vibe-guard 1.1.5 → 1.2.0

package/README.md

@@ -1,17 +1,20 @@
 # ██ Vibe-Guard Security Scanner
 
-**Security Scanner** - Zero dependencies, instant setup, works everywhere. Optimized performance for security scanning. Current ruleset: 25 essential security rules.
+**Professional Security Scanner** - Zero dependencies, instant setup, works everywhere. Optimized performance for security scanning. Current ruleset: 28 essential security rules including container security.
 
 [![npm version](https://img.shields.io/npm/v/vibe-guard.svg)](https://www.npmjs.com/package/vibe-guard)
 [![Downloads (total)](https://img.shields.io/npm/dt/vibe-guard.svg)](https://www.npmjs.com/package/vibe-guard)
 [![License](https://img.shields.io/npm/l/vibe-guard.svg)](https://github.com/Devjosef/vibe-guard/blob/main/LICENSE)
 
-## 🚀 Quick Start
+## Quick Start
 
 ```bash
 # Install globally
 npm install -g vibe-guard
 
+# Start interactive session
+vibe-guard start
+
 # Scan your project
 vibe-guard scan .
 
@@ -22,18 +25,18 @@ vibe-guard learn xss-detection
 vibe-guard demo
 ```
 
-## Learning Security 
+## Interactive Security Learning
 
-Vibe-Guard is more than a scanner, it's an educational tool that teaches you about web security:
+Vibe-Guard is more than a scanner—it's an educational platform that teaches you about web security through hands-on experience:
 
-### **Understanding Vulnerabilities**
+### Understanding Vulnerabilities
 
 **XSS (Cross-Site Scripting):**
 ```javascript
 // ❌ Vulnerable code
 app.get('/user', (req, res) => {
   const userInput = req.query.name;
-  res.send('<h1>Hello ' + userInput + '</h1>'); // XSS!
+  res.send('<h1>Hello ' + userInput + '</h1>'); // XSS vulnerability!
 });
 
 // ✅ Secure code
@@ -46,7 +49,7 @@ app.get('/user', (req, res) => {
 **SQL Injection:**
 ```javascript
 // ❌ Vulnerable code
-const query = 'SELECT * FROM users WHERE id = ' + userId; // SQL injection!
+const query = 'SELECT * FROM users WHERE id = ' + userId; // SQL injection risk!
 
 // ✅ Secure code
 const query = 'SELECT * FROM users WHERE id = ?';
@@ -56,36 +59,64 @@ db.query(query, [userId]);
 **Exposed Secrets:**
 ```javascript
 // ❌ Vulnerable code
-const API_KEY = 'sk-1234567890abcdef'; // Exposed in code!
+const API_KEY = 'sk-1234567890abcdef'; // Secret exposed in source code!
 
 // ✅ Secure code
 const API_KEY = process.env.API_KEY; // Environment variable
 ```
 
-### **Security Best Practices**
+**Container Security:**
+```yaml
+# ❌ Vulnerable Kubernetes manifest
+apiVersion: apps/v1
+kind: Deployment
+spec:
+  template:
+    spec:
+      containers:
+      - name: app
+        image: nginx:latest  # Latest tag vulnerability
+        securityContext:
+          runAsUser: 0       # Root user vulnerability
+          privileged: true   # Privileged container vulnerability
+
+# ✅ Secure Kubernetes manifest
+apiVersion: apps/v1
+kind: Deployment
+spec:
+  template:
+    spec:
+      containers:
+      - name: app
+        image: nginx:1.21.6@sha256:abc123...  # Pinned digest
+        securityContext:
+          runAsUser: 1000    # Non-root user
+          runAsNonRoot: true
+          allowPrivilegeEscalation: false
+```
+
+### Security Best Practices
 
 1. **Input Validation** - Always validate and sanitize user input
-2. **Output Encoding** - Encode output to prevent XSS
-3. **Parameterized Queries** - Use prepared statements for SQL
-4. **Environment Variables** - Never hardcode secrets
+2. **Output Encoding** - Encode output to prevent XSS attacks
+3. **Parameterized Queries** - Use prepared statements for database operations
+4. **Environment Variables** - Never hardcode secrets in source code
 5. **Security Headers** - Implement proper HTTP security headers
+6. **Container Security** - Use non-root users, pinned image digests, and proper security contexts
 
-## Security Rules
+## Comprehensive Security Coverage
 
-Vibe-Guard detects 25 types of vulnerabilities:
+Vibe-Guard detects 28 types of vulnerabilities across multiple categories:
 
