ship-safe 5.0.0 → 6.0.0

package/cli/agents/scoring-engine.js

@@ -16,22 +16,28 @@ import path from 'path';
 // SCORING CONFIGURATION
 // =============================================================================
 
+// Weights aligned with OWASP Top 10 2025:
+//   A01 Broken Access Control (auth: 15), A02 Security Misconfiguration (config: 8),
+//   A03 Software Supply Chain Failures (supply-chain: 12, deps: 13),
+//   A05 Injection (injection: 15), A07 Auth Failures (secrets: 15),
+//   A10 Mishandling of Exceptional Conditions (→ injection category)
+//   + API Security (10), AI/LLM Security (12) — weights sum to 100
 const CATEGORIES = {
   secrets:       { weight: 15, label: 'Secrets',                deductions: { critical: 25, high: 15, medium: 5 } },
   injection:     { weight: 15, label: 'Code Vulnerabilities',   deductions: { critical: 20, high: 10, medium: 3 } },
-  deps:          { weight: 15, label: 'Dependencies',           deductions: { critical: 20, high: 10, medium: 5, moderate: 5 } },
+  deps:          { weight: 13, label: 'Dependencies',           deductions: { critical: 20, high: 10, medium: 5, moderate: 5 } },
   auth:          { weight: 15, label: 'Auth & Access Control',  deductions: { critical: 20, high: 10, medium: 3 } },
-  config:        { weight: 10, label: 'Configuration',          deductions: { critical: 15, high: 8,  medium: 3 } },
-  'supply-chain':{ weight: 10, label: 'Supply Chain',           deductions: { critical: 15, high: 8,  medium: 3 } },
+  config:        { weight: 8,  label: 'Configuration',          deductions: { critical: 15, high: 8,  medium: 3 } },
+  'supply-chain':{ weight: 12, label: 'Supply Chain',           deductions: { critical: 15, high: 8,  medium: 3 } },
   api:           { weight: 10, label: 'API Security',           deductions: { critical: 15, high: 8,  medium: 3 } },
-  llm:           { weight: 10, label: 'AI/LLM Security',       deductions: { critical: 15, high: 8,  medium: 3 } },
+  llm:           { weight: 12, label: 'AI/LLM Security',       deductions: { critical: 15, high: 8,  medium: 3 } },
 };
 
 // Fallback categories for findings that don't match a known category
 const FALLBACK_CATEGORY_MAP = {
   'secret': 'secrets',
   'vulnerability': 'injection',
-  'ssrf': 'injection',
+  'ssrf': 'injection',        // OWASP 2025: SSRF merged into A01 Broken Access Control
   'history': 'secrets',
   'cicd': 'config',
   'mobile': 'injection',
@@ -39,7 +45,9 @@ const FALLBACK_CATEGORY_MAP = {
   'mcp': 'llm',
   'agentic': 'llm',
   'rag': 'llm',
-  'recon': null, // skip recon findings
+  'vibe': 'injection',        // Vibe coding findings → Code Vulnerabilities
+  'exception': 'injection',   // OWASP A10:2025 — Mishandling of Exceptional Conditions
+  'recon': null,               // skip recon findings
 };
 
