security-mcp 1.1.2 → 1.1.4

package/dist/cli/install.js

@@ -29,6 +29,7 @@ function getEditorTargets(opts) {
     const cursorGlobalPath = resolveHome("~/.cursor/mcp.json");
     const cursorLocalPath = ".cursor/mcp.json";
     const vscodePath = getVsCodeSettingsPath();
+    const windsurfPath = resolveHome("~/.windsurf/mcp.json");
     const all = [
         {
             name: "Claude Code",
@@ -53,6 +54,12 @@ function getEditorTargets(opts) {
             configPath: vscodePath,
             type: "vscode-settings",
             detected: existsSync(vscodePath)
+        },
+        {
+            name: "Windsurf",
+            configPath: windsurfPath,
+            type: "mcp-servers-json",
+            detected: existsSync(resolveHome("~/.windsurf"))
         }
     ];
     if (opts.all) {
@@ -166,11 +173,24 @@ function installSkill(dryRun) {
  */
 // CWE-22: only alphanumeric, hyphens, and dots allowed in skill names
 const SAFE_SKILL_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/;
+// CWE-918: allowlist for skill download hosts — no user-controlled URLs reach the network
+const ALLOWED_SKILL_HOSTS = new Set(["raw.githubusercontent.com", "github.com"]);
 export async function downloadSkill(skillName, url, dryRun = false) {
     if (!SAFE_SKILL_NAME_RE.test(skillName)) {
         process.stdout.write(`  [error] invalid skill name "${skillName}" — skipping download\n`);
         return;
     }
+    try {
+        const { hostname } = new URL(url);
+        if (!ALLOWED_SKILL_HOSTS.has(hostname)) {
+            process.stdout.write(`  [error] blocked skill download from unauthorized host "${hostname}"\n`);
+            return;
+        }
+    }
+    catch {
+        process.stdout.write(`  [error] invalid skill URL "${url}" — skipping download\n`);
+        return;
+    }
     const skillDest = resolveHome(`~/.claude/skills/${skillName}/SKILL.md`);
     if (dryRun) {
         process.stdout.write(`  [dry-run] would download skill "${skillName}" from ${url} → ${skillDest}\n`);
@@ -271,12 +291,22 @@ export async function runInstall(opts) {
     process.stdout.write("\nInstalling security policy...\n");
     installPolicy(dryRun);
     process.stdout.write("\n");
-    process.stdout.write(dryRun
-        ? "Dry-run complete. Re-run without --dry-run to apply.\n"
-        : "Done! Restart your editor to activate the security-mcp server.\n");
+    if (dryRun) {
+        process.stdout.write("Dry-run complete. Re-run without --dry-run to apply.\n\n");
+        return;
+    }
+    process.stdout.write("Installation complete!\n");
     process.stdout.write(`Install mode: ${opts.useGlobalBinary ? "global binary (security-mcp serve)" : "npx (npx -y security-mcp@latest serve)"}\n`);
     process.stdout.write("\nNext steps:\n");
-    process.stdout.write("  1. Restart your editor.\n");
-    process.stdout.write('  2. In Claude Code, type /senior-security-engineer to activate the security persona.\n');
-    process.stdout.write('  3. Ask your AI: "Run security.start_review with mode=recent_changes" to begin an auditable review.\n\n');
+    process.stdout.write("  1. Restart your editor (fully quit and reopen — not just reload window).\n");
+    process.stdout.write("  2. Verify the server loaded:\n");
+    process.stdout.write("       Claude Code: type /mcp and confirm security-mcp is listed as Connected.\n");
+    process.stdout.write("       Cursor:       Settings > MCP > security-mcp should show as active.\n");
+    process.stdout.write("  3. Run your first security review:\n");
+    process.stdout.write("       /senior-security-engineer\n");
+    process.stdout.write("     The agent will ask you to choose a scan scope (recent changes / full codebase / specific files).\n");
+    process.stdout.write("  4. For a deep 39-agent audit before a release:\n");
+    process.stdout.write("       /ciso-orchestrator\n");
+    process.stdout.write("\nVerify this install at any time:\n");
+    process.stdout.write("  npx -y security-mcp@latest --version\n\n");
 }

package/dist/cli/onboarding.js

@@ -275,8 +275,14 @@ async function fetchLatestRelease(repo) {
 function pickAsset(assets, pattern) {
     return assets.find((a) => a.name.toLowerCase().includes(pattern.toLowerCase()))?.browser_download_url;
 }
+const ALLOWED_BINARY_HOSTS = new Set([
+    "github.com", "objects.githubusercontent.com", "github-releases.githubusercontent.com"
+]);
 async function downloadBinary(url, dest) {
     try {
+        const { hostname } = new URL(url);
+        if (!ALLOWED_BINARY_HOSTS.has(hostname))
+            return false;
         const res = await fetch(url);
         if (!res.ok || !res.body)
             return false;

package/dist/gate/checks/auth-deep.js

@@ -0,0 +1,231 @@
+/**
+ * Deep authentication and session enforcement — covers JWT, OAuth, session, and cookie
+ * attack classes not detected by existing checks.
