xploitscan-shared-rules 1.2.1 → 1.2.2

package/dist/index.js

@@ -10,11 +10,381 @@ function getSnippet(content, line, contextLines = 2) {
   }).join("\n");
 }
 
+// src/ast/parse.ts
+import { parse } from "@babel/parser";
+var MAX_CACHE = 256;
+var cache = /* @__PURE__ */ new Map();
+function cacheKey(filename, contentHash) {
+  return `${filename}:${contentHash}`;
+}
+function quickHash(s) {
+  let h = 5381;
+  const step = Math.max(1, Math.floor(s.length / 32));
+  for (let i = 0; i < s.length; i += step) {
+    h = (h << 5) + h + s.charCodeAt(i) | 0;
+  }
+  return h * 31 + s.length | 0;
+}
+function pickLanguage(filename) {
+  if (/\.tsx$/i.test(filename)) return "tsx";
+  if (/\.jsx$/i.test(filename)) return "jsx";
+  if (/\.(ts|cts|mts)$/i.test(filename)) return "ts";
+  if (/\.(js|cjs|mjs)$/i.test(filename)) return "js";
+  return null;
+}
+function parseFile(content, filename) {
+  const lang = pickLanguage(filename);
+  if (!lang) return null;
+  if (!content || content.length === 0) return null;
+  const key = cacheKey(filename, quickHash(content));
+  if (cache.has(key)) return cache.get(key) ?? null;
+  const plugins = [];
+  if (lang === "ts" || lang === "tsx") plugins.push("typescript");
+  if (lang === "jsx" || lang === "tsx") plugins.push("jsx");
+  plugins.push("decorators-legacy", "classProperties", "dynamicImport", "topLevelAwait");
+  let ast = null;
+  try {
+    ast = parse(content, {
+      sourceType: "unambiguous",
+      allowImportExportEverywhere: true,
+      allowReturnOutsideFunction: true,
+      allowAwaitOutsideFunction: true,
+      allowUndeclaredExports: true,
+      errorRecovery: true,
+      plugins
+    });
+  } catch {
+    cache.set(key, null);
+    if (cache.size > MAX_CACHE) {
+      const firstKey = cache.keys().next().value;
+      if (firstKey !== void 0) cache.delete(firstKey);
+    }
+    return null;
+  }
+  const entry = { ast, language: lang };
+  cache.set(key, entry);
+  if (cache.size > MAX_CACHE) {
+    const firstKey = cache.keys().next().value;
+    if (firstKey !== void 0) cache.delete(firstKey);
+  }
+  return entry;
+}
+
+// src/ast/taint.ts
+import _traverse from "@babel/traverse";
+var traverse = typeof _traverse === "function" ? _traverse : _traverse.default;
+var TAINTED_PROP_SUFFIXES = /* @__PURE__ */ new Set([
+  "body",
+  "query",
+  "params",
+  "headers",
+  "cookies",
+  "queryStringParameters",
+  "pathParameters",
+  "rawBody",
+  "searchParams"
+]);
+var TAINTED_REQUEST_OBJECTS = /* @__PURE__ */ new Set([
+  "req",
+  "request",
+  "ctx",
+  // Koa
+  "context",
+  // Koa alt
+  "event"
+  // Lambda
+]);
+function buildTaintMap(parsed) {
+  const tainted = /* @__PURE__ */ new Set();
+  function reachesRequestIdent(node) {
+    if (!node) return false;
+    if (node.type === "Identifier") return TAINTED_REQUEST_OBJECTS.has(node.name);
+    if (node.type === "MemberExpression") {
+      if (node.property.type === "Identifier" && node.property.name === "request" && node.object.type === "Identifier" && TAINTED_REQUEST_OBJECTS.has(node.object.name)) {
+        return true;
+      }
+      return reachesRequestIdent(node.object);
+    }
+    return false;
+  }
+  function nodeIsTaintedSource(node) {
+    if (!node) return false;
+    if (node.type === "MemberExpression") {
+      const prop = node.property;
+      const propName = prop.type === "Identifier" ? prop.name : prop.type === "StringLiteral" ? prop.value : "";
+      if (TAINTED_PROP_SUFFIXES.has(propName)) {
+        const obj = node.object;
+        if (obj.type === "Identifier" && TAINTED_REQUEST_OBJECTS.has(obj.name)) {
+          return true;
+        }
+        if (reachesRequestIdent(obj)) return true;
+        if (nodeIsTaintedSource(obj)) return true;
+      }
+      if (node.object.type === "Identifier" && node.object.name === "process" && prop.type === "Identifier" && prop.name === "argv") {
+        return true;
+      }
+      if (nodeIsTaintedSource(node.object)) return true;
+      return false;
+    }
+    if (node.type === "CallExpression") {
+      const callee = node.callee;
+      if (callee.type === "MemberExpression" && callee.property.type === "Identifier" && callee.property.name === "get" && nodeIsTaintedSource(callee.object)) {
+        return true;
+      }
+      const BODY_READERS = /* @__PURE__ */ new Set(["json", "formData", "text", "arrayBuffer", "blob"]);
+      if (callee.type === "MemberExpression" && callee.property.type === "Identifier" && BODY_READERS.has(callee.property.name)) {
+        const obj = callee.object;
+        if (obj.type === "Identifier" && TAINTED_REQUEST_OBJECTS.has(obj.name)) {
+          return true;
+        }
+        if (reachesRequestIdent(obj)) return true;
+      }
+    }
+    if (node.type === "AwaitExpression") {
+      return nodeIsTaintedSource(node.argument);
+    }
+    return false;
+  }
+  function exprIsTainted(node) {
+    if (!node) return false;
+    if (nodeIsTaintedSource(node)) return true;
+    if (node.type === "Identifier") return tainted.has(node.name);
+    if (node.type === "TemplateLiteral") {
+      return node.expressions.some((e) => exprIsTainted(e));
+    }
+    if (node.type === "BinaryExpression" && node.operator === "+") {
+      return exprIsTainted(node.left) || exprIsTainted(node.right);
+    }
+    if (node.type === "LogicalExpression" && (node.operator === "||" || node.operator === "??")) {
+      return exprIsTainted(node.left) || exprIsTainted(node.right);
+    }
+    if (node.type === "ConditionalExpression") {
+      return exprIsTainted(node.consequent) || exprIsTainted(node.alternate);
+    }
+    if (node.type === "MemberExpression") {
+      return exprIsTainted(node.object);
+    }
+    if (node.type === "CallExpression") {
+      if (nodeIsTaintedSource(node)) return true;
+      if (node.callee.type === "MemberExpression") {
+        if (exprIsTainted(node.callee.object)) return true;
+        const obj = node.callee.object;
+        const prop = node.callee.property;
+        if (prop.type === "Identifier" && obj.type === "Identifier" && obj.name === "path" && ["join", "resolve", "normalize", "format", "parse", "relative"].includes(prop.name)) {
+          return node.arguments.some((a) => a.type !== "SpreadElement" && exprIsTainted(a));
+        }
+        if (prop.type === "Identifier" && obj.type === "Identifier" && obj.name === "Buffer" && ["from", "concat", "alloc", "allocUnsafe"].includes(prop.name)) {
+          return node.arguments.some((a) => a.type !== "SpreadElement" && exprIsTainted(a));
+        }
+      }
+      if (node.callee.type === "Identifier") {
+        if (["String", "Number", "Boolean", "URL", "URLSearchParams"].includes(node.callee.name)) {
+          return node.arguments.some((a) => a.type !== "SpreadElement" && exprIsTainted(a));
+        }
+      }
+    }
+    if (node.type === "AwaitExpression") {
+      return exprIsTainted(node.argument);
+    }
+    return false;
+  }
+  traverse(parsed.ast, {
+    VariableDeclarator(path) {
+      const node = path.node;
+      if (node.type !== "VariableDeclarator") return;
+      const init = node.init;
+      if (!init) return;
+      if (node.id.type === "Identifier") {
+        if (exprIsTainted(init)) {
+          tainted.add(node.id.name);
+        }
+      }
+      if (node.id.type === "ObjectPattern") {
+        const isTainted2 = nodeIsTaintedSource(init) || init.type === "Identifier" && tainted.has(init.name);
+        if (isTainted2) {
+          for (const prop of node.id.properties) {
+            if (prop.type === "ObjectProperty") {
+              if (prop.value.type === "Identifier") tainted.add(prop.value.name);
+            } else if (prop.type === "RestElement") {
+              if (prop.argument.type === "Identifier") tainted.add(prop.argument.name);
+            }
+          }
+        }
+      }
+    },
+    AssignmentExpression(path) {
+      const node = path.node;
+      if (node.type !== "AssignmentExpression") return;
+      if (node.operator !== "=" && node.operator !== "||=" && node.operator !== "??=") return;
+      if (node.left.type !== "Identifier") return;
+      if (exprIsTainted(node.right)) {
+        tainted.add(node.left.name);
+      }
+    }
+  });
+  const isTainted = (node) => {
+    if (!node) return false;
+    if (node.type === "Identifier") return tainted.has(node.name);
+    if (nodeIsTaintedSource(node)) return true;
+    if (node.type === "TemplateLiteral") {
+      return node.expressions.some((e) => isTainted(e));
+    }
+    if (node.type === "BinaryExpression" && node.operator === "+") {
+      return isTainted(node.left) || isTainted(node.right);
+    }
+    if (node.type === "LogicalExpression" && (node.operator === "||" || node.operator === "??" || node.operator === "&&")) {
+      return isTainted(node.left) || isTainted(node.right);
+    }
+    if (node.type === "ConditionalExpression") {
+      return isTainted(node.consequent) || isTainted(node.alternate);
+    }
+    if (node.type === "AwaitExpression") {
+      return isTainted(node.argument);
+    }
+    if (node.type === "MemberExpression") {
+      return isTainted(node.object);
+    }
+    if (node.type === "CallExpression") {
+      if (node.callee.type === "MemberExpression") {
+        if (isTainted(node.callee.object)) return true;
+        const obj = node.callee.object;
+        const prop = node.callee.property;
+        if (prop.type === "Identifier" && obj.type === "Identifier" && obj.name === "path" && ["join", "resolve", "normalize", "format", "relative", "parse"].includes(prop.name)) {
+          return node.arguments.some((a) => a.type !== "SpreadElement" && isTainted(a));