-- **Authentication & Authorization**: Missing authentication, broken access control
-- **Input Validation**: SQL injection, XSS, unvalidated input
-- **Data Protection**: Exposed secrets, hardcoded sensitive data
-- **Configuration**: Insecure configuration, missing security headers
-- **Session Management**: Insecure session handling
-- **Error Handling**: Information disclosure through errors
-- **File Operations**: Directory traversal, insecure file uploads
-- **Dependencies**: Insecure dependencies, outdated packages
-- **AI/ML Security**: AI-generated code validation, prompt injection
-- **Modern Threats**: CSRF, CORS issues, insecure logging
+- **Authentication & Authorization**: Missing authentication, broken access control, session management
+- **Input Validation**: SQL injection, XSS, unvalidated input, directory traversal
+- **Data Protection**: Exposed secrets, hardcoded sensitive data, insecure logging
+- **Configuration**: Insecure configuration, missing security headers, CORS issues
+- **Modern Threats**: CSRF protection, AI-generated code validation, prompt injection
+- **Dependencies**: Insecure dependencies, outdated packages, vulnerability assessment
+- **Container Security**: Kubernetes security, Dockerfile vulnerabilities, container registry issues
 
-## Use Cases
+## Professional Use Cases
 
 **CI/CD Integration:**
 ```yaml
@@ -101,9 +132,12 @@ Vibe-Guard detects 25 types of vulnerabilities:
 vibe-guard scan . || exit 1
 ```
 
-**Educational Tool:**
+**Interactive Learning:**
 ```bash
-# Learn about security concepts
+# Start interactive session
+vibe-guard start
+
+# Learn specific security concepts
 vibe-guard learn sql-injection
 vibe-guard learn xss-detection
 
@@ -111,9 +145,9 @@ vibe-guard learn xss-detection
 vibe-guard demo
 ```
 