+ * CWE references per MITRE CWE catalog; ATT&CK techniques per MITRE ATT&CK v14.
+ */
+import { sanitizeErrorMessage } from "../result.js";
+import { searchRepo } from "../../repo/search.js";
+const NON_CODE_RE = /\.(?:md|json|yaml|yml|txt|rst|toml|lock)$/i;
+export async function checkAuthDeep(_opts) {
+    const findings = [];
+    const codeSearch = async (query) => (await searchRepo({ query, isRegex: true, maxMatches: 200 })).filter(h => !NON_CODE_RE.test(h.file));
+    try {
+        // 1. JWT verify without explicit algorithms array (algorithm confusion / none-attack)
+        const jwtVerifyHits = await codeSearch(String.raw `jwt\.verify\s*\(`);
+        const jwtAlgSafeRe = /algorithms\s*:\s*\[/;
+        const jwtAlgUnsafe = jwtVerifyHits.filter((h) => !jwtAlgSafeRe.test(h.preview));
+        if (jwtAlgUnsafe.length > 0) {
+            findings.push({
+                id: "JWT_ALG_NONE_ACCEPTED",
+                title: "jwt.verify() called without explicit algorithms array — algorithm confusion attack possible (CWE-327)",
+                severity: "CRITICAL",
+                evidence: jwtAlgUnsafe.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(jwtAlgUnsafe.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Always pass algorithms: ['RS256'] (or your actual algorithm) to jwt.verify().",
+                    "CWE-327 — without algorithms pin, attacker can forge tokens using alg:none or switch RS256→HS256 using the public key as secret.",
+                    "Fix: jwt.verify(token, publicKey, { algorithms: ['RS256'] })"
+                ]
+            });
+        }
+        // 2. Session not regenerated after login (session fixation)
+        const loginHandlerHits = await codeSearch(String.raw `(?:req\.session\.user|req\.session\.userId|req\.session\.account|req\.session\.authenticated)\s*=`);
+        const sessionRegenerateRe = /req\.session\.regenerate|session\.regenerate\s*\(/;
+        const sessionFixationRisk = loginHandlerHits.filter((h) => !sessionRegenerateRe.test(h.preview));
+        if (sessionFixationRisk.length > 0) {
+            findings.push({
+                id: "SESSION_FIXATION",
+                title: "Session identity set without session regeneration — session fixation risk (CWE-384)",
+                severity: "HIGH",
+                evidence: sessionFixationRisk.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(sessionFixationRisk.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Call req.session.regenerate() before setting session identity after authentication.",
+                    "CWE-384 — an attacker who fixes the session ID before login can hijack the authenticated session.",
+                    "Fix: req.session.regenerate((err) => { req.session.userId = user.id; res.json({ ok: true }); });"
+                ]
+            });
+        }
+        // 3. OAuth authorize endpoint without state parameter generation
+        const oauthAuthHits = await codeSearch(String.raw `(?:authorizationUrl|oauth\.authorize|passport\.authenticate\s*\(\s*['"]oauth|\.redirect\s*\(\s*['"]https:\/\/[^'"]*\/oauth\/authorize|\/oauth\/callback|\/auth\/callback)`);
+        const oauthStateSafeRe = /state\s*[:=]|generateState|crypto\.randomBytes|randomUUID|nonce/;
+        const oauthStateUnsafe = oauthAuthHits.filter((h) => !oauthStateSafeRe.test(h.preview));
+        if (oauthStateUnsafe.length > 0) {
+            findings.push({
+                id: "OAUTH_MISSING_STATE",
+                title: "OAuth flow without state parameter — CSRF on authorization callback (CWE-352)",
+                severity: "HIGH",
+                evidence: oauthStateUnsafe.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(oauthStateUnsafe.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Generate a cryptographically random state parameter and verify it on the callback.",
+                    "CWE-352 — without state, an attacker can inject their own authorization code into the victim's session.",
+                    "Fix: const state = crypto.randomBytes(32).toString('hex'); session.oauthState = state; // verify on callback"
+                ]
+            });
+        }
+        // 4. OAuth redirect_uri validated with includes/startsWith (too broad)
+        const redirectUriHits = await codeSearch(String.raw `redirect_uri.*(?:\.includes\s*\(|\.startsWith\s*\(|\.match\s*\(|indexOf\s*\()|(?:\.includes\s*\(|\.startsWith\s*\().*redirect_uri`);
+        if (redirectUriHits.length > 0) {
+            findings.push({
+                id: "OAUTH_OPEN_REDIRECT_URI",
