n]{6,}["']`,
+            isRegex: true,
+            maxMatches: 200
+        });
+        // Filter for hits near ORM/DB keywords
+        const ormKeywordRe = /database|db|sequelize|typeorm|prisma|mongoose|knex/i;
+        const ormPwdHits = hardcodedPwdHits.filter((m) => ormKeywordRe.test(m.preview));
+        if (ormPwdHits.length > 0) {
+            findings.push({
+                id: "DB_HARDCODED_PASSWORD",
+                title: "Hardcoded database password detected in ORM/DB configuration",
+                severity: "CRITICAL",
+                evidence: ormPwdHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(ormPwdHits.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Move database credentials to environment variables or a secrets manager.",
+                    "Never hardcode passwords in source code."
+                ]
+            });
+        }
+        // 4. No connection pool limits
+        const poolInitHits = await searchRepo({
+            query: String.raw `new Pool|createPool|new Sequelize|DataSource\(|createConnection`,
+            isRegex: true,
+            maxMatches: 200
+        });
+        const poolLimitHits = await searchRepo({
+            query: String.raw `max:|pool_size|poolSize|connectionLimit`,
+            isRegex: true,
+            maxMatches: 200
+        });
+        if (poolInitHits.length > 0 && poolLimitHits.length === 0) {
+            findings.push({
+                id: "DB_NO_POOL_LIMITS",
+                title: "Database connection pool initialized without explicit limits",
+                severity: "MEDIUM",
+                evidence: poolInitHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(poolInitHits.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Set connection pool limits (max, min) to prevent resource exhaustion.",
+                    "Unbounded pools can crash the database under load or be exploited for DoS."
+                ]
+            });
+        }
+        // 5. Backup encryption not configured
+        const backupHits = await searchRepo({
+            query: String.raw `backup_retention|automated_backups|backup_window`,
+            isRegex: true,
+            maxMatches: 200
+        });
+        const encryptionHits = await searchRepo({
+            query: String.raw `encrypted|kms_key`,
+            isRegex: true,
+            maxMatches: 200
+        });
+        if (backupHits.length > 0 && encryptionHits.length === 0) {
+            findings.push({
+                id: "DB_BACKUP_NOT_ENCRYPTED",
+                title: "Database backup configured without encryption",
+                severity: "HIGH",
+                evidence: backupHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(backupHits.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Enable backup encryption with a KMS key.",
+                    "Unencrypted backups expose all data if storage is compromised."
+                ]
+            });
+        }
+        // 6. SQL string concatenation (SQLi risk)
+        const sqliHits = await searchRepo({
+            query: String.raw `["']\s*\+\s*(?:req\.|params\.|query\.|body\.|user\.|input\.)`,
+            isRegex: true,
+            maxMatches: 200
+        });
+        // Also check for template literal injection
+        const sqliTemplateHits = await searchRepo({
+            query: String.raw `\$\{.*(?:req\.|params\.|query\.|body\.)[^}]*\}`,
+            isRegex: true,
+            maxMatches: 200
+        });
+        const allSqliHits = [...sqliHits, ...sqliTemplateHits];
+        if (allSqliHits.length > 0) {
+            findings.push({
+                id: "DB_SQL_INJECTION_RISK",
+                title: "Possible SQL injection: user input concatenated into query string",
+                severity: "CRITICAL",
+                evidence: allSqliHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(allSqliHits.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Use parameterized queries or ORM query builders — never concatenate user input into SQL.",
+                    "CWE-89: SQL injection can lead to full database compromise."