+        }
+        if (prop.type === "Identifier" && obj.type === "Identifier" && obj.name === "Buffer" && ["from", "concat", "alloc", "allocUnsafe"].includes(prop.name)) {
+          return node.arguments.some((a) => a.type !== "SpreadElement" && isTainted(a));
+        }
+      }
+      if (node.callee.type === "Identifier") {
+        if (["String", "Number", "Boolean", "URL", "URLSearchParams"].includes(node.callee.name)) {
+          return node.arguments.some((a) => a.type !== "SpreadElement" && isTainted(a));
+        }
+      }
+    }
+    return false;
+  };
+  return {
+    isTainted,
+    isTaintedIdent: (name) => tainted.has(name),
+    taintedNames: () => Array.from(tainted)
+  };
+}
+
+// src/ast/traverse.ts
+import _traverse2 from "@babel/traverse";
+var traverse2 = typeof _traverse2 === "function" ? _traverse2 : _traverse2.default;
+function visitBinary(parsed, visit) {
+  traverse2(parsed.ast, {
+    BinaryExpression(path) {
+      const line = path.node.loc?.start.line ?? 1;
+      visit(path.node, line);
+    }
+  });
+}
+function visitCalls(parsed, matchCallee, visit) {
+  traverse2(parsed.ast, {
+    CallExpression(path) {
+      const node = path.node;
+      if (!matchCallee(node.callee)) return;
+      const line = node.loc?.start.line ?? 1;
+      visit(node, line);
+    }
+  });
+}
+function isCalleeNamed(callee, name) {
+  if (callee.type === "Identifier") return callee.name === name;
+  if (callee.type === "MemberExpression" && callee.property.type === "Identifier") {
+    return callee.property.name === name;
+  }
+  if (callee.type === "OptionalMemberExpression" && callee.property.type === "Identifier") {
+    return callee.property.name === name;
+  }
+  return false;
+}
+function isMethodCall(callee, objName, methodName) {
+  if (callee.type !== "MemberExpression" && callee.type !== "OptionalMemberExpression") {
+    return false;
+  }
+  if (callee.property.type !== "Identifier") return false;
+  if (callee.property.name !== methodName) return false;
+  if (callee.object.type !== "Identifier") return false;
+  return callee.object.name === objName;
+}
+function getObjectProperty(node, key) {
+  for (const prop of node.properties) {
+    if (prop.type === "ObjectProperty") {
+      if (prop.key.type === "Identifier" && prop.key.name === key) {
+        return { value: prop.value };
+      }
+      if (prop.key.type === "StringLiteral" && prop.key.value === key) {
+        return { value: prop.value };
+      }
+    }
+  }
+  return null;
+}
+function callSpreads(call, matcher) {
+  for (const arg of call.arguments) {
+    if (arg.type === "SpreadElement") {
+      if (matcher(arg.argument)) return true;
+    }
+    if (arg.type === "ObjectExpression") {
+      for (const prop of arg.properties) {
+        if (prop.type === "SpreadElement") {
+          if (matcher(prop.argument)) return true;
+        }
+      }
+    }
+  }
+  return false;
+}
+
 // src/rules.ts
 var TEST_FILE_PATTERN = /(?:\.test\.|\.spec\.|__tests__|__mocks__|\.stories\.|\.story\.|\/test\/|\/tests\/|\/fixtures?\/|\/mocks?\/|\.mock\.|test-utils|testing|\.cy\.|\.e2e\.)/i;
 function isTestFile(filePath) {
   return TEST_FILE_PATTERN.test(filePath);
 }
+var SERVER_SIDE_PATH_RE = new RegExp(
+  [
+    // Directory-style anchors — match with OR without leading slash so
+    // relative paths (`routes/users.js`) work as well as absolute.
+    "(?:^|/)api/",
+    "(?:^|/)routes?/",
+    "(?:^|/)controllers?/",
+    "(?:^|/)endpoints?/",
+    "(?:^|/)handlers?/",
+    "(?:^|/)middleware/",
+    "(?:^|/)webhooks?/",
+    "(?:^|/)services?/",
+    "(?:^|/)lambda/",
+    "(?:^|/)functions?/",
+    "(?:^|/)pages/api/",
+    "(?:^|/)app/.*/route\\.(?:m?[jt]sx?|cjs)$",
+    // Bare-filename anchors (with or without leading directory).
+    // Allows compound names like webhook-handler.js, cron-runner.js,
+    // user-service.ts via the optional (?:[-_]\w+)* suffix group.
+    "(?:^|/)(?:api|routes?|controllers?|endpoints?|handlers?|middleware|webhooks?|services?|server|app|index|main|lambda|function|ingest|runner|worker|resolvers?)(?:[-_]\\w+)*\\.(?:m?[jt]sx?|cjs|py|rb|go)$",
+    // Common functional names that imply request handling.
+    "(?:^|/)(?:auth|login|logout|signup|signin|register|password|reset|callback|oauth|admin|dashboard|profile|account|checkout|payment|webhook|audit|cron|search|upload|download|errors?|create-?\\w*|update-?\\w*|delete-?\\w*)(?:[-_]\\w+)*\\.(?:m?[jt]sx?|cjs|py|rb|go)$"
+  ].join("|"),
+  "i"
+);
+function isServerSideFile(filePath) {
+  if (isTestFile(filePath)) return false;
+  return SERVER_SIDE_PATH_RE.test(filePath);
+}
+var CONFIG_FILE_PATTERN = new RegExp(
+  [
+    "\\.config\\.(?:m?[jt]sx?|cjs)$",
+    "(?:^|/)config\\.(?:m?[jt]sx?|cjs|py|rb|json|ya?ml)$",
+    "(?:^|/)settings\\.(?:m?[jt]sx?|cjs|py)$",
+    "(?:^|/)\\.env(?:\\.|$)",
+    "(?:^|/)(?:knex|drizzle|next|vite|rollup|webpack|tailwind|postcss|jest|vitest|tsup|babel)\\.config\\.(?:m?[jt]sx?|cjs)$",
+    "(?:^|/)(?:db|database|connection|pool)\\.(?:config\\.)?(?:m?[jt]sx?|cjs|py|rb)$"
+  ].join("|"),
+  "i"
+);
 function isCommentLine(content, matchIndex) {
   const lineStart = content.lastIndexOf("\n", matchIndex - 1) + 1;
   const lineText = content.substring(lineStart, content.indexOf("\n", matchIndex)).trimStart();
@@ -23,7 +393,7 @@ function isCommentLine(content, matchIndex) {
 function isInsideFixMessage(content, matchIndex) {
   const lineStart = content.lastIndexOf("\n", matchIndex - 1) + 1;
   const lineText = content.substring(lineStart, content.indexOf("\n", matchIndex));
-  return /(?:fix|description|message|suggestion|hint|help|example|doc|comment)\s*[:=(]/i.test(lineText) || /return\s*["'`].*(?:Use|Replace|Add|Move|Set|Enable|Disable|Never|Don't|Do not|Instead)/i.test(lineText);
+  return /(?:fix|description|message|suggestion|hint|help|example|doc|comment)\s*[:=(]/i.test(lineText) || /return\s*["'`].*\b(?:Use|Replace|Add|Move|Set|Enable|Disable|Never|Don't|Do not|Instead)\b/i.test(lineText);
 }
 function findMatches(content, pattern, rule, filePath, fixTemplate) {
   const matches = [];
@@ -47,6 +417,23 @@ function findMatches(content, pattern, rule, filePath, fixTemplate) {
   }
   return matches;
 }
+function astMatch(content, filePath, line, rule, fix) {
+  return {
+    rule: rule.id,
+    title: rule.title,
+    severity: rule.severity,
+    category: rule.category,
+    file: filePath,
+    line,
+    snippet: getSnippet(content, line),
+    fix
+  };
+}
+function tryParse(content, filePath) {
+  const parsed = parseFile(content, filePath);
+  if (!parsed) return null;
+  return { parsed, taint: buildTaintMap(parsed) };
+}
 var hardcodedSecrets = {
   id: "VC001",
   title: "Hardcoded API Key or Secret",
@@ -70,6 +457,17 @@ var hardcodedSecrets = {
       /sk-[a-zA-Z0-9]{20,}T3BlbkFJ[a-zA-Z0-9]{20,}/g,
       // Generic tokens in assignments — require standalone word and longer min length
       /(?:^|[\s,({])(?:token|secret|password|passwd|pwd)\s*[:=]\s*["'`]([a-zA-Z0-9_\-!@#$%^&*]{20,})["'`]/gim,
+      // SCREAMING_CASE identifiers ending in SECRET/TOKEN/KEY/PASSWORD
+      // (OAUTH_CLIENT_SECRET, JWT_PRIVATE_KEY, STRIPE_WEBHOOK_SECRET, etc.)
+      // that are assigned a string literal, not an env var or function call.
+      /[A-Z][A-Z0-9_]*_(?:SECRET|TOKEN|KEY|PASSWORD|PASSWD)\s*[:=]\s*["'`]([a-zA-Z0-9_\-!@#$%^&*.\/]{12,})["'`]/g,
+      // camelCase / snake_case object properties that look like credentials:
+      // apiKey: "...", webhookUrl: "https://...", accountSid: "...", authToken: "..."
+      // password: "..." caught here separately with a lower threshold (many
+      // real passwords are 8-16 chars, below the 12-char floor of the
+      // generic `secret = "..."` pattern).
+      /\b(?:apiKey|api_key|authToken|auth_token|webhookUrl|webhook_url|accountSid|account_sid|clientSecret|client_secret|refreshToken|refresh_token)\s*:\s*["'`]([a-zA-Z0-9_\-!@#$%^&*.\/:\-]{12,})["'`]/gi,
+      /\b(?:password|passwd|pwd)\s*:\s*["'`]([a-zA-Z0-9_\-!@#$%^&*.\/:\-]{8,})["'`]/gi,
       // Private keys
       /-----BEGIN (?:RSA |EC |DSA )?PRIVATE KEY-----/g,
       // Database URLs with credentials
@@ -82,19 +480,49 @@ var hardcodedSecrets = {
       "Supabase key detected. Service role keys bypass Row Level Security and grant full database read/write access. Move to a server-side environment variable immediately.",
       "OpenAI API key detected \u2014 grants full API access and can incur charges. Rotate at platform.openai.com \u2192 API Keys.",
       "Hardcoded token or password detected. Move to an environment variable and rotate the credential if it has been committed to version control.",
+      "Named secret constant detected (XXX_SECRET / XXX_TOKEN / XXX_KEY). Move to an environment variable: `const NAME = process.env.NAME;`. Rotate the credential if this file has been committed to version control.",
+      "Credential assigned to a config object property. Move to an environment variable \u2014 `apiKey: process.env.API_KEY` \u2014 and rotate the value if this file has been committed.",
+      "Hardcoded password detected in a config object. Move to an environment variable (`password: process.env.DB_PASSWORD`) and rotate the password if this file has been committed.",
       "Private key found in source code. If this has been committed to version control, consider the key compromised \u2014 generate a new key pair and revoke the old one.",
       "Database credentials in connection string. An attacker with this URL has full database access. Move to an environment variable, restrict network access, and rotate the password."