+                title: "OAuth redirect_uri validated with includes/startsWith — open redirect via subdomain (CWE-601)",
+                severity: "HIGH",
+                evidence: redirectUriHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(redirectUriHits.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Validate redirect_uri with exact string equality against a pre-registered allowlist.",
+                    "CWE-601 — startsWith('https://example.com') allows https://example.com.evil.com/.",
+                    "Fix: if (redirectUri !== REGISTERED_REDIRECT_URI) throw new Error('Invalid redirect_uri');"
+                ]
+            });
+        }
+        // 5. PKCE not enforced — OAuth/OIDC flow without code_challenge
+        const pkceHits = await codeSearch(String.raw `(?:authorization_code|grant_type.*authorization_code|code.*exchange|token.*endpoint.*code\b)`);
+        const pkceSafeRe = /code_challenge|code_verifier|pkce|PKCE/;
+        const pkceUnsafe = pkceHits.filter((h) => !pkceSafeRe.test(h.preview));
+        if (pkceUnsafe.length > 0) {
+            findings.push({
+                id: "PKCE_NOT_ENFORCED",
+                title: "OAuth authorization code flow without PKCE — code interception attack (RFC 7636)",
+                severity: "HIGH",
+                evidence: pkceUnsafe.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(pkceUnsafe.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Require PKCE (code_challenge_method=S256) for all public clients and SPAs.",
+                    "RFC 7636 / ATT&CK T1528 — without PKCE, a stolen authorization code can be exchanged for tokens.",
+                    "Fix: enforce code_challenge in the /authorize handler and verify code_verifier in /token exchange."
+                ]
+            });
+        }
+        // 6. Hardcoded JWT secret (short literal string)
+        const hardcodedJwtHits = await codeSearch(String.raw `jwt\.sign\s*\([^,]+,\s*['"][a-zA-Z0-9!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]{1,32}['"]|jwt\.verify\s*\([^,]+,\s*['"][a-zA-Z0-9!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]{1,32}['"]`);
+        if (hardcodedJwtHits.length > 0) {
+            findings.push({
+                id: "HARDCODED_JWT_SECRET",
+                title: "Hardcoded JWT secret literal — secret exposed in source code (CWE-798)",
+                severity: "CRITICAL",
+                evidence: hardcodedJwtHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(hardcodedJwtHits.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Move JWT secrets to environment variables or a secrets manager; never commit them to source.",
+                    "CWE-798 — hardcoded secrets are trivially extracted from git history and Docker images.",
+                    "Fix: jwt.sign(payload, process.env.JWT_SECRET!, { algorithms: ['RS256'] })"
+                ]
+            });
+        }
+        // 7. Login/auth/token endpoints without rate limiting middleware
+        const loginRouteHits = await codeSearch(String.raw `(?:router|app)\.post\s*\(\s*['"][^'"]*(?:\/login|\/signin|\/auth|\/token|\/session)['"]\s*,`);
+        const rateLimitRe = /rateLimit|rateLimiter|rate_limit|limiter|throttle|slowDown|expressRateLimit/;
+        const rateLimitMissing = loginRouteHits.filter((h) => !rateLimitRe.test(h.preview));
+        if (rateLimitMissing.length > 0) {
+            findings.push({
+                id: "MISSING_RATE_LIMIT_LOGIN",
+                title: "Authentication endpoint without rate limiting — brute force attack surface (CWE-307)",
+                severity: "HIGH",
+                evidence: rateLimitMissing.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(rateLimitMissing.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Apply express-rate-limit or equivalent middleware to all authentication endpoints.",
+                    "CWE-307 — without rate limiting, brute force or credential stuffing attacks are unrestricted.",
+                    "Fix: app.post('/login', loginRateLimiter, authHandler); // max: 5 attempts per 15 minutes"
+                ]
+            });
+        }
+        // 8. Plaintext password comparison (timing oracle / no hashing)
+        const passwordCompareHits = await codeSearch(String.raw `password\s*===\s*(?:req\.|user\.|stored|db\.|record\.)|(?:req\.|body\.)password\s*===\s*|password\s*==\s*(?:req\.|user\.|stored|db\.)|compareSync\s*\(\s*(?:req\.|body\.)`);
+        const passwordSafeRe = /bcrypt|argon2|scrypt|pbkdf2|timingSafeEqual|compare\s*\(/i;
+        const passwordUnsafe = passwordCompareHits.filter((h) => !passwordSafeRe.test(h.preview));