+                ]
+            });
+        }
+    }
+    catch (err) {
+        console.warn("[checkDatabase] Internal error:", err instanceof Error ? err.message : String(err));
+    }
+    return findings;
+}

package/dist/gate/checks/dependencies.js

@@ -1,5 +1,129 @@
 import fg from "fast-glob";
 import { readFileSafe } from "../../repo/fs.js";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { readFile } from "node:fs/promises";
+const execFileAsync = promisify(execFile);
+// 24-hour cache for OpenSSF Scorecard API responses
+const scorecardCache = new Map();
+const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+async function fetchScorecardScore(dep) {
+    try {
+        const cached = scorecardCache.get(dep);
+        if (cached && Date.now() - cached.fetchedAt < CACHE_TTL_MS) {
+            return cached.score;
+        }
+        // dep may be scoped (e.g. @org/pkg) — map to github owner/repo is heuristic
+        // We try the npm registry to find the repository
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), 5000);
+        try {
+            const npmResp = await fetch(`https://registry.npmjs.org/${encodeURIComponent(dep)}/latest`, {
+                signal: controller.signal
+            });
+            if (!npmResp.ok)
+                return null;
+            const npmData = await npmResp.json();
+            const repoUrl = npmData?.repository?.url ?? "";
+            const ghMatch = /github\.com[/:]([^/]+\/[^/.]+)/.exec(repoUrl);
+            if (!ghMatch)
+                return null;
+            const ghPath = ghMatch[1].replace(/\.git$/, "");
+            const controller2 = new AbortController();
+            const timeout2 = setTimeout(() => controller2.abort(), 5000);
+            try {
+                const scoreResp = await fetch(`https://api.securityscorecards.dev/projects/github.com/${ghPath}`, { signal: controller2.signal });
+                if (!scoreResp.ok)
+                    return null;
+                const scoreData = await scoreResp.json();
+                const score = scoreData?.score ?? null;
+                if (score !== null) {
+                    scorecardCache.set(dep, { score, fetchedAt: Date.now() });
+                }
+                return score;
+            }
+            finally {
+                clearTimeout(timeout2);
+            }
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    catch {
+        return null;
+    }
+}
+async function checkNpmProvenance() {
+    const findings = [];
+    try {
+        // 1. npm audit signatures (npm 9+)
+        try {
+            const { stdout } = await execFileAsync("npm", ["audit", "signatures", "--json"], {
+                timeout: 30000,
+                env: process.env
+            });
+            if (stdout) {
+                let auditResult;
+                try {
+                    auditResult = JSON.parse(stdout);
+                }
+                catch {
+                    auditResult = null;
+                }
+                if (auditResult && typeof auditResult === "object") {
+                    const result = auditResult;
+                    const invalid = result["invalid"] ?? [];
+                    const missing = result["missing"] ?? [];
+                    const noProvenance = [...invalid, ...missing];
+                    if (noProvenance.length > 0) {
+                        findings.push({
+                            id: "DEP_NO_PROVENANCE",
+                            title: `${noProvenance.length} production dependencies lack npm provenance attestation`,
+                            severity: "MEDIUM",
+                            evidence: noProvenance.slice(0, 10).map((p) => typeof p === "object" && p !== null ? JSON.stringify(p).slice(0, 120) : String(p)),
+                            requiredActions: [
+                                "Require packages with npm provenance attestation (npm 9+).",
+                                "Pin dependencies to specific versions and verify signatures."
+                            ]
+                        });
+                    }
+                }
+            }
+        }
+        catch {
+            // npm not available or < v9 — skip gracefully
+        }
+        // 2. OpenSSF Scorecard for top 5 production deps
+        try {
+            const pkgRaw = await readFile("package.json", "utf8");
+            const pkg = JSON.parse(pkgRaw);
+            const prodDeps = Object.keys(pkg.dependencies ?? {}).slice(0, 5);
+            for (const dep of prodDeps) {
+                const score = await fetchScorecardScore(dep);
+                if (score !== null && score < 5.0) {
+                    findings.push({
+                        id: "DEP_LOW_SCORECARD",
+                        title: `Dependency "${dep}" has a low OpenSSF Scorecard score (${score.toFixed(1)}/10)`,
+                        severity: "MEDIUM",
+                        evidence: [`${dep}: score ${score.toFixed(1)}/10 (threshold: 5.0)`],
+                        requiredActions: [
+                            `Review the OpenSSF Scorecard for ${dep} at https://scorecard.dev.`,
+                            "Consider replacing low-scored dependencies or accepting documented risk."
+                        ]
+                    });
+                }
+            }
+        }
+        catch {
+            // package.json unreadable or API unavailable — skip
+        }
+    }
+    catch (err) {
+        console.warn("[checkNpmProvenance] Internal error:", err instanceof Error ? err.message : String(err));
+    }
+    return { findings };
+}
 export async function checkDependencies(_) {
     const findings = [];
     const manifests = await fg(["package.json"], { dot: true });
@@ -39,5 +163,7 @@ export async function checkDependencies(_) {
             requiredActions: ["Fix package.json JSON syntax."]
         });
     }
+    const provenance = await checkNpmProvenance();
+    findings.push(...provenance.findings);
     return findings;
 }

package/dist/gate/checks/dlp.js

@@ -0,0 +1,153 @@
+import { searchRepo } from "../../repo/search.js";
+export async function checkDlp(_opts) {
+    const findings = [];
+    try {
+        // 1. SSN in logs
+        const ssnHits = await searchRepo({
+            query: String.raw `(?:console\.log|logger\.\w+|log\.\w+)\s*\([^)]*\b\d{3}[-\s]?\d{2}[-\s]?\d{4}\b`,
+            isRegex: true,
+            maxMatches: 200
+        });
+        if (ssnHits.length > 0) {
+            findings.push({
+                id: "DLP_SSN_IN_LOGS",
+                title: "Social Security Number pattern detected in log statement",
+                severity: "CRITICAL",
+                evidence: ssnHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(ssnHits.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Remove SSN values from log statements immediately.",
+                    "HIPAA requires protection of SSNs as Protected Health Information (PHI).",
+                    "Use tokenization or masking before logging any government ID."
