vaspera 2.5.0

package/dist/scanners/secrets.js

@@ -0,0 +1,367 @@
+/**
+ * Secrets Scanner
+ *
+ * Detects hardcoded secrets, API keys, and credentials using:
+ * 1. gitleaks CLI if available
+ * 2. Fallback to regex-based detection
+ *
+ * All secrets findings are severity: critical
+ *
+ * @module scanners/secrets
+ */
+import { spawn } from "child_process";
+import { readFile, readdir } from "fs/promises";
+import { join, relative, extname } from "path";
+import { logger } from "../logger.js";
+/**
+ * Secret detection patterns (fallback when gitleaks not available)
+ */
+const SECRET_PATTERNS = [
+    {
+        name: "aws-access-key",
+        pattern: /AKIA[0-9A-Z]{16}/g,
+        description: "AWS Access Key ID",
+    },
+    {
+        name: "aws-secret-key",
+        pattern: /[0-9a-zA-Z/+]{40}/g,
+        description: "Potential AWS Secret Access Key",
+    },
+    {
+        name: "github-token",
+        pattern: /gh[pousr]_[A-Za-z0-9_]{36,}/g,
+        description: "GitHub Personal Access Token",
+    },
+    {
+        name: "github-oauth",
+        pattern: /gho_[A-Za-z0-9_]{36,}/g,
+        description: "GitHub OAuth Token",
+    },
+    {
+        name: "stripe-key",
+        pattern: /sk_live_[0-9a-zA-Z]{24,}/g,
+        description: "Stripe Secret Key",
+    },
+    {
+        name: "stripe-publishable",
+        pattern: /pk_live_[0-9a-zA-Z]{24,}/g,
+        description: "Stripe Publishable Key (should still not be committed)",
+    },
+    {
+        name: "slack-token",
+        pattern: /xox[baprs]-[0-9a-zA-Z-]{10,}/g,
+        description: "Slack Token",
+    },
+    {
+        name: "slack-webhook",
+        pattern: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]{8}\/B[A-Z0-9]{8,}\/[a-zA-Z0-9]{24}/g,
+        description: "Slack Webhook URL",
+    },
+    {
+        name: "openai-key",
+        pattern: /sk-[a-zA-Z0-9]{48}/g,
+        description: "OpenAI API Key",
+    },
+    {
+        name: "anthropic-key",
+        pattern: /sk-ant-[a-zA-Z0-9-]{95}/g,
+        description: "Anthropic API Key",
+    },
+    {
+        name: "supabase-key",
+        pattern: /eyJ[a-zA-Z0-9_-]*\.eyJ[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]*/g,
+        description: "JWT Token (possibly Supabase)",
+    },
+    {
+        name: "generic-api-key",
+        pattern: /['"][a-zA-Z0-9_-]*[aA][pP][iI][_-]?[kK][eE][yY]['"][\s]*[:=][\s]*['"][a-zA-Z0-9_\-/+=]{20,}['"]/g,
+        description: "Generic API Key assignment",
+    },
+    {
+        name: "generic-secret",
+        pattern: /['"][a-zA-Z0-9_-]*[sS][eE][cC][rR][eE][tT]['"][\s]*[:=][\s]*['"][a-zA-Z0-9_\-/+=]{10,}['"]/g,
+        description: "Generic Secret assignment",
+    },
+    {
+        name: "generic-password",
+        pattern: /['"][a-zA-Z0-9_-]*[pP][aA][sS][sS][wW][oO][rR][dD]['"][\s]*[:=][\s]*['"][^'"]{8,}['"]/g,
+        description: "Hardcoded password",
+    },
+    {
+        name: "private-key",
+        pattern: /-----BEGIN (?:RSA |DSA |EC |OPENSSH )?PRIVATE KEY-----/g,
+        description: "Private key header",
+    },
+];
+/**
+ * Files to skip when scanning for secrets
+ */
+const SKIP_PATTERNS = [
+    /node_modules/,
+    /\.git\//,
+    /dist\//,
+    /build\//,
+    /coverage\//,
+    /\.lock$/,
+    /\.snap$/,
+    /\.min\./,
+    /bundle\./,
+    /vendor\//,
+];
+/**
+ * File extensions to scan
+ */
+const SCAN_EXTENSIONS = new Set([
+    ".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs",
+    ".json", ".yaml", ".yml", ".toml",
+    ".env", ".env.example", ".env.local", ".env.development",
+    ".sh", ".bash", ".zsh",
+    ".py", ".rb", ".go", ".java",
+    ".xml", ".properties", ".cfg", ".ini", ".conf",
+]);
+/**
+ * Run secrets detection and return findings
+ */
+export async function runSecretsScanner(projectPath) {
+    const startTime = Date.now();
+    // Try gitleaks first
+    const gitleaksAvailable = await checkGitleaksAvailable();
+    if (gitleaksAvailable.available) {
+        logger.info("scanners.secrets_using_gitleaks", { version: gitleaksAvailable.version });
+        return runGitleaks(projectPath, startTime);
+    }
+    // Fallback to regex-based detection
+    logger.info("scanners.secrets_using_fallback", {
+        reason: "gitleaks not available, using regex patterns",
+    });
+    return runRegexScanner(projectPath, startTime);
+}
+/**
+ * Run gitleaks CLI
+ */
+async function runGitleaks(projectPath, startTime) {
+    const findings = [];
+    return new Promise((resolve) => {
+        const child = spawn("gitleaks", ["detect", "--source", projectPath, "--report-format", "json", "--report-path", "-", "--no-git"], {
+            cwd: projectPath,
+            timeout: 120000, // 2 minute timeout
+        });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (data) => {
+            stdout += data.toString();
+        });
