xploitscan-shared-rules 1.13.0 → 1.14.0

package/dist/index.js

@@ -1,13 +1,48 @@
 // src/snippet.ts
-function getSnippet(content, line, contextLines = 2) {
+var cacheContent = null;
+var cacheLines = [];
+var cacheOffsets = [];
+function lineIndex(content) {
+  if (content === cacheContent) return { lines: cacheLines, offsets: cacheOffsets };
   const lines = content.split("\n");
+  const offsets = new Array(lines.length);
+  let off = 0;
+  for (let i = 0; i < lines.length; i++) {
+    offsets[i] = off;
+    off += lines[i].length + 1;
+  }
+  cacheContent = content;
+  cacheLines = lines;
+  cacheOffsets = offsets;
+  return { lines, offsets };
+}
+function lineNumberAt(content, index) {
+  const { offsets } = lineIndex(content);
+  let lo = 0;
+  let hi = offsets.length - 1;
+  let ans = 0;
+  while (lo <= hi) {
+    const mid = lo + hi >> 1;
+    if (offsets[mid] <= index) {
+      ans = mid;
+      lo = mid + 1;
+    } else {
+      hi = mid - 1;
+    }
+  }
+  return ans + 1;
+}
+function getSnippet(content, line, contextLines = 2) {
+  const { lines } = lineIndex(content);
   const start = Math.max(0, line - 1 - contextLines);
   const end = Math.min(lines.length, line + contextLines);
-  return lines.slice(start, end).map((l, i) => {
-    const lineNum = start + i + 1;
+  const out = [];
+  for (let i = start; i < end; i++) {
+    const lineNum = i + 1;
     const marker = lineNum === line ? ">" : " ";
-    return `${marker} ${lineNum.toString().padStart(4)} | ${l}`;
-  }).join("\n");
+    out.push(`${marker} ${lineNum.toString().padStart(4)} | ${lines[i]}`);
+  }
+  return out.join("\n");
 }
 
 // src/rule-impacts.ts
@@ -221,7 +256,9 @@ var RULE_IMPACTS = {
   VC207: "Model output is attacker-influenceable via prompt injection. Feeding it into eval, new Function, a shell command, a raw SQL string, or a filesystem path turns a crafted or hallucinated response into remote code execution, command injection, SQL injection, or path traversal \u2014 your most dangerous sinks, driven by untrusted text.",
   VC208: "Interpolating a secret into a prompt ships your API key, token, or password to a third-party model provider, where it persists in their request logs and training-eligible data. A credential that leaves your infrastructure in prompt text should be considered compromised and rotated.",
   VC209: "Webhooks are delivered at-least-once. Without de-duplicating on the event id, a retried or replayed delivery re-runs the side effect \u2014 a customer is charged twice, a record is duplicated, or an entitlement is granted again. Stripe and Svix both retry on any non-2xx, so this fires in normal operation, not just under attack.",
-  VC210: "If your auth middleware skips /api, those routes run with no gate unless each one re-checks auth itself. It is the most common way a Next.js app ends up with publicly callable API routes that everyone assumed the middleware was protecting."
+  VC210: "If your auth middleware skips /api, those routes run with no gate unless each one re-checks auth itself. It is the most common way a Next.js app ends up with publicly callable API routes that everyone assumed the middleware was protecting.",
+  VC211: "A real credit card number in source is cardholder data sitting in git history, CI logs, and every backup \u2014 a direct PCI-DSS violation. Anyone with repo access can read it, and it cannot be un-leaked once committed; the card must be treated as compromised.",
+  VC212: "A hardcoded Social Security Number is regulated PII permanently embedded in your git history and backups. It exposes a real person to identity theft, and its presence in source can trigger breach-notification and privacy-law obligations the moment the repo is accessed."