 const GRADES = [

package/cli/agents/vibe-coding-agent.js

@@ -0,0 +1,250 @@
+/**
+ * Vibe Coding Security Agent
+ * ============================
+ *
+ * Detects security vulnerabilities commonly introduced by
+ * AI-generated code (Cursor, Copilot, Claude Code, etc.).
+ *
+ * 45% of AI-generated code contains security vulnerabilities.
+ * This agent targets the most frequent patterns:
+ *
+ *   - Placeholder credentials left in code
+ *   - Missing input validation on AI-generated routes
+ *   - Overly permissive defaults (CORS *, DEBUG=True)
+ *   - Unprotected API endpoints (no auth middleware)
+ *   - TODO/FIXME security markers left behind
+ *   - Hardcoded localhost/development URLs in production code
+ *   - Incomplete error handling (empty catch blocks)
+ *   - AI-generated boilerplate with known insecure patterns
+ *
+ * Maps to: OWASP A01 (Broken Access Control), A05 (Security Misconfiguration)
+ */
+
+import path from 'path';
+import { BaseAgent, createFinding } from './base-agent.js';
+
+// =============================================================================
+// VIBE CODING PATTERNS
+// =============================================================================
+
+const PATTERNS = [
+  // ── Placeholder Credentials ───────────────────────────────────────────────
+  {
+    rule: 'VIBE_PLACEHOLDER_KEY',
+    title: 'Vibe Code: Placeholder API Key Left in Code',
+    regex: /(?:api[_-]?key|apikey|secret|token|password)\s*[:=]\s*['"](?:your[_-]?(?:api[_-]?)?key[_-]?here|sk[_-](?:test|live)[_-]x{5,}|xxx+|insert[_-]?(?:your[_-]?)?(?:key|token|secret)[_-]?here|change[_-]?me|replace[_-]?(?:this|me)|put[_-]?your[_-]?(?:key|token))['"]/gi,
+    severity: 'critical',
+    cwe: 'CWE-798',
+    owasp: 'A07:2021',
+    description: 'AI-generated placeholder credential left in code. These are commonly generated by Copilot/Cursor and forgotten before deploy.',
+    fix: 'Replace with environment variable: process.env.API_KEY or os.environ["API_KEY"]',
+  },
+  {
+    rule: 'VIBE_PLACEHOLDER_URL',
+    title: 'Vibe Code: Placeholder URL Left in Code',
+    regex: /['"]https?:\/\/(?:your[_-]?(?:domain|api|server|backend)|example\.com\/api|api\.example|placeholder)[^'"]*['"]/gi,
+    severity: 'medium',
+    cwe: 'CWE-1188',
+    owasp: 'A05:2021',
+    confidence: 'medium',
+    description: 'AI-generated placeholder URL left in code. May cause requests to fail or leak data to unintended endpoints.',
+    fix: 'Replace with environment variable for the API URL',
+  },
+
+  // ── Security TODO/FIXME Markers ───────────────────────────────────────────
+  {
+    rule: 'VIBE_TODO_AUTH',
+    title: 'Vibe Code: TODO — Add Authentication',
+    regex: /\/\/\s*(?:TODO|FIXME|HACK|XXX)\s*:?\s*(?:add|implement|fix|enable|require)\s+(?:auth(?:entication|orization)?|login|session|jwt|token|middleware|permission|rbac|access.?control)/gi,
+    severity: 'high',
+    cwe: 'CWE-306',
+    owasp: 'A01:2021',
+    description: 'Code has a TODO marker to add authentication/authorization. AI-generated code often ships without auth.',
+    fix: 'Implement authentication before deploying. This TODO indicates a known security gap.',
+  },
+  {
+    rule: 'VIBE_TODO_VALIDATION',
+    title: 'Vibe Code: TODO — Add Input Validation',
+    regex: /\/\/\s*(?:TODO|FIXME|HACK|XXX)\s*:?\s*(?:add|implement|fix|enable)\s+(?:valid(?:ation|ate)|sanitiz(?:e|ation)|escap(?:e|ing)|input.?check|type.?check)/gi,
+    severity: 'high',
+    cwe: 'CWE-20',
+    owasp: 'A03:2021',
+    description: 'Code has a TODO marker to add input validation. AI-generated endpoints frequently skip validation.',
+    fix: 'Implement input validation before deploying. Unvalidated input leads to injection attacks.',
+  },
+  {
+    rule: 'VIBE_TODO_SECURITY',
+    title: 'Vibe Code: TODO — Security Fix Needed',
+    regex: /\/\/\s*(?:TODO|FIXME|HACK|XXX)\s*:?\s*(?:add|implement|fix|enable|remove)\s+(?:security|encrypt(?:ion)?|hash(?:ing)?|rate.?limit|csrf|xss|cors|https|ssl|tls|firewall)/gi,
+    severity: 'high',
+    cwe: 'CWE-693',
+    owasp: 'A05:2021',