     ];
+    const minLen = [
+      12,
+      // [0] generic API key
+      16,
+      // [1] AWS — already rigid in the regex, length floor is defensive
+      20,
+      // [2] Stripe
+      50,
+      // [3] Supabase JWT
+      40,
+      // [4] OpenAI
+      20,
+      // [5] generic tokens with {20,} in the regex
+      12,
+      // [6] SCREAMING_CASE named constants
+      12,
+      // [7] camelCase config props (apiKey/webhookUrl/etc.)
+      8,
+      // [8] password: "..." — lower floor per the pattern comment above
+      0,
+      // [9] private keys — no length check
+      0
+      // [10] DB URLs — no length check
+    ];
     const matches = [];
     for (let pi = 0; pi < patterns.length; pi++) {
       const pattern = patterns[pi];
       const rawMatches = findMatches(content, pattern, hardcodedSecrets, filePath, () => fixMessages[pi]);
+      const floor = minLen[pi] ?? 12;
       for (const rm of rawMatches) {
         const lineText = content.split("\n")[rm.line - 1] || "";
         const trimmed = lineText.trimStart();
         if (trimmed.startsWith("//") || trimmed.startsWith("#")) continue;
-        const secretMatch = lineText.match(/[:=]\s*["'`]([^"'`]*)["'`]/);
-        if (secretMatch && secretMatch[1].length < 12) continue;
+        if (floor > 0) {
+          const secretMatch = lineText.match(/[:=]\s*["'`]([^"'`]*)["'`]/);
+          if (secretMatch && secretMatch[1].length < floor) continue;
+        }
         matches.push(rm);
       }
     }
@@ -130,8 +558,7 @@ var missingAuthMiddleware = {
   category: "Authentication",
   description: "API routes without authentication checks allow unauthorized access.",
   check(content, filePath) {
-    const isApiRoute = /(?:\/api\/|routes?\/|controllers?\/|endpoints?\/)/.test(filePath) || filePath.includes("server.");
-    if (!isApiRoute) return [];
+    if (!isServerSideFile(filePath)) return [];
     const routePatterns = [
       // Express/Hono style
       /\.(get|post|put|patch|delete)\s*\(\s*["'`][^"'`]+["'`]\s*,\s*(?:async\s+)?\(?(?:req|c|ctx)/gi,
@@ -144,35 +571,36 @@ var missingAuthMiddleware = {
     if (isAuthRoute) return [];
     const isWebhookRoute = /\/webhook/i.test(filePath);
     if (isWebhookRoute) return [];
+    const codeOnly = content.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/.*$/gm, "$1").replace(/^\s*#.*$/gm, "");
     const authPatterns = [
-      /auth/i,
-      /session/i,
-      /jwt/i,
-      /bearer/i,
-      /middleware/i,
-      /getUser/i,
-      /currentUser/i,
-      /isAuthenticated/i,
-      /requireAuth/i,
-      /requireUser/i,
-      /requireUserForApi/i,
-      /clerk/i,
+      /\bgetUser\b/i,
+      /\bcurrentUser\b/i,
+      /\bisAuthenticated\b/i,
+      /\brequireAuth\b/i,
+      /\brequireUser\b/i,
+      /\brequireUserForApi\b/i,
+      /\bwithAuth\b/i,
+      /\bgetServerSession\b/i,
+      /\bgetToken\b/i,
+      /\bverifyToken\b/i,
+      /\bvalidateToken\b/i,
+      /\bcheckApiKey\b/i,
+      /\bverifyCronSecret\b/i,
+      /\bverifySecret\b/i,
       /supabase\.auth/i,
-      /getServerSession/i,
-      /getToken/i,
-      /protect/i,
-      /guard/i,
-      /verifyToken/i,
-      /validateToken/i,
-      /withAuth/i,
-      /passport/i,
       /firebase\.auth/i,
-      /cognito/i,
-      /verifyCronSecret/i,
-      /verifySecret/i,
-      /checkApiKey/i
+      /\bclerk\b/i,
+      /\bpassport\b/i,
+      /\bcognito\b/i,
+      /\bauth\(\)/i,
+      /req\.user\b/i,
+      /req\.session\.\w+/i,
+      /\bjwt\.verify\b/i,
+      /\bbearer\s/i,
+      /\b(?:protect|guard)\(/i,
+      /\.use\([^)]*(?:auth|session|protect|requireAuth)/i
     ];
-    const hasAuth = authPatterns.some((p) => p.test(content));
+    const hasAuth = authPatterns.some((p) => p.test(codeOnly));
     if (hasAuth) return [];
     const matches = [];
     for (const pattern of routePatterns) {
@@ -347,6 +775,37 @@ var xssVulnerability = {
         matches.push(m);
       }
     }
+    if (!/\.(?:send|end|write)\s*\(/.test(content) || !/\$\{/.test(content)) {
+      return matches;
+    }
+    const ctx = tryParse(content, filePath);
+    if (!ctx) return matches;
+    const { parsed, taint } = ctx;
+    visitCalls(
+      parsed,
+      (callee) => {
+        if (callee.type !== "MemberExpression") return false;
+        if (callee.property.type !== "Identifier") return false;
+        return ["send", "end", "write"].includes(callee.property.name);
+      },
+      (call, line) => {
+        const first = call.arguments[0];
+        if (!first || first.type !== "TemplateLiteral") return;
+        const literalParts = first.quasis.map((q) => q.value.raw).join("");
+        if (!/<\/?\w+/.test(literalParts)) return;
+        if (!taint.isTainted(first)) return;
+        if (matches.some((m) => m.line === line)) return;
+        matches.push(
+          astMatch(
+            content,
+            filePath,
+            line,
+            xssVulnerability,
+            "Never echo user-supplied HTML back to the browser unescaped. Sanitize with DOMPurify, use a templating engine that auto-escapes, or set `res.type('text/plain')` if you never intended HTML."
+          )
+        );
+      }
+    );
     return matches;
   }
 };
@@ -800,7 +1259,7 @@ var prototypePollution = {
   title: "Prototype Pollution Risk",
   severity: "high",
   category: "Injection",
-  description: "Parsing JSON from localStorage, URL params, or external sources and merging it into objects without validation can lead to prototype pollution, allowing attackers to inject __proto__ or constructor properties.",
+  description: "Deep-merging or Object.assign-ing attacker-controlled data (request bodies, parsed localStorage, query params) into a host object can pollute Object.prototype via keys like __proto__ and constructor.prototype.",
   check(content, filePath) {
     const matches = [];
     const storageParsePatterns = [
@@ -808,26 +1267,70 @@ var prototypePollution = {
       /JSON\.parse\s*\(\s*window\.localStorage/g
     ];
     const hasValidation = /schema|validate|sanitize|whitelist|allowedKeys|pick\(|Object\.freeze|zod|yup|joi|ajv/i.test(content);
-    if (hasValidation) return [];
-    const hasUnsafeMerge = /Object\.assign\s*\([^)]*JSON\.parse|\.\.\.JSON\.parse|\{.*\.\.\.(?:stored|saved|cached|parsed|data)/i.test(content);
-    if (hasUnsafeMerge) {
-      matches.push(...findMatches(
-        content,
-        /Object\.assign\s*\([^)]*JSON\.parse|\.\.\.JSON\.parse/g,
-        prototypePollution,
-        filePath,
-        () => "Validate parsed data against an expected schema before merging into objects. Use Object.freeze(), a validation library (Zod, Yup), or manually check for __proto__ and constructor keys."
-      ));
-    }
-    for (const p of storageParsePatterns) {
-      matches.push(...findMatches(
-        content,
-        p,
-        prototypePollution,
-        filePath,
-        () => "Validate localStorage data against an expected schema before using it. Malicious extensions or XSS can modify localStorage values."
-      ));
+    if (!hasValidation) {
+      const hasUnsafeMerge = /Object\.assign\s*\([^)]*JSON\.parse|\.\.\.JSON\.parse|\{.*\.\.\.(?:stored|saved|cached|parsed|data)/i.test(content);
+      if (hasUnsafeMerge) {
+        matches.push(...findMatches(
+          content,
+          /Object\.assign\s*\([^)]*JSON\.parse|\.\.\.JSON\.parse/g,
+          prototypePollution,
+          filePath,
+          () => "Validate parsed data against an expected schema before merging into objects. Use Object.freeze(), a validation library (Zod, Yup), or manually check for __proto__ and constructor keys."
+        ));
+      }
+      for (const p of storageParsePatterns) {
+        matches.push(...findMatches(
+          content,
+          p,
+          prototypePollution,
+          filePath,
+          () => "Validate localStorage data against an expected schema before using it. Malicious extensions or XSS can modify localStorage values."
+        ));
+      }
     }
+    if (!/\b(?:merge|assign|extend|defaults)\s*\(/.test(content)) return matches;
+    const ctx = tryParse(content, filePath);
+    if (!ctx) return matches;
+    const { parsed, taint } = ctx;
+    const ALL_ARG_SINKS = [
+      { obj: "_", method: "merge" },
+      { obj: "lodash", method: "merge" },
+      { method: "merge" },
+      // bare `merge(target, src)` from ESM import
+      { obj: "_", method: "defaultsDeep" },
+      { obj: "lodash", method: "defaultsDeep" },
+      { obj: "Object", method: "assign" },
+      { method: "extend" },
+      // jquery/underscore style
+      { obj: "$", method: "extend" }
+    ];
+    visitCalls(
+      parsed,
+      (callee) => {
+        for (const sink of ALL_ARG_SINKS) {
+          if (sink.obj && isMethodCall(callee, sink.obj, sink.method)) return true;
+          if (!sink.obj && isCalleeNamed(callee, sink.method)) return true;
+        }
+        return false;
+      },
+      (call, line) => {
+        const sources = call.arguments.slice(1);
+        const tainted = sources.some((arg) => {
+          if (arg.type === "SpreadElement") return taint.isTainted(arg.argument);
+          return taint.isTainted(arg);
+        });
+        if (!tainted) return;
+        matches.push(
+          astMatch(
+            content,
+            filePath,
+            line,
+            prototypePollution,
+            "Filter __proto__, constructor, and prototype keys before merging user-supplied data into an object. Prefer lodash.mergeWith() with a customizer that returns undefined for those keys, or validate the source with a schema library (Zod, Yup, Joi, Ajv) first."