+        if (passwordUnsafe.length > 0) {
+            findings.push({
+                id: "PASSWORD_PLAIN_COMPARE",
+                title: "Plaintext password comparison — no hashing or timing oracle (CWE-256)",
+                severity: "CRITICAL",
+                evidence: passwordUnsafe.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(passwordUnsafe.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Use bcrypt.compare() or argon2.verify() for password verification — never === comparison.",
+                    "CWE-256 — plaintext comparison leaks timing information and stores passwords without hashing.",
+                    "Fix: const valid = await bcrypt.compare(password, user.passwordHash); if (!valid) throw new Error('Unauthorized');"
+                ]
+            });
+        }
+        // 9. SAML signature validation disabled
+        const samlHits = await codeSearch(String.raw `(?:new\s+saml\.Strategy|passport-saml|samlify|node-saml|SAMLResponse|validateSignature\s*:\s*false|wantAssertionsSigned\s*:\s*false|signatureAlgorithm\s*:\s*['"]none['"])`);
+        const samlUnsafeRe = /validateSignature\s*:\s*false|wantAssertionsSigned\s*:\s*false|signatureAlgorithm\s*:\s*['"]none['"]/;
+        const samlUnsafe = samlHits.filter((h) => samlUnsafeRe.test(h.preview));
+        if (samlUnsafe.length > 0) {
+            findings.push({
+                id: "SAML_SIGNATURE_NOT_ENFORCED",
+                title: "SAML signature validation disabled — SAML response forgery (CWE-347)",
+                severity: "CRITICAL",
+                evidence: samlUnsafe.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(samlUnsafe.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Set validateSignature:true and wantAssertionsSigned:true in all SAML strategy configurations.",
+                    "CWE-347 — unsigned SAML responses allow any user to craft an assertion claiming to be any other user.",
+                    "Fix: new SamlStrategy({ validateSignature: true, wantAssertionsSigned: true, cert: IDP_CERT }, ...)"
+                ]
+            });
+        }
+        // 10. Cookies without httpOnly/secure/sameSite flags
+        const cookieHits = await codeSearch(String.raw `res\.cookie\s*\(\s*['"][^'"]+['"]`);
+        const cookieHttpOnlyRe = /httpOnly\s*:\s*true/;
+        const cookieSecureRe = /secure\s*:\s*true/;
+        const cookieUnsafe = cookieHits.filter((h) => !cookieHttpOnlyRe.test(h.preview) || !cookieSecureRe.test(h.preview));
+        if (cookieUnsafe.length > 0) {
+            findings.push({
+                id: "COOKIE_MISSING_SECURE_FLAGS",
+                title: "Cookie set without httpOnly and/or secure flags (CWE-1004 / CWE-614)",
+                severity: "HIGH",
+                evidence: cookieUnsafe.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(cookieUnsafe.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Set httpOnly:true, secure:true, and sameSite:'Strict' on all authentication and session cookies.",
+                    "CWE-1004/CWE-614 — missing httpOnly enables XSS cookie theft; missing secure sends cookie over HTTP.",
+                    "Fix: res.cookie('session', token, { httpOnly: true, secure: true, sameSite: 'Strict', maxAge: 3600000 });"
+                ]
+            });
+        }
+        // 11. Refresh token issued but old token not invalidated (token rotation missing)
+        const refreshTokenHits = await codeSearch(String.raw `(?:refresh_token|refreshToken)\s*[:=](?:.*jwt\.sign|.*generateToken|.*createToken|.*sign\s*\()|(?:grantType|grant_type)\s*[:=]\s*['"]refresh_token['"]`);
+        const refreshRotateRe = /delete|revoke|invalidate|blacklist|rotateToken|revokeToken|tokenFamily|REFRESH_TOKEN_FAMILY/;
+        const refreshUnsafe = refreshTokenHits.filter((h) => !refreshRotateRe.test(h.preview));
+        if (refreshUnsafe.length > 0) {
+            findings.push({
+                id: "REFRESH_TOKEN_NOT_ROTATED",
+                title: "Refresh token issued without revoking previous token — replay attack surface (CWE-613)",
+                severity: "HIGH",
+                evidence: refreshUnsafe.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(refreshUnsafe.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Implement refresh token rotation: invalidate the old token before issuing the new one.",
+                    "CWE-613 — without rotation, a stolen refresh token remains valid indefinitely.",
+                    "Fix: await db.refreshTokens.delete(oldToken); const newToken = issueRefreshToken(user); // token family detection for theft detection"