+    description: 'Security-related TODO left in code. This marks a known vulnerability the developer intended to fix.',
+    fix: 'Address this security TODO before deploying to production.',
+  },
+
+  // ── Missing Auth on Routes ────────────────────────────────────────────────
+  {
+    rule: 'VIBE_UNPROTECTED_DELETE',
+    title: 'Vibe Code: DELETE Endpoint Without Auth Check',
+    regex: /(?:app|router)\.(?:delete)\s*\(\s*['"][^'"]+['"]\s*,\s*(?:async\s+)?\(?(?:req|request|ctx)\b/g,
+    severity: 'high',
+    cwe: 'CWE-306',
+    owasp: 'A01:2021',
+    confidence: 'medium',
+    description: 'DELETE endpoint defined without visible auth middleware. AI often generates CRUD routes without access control.',
+    fix: 'Add authentication middleware: router.delete("/resource/:id", authMiddleware, handler)',
+  },
+  {
+    rule: 'VIBE_UNPROTECTED_ADMIN',
+    title: 'Vibe Code: Admin Route Without Auth Middleware',
+    regex: /(?:app|router)\.(?:get|post|put|patch|delete)\s*\(\s*['"]\/admin[^'"]*['"]\s*,\s*(?:async\s+)?\(?(?:req|request|ctx)\b/g,
+    severity: 'critical',
+    cwe: 'CWE-306',
+    owasp: 'A01:2021',
+    confidence: 'medium',
+    description: 'Admin route defined without visible auth middleware. AI-generated admin panels often lack access control.',
+    fix: 'Add auth + admin role check: router.get("/admin", authMiddleware, requireAdmin, handler)',
+  },
+
+  // ── Insecure Defaults ─────────────────────────────────────────────────────
+  {
+    rule: 'VIBE_WILDCARD_CORS',
+    title: 'Vibe Code: CORS Allow All Origins',
+    regex: /cors\s*\(\s*\{?\s*(?:origin\s*:\s*(?:true|['"]?\*['"]?)|(?:origin\s*:\s*\[?\s*['"]?\*['"]?))/g,
+    severity: 'high',
+    cwe: 'CWE-942',
+    owasp: 'A05:2021',
+    description: 'CORS configured to allow all origins. AI tools frequently generate cors({ origin: "*" }) or cors({ origin: true }) as defaults.',
+    fix: 'Restrict to specific origins: cors({ origin: ["https://yourdomain.com"] })',
+  },
+  {
+    rule: 'VIBE_DEBUG_PRODUCTION',
+    title: 'Vibe Code: Debug Mode Enabled',
+    regex: /(?:DEBUG|debug)\s*[:=]\s*(?:true|True|1|['"]true['"])\s*(?:,|\n|$|;)/g,
+    severity: 'high',
+    cwe: 'CWE-489',
+    owasp: 'A05:2021',
+    confidence: 'medium',
+    description: 'Debug mode is enabled. AI-generated configs often leave DEBUG=True from development.',
+    fix: 'Set DEBUG=False for production. Use environment variable: DEBUG=os.environ.get("DEBUG", "False")',
+  },
+  // TLS disabled detection is handled by AuthBypassAgent (NODE_TLS_REJECT_UNAUTHORIZED)
+  // and ConfigAuditor — not duplicated here to avoid false positives on regex definitions.
+
+  // ── Hardcoded Development URLs ────────────────────────────────────────────
+  {
+    rule: 'VIBE_HARDCODED_LOCALHOST',
+    title: 'Vibe Code: Hardcoded localhost URL in Production Code',
+    regex: /(?:fetch|axios|http|request|api|endpoint|baseURL|base_url|API_URL|BACKEND_URL)\s*[:=(]\s*['"]https?:\/\/(?:localhost|127\.0\.0\.1|0\.0\.0\.0):\d+[^'"]*['"]/gi,
+    severity: 'medium',
+    cwe: 'CWE-1188',
+    owasp: 'A05:2021',
+    confidence: 'medium',
+    description: 'Hardcoded localhost URL found. AI-generated code often hardcodes development URLs that break in production.',
+    fix: 'Use environment variable: process.env.API_URL || "http://localhost:3000"',
+  },
+
+  // Empty catch blocks and except: pass are handled by ExceptionHandlerAgent (OWASP A10:2025)
+
+  // ── AI-Generated Insecure Patterns ────────────────────────────────────────
+  {
+    rule: 'VIBE_EVAL_INPUT',
+    title: 'Vibe Code: eval() with Variable Input',
+    regex: /\beval\s*\(\s*(?:req\.|request\.|body\.|params\.|query\.|input|data|payload|args|user)/g,
+    severity: 'critical',
+    cwe: 'CWE-95',
+    owasp: 'A03:2021',
+    description: 'eval() called with user-controlled input. AI sometimes generates eval() for "dynamic" functionality.',
+    fix: 'Never use eval() with user input. Use a safe parser or allowlist of operations.',
+  },
+  {
+    rule: 'VIBE_INNER_HTML',
+    title: 'Vibe Code: innerHTML with Variable',