+        child.stderr.on("data", (data) => {
+            stderr += data.toString();
+        });
+        child.on("close", (code) => {
+            // gitleaks returns 1 if secrets found, 0 if clean
+            if (stdout) {
+                try {
+                    const results = JSON.parse(stdout);
+                    for (const result of results) {
+                        const relativePath = relative(projectPath, result.File) || result.File;
+                        findings.push({
+                            scanner: "gitleaks",
+                            ruleId: `gitleaks:${result.RuleID}`,
+                            file: relativePath,
+                            line: result.StartLine,
+                            column: result.StartColumn,
+                            endLine: result.EndLine,
+                            endColumn: result.EndColumn,
+                            message: result.Description,
+                            severity: "critical", // All secrets are critical
+                            confidence: 100,
+                            evidence: redactSecret(result.Match),
+                            metadata: {
+                                entropy: result.Entropy,
+                                fingerprint: result.Fingerprint,
+                                tags: result.Tags,
+                            },
+                        });
+                    }
+                }
+                catch (parseError) {
+                    // Empty array or parsing failed
+                    logger.debug("scanners.gitleaks_parse_error", {
+                        error: parseError instanceof Error ? parseError.message : String(parseError),
+                    });
+                }
+            }
+            resolve({
+                scanner: "gitleaks",
+                findings,
+                duration: Date.now() - startTime,
+                success: true,
+                exitCode: code ?? undefined,
+            });
+        });
+        child.on("error", (err) => {
+            resolve({
+                scanner: "gitleaks",
+                findings: [],
+                duration: Date.now() - startTime,
+                success: false,
+                error: err.message,
+            });
+        });
+    });
+}
+/**
+ * Run regex-based secret detection (fallback)
+ */
+async function runRegexScanner(projectPath, startTime) {
+    const findings = [];
+    let filesScanned = 0;
+    async function scanDirectory(dirPath) {
+        const entries = await readdir(dirPath, { withFileTypes: true });
+        for (const entry of entries) {
+            const fullPath = join(dirPath, entry.name);
+            const relativePath = relative(projectPath, fullPath);
+            // Skip excluded patterns
+            if (SKIP_PATTERNS.some((pattern) => pattern.test(relativePath))) {
+                continue;
+            }
+            if (entry.isDirectory()) {
+                await scanDirectory(fullPath);
+            }
+            else if (entry.isFile()) {
+                const ext = extname(entry.name).toLowerCase();
+                const shouldScan = SCAN_EXTENSIONS.has(ext) || entry.name.startsWith(".env");
+                if (shouldScan) {
+                    const fileFindings = await scanFile(fullPath, relativePath);
+                    findings.push(...fileFindings);
+                    filesScanned++;
+                }
+            }
+        }
+    }
+    try {
+        await scanDirectory(projectPath);
+        logger.info("scanners.secrets_regex_complete", {
+            filesScanned,
+            findingsCount: findings.length,
+            duration: Date.now() - startTime,
+        });
+        return {
+            scanner: "gitleaks", // Use gitleaks name for consistency
+            findings,
+            duration: Date.now() - startTime,
+            success: true,
+            filesScanned,
+            rulesUsed: SECRET_PATTERNS.map((p) => p.name),
+        };
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        logger.error("scanners.secrets_failed", { error: errorMessage });
+        return {
+            scanner: "gitleaks",
+            findings: [],
+            duration: Date.now() - startTime,
+            success: false,
+            error: errorMessage,
+        };
+    }
+}
+/**
+ * Scan a single file for secrets
+ */
+async function scanFile(filePath, relativePath) {
+    const findings = [];
+    try {
+        const content = await readFile(filePath, "utf-8");
+        const lines = content.split("\n");
+        for (let lineNum = 0; lineNum < lines.length; lineNum++) {
+            const line = lines[lineNum];
+            for (const pattern of SECRET_PATTERNS) {
+                // Reset regex state
+                pattern.pattern.lastIndex = 0;
+                let match;