+                ]
+            });
+        }
+        // 12. JWT HS/RS confusion — jwt.verify called without algorithm pin on RS256 context
+        const jwtHsRsHits = await codeSearch(String.raw `jwt\.verify\s*\(\s*[^,]+,\s*(?:publicKey|PUBLIC_KEY|pub_key|process\.env\.[A-Z_]*PUBLIC|fs\.readFileSync[^)]*\.pem)`);
+        const jwtHsRsSafeRe = /algorithms\s*:\s*\[\s*['"](?:RS|ES|PS)/;
+        const jwtHsRsUnsafe = jwtHsRsHits.filter((h) => !jwtHsRsSafeRe.test(h.preview));
+        if (jwtHsRsUnsafe.length > 0) {
+            findings.push({
+                id: "JWT_HS_RS_CONFUSION",
+                title: "JWT verified with public key without algorithm pin — HS/RS confusion attack (CVE-2015-9235 pattern)",
+                severity: "CRITICAL",
+                evidence: jwtHsRsUnsafe.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(jwtHsRsUnsafe.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Pin the algorithm to RS256/ES256 explicitly: jwt.verify(token, publicKey, { algorithms: ['RS256'] }).",
+                    "Without algorithm pin: attacker takes RS256 public key, signs token with HS256 using that key as the HMAC secret — library accepts it.",
+                    "This is CVE-2015-9235 — still exploitable in jsonwebtoken < 9.0 without the algorithms option."
+                ]
+            });
+        }
+    }
+    catch (err) {
+        console.warn("[checkAuthDeep] Internal error:", sanitizeErrorMessage(err instanceof Error ? err.message : String(err)));
+    }
+    return findings;
+}

package/dist/gate/checks/injection-deep.js

@@ -0,0 +1,205 @@
+/**
+ * Deep injection class enforcement — covers attack vectors not detected by existing checks.
+ * CWE references per MITRE CWE catalog; ATT&CK techniques per MITRE ATT&CK v14.
+ */
+import { sanitizeErrorMessage } from "../result.js";
+import { searchRepo } from "../../repo/search.js";
+const NON_CODE_RE = /\.(?:md|json|yaml|yml|txt|rst|toml|lock)$/i;
+export async function checkInjectionDeep(_opts) {
+    const findings = [];
+    const codeSearch = async (query) => (await searchRepo({ query, isRegex: true, maxMatches: 200 })).filter(h => !NON_CODE_RE.test(h.file));
+    try {
+        // 1. XXE — XML entity parsing without entity disabling
+        const xxeHits = await codeSearch(String.raw `(?:new\s+(?:DOMParser|SAXParser|XMLParser|fxp\.XMLParser)|xml2js\.parseString|fast-xml-parser|libxmljs\.parseXml|parseXML)\s*\(`);
+        const xxeSafeRe = /entityExpansion\s*:\s*false|processEntities\s*:\s*false|resolveEntities\s*:\s*false|FEATURE_EXTERNAL_GENERAL_ENTITIES|XMLConstants\.FEATURE_SECURE_PROCESSING/;
+        const xxeUnsafe = xxeHits.filter((h) => !xxeSafeRe.test(h.preview));
+        if (xxeUnsafe.length > 0) {
+            findings.push({
+                id: "XXE_ENTITY_PARSING",
+                title: "XML parser may process external entities (XXE — CWE-611)",
+                severity: "HIGH",
+                evidence: xxeUnsafe.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(xxeUnsafe.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Disable external entity processing: set processEntities:false (fast-xml-parser) or resolveEntities:false (xml2js).",
+                    "CWE-611 / ATT&CK T1190 — XXE can leak files, SSRF, or RCE via server-side request.",
+                    "Example fix (fast-xml-parser): new XMLParser({ processEntities: false, ignoreAttributes: false })"
+                ]
+            });
+        }
+        // 2. SSTI — server-side template injection via user-controlled compile
+        const sstiHits = await codeSearch(String.raw `(?:Handlebars\.compile|ejs\.render|ejs\.compile|nunjucks\.renderString|pug\.compile|pug\.render|\.template\s*\(|Mustache\.render)\s*\(\s*(?:req\.|body\.|params\.|query\.|user\.|input|template|src)`);
+        if (sstiHits.length > 0) {
+            findings.push({
+                id: "SSTI_TEMPLATE_COMPILE",
+                title: "Server-side template compiled from user input (SSTI — CWE-94)",
+                severity: "CRITICAL",
+                evidence: sstiHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(sstiHits.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Never compile templates from user input — only render with user-controlled data as context variables.",
+                    "CWE-94 / ATT&CK T1059 — SSTI achieves RCE via template engine expression evaluation.",
+                    "Fix: precompile templates at build time; pass untrusted data only as template context, never as template source."