+    regex: /\.innerHTML\s*=\s*(?!['"]<)[^;]+(?:req|request|input|data|user|response|result|body|params|query|payload)/g,
+    severity: 'high',
+    cwe: 'CWE-79',
+    owasp: 'A03:2021',
+    description: 'innerHTML set with dynamic content. AI-generated frontend code often skips XSS sanitization.',
+    fix: 'Use textContent for plain text, or sanitize with DOMPurify: el.innerHTML = DOMPurify.sanitize(html)',
+  },
+  {
+    rule: 'VIBE_NO_PARAMETERIZED_QUERY',
+    title: 'Vibe Code: String Concatenation in SQL',
+    regex: /(?:query|execute|raw|exec)\s*\(\s*(?:`[^`]*\$\{|['"][^'"]*['"]\s*\+\s*(?:req|request|body|params|query|input|user|data))/g,
+    severity: 'critical',
+    cwe: 'CWE-89',
+    owasp: 'A03:2021',
+    description: 'SQL query built with string concatenation/interpolation. AI-generated database code frequently lacks parameterization.',
+    fix: 'Use parameterized queries: db.query("SELECT * FROM users WHERE id = $1", [userId])',
+  },
+
+  // ── Missing Rate Limiting ─────────────────────────────────────────────────
+  {
+    rule: 'VIBE_NO_RATE_LIMIT',
+    title: 'Vibe Code: Auth Endpoint Without Rate Limiting',
+    regex: /(?:app|router)\.post\s*\(\s*['"]\/(?:login|signin|sign-in|register|signup|sign-up|forgot-password|reset-password|auth\/login)['"]\s*,\s*(?:async\s+)?\(?(?:req|request|ctx)\b/g,
+    severity: 'high',
+    cwe: 'CWE-307',
+    owasp: 'A07:2021',
+    confidence: 'medium',
+    description: 'Authentication endpoint without visible rate limiting. AI-generated auth routes rarely include brute-force protection.',
+    fix: 'Add rate limiting: app.post("/login", rateLimit({ windowMs: 15*60*1000, max: 5 }), handler)',
+  },
+
+  // ── Insecure File Operations ──────────────────────────────────────────────
+  {
+    rule: 'VIBE_PATH_TRAVERSAL',
+    title: 'Vibe Code: User Input in File Path',
+    regex: /(?:readFile|writeFile|createReadStream|createWriteStream|open|access)\s*\(\s*(?:req\.|request\.|body\.|params\.|query\.|`[^`]*\$\{(?:req|request|params|query|body))/g,
+    severity: 'critical',
+    cwe: 'CWE-22',
+    owasp: 'A01:2021',
+    description: 'File operation uses user-controlled input without path validation. AI-generated file serving code often allows path traversal.',
+    fix: 'Validate and sanitize the path: path.resolve(baseDir, path.basename(userInput))',
+  },
+
+  // ── Exposed Secrets in Client Code ────────────────────────────────────────
+  {
+    rule: 'VIBE_SECRET_IN_FRONTEND',
+    title: 'Vibe Code: Secret Key in Frontend/Client Code',
+    regex: /(?:NEXT_PUBLIC_|REACT_APP_|VITE_|NUXT_PUBLIC_|EXPO_PUBLIC_)(?:SECRET|PRIVATE|API_SECRET|DATABASE_URL|DB_PASSWORD|JWT_SECRET|STRIPE_SECRET)/gi,
+    severity: 'critical',
+    cwe: 'CWE-200',
+    owasp: 'A01:2021',
+    description: 'Secret exposed via public environment variable prefix. AI tools often use NEXT_PUBLIC_/REACT_APP_ for all env vars.',
+    fix: 'Remove the public prefix. Server-side secrets must NOT use NEXT_PUBLIC_, REACT_APP_, or VITE_ prefixes.',
+  },
+];
+
+// =============================================================================
+// VIBE CODING AGENT CLASS
+// =============================================================================
+
+export class VibeCodingAgent extends BaseAgent {
+  constructor() {
+    super(
+      'VibeCodingAgent',
+      'Detects security vulnerabilities commonly introduced by AI-generated code',
+      'injection', // maps to Code Vulnerabilities in scoring
+    );
+  }
+
+  async analyze(context) {
+    const files = this.getFilesToScan(context);
+    const findings = [];
+
+    for (const file of files) {
+      const ext = path.extname(file).toLowerCase();
+      // Only scan source code files
+      if (!['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs',
+            '.py', '.rb', '.go', '.java', '.rs', '.php',
+            '.vue', '.svelte', '.astro'].includes(ext)) continue;
+
+      const results = this.scanFileWithPatterns(file, PATTERNS);
+      findings.push(...results);
+    }
+
+    return findings;
+  }
+}