+                while ((match = pattern.pattern.exec(line)) !== null) {
+                    // Skip if it looks like a placeholder
+                    if (isPlaceholder(match[0]))
+                        continue;
+                    // Skip if it's in a comment
+                    if (isInComment(line, match.index))
+                        continue;
+                    findings.push({
+                        scanner: "gitleaks",
+                        ruleId: `gitleaks:${pattern.name}`,
+                        file: relativePath,
+                        line: lineNum + 1,
+                        column: match.index + 1,
+                        message: pattern.description,
+                        severity: "critical",
+                        confidence: 100,
+                        evidence: redactSecret(match[0]),
+                    });
+                }
+            }
+        }
+    }
+    catch {
+        // Skip files that can't be read
+    }
+    return findings;
+}
+/**
+ * Check if a match is likely a placeholder
+ */
+function isPlaceholder(match) {
+    const lower = match.toLowerCase();
+    return (lower.includes("example") ||
+        lower.includes("placeholder") ||
+        lower.includes("your_") ||
+        lower.includes("xxx") ||
+        lower.includes("***") ||
+        lower.includes("...") ||
+        lower === "''" ||
+        lower === '""' ||
+        /^['"]['"]+$/.test(match));
+}
+/**
+ * Check if position is inside a comment
+ */
+function isInComment(line, position) {
+    const beforeMatch = line.slice(0, position);
+    return beforeMatch.includes("//") || beforeMatch.includes("/*");
+}
+/**
+ * Redact the middle of a secret for display
+ */
+function redactSecret(secret) {
+    if (secret.length <= 10) {
+        return "*".repeat(secret.length);
+    }
+    const visibleChars = Math.min(4, Math.floor(secret.length / 4));
+    return (secret.slice(0, visibleChars) +
+        "*".repeat(secret.length - visibleChars * 2) +
+        secret.slice(-visibleChars));
+}
+/**
+ * Check if gitleaks is available
+ */
+export async function checkGitleaksAvailable() {
+    return new Promise((resolve) => {
+        const child = spawn("gitleaks", ["version"], {
+            timeout: 5000,
+        });
+        let version = "";
+        child.stdout.on("data", (data) => {
+            version += data.toString().trim();
+        });
+        child.on("close", (code) => {
+            if (code === 0 && version) {
+                resolve({ available: true, version });
+            }
+            else {
+                resolve({ available: false, error: "gitleaks not found" });
+            }
+        });
+        child.on("error", () => {
+            resolve({ available: false, error: "gitleaks not found" });
+        });
+    });
+}
+//# sourceMappingURL=secrets.js.map

package/dist/scanners/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/scanners/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAQ,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE/C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AA0BtC;;GAEG;AACH,MAAM,eAAe,GAIhB;IACH;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,mBAAmB;KACjC;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,8BAA8B;KAC5C;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,wBAAwB;QACjC,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,2BAA2B;QACpC,WAAW,EAAE,mBAAmB;KACjC;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,2BAA2B;QACpC,WAAW,EAAE,wDAAwD;KACtE;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,+BAA+B;QACxC,WAAW,EAAE,aAAa;KAC3B;IACD;QACE,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,sFAAsF;QAC/F,WAAW,EAAE,mBAAmB;KACjC;IACD;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EAAE,gBAAgB;KAC9B;IACD;QACE,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,0BAA0B;QACnC,WAAW,EAAE,mBAAmB;KACjC;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,uDAAuD;QAChE,WAAW,EAAE,+BAA+B;KAC7C;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,kGAAkG;QAC3G,WAAW,EAAE,4BAA4B;KAC1C;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,6FAA6F;QACtG,WAAW,EAAE,2BAA2B;KACzC;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,wFAAwF;QACjG,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,yDAAyD;QAClE,WAAW,EAAE,oBAAoB;KAClC;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,aAAa,GAAG;IACpB,cAAc;IACd,SAAS;IACT,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,SAAS;IACT,SAAS;IACT,SAAS;IACT,UAAU;IACV,UAAU;CACX,CAAC;AAEF;;GAEG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO;IACjC,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB;IACxD,KAAK,EAAE,OAAO,EAAE,MAAM;IACtB,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO;IAC5B,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO;CAC/C,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,WAAmB;