verification-layer 0.27.6 → 0.27.7

package/dist/rule-catalog.json

@@ -1,6 +1,6 @@
 {
   "package": "verification-layer",
-  "version": "0.27.6",
+  "version": "0.27.7",
   "total": 143,
   "counts": {
     "phi-exposure": 29,

package/dist/scanners/hipaa2026/false-positives.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=false-positives.test.d.ts.map

package/dist/scanners/hipaa2026/false-positives.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"false-positives.test.d.ts","sourceRoot":"","sources":["../../../src/scanners/hipaa2026/false-positives.test.ts"],"names":[],"mappings":""}

package/dist/scanners/hipaa2026/false-positives.test.js

@@ -0,0 +1,53 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { hipaa2026Scanner } from './index.js';
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import * as os from 'os';
+describe('HIPAA 2026 false-positive regressions', () => {
+    let tempDir = '';
+    beforeEach(async () => {
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hipaa2026-fp-'));
+    });
+    afterEach(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    async function scan(filename, content) {
+        const file = path.join(tempDir, filename);
+        await fs.writeFile(file, content, 'utf-8');
+        return hipaa2026Scanner.scan([file], { path: tempDir });
+    }
+    it('does not treat metadata authors + PHI marketing copy as an MFA flow', async () => {
+        const findings = await scan('layout.tsx', `
+export const metadata = {
+  authors: [{ name: 'vlayer' }],
+  description: 'Find PHI security risks before production',
+};
+      `);
+        expect(findings.some((f) => f.id === 'HIPAA-MFA-001')).toBe(false);
+    });
+    it('does not treat supabase.auth.signUp as a PHI login flow', async () => {
+        const findings = await scan('signup.ts', `
+const result = await supabase.auth.signUp({ email, password });
+const healthProfile = await createHealthProfile(result.data.user?.id);
+      `);
+        expect(findings.some((f) => f.id === 'HIPAA-MFA-001')).toBe(false);
+    });
+    it('does not classify a single invalid-credentials response as a breach', async () => {
+        const findings = await scan('signin.ts', `
+if (error) {
+  return Response.json({ error: 'Invalid credentials' }, { status: 401 });
+}
+      `);
+        expect(findings.some((f) => f.id === 'HIPAA-BREACH-001')).toBe(false);
+    });
+    it('still detects repeated failed login attempts without monitoring', async () => {
+        const findings = await scan('auth-monitoring.ts', `
+const failedLoginAttempts = getFailedLoginAttempts(user.id);
+if (failedLoginAttempts > 5) {
+  lockAccount(user.id);
+}
+      `);
+        expect(findings.some((f) => f.id === 'HIPAA-BREACH-001')).toBe(true);
+    });
+});
+//# sourceMappingURL=false-positives.test.js.map

package/dist/scanners/hipaa2026/false-positives.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"false-positives.test.js","sourceRoot":"","sources":["../../../src/scanners/hipaa2026/false-positives.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,IAAI,OAAO,GAAG,EAAE,CAAC;IAEjB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,IAAI,CAAC,QAAgB,EAAE,OAAe;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC1C,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,QAAQ,GAAG,MAAM,IAAI,CACzB,YAAY,EACZ;;;;;OAKC,CACF,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,QAAQ,GAAG,MAAM,IAAI,CACzB,WAAW,EACX;;;OAGC,CACF,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,QAAQ,GAAG,MAAM,IAAI,CACzB,WAAW,EACX;;;;OAIC,CACF,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,QAAQ,GAAG,MAAM,IAAI,CACzB,oBAAoB,EACpB;;;;;OAKC,CACF,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/scanners/hipaa2026/patterns.d.ts

@@ -23,35 +23,19 @@ export declare const MFA_PATTERNS: HIPAA2026Pattern;
  * HIPAA-ENC-REST-001: Encryption at Rest