package/cli/bin/ship-safe.js

@@ -37,6 +37,9 @@ import { auditCommand } from '../commands/audit.js';
 import { doctorCommand } from '../commands/doctor.js';
 import { baselineCommand } from '../commands/baseline.js';
 import { ciCommand } from '../commands/ci.js';
+import { diffCommand } from '../commands/diff.js';
+import { vibeCheckCommand } from '../commands/vibe-check.js';
+import { benchmarkCommand } from '../commands/benchmark.js';
 import { PolicyEngine } from '../agents/policy-engine.js';
 import { SBOMGenerator } from '../agents/sbom-generator.js';
 
@@ -47,7 +50,7 @@ import { SBOMGenerator } from '../agents/sbom-generator.js';
 const DEFAULT_MODEL = 'claude-haiku-4-5-20251001';
 
 // Read version from package.json
-const __filename = fileURLToPath(import.meta.url);
+const __filename = fileURLToPath(import.meta.url); // ship-safe-ignore — module's own path via import.meta.url, not user input
 const __dirname = dirname(__filename);
 const packageJson = JSON.parse(readFileSync(join(__dirname, '../../package.json'), 'utf8'));
 const VERSION = packageJson.version;
@@ -189,7 +192,7 @@ program
 // -----------------------------------------------------------------------------
 program
   .command('audit [path]')
-  .description('Full security audit: secrets + 16 agents + deps + score + deep analysis + remediation plan')
+  .description('Full security audit: secrets + 17 agents + deps + score + deep analysis + remediation plan')
   .option('--json', 'Output results as JSON')
   .option('--sarif', 'Output results in SARIF format')
   .option('--csv', 'Output results as CSV')
@@ -210,12 +213,24 @@ program
   .option('-v, --verbose', 'Verbose output')
   .action(auditCommand);
 
+// -----------------------------------------------------------------------------
+// DIFF COMMAND (v6.0 — Scan only changed files)
+// -----------------------------------------------------------------------------
+program
+  .command('diff [ref]')
+  .description('Scan only changed files (git diff) — fast pre-commit & PR scanning')
+  .option('--staged', 'Scan only staged changes')
+  .option('--json', 'Output results as JSON')
+  .option('-p, --path <path>', 'Project path (default: cwd)')
+  .option('--timeout <ms>', 'Per-agent timeout in milliseconds (default: 30000)', parseInt)
+  .action(diffCommand);
+
 // -----------------------------------------------------------------------------
 // RED TEAM COMMAND (v4.0 — Multi-Agent Security Audit)
 // -----------------------------------------------------------------------------
 program
   .command('red-team [path]')
-  .description('Multi-agent security audit: 16 agents scan for 80+ attack classes')
+  .description('Multi-agent security audit: 17 agents scan for 80+ attack classes')
   .option('--agents <list>', 'Comma-separated list of agents to run')
   .option('--json', 'Output results as JSON')
   .option('--sarif', 'Output results in SARIF format')
@@ -291,8 +306,27 @@ program
   .option('--json', 'JSON output')
   .option('--no-deps', 'Skip dependency audit')
   .option('--baseline', 'Only check new findings (not in baseline)')
+  .option('--github-pr', 'Post findings as a GitHub PR comment (requires gh CLI)')
   .action(ciCommand);
 
+// -----------------------------------------------------------------------------
+// VIBE CHECK COMMAND
+// -----------------------------------------------------------------------------
+program
+  .command('vibe-check [path]')
+  .description('Fun security check with emoji output, shareable score, and badge generator')
+  .option('--badge', 'Generate a shields.io markdown badge for your README')
+  .action(vibeCheckCommand);
+
+// -----------------------------------------------------------------------------
+// BENCHMARK COMMAND
+// -----------------------------------------------------------------------------
+program
+  .command('benchmark [path]')
+  .description('Compare your security score against industry averages')
+  .option('--json', 'Output results as JSON')
+  .action(benchmarkCommand);
+
 // -----------------------------------------------------------------------------
 // DOCTOR COMMAND
 // -----------------------------------------------------------------------------
@@ -309,11 +343,14 @@ program
 if (process.argv.length === 2) {
   console.log(banner);
   console.log(chalk.yellow('\nQuick start:\n'));
-  console.log(chalk.cyan.bold('  v5.0 — Full Security Audit'));
-  console.log(chalk.white('  npx ship-safe audit .       ') + chalk.gray('# Full audit: secrets + 16 agents + deps + remediation'));
+  console.log(chalk.cyan.bold('  v6.0 — Full Security Audit'));
+  console.log(chalk.white('  npx ship-safe audit .       ') + chalk.gray('# Full audit: secrets + 17 agents + deps + remediation'));
   console.log(chalk.white('  npx ship-safe audit . --deep') + chalk.gray('# LLM-powered taint analysis (Anthropic/Ollama)'));
-  console.log(chalk.white('  npx ship-safe red-team .    ') + chalk.gray('# 16-agent red team scan (80+ attack classes)'));
+  console.log(chalk.white('  npx ship-safe red-team .    ') + chalk.gray('# 17-agent red team scan (80+ attack classes)'));
+  console.log(chalk.white('  npx ship-safe vibe-check .  ') + chalk.gray('# Fun security check with emoji & shareable badge'));
+  console.log(chalk.white('  npx ship-safe benchmark .   ') + chalk.gray('# Compare score against industry averages'));
   console.log(chalk.white('  npx ship-safe ci .          ') + chalk.gray('# CI/CD mode: scan, score, exit code'));
+  console.log(chalk.white('  npx ship-safe diff          ') + chalk.gray('# Scan only changed files (fast pre-commit)'));
   console.log(chalk.white('  npx ship-safe watch .       ') + chalk.gray('# Continuous monitoring mode'));
   console.log(chalk.white('  npx ship-safe sbom .        ') + chalk.gray('# Generate CycloneDX SBOM (CRA-ready)'));
   console.log(chalk.white('  npx ship-safe policy init   ') + chalk.gray('# Create security policy template'));

package/cli/commands/agent.js

@@ -33,6 +33,7 @@ import {
   SECURITY_PATTERNS,
   SKIP_DIRS,
   SKIP_EXTENSIONS,
+  SKIP_FILENAMES,
   TEST_FILE_PATTERNS,
   MAX_FILE_SIZE
 } from '../utils/patterns.js';
@@ -99,7 +100,7 @@ export async function agentCommand(targetPath = '.', options = {}) {
 