-## Installation
+## Installation Options
 
-**NPM:**
+**NPM (Recommended):**
 ```bash
 npm install -g vibe-guard
 ```
@@ -137,46 +171,50 @@ chmod +x vibe-guard
 curl -L https://github.com/Devjosef/vibe-guard/releases/latest/download/vibe-guard-windows-x64.exe -o vibe-guard.exe
 ```
 
-## Documentation
+## Documentation & Resources
 
-- **[Getting Started](https://devjosef.github.io/vibe-guard/getting-started.html)** - Complete setup guide
-- **[Security Rules](https://devjosef.github.io/vibe-guard/rules.html)** - Detailed rule explanations
-- **[Performance Guide](https://devjosef.github.io/vibe-guard/performance.html)** - Optimization tips
-- **[API Reference](https://devjosef.github.io/vibe-guard/docs.html)** - Programmatic usage
+- **[Getting Started](https://devjosef.github.io/vibe-guard/getting-started.html)** - Complete setup and configuration guide
+- **[Security Rules](https://devjosef.github.io/vibe-guard/rules.html)** - Detailed rule explanations and examples
+- **[Performance Guide](https://devjosef.github.io/vibe-guard/performance.html)** - Optimization and best practices
+- **[API Reference](https://devjosef.github.io/vibe-guard/docs.html)** - Programmatic usage and integration
 
-## 🤝 Community
+## Community & Support
 
-**Join us in making the web more secure:**
+**Join our community of security professionals and developers:**
 
--  **Learn**: `vibe-guard learn [topic]` - Understand security concepts
--  **Demo**: `vibe-guard demo` - Try with example vulnerabilities
--  **Stats**: `vibe-guard stats` - See your security impact
--  **Discuss**: [GitHub Discussions](https://github.com/Devjosef/vibe-guard/discussions)
--  **Report**: [GitHub Issues](https://github.com/Devjosef/vibe-guard/issues)
--  **Star**: [GitHub Repository](https://github.com/Devjosef/vibe-guard)
+- **Interactive Learning**: `vibe-guard start` - Begin your security journey
+- **Educational Commands**: `vibe-guard learn [topic]` - Master security concepts
+- **Hands-on Practice**: `vibe-guard demo` - Test with example vulnerabilities
+- **Performance Insights**: `vibe-guard stats` - Track your security impact
+- **Community Discussion**: [GitHub Discussions](https://github.com/Devjosef/vibe-guard/discussions)
+- **Issue Reporting**: [GitHub Issues](https://github.com/Devjosef/vibe-guard/issues)
+- **Repository**: [GitHub Repository](https://github.com/Devjosef/vibe-guard)
 
-##  Why Vibe-Guard?
+## Why Choose Vibe-Guard?
 
 **Built for developers who code fast and need security that keeps up:**
 
--  **Zero dependencies** - Lightweight and fast
--  **25 security rules** - Comprehensive coverage
--  **Cross-platform** - Works everywhere
--  **Educational** - Learn while you scan
--  **OWASP aligned** - Industry best practices
--  **Developer-friendly** - Simple CLI interface
+- **Zero Dependencies** - Lightweight, fast, and reliable
+- **28 Security Rules** - Comprehensive coverage of modern threats including container security
+- **Cross-Platform** - Works seamlessly across all operating systems
+- **Educational Focus** - Learn security while you scan
+- **OWASP Aligned** - Industry best practices and standards
+- **Developer-Friendly** - Simple, intuitive CLI interface
+- **Interactive Mode** - Guided learning with `vibe-guard start`
+- **Container Security** - Kubernetes, Dockerfile, and registry security scanning
 
-##  Impact
+## Impact & Adoption
 
-Every scan makes the web a little more secure:
+Every scan contributes to a more secure web ecosystem:
 
-- **600+ total downloads** on NPM
-- **25 security rules** covering modern threats
-- **Cross-platform** support (Linux, macOS, Windows)
-- **Zero dependencies** for maximum compatibility
-- **Educational focus** - teaching security concepts
+- **500+ total downloads** on NPM with growing adoption
+- **28 security rules** covering contemporary threat vectors including container security
+- **Cross-platform support** for Linux, macOS, and Windows
+- **Zero dependencies** ensuring maximum compatibility
+- **Educational approach** - building security awareness
+- **Container security** - Kubernetes, Dockerfile, and registry vulnerability detection
 
-##  License
+## License
 
 MIT License - see [LICENSE](LICENSE) for details.
 

package/dist/rules/container-registry-security.d.ts

@@ -0,0 +1,21 @@
+import { BaseRule, FileContent, SecurityIssue } from '../types';
+export declare class ContainerRegistrySecurityRule extends BaseRule {
+    readonly name = "container-registry-security";
+    readonly description = "Detects container registry security misconfigurations and vulnerabilities";
+    readonly severity: "medium";
+    private readonly registryPatterns;
+    check(fileContent: FileContent): SecurityIssue[];
+    private isContainerFile;
+    private analyzeRegistryContext;
+    private extractRegistryType;
+    private extractImageName;
+    private extractImageTag;
+    private extractPullPolicyType;
+    private extractRegistryUrls;
+    private extractImageReferences;
+    private shouldSkipMatch;
+    private determineSeverity;
+    private enhanceSuggestion;
+    private checkMissingPractices;
+}
+//# sourceMappingURL=container-registry-security.d.ts.map