  */
 export declare const ENCRYPTION_AT_REST_PATTERNS: HIPAA2026Pattern;
-/**
- * HIPAA-SESSION-001: Automatic Session Timeout
- */
+/** HIPAA-SESSION-001: Automatic Session Timeout */
 export declare const SESSION_TIMEOUT_PATTERNS: HIPAA2026Pattern;
-/**
- * HIPAA-REVOKE-001: Immediate Access Revocation
- */
+/** HIPAA-REVOKE-001: Immediate Access Revocation */
 export declare const ACCESS_REVOCATION_PATTERNS: HIPAA2026Pattern;
-/**
- * HIPAA-BREACH-001: 24-Hour Breach Notification
- */
+/** HIPAA-BREACH-001: 24-Hour Breach Notification */
 export declare const BREACH_NOTIFICATION_PATTERNS: HIPAA2026Pattern;
-/**
- * HIPAA-SEGMENT-001: Network Segmentation
- */
+/** HIPAA-SEGMENT-001: Network Segmentation */
 export declare const NETWORK_SEGMENTATION_PATTERNS: HIPAA2026Pattern;
-/**
- * HIPAA-ASSET-001: Technology Asset Inventory
- * Special pattern - triggers asset inventory generation
- */
+/** HIPAA-ASSET-001: Technology Asset Inventory */
 export declare const ASSET_INVENTORY_PATTERNS: HIPAA2026Pattern;
-/**
- * HIPAA-FLOW-001: ePHI Flow Mapping
- * Special pattern - triggers flow map generation
- */
+/** HIPAA-FLOW-001: ePHI Flow Mapping */
 export declare const PHI_FLOW_MAPPING_PATTERNS: HIPAA2026Pattern;
-/**
- * HIPAA-PENTEST-001: Vulnerability Scanning Configuration
- */
+/** HIPAA-PENTEST-001: Vulnerability Scanning Configuration */
 export declare const VULNERABILITY_SCANNING_PATTERNS: HIPAA2026Pattern;
 export declare const ALL_HIPAA_2026_PATTERNS: HIPAA2026Pattern[];
 //# sourceMappingURL=patterns.d.ts.map

package/dist/scanners/hipaa2026/patterns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../../src/scanners/hipaa2026/patterns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,GAAG,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,eAAO,MAAM,YAAY,EAAE,gBA2B1B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,2BAA2B,EAAE,gBA6BzC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,EAAE,gBA8BtC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B,EAAE,gBA2BxC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,4BAA4B,EAAE,gBAuB1C,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,6BAA6B,EAAE,gBAgC3C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,gBAmBtC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,gBAmBvC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,+BAA+B,EAAE,gBAoB7C,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,gBAAgB,EAUrD,CAAC"}
+{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../../src/scanners/hipaa2026/patterns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,GAAG,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,eAAO,MAAM,YAAY,EAAE,gBA6B1B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,2BAA2B,EAAE,gBAuBzC,CAAC;AAEF,mDAAmD;AACnD,eAAO,MAAM,wBAAwB,EAAE,gBAqBtC,CAAC;AAEF,oDAAoD;AACpD,eAAO,MAAM,0BAA0B,EAAE,gBAqBxC,CAAC;AAEF,oDAAoD;AACpD,eAAO,MAAM,4BAA4B,EAAE,gBAwB1C,CAAC;AAEF,8CAA8C;AAC9C,eAAO,MAAM,6BAA6B,EAAE,gBAuB3C,CAAC;AAEF,kDAAkD;AAClD,eAAO,MAAM,wBAAwB,EAAE,gBAetC,CAAC;AAEF,wCAAwC;AACxC,eAAO,MAAM,yBAAyB,EAAE,gBAevC,CAAC;AAEF,8DAA8D;AAC9D,eAAO,MAAM,+BAA+B,EAAE,gBAmB7C,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,gBAAgB,EAUrD,CAAC"}

package/dist/scanners/hipaa2026/patterns.js

@@ -13,8 +13,10 @@ export const MFA_PATTERNS = {
     severity: 'critical',
     hipaaReference: '45 CFR §164.312(a)(2)(i) - Access Control (Required)',
     patterns: [
-        // Login/auth without MFA
-        /(?:login|authenticate|signin|auth).*?(?:patient|phi|medical|health)(?!.*?(?:mfa|multi.?factor|2fa|totp|authenticator))/i,
+        // Login/sign-in/authentication flows that also access PHI. Deliberately avoid
+        // the generic token "auth": provider namespaces such as supabase.auth.signUp
+        // and metadata keys such as "authors" are not evidence of a PHI login flow.