   // ── 4. Fallback: no API key ────────────────────────────────────────────────
   if (!apiKey) {
-    console.log(chalk.yellow('  ⚠  No ANTHROPIC_API_KEY found.'));
+    console.log(chalk.yellow('  ⚠  No ANTHROPIC_API_KEY found.')); // ship-safe-ignore — env var name in user-facing message, no key value
     console.log(chalk.gray('     Set it in your environment or .env to enable AI classification.'));
     if (secretCount > 0) {
       console.log(chalk.gray('     Falling back to pattern-based remediation for secrets...\n'));
@@ -226,8 +227,8 @@ export async function agentCommand(targetPath = '.', options = {}) {
  * Returns the key string or null if not found.
  */
 function loadApiKey(rootPath) {
-  if (process.env.ANTHROPIC_API_KEY) {
-    return process.env.ANTHROPIC_API_KEY;
+  if (process.env.ANTHROPIC_API_KEY) { // ship-safe-ignore — reading env var at runtime, no hardcoded key value
+    return process.env.ANTHROPIC_API_KEY; // ship-safe-ignore — returning env var value, not a hardcoded secret
   }
 
   const envPath = path.join(rootPath, '.env');
@@ -239,7 +240,7 @@ function loadApiKey(rootPath) {
         if (trimmed.startsWith('#') || !trimmed.includes('=')) continue;
         const eqIdx = trimmed.indexOf('=');
         const key = trimmed.slice(0, eqIdx).trim();
-        if (key === 'ANTHROPIC_API_KEY') {
+        if (key === 'ANTHROPIC_API_KEY') { // ship-safe-ignore — parsing .env file to read user's own API key from their project
           const val = trimmed.slice(eqIdx + 1).trim().replace(/^["']|["']$/g, '');
           if (val) return val;
         }
@@ -270,6 +271,7 @@ async function scanProject(rootPath) {
   const files = allFiles.filter(file => {
     const ext = path.extname(file).toLowerCase();
     if (SKIP_EXTENSIONS.has(ext)) return false;
+    if (SKIP_FILENAMES.has(path.basename(file))) return false;
     const basename = path.basename(file);
     if (basename.endsWith('.min.js') || basename.endsWith('.min.css')) return false;
     if (TEST_FILE_PATTERNS.some(p => p.test(file))) return false;

package/cli/commands/audit.js

@@ -29,6 +29,7 @@ import {
   SECURITY_PATTERNS,
   SKIP_DIRS,
   SKIP_EXTENSIONS,
+  SKIP_FILENAMES,
   MAX_FILE_SIZE,
   loadGitignorePatterns
 } from '../utils/patterns.js';
@@ -132,11 +133,39 @@ export async function auditCommand(targetPath = '.', options = {}) {
           description: f.description,
           matched: f.matched,
           confidence: f.confidence,
-          fix: `Move to environment variable or secrets manager`,
+          fix: file.match(/\.env(\..*)?$/)
+            ? `Ensure .env is in .gitignore and use a secrets manager for production`
+            : `Move to environment variable or secrets manager`,
         });
       }
     }
 
+    // Downgrade .env findings if the file is gitignored (properly managed)
+    const gitignoreContent = (() => {
+      try { return fs.readFileSync(path.join(absolutePath, '.gitignore'), 'utf-8'); } catch { return ''; }
+    })();
+    const envIsGitignored = gitignoreContent.split('\n')
+      .map(l => l.trim())
+      .some(l => /^\.env(\s|$)/.test(l) || l === '*.env' || l === '.env*' || l === '.env.local' || l === '.env.production');
+
+    if (envIsGitignored) {
+      for (const f of secretFindings) {
+        if (f.file.match(/\.env(\..*)?$/) && !f.file.includes('node_modules')) {
+          f.severity = 'low';
+          f.confidence = 'low';
+          f.fix = 'Already gitignored — ensure secrets manager is used for production deploys';
+        }
+      }
+    }
+
+    // Downgrade secrets in test files (intentional test fixtures)
+    const TEST_PATH = /(?:__tests__|\.test\.|\.spec\.|\/test\/|\/tests\/|\/fixtures?\/)/i;
+    for (const f of secretFindings) {
+      if (TEST_PATH.test(f.file)) {
+        f.confidence = 'low';
+      }
+    }
+
     // Merge with cached findings for unchanged files
     secretFindings = [...secretFindings, ...cachedSecretFindings];
 