+          )
+        );
+      }
+    );
     return matches;
   }
 };
@@ -860,13 +1363,13 @@ var unsanitizedFilenames = {
   description: "Using user-supplied filenames without sanitization in file operations can enable path traversal, overwriting system files, or executing commands via special characters.",
   check(content, filePath) {
     const matches = [];
+    const hasSanitization = /sanitize|cleanFilename|safeFilename|replace\s*\(\s*\/\[.*\]\/|\.startsWith\s*\(\s*(?:UPLOADS_DIR|\w+_DIR)/i.test(content);
+    if (hasSanitization) return [];
     const patterns = [
       /(?:writeFile|writeFileSync|createWriteStream|rename|copyFile)\s*\(\s*(?:`[^`]*\$\{|[^"'`\s,]+\s*\+)/g,
       /(?:dialog\.showSaveDialog|saveDialog).*(?:defaultPath|fileName)\s*:\s*(?!["'`])/g,
       /\.download\s*=\s*(?!["'`])/g
     ];
-    const hasSanitization = /sanitize|cleanFilename|safeFilename|replace\s*\(\s*\/\[.*\]\//i.test(content);
-    if (hasSanitization) return [];
     for (const p of patterns) {
       matches.push(...findMatches(
         content,
@@ -876,6 +1379,61 @@ var unsanitizedFilenames = {
         () => "Sanitize filenames before use: strip path separators (/ \\), special chars, and '..' sequences. Example: name.replace(/[^a-zA-Z0-9._-]/g, '_')"
       ));
     }
+    if (!/\b(?:fs|fsPromises)\.(?:readFile|writeFile|appendFile|readFileSync|writeFileSync|appendFileSync|createReadStream|createWriteStream|unlink|unlinkSync|stat|statSync|rm|rmSync|mkdir|mkdirSync)\s*\(/.test(content)) {
+      return matches;
+    }
+    const ctx = tryParse(content, filePath);
+    if (!ctx) return matches;
+    const { parsed, taint } = ctx;
+    const FS_SINKS = /* @__PURE__ */ new Set([
+      "readFile",
+      "writeFile",
+      "appendFile",
+      "readFileSync",
+      "writeFileSync",
+      "appendFileSync",
+      "createReadStream",
+      "createWriteStream",
+      "unlink",
+      "unlinkSync",
+      "rm",
+      "rmSync",
+      "stat",
+      "statSync",
+      "mkdir",
+      "mkdirSync"
+    ]);
+    const isFsReceiver = (obj) => {
+      if (obj.type === "Identifier") return obj.name === "fs" || obj.name === "fsPromises";
+      if (obj.type === "MemberExpression") {
+        return obj.object.type === "Identifier" && obj.object.name === "fs" && obj.property.type === "Identifier" && obj.property.name === "promises";
+      }
+      return false;
+    };
+    visitCalls(
+      parsed,
+      (callee) => {
+        if (callee.type !== "MemberExpression") return false;
+        if (callee.property.type !== "Identifier") return false;
+        if (!FS_SINKS.has(callee.property.name)) return false;
+        return isFsReceiver(callee.object);
+      },
+      (call, line) => {
+        const first = call.arguments[0];
+        if (!first || first.type === "SpreadElement") return;
+        if (!taint.isTainted(first)) return;
+        if (matches.some((m) => m.line === line)) return;
+        matches.push(
+          astMatch(
+            content,
+            filePath,
+            line,
+            unsanitizedFilenames,
+            "Resolve the path against a fixed base directory and verify it stays within that base before the fs call: `const target = path.resolve(BASE, req.body.name); if (!target.startsWith(BASE + path.sep)) throw new Error('path traversal');`"
+          )
+        );
+      }
+    );
     return matches;
   }
 };
@@ -1026,8 +1584,9 @@ var insecureDeserialization = {
       /unserialize\s*\(/g,
       // Ruby Marshal
       /Marshal\.load\s*\(/g,
-      // YAML unsafe load (Python)
-      /yaml\.load\s*\([^)]*(?!Loader\s*=\s*yaml\.SafeLoader)/g,
+      // YAML unsafe load (Python + js-yaml). Filtered below so safe schema
+      // arguments (SAFE_SCHEMA, FAILSAFE_SCHEMA, yaml.SafeLoader) don't FP.
+      /yaml\.load\s*\(/g,
       /yaml\.unsafe_load\s*\(/g,
       // Java ObjectInputStream
       /ObjectInputStream\s*\(/g,
@@ -1043,7 +1602,20 @@ var insecureDeserialization = {
         () => "Never deserialize untrusted data. Use JSON instead of pickle/Marshal/unserialize. For YAML, use yaml.safe_load(). Validate and sanitize all input before deserialization."
       ));
     }
-    return matches;
+    return matches.filter((m) => {
+      if (!/yaml\.load\s*\(/.test(m.snippet ?? "")) return true;
+      const lineText = (m.snippet ?? "").toLowerCase();
+      if (/safe_schema|failsafe_schema|safe_load|safeloader/.test(lineText)) {
+        return false;
+      }
+      const lineIdx = m.line - 1;
+      const lines = content.split("\n");
+      const ctx = lines.slice(lineIdx, lineIdx + 3).join("\n").toLowerCase();
+      if (/safe_schema|failsafe_schema|safe_load|safeloader/.test(ctx)) {
+        return false;
+      }
+      return true;
+    });
   }
 };
 var hardcodedJWTSecret = {
@@ -1121,7 +1693,12 @@ var exposedDebugMode = {
       /app\.debug\s*=\s*True/g,
       /app\.run\s*\([^)]*debug\s*=\s*True/g,
       // Source maps in production
-      /devtool\s*:\s*["'`](?:eval|cheap|source-map|inline-source-map)["'`]/g
+      /devtool\s*:\s*["'`](?:eval|cheap|source-map|inline-source-map)["'`]/g,
+      // Debug endpoints that leak environment / process internals in the
+      // response body. Very high-signal — a production service shouldn't
+      // serialize process.env or process.version to callers.
+      /res\.(?:json|send)\s*\([^)]*process\.(?:env|version|pid|arch|platform)/gi,
+      /(?:env|environment)\s*:\s*process\.env\b/gi
     ];
     for (const p of patterns) {
       matches.push(...findMatches(
@@ -1159,6 +1736,21 @@ var insecureRandomness = {
       if (nonSecurityVarNames.test(lineText)) continue;
       matches.push(rm);
     }
+    const SECURITY_FN_CONTEXT = /\b(?:function|def|async|const|let|var)\s+\w*(?:generate|create|make|new|mint|issue)[A-Z_]\w*(?:Token|Session|Nonce|Salt|Secret|Password|Otp|Csrf|Key|Code|Auth)\w*/i;
+    const SECURITY_IDENT_CONTEXT = /\b(?:session[_-]?token|csrf[_-]?token|reset[_-]?token|verify[_-]?code|otp[_-]?code|refresh[_-]?token|api[_-]?key)\b/i;
+    if (SECURITY_FN_CONTEXT.test(content) || SECURITY_IDENT_CONTEXT.test(content)) {
+      const raw = findMatches(
+        content,
+        /Math\.random\s*\(\s*\)/g,
+        insecureRandomness,
+        filePath,
+        () => "Math.random() is not cryptographically secure. Use crypto.randomBytes() (Node), crypto.getRandomValues() (browser), or crypto.randomUUID() for tokens, session IDs, salts, and similar values."
+      );
+      for (const m of raw) {
+        if (matches.some((existing) => existing.line === m.line)) continue;
+        matches.push(m);
+      }
+    }
     return matches;
   }
 };
@@ -1170,13 +1762,13 @@ var openRedirectParams = {
   description: "Redirect parameters like ?redirect_url=, ?return_to=, ?next= passed directly to redirects enable phishing attacks.",
   check(content, filePath) {
     const matches = [];
+    const codeOnly = content.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/.*$/gm, "$1");
+    const hasValidation = /allowed[_-]?(?:urls?|domains?|hosts?|paths?|routes?|list)|allow[_-]?list|valid[_-]?url|safe[_-]?domain|whitelist|startsWith.*https|new URL.*hostname/i.test(codeOnly);
+    if (hasValidation) return [];
     const patterns = [
-      // Reading redirect-like query params and using in redirect
       /(?:redirect_url|redirect_uri|return_to|return_url|next|callback_url|continue|goto|target|dest|destination|forward|redir)\s*(?:=|:)\s*(?:req\.query|req\.params|searchParams|query|params)\./gi,
       /redirect\s*\(\s*(?:req\.query|req\.params|searchParams\.get)\s*\(\s*["'`](?:redirect|return|next|callback|url|goto)/gi
     ];
-    const hasValidation = /allowedUrls|allowedDomains|allowedHosts|validUrl|safeDomain|whitelist|startsWith.*https|new URL.*hostname/i.test(content);
-    if (hasValidation) return [];
     for (const p of patterns) {
       matches.push(...findMatches(
         content,
@@ -1186,6 +1778,29 @@ var openRedirectParams = {
         () => "Validate redirect URLs against an allowlist of trusted domains. Use: const url = new URL(input); if (!ALLOWED_HOSTS.includes(url.hostname)) reject."