package/dist/rules/container-registry-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-registry-security.d.ts","sourceRoot":"","sources":["../../src/rules/container-registry-security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAiB,MAAM,UAAU,CAAC;AAoC/E,qBAAa,6BAA8B,SAAQ,QAAQ;IACzD,QAAQ,CAAC,IAAI,iCAAiC;IAC9C,QAAQ,CAAC,WAAW,+EAA+E;IACnG,QAAQ,CAAC,QAAQ,EAAG,QAAQ,CAAU;IAEtC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAgE/B;IAEF,KAAK,CAAC,WAAW,EAAE,WAAW,GAAG,aAAa,EAAE;IAsChD,OAAO,CAAC,eAAe;IAevB,OAAO,CAAC,sBAAsB;IAuB9B,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,gBAAgB;IAKxB,OAAO,CAAC,eAAe;IAKvB,OAAO,CAAC,qBAAqB;IAK7B,OAAO,CAAC,mBAAmB;IAU3B,OAAO,CAAC,sBAAsB;IAU9B,OAAO,CAAC,eAAe;IAYvB,OAAO,CAAC,iBAAiB;IA4BzB,OAAO,CAAC,iBAAiB;IAkDzB,OAAO,CAAC,qBAAqB;CA8E9B"}

package/dist/rules/container-registry-security.js

@@ -0,0 +1,271 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ContainerRegistrySecurityRule = void 0;
+const types_1 = require("../types");
+class ContainerRegistrySecurityRule extends types_1.BaseRule {
+    constructor() {
+        super(...arguments);
+        this.name = 'container-registry-security';
+        this.description = 'Detects container registry security misconfigurations and vulnerabilities';
+        this.severity = 'medium';
+        this.registryPatterns = [
+            {
+                pattern: /image:\s*([^:]+):latest/gm,
+                type: 'Latest Tag Usage',
+                severity: 'high',
+                description: 'Using latest tag can lead to unpredictable deployments',
+                suggestion: 'Use specific version tags (e.g., nginx:1.21.6 instead of nginx:latest)'
+            },
+            {
+                pattern: /image:\s*([^:]+):([^\s]+)(?!@sha256:)(?!@sha512:)/gm,
+                type: 'Missing Image Digest',
+                severity: 'high',
+                description: 'Image reference without @sha256 digest can lead to supply chain attacks',
+                suggestion: 'Use pinned digest: image@sha256:abc123... for immutable references'
+            },
+            {
+                pattern: /image:\s*([^:]+):([^\s]+)@sha256:([a-f0-9]{64})/gm,
+                type: 'Image Digest Present',
+                severity: 'low',
+                description: 'Image digest provides immutable reference - good practice',
+                suggestion: 'Good practice: Image digest ensures consistent deployments'
+            },
+            {
+                pattern: /image:\s*([^:]+):([^\s]+)(?!@sha256:)(?!@sha512:)/gm,
+                type: 'Missing Image Signature',
+                severity: 'medium',
+                description: 'Image without signature verification',
+                suggestion: 'Use signed images and verify signatures in CI/CD pipeline'
+            },
+            {
+                pattern: /image:\s*([^:]+):([^\s]+)(?!@sha256:)(?!@sha512:)/gm,
+                type: 'Insecure Image Pull',
+                severity: 'high',
+                description: 'Image pull without authentication or verification',
+                suggestion: 'Use imagePullSecrets and verify image integrity'
+            },
+            {
+                pattern: /image:\s*([^:]+):([^\s]+)(?!@sha256:)(?!@sha512:)/gm,
+                type: 'Public Registry Usage',
+                severity: 'medium',
+                description: 'Using public registry (Docker Hub, GCR, etc.) without verification',
+                suggestion: 'Use private registry or verify public images before deployment'
+            },
+            {
+                pattern: /image:\s*([^:]+):([^\s]+)(?!@sha256:)(?!@sha512:)/gm,
+                type: 'Missing Image Scanning',
+                severity: 'medium',
+                description: 'No vulnerability scanning detected in workflow',
+                suggestion: 'Implement image vulnerability scanning in CI/CD pipeline'
+            },
+            {
+                pattern: /imagePullPolicy:\s*Always/gm,
+                type: 'Always Pull Policy',
+                severity: 'low',
+                description: 'Always pulling images can slow deployments and increase security risk',
+                suggestion: 'Use IfNotPresent or specific version tags with IfNotPresent policy'
+            },
+            {
+                pattern: /insecure-registry|http:/gm,
+                type: 'Insecure Registry',
+                severity: 'critical',
+                description: 'Using insecure registry over HTTP',
+                suggestion: 'Use HTTPS registry endpoints for secure communication'
+            }
+        ];
+    }
+    check(fileContent) {
+        const issues = [];
+        if (!this.isContainerFile(fileContent.path)) {
+            return issues;
+        }
+        const context = this.analyzeRegistryContext(fileContent.content);
+        for (const { pattern, type, severity, description, suggestion } of this.registryPatterns) {
+            const matches = this.findMatches(fileContent.content, pattern);
+            for (const { line, column, lineContent } of matches) {
+                if (this.shouldSkipMatch(type, context)) {
+                    continue;
+                }
+                const finalSeverity = this.determineSeverity(severity, context, type);
+                const enhancedSuggestion = this.enhanceSuggestion(suggestion, context, type);
+                issues.push(this.createIssue(fileContent.path, line, column, lineContent, `${type}: ${description}`, enhancedSuggestion, finalSeverity));
+            }