 };
 
 // src/exposure.ts
@@ -815,7 +852,7 @@ var SERVER_SIDE_PATH_RE = new RegExp(
   ].join("|"),
   "i"
 );
-var SERVER_SIDE_CONTENT_RE = /\b(?:req|request)\.(?:body|query|params|headers|cookies)\b|\b(?:app|router)\.(?:get|post|put|patch|delete|use|all)\s*\(|\bctx\.request\b|\bevent\.(?:body|queryStringParameters|pathParameters)\b|\(\s*req\s*,\s*res\b|(?:import|require)\b[^;\n]*['"]express['"]|\bNextFunction\b/;
+var SERVER_SIDE_CONTENT_RE = /\b(?:req|request)\.(?:body|query|params|headers|cookies)\b|\b(?:app|router)\.(?:get|post|put|patch|delete|use|all)\s*\(|\bctx\.request\b|\bevent\.(?:body|queryStringParameters|pathParameters)\b|\(\s*req\s*,\s*res\b|(?:import|require)\b[^;\n]{0,200}['"]express['"]|\bNextFunction\b/;
 function isServerSideFile(filePath, content) {
   if (isTestFile(filePath)) return false;
   if (SERVER_SIDE_PATH_RE.test(filePath)) return true;
@@ -862,13 +899,23 @@ function filterSilenced(matches, content, ruleId) {
 }
 function findMatches(content, pattern, rule, filePath, fixTemplate) {
   const matches = [];
-  const lines = content.split("\n");
   let m;
   const re = new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`);
+  let scanned = 0;
+  let lineNum = 1;
+  let lastMatchIndex = -1;
+  const MAX_MATCHES = 500;
   while ((m = re.exec(content)) !== null) {
+    if (m.index === lastMatchIndex && m[0].length === 0) {
+      re.lastIndex++;
+      continue;
+    }
+    lastMatchIndex = m.index;
     if (isCommentLine(content, m.index)) continue;
     if (isInsideFixMessage(content, m.index)) continue;
-    const lineNum = content.substring(0, m.index).split("\n").length;
+    for (; scanned < m.index; scanned++) {
+      if (content.charCodeAt(scanned) === 10) lineNum++;
+    }
     matches.push({
       rule: rule.id,
       title: rule.title,
@@ -879,6 +926,7 @@ function findMatches(content, pattern, rule, filePath, fixTemplate) {
       snippet: getSnippet(content, lineNum),
       fix: fixTemplate?.(m)
     });
+    if (matches.length >= MAX_MATCHES) break;
   }
   return matches;
 }
@@ -894,10 +942,26 @@ function astMatch(content, filePath, line, rule, fix) {
     fix
   };
 }
+var parseCacheContent = null;
+var parseCachePath = null;
+var parseCacheResult = null;
+var parseCacheValid = false;
 function tryParse(content, filePath) {
-  const parsed = parseFile(content, filePath);
-  if (!parsed) return null;
-  return { parsed, taint: buildTaintMap(parsed) };
+  if (parseCacheValid && content === parseCacheContent && filePath === parseCachePath) {
+    return parseCacheResult;
+  }
+  let result = null;
+  try {
+    const parsed = parseFile(content, filePath);
+    result = parsed ? { parsed, taint: buildTaintMap(parsed) } : null;
+  } catch {
+    result = null;
+  }
+  parseCacheResult = result;
+  parseCacheContent = content;
+  parseCachePath = filePath;
+  parseCacheValid = true;
+  return result;
 }
 var hardcodedSecrets = {
   id: "VC001",
@@ -1265,7 +1329,7 @@ var xssVulnerability = {
     const hasSanitizerBypass = /bypassSecurityTrust(?:Html|Script|Style|Url|ResourceUrl)\s*\(/.test(content);
     if (/(?:sanitize|purify|escape|xss)/i.test(filePath)) return [];
     if (!hasSanitizerBypass && /DOMPurify\.sanitize|sanitizeHtml|xss\(|escapeHtml/i.test(content)) return [];
-    if (!hasSanitizerBypass && /(?:import|require)\s*\(?.*(?:DOMPurify|dompurify|sanitize|sanitizer)/i.test(content)) return [];
+    if (!hasSanitizerBypass && /(?:import|require)\s*\(?[^\n]{0,200}(?:DOMPurify|dompurify|sanitize|sanitizer)/i.test(content)) return [];
     const patterns = [
       // React dangerouslySetInnerHTML
       /dangerouslySetInnerHTML\s*=\s*\{\s*\{\s*__html\s*:/g,
@@ -1294,9 +1358,9 @@ var xssVulnerability = {
         () => "Sanitize user input before rendering as HTML. Use a library like DOMPurify: DOMPurify.sanitize(userInput). If this site is intentional (JSON-LD structured data, a const boot script, a sandboxed preview), add an inline `// VC007-OK: <reason>` comment above the line to silence."
       );
       for (const m of raw) {
-        const lineText = allLines[m.line - 1] || "";
+        const lineText = (allLines[m.line - 1] || "").slice(0, 4e3);
         if (/\.innerHTML\s*=\s*['"]/.test(lineText) && !/\$\{/.test(lineText)) continue;
-        if (/\.innerHTML\s*=\s*['"][^'"]*['"]\s*$/.test(lineText)) continue;
+        if (/\.innerHTML\s*=\s*['"][^'"]{0,2000}['"]\s*$/.test(lineText)) continue;
         if (/dangerouslySetInnerHTML/.test(lineText)) {
           const windowText = allLines.slice(m.line - 1, m.line + 2).join("\n");
           if (/JSON\.stringify/i.test(windowText)) continue;
@@ -1547,7 +1611,7 @@ var evalUsage = {
       /new\s+Function\s*\(\s*(?!["'`])/g
     ];
     const hasEvalInString = /["'`]eval(?:-source-map|["'`])/i.test(content);
-    if (hasEvalInString && !/\beval\s*\([^)]*(?:req\.|body\.|input|params|user|data)/i.test(content)) return [];
+    if (hasEvalInString && !/\beval\s*\([^)]{0,500}(?:req\.|body\.|input|params|user|data)/i.test(content)) return [];
     const matches = [];
     for (const p of patterns) {
       const rawMatches = findMatches(