       ));
     }
+    if (!/\.redirect\s*\(/.test(content)) return matches;
+    const ctx = tryParse(content, filePath);
+    if (!ctx) return matches;
+    const { parsed, taint } = ctx;
+    visitCalls(
+      parsed,
+      (callee) => isCalleeNamed(callee, "redirect"),
+      (call, line) => {
+        const first = call.arguments[0];
+        if (!first || first.type === "SpreadElement") return;
+        if (!taint.isTainted(first)) return;
+        if (matches.some((m) => m.line === line)) return;
+        matches.push(
+          astMatch(
+            content,
+            filePath,
+            line,
+            openRedirectParams,
+            "Validate redirect targets against an allowlist before calling res.redirect(). `const ALLOWED = new Set(['/dashboard', '/settings']); if (!ALLOWED.has(next)) return res.redirect('/dashboard');`"
+          )
+        );
+      }
+    );
     return matches;
   }
 };
@@ -1228,8 +1843,7 @@ var exposedStackTraces = {
   category: "Information Leakage",
   description: "Returning error.stack or detailed error messages in API responses reveals internal code paths, file structure, and dependencies to attackers.",
   check(content, filePath) {
-    const isApiFile = /(?:\/api\/|routes?\/|controllers?\/|server\.|middleware)/i.test(filePath);
-    if (!isApiFile) return [];
+    if (!isServerSideFile(filePath)) return [];
     const matches = [];
     const patterns = [
       // Sending stack trace in response
@@ -1260,9 +1874,10 @@ var insecureFileUpload = {
   description: "File uploads validated only by extension (not MIME type or content) allow attackers to upload executable files disguised as images or documents.",
   check(content, filePath) {
     if (!/upload|multer|formidable|busboy|multipart/i.test(content)) return [];
+    const codeOnly = content.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/.*$/gm, "$1").replace(/^\s*#.*$/gm, "");
     const matches = [];
-    const hasExtCheck = /\.(?:endsWith|match|test)\s*\([^)]*(?:\.jpg|\.png|\.pdf|\.doc|ext)/i.test(content);
-    const hasMimeCheck = /mimetype|content-type|file\.type|mime|magic\.detect|file-type/i.test(content);
+    const hasExtCheck = /\.(?:endsWith|match|test)\s*\([^)]*(?:\.jpg|\.png|\.pdf|\.doc|ext)/i.test(codeOnly) || /\/\\\.\((?:\?:)?[a-z]{2,5}(?:\|[a-z]{2,5})+\)/i.test(codeOnly);
+    const hasMimeCheck = /\bmimetype\b|\bcontent-type\b|\bfile\.type\b|\bmime\.\w|\bmagic\.detect\b|\bfile-type\b|fileTypeFromBuffer/i.test(codeOnly);
     if (hasExtCheck && !hasMimeCheck) {
       matches.push(...findMatches(
         content,
@@ -1326,34 +1941,53 @@ var ssrfVulnerability = {
   category: "Injection",
   description: "Fetching URLs from user input without validation allows attackers to access internal services, cloud metadata endpoints (169.254.169.254), and private networks.",
   check(content, filePath) {
-    if (isTestFile(filePath)) return [];
-    const isServerFile = /(?:\/api\/|routes?\/|controllers?\/|server\.|handler|middleware)/i.test(filePath);
-    if (!isServerFile) return [];
+    if (!isServerSideFile(filePath)) return [];
     const matches = [];
-    const patterns = [
-      /(?:fetch|axios\.get|axios\.post|axios|got|request|http\.get|https\.get)\s*\(\s*(?:req\.(?:body|query|params))\./gi
-    ];
     const hasValidation = /allowedHosts|allowedDomains|allowedUrls|safeDomain|whitelist|urlValidator|new URL.*hostname.*includes|isAllowedUrl|validateUrl|isValidUrl/i.test(content);
     if (hasValidation) return [];
-    for (const p of patterns) {
-      const rawMatches = findMatches(
-        content,
-        p,
-        ssrfVulnerability,
-        filePath,
-        () => "Validate URLs against an allowlist before fetching. Block internal IPs: 127.0.0.1, 10.x, 172.16-31.x, 192.168.x, 169.254.169.254 (cloud metadata). Use: const url = new URL(input); if (!ALLOWED_HOSTS.includes(url.hostname)) throw new Error('Blocked');"
-      );
-      for (const rm of rawMatches) {
-        const lineText = content.split("\n")[rm.line - 1] || "";
-        const varMatch = lineText.match(/(?:fetch|axios\.\w+|got|request|https?\.get)\s*\(\s*(\w+)/);
-        if (varMatch) {
-          const varName = varMatch[1];
-          const constDef = new RegExp(`const\\s+${varName}\\s*=\\s*["'\`]https?://`, "i");
-          if (constDef.test(content)) continue;
+    const inlinePattern = /(?:fetch|axios\.get|axios\.post|axios|got|request|http\.get|https\.get)\s*\(\s*(?:req\.(?:body|query|params))\./gi;
+    matches.push(...findMatches(
+      content,
+      inlinePattern,
+      ssrfVulnerability,
+      filePath,
+      () => "Validate URLs against an allowlist before fetching. Block internal IPs: 127.0.0.1, 10.x, 172.16-31.x, 192.168.x, 169.254.169.254 (cloud metadata). Use: const url = new URL(input); if (!ALLOWED_HOSTS.includes(url.hostname)) throw new Error('Blocked');"
+    ));
+    if (!/\b(?:fetch|axios|got|request|http\.get|https\.get)\b/.test(content)) return matches;
+    const ctx = tryParse(content, filePath);
+    if (!ctx) return matches;
+    const { parsed, taint } = ctx;
+    const FETCH_CALLEES = /* @__PURE__ */ new Set(["fetch", "axios", "got", "request"]);
+    const FETCH_METHODS = /* @__PURE__ */ new Set(["get", "post", "put", "patch", "delete", "request"]);
+    visitCalls(
+      parsed,
+      (callee) => {
+        if (callee.type === "Identifier" && FETCH_CALLEES.has(callee.name)) return true;
+        if (callee.type === "MemberExpression" && callee.property.type === "Identifier") {
+          if (!FETCH_METHODS.has(callee.property.name)) return false;
+          const obj = callee.object;
+          if (obj.type === "Identifier") {
+            return obj.name === "axios" || obj.name === "got" || obj.name === "http" || obj.name === "https";
+          }
         }
-        matches.push(rm);
+        return false;
+      },
+      (call, line) => {
+        const first = call.arguments[0];
+        if (!first || first.type === "SpreadElement") return;
+        if (!taint.isTainted(first)) return;
+        if (matches.some((m) => m.line === line)) return;
+        matches.push(
+          astMatch(
+            content,
+            filePath,
+            line,
+            ssrfVulnerability,
+            "Validate URLs against an allowlist before fetching. Parse the URL, check the hostname against a static set, and block internal IPs (127.0.0.1, 10.x, 172.16-31.x, 192.168.x, 169.254.169.254)."
+          )
+        );
       }
-    }
+    );
     return matches;
   }
 };
@@ -1364,19 +1998,15 @@ var massAssignment = {
   category: "Authorization",
   description: "Spreading or assigning request body directly into database models allows attackers to set fields they shouldn't (e.g., isAdmin, role, verified).",
   check(content, filePath) {
-    const isApiFile = /(?:\/api\/|routes?\/|controllers?\/|server\.|handler)/i.test(filePath);
-    if (!isApiFile) return [];
+    if (!isServerSideFile(filePath)) return [];
+    const hasSanitization = /pick\(|omit\(|allowedFields|sanitize|whitelist|permit|strong_params/i.test(content);
+    if (hasSanitization) return [];
     const matches = [];
     const patterns = [
-      // Object.assign(model, req.body)
       /Object\.assign\s*\(\s*(?:user|account|profile|record|doc|model|entity)[^,]*,\s*(?:req\.body|body|input|data)\s*\)/gi,
-      // Spread req.body into create/update
       /(?:create|update|insert|save|findOneAndUpdate|updateOne|upsert)\s*\(\s*\{[^}]*\.\.\.(?:req\.body|body|input|data)/gi,
-      // Direct req.body into DB
       /(?:create|insert|save)\s*\(\s*(?:req\.body|body)\s*\)/gi
     ];
-    const hasSanitization = /pick\(|omit\(|allowedFields|sanitize|whitelist|permit|strong_params/i.test(content);
-    if (hasSanitization) return [];
     for (const p of patterns) {
       matches.push(...findMatches(
         content,
@@ -1386,6 +2016,61 @@ var massAssignment = {
         () => "Never pass req.body directly to database operations. Explicitly pick allowed fields: const { name, email } = req.body; await db.create({ name, email });"
       ));
     }
+    const ORM_METHOD_PREFIXES = [
+      "create",
+      "insert",
+      "save",
+      "update",
+      "upsert",
+      "patch",
+      "bulkCreate",
+      "bulkInsert",
+      "bulkUpsert",
+      "findOneAndUpdate",
+      "findByIdAndUpdate",
+      "findAndUpdate",
+      "build",
+      "merge",
+      "replace"
+    ];
+    const isOrmMethod = (name) => ORM_METHOD_PREFIXES.some((p) => name === p || name.startsWith(p));
+    if (!/\b(?:create|insert|save|update|upsert|patch|bulk|findOneAndUpdate|findByIdAndUpdate|findAndUpdate|build|merge|replace)\w*\s*\(/.test(content)) {
+      return matches;
+    }
+    const ctx = tryParse(content, filePath);
+    if (!ctx) return matches;
+    const { parsed, taint } = ctx;
+    visitCalls(
+      parsed,
+      (callee) => {
+        if (callee.type === "MemberExpression" && callee.property.type === "Identifier") {
+          return isOrmMethod(callee.property.name);
+        }
+        return false;
+      },
+      (call, line) => {
+        const tainted = call.arguments.some((arg) => {
+          if (arg.type === "SpreadElement") return taint.isTainted(arg.argument);
+          if (arg.type === "ObjectExpression") {
+            return arg.properties.some(
+              (p) => p.type === "SpreadElement" && taint.isTainted(p.argument)
+            );
+          }
+          return taint.isTainted(arg);
+        });
+        if (!tainted) return;
+        if (matches.some((m) => m.line === line)) return;
+        matches.push(
+          astMatch(
+            content,
+            filePath,
+            line,
+            massAssignment,
+            "Pick allowed fields explicitly instead of spreading the request body. `User.create({ email: req.body.email, name: req.body.name })` rather than `User.create({ ...req.body })`."