+                ]
+            });
+        }
+        // 2. Credit card in logs (PAN)
+        const panHits = await searchRepo({
+            query: String.raw `(?:console\.log|logger\.\w+)\s*\([^)]*\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13})\b`,
+            isRegex: true,
+            maxMatches: 200
+        });
+        if (panHits.length > 0) {
+            findings.push({
+                id: "DLP_PAN_IN_LOGS",
+                title: "Credit card PAN pattern detected in log statement — PCI DSS violation",
+                severity: "CRITICAL",
+                evidence: panHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(panHits.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Remove all PAN values from log statements immediately.",
+                    "PCI DSS Requirement 3: Never log full card numbers.",
+                    "Use masked PANs (show only last 4 digits) if logging is required."
+                ]
+            });
+        }
+        // 3. Full request body logged
+        const reqBodyLogHits = await searchRepo({
+            query: String.raw `(?:console\.log|logger\.\w+)\s*\(\s*(?:req\.body|request\.body|ctx\.body|\{\.\.\.req)`,
+            isRegex: true,
+            maxMatches: 200
+        });
+        if (reqBodyLogHits.length > 0) {
+            findings.push({
+                id: "DLP_REQUEST_BODY_LOGGED",
+                title: "Full request body logged — may expose PII/credentials",
+                severity: "HIGH",
+                evidence: reqBodyLogHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(reqBodyLogHits.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Never log full request bodies — use field allowlists to log only non-sensitive fields.",
+                    "GDPR Article 5: data minimization applies to logs. HIPAA prohibits logging PHI."
+                ]
+            });
+        }
+        // 4. User object logged
+        const userLogHits = await searchRepo({
+            query: String.raw `(?:console\.log|logger\.\w+)\s*\(\s*(?:user|currentUser|req\.user|session\.user)\s*[,)]`,
+            isRegex: true,
+            maxMatches: 200
+        });
+        if (userLogHits.length > 0) {
+            findings.push({
+                id: "DLP_USER_OBJECT_LOGGED",
+                title: "User object logged — may expose PII, hashed passwords, or tokens",
+                severity: "HIGH",
+                evidence: userLogHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(userLogHits.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Log only specific non-sensitive user fields (e.g. userId, role).",
+                    "Never log the full user object — it likely contains PII and auth data (GDPR, HIPAA)."
+                ]
+            });
+        }
+        // 5. Email in logs
+        const emailLogHits = await searchRepo({
+            query: String.raw `(?:console\.log|logger\.\w+)\s*\([^)]*[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}`,
+            isRegex: true,
+            maxMatches: 200
+        });
+        if (emailLogHits.length > 0) {
+            findings.push({
+                id: "DLP_EMAIL_IN_LOGS",
+                title: "Email address detected in log statement",
+                severity: "MEDIUM",
+                evidence: emailLogHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(emailLogHits.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Mask or hash email addresses before logging (GDPR Article 5 — data minimization).",
+                    "Use a user ID or anonymized identifier in logs instead of the email."
+                ]
+            });
+        }
+        // 6. Stack traces in API responses
+        const stackTraceHits = await searchRepo({
+            query: String.raw `(?:res\.json|res\.send|response\.json)\s*\(\s*\{[^}]*(?:stack|stackTrace|error\.stack)`,
+            isRegex: true,
+            maxMatches: 200
+        });
+        if (stackTraceHits.length > 0) {
+            findings.push({
+                id: "DLP_STACK_TRACE_IN_RESPONSE",
+                title: "Stack trace exposed in API response — CWE-209 information leakage",
+                severity: "HIGH",
+                evidence: stackTraceHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(stackTraceHits.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Never expose stack traces in API responses (CWE-209).",
+                    "Log errors internally with a correlation ID; return only a safe error message to clients."
+                ]
+            });
+        }
+        // 7. Server version disclosure
+        const poweredByHits = await searchRepo({
+            query: String.raw `X-Powered-By|Server:\s*(?:Express|nginx|Apache)|app\.set\s*\(\s*['"]x-powered-by['"]`,
+            isRegex: true,
+            maxMatches: 200
+        });
+        if (poweredByHits.length > 0) {
+            // Check if x-powered-by is disabled nearby
+            const disableHits = await searchRepo({
+                query: String.raw `app\.disable\s*\(\s*['"]x-powered-by['"]`,
+                isRegex: true,
+                maxMatches: 200
+            });
+            if (disableHits.length === 0) {
+                findings.push({
+                    id: "DLP_SERVER_HEADER_DISCLOSURE",
+                    title: "Server technology disclosed via X-Powered-By or Server response header",
+                    severity: "MEDIUM",
+                    evidence: poweredByHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                    files: [...new Set(poweredByHits.slice(0, 10).map((m) => m.file))],
+                    requiredActions: [
+                        "Call app.disable('x-powered-by') in Express.",
+                        "Remove or obscure Server headers — version disclosure aids attacker reconnaissance."
+                    ]
+                });
+            }
+        }
+    }
+    catch (err) {
+        console.warn("[checkDlp] Internal error:", err instanceof Error ? err.message : String(err));
+    }
+    return findings;
+}