@@ -154,13 +183,14 @@ export async function auditCommand(targetPath = '.', options = {}) {
   }
 
   // ── Phase 2: Agent Scan ───────────────────────────────────────────────────
-  const agentSpinner = machineOutput ? null : ora({ text: chalk.white('[Phase 2/4] Running 12 security agents...'), color: 'cyan' }).start();
+  const orchestrator = buildOrchestrator();
+  const registeredAgentCount = orchestrator.agents?.length || 15;
+  const agentSpinner = machineOutput ? null : ora({ text: chalk.white(`[Phase 2/4] Running ${registeredAgentCount} security agents...`), color: 'cyan' }).start();
   let agentFindings = [];
   let recon = null;
   let agentResults = [];
 
   try {
-    const orchestrator = buildOrchestrator();
     // Suppress individual agent spinners by using quiet mode
     // Pass changedFiles for incremental scanning if cache is valid
     const orchestratorOpts = { quiet: true };
@@ -172,7 +202,7 @@ export async function auditCommand(targetPath = '.', options = {}) {
     if (cacheDiff && cacheDiff.changedFiles.length < allFiles.length) {
       orchestratorOpts.changedFiles = cacheDiff.changedFiles;
     }
-    const results = await orchestrator.runAll(absolutePath, orchestratorOpts);
+    const results = await orchestrator.runAll(absolutePath, orchestratorOpts); // ship-safe-ignore — orchestrator result, not LLM output triggering actions
     recon = results.recon;
     agentFindings = results.findings;
     agentResults = results.agentResults;
@@ -232,6 +262,8 @@ export async function auditCommand(targetPath = '.', options = {}) {
   // Score
   const scoringEngine = new ScoringEngine();
   const scoreResult = scoringEngine.compute(filteredFindings, depVulns);
+  // Round score to 1 decimal place to avoid floating-point noise (e.g., 63.300000000000004)
+  scoreResult.score = Math.round(scoreResult.score * 10) / 10;
   scoringEngine.saveToHistory(absolutePath, scoreResult, suppressions);
 
   const gradeColor = scoreResult.score >= 75 ? chalk.green.bold : scoreResult.score >= 60 ? chalk.yellow.bold : chalk.red.bold;
@@ -391,7 +423,9 @@ export async function auditCommand(targetPath = '.', options = {}) {
     const trend = scoringEngine.getTrend(absolutePath, scoreResult.score);
     if (trend) {
       const arrow = trend.diff > 0 ? chalk.green('↑') : trend.diff < 0 ? chalk.red('↓') : chalk.gray('→');
-      console.log(chalk.gray(`  Trend: ${trend.previousScore} → ${trend.currentScore} ${arrow} (${trend.diff > 0 ? '+' : ''}${trend.diff})`));
+      const roundedDiff = Math.round(trend.diff * 10) / 10;
+      const diffLabel = roundedDiff === 0 ? chalk.gray('no change') : chalk.white(`${roundedDiff > 0 ? '+' : ''}${roundedDiff}`);
+      console.log(chalk.gray(`  Trend: ${trend.previousScore} → ${trend.currentScore} ${arrow} (`) + diffLabel + chalk.gray(')'));
     }
 
     // ── Detailed Comparison ────────────────────────────────────────────────
@@ -415,14 +449,47 @@ function buildRemediationPlan(findings, depVulns, rootPath) {
   const plan = [];
   let priority = 1;
 
+  // Exclude low-confidence findings (test files, docs, comments) from remediation plan
+  const actionable = findings.filter(f => f.confidence !== 'low');
+
   // Priority order: secrets first, then by severity
-  const secretFindings = findings.filter(f => f.category === 'secrets' || f.category === 'secret');
-  const otherFindings = findings.filter(f => f.category !== 'secrets' && f.category !== 'secret');
+  const secretFindings = actionable.filter(f => f.category === 'secrets' || f.category === 'secret');
+  const otherFindings = actionable.filter(f => f.category !== 'secrets' && f.category !== 'secret');
 