+          )
+        );
+      }
+    );
     return matches;
   }
 };
@@ -1398,12 +2083,12 @@ var timingAttack = {
   check(content, filePath) {
     if (isTestFile(filePath)) return [];
     const matches = [];
+    const hasTimingSafe = /timingSafeEqual|constantTimeEqual|safeCompare|secureCompare/i.test(content);
+    if (hasTimingSafe) return [];
     const patterns = [
       /(?:token|secret|hash|digest|signature|hmac|apiKey|api_key)\s*(?:===|!==)\s*(?:req\.|body\.|params\.|query\.|input)/gi,
       /(?:^|[^.\w])(?:req\.|body\.|params\.|query\.|input)[\w.]*(?:token|secret|hash|digest|signature|hmac)\s*(?:===|!==)/gim
     ];
-    const hasTimingSafe = /timingSafeEqual|constantTimeEqual|safeCompare|secureCompare/i.test(content);
-    if (hasTimingSafe) return [];
     for (const p of patterns) {
       const raw = findMatches(
         content,
@@ -1418,6 +2103,43 @@ var timingAttack = {
         matches.push(m);
       }
     }
+    if (!/===|!==/.test(content)) return matches;
+    const ctx = tryParse(content, filePath);
+    if (!ctx) return matches;
+    const SECRET_NAME_RE = /(?:secret|token|api[_-]?key|auth[_-]?key|jwt[_-]?secret|signature|hmac|password|passwd|pwd_hash|pwd_digest|digest)/i;
+    function looksLikeSecret(node) {
+      if (node.type === "Identifier") return SECRET_NAME_RE.test(node.name);
+      if (node.type === "MemberExpression") {
+        if (node.property.type === "Identifier" && SECRET_NAME_RE.test(node.property.name)) return true;
+        if (node.property.type === "StringLiteral" && SECRET_NAME_RE.test(node.property.value)) return true;
+        return looksLikeSecret(node.object);
+      }
+      return false;
+    }
+    visitBinary(ctx.parsed, (n, line) => {
+      if (n.operator !== "===" && n.operator !== "!==" && n.operator !== "==" && n.operator !== "!=") {
+        return;
+      }
+      if (n.left.type === "UnaryExpression" && n.left.operator === "typeof") return;
+      if (n.right.type === "UnaryExpression" && n.right.operator === "typeof") return;
+      const leftSecret = looksLikeSecret(n.left);
+      const rightSecret = looksLikeSecret(n.right);
+      if (!leftSecret && !rightSecret) return;
+      const otherSide = leftSecret ? n.right : n.left;
+      if (otherSide.type === "StringLiteral" || otherSide.type === "NumericLiteral" || otherSide.type === "NullLiteral" || otherSide.type === "BooleanLiteral") {
+        return;
+      }
+      if (matches.some((m) => m.line === line)) return;
+      matches.push(
+        astMatch(
+          content,
+          filePath,
+          line,
+          timingAttack,
+          "Compare secrets with crypto.timingSafeEqual() after a length check. === short-circuits on the first differing byte and leaks information via timing."
+        )
+      );
+    });
     return matches;
   }
 };
@@ -1428,16 +2150,14 @@ var logInjection = {
   category: "Injection",
   description: "Logging unsanitized user input allows attackers to forge log entries, inject malicious content, or exploit log aggregation systems via newlines and special characters.",
   check(content, filePath) {
-    if (filePath.includes("test") || filePath.includes("mock")) return [];
-    const isServerFile = /(?:\/api\/|routes?\/|controllers?\/|server\.|middleware|handler)/i.test(filePath);
-    if (!isServerFile) return [];
+    if (!isServerSideFile(filePath)) return [];
+    const hasSanitization = /replace\s*\(\s*\/\[?\\r\\n\]|sanitizeLog|stripNewlines|sanitizeForLog/i.test(content);
+    if (hasSanitization) return [];
     const matches = [];
     const patterns = [
       /console\.(?:log|warn|error|info)\s*\([^)]*(?:req\.body|req\.query|req\.params|req\.headers)\s*\)/gi,
       /(?:logger|log)\.(?:info|warn|error|debug)\s*\([^)]*(?:req\.body|req\.query|req\.params)\s*\)/gi
     ];
-    const hasSanitization = /sanitize|escape|JSON\.stringify|replace.*\\n/i.test(content);
-    if (hasSanitization) return [];
     for (const p of patterns) {
       matches.push(...findMatches(
         content,
@@ -1447,6 +2167,41 @@ var logInjection = {
         () => "Sanitize user input before logging: strip newlines and control characters. Use JSON.stringify() or a structured logger (e.g., pino, winston) that escapes values automatically."
       ));
     }
+    if (!/(?:console\.|logger\.|log\.)\s*\w+\s*\(/.test(content)) return matches;
+    const ctx = tryParse(content, filePath);
+    if (!ctx) return matches;
+    const { parsed, taint } = ctx;
+    const LOG_METHODS = /* @__PURE__ */ new Set(["log", "warn", "error", "info", "debug", "trace"]);
+    visitCalls(
+      parsed,
+      (callee) => {
+        if (callee.type !== "MemberExpression") return false;
+        if (callee.property.type !== "Identifier") return false;
+        if (!LOG_METHODS.has(callee.property.name)) return false;
+        const obj = callee.object;
+        if (obj.type === "Identifier") {
+          return obj.name === "console" || obj.name === "logger" || obj.name === "log";
+        }
+        return false;
+      },
+      (call, line) => {
+        const tainted = call.arguments.some((arg) => {
+          if (arg.type === "SpreadElement") return taint.isTainted(arg.argument);
+          return taint.isTainted(arg);
+        });
+        if (!tainted) return;
+        if (matches.some((m) => m.line === line)) return;
+        matches.push(
+          astMatch(
+            content,
+            filePath,
+            line,
+            logInjection,
+            "Strip newlines/control chars before embedding user input in a log line. `value.replace(/[\\r\\n]/g, ' ')` for quick fix; a structured logger escapes values automatically."
+          )
+        );
+      }
+    );
     return matches;
   }
 };
@@ -1459,7 +2214,33 @@ var weakPasswordRequirements = {
   check(content, filePath) {
     if (isTestFile(filePath)) return [];
     if (!/(?:password|passwd|pwd)/i.test(content)) return [];
-    if (!/(?:register|signup|sign.up|createUser|create.user|changePassword|resetPassword|set.password)/i.test(content) && !/(?:\/api\/|routes?\/|controllers?\/)/i.test(filePath)) return [];
+    const isPasswordContext = /(?:register|signup|sign.up|createUser|create.user|changePassword|resetPassword|set.password|validatePassword|validate.password|passwordPolicy|password.policy)/i.test(
+      content
+    ) || isServerSideFile(filePath);
+    const matches = [];
+    if (isPasswordContext) {
+      const weakThresholdPatterns = [
+        // password.length < 4, password.length < 6, etc.
+        /(?:password|pwd|passwd)\s*\.length\s*<\s*[1-7]\b/gi,
+        /(?:password|pwd|passwd)\s*\.length\s*<=\s*[0-6]\b/gi,
+        // password.length >= 4, password.length >= 6 (min length set too low)
+        /(?:password|pwd|passwd)\s*\.length\s*>=\s*[1-7]\b/gi,
+        /(?:password|pwd|passwd)\s*\.length\s*>\s*[0-6]\b/gi,
+        // Python: len(password) < 8 with a low threshold
+        /len\s*\(\s*(?:password|pwd|passwd)\s*\)\s*<\s*[1-7]\b/gi
+      ];
+      for (const p of weakThresholdPatterns) {
+        matches.push(...findMatches(
+          content,
+          p,
+          weakPasswordRequirements,
+          filePath,
+          () => "Minimum password length is too low. Require at least 8 characters with complexity (upper+lower+digit+symbol) or 12+ characters without complexity. OWASP ASVS L1 requires 8+; NIST 800-63B recommends 12+."
+        ));
+      }
+      if (matches.length > 0) return matches;
+    }
+    if (!isPasswordContext) return [];
     const hasValidation = /(?:password|pwd).*(?:\.length|minLength|minlength|min_length)\s*(?:>=?|<|>)\s*\d|(?:password|pwd).*(?:match|test|regex|pattern)|zxcvbn|password-validator|passwordStrength|isStrongPassword|joi\.|yup\.|zod\.|validate|schema/i.test(content);
     if (hasValidation) return [];
     const hasPasswordHandling = /(?:password|pwd)\s*[:=]\s*(?:req\.body|body|input|params|args)\./i.test(content);
@@ -1492,7 +2273,8 @@ var sessionFixation = {
     if (isTestFile(filePath)) return [];
     if (!/(?:login|signin|sign.in|authenticate)/i.test(content)) return [];
     if (!/session/i.test(content)) return [];
-    const hasRegenerate = /regenerate|destroy.*create|req\.session\.id\s*=|session\.regenerateId|rotateSession|clearCookies/i.test(content);
+    const codeOnly = content.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/.*$/gm, "$1");
+    const hasRegenerate = /regenerate|destroy.*create|req\.session\.id\s*=|session\.regenerateId|rotateSession|clearCookies/i.test(codeOnly);
     if (hasRegenerate) return [];
     const hasLogin = /(?:function\s+(?:login|signin|authenticate)|(?:login|signin|authenticate)\s*(?:=\s*(?:async\s*)?\(|:\s*(?:async\s*)?\())/i.test(content);
     if (!hasLogin) return [];
@@ -1515,7 +2297,8 @@ var missingBruteForce = {
     const isLoginFile = /(?:login|signin|sign.in|auth)/i.test(filePath) || /(?:login|signin|authenticate).*(?:post|handler|route)/i.test(content);
     if (!isLoginFile) return [];
     if (!/(?:password|credential)/i.test(content)) return [];
-    const hasBruteForce = /rate.?limit|throttle|lockout|maxAttempts|max_attempts|failedAttempts|loginAttempts|brute|express-brute|express-rate-limit|slowDown/i.test(content);
+    const codeOnly = content.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/.*$/gm, "$1").replace(/^\s*#.*$/gm, "");
+    const hasBruteForce = /rate.?limit|throttle|lockout|maxAttempts|max_attempts|failedAttempts|loginAttempts|express-brute|express-rate-limit|slowDown/i.test(codeOnly);
     if (hasBruteForce) return [];
     return findMatches(
       content,
@@ -1542,7 +2325,10 @@ var nosqlInjection = {
       // $where with user input
       /\$where\s*:\s*(?!["'`])/g,
       // Direct variable in query without sanitization
-      /\.(?:findOne|findById|deleteOne|updateOne|findOneAndUpdate)\s*\(\s*\{[^}]*:\s*(?:req\.(?:body|query|params))\./gi
+      /\.(?:findOne|findById|deleteOne|updateOne|findOneAndUpdate)\s*\(\s*\{[^}]*:\s*(?:req\.(?:body|query|params))\./gi,
+      // findOneAndUpdate / updateOne / deleteOne / find with req.body as
+      // the entire filter (attacker controls the filter shape).