@@ -1588,7 +1652,7 @@ var unvalidatedRedirect = {
       const isPureLiteral = /^["'`][^"'`]*["'`]$/.test(value);
       if (!hasInterpolation && isPureLiteral) continue;
       if (isInlineSilenced(content, m.index, "VC016")) continue;
-      const line = content.substring(0, m.index).split("\n").length;
+      const line = lineNumberAt(content, m.index);
       matches.push({
         rule: "VC016",
         title: unvalidatedRedirect.title,
@@ -1811,11 +1875,11 @@ var prototypePollution = {
     ];
     const hasValidation = /schema|validate|sanitize|whitelist|allowedKeys|pick\(|Object\.freeze|zod|yup|joi|ajv/i.test(content);
     if (!hasValidation) {
-      const hasUnsafeMerge = /Object\.assign\s*\([^)]*JSON\.parse|\.\.\.JSON\.parse|\{.*\.\.\.(?:stored|saved|cached|parsed|data)/i.test(content);
+      const hasUnsafeMerge = /Object\.assign\s*\([^)]{0,500}JSON\.parse|\.\.\.JSON\.parse|\{[^\n]{0,300}\.\.\.(?:stored|saved|cached|parsed|data)/i.test(content);
       if (hasUnsafeMerge) {
         matches.push(...findMatches(
           content,
-          /Object\.assign\s*\([^)]*JSON\.parse|\.\.\.JSON\.parse/g,
+          /Object\.assign\s*\([^)]{0,500}JSON\.parse|\.\.\.JSON\.parse/g,
           prototypePollution,
           filePath,
           () => "Validate parsed data against an expected schema before merging into objects. Use Object.freeze(), a validation library (Zod, Yup), or manually check for __proto__ and constructor keys."
@@ -3361,7 +3425,7 @@ var dangerousInnerHTML = {
       if (/^[A-Z][A-Z0-9_]+$/.test(value)) continue;
       if (/^["'`][^$]*["'`]$/.test(value)) continue;
       if (/JSON\.stringify/i.test(value)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC063",
         title: dangerousInnerHTML.title,
@@ -4103,7 +4167,7 @@ var missingSRI = {
     const re = new RegExp(scriptPattern.source, scriptPattern.flags);
     while ((m = re.exec(content)) !== null) {
       if (!m[0].includes("integrity")) {
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         matches.push({
           rule: "VC084",
           title: missingSRI.title,
@@ -4735,8 +4799,13 @@ var complianceMap = {
   // VC209–VC210: advisory heuristics
   VC209: { owasp: "A04:2021", cwe: "CWE-799" },
   // webhook missing idempotency
-  VC210: { owasp: "A01:2021", cwe: "CWE-862" }
+  VC210: { owasp: "A01:2021", cwe: "CWE-862" },
   // middleware matcher excludes /api
+  // VC211–VC212: hardcoded sensitive personal data (PII) in source
+  VC211: { owasp: "A02:2021", cwe: "CWE-540" },
+  // hardcoded credit card number
+  VC212: { owasp: "A02:2021", cwe: "CWE-540" }
+  // hardcoded US SSN
 };
 var consoleLogProduction = {
   id: "VC097",
@@ -4974,7 +5043,7 @@ var s3BucketNoEncryption = {
       const blockEnd = Math.min(m.index + 2e3, content.length);
       const blockContent = content.substring(m.index, blockEnd);
       if (!/server_side_encryption/.test(blockContent)) {
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         matches.push({
           rule: "VC107",
           title: s3BucketNoEncryption.title,
@@ -5005,7 +5074,7 @@ var securityGroupAllInbound = {
       while ((m = ingressPattern.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
         if (/from_port\s*=\s*0/.test(m[0]) || !/from_port/.test(m[0])) {
-          const lineNum = content.substring(0, m.index).split("\n").length;
+          const lineNum = lineNumberAt(content, m.index);
           matches.push({
             rule: "VC108",
             title: securityGroupAllInbound.title,
@@ -5092,7 +5161,7 @@ var lambdaWithoutVPC = {
       const blockEnd = Math.min(m.index + 2e3, content.length);
       const blockContent = content.substring(m.index, blockEnd);
       if (!/vpc_config\s*\{/.test(blockContent)) {
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         matches.push({
           rule: "VC111",
           title: lambdaWithoutVPC.title,
@@ -5122,7 +5191,7 @@ var dockerLatestTag = {
     while ((m = fromPattern.exec(content)) !== null) {
       const image = m[1];
       if (image.endsWith(":latest") || !image.includes(":") && !image.startsWith("$")) {
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         matches.push({
           rule: "VC112",
           title: dockerLatestTag.title,
@@ -5250,17 +5319,26 @@ var pathTraversal = {
     const findings = [];
     const patterns = [
       /(?:readFile|readFileSync|createReadStream|writeFile|writeFileSync|appendFile|unlink|unlinkSync|access|stat|statSync|existsSync)\s*\(\s*(?:req\.|request\.|ctx\.|params\.|query\.)/gi,
-      /(?:path\.join|path\.resolve)\s*\([^)]*(?:req\.|request\.|ctx\.|params\.|query\.)[^)]*\)/gi,
-      /(?:res\.sendFile|res\.download)\s*\([^)]*(?:req\.|request\.)/gi,
+      /(?:path\.join|path\.resolve)\s*\([^)]{0,500}(?:req\.|request\.|ctx\.|params\.|query\.)[^)]{0,500}\)/gi,
+      /(?:res\.sendFile|res\.download)\s*\([^)]{0,500}(?:req\.|request\.)/gi,
       /open\s*\(\s*(?:request\.|params\[|args\.)/gi
     ];
+    const MAX_MATCHES = 500;
     for (const pat of patterns) {
+      if (findings.length >= MAX_MATCHES) break;
       let m;
+      let lastIdx = -1;