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,qBAAqB;IACrB,MAAM,iBAAiB,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAEzD,IAAI,iBAAiB,CAAC,SAAS,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,OAAO,EAAE,iBAAiB,CAAC,OAAO,EAAE,CAAC,CAAC;QACvF,OAAO,WAAW,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC7C,CAAC;IAED,oCAAoC;IACpC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;QAC7C,MAAM,EAAE,8CAA8C;KACvD,CAAC,CAAC;IACH,OAAO,eAAe,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,WAAW,CAAC,WAAmB,EAAE,SAAiB;IAC/D,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAE5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CACjB,UAAU,EACV,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,UAAU,CAAC,EAChG;YACE,GAAG,EAAE,WAAW;YAChB,OAAO,EAAE,MAAM,EAAE,mBAAmB;SACrC,CACF,CAAC;QAEF,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC/B,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC/B,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,kDAAkD;YAClD,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC;oBACH,MAAM,OAAO,GAAqB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAErD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;wBAC7B,MAAM,YAAY,GAAG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC;wBAEvE,QAAQ,CAAC,IAAI,CAAC;4BACZ,OAAO,EAAE,UAAU;4BACnB,MAAM,EAAE,YAAY,MAAM,CAAC,MAAM,EAAE;4BACnC,IAAI,EAAE,YAAY;4BAClB,IAAI,EAAE,MAAM,CAAC,SAAS;4BACtB,MAAM,EAAE,MAAM,CAAC,WAAW;4BAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;4BACvB,SAAS,EAAE,MAAM,CAAC,SAAS;4BAC3B,OAAO,EAAE,MAAM,CAAC,WAAW;4BAC3B,QAAQ,EAAE,UAAU,EAAE,2BAA2B;4BACjD,UAAU,EAAE,GAAG;4BACf,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC;4BACpC,QAAQ,EAAE;gCACR,OAAO,EAAE,MAAM,CAAC,OAAO;gCACvB,WAAW,EAAE,MAAM,CAAC,WAAW;gCAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;6BAClB;yBACF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,gCAAgC;oBAChC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;wBAC5C,KAAK,EAAE,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;qBAC7E,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,OAAO,CAAC;gBACN,OAAO,EAAE,UAAU;gBACnB,QAAQ;gBACR,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAChC,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,IAAI,IAAI,SAAS;aAC5B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,OAAO,CAAC;gBACN,OAAO,EAAE,UAAU;gBACnB,QAAQ,EAAE,EAAE;gBACZ,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAChC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,GAAG,CAAC,OAAO;aACnB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,eAAe,CAAC,WAAmB,EAAE,SAAiB;IACnE,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,KAAK,UAAU,aAAa,CAAC,OAAe;QAC1C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,YAAY,GAAG,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAErD,yBAAyB;YACzB,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBAChE,SAAS;YACX,CAAC;YAED,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC9C,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBAE7E,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;oBAC5D,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;oBAC/B,YAAY,EAAE,CAAC;gBACjB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;QAEjC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;YAC7C,YAAY;YACZ,aAAa,EAAE,QAAQ,CAAC,MAAM;YAC9B,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACjC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,UAAU,EAAE,oCAAoC;YACzD,QAAQ;YACR,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAChC,OAAO,EAAE,IAAI;YACb,YAAY;YACZ,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAC9C,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QAEjE,OAAO;YACL,OAAO,EAAE,UAAU;YACnB,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAChC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,YAAY;SACpB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,QAAQ,CAAC,QAAgB,EAAE,YAAoB;IAC5D,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAElC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;YAE5B,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;gBACtC,oBAAoB;gBACpB,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;gBAE9B,IAAI,KAA6B,CAAC;gBAClC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACrD,sCAAsC;oBACtC,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;wBAAE,SAAS;oBAEtC,4BAA4B;oBAC5B,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC;wBAAE,SAAS;oBAE7C,QAAQ,CAAC,IAAI,CAAC;wBACZ,OAAO,EAAE,UAAU;wBACnB,MAAM,EAAE,YAAY,OAAO,CAAC,IAAI,EAAE;wBAClC,IAAI,EAAE,YAAY;wBAClB,IAAI,EAAE,OAAO,GAAG,CAAC;wBACjB,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;wBACvB,OAAO,EAAE,OAAO,CAAC,WAAW;wBAC5B,QAAQ,EAAE,UAAU;wBACpB,UAAU,EAAE,GAAG;wBACf,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;qBACjC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,OAAO,CACL,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QACzB,