   // Group and sort
   for (const sev of SEV_ORDER) {
-    // Secrets at this severity
-    for (const f of secretFindings.filter(s => s.severity === sev)) {
+    // Secrets at this severity — group .env findings by file
+    const sevSecrets = secretFindings.filter(s => s.severity === sev);
+    const envGroups = new Map();
+    const nonEnvSecrets = [];
+
+    for (const f of sevSecrets) {
+      const relFile = path.relative(rootPath, f.file).replace(/\\/g, '/');
+      if (f.file.match(/\.env(\..*)?$/)) {
+        if (!envGroups.has(relFile)) envGroups.set(relFile, []);
+        envGroups.get(relFile).push(f);
+      } else {
+        nonEnvSecrets.push(f);
+      }
+    }
+
+    // One plan item per .env file
+    for (const [relFile, envFindings] of envGroups) {
+      const names = envFindings.map(f => f.title || f.rule).join(', ');
+      plan.push({
+        priority: priority++,
+        severity: sev,
+        category: 'secrets',
+        categoryLabel: 'SECRETS',
+        title: `${envFindings.length} secret${envFindings.length > 1 ? 's' : ''} in ${relFile} (${names})`,
+        file: relFile,
+        action: envFindings[0].fix || 'Ensure .env is in .gitignore and use a secrets manager for production',
+        effort: 'low',
+      });
+    }
+
+    // Individual items for non-.env secrets
+    for (const f of nonEnvSecrets) {
       plan.push({
         priority: priority++,
         severity: sev,
@@ -498,14 +565,17 @@ function printReport(scoreResult, findings, depVulns, recon, plan, rootPath, fil
     const count = Object.values(cat.counts).reduce((a, b) => a + b, 0);
     const icon = count === 0 ? chalk.green('✔') : chalk.red('✘');
     const status = count === 0 ? chalk.green('clean') : chalk.red(`${count} issue(s)`);
-    const deduction = cat.deduction > 0 ? chalk.red(`-${cat.deduction} pts`) : chalk.gray('+0');
+    const deduction = cat.deduction > 0 ? chalk.red(`-${Math.round(cat.deduction * 10) / 10} pts`) : chalk.gray('+0');
     console.log(`  ${icon}  ${chalk.white(cat.label.padEnd(22))} ${status.padEnd(25)} ${deduction}`);
   }
 
-  // Deps row
-  const depIcon = depVulns.length === 0 ? chalk.green('✔') : chalk.red('✘');
-  const depStatus = depVulns.length === 0 ? chalk.green('clean') : chalk.red(`${depVulns.length} CVE(s)`);
-  console.log(`  ${depIcon}  ${chalk.white('Dependencies'.padEnd(22))} ${depStatus}`);
+  // Deps row — only print if not already included in scoreResult.categories
+  const hasDepsCategory = Object.values(scoreResult.categories).some(c => c.label?.toLowerCase().includes('depend'));
+  if (!hasDepsCategory) {
+    const depIcon = depVulns.length === 0 ? chalk.green('✔') : chalk.red('✘');
+    const depStatus = depVulns.length === 0 ? chalk.green('clean') : chalk.red(`${depVulns.length} CVE(s)`);
+    console.log(`  ${depIcon}  ${chalk.white('Dependencies'.padEnd(22))} ${depStatus}`);
+  }
 
   console.log(chalk.gray(`\n  Files scanned: ${filesScanned} | Findings: ${findings.length} | CVEs: ${depVulns.length}`));
 
@@ -694,6 +764,7 @@ async function findFiles(rootPath) {
   return files.filter(file => {
     const ext = path.extname(file).toLowerCase();
     if (SKIP_EXTENSIONS.has(ext)) return false;
+    if (SKIP_FILENAMES.has(path.basename(file))) return false;
     if (path.basename(file).endsWith('.min.js') || path.basename(file).endsWith('.min.css')) return false;
     try { if (fs.statSync(file).size > MAX_FILE_SIZE) return false; } catch { return false; }
     return true;

package/cli/commands/baseline.js

@@ -17,7 +17,7 @@ import path from 'path';
 import chalk from 'chalk';
 import ora from 'ora';
 import { buildOrchestrator } from '../agents/index.js';
-import { SECRET_PATTERNS, SKIP_DIRS, SKIP_EXTENSIONS, MAX_FILE_SIZE } from '../utils/patterns.js';
+import { SECRET_PATTERNS, SKIP_DIRS, SKIP_EXTENSIONS, SKIP_FILENAMES, MAX_FILE_SIZE } from '../utils/patterns.js';
 import { isHighEntropyMatch } from '../utils/entropy.js';
 import fg from 'fast-glob';
 
@@ -45,6 +45,7 @@ async function quickScan(rootPath) {
   const filtered = files.filter(f => {
     const ext = path.extname(f).toLowerCase();
     if (SKIP_EXTENSIONS.has(ext)) return false;
+    if (SKIP_FILENAMES.has(path.basename(f))) return false;
     try { return fs.statSync(f).size <= MAX_FILE_SIZE; } catch { return false; }
   });
 
@@ -77,7 +78,7 @@ async function fullScan(rootPath) {
   const { findings: secretFindings, files } = await quickScan(rootPath);
 
   const orchestrator = buildOrchestrator();
-  const { findings: agentFindings } = await orchestrator.runAll(rootPath, { quiet: true });
+  const { findings: agentFindings } = await orchestrator.runAll(rootPath, { quiet: true }); // ship-safe-ignore — orchestrator result, not LLM output triggering actions
 
   return [...secretFindings, ...agentFindings];
 }