       while ((m = pat.exec(content)) !== null) {
+        if (findings.length >= MAX_MATCHES) break;
+        if (m.index === lastIdx && m[0].length === 0) {
+          pat.lastIndex++;
+          continue;
+        }
+        lastIdx = m.index;
         if (isCommentLine(content, m.index)) continue;
         const surrounding = content.substring(Math.max(0, m.index - 200), m.index + 200);
         if (/path\.normalize|sanitize|\.replace\(\s*['"]\.\.|\.startsWith\s*\(|realpath/i.test(surrounding)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC117",
           title: pathTraversal.title,
@@ -5291,7 +5369,7 @@ var piiInLogs = {
     while ((m = logPattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
       if (isInsideFixMessage(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC118",
         title: piiInLogs.title,
@@ -5329,7 +5407,7 @@ var hardcodedOAuthSecret = {
       while ((m = pat.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
         if (/process\.env|os\.environ|ENV\[|getenv|\$\{|<your|CHANGE_ME|xxx|placeholder/i.test(m[0])) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC119",
           title: hardcodedOAuthSecret.title,
@@ -5361,7 +5439,7 @@ var missingOAuthState = {
       if (isCommentLine(content, m.index)) continue;
       const surrounding = content.substring(m.index, Math.min(content.length, m.index + 500));
       if (/state\s*[=:]/i.test(surrounding)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC120",
         title: missingOAuthState.title,
@@ -5389,7 +5467,7 @@ var unpinnedGitHubAction = {
     let m;
     while ((m = usesPattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC121",
         title: unpinnedGitHubAction.title,
@@ -5423,7 +5501,7 @@ var deprecatedTLS = {
       let m;
       while ((m = pat.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC122",
           title: deprecatedTLS.title,
@@ -5459,7 +5537,7 @@ var weakRSAKeySize = {
       let m;
       while ((m = pat.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC123",
           title: weakRSAKeySize.title,
@@ -5495,7 +5573,7 @@ var ecbModeEncryption = {
       let m;
       while ((m = pat.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC124",
           title: ecbModeEncryption.title,
@@ -5526,7 +5604,7 @@ var insecurePasswordReset = {
     let m;
     while ((m = weakTokens.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC125",
         title: insecurePasswordReset.title,
@@ -5543,7 +5621,7 @@ var insecurePasswordReset = {
       if (isCommentLine(content, m.index)) continue;
       const surrounding = content.substring(Math.max(0, m.index - 500), m.index);
       if (!/(?:reset|forgot).*password/i.test(surrounding)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC125",
         title: insecurePasswordReset.title,
@@ -5604,7 +5682,7 @@ var insecureHTTPMethods = {
         if (isCommentLine(content, m.index)) continue;
         const handlerBlock = content.substring(m.index, Math.min(content.length, m.index + 500));
         if (/auth|authenticate|authorize|requireAuth|isAuthenticated|protect|guard|middleware|session|jwt|verify|clerk|getAuth/i.test(handlerBlock)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC127",
           title: insecureHTTPMethods.title,
@@ -5638,7 +5716,7 @@ var httpRequestSmuggling = {
       let m;
       while ((m = pat.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC128",
           title: httpRequestSmuggling.title,
@@ -5672,7 +5750,7 @@ var unencryptedPII = {
       let m;
       while ((m = pat.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC129",
           title: unencryptedPII.title,
@@ -5704,7 +5782,7 @@ var missingAuthRateLimit = {
       if (isCommentLine(content, m.index)) continue;
       const surrounding = content.substring(Math.max(0, m.index - 300), Math.min(content.length, m.index + 300));
       if (/rateLimit|rateLimiter|throttle|slowDown|express-rate-limit|rate_limit|RateLimiter|limiter/i.test(surrounding)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC130",
         title: missingAuthRateLimit.title,
@@ -5742,7 +5820,7 @@ var vulnerableDependencies = {
     for (const [pat, message] of vulnerablePackages) {
       let m;
       while ((m = pat.exec(content)) !== null) {
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC131",
           title: vulnerableDependencies.title,
@@ -5774,7 +5852,7 @@ function secretRuleCheck(content, filePath, pattern, ruleId, title, severity, fi
     const lineStart = content.lastIndexOf("\n", m.index - 1) + 1;
     const lineText = content.substring(lineStart, content.indexOf("\n", m.index));
     if (PLACEHOLDER_RE.test(lineText)) continue;
-    const lineNum = content.substring(0, m.index).split("\n").length;
+    const lineNum = lineNumberAt(content, m.index);
     findings.push({
       rule: ruleId,
       title,
@@ -5875,7 +5953,7 @@ var hardcodedGCPServiceAccount = {
     const findings = [];
     const m = content.match(/"type"\s*:\s*"service_account"/);
     if (m && m.index !== void 0) {
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC136",
         title: this.title,