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC7B,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QACvB,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrB,KAAK,KAAK,IAAI;QACd,KAAK,KAAK,IAAI;QACd,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAC1B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,IAAY,EAAE,QAAgB;IACjD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC5C,OAAO,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAClE,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,CACL,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,YAAY,GAAG,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAC5B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAK1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE;YAC3C,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,IAAI,OAAO,GAAG,EAAE,CAAC;QAEjB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC/B,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;gBAC1B,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/scanners/secrets.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Unit tests for secrets scanner module
+ */
+export {};
+//# sourceMappingURL=secrets.test.d.ts.map

package/dist/scanners/secrets.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.test.d.ts","sourceRoot":"","sources":["../../src/scanners/secrets.test.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/scanners/secrets.test.js

@@ -0,0 +1,160 @@
+/**
+ * Unit tests for secrets scanner module
+ */
+import { describe, it, expect, beforeEach, afterEach, afterAll } from "vitest";
+import { mkdir, rm, writeFile } from "fs/promises";
+import { join } from "path";
+import { tmpdir } from "os";
+import { runSecretsScanner, checkGitleaksAvailable } from "./secrets.js";
+const TEST_BASE = join(tmpdir(), "vaspera-secrets-test-" + Date.now() + "-" + Math.random().toString(36).slice(2));
+let testProjectPath;
+beforeEach(async () => {
+    testProjectPath = join(TEST_BASE, "project-" + Math.random().toString(36).slice(2));
+    await mkdir(testProjectPath, { recursive: true });
+});
+afterEach(async () => {
+    try {
+        await rm(testProjectPath, { recursive: true, force: true });
+    }
+    catch {
+        // Ignore cleanup errors
+    }
+});
+afterAll(async () => {
+    try {
+        await rm(TEST_BASE, { recursive: true, force: true });
+    }
+    catch {
+        // Ignore cleanup errors
+    }
+});
+describe("checkGitleaksAvailable", () => {
+    it("returns availability status", async () => {
+        const result = await checkGitleaksAvailable();
+        expect(result).toHaveProperty("available");
+        expect(typeof result.available).toBe("boolean");
+        if (result.available) {
+            expect(result.version).toBeDefined();
+        }
+        else {
+            expect(result.error).toBeDefined();
+        }
+    });
+});
+describe("runSecretsScanner", () => {
+    it("returns empty findings for clean project", async () => {
+        await writeFile(join(testProjectPath, "index.ts"), `export const greeting = "Hello, world!";`);
+        const result = await runSecretsScanner(testProjectPath);
+        expect(result.scanner).toBe("gitleaks");
+        expect(result.success).toBe(true);
+        expect(result.findings).toHaveLength(0);
+        expect(result.duration).toBeGreaterThanOrEqual(0);
+    });
+    it("detects AWS access key patterns", async () => {
+        await writeFile(join(testProjectPath, "config.ts"), `export const awsKey = "AKIAIOSFODNN7EXAMPLE";`);
+        const result = await runSecretsScanner(testProjectPath);
+        // Will find if gitleaks or regex fallback works
+        if (result.success && result.findings.length > 0) {
+            expect(result.findings[0].severity).toBe("critical");
+            expect(result.findings[0].file).toContain("config.ts");
+        }
+        expect(result.scanner).toBe("gitleaks");
+    });
+    it("detects GitHub token patterns", async () => {
+        await writeFile(join(testProjectPath, "secrets.ts"), `const token = "ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";`);
+        const result = await runSecretsScanner(testProjectPath);
+        if (result.success && result.findings.length > 0) {
+            expect(result.findings[0].severity).toBe("critical");
+            expect(result.findings[0].ruleId).toContain("github");
+        }
+        expect(result.scanner).toBe("gitleaks");
+    });
+    it("detects Slack token patterns", async () => {
+        await writeFile(join(testProjectPath, "slack.ts"), `const slackToken = "xoxb-123456789012-1234567890123-abcdefghij123456klmnopqr";`);
+        const result = await runSecretsScanner(testProjectPath);
+        if (result.success && result.findings.length > 0) {
+            expect(result.findings[0].severity).toBe("critical");
+        }
+        expect(result.scanner).toBe("gitleaks");