+        /(?:\blogin\b|\bauthenticate(?:User)?\b|\bsign(?:-|_)?in\b).*?(?:patient|phi|medical|health)(?!.*?(?:mfa|multi.?factor|2fa|totp|authenticator))/i,
         // Auth configs without MFA
         /(?:passport|auth0|okta|cognito)\.(?:use|configure).*?(?!.*?(?:mfa|multiFactor|requireMFA))/i,
         // Admin endpoints without MFA
@@ -44,17 +46,11 @@ export const ENCRYPTION_AT_REST_PATTERNS = {
     severity: 'critical',
     hipaaReference: '45 CFR §164.312(a)(2)(iv) - Encryption (Required)',
     patterns: [
-        // Database without encryption
         /(?:mongoose|sequelize|typeorm|prisma)\.(?:connect|createConnection).*?(?!.*?(?:encrypt|ssl|tls))/i,
-        // File storage without encryption
         /(?:fs\.writeFile|writeFileSync|s3\.putObject).*?(?:patient|phi|medical)(?!.*?(?:encrypt|cipher))/i,
-        // LocalStorage with PHI
         /localStorage\.setItem.*?(?:patient|ssn|mrn|phi)/i,
-        // Cookie with PHI unencrypted
         /(?:res\.cookie|setCookie).*?(?:patient|phi|medical)(?!.*?(?:encrypt|secure|httpOnly))/i,
-        // MongoDB without encryption
         /MongoClient\.connect.*?(?!.*?(?:ssl|tls|encryption))/i,
-        // PostgreSQL without encryption
         /(?:pg|postgres)\.(?:connect|Pool).*?(?!.*?ssl)/i,
     ],
     negativePatterns: [
@@ -67,9 +63,7 @@ export const ENCRYPTION_AT_REST_PATTERNS = {
     confidence: 'high',
     category: 'encryption',
 };
-/**
- * HIPAA-SESSION-001: Automatic Session Timeout
- */
+/** HIPAA-SESSION-001: Automatic Session Timeout */
 export const SESSION_TIMEOUT_PATTERNS = {
     id: 'HIPAA-SESSION-001',
     name: 'Missing Automatic Session Timeout',
@@ -77,22 +71,13 @@ export const SESSION_TIMEOUT_PATTERNS = {
     severity: 'high',
     hipaaReference: '45 CFR §164.312(a)(2)(iii) - Session Control (Required)',
     patterns: [
-        // Session config without expiration
         /(?:express-session|session)\.(?:configure|use)(?!.*?(?:maxAge|expires|timeout))/i,
-        // Session with timeout > 15 min (900000 ms)
         /maxAge:\s*(?:9[0-9]{5}[0-9]+|[1-9][0-9]{6,})/i,
-        // JWT without expiration
         /jwt\.sign\([^)]*(?!.*?expiresIn)/i,
-        // Cookie session without expiration
         /cookie-session.*?(?!.*?maxAge)/i,
-        // Missing idle timeout
         /session.*?(?!.*?(?:idle|inactivity).*?timeout)/i,
     ],
     negativePatterns: [
-        // Compliant session length: maxAge with a 1–6 digit value (≤ 999999 ms,
-        // i.e. ≤ ~16 min). The \b stops it matching a prefix of a longer (>15 min)
-        // value, which the positive pattern above flags. Includes the exact 900000
-        // (15 min) boundary the autofix recommends — the old [1-8][0-9]{5} excluded it.
         /maxAge:\s*[1-9][0-9]{0,5}\b/i,
         /expiresIn:\s*['"](?:1[0-5]m|[1-9]m)['"]/i,
         /idleTimeout/i,
@@ -101,9 +86,7 @@ export const SESSION_TIMEOUT_PATTERNS = {
     confidence: 'high',
     category: 'access-control',
 };
-/**
- * HIPAA-REVOKE-001: Immediate Access Revocation
- */
+/** HIPAA-REVOKE-001: Immediate Access Revocation */
 export const ACCESS_REVOCATION_PATTERNS = {
     id: 'HIPAA-REVOKE-001',
     name: 'Missing Immediate Access Revocation',
@@ -111,15 +94,9 @@ export const ACCESS_REVOCATION_PATTERNS = {
     severity: 'critical',
     hipaaReference: '45 CFR §164.308(a)(3)(ii)(C) - Termination Procedures (Required)',
     patterns: [
-        // Deactivate user without token revocation
         /(?:deactivate|disable|remove)User(?!.*?(?:revoke|invalidate|blacklist).*?(?:token|session))/i,
-        // Delete user without session cleanup
         /(?:deleteUser|removeUser).*?(?!.*?(?:logout|invalidate|clearSessions))/i,
-        // Termination/deactivation as an actual operation — identifier or method call.