@@ -5981,7 +6059,7 @@ var hardcodedDatadogKey = {
       const lineStart = content.lastIndexOf("\n", m.index - 1) + 1;
       const lineText = content.substring(lineStart, content.indexOf("\n", m.index));
       if (PLACEHOLDER_RE.test(lineText)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC141",
         title: this.title,
@@ -6015,7 +6093,7 @@ var hardcodedVercelToken = {
       const lineStart = content.lastIndexOf("\n", m.index - 1) + 1;
       const lineText = content.substring(lineStart, content.indexOf("\n", m.index));
       if (PLACEHOLDER_RE.test(lineText)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC142",
         title: this.title,
@@ -6049,7 +6127,7 @@ var hardcodedSupabaseServiceRole = {
       const lineStart = content.lastIndexOf("\n", m.index - 1) + 1;
       const lineText = content.substring(lineStart, content.indexOf("\n", m.index));
       if (PLACEHOLDER_RE.test(lineText)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC143",
         title: this.title,
@@ -6113,7 +6191,7 @@ function contextSecretRuleCheck(content, filePath, pattern, ruleId, title, sever
     const lineStart = content.lastIndexOf("\n", m.index - 1) + 1;
     const lineText = content.substring(lineStart, content.indexOf("\n", m.index));
     if (PLACEHOLDER_RE.test(lineText)) continue;
-    const lineNum = content.substring(0, m.index).split("\n").length;
+    const lineNum = lineNumberAt(content, m.index);
     findings.push({
       rule: ruleId,
       title,
@@ -6593,7 +6671,7 @@ var ghaPullRequestTargetCheckout = {
     const checkoutPattern = /uses\s*:\s*actions\/checkout@[^\n]*[\s\S]{0,400}?ref\s*:\s*\$\{\{\s*github\.event\.pull_request\.head\.(?:ref|sha)\s*\}\}/g;
     let m;
     while ((m = checkoutPattern.exec(content)) !== null) {
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC184",
         title: ghaPullRequestTargetCheckout.title,
@@ -6677,7 +6755,7 @@ var ghaThirdPartyActionWithSecrets = {
     const pattern = /uses\s*:\s*(?!actions\/|github\/|aws-actions\/|azure\/|google-github-actions\/|hashicorp\/)([\w\-]+\/[\w\-./]+)@[^\n]*\n[\s\S]{0,800}?with\s*:[\s\S]{0,800}?\$\{\{\s*secrets\./g;
     let m;
     while ((m = pattern.exec(content)) !== null) {
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC187",
         title: ghaThirdPartyActionWithSecrets.title,
@@ -6842,7 +6920,7 @@ var pyRequestsVerifyFalse = {
     let m;
     while ((m = pattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC191",
         title: pyRequestsVerifyFalse.title,
@@ -6873,7 +6951,7 @@ var pyJinja2AutoescapeOff = {
     let m;
     while ((m = pattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC192",
         title: pyJinja2AutoescapeOff.title,
@@ -6902,7 +6980,7 @@ var pyTempfileMktemp = {
     let m;
     while ((m = pattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC193",
         title: pyTempfileMktemp.title,
@@ -6944,7 +7022,7 @@ var pyDjangoMarkSafe = {
       let m;
       while ((m = pattern.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         if (seenLines.has(lineNum)) continue;
         seenLines.add(lineNum);
         findings.push({
@@ -6981,7 +7059,7 @@ var pyParamikoAutoAdd = {
       let m;
       while ((m = pattern.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         if (seenLines.has(lineNum)) continue;
         seenLines.add(lineNum);
         findings.push({
@@ -7014,7 +7092,7 @@ var pyDjangoAllowedHostsWildcard = {
     let m;
     while ((m = pattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC196",
         title: pyDjangoAllowedHostsWildcard.title,
@@ -7052,7 +7130,7 @@ var pyJWTDecodeWeakConfig = {
         if (isCommentLine(content, m.index)) continue;
         const args = m[1];
         if (/\balgorithms\s*=/.test(args)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         if (seenLines.has(lineNum)) continue;
         seenLines.add(lineNum);
         findings.push({
@@ -7103,7 +7181,7 @@ var llmPromptInjection = {
       let m;
       while ((m = pattern.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         if (seenLines.has(lineNum)) continue;
         seenLines.add(lineNum);
         findings.push({
@@ -7142,7 +7220,7 @@ var llmSystemPromptInjection = {
       let m;
       while ((m = pattern.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC199",
           title: llmSystemPromptInjection.title,
@@ -7184,7 +7262,7 @@ var llmOutputAsHTML = {
       let m;
       while ((m = pattern.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         if (seenLines.has(lineNum)) continue;
         seenLines.add(lineNum);
         findings.push({
@@ -7221,7 +7299,7 @@ var vectorStoreQueryNoUserFilter = {
       if (/\b(?:user[_-]?id|userId|tenant[_-]?id|tenantId|org[_-]?id|orgId|owner[_-]?id|ownerId|account[_-]?id|customer[_-]?id|workspace[_-]?id)\b/i.test(args)) continue;
       if (/\bnamespace\s*[:=]\s*[`"']?[^,)`"']*(?:user|tenant|org|owner|account|customer|workspace)/i.test(args)) continue;
       if (/\bfilter\s*[:=][\s\S]*?(?:\buser|\btenant|\borg|\bowner|\baccount|\bcustomer|\bworkspace)/i.test(args)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC201",