+    });
+    it("skips node_modules directory", async () => {
+        await mkdir(join(testProjectPath, "node_modules", "pkg"), { recursive: true });
+        await writeFile(join(testProjectPath, "node_modules", "pkg", "index.js"), `const secret = "AKIAIOSFODNN7EXAMPLE";` // Secret in node_modules should be skipped
+        );
+        await writeFile(join(testProjectPath, "index.ts"), `export const hello = "world";`);
+        const result = await runSecretsScanner(testProjectPath);
+        expect(result.success).toBe(true);
+        // Should not find secrets in node_modules
+        const nodeModulesFindings = result.findings.filter((f) => f.file.includes("node_modules"));
+        expect(nodeModulesFindings).toHaveLength(0);
+    });
+    it("skips placeholder secrets", async () => {
+        await writeFile(join(testProjectPath, "example.ts"), `
+        const key1 = "your_api_key_here";
+        const key2 = "xxx-placeholder-xxx";
+        const key3 = "example_token_12345";
+      `);
+        const result = await runSecretsScanner(testProjectPath);
+        // Placeholder patterns should be skipped
+        expect(result.success).toBe(true);
+        // These are clearly placeholders, regex fallback should skip them
+    });
+    it("returns scanner metadata", async () => {
+        await writeFile(join(testProjectPath, "empty.ts"), "");
+        const result = await runSecretsScanner(testProjectPath);
+        expect(result).toHaveProperty("scanner", "gitleaks");
+        expect(result).toHaveProperty("success");
+        expect(result).toHaveProperty("duration");
+        expect(result).toHaveProperty("findings");
+        expect(Array.isArray(result.findings)).toBe(true);
+    });
+    it("detects private key headers", async () => {
+        await writeFile(join(testProjectPath, "key.pem"), `-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAwJENcRev+eXZKvhhWLiV3Lz2MYOWOe5z3tQGucn
+-----END RSA PRIVATE KEY-----`);
+        const result = await runSecretsScanner(testProjectPath);
+        // Should detect private key if fallback regex is used
+        // Note: .pem might not be in the default scan extensions for regex fallback
+        expect(result.success).toBe(true);
+    });
+    it("handles non-existent directory", async () => {
+        const result = await runSecretsScanner("/nonexistent/path");
+        // Should fail gracefully
+        expect(result.scanner).toBe("gitleaks");
+        // May succeed with 0 findings or fail with error depending on scanner
+    });
+    it("redacts secrets in evidence", async () => {
+        await writeFile(join(testProjectPath, "api.ts"), `const key = "sk_live_4eC39HqLyjWDarjtT1zdp7dc";` // Stripe-like key
+        );
+        const result = await runSecretsScanner(testProjectPath);
+        if (result.findings.length > 0) {
+            const finding = result.findings[0];
+            if (finding.evidence) {
+                // Evidence should be redacted (contain asterisks)
+                expect(finding.evidence).toMatch(/\*/);
+                // Should not contain the full secret
+                expect(finding.evidence).not.toBe("sk_live_4eC39HqLyjWDarjtT1zdp7dc");
+            }
+        }
+    });
+});
+describe("runSecretsScanner - confidence", () => {
+    it("all findings have confidence 100", async () => {
+        await writeFile(join(testProjectPath, "secrets.ts"), `
+        const aws = "AKIAIOSFODNN7EXAMPLE";
+        const github = "ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";
+      `);
+        const result = await runSecretsScanner(testProjectPath);
+        for (const finding of result.findings) {
+            expect(finding.confidence).toBe(100);
+        }
+    });
+    it("all findings are severity critical", async () => {
+        await writeFile(join(testProjectPath, "secrets.ts"), `const token = "xoxb-123456789012-1234567890123-abcdefghij123456klmnopqr";`);
+        const result = await runSecretsScanner(testProjectPath);
+        for (const finding of result.findings) {
+            expect(finding.severity).toBe("critical");
+        }
+    });
+});
+//# sourceMappingURL=secrets.test.js.map