+        }
+        const missingPractices = this.checkMissingPractices(context);
+        issues.push(...missingPractices);
+        return issues;
+    }
+    isContainerFile(filePath) {
+        const lowerPath = filePath.toLowerCase();
+        return lowerPath.includes('dockerfile') ||
+            lowerPath.endsWith('docker-compose.yml') ||
+            lowerPath.endsWith('docker-compose.yaml') ||
+            lowerPath.endsWith('.dockerfile') ||
+            lowerPath.endsWith('.yaml') ||
+            lowerPath.endsWith('.yml') ||
+            lowerPath.includes('k8s') ||
+            lowerPath.includes('kubernetes') ||
+            lowerPath.includes('deployment') ||
+            lowerPath.includes('service') ||
+            lowerPath.includes('pod');
+    }
+    analyzeRegistryContext(content) {
+        return {
+            hasImagePullSecrets: /imagePullSecrets:/m.test(content),
+            hasImageDigest: /@sha256:|@sha512:/m.test(content),
+            hasImageSignature: /@sha256:|@sha512:/m.test(content),
+            hasImagePullPolicy: /imagePullPolicy:/m.test(content),
+            registryType: this.extractRegistryType(content),
+            imageName: this.extractImageName(content),
+            imageTag: this.extractImageTag(content),
+            hasInsecureRegistry: /insecure-registry|http:/m.test(content),
+            hasPublicRegistry: /docker\.io|gcr\.io|quay\.io|registry\.k8s\.io/m.test(content),
+            hasPrivateRegistry: /\.local|\.internal|private/m.test(content),
+            hasImageScanning: /scan|vulnerability|security/m.test(content),
+            hasImageSigning: /sign|signature|cosign/m.test(content),
+            pullPolicyType: this.extractPullPolicyType(content),
+            hasTrivyScanning: /trivy|aquasec/m.test(content),
+            hasCosignSigning: /cosign|signature/m.test(content),
+            hasVulnerabilityScanning: /vulnerability|scan|security/m.test(content),
+            registryUrls: this.extractRegistryUrls(content),
+            imageReferences: this.extractImageReferences(content)
+        };
+    }
+    extractRegistryType(content) {
+        if (/docker\.io/m.test(content))
+            return 'docker-hub';
+        if (/gcr\.io/m.test(content))
+            return 'gcr';
+        if (/quay\.io/m.test(content))
+            return 'quay';
+        if (/registry\.k8s\.io/m.test(content))
+            return 'k8s-registry';
+        if (/\.local|\.internal/m.test(content))
+            return 'private';
+        return 'unknown';
+    }
+    extractImageName(content) {
+        const imageMatch = content.match(/image:\s*([^:]+):/m);
+        return imageMatch?.[1] ?? 'unknown';
+    }
+    extractImageTag(content) {
+        const tagMatch = content.match(/image:\s*[^:]+:([^\s@]+)/m);
+        return tagMatch?.[1] ?? 'latest';
+    }
+    extractPullPolicyType(content) {
+        const policyMatch = content.match(/imagePullPolicy:\s*(\w+)/m);
+        return policyMatch?.[1] ?? 'unknown';
+    }
+    extractRegistryUrls(content) {
+        const urlMatches = content.match(/(?:registry|repository):\s*([^\s\n]+)/gm);
+        if (!urlMatches)
+            return [];
+        return urlMatches.map(match => {
+            const urlMatch = match.match(/(?:registry|repository):\s*(.+)/);
+            return urlMatch?.[1]?.trim() ?? '';
+        }).filter(url => url.length > 0);
+    }
+    extractImageReferences(content) {
+        const imageMatches = content.match(/image:\s*([^\s\n]+)/gm);
+        if (!imageMatches)
+            return [];
+        return imageMatches.map(match => {
+            const imageMatch = match.match(/image:\s*(.+)/);
+            return imageMatch?.[1]?.trim() ?? '';
+        }).filter(image => image.length > 0);
+    }
+    shouldSkipMatch(type, context) {
+        if (type === 'Missing Image Digest' && context.hasImageDigest) {
+            return true;
+        }
+        if (type === 'Missing Image Signature' && context.hasImageSignature) {
+            return true;
+        }
+        return false;
+    }
+    determineSeverity(baseSeverity, context, type) {
+        if (type === 'Missing Image Digest' && !context.hasImageDigest) {
+            return 'high';
+        }
+        if (type === 'Insecure Registry' && context.hasInsecureRegistry) {
+            return 'critical';
+        }
+        if (type === 'Public Registry Usage' && context.hasPublicRegistry && !context.hasVulnerabilityScanning) {
+            return 'high';
+        }
+        if (type === 'Latest Tag Usage' && context.hasPublicRegistry) {
+            return 'high';
+        }
+        if (type === 'Missing Image Scanning' && context.hasPublicRegistry) {
+            return 'high';
+        }
+        if (type === 'Insecure Image Pull' && context.hasPrivateRegistry && !context.hasImagePullSecrets) {
+            return 'critical';
+        }
+        return baseSeverity;
+    }
+    enhanceSuggestion(baseSuggestion, context, type) {
+        let suggestion = baseSuggestion;
+        if (type === 'Missing Image Digest') {
+            suggestion += '\n\n**Complete secure image reference example:**\n```yaml\nimage: nginx@sha256:abc123def456...\nimagePullPolicy: IfNotPresent\nimagePullSecrets:\n  - name: registry-secret\n```';
+            suggestion += '\n\n**Security benefit:** Pinned digests prevent supply chain attacks and ensure immutable images';