+      /\.(?:findOne|findById|findOneAndUpdate|updateOne|deleteOne|deleteMany|updateMany|replaceOne|find)\s*\(\s*req\.body\s*[,)]/gi
     ];
     const hasSanitization = /sanitize|escape|mongo-sanitize|express-mongo-sanitize|validator|typeof.*===.*string/i.test(content);
     if (hasSanitization) return [];
@@ -1621,7 +2407,7 @@ var graphqlIntrospection = {
   category: "Information Leakage",
   description: "GraphQL introspection exposes your entire API schema, types, queries, and mutations to attackers, making it easy to find attack vectors.",
   check(content, filePath) {
-    if (!/graphql/i.test(content) && !/graphql/i.test(filePath)) return [];
+    if (!/graphql|apollo|ApolloServer|GraphQLServer|createYoga|buildSchema|makeExecutableSchema/i.test(content) && !/graphql|apollo/i.test(filePath)) return [];
     const matches = [];
     if (/introspection\s*:\s*true/i.test(content)) {
       matches.push(...findMatches(
@@ -1760,6 +2546,15 @@ var exposedSourceMaps = {
         () => "Set productionSourceMap: false to avoid exposing source code in production."
       ));
     }
+    if (/productionBrowserSourceMaps\s*:\s*true/i.test(content)) {
+      matches.push(...findMatches(
+        content,
+        /productionBrowserSourceMaps\s*:\s*true/gi,
+        exposedSourceMaps,
+        filePath,
+        () => "Set productionBrowserSourceMaps: false in next.config.js. If you need source maps for error tracking, upload them to your error tracker instead (e.g. Sentry upload-sourcemaps) rather than serving them publicly."
+      ));
+    }
     return matches;
   }
 };
@@ -1885,14 +2680,14 @@ var weakHashing = {
     if (filePath.includes("test") || filePath.includes("mock")) return [];
     if (/bcrypt|scrypt|argon2/i.test(content)) return [];
     const matches = [];
-    const patterns = [
+    const inlinePatterns = [
       /(?:md5|sha1|sha256|sha512)\s*\([^)]*(?:password|passwd|pwd)/gi,
       /createHash\s*\(\s*["'`](?:md5|sha1|sha256)["'`]\).*(?:password|passwd|pwd)/gi,
       /(?:password|passwd|pwd).*createHash\s*\(\s*["'`](?:md5|sha1|sha256)["'`]\)/gi,
       /hashlib\.(?:md5|sha1|sha256)\s*\([^)]*(?:password|passwd|pwd)/gi,
       /Digest::(?:MD5|SHA1|SHA256).*(?:password|passwd|pwd)/gi
     ];
-    for (const p of patterns) {
+    for (const p of inlinePatterns) {
       matches.push(...findMatches(
         content,
         p,
@@ -1901,6 +2696,27 @@ var weakHashing = {
         () => "Use bcrypt, scrypt, or argon2 for password hashing \u2014 they're intentionally slow. Example: const hash = await bcrypt.hash(password, 12);"
       ));
     }
+    const hasPasswordContext = /\b(?:hashPassword|hash_password|verify_password|verifyPassword|password_hash|password_hash_verify|password_hashing)\b/i.test(content) || /\b(?:function|def|async)\s+\w*(?:password|pwd)\w*/i.test(content) || /\bpassword\s*[:=]/i.test(content);
+    if (hasPasswordContext) {
+      const weakCallPatterns = [
+        /createHash\s*\(\s*["'`](?:md5|sha1|sha256)["'`]\s*\)/gi,
+        /hashlib\.(?:md5|sha1|sha256)\s*\(/gi,
+        /Digest::(?:MD5|SHA1|SHA256)\./gi
+      ];
+      for (const p of weakCallPatterns) {
+        const raw = findMatches(
+          content,
+          p,
+          weakHashing,
+          filePath,
+          () => "Use bcrypt, scrypt, or argon2 for password hashing. These algorithms are intentionally slow so brute-force attacks are infeasible."
+        );
+        for (const m of raw) {
+          if (matches.some((existing) => existing.line === m.line)) continue;
+          matches.push(m);
+        }
+      }
+    }
     return matches;
   }
 };
@@ -1983,7 +2799,8 @@ var dangerousInnerHTML = {
     if (!filePath.match(/\.(jsx|tsx)$/)) return [];
     if (isTestFile(filePath)) return [];
     if (!/dangerouslySetInnerHTML/i.test(content)) return [];
-    const hasSanitize = /DOMPurify|sanitize|purify|xss|sanitizeHtml|isomorphic-dompurify/i.test(content);
+    const codeOnly = content.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/.*$/gm, "$1").replace(/\{\s*\/\*[\s\S]*?\*\/\s*\}/g, "");
+    const hasSanitize = /\b(?:DOMPurify|sanitizeHtml|sanitize-html|isomorphic-dompurify)\b|\b(?:sanitize|purify|xss)\s*\(/i.test(codeOnly);
     if (hasSanitize) return [];
     const findings = [];
     const re = /dangerouslySetInnerHTML\s*=\s*\{\s*\{\s*__html\s*:\s*([^}]+)\}/g;
@@ -2271,7 +3088,8 @@ var missingCSRF = {
         () => "Remove @csrf_exempt and use proper CSRF tokens. For APIs, use token-based auth (JWT) instead of session cookies."
       ));
     }
-    if (/MIDDLEWARE.*=.*\[/s.test(content) && !/CsrfViewMiddleware/i.test(content) && /django/i.test(content)) {
+    const pythonCodeOnly = content.replace(/^\s*#.*$/gm, "");
+    if (/MIDDLEWARE.*=.*\[/s.test(pythonCodeOnly) && !/CsrfViewMiddleware/i.test(pythonCodeOnly) && /django/i.test(content)) {
       matches.push(...findMatches(
         content,
         /MIDDLEWARE\s*=/g,
@@ -2290,20 +3108,47 @@ var githubActionsInjection = {
   category: "Injection",
   description: "Using ${{ github.event.* }} directly in 'run:' steps allows attackers to inject shell commands via PR titles, issue bodies, or branch names.",
   check(content, filePath) {
-    if (!filePath.match(/\.github\/workflows\/.*\.(yml|yaml)$/i)) return [];
+    const isWorkflowPath = /\.github\/workflows\/.*\.(ya?ml)$/i.test(filePath);
+    const looksLikeWorkflow = /\.(ya?ml)$/i.test(filePath) && /^\s*on\s*:/m.test(content) && /^\s*jobs\s*:/m.test(content);
+    if (!isWorkflowPath && !looksLikeWorkflow) return [];
     const matches = [];
     const patterns = [
       /run:.*\$\{\{\s*github\.event\.(?:issue|pull_request|comment|review|head_commit)\.(?:title|body|message)/gi,
-      /run:.*\$\{\{\s*github\.event\.(?:inputs|head_ref|base_ref)/gi
+      /run:.*\$\{\{\s*github\.event\.(?:inputs|head_ref|base_ref)/gi,
+      // Literal-block `run: |` with user-controllable interpolation on the
+      // SAME line or a following indented line. Anchored to `run:` (either
+      // on the same line or within the prior few lines before the
+      // interpolation) so `env: TITLE: ${{ github.event.issue.title }}` —
+      // the recommended-fix shape — doesn't false-positive.
+      /(?:^\s*(?:-\s+)?run:\s*\|?\s*\n(?:(?!^\s*(?:[-]\s*)?(?:env|with|id|name|if|timeout-minutes|continue-on-error|shell|working-directory|uses):).+\n){0,20}\s*.*)?\$\{\{\s*github\.event\.(?:issue|pull_request|comment|review|head_commit)\.(?:title|body|message|name)/gmi
     ];
+    const lines = content.split("\n");
+    const isEnvMappingLine = (lineNum) => {
+      const lineText = lines[lineNum - 1] ?? "";
+      if (/^\s*env\s*:/.test(lineText)) return true;
+      const indent = lineText.match(/^(\s*)/)?.[1]?.length ?? 0;
+      if (indent === 0) return false;
+      for (let i = lineNum - 2; i >= 0; i--) {
+        const prev = lines[i] ?? "";
+        if (!prev.trim()) continue;
+        const prevIndent = prev.match(/^(\s*)/)?.[1]?.length ?? 0;
+        if (prevIndent < indent) {
+          return /^\s*env\s*:/.test(prev);
+        }
+      }
+      return false;
+    };
     for (const p of patterns) {
-      matches.push(...findMatches(
+      for (const m of findMatches(
         content,
         p,
         githubActionsInjection,
         filePath,
         () => "Never use ${{ github.event.* }} directly in 'run:'. Pass it as an environment variable: env: TITLE: ${{ github.event.issue.title }} then use $TITLE in the script."
-      ));
+      )) {
+        if (isEnvMappingLine(m.line)) continue;
+        matches.push(m);
+      }
     }
     return matches;
   }
@@ -2351,6 +3196,15 @@ var corsServerless = {
         () => "Replace wildcard CORS with specific origins: allowOrigin: ['https://yourdomain.com']. Wildcard allows any site to call your API."
       ));
     }
+    if (/^\s*origin\s*:\s*['"]\*['"]/m.test(content)) {
+      matches.push(...findMatches(
+        content,
+        /^\s*origin\s*:\s*['"]\*['"]/gim,
+        corsServerless,
+        filePath,
+        () => "Replace the wildcard origin with a concrete allowlist: `origin: https://yourdomain.com` (or an array). Combined with `allowCredentials: true`, wildcard CORS is rejected by the browser; combined with auth headers, it's a data-exfiltration surface."