+                ]
+            });
+        }
+        // 3. Prototype pollution — unsafe merge of user-controlled data into plain objects
+        const ppHits = await codeSearch(String.raw `(?:_\.merge|Object\.assign|deepmerge|lodash\.merge|merge\s*\()\s*\(\s*(?:\{\}|obj|target|options|config|settings|result)\s*,\s*(?:req\.|body\.|params\.|query\.|user\.|payload\.|data\.)`);
+        if (ppHits.length > 0) {
+            findings.push({
+                id: "PROTOTYPE_POLLUTION",
+                title: "Unsafe merge of user-controlled data into plain object — prototype pollution risk (CWE-1321)",
+                severity: "HIGH",
+                evidence: ppHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(ppHits.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Validate with Zod/Joi schema before merging; use Object.create(null) as the merge target.",
+                    "CWE-1321 / ATT&CK T1548 — payload {\"__proto__\":{\"isAdmin\":true}} can pollute all objects in the process.",
+                    "Fix: const safe = schema.parse(req.body); Object.assign(Object.create(null), defaults, safe);"
+                ]
+            });
+        }
+        // 4. Open redirect — res.redirect with unvalidated user input
+        const openRedirectHits = await codeSearch(String.raw `res\.redirect\s*\(\s*(?:req\.|body\.|params\.|query\.|headers\.|url\b|redirect|returnUrl|next|target|destination)`);
+        const redirectAllowlistRe = /allowlist|allowedHosts|isAllowed|REDIRECT_WHITELIST|validateRedirect|isSafeUrl|startsWith\s*\(['"]\/\b/;
+        const openRedirectUnsafe = openRedirectHits.filter((h) => !redirectAllowlistRe.test(h.preview));
+        if (openRedirectUnsafe.length > 0) {
+            findings.push({
+                id: "OPEN_REDIRECT",
+                title: "Open redirect — user-controlled URL in res.redirect() without allowlist (CWE-601)",
+                severity: "HIGH",
+                evidence: openRedirectUnsafe.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(openRedirectUnsafe.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Validate redirect targets against an allowlist of trusted hosts or enforce relative-only redirects.",
+                    "CWE-601 / ATT&CK T1598 — open redirects are used in phishing chains and OAuth token theft.",
+                    "Fix: if (!url.startsWith('/') || url.startsWith('//')) throw new Error('Invalid redirect');"
+                ]
+            });
+        }
+        // 5. NoSQL operator injection — MongoDB query built from req.body directly
+        const nosqlHits = await codeSearch(String.raw `(?:\.find|\.findOne|\.findOneAndUpdate|\.updateOne|\.deleteOne|\.aggregate)\s*\(\s*(?:req\.body|body\.|params\.|query\.)\b`);
+        if (nosqlHits.length > 0) {
+            findings.push({
+                id: "NOSQL_OPERATOR_INJECTION",
+                title: "NoSQL query built from user input without operator stripping (CWE-943)",
+                severity: "HIGH",
+                evidence: nosqlHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(nosqlHits.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Never pass req.body directly into MongoDB queries — extract and validate each field individually.",
+                    "CWE-943 — payload {\"$gt\":\"\"} bypasses equality checks; {\"$where\":\"sleep(5000)\"} achieves DoS.",
+                    "Fix: const { username } = z.object({ username: z.string() }).parse(req.body); User.findOne({ username });"
+                ]
+            });
+        }
+        // 6. CRLF injection — user value in res.setHeader without sanitization
+        const crlfHits = await codeSearch(String.raw `res\.setHeader\s*\(\s*[^,]+,\s*(?:req\.|body\.|params\.|query\.|user\.|headers\.)`);
+        const crlfSafeRe = /replace\s*\(.*\\r|replace\s*\(.*\\n|sanitize|encodeURIComponent/;
+        const crlfUnsafe = crlfHits.filter((h) => !crlfSafeRe.test(h.preview));
+        if (crlfUnsafe.length > 0) {
+            findings.push({
+                id: "CRLF_INJECTION",
+                title: "CRLF injection risk — user value written to HTTP response header (CWE-113)",