-        // Must NOT match prose/log strings like console.log('User deactivated ...'),
-        // which describe an action rather than perform one (false positive).
         /(?:deactivat|terminat|disabl)e?(?:User|Account|Member|Employee)|(?:user|account|member|employee)(?:Deactivation|Termination)|(?:user|account|member)\.(?:deactivate|terminate|disable)\b/i,
-        // Role change without re-auth
         /(?:updateRole|changePermissions)(?!.*?(?:logout|reauth|invalidate))/i,
     ],
     negativePatterns: [
@@ -132,9 +109,7 @@ export const ACCESS_REVOCATION_PATTERNS = {
     confidence: 'medium',
     category: 'access-control',
 };
-/**
- * HIPAA-BREACH-001: 24-Hour Breach Notification
- */
+/** HIPAA-BREACH-001: 24-Hour Breach Notification */
 export const BREACH_NOTIFICATION_PATTERNS = {
     id: 'HIPAA-BREACH-001',
     name: 'Missing Breach Notification Mechanism',
@@ -144,8 +119,9 @@ export const BREACH_NOTIFICATION_PATTERNS = {
     patterns: [
         // Security errors without breach handler
         /catch\s*\(.*?error.*?\).*?(?:security|unauthorized|breach)(?!.*?(?:notifyBreach|incidentResponse|alertSecurity))/i,
-        // Failed login attempts without monitoring
-        /(?:failed|invalid).*?(?:login|auth)(?!.*?(?:monitor|alert|notify))/i,
+        // Repeated/aggregated failed-login signals without monitoring. A single
+        // "invalid credentials" response is an authentication outcome, not a breach.
+        /(?:failed|invalid).*?(?:login|auth).*?(?:attempts?|count|threshold|rate|repeated|multiple)(?!.*?(?:monitor|alert|notify))/i,
         // Data access anomaly without alert
         /(?:unusual|suspicious).*?access(?!.*?(?:alert|notify|incident))/i,
     ],
@@ -159,9 +135,7 @@ export const BREACH_NOTIFICATION_PATTERNS = {
     confidence: 'medium',
     category: 'audit-logging',
 };
-/**
- * HIPAA-SEGMENT-001: Network Segmentation
- */
+/** HIPAA-SEGMENT-001: Network Segmentation */
 export const NETWORK_SEGMENTATION_PATTERNS = {
     id: 'HIPAA-SEGMENT-001',
     name: 'Missing Network Segmentation for PHI',
@@ -169,25 +143,16 @@ export const NETWORK_SEGMENTATION_PATTERNS = {
     severity: 'critical',
     hipaaReference: '45 CFR §164.312(e)(1) - Transmission Security (Required)',
     patterns: [
-        // CORS allowing all origins for PHI
         /cors\(\{?\s*origin:\s*['"]?\*['"]?.*?(?:patient|phi|medical)/i,
-        // PHI API without network restrictions
         /\/api.*?(?:patient|phi|medical)(?!.*?(?:firewall|vpc|subnet|private))/i,
-        // Internal PHI service publicly accessible
         /(?:express|fastify|koa)\.listen.*?(?:patient|phi)(?!.*?(?:localhost|127\.0\.0\.1|private))/i,
-        // Missing VPC/subnet config on a backend database/storage service.
-        // `storage` is guarded against client-side browser APIs (localStorage,
-        // sessionStorage) — network segmentation does not apply to those.
         /(?:database|(?<!local)(?<!session)storage).*?(?:patient|phi)(?!.*?(?:vpc|subnet|securityGroup))/i,
     ],
     negativePatterns: [
-        /origin:\s*\[.*?\]/i, // Whitelist
+        /origin:\s*\[.*?\]/i,
         /private.*?subnet/i,
         /securityGroup/i,
         /firewall.*?rules/i,
-        // Client-side HTTP *consumption* (fetch/axios) is not an exposed PHI
-        // service. Network segmentation applies to the server/infra that exposes
-        // the endpoint, not to a frontend call that reads from it.