+        }
+        if (type === 'Latest Image Tag') {
+            suggestion += `\n\n**Current image:** ${context.imageName}:${context.imageTag}`;
+            suggestion += '\n**Recommended:** Use specific version tags for reproducible deployments';
+            suggestion += '\n**Example:** Replace `nginx:latest` with `nginx:1.21.6`';
+        }
+        if (type === 'Missing Image Scanning') {
+            suggestion += '\n\n**Implement image scanning with Trivy:**\n```yaml\n# In CI/CD pipeline\n- name: Scan image\n  run: |\n    docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \\\n      aquasec/trivy image ${IMAGE_NAME}:${IMAGE_TAG}\n```';
+            suggestion += '\n\n**Alternative tools:** Snyk, Clair, or built-in registry scanning';
+        }
+        if (type === 'Insecure Image Pull') {
+            suggestion += '\n\n**Secure image pull configuration:**\n```yaml\nimagePullSecrets:\n  - name: registry-secret\nimagePullPolicy: IfNotPresent\n```';
+            suggestion += '\n\n**For private registries:** Always use imagePullSecrets for authentication';
+        }
+        if (type === 'Public Registry Usage') {
+            suggestion += `\n\n**Registry type detected:** ${context.registryType}`;
+            suggestion += '\n**Security risk:** Public registries can be compromised or contain malicious images';
+            suggestion += '\n**Solution:** Use private registry or verify public images before deployment';
+        }
+        if (type === 'Missing Image Signature') {
+            suggestion += '\n\n**Implement image signing with cosign:**\n```bash\n# Sign image\ncosign sign --key cosign.key ${IMAGE_NAME}:${IMAGE_TAG}\n\n# Verify signature\ncosign verify --key cosign.pub ${IMAGE_NAME}:${IMAGE_TAG}\n```';
+            suggestion += '\n\n**Security benefit:** Image signatures ensure integrity and authenticity';
+        }
+        if (type === 'Insecure Registry') {
+            suggestion += '\n\n**Security risk:** HTTP registries are vulnerable to man-in-the-middle attacks';
+            suggestion += '\n**Solution:** Use HTTPS registry endpoints for secure communication';
+            suggestion += '\n**Example:** Replace `http://registry.example.com` with `https://registry.example.com`';
+        }
+        if (type === 'Always Pull Policy') {
+            suggestion += '\n\n**Current pull policy:** ' + context.pullPolicyType;
+            suggestion += '\n**Security risk:** Always pulling can slow deployments and increase attack surface';
+            suggestion += '\n**Recommended:** Use `IfNotPresent` with specific version tags';
+        }
+        return suggestion;
+    }
+    checkMissingPractices(context) {
+        const issues = [];
+        if (!context.hasImagePullSecrets && context.hasPrivateRegistry) {
+            issues.push(this.createIssue('Container Manifest', 1, 1, 'image: ...', 'Missing image pull secrets: Cannot authenticate with private registry', 'Add imagePullSecrets to authenticate with private registry:\n```yaml\nimagePullSecrets:\n  - name: registry-secret\n```', 'high'));
+        }
+        if (!context.hasImageDigest && context.imageReferences.length > 0) {
+            issues.push(this.createIssue('Container Manifest', 1, 1, 'image: ...', 'Missing image digest: Image references are mutable', 'Use image digest for immutable references: image@sha256:abc123...\n**Security benefit:** Prevents supply chain attacks', 'high'));
+        }
+        if (!context.hasVulnerabilityScanning && context.hasPublicRegistry) {
+            issues.push(this.createIssue('Container Manifest', 1, 1, 'image: ...', 'Missing image scanning: No vulnerability assessment for public registry images', 'Implement image vulnerability scanning in CI/CD pipeline:\n```yaml\n# Trivy scanning\n- name: Scan image\n  run: docker run --rm aquasec/trivy image ${IMAGE_NAME}:${IMAGE_TAG}\n```', 'high'));
+        }
+        if (!context.hasImageSigning && context.hasPublicRegistry) {
+            issues.push(this.createIssue('Container Manifest', 1, 1, 'image: ...', 'Missing image signing: No integrity verification for public registry images', 'Implement image signing and verification in CI/CD pipeline:\n```bash\n# Sign with cosign\ncosign sign --key cosign.key ${IMAGE_NAME}:${IMAGE_TAG}\n```', 'medium'));
+        }
+        if (!context.hasImagePullPolicy && context.imageReferences.length > 0) {
+            issues.push(this.createIssue('Container Manifest', 1, 1, 'image: ...', 'Missing image pull policy: No pull policy specified', 'Add imagePullPolicy for better control:\n```yaml\nimagePullPolicy: IfNotPresent\n```', 'low'));
+        }
+        if (context.hasInsecureRegistry) {
+            issues.push(this.createIssue('Container Manifest', 1, 1, 'registry: ...', 'Insecure registry detected: Using HTTP instead of HTTPS', 'Use HTTPS registry endpoints for secure communication:\n```yaml\n# Replace http:// with https://\nregistry: https://registry.example.com\n```', 'critical'));
+        }
+        return issues;
+    }
+}
+exports.ContainerRegistrySecurityRule = ContainerRegistrySecurityRule;
+//# sourceMappingURL=container-registry-security.js.map

