xploitscan-shared-rules 1.2.1 → 1.3.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 VibeCheck
+Copyright (c) 2026 Cipherline LLC
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -0,0 +1,58 @@
+# xploitscan-shared-rules
+
+Shared XploitScan rule definitions, helpers, compliance mappings, the AI false-positive filter, and the entropy-based secret scanner.
+
+This package is the source of truth for XploitScan's detection logic. It's consumed by the [XploitScan CLI](https://www.npmjs.com/package/xploitscan), the [XploitScan MCP server](https://www.npmjs.com/package/xploitscan-mcp), the web scan API at [xploitscan.com](https://xploitscan.com), and the [XploitScan GitHub Action](https://github.com/marketplace/actions/xploitscan-security-scanner) — so detection behavior can't drift between surfaces.
+
+## What's in here
+
+- **206 security rules** — pattern + AST-based detection for hardcoded secrets, SQL injection, XSS, SSRF, prototype pollution, crypto misuse, deserialization, JWT alg confusion, and more.
+- **Compliance mappings** — each rule tagged with the SOC2, ISO 27001, and OWASP Top 10 controls it covers.
+- **AI false-positive filter** — optional Claude Haiku integration that re-evaluates findings to suppress benign matches before reporting.
+- **Entropy-based secret scanner** — detects high-entropy strings that look like credentials but don't match a known service-key pattern.
+
+## Installation
+
+```bash
+npm install xploitscan-shared-rules
+# or
+pnpm add xploitscan-shared-rules
+```
+
+## Usage
+
+```ts
+import { getAllRules, scanContent, calculateGrade } from "xploitscan-shared-rules";
+
+const rules = getAllRules();
+const findings = scanContent(sourceCode, filePath, rules);
+const { grade, score } = calculateGrade(findings);
+```
+
+For the full API surface, see the TypeScript definitions in `dist/index.d.ts` (shipped with the package).
+
+## Most users want the CLI, not this package
+
+If you're scanning code, install the CLI instead:
+
+```bash
+npx xploitscan scan .
+```
+
+This package is published as a building block for the official XploitScan surfaces and for advanced users who want to call the detection engine directly from their own tooling.
+
+## Links
+
+- **[XploitScan website](https://xploitscan.com)**
+- [Documentation](https://xploitscan.com/docs)
+- [Detection benchmark](https://xploitscan.com/benchmark) — live precision/recall numbers vs Semgrep and Bearer
+- [CLI on npm](https://www.npmjs.com/package/xploitscan)
+- [Changelog](https://xploitscan.com/changelog)
+
+## License
+
+MIT — see [LICENSE](./LICENSE).
+
+---
+
+Built by [Cipherline LLC](https://xploitscan.com) — [admin@xploitscan.com](mailto:admin@xploitscan.com)