+      ));
+    }
     return matches;
   }
 };
@@ -2512,27 +3366,55 @@ var xxeVulnerability = {
   category: "Injection",
   description: "XML parsers that process external entities allow attackers to read files, perform SSRF, or cause DoS via billion-laughs attacks.",
   check(content, filePath) {
-    if (!/xml|parseXML|DOMParser|SAXParser|etree|lxml/i.test(content)) return [];
+    if (!/xml|parseXml|parseXML|DOMParser|SAXParser|etree|lxml|libxml/i.test(content)) return [];
     const matches = [];
     const patterns = [
-      /\.parseXML\s*\(/g,
+      /\.parseXm?l\s*\(/gi,
+      // catches parseXml (libxmljs) AND parseXML
       /new\s+DOMParser\s*\(\)/g,
       /etree\.parse\s*\(/g,
       /lxml\.etree/g,
       /SAXParserFactory/g,
       /XMLReaderFactory/g
     ];
-    const hasProtection = /noent.*false|resolveExternals.*false|FEATURE_EXTERNAL.*false|defusedxml|disallow-doctype-decl/i.test(content);
-    if (hasProtection) return [];
-    for (const p of patterns) {
-      matches.push(...findMatches(
-        content,
-        p,
-        xxeVulnerability,
-        filePath,
-        () => "Disable external entities: set noent: false, or use defusedxml (Python). For Java: factory.setFeature('http://apache.org/xml/features/disallow-doctype-decl', true)."
-      ));
+    const hasProtection = /noent\s*:\s*false|resolveExternals\s*:\s*false|FEATURE_EXTERNAL.*false|defusedxml|disallow-doctype-decl|nonet\s*:\s*true/i.test(content);
+    if (!hasProtection) {
+      for (const p of patterns) {
+        matches.push(...findMatches(
+          content,
+          p,
+          xxeVulnerability,
+          filePath,
+          () => "Disable external entities: set noent: false + dtdload: false + nonet: true (libxmljs), or use defusedxml (Python), or factory.setFeature('http://apache.org/xml/features/disallow-doctype-decl', true) (Java)."
+        ));
+      }
     }
+    if (!/parseXml\s*\(/.test(content)) return matches;
+    const ctx = tryParse(content, filePath);
+    if (!ctx) return matches;
+    visitCalls(
+      ctx.parsed,
+      (callee) => isCalleeNamed(callee, "parseXml") || isCalleeNamed(callee, "parseXML"),
+      (call, line) => {
+        const opts = call.arguments[1];
+        if (!opts || opts.type !== "ObjectExpression") return;
+        const noent = getObjectProperty(opts, "noent");
+        const dtdload = getObjectProperty(opts, "dtdload");
+        const external = getObjectProperty(opts, "resolveExternals");
+        const dangerous = noent?.value.type === "BooleanLiteral" && noent.value.value === true || dtdload?.value.type === "BooleanLiteral" && dtdload.value.value === true || external?.value.type === "BooleanLiteral" && external.value.value === true;
+        if (!dangerous) return;
+        if (matches.some((m) => m.line === line)) return;
+        matches.push(
+          astMatch(
+            content,
+            filePath,
+            line,
+            xxeVulnerability,
+            "Set noent: false, dtdload: false, and nonet: true on the parser options to disable external-entity resolution."
+          )
+        );
+      }
+    );
     return matches;
   }
 };
@@ -2561,6 +3443,46 @@ var ssti = {
         () => "Never render templates from user input. Use pre-defined templates and pass data as context variables: render_template('template.html', data=user_data)."
       ));
     }
+    if (!/(?:\.compile|\.render|renderString|render_template_string)\s*\(/.test(content)) {
+      return matches;
+    }
+    const ctx = tryParse(content, filePath);
+    if (!ctx) return matches;
+    const { parsed, taint } = ctx;
+    const SSTI_METHODS = /* @__PURE__ */ new Set([
+      "compile",
+      // Handlebars.compile, pug.compile, _.template (returns a function)
+      "render",
+      // ejs.render, engine.render, mustache.render
+      "renderString",
+      // nunjucks.renderString
+      "render_template_string"
+    ]);
+    visitCalls(
+      parsed,
+      (callee) => {
+        if (callee.type === "Identifier" && SSTI_METHODS.has(callee.name)) return true;
+        if (callee.type === "MemberExpression" && callee.property.type === "Identifier") {
+          return SSTI_METHODS.has(callee.property.name);
+        }
+        return false;
+      },
+      (call, line) => {
+        const first = call.arguments[0];
+        if (!first || first.type === "SpreadElement") return;
+        if (!taint.isTainted(first)) return;
+        if (matches.some((m) => m.line === line)) return;
+        matches.push(
+          astMatch(
+            content,
+            filePath,
+            line,
+            ssti,
+            "Compile templates from a trusted, static source (a file path or a constant string). Pass user data only as context values."
+          )
+        );
+      }
+    );
     return matches;
   }
 };
@@ -2630,7 +3552,7 @@ var exposedAdminRoutes = {
   category: "Information Leakage",
   description: "Routes like /admin, /debug, /phpinfo, or /actuator without authentication expose sensitive controls and information to attackers.",
   check(content, filePath) {
-    if (!/(?:\/api\/|routes?\/|server\.|app\.|index\.[jt]s)/i.test(filePath)) return [];
+    if (!isServerSideFile(filePath)) return [];
     const matches = [];
     const patterns = [
       /[.'"]\s*(?:get|use|all)\s*\(\s*["'`]\/(?:admin|debug|_debug|__debug__|phpinfo|actuator|graphiql|playground|swagger|reset|seed|test|dev|mock)["'`]/gi
@@ -2697,9 +3619,10 @@ var sensitiveURLParams = {
     if (isTestFile(filePath)) return [];
     const matches = [];
     const patterns = [
-      // Actual code building URLs with sensitive params (template literals or concat)
-      /[&?](?:password|secret|api_key|apiKey|access_token|ssn|credit_card)\s*=\s*\$\{/gi,
-      /[&?](?:password|secret|api_key|apiKey|access_token)\s*=["']\s*\+/gi
+      // Template literals embedding sensitive values in URL query strings
+      /[?&](?:password|passwd|pwd|secret|api[_-]?key|access[_-]?token|refresh[_-]?token|auth[_-]?token|session(?:[_-]?id)?|token|jwt|ssn|credit[_-]?card)\s*=\s*\$\{/gi,
+      // String concat building the same
+      /[?&](?:password|passwd|pwd|secret|api[_-]?key|access[_-]?token|refresh[_-]?token|auth[_-]?token|session(?:[_-]?id)?|token|jwt|ssn|credit[_-]?card)\s*=["']\s*\+/gi
     ];
     for (const p of patterns) {
       matches.push(...findMatches(
@@ -2721,7 +3644,7 @@ var missingContentDisposition = {
   description: "File download endpoints without Content-Disposition headers may render files inline, leading to XSS if the file contains HTML/JS.",
   check(content, filePath) {
     if (!/(?:download|sendFile|send_file|pipe|createReadStream)/i.test(content)) return [];
-    if (!/(?:\/api\/|routes?\/|controllers?\/|server\.|handler)/i.test(filePath)) return [];
+    if (!isServerSideFile(filePath)) return [];
     if (/Content-Disposition|attachment|download/i.test(content)) return [];
     return findMatches(
       content,
@@ -2763,9 +3686,13 @@ var raceCondition = {
     if (filePath.includes("test") || filePath.includes("mock")) return [];
     const matches = [];
     const patterns = [
-      /(?:existsSync|exists)\s*\([^)]+\)[\s\S]{0,50}(?:writeFileSync|writeFile|unlinkSync|unlink|renameSync)\s*\(/g,
-      /os\.path\.exists\s*\([^)]+\)[\s\S]{0,50}open\s*\(/g,
-      /File\.exists\?\s*\([^)]+\)[\s\S]{0,50}File\.(?:write|delete)/g
+      // Check-then-act with writes / deletes / renames
+      /(?:existsSync|exists)\s*\([^)]+\)[\s\S]{0,80}(?:writeFileSync|writeFile|unlinkSync|unlink|renameSync|rename)\s*\(/g,
+      // Check-then-read — also vulnerable: an attacker can swap the symlink
+      // between the exists/stat call and the read.
+      /(?:existsSync|statSync)\s*\([^)]+\)[\s\S]{0,80}(?:readFileSync|readFile|createReadStream)\s*\(/g,
+      /os\.path\.exists\s*\([^)]+\)[\s\S]{0,80}open\s*\(/g,
+      /File\.exists\?\s*\([^)]+\)[\s\S]{0,80}File\.(?:write|delete|read)/g
     ];
     for (const p of patterns) {
       matches.push(...findMatches(
@@ -2814,7 +3741,7 @@ var unprotectedDownload = {
   description: "File download endpoints that accept user-controlled filenames without path validation allow directory traversal to read arbitrary files.",
   check(content, filePath) {
     if (!/(?:download|sendFile|send_file)/i.test(content)) return [];
-    if (!/(?:\/api\/|routes?\/|controllers?\/|server\.|handler)/i.test(filePath)) return [];
+    if (!isServerSideFile(filePath)) return [];
     const matches = [];
     if (/(?:sendFile|download|send_file)\s*\([^)]*(?:req\.|params\.|query\.|body\.)/i.test(content)) {
       const hasValidation = /path\.resolve|path\.normalize|path\.join.*__dirname|realpath|includes\s*\(\s*["']\.\./i.test(content);
@@ -5409,7 +6336,9 @@ export {
   allRules,
   androidDebuggable,
   blockingMainThread,
+  buildTaintMap,
   calculateGrade,
+  callSpreads,
   callbackHell,
   clickjacking,
   clientComponentSecret,
@@ -5450,6 +6379,7 @@ export {
   firebaseClientConfig,
   flaskSecretKey,
   freeRules,
+  getObjectProperty,
   getSnippet,
   githubActionsInjection,
   graphqlIntrospection,
@@ -5486,6 +6416,8 @@ export {
   insecureRandomness,
   insecureWebSocket,
   ipcPathTraversal,
+  isCalleeNamed,
+  isMethodCall,
   javaDeserialization,
   jwtAlgConfusion,
   k8sNoResourceLimits,
@@ -5523,6 +6455,7 @@ export {
   nosqlInjection,
   openRedirectParams,
   overlyPermissiveIAM,
+  parseFile,
   pathTraversal,
   pickleDeserialization,
   piiInLogs,
@@ -5566,6 +6499,8 @@ export {
   unvalidatedAPIParams,
   unvalidatedEventData,
   unvalidatedRedirect,
+  visitBinary,
+  visitCalls,
   vulnerableDependencies,
   weakHashing,
   weakPasswordRequirements,