package/dist/scanners/secrets.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.test.js","sourceRoot":"","sources":["../../src/scanners/secrets.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC/E,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEzE,MAAM,SAAS,GAAG,IAAI,CACpB,MAAM,EAAE,EACR,uBAAuB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CACjF,CAAC;AACF,IAAI,eAAuB,CAAC;AAE5B,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,eAAe,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,KAAK,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,MAAM,GAAG,MAAM,sBAAsB,EAAE,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,CAAC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEhD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACrC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,SAAS,CACb,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,EACjC,0CAA0C,CAC3C,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,eAAe,CAAC,CAAC;QAExD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,SAAS,CACb,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,EAClC,+CAA+C,CAChD,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,eAAe,CAAC,CAAC;QAExD,gDAAgD;QAChD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACrD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,SAAS,CACb,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,EACnC,2DAA2D,CAC5D,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,eAAe,CAAC,CAAC;QAExD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACrD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,SAAS,CACb,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,EACjC,gFAAgF,CACjF,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,eAAe,CAAC,CAAC;QAExD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,KAAK,CAAC,IAAI,CAAC,eAAe,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,MAAM,SAAS,CACb,IAAI,CAAC,eAAe,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,CAAC,EACxD,wCAAwC,CAAC,2CAA2C;SACrF,CAAC;QACF,MAAM,SAAS,CACb,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,EACjC,+BAA+B,CAChC,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,eAAe,CAAC,CAAC;QAExD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,0CAA0C;QAC1C,MAAM,mBAAmB,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAChC,CAAC;QACF,MAAM,CAAC,mBAAmB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,SAAS,CACb,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,EACnC;;;;OAIC,CACF,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,eAAe,CAAC,CAAC;QAExD,yCAAyC;QACzC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,kEAAkE;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,eAAe,CAAC,CAAC;QAExD,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,SAAS,CACb,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,EAChC;;8BAEwB,CACzB,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,eAAe,CAAC,CAAC;QAExD,sDAAsD;QACtD,4EAA4E;QAC5E,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;QAE5D,yBAAyB;QACzB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,sEAAsE;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,SAAS,CACb,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,EAC/B,iDAAiD,CAAC,kBAAkB;SACrE,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,eAAe,CAAC,CAAC;QAExD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,kDAAkD;gBAClD,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACvC,qCAAqC;gBACrC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,SAAS,CACb,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,EACnC;;;OAGC,CACF,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,eAAe,CAAC,CAAC;QAExD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,SAAS,CACb,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,EACnC,2EAA2E,CAC5E,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,eAAe,CAAC,CAAC;QAExD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/scanners/semgrep.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Semgrep Scanner
+ *
+ * Runs Semgrep with OWASP, JavaScript/TypeScript, and custom rules.
+ * Outputs SARIF format which we parse into DeterministicFindings.
+ *
+ * If Semgrep is not available, returns empty results with instruction
+ * to install: `pip install semgrep` or `brew install semgrep`
+ *
+ * @module scanners/semgrep
+ */
+import type { ScannerResult } from "./types.js";
+/**
+ * Run Semgrep analysis and return findings
+ */
+export declare function runSemgrep(projectPath: string, options?: {
+    configs?: string[];
+    customRulesDir?: string;
+    timeout?: number;
+}): Promise<ScannerResult>;
+/**
+ * Check if Semgrep is available
+ */
+export declare function checkSemgrepAvailable(): Promise<{
+    available: boolean;
+    version?: string;
+    error?: string;
+}>;
+/**
+ * Generate a sample Semgrep rules file for Supabase RLS
+ */
+export declare function generateSupabaseRules(outputDir: string): Promise<string>;
+//# sourceMappingURL=semgrep.d.ts.map

package/dist/scanners/semgrep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semgrep.d.ts","sourceRoot":"","sources":["../../src/scanners/semgrep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,KAAK,EAAwB,aAAa,EAAe,MAAM,YAAY,CAAC;AAgFnF;;GAEG;AACH,wBAAsB,UAAU,CAC9B,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;IACR,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACA,OAAO,CAAC,aAAa,CAAC,CAoGxB;AAmJD;;GAEG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC;IACrD,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAmCD;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA6D9E"}