         title: vectorStoreQueryNoUserFilter.title,
@@ -7258,7 +7336,7 @@ var vectorStoreUpsertNoMetadata = {
       if (/\bnamespace\s*[:=]\s*[`"']?[^,)`"']*(?:user|tenant|org)/i.test(args)) {
         continue;
       }
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC202",
         title: vectorStoreUpsertNoMetadata.title,
@@ -7312,7 +7390,7 @@ var llmCallNoMaxTokens = {
       if (depth !== 0) continue;
       const args = content.substring(openIdx + 1, i).replace(/\/\*[\s\S]*?\*\//g, "").replace(/\/\/[^\n]*/g, "").replace(/#[^\n]*/g, "");
       if (TOKEN_KW_RE.test(args)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC203",
         title: llmCallNoMaxTokens.title,
@@ -7352,7 +7430,7 @@ var graphqlNoDepthLimit = {
     let m;
     while ((m = anchorRe.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC204",
         title: graphqlNoDepthLimit.title,
@@ -7386,7 +7464,7 @@ var graphqlNoComplexityLimit = {
     let m;
     while ((m = anchorRe.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC205",
         title: graphqlNoComplexityLimit.title,
@@ -7416,7 +7494,7 @@ var graphqlCSRFDisabled = {
     let m;
     while ((m = pattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC206",
         title: graphqlCSRFDisabled.title,
@@ -7512,7 +7590,7 @@ var webhookMissingIdempotency = {
     if (/idempoten|event\.id|evt\.id|delivery_?id|alreadyProcessed|processedEvents|ON\s+CONFLICT|INSERT\s+OR\s+IGNORE|\bseen\b|\bprocessed\b/i.test(content)) return [];
     const m = content.match(/constructEvent|new\s+Webhook\s*\(|verifyHeader/i);
     if (!m || m.index === void 0) return [];
-    const line = content.substring(0, m.index).split("\n").length;
+    const line = lineNumberAt(content, m.index);
     return filterSilenced([{
       rule: "VC209",
       title: webhookMissingIdempotency.title,
@@ -7539,7 +7617,7 @@ var middlewareMatcherExcludesApi = {
     if (!/\(\?!\s*[^)]*\bapi\b/.test(content)) return [];
     const m = content.match(/matcher\s*:/);
     if (!m || m.index === void 0) return [];
-    const line = content.substring(0, m.index).split("\n").length;
+    const line = lineNumberAt(content, m.index);
     return filterSilenced([{
       rule: "VC210",
       title: middlewareMatcherExcludesApi.title,
@@ -7552,6 +7630,113 @@ var middlewareMatcherExcludesApi = {
     }], content, "VC210");
   }
 };
+function passesLuhn(digits) {
+  let sum = 0;
+  let alt = false;
+  for (let i = digits.length - 1; i >= 0; i--) {
+    let d = digits.charCodeAt(i) - 48;
+    if (d < 0 || d > 9) return false;
+    if (alt) {
+      d *= 2;
+      if (d > 9) d -= 9;
+    }
+    sum += d;
+    alt = !alt;
+  }
+  return sum % 10 === 0;
+}
+function looksLikeIssuerCard(d) {
+  if (/^4/.test(d) && (d.length === 13 || d.length === 16 || d.length === 19)) return true;
+  if (/^5[1-5]/.test(d) && d.length === 16) return true;
+  if (/^2(2[2-9]|[3-6]\d|7[01]|720)/.test(d) && d.length === 16) return true;
+  if (/^3[47]/.test(d) && d.length === 15) return true;
+  if (/^(6011|65|64[4-9])/.test(d) && d.length === 16) return true;
+  return false;
+}
+var TEST_CARD_NUMBERS = /* @__PURE__ */ new Set([
+  "4242424242424242",
+  "4111111111111111",
+  "4012888888881881",
+  "4000056655665556",
+  "4000000000000002",
+  "4000000000009995",
+  "5555555555554444",
+  "5200828282828210",
+  "5105105105105100",
+  "2223003122003222",
+  "378282246310005",
+  "371449635398431",
+  "6011111111111117",
+  "6011000990139424",
+  "3056930009020004",
+  "38520000023237"
+]);
+var hardcodedCreditCard = {
+  id: "VC211",
+  title: "Hardcoded credit card number",
+  severity: "high",
+  category: "Information Leakage",
+  description: "A literal credit card number (Luhn-valid, with a real issuer prefix, and not a known network test card) appears in source. Cardholder data does not belong in code \u2014 it lands in git history, logs, and backups, and is a PCI-DSS violation. Use your processor's published test cards for tests, and tokenize real cards.",
+  check(content, filePath) {
+    if (isTestFile(filePath)) return [];
+    const findings = [];
+    const pattern = /(?<![\d.])\d[\d -]{11,21}\d(?![\d.])/g;
+    let m;
+    while ((m = pattern.exec(content)) !== null) {
+      const digits = m[0].replace(/[ -]/g, "");
+      if (digits.length < 13 || digits.length > 19) continue;
+      if (TEST_CARD_NUMBERS.has(digits)) continue;
+      if (!looksLikeIssuerCard(digits)) continue;
+      if (!passesLuhn(digits)) continue;
+      if (isCommentLine(content, m.index)) continue;
+      const lineNum = lineNumberAt(content, m.index);
+      findings.push({
+        rule: "VC211",
+        title: hardcodedCreditCard.title,
+        severity: "high",
+        category: "Information Leakage",
+        file: filePath,
+        line: lineNum,
+        snippet: getSnippet(content, lineNum),
+        fix: "Never store a real card number in source. Tokenize through your payment processor (Stripe, Braintree) and keep only the returned token. For tests, use the processor's published test cards (e.g. Stripe's 4242 4242 4242 4242)."