+                severity: "HIGH",
+                evidence: crlfUnsafe.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(crlfUnsafe.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    String.raw `Strip \r and \n from any user-controlled value before writing to response headers.`,
+                    "CWE-113 — CRLF injection enables HTTP response splitting, header injection, session fixation.",
+                    String.raw `Fix: const safe = value.replace(/[\r\n]/g, ''); res.setHeader('X-Header', safe);`
+                ]
+            });
+        }
+        // 7. YAML unsafe load (js-yaml v3 default)
+        const yamlHits = await codeSearch(String.raw `yaml\.load\s*\((?!.*FAILSAFE_SCHEMA)(?!.*JSON_SCHEMA)(?!.*CORE_SCHEMA)|jsYaml\.load\s*\((?!.*schema)|require\s*\(['"]js-yaml['"]\)\.load\s*\(`);
+        if (yamlHits.length > 0) {
+            findings.push({
+                id: "YAML_UNSAFE_LOAD",
+                title: "js-yaml load() without safe schema — arbitrary code execution risk (CWE-502)",
+                severity: "CRITICAL",
+                evidence: yamlHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(yamlHits.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Use yaml.load(str, { schema: yaml.FAILSAFE_SCHEMA }) or yaml.safeLoad() (js-yaml v3).",
+                    "CWE-502 — js-yaml default schema executes JS functions embedded in YAML (!!js/function).",
+                    "For js-yaml v4+: safeLoad was removed; use load() which is safe by default — verify version."
+                ]
+            });
+        }
+        // 8. Unsafe deserialization
+        const deserializeHits = await codeSearch(String.raw `(?:node-serialize\.unserialize|serialize\.unserialize|unserialize\s*\(|new\s+Function\s*\(\s*(?:req\.|body\.|params\.|data\.|input)|eval\s*\(\s*(?:req\.|body\.|params\.|data\.|Buffer\.from|atob\())`);
+        if (deserializeHits.length > 0) {
+            findings.push({
+                id: "DESERIALIZE_UNSAFE",
+                title: "Unsafe deserialization of user input (CWE-502)",
+                severity: "CRITICAL",
+                evidence: deserializeHits.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(deserializeHits.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Never deserialize untrusted data with node-serialize, eval(), or new Function().",
+                    "CWE-502 / ATT&CK T1059 — deserialization gadget chains achieve RCE without user interaction.",
+                    "Fix: use JSON.parse() with a Zod schema for structured data; for binary formats use a safe decoder with a strict schema."
+                ]
+            });
+        }
+        // 9. Path traversal — path.join with user-controlled segment without normalization check
+        const pathTraversalHits = await codeSearch(String.raw `path\.(?:join|resolve)\s*\([^)]*(?:req\.|body\.|params\.|query\.|filename|filepath|file_path|filePath|fileName)[^)]*\)`);
+        const pathSafeRe = /normalize|startsWith|indexOf\s*\(base|resolve.*startsWith|\.includes\s*\(['"]\.\.['"]|path\.sep/;
+        const pathUnsafe = pathTraversalHits.filter((h) => !pathSafeRe.test(h.preview));
+        if (pathUnsafe.length > 0) {
+            findings.push({
+                id: "PATH_TRAVERSAL_JOIN",
+                title: "Path traversal — path.join() with user input without prefix verification (CWE-22)",
+                severity: "HIGH",
+                evidence: pathUnsafe.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(pathUnsafe.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "After path.join(), verify the resolved path starts with the intended base directory.",
+                    "CWE-22 / ATT&CK T1083 — ../../etc/passwd reads arbitrary files on the server.",
+                    "Fix: const full = path.resolve(BASE_DIR, userFilename); if (!full.startsWith(BASE_DIR + path.sep)) throw new Error('Invalid path');"
+                ]
+            });
+        }
+        // 10. Log injection — user-controlled strings logged without newline stripping