         /\bfetch\s*\(/i,
         /\baxios\b/i,
     ],
@@ -195,10 +160,7 @@ export const NETWORK_SEGMENTATION_PATTERNS = {
     confidence: 'high',
     category: 'access-control',
 };
-/**
- * HIPAA-ASSET-001: Technology Asset Inventory
- * Special pattern - triggers asset inventory generation
- */
+/** HIPAA-ASSET-001: Technology Asset Inventory */
 export const ASSET_INVENTORY_PATTERNS = {
     id: 'HIPAA-ASSET-001',
     name: 'Generate ePHI Technology Asset Inventory',
@@ -206,23 +168,16 @@ export const ASSET_INVENTORY_PATTERNS = {
     severity: 'high',
     hipaaReference: '45 CFR §164.308(a)(1)(ii)(A) - Risk Analysis (Required)',
     patterns: [
-        // Databases
         /(?:mongoose|sequelize|prisma|typeorm|knex)\.(?:connect|model)/i,
-        // Storage services
         /(?:s3|azure\.storage|gcs)\./i,
-        // Third-party integrations
         /(?:stripe|twilio|sendgrid|mailgun)\.(?:api|client)/i,
-        // APIs
         /(?:axios|fetch|got|request)\./i,
     ],
     autoFix: 'Asset inventory will be generated automatically in scan report',
     confidence: 'high',
     category: 'data-retention',
 };
-/**
- * HIPAA-FLOW-001: ePHI Flow Mapping
- * Special pattern - triggers flow map generation
- */
+/** HIPAA-FLOW-001: ePHI Flow Mapping */
 export const PHI_FLOW_MAPPING_PATTERNS = {
     id: 'HIPAA-FLOW-001',
     name: 'Generate ePHI Flow Map',
@@ -230,22 +185,16 @@ export const PHI_FLOW_MAPPING_PATTERNS = {
     severity: 'high',
     hipaaReference: '45 CFR §164.308(a)(1)(ii)(A) - Risk Analysis (Required)',
     patterns: [
-        // Input points
         /(?:req\.body|req\.params|req\.query).*?(?:patient|phi|medical)/i,
-        // Processing
         /(?:process|transform|validate).*?(?:patient|phi)/i,
-        // Storage
         /(?:save|insert|update).*?(?:patient|phi)/i,
-        // Output
         /(?:res\.(?:send|json)|return).*?(?:patient|phi)/i,
     ],
     autoFix: 'PHI flow map will be generated automatically in scan report',
     confidence: 'high',
     category: 'data-retention',
 };
-/**
- * HIPAA-PENTEST-001: Vulnerability Scanning Configuration
- */
+/** HIPAA-PENTEST-001: Vulnerability Scanning Configuration */
 export const VULNERABILITY_SCANNING_PATTERNS = {
     id: 'HIPAA-PENTEST-001',
     name: 'Missing Vulnerability Scanning Configuration',
@@ -253,7 +202,6 @@ export const VULNERABILITY_SCANNING_PATTERNS = {
     severity: 'high',
     hipaaReference: '45 CFR §164.308(a)(8) - Evaluation (Required)',
     patterns: [
-        // Missing security scanning configs
         /package\.json(?!.*?(?:snyk|audit|vulnerability))/i,
     ],
     negativePatterns: [

package/dist/scanners/hipaa2026/patterns.js.map

@@ -1 +1 @@