package/dist/rules/container-registry-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-registry-security.js","sourceRoot":"","sources":["../../src/rules/container-registry-security.ts"],"names":[],"mappings":";;;AAAA,oCAA+E;AAoC/E,MAAa,6BAA8B,SAAQ,gBAAQ;IAA3D;;QACW,SAAI,GAAG,6BAA6B,CAAC;QACrC,gBAAW,GAAG,2EAA2E,CAAC;QAC1F,aAAQ,GAAG,QAAiB,CAAC;QAErB,qBAAgB,GAAsB;YACrD;gBACE,OAAO,EAAE,2BAA2B;gBACpC,IAAI,EAAE,kBAAkB;gBACxB,QAAQ,EAAE,MAAM;gBAChB,WAAW,EAAE,wDAAwD;gBACrE,UAAU,EAAE,wEAAwE;aACrF;YACD;gBACE,OAAO,EAAE,qDAAqD;gBAC9D,IAAI,EAAE,sBAAsB;gBAC5B,QAAQ,EAAE,MAAM;gBAChB,WAAW,EAAE,yEAAyE;gBACtF,UAAU,EAAE,oEAAoE;aACjF;YACD;gBACE,OAAO,EAAE,mDAAmD;gBAC5D,IAAI,EAAE,sBAAsB;gBAC5B,QAAQ,EAAE,KAAK;gBACf,WAAW,EAAE,2DAA2D;gBACxE,UAAU,EAAE,4DAA4D;aACzE;YACD;gBACE,OAAO,EAAE,qDAAqD;gBAC9D,IAAI,EAAE,yBAAyB;gBAC/B,QAAQ,EAAE,QAAQ;gBAClB,WAAW,EAAE,sCAAsC;gBACnD,UAAU,EAAE,2DAA2D;aACxE;YACD;gBACE,OAAO,EAAE,qDAAqD;gBAC9D,IAAI,EAAE,qBAAqB;gBAC3B,QAAQ,EAAE,MAAM;gBAChB,WAAW,EAAE,mDAAmD;gBAChE,UAAU,EAAE,iDAAiD;aAC9D;YACD;gBACE,OAAO,EAAE,qDAAqD;gBAC9D,IAAI,EAAE,uBAAuB;gBAC7B,QAAQ,EAAE,QAAQ;gBAClB,WAAW,EAAE,oEAAoE;gBACjF,UAAU,EAAE,gEAAgE;aAC7E;YACD;gBACE,OAAO,EAAE,qDAAqD;gBAC9D,IAAI,EAAE,wBAAwB;gBAC9B,QAAQ,EAAE,QAAQ;gBAClB,WAAW,EAAE,gDAAgD;gBAC7D,UAAU,EAAE,0DAA0D;aACvE;YACD;gBACE,OAAO,EAAE,6BAA6B;gBACtC,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,KAAK;gBACf,WAAW,EAAE,uEAAuE;gBACpF,UAAU,EAAE,oEAAoE;aACjF;YACD;gBACE,OAAO,EAAE,2BAA2B;gBACpC,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,UAAU;gBACpB,WAAW,EAAE,mCAAmC;gBAChD,UAAU,EAAE,uDAAuD;aACpE;SACF,CAAC;IAkSJ,CAAC;IAhSC,KAAK,CAAC,WAAwB;QAC5B,MAAM,MAAM,GAAoB,EAAE,CAAC;QAEnC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAEjE,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACzF,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAE/D,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,OAAO,EAAE,CAAC;gBACpD,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;oBACxC,SAAS;gBACX,CAAC;gBAED,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;gBACtE,MAAM,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;gBAE7E,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAC1B,WAAW,CAAC,IAAI,EAChB,IAAI,EACJ,MAAM,EACN,WAAW,EACX,GAAG,IAAI,KAAK,WAAW,EAAE,EACzB,kBAAkB,EAClB,aAAa,CACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAC;QAEjC,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,eAAe,CAAC,QAAgB;QACtC,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzC,OAAO,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;YAChC,SAAS,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YACxC,SAAS,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YACzC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC;YACjC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC3B,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC1B,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;YACzB,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;YAChC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;YAChC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC7B,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAEO,sBAAsB,CAAC,OAAe;QAC5C,OAAO;YACL,mBAAmB,EAAE,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;YACvD,cAAc,EAAE,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;YAClD,iBAAiB,EAAE,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;YACrD,kBAAkB,EAAE,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC;YACrD,YAAY,EAAE,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC;YAC/C,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACzC,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;YACvC,mBAAmB,EAAE,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;YAC7D,iBAAiB,EAAE,gDAAgD,CAAC,IAAI,CAAC,OAAO,CAAC;YACjF,kBAAkB,EAAE,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC;YAC/D,gBAAgB,EAAE,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC;YAC9D,eAAe,EAAE,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC;YACvD,cAAc,EAAE,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;YACnD,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YAChD,gBAAgB,EAAE,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC;YACnD,wBAAwB,EAAE,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC;YACtE,YAAY,EAAE,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC;YAC/C,eAAe,EAAE,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC;SACtD,CAAC;IACJ,CAAC;IAEO,mBAAmB,CAAC,OAAe;QACzC,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,YAAY,CAAC;QACrD,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,MAAM,CAAC;QAC7C,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,cAAc,CAAC;QAC9D,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,gBAAgB,CAAC,OAAe;QACtC,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACvD,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;IACtC,CAAC;IAEO,eAAe,CAAC,OAAe;QACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC5D,OAAO,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;IACnC,CAAC;IAEO,qBAAqB,CAAC,OAAe;QAC3C,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/D,OAAO,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;IACvC,CAAC;IAEO,mBAAmB,CAAC,OAAe;QACzC,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC5E,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QAE3B,OAAO,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;YAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;YAChE,OAAO,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACrC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,CAAC;IAEO,sBAAsB,CAAC,OAAe;QAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,CAAC;QAE7B,OAAO,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;YAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAChD,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,CAAC;IAEO,eAAe,CAAC,IAAY,EAAE,OAAwB;QAC5D,IAAI,IAAI,KAAK,sBAAsB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,KAAK,yBAAyB,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,iBAAiB,CAAC,YAA2B,EAAE,OAAwB,EAAE,IAAY;QAC3F,IAAI,IAAI,KAAK,sBAAsB,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAC/D,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,IAAI,KAAK,mBAAmB,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;YAChE,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,IAAI,IAAI,KAAK,uBAAuB,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC;YACvG,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,IAAI,KAAK,kBAAkB,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC7D,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,IAAI,KAAK,wBAAwB,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YACnE,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,IAAI,KAAK,qBAAqB,IAAI,OAAO,CAAC,kBAAkB,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;YACjG,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAEO,iBAAiB,CAAC,cAAsB,EAAE,OAAwB,EAAE,IAAY;QACtF,IAAI,UAAU,GAAG,cAAc,CAAC;QAEhC,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;YACpC,UAAU,IAAI,kLAAkL,CAAC;YACjM,UAAU,IAAI,mGAAmG,CAAC;QACpH,CAAC;QAED,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAChC,UAAU,IAAI,0BAA0B,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YAChF,UAAU,IAAI,2EAA2E,CAAC;YAC1F,UAAU,IAAI,2DAA2D,CAAC;QAC5E,CAAC;QAED,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;YACtC,UAAU,IAAI,0OAA0O,CAAC;YACzP,UAAU,IAAI,uEAAuE,CAAC;QACxF,CAAC;QAED,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;YACnC,UAAU,IAAI,qIAAqI,CAAC;YACpJ,UAAU,IAAI,gFAAgF,CAAC;QACjG,CAAC;QAED,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACrC,UAAU,IAAI,mCAAmC,OAAO,CAAC,YAAY,EAAE,CAAC;YACxE,UAAU,IAAI,uFAAuF,CAAC;YACtG,UAAU,IAAI,gFAAgF,CAAC;QACjG,CAAC;QAED,IAAI,IAAI,KAAK,yBAAyB,EAAE,CAAC;YACvC,UAAU,IAAI,oNAAoN,CAAC;YACnO,UAAU,IAAI,8EAA8E,CAAC;QAC/F,CAAC;QAED,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACjC,UAAU,IAAI,oFAAoF,CAAC;YACnG,UAAU,IAAI,uEAAuE,CAAC;YACtF,UAAU,IAAI,0FAA0F,CAAC;QAC3G,CAAC;QAED,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAClC,UAAU,IAAI,+BAA+B,GAAG,OAAO,CAAC,cAAc,CAAC;YACvE,UAAU,IAAI,sFAAsF,CAAC;YACrG,UAAU,IAAI,kEAAkE,CAAC;QACnF,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,qBAAqB,CAAC,OAAwB;QACpD,MAAM,MAAM,GAAoB,EAAE,CAAC;QAEnC,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAC/D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAC1B,oBAAoB,EACpB,CAAC,EACD,CAAC,EACD,YAAY,EACZ,uEAAuE,EACvE,yHAAyH,EACzH,MAAM,CACP,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAC1B,oBAAoB,EACpB,CAAC,EACD,CAAC,EACD,YAAY,EACZ,oDAAoD,EACpD,wHAAwH,EACxH,MAAM,CACP,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,wBAAwB,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YACnE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAC1B,oBAAoB,EACpB,CAAC,EACD,CAAC,EACD,YAAY,EACZ,gFAAgF,EAChF,sLAAsL,EACtL,MAAM,CACP,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAC1B,oBAAoB,EACpB,CAAC,EACD,CAAC,EACD,YAAY,EACZ,6EAA6E,EAC7E,wJAAwJ,EACxJ,QAAQ,CACT,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAC1B,oBAAoB,EACpB,CAAC,EACD,CAAC,EACD,YAAY,EACZ,qDAAqD,EACrD,sFAAsF,EACtF,KAAK,CACN,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAC1B,oBAAoB,EACpB,CAAC,EACD,CAAC,EACD,eAAe,EACf,yDAAyD,EACzD,+IAA+I,EAC/I,UAAU,CACX,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CAEF;AAvWD,sEAuWC"}

package/dist/rules/dockerfile-security.d.ts

@@ -0,0 +1,20 @@
+import { BaseRule, FileContent, SecurityIssue } from '../types';
+export declare class DockerfileSecurityRule extends BaseRule {
+    readonly name = "dockerfile-security";
+    readonly description = "Detects common Dockerfile security vulnerabilities and misconfigurations";
+    readonly severity: "high";
+    private readonly dockerfilePatterns;
+    check(fileContent: FileContent): SecurityIssue[];
+    private isDockerfile;
+    private analyzeDockerfileContext;
+    private extractBaseImage;
+    private extractExposedPorts;
+    private checkDockerignoreExists;
+    private extractUserDirectiveOrder;
+    private hasPublicPorts;
+    private shouldSkipMatch;
+    private determineSeverity;
+    private enhanceSuggestion;
+    private checkMissingPractices;
+}
+//# sourceMappingURL=dockerfile-security.d.ts.map

package/dist/rules/dockerfile-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dockerfile-security.d.ts","sourceRoot":"","sources":["../../src/rules/dockerfile-security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAiB,MAAM,UAAU,CAAC;AAmC/E,qBAAa,sBAAuB,SAAQ,QAAQ;IAClD,QAAQ,CAAC,IAAI,yBAAyB;IACtC,QAAQ,CAAC,WAAW,8EAA8E;IAClG,QAAQ,CAAC,QAAQ,EAAG,MAAM,CAAU;IAEpC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAqFjC;IAEF,KAAK,CAAC,WAAW,EAAE,WAAW,GAAG,aAAa,EAAE;IAsChD,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,wBAAwB;IAyBhC,OAAO,CAAC,gBAAgB;IAKxB,OAAO,CAAC,mBAAmB;IAU3B,OAAO,CAAC,uBAAuB;IAI/B,OAAO,CAAC,yBAAyB;IAajC,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,eAAe;IAYvB,OAAO,CAAC,iBAAiB;IA4BzB,OAAO,CAAC,iBAAiB;IAiDzB,OAAO,CAAC,qBAAqB;CAuG9B"}