+        const logInjectionHits = await codeSearch(String.raw `(?:console\.(?:log|warn|error|info)|logger\.(?:log|warn|error|info|debug)|log\.(?:info|warn|error|debug))\s*\([^)]*(?:req\.|body\.|params\.|query\.|headers\.|user\.|username|email|ip\b)`);
+        const logSafeRe = /replace\s*\(.*\\n|replace\s*\(.*\\r|sanitize|JSON\.stringify|inspect\s*\(/;
+        const logUnsafe = logInjectionHits.filter((h) => !logSafeRe.test(h.preview));
+        if (logUnsafe.length > 0) {
+            findings.push({
+                id: "LOG_INJECTION",
+                title: "Log injection — user-controlled string written to logs without newline sanitization (CWE-117)",
+                severity: "MEDIUM",
+                evidence: logUnsafe.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(logUnsafe.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    String.raw `Strip or encode \n and \r from user-controlled values before logging.`,
+                    "CWE-117 — log injection forges log entries, erasing evidence of attacks or injecting false audit trails.",
+                    String.raw `Fix: logger.info('Login attempt', { username: username.replace(/[\r\n]/g, '_') });`
+                ]
+            });
+        }
+        // 11. SSRF via user-controlled URL in HTTP request
+        const ssrfHits = await codeSearch(String.raw `(?:fetch|axios\.(?:get|post|put|delete|request)|https?\.(?:get|request)|got\s*\(|needle\.(?:get|post)|superagent\.(?:get|post))\s*\(\s*(?:req\.|body\.|params\.|query\.|url\b|webhook|endpoint|target|callback|proxy)`);
+        const ssrfSafeRe = /allowedHosts|SSRF_GUARD|validateUrl|isAllowedUrl|new URL.*hostname|URL_ALLOWLIST/;
+        const ssrfUnsafe = ssrfHits.filter((h) => !ssrfSafeRe.test(h.preview));
+        if (ssrfUnsafe.length > 0) {
+            findings.push({
+                id: "SSRF_USER_URL",
+                title: "SSRF — HTTP request to user-controlled URL without allowlist (CWE-918)",
+                severity: "CRITICAL",
+                evidence: ssrfUnsafe.slice(0, 10).map((m) => `${m.file}:${m.line}:${m.preview}`),
+                files: [...new Set(ssrfUnsafe.slice(0, 10).map((m) => m.file))],
+                requiredActions: [
+                    "Validate the URL hostname against an explicit allowlist before making server-side HTTP requests.",
+                    "CWE-918 / ATT&CK T1090 — SSRF reaches 169.254.169.254 for cloud metadata, internal services, and localhost.",
+                    "Fix: const { hostname } = new URL(userUrl); if (!ALLOWED_HOSTS.includes(hostname)) throw new Error('Blocked');"
+                ]
+            });
+        }
+    }
+    catch (err) {
+        console.warn("[checkInjectionDeep] Internal error:", sanitizeErrorMessage(err instanceof Error ? err.message : String(err)));
+    }
+    return findings;
+}

package/dist/gate/policy.js

@@ -28,6 +28,8 @@ import { runRuntimeChecks } from "./checks/runtime.js";
 import { runCiPipelineChecks } from "./checks/ci-pipeline.js";
 import { runNucleiChecks } from "./checks/nuclei.js";
 import { getCommitHash, loadBaseline, saveBaseline, compareBaseline } from "./baseline.js";
+import { checkInjectionDeep } from "./checks/injection-deep.js";
+import { checkAuthDeep } from "./checks/auth-deep.js";
 import { randomUUID } from "node:crypto";
 const PolicySchema = z.object({
     name: z.string(),
@@ -170,7 +172,9 @@ export async function runPrGate(opts) {
             surfaces.ai ? runAiRedteamChecks({ changedFiles }) : Promise.resolve([]),
             process.env["SECURITY_STAGING_URL"] ? runRuntimeChecks({ targets, changedFiles }) : Promise.resolve([]),
             runCiPipelineChecks({ changedFiles }),
-            process.env["SECURITY_STAGING_URL"] ? runNucleiChecks({ changedFiles }) : Promise.resolve([])
+            process.env["SECURITY_STAGING_URL"] ? runNucleiChecks({ changedFiles }) : Promise.resolve([]),
+            (surfaces.api || surfaces.web) ? checkInjectionDeep({ changedFiles }) : Promise.resolve([]),
+            (surfaces.api || surfaces.web) ? checkAuthDeep({ changedFiles }) : Promise.resolve([])
         ]);
         rawFindings = [];
         for (const result of checkResults) {