-{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../../src/scanners/hipaa2026/patterns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgBH;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAqB;IAC5C,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,oDAAoD;IAC1D,WAAW,EAAE,sGAAsG;IACnH,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,sDAAsD;IACtE,QAAQ,EAAE;QACR,yBAAyB;QACzB,yHAAyH;QACzH,2BAA2B;QAC3B,6FAA6F;QAC7F,8BAA8B;QAC9B,sDAAsD;QACtD,+BAA+B;QAC/B,mDAAmD;QACnD,wBAAwB;QACxB,kDAAkD;KACnD;IACD,gBAAgB,EAAE;QAChB,qBAAqB;QACrB,cAAc;QACd,wBAAwB;QACxB,iBAAiB;KAClB;IACD,OAAO,EAAE,yFAAyF;IAClG,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAqB;IAC3D,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,wCAAwC;IAC9C,WAAW,EAAE,+DAA+D;IAC5E,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,mDAAmD;IACnE,QAAQ,EAAE;QACR,8BAA8B;QAC9B,mGAAmG;QACnG,kCAAkC;QAClC,mGAAmG;QACnG,wBAAwB;QACxB,kDAAkD;QAClD,8BAA8B;QAC9B,wFAAwF;QACxF,6BAA6B;QAC7B,uDAAuD;QACvD,gCAAgC;QAChC,iDAAiD;KAClD;IACD,gBAAgB,EAAE;QAChB,kBAAkB;QAClB,cAAc;QACd,WAAW;QACX,UAAU;KACX;IACD,OAAO,EAAE,+FAA+F;IACxG,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,YAAY;CACvB,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAqB;IACxD,EAAE,EAAE,mBAAmB;IACvB,IAAI,EAAE,mCAAmC;IACzC,WAAW,EAAE,uEAAuE;IACpF,QAAQ,EAAE,MAAM;IAChB,cAAc,EAAE,yDAAyD;IACzE,QAAQ,EAAE;QACR,oCAAoC;QACpC,kFAAkF;QAClF,4CAA4C;QAC5C,+CAA+C;QAC/C,yBAAyB;QACzB,mCAAmC;QACnC,oCAAoC;QACpC,iCAAiC;QACjC,uBAAuB;QACvB,iDAAiD;KAClD;IACD,gBAAgB,EAAE;QAChB,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,gFAAgF;QAChF,8BAA8B;QAC9B,0CAA0C;QAC1C,cAAc;KACf;IACD,OAAO,EAAE,+EAA+E;IACxF,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqB;IAC1D,EAAE,EAAE,kBAAkB;IACtB,IAAI,EAAE,qCAAqC;IAC3C,WAAW,EAAE,wEAAwE;IACrF,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,kEAAkE;IAClF,QAAQ,EAAE;QACR,2CAA2C;QAC3C,8FAA8F;QAC9F,sCAAsC;QACtC,yEAAyE;QACzE,+EAA+E;QAC/E,6EAA6E;QAC7E,qEAAqE;QACrE,2LAA2L;QAC3L,8BAA8B;QAC9B,sEAAsE;KACvE;IACD,gBAAgB,EAAE;QAChB,kBAAkB;QAClB,wBAAwB;QACxB,sBAAsB;QACtB,oBAAoB;KACrB;IACD,OAAO,EAAE,+FAA+F;IACxG,UAAU,EAAE,QAAQ;IACpB,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAqB;IAC5D,EAAE,EAAE,kBAAkB;IACtB,IAAI,EAAE,uCAAuC;IAC7C,WAAW,EAAE,wEAAwE;IACrF,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,qEAAqE;IACrF,QAAQ,EAAE;QACR,yCAAyC;QACzC,mHAAmH;QACnH,2CAA2C;QAC3C,qEAAqE;QACrE,oCAAoC;QACpC,kEAAkE;KACnE;IACD,gBAAgB,EAAE;QAChB,uBAAuB;QACvB,4BAA4B;QAC5B,sBAAsB;QACtB,eAAe;KAChB;IACD,OAAO,EAAE,0FAA0F;IACnG,UAAU,EAAE,QAAQ;IACpB,QAAQ,EAAE,eAAe;CAC1B,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAqB;IAC7D,EAAE,EAAE,mBAAmB;IACvB,IAAI,EAAE,sCAAsC;IAC5C,WAAW,EAAE,iFAAiF;IAC9F,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,0DAA0D;IAC1E,QAAQ,EAAE;QACR,oCAAoC;QACpC,+DAA+D;QAC/D,uCAAuC;QACvC,wEAAwE;QACxE,2CAA2C;QAC3C,6FAA6F;QAC7F,mEAAmE;QACnE,uEAAuE;QACvE,kEAAkE;QAClE,kGAAkG;KACnG;IACD,gBAAgB,EAAE;QAChB,oBAAoB,EAAE,YAAY;QAClC,mBAAmB;QACnB,gBAAgB;QAChB,mBAAmB;QACnB,qEAAqE;QACrE,yEAAyE;QACzE,2DAA2D;QAC3D,eAAe;QACf,YAAY;KACb;IACD,OAAO,EAAE,gGAAgG;IACzG,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAqB;IACxD,EAAE,EAAE,iBAAiB;IACrB,IAAI,EAAE,0CAA0C;IAChD,WAAW,EAAE,+EAA+E;IAC5F,QAAQ,EAAE,MAAM;IAChB,cAAc,EAAE,yDAAyD;IACzE,QAAQ,EAAE;QACR,YAAY;QACZ,gEAAgE;QAChE,mBAAmB;QACnB,8BAA8B;QAC9B,2BAA2B;QAC3B,qDAAqD;QACrD,OAAO;QACP,gCAAgC;KACjC;IACD,OAAO,EAAE,gEAAgE;IACzE,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAqB;IACzD,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,wBAAwB;IAC9B,WAAW,EAAE,4FAA4F;IACzG,QAAQ,EAAE,MAAM;IAChB,cAAc,EAAE,yDAAyD;IACzE,QAAQ,EAAE;QACR,eAAe;QACf,iEAAiE;QACjE,aAAa;QACb,mDAAmD;QACnD,UAAU;QACV,2CAA2C;QAC3C,SAAS;QACT,kDAAkD;KACnD;IACD,OAAO,EAAE,6DAA6D;IACtE,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAqB;IAC/D,EAAE,EAAE,mBAAmB;IACvB,IAAI,EAAE,8CAA8C;IACpD,WAAW,EAAE,gFAAgF;IAC7F,QAAQ,EAAE,MAAM;IAChB,cAAc,EAAE,+CAA+C;IAC/D,QAAQ,EAAE;QACR,oCAAoC;QACpC,mDAAmD;KACpD;IACD,gBAAgB,EAAE;QAChB,kBAAkB;QAClB,YAAY;QACZ,QAAQ;QACR,YAAY;QACZ,kBAAkB;KACnB;IACD,OAAO,EAAE,iFAAiF;IAC1F,UAAU,EAAE,QAAQ;IACpB,QAAQ,EAAE,eAAe;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAuB;IACzD,YAAY;IACZ,2BAA2B;IAC3B,wBAAwB;IACxB,0BAA0B;IAC1B,4BAA4B;IAC5B,6BAA6B;IAC7B,wBAAwB;IACxB,yBAAyB;IACzB,+BAA+B;CAChC,CAAC"}
+{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../../src/scanners/hipaa2026/patterns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgBH;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAqB;IAC5C,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,oDAAoD;IAC1D,WAAW,EAAE,sGAAsG;IACnH,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,sDAAsD;IACtE,QAAQ,EAAE;QACR,8EAA8E;QAC9E,6EAA6E;QAC7E,4EAA4E;QAC5E,iJAAiJ;QACjJ,2BAA2B;QAC3B,6FAA6F;QAC7F,8BAA8B;QAC9B,sDAAsD;QACtD,+BAA+B;QAC/B,mDAAmD;QACnD,wBAAwB;QACxB,kDAAkD;KACnD;IACD,gBAAgB,EAAE;QAChB,qBAAqB;QACrB,cAAc;QACd,wBAAwB;QACxB,iBAAiB;KAClB;IACD,OAAO,EAAE,yFAAyF;IAClG,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAqB;IAC3D,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,wCAAwC;IAC9C,WAAW,EAAE,+DAA+D;IAC5E,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,mDAAmD;IACnE,QAAQ,EAAE;QACR,mGAAmG;QACnG,mGAAmG;QACnG,kDAAkD;QAClD,wFAAwF;QACxF,uDAAuD;QACvD,iDAAiD;KAClD;IACD,gBAAgB,EAAE;QAChB,kBAAkB;QAClB,cAAc;QACd,WAAW;QACX,UAAU;KACX;IACD,OAAO,EAAE,+FAA+F;IACxG,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,YAAY;CACvB,CAAC;AAEF,mDAAmD;AACnD,MAAM,CAAC,MAAM,wBAAwB,GAAqB;IACxD,EAAE,EAAE,mBAAmB;IACvB,IAAI,EAAE,mCAAmC;IACzC,WAAW,EAAE,uEAAuE;IACpF,QAAQ,EAAE,MAAM;IAChB,cAAc,EAAE,yDAAyD;IACzE,QAAQ,EAAE;QACR,kFAAkF;QAClF,+CAA+C;QAC/C,mCAAmC;QACnC,iCAAiC;QACjC,iDAAiD;KAClD;IACD,gBAAgB,EAAE;QAChB,8BAA8B;QAC9B,0CAA0C;QAC1C,cAAc;KACf;IACD,OAAO