+      });
+    }
+    return findings;
+  }
+};
+var hardcodedSSN = {
+  id: "VC212",
+  title: "Hardcoded US Social Security Number",
+  severity: "high",
+  category: "Information Leakage",
+  description: "A value in SSN format (NNN-NN-NNNN) is assigned to an SSN-named field in source. Social Security Numbers are regulated PII; a literal one leaks into git history, logs, and backups. Store SSNs encrypted at rest and load test data from generated fakes, never a code literal.",
+  check(content, filePath) {
+    if (isTestFile(filePath)) return [];
+    const findings = [];
+    const pattern = /(?:ssn|social[_-]?sec(?:urity)?(?:[_-]?(?:no|num|number))?|taxpayer[_-]?id)\b["']?\s*[:=]\s*["']?(\d{3}-\d{2}-\d{4})/gi;
+    let m;
+    while ((m = pattern.exec(content)) !== null) {
+      const ssn = m[1];
+      const [area, group, serial] = ssn.split("-");
+      if (area === "000" || area === "666" || Number(area) >= 900) continue;
+      if (group === "00" || serial === "0000") continue;
+      if (ssn === "123-45-6789") continue;
+      if (isCommentLine(content, m.index)) continue;
+      const lineNum = lineNumberAt(content, m.index);
+      findings.push({
+        rule: "VC212",
+        title: hardcodedSSN.title,
+        severity: "high",
+        category: "Information Leakage",
+        file: filePath,
+        line: lineNum,
+        snippet: getSnippet(content, lineNum),
+        fix: "Don't hardcode SSNs. Generate fake values for tests (a faker/factory), and store real SSNs with application-level encryption or in a secrets vault \u2014 never as a code literal."
+      });
+    }
+    return findings;
+  }
+};
 var secretInURLParam = {
   id: "VC146",
   title: "Secret Passed in URL Query Parameter",
@@ -7577,7 +7762,7 @@ var secretInURLParam = {
         if (isCommentLine(content, m.index)) continue;
         if (isInsideFixMessage(content, m.index)) continue;
         if (isInlineSilenced(content, m.index, "VC146")) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC146",
           title: this.title,
@@ -7608,7 +7793,7 @@ var secretLoggedToConsole = {
     while ((m = pattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
       if (isInsideFixMessage(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC147",
         title: this.title,
@@ -7638,7 +7823,7 @@ var secretInErrorResponse = {
     while ((m = pattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
       if (isInsideFixMessage(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC148",
         title: this.title,
@@ -7677,7 +7862,7 @@ var secretInBundleConfig = {
       while ((m = re.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
         if (isInsideFixMessage(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC149",
           title: this.title,
@@ -7715,7 +7900,7 @@ var secretInHTMLAttribute = {
       while ((m = re.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
         if (isInsideFixMessage(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC150",
           title: this.title,
@@ -7742,9 +7927,9 @@ var secretInCLIArgument = {
     if (!filePath.match(/\.(js|ts|jsx|tsx|py|rb)$/)) return [];
     const findings = [];
     const patterns = [
-      /(?:exec|execSync|spawn|spawnSync|child_process)\s*\([^)]*\$\{[^}]*(?:api[_-]?key|secret|token|password|credentials)/gi,
-      /(?:exec|execSync|spawn|spawnSync|child_process)\s*\([^)]*["']\s*\+\s*(?:api[_-]?key|secret|token|password|credentials)/gi,
-      /(?:subprocess|os\.system|os\.popen)\s*\([^)]*\{[^}]*(?:api[_-]?key|secret|token|password|credentials)/gi
+      /(?:exec|execSync|spawn|spawnSync|child_process)\s*\([^)]{0,500}\$\{[^}]{0,200}(?:api[_-]?key|secret|token|password|credentials)/gi,
+      /(?:exec|execSync|spawn|spawnSync|child_process)\s*\([^)]{0,500}["']\s*\+\s*(?:api[_-]?key|secret|token|password|credentials)/gi,
+      /(?:subprocess|os\.system|os\.popen)\s*\([^)]{0,500}\{[^}]{0,200}(?:api[_-]?key|secret|token|password|credentials)/gi
     ];
     for (const p of patterns) {
       let m;
@@ -7752,7 +7937,7 @@ var secretInCLIArgument = {