,EAAE,+EAA+E;IACxF,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF,oDAAoD;AACpD,MAAM,CAAC,MAAM,0BAA0B,GAAqB;IAC1D,EAAE,EAAE,kBAAkB;IACtB,IAAI,EAAE,qCAAqC;IAC3C,WAAW,EAAE,wEAAwE;IACrF,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,kEAAkE;IAClF,QAAQ,EAAE;QACR,8FAA8F;QAC9F,yEAAyE;QACzE,2LAA2L;QAC3L,sEAAsE;KACvE;IACD,gBAAgB,EAAE;QAChB,kBAAkB;QAClB,wBAAwB;QACxB,sBAAsB;QACtB,oBAAoB;KACrB;IACD,OAAO,EAAE,+FAA+F;IACxG,UAAU,EAAE,QAAQ;IACpB,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF,oDAAoD;AACpD,MAAM,CAAC,MAAM,4BAA4B,GAAqB;IAC5D,EAAE,EAAE,kBAAkB;IACtB,IAAI,EAAE,uCAAuC;IAC7C,WAAW,EAAE,wEAAwE;IACrF,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,qEAAqE;IACrF,QAAQ,EAAE;QACR,yCAAyC;QACzC,mHAAmH;QACnH,wEAAwE;QACxE,6EAA6E;QAC7E,4HAA4H;QAC5H,oCAAoC;QACpC,kEAAkE;KACnE;IACD,gBAAgB,EAAE;QAChB,uBAAuB;QACvB,4BAA4B;QAC5B,sBAAsB;QACtB,eAAe;KAChB;IACD,OAAO,EAAE,0FAA0F;IACnG,UAAU,EAAE,QAAQ;IACpB,QAAQ,EAAE,eAAe;CAC1B,CAAC;AAEF,8CAA8C;AAC9C,MAAM,CAAC,MAAM,6BAA6B,GAAqB;IAC7D,EAAE,EAAE,mBAAmB;IACvB,IAAI,EAAE,sCAAsC;IAC5C,WAAW,EAAE,iFAAiF;IAC9F,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,0DAA0D;IAC1E,QAAQ,EAAE;QACR,+DAA+D;QAC/D,wEAAwE;QACxE,6FAA6F;QAC7F,kGAAkG;KACnG;IACD,gBAAgB,EAAE;QAChB,oBAAoB;QACpB,mBAAmB;QACnB,gBAAgB;QAChB,mBAAmB;QACnB,eAAe;QACf,YAAY;KACb;IACD,OAAO,EAAE,gGAAgG;IACzG,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF,kDAAkD;AAClD,MAAM,CAAC,MAAM,wBAAwB,GAAqB;IACxD,EAAE,EAAE,iBAAiB;IACrB,IAAI,EAAE,0CAA0C;IAChD,WAAW,EAAE,+EAA+E;IAC5F,QAAQ,EAAE,MAAM;IAChB,cAAc,EAAE,yDAAyD;IACzE,QAAQ,EAAE;QACR,gEAAgE;QAChE,8BAA8B;QAC9B,qDAAqD;QACrD,gCAAgC;KACjC;IACD,OAAO,EAAE,gEAAgE;IACzE,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF,wCAAwC;AACxC,MAAM,CAAC,MAAM,yBAAyB,GAAqB;IACzD,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,wBAAwB;IAC9B,WAAW,EAAE,4FAA4F;IACzG,QAAQ,EAAE,MAAM;IAChB,cAAc,EAAE,yDAAyD;IACzE,QAAQ,EAAE;QACR,iEAAiE;QACjE,mDAAmD;QACnD,2CAA2C;QAC3C,kDAAkD;KACnD;IACD,OAAO,EAAE,6DAA6D;IACtE,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,+BAA+B,GAAqB;IAC/D,EAAE,EAAE,mBAAmB;IACvB,IAAI,EAAE,8CAA8C;IACpD,WAAW,EAAE,gFAAgF;IAC7F,QAAQ,EAAE,MAAM;IAChB,cAAc,EAAE,+CAA+C;IAC/D,QAAQ,EAAE;QACR,mDAAmD;KACpD;IACD,gBAAgB,EAAE;QAChB,kBAAkB;QAClB,YAAY;QACZ,QAAQ;QACR,YAAY;QACZ,kBAAkB;KACnB;IACD,OAAO,EAAE,iFAAiF;IAC1F,UAAU,EAAE,QAAQ;IACpB,QAAQ,EAAE,eAAe;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAuB;IACzD,YAAY;IACZ,2BAA2B;IAC3B,wBAAwB;IACxB,0BAA0B;IAC1B,4BAA4B;IAC5B,6BAA6B;IAC7B,wBAAwB;IACxB,yBAAyB;IACzB,+BAA+B;CAChC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "verification-layer",
-  "version": "0.27.6",
+  "version": "0.27.7",
   "description": "Open-source HIPAA compliance scanner for healthcare code. 143 rules, 5 HIPAA categories. CLI + CI/CD + VS Code.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",