       while ((m = re.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
         if (isInsideFixMessage(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC151",
           title: this.title,
@@ -7798,7 +7983,7 @@ var webhookSignatureVerification = {
       if (svc.verify.test(content)) continue;
       const m = content.match(/export\s+(?:async\s+)?function\s+POST/);
       if (!m || m.index === void 0) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC152",
         title: `${svc.name} Webhook Missing Signature Verification`,
@@ -7865,7 +8050,7 @@ var missingRequestValidation = {
     if (/if\s*\(\s*!(?:body|parsed|data|payload)\.|throw.*(?:missing|invalid|required)/i.test(content)) return [];
     const m = content.match(/export\s+(?:async\s+)?function\s+(?:POST|PUT|PATCH)/);
     if (!m || m.index === void 0) return [];
-    const lineNum = content.substring(0, m.index).split("\n").length;
+    const lineNum = lineNumberAt(content, m.index);
     return [{
       rule: "VC154",
       title: this.title,
@@ -7892,7 +8077,7 @@ var missingAIRateLimit = {
     if (/rateLimit|rateLimiter|throttle|checkRateLimit|limiter|slowDown|express-rate-limit/i.test(content)) return [];
     const m = content.match(/export\s+(?:async\s+)?function\s+(?:POST|GET)/i) || content.match(/\.(post|get)\s*\(/i);
     if (!m || m.index === void 0) return [];
-    const lineNum = content.substring(0, m.index).split("\n").length;
+    const lineNum = lineNumberAt(content, m.index);
     return [{
       rule: "VC155",
       title: this.title,
@@ -7921,7 +8106,7 @@ var missingPagination = {
     if (/findUnique|findFirst|findById|\.findOne|WHERE.*id\s*=/i.test(content)) return [];
     const m = content.match(/export\s+(?:async\s+)?function\s+GET/);
     if (!m || m.index === void 0) return [];
-    const lineNum = content.substring(0, m.index).split("\n").length;
+    const lineNum = lineNumberAt(content, m.index);
     return [{
       rule: "VC156",
       title: this.title,
@@ -7982,7 +8167,7 @@ var insecureDirectObjectReference = {
     if (/requireUser|requireUserForApi|getServerSession|auth\(\)/i.test(content)) return [];
     const m = content.match(/params\.id|params\.(?:slug|uuid)|req\.params\./);
     if (!m || m.index === void 0) return [];
-    const lineNum = content.substring(0, m.index).split("\n").length;
+    const lineNum = lineNumberAt(content, m.index);
     return [{
       rule: "VC158",
       title: this.title,
@@ -8280,7 +8465,10 @@ var allCustomRules = [
   // VC204–VC206: GraphQL server hardening
   graphqlNoDepthLimit,
   graphqlNoComplexityLimit,
-  graphqlCSRFDisabled
+  graphqlCSRFDisabled,
+  // VC211–VC212: hardcoded sensitive personal data (PII)
+  hardcodedCreditCard,
+  hardcodedSSN
 ];
 function runCustomRules(content, filePath, disabledRules = [], tier = "free", extraRules = []) {
   const findings = [];
@@ -8288,6 +8476,17 @@ function runCustomRules(content, filePath, disabledRules = [], tier = "free", ex
     return findings;
   }
   if (/pro-rules-bundle|\.bundle\./i.test(filePath)) return findings;
+  let maxLineLen = 0;
+  {
+    let lineStart = 0;
+    for (let i = 0; i <= content.length; i++) {
+      if (i === content.length || content.charCodeAt(i) === 10) {
+        if (i - lineStart > maxLineLen) maxLineLen = i - lineStart;
+        lineStart = i + 1;
+      }
+    }
+  }
+  if (maxLineLen > 5e4) return findings;
   if (/onboarding|demo-data|example-vulnerable|code-sample/i.test(filePath)) return findings;
   const ruleset = tier === "pro" && extraRules.length > 0 ? [...freeRules, ...extraRules] : freeRules;
   for (const rule of ruleset) {
@@ -8697,6 +8896,7 @@ export {
   hardcodedAnthropicKey,
   hardcodedCloudflareToken,
   hardcodedCohereKey,
+  hardcodedCreditCard,
   hardcodedDatadogKey,
   hardcodedDiscordToken,
   hardcodedEncryptionKey,
@@ -8726,6 +8926,7 @@ export {
   hardcodedRailwayToken,
   hardcodedReplicateKey,
   hardcodedResendKey,
+  hardcodedSSN,
   hardcodedSecrets,
   hardcodedSendGridKey,
   hardcodedSentryAuthToken,