xploitscan 1.0.7 → 1.0.8

package/dist/index.js

@@ -335,15 +335,20 @@ var hardcodedSecrets = {
       // Database URLs with credentials
       /(?:postgres|mysql|mongodb(?:\+srv)?):\/\/[^:]+:[^@]+@[^/\s"'`]+/gi
     ];
+    const fixMessages = [
+      "Move this API key to an environment variable. If this key has been committed, rotate it immediately \u2014 it may have already been scraped by bots.",
+      "AWS access key detected \u2014 may grant full account access (EC2, S3, IAM, billing). Rotate immediately in AWS Console \u2192 IAM \u2192 Security Credentials. Use IAM roles or environment variables instead.",
+      "Stripe key detected. sk_live_ keys can process real charges, issue refunds, and access customer payment data. sk_test_ keys are lower risk but should still not be committed. Rotate in Stripe Dashboard \u2192 Developers \u2192 API Keys.",
+      "Supabase key detected. Service role keys bypass Row Level Security and grant full database read/write access. Move to a server-side environment variable immediately.",
+      "OpenAI API key detected \u2014 grants full API access and can incur charges. Rotate at platform.openai.com \u2192 API Keys.",
+      "Hardcoded token or password detected. Move to an environment variable and rotate the credential if it has been committed to version control.",
+      "Private key found in source code. If this has been committed to version control, consider the key compromised \u2014 generate a new key pair and revoke the old one.",
+      "Database credentials in connection string. An attacker with this URL has full database access. Move to an environment variable, restrict network access, and rotate the password."
+    ];
     const matches = [];
-    for (const pattern of patterns) {
-      const rawMatches = findMatches(
-        content,
-        pattern,
-        hardcodedSecrets,
-        filePath,
-        () => "Move this secret to an environment variable and add it to .env (not committed to git). Use .env.example to document the required variables."
-      );
+    for (let pi = 0; pi < patterns.length; pi++) {
+      const pattern = patterns[pi];
+      const rawMatches = findMatches(content, pattern, hardcodedSecrets, filePath, () => fixMessages[pi]);
       for (const rm3 of rawMatches) {
         const lineText = content.split("\n")[rm3.line - 1] || "";
         const trimmed = lineText.trimStart();
@@ -1144,51 +1149,52 @@ function detectFramework(files) {
   if (frameworks.size === 0) frameworks.add("unknown");
   return [...frameworks];
 }
-function calculateGrade(findings, totalFiles) {
+function calculateGrade(findings, _totalFiles) {
   if (findings.length === 0) {
-    return { grade: "A+", score: 100, summary: "No security issues detected. Excellent!" };
+    return { grade: "A+", score: 100, summary: "No security issues detected. Excellent." };
   }
-  let deductions = 0;
+  let critical = 0, high = 0, medium = 0, low = 0;
   for (const f of findings) {
-    switch (f.severity) {
-      case "critical":
-        deductions += 15;
-        break;
-      case "high":
-        deductions += 8;
-        break;
-      case "medium":
-        deductions += 4;
-        break;
-      case "low":
-        deductions += 1;
-        break;
-    }
-  }
-  const sizeBuffer = Math.min(Math.log2(Math.max(totalFiles, 1)) * 2, 15);
-  const score = Math.max(0, Math.min(100, 100 - deductions + sizeBuffer));
+    if (f.severity === "critical") critical++;
+    else if (f.severity === "high") high++;
+    else if (f.severity === "medium") medium++;
+    else if (f.severity === "low") low++;
+  }
+  const deductions = critical * 15 + high * 7 + medium * 3 + low * 1;
+  const rawScore = Math.max(0, 100 - deductions);
   let grade;
+  if (rawScore >= 97) grade = "A+";
+  else if (rawScore >= 90) grade = "A";
+  else if (rawScore >= 80) grade = "B";
+  else if (rawScore >= 70) grade = "C";
+  else if (rawScore >= 60) grade = "D";
+  else grade = "F";
+  const capGrade = (cap) => {
+    const order = ["A+", "A", "B", "C", "D", "F"];
+    return order.indexOf(grade) < order.indexOf(cap) ? cap : grade;
+  };
+  if (critical >= 1) grade = capGrade("D");
+  else if (high >= 3) grade = capGrade("D");
+  else if (high >= 1) grade = capGrade("B");
+  else if (medium >= 5) grade = capGrade("B");
+  else if (medium >= 1) grade = capGrade("A");
   let summary;
-  if (score >= 95) {
-    grade = "A+";
-    summary = "Excellent security posture with minimal issues.";
-  } else if (score >= 85) {
-    grade = "A";
-    summary = "Strong security with a few minor concerns.";
-  } else if (score >= 70) {
-    grade = "B";
-    summary = "Good security but some issues need attention.";
-  } else if (score >= 55) {
-    grade = "C";
-    summary = "Fair security \u2014 several vulnerabilities should be fixed.";
-  } else if (score >= 35) {
-    grade = "D";
-    summary = "Poor security \u2014 critical issues require immediate attention.";
+  if (critical > 0) {
+    summary = `${critical} critical ${critical === 1 ? "vulnerability" : "vulnerabilities"} require immediate attention.`;
+  } else if (high >= 3) {
+    summary = `${high} high-severity issues require urgent attention.`;
+  } else if (high > 0) {
+    summary = `${high} high-severity ${high === 1 ? "issue needs" : "issues need"} attention.`;
+  } else if (medium >= 5) {
+    summary = `${medium} medium-severity issues to address.`;
+  } else if (medium > 0) {
+    summary = `Clean of critical and high issues. ${medium} medium-severity ${medium === 1 ? "issue" : "issues"} to review.`;
+  } else if (low > 0) {
+    summary = `Clean of critical, high, and medium issues. ${low} low-severity best-practice ${low === 1 ? "note" : "notes"}.`;
   } else {
-    grade = "F";
-    summary = "Failing \u2014 serious vulnerabilities present. Fix critical issues immediately.";
+    summary = "No security issues detected.";
   }
-  return { grade, score: Math.round(score), summary };
+  return { grade, score: rawScore, summary };
 }
 var complianceMap = {
   VC001: { owasp: "A07:2021", cwe: "CWE-798" },
@@ -1321,7 +1327,29 @@ var complianceMap = {
   VC128: { owasp: "A05:2021", cwe: "CWE-444" },
   VC129: { owasp: "A02:2021", cwe: "CWE-311" },
   VC130: { owasp: "A07:2021", cwe: "CWE-307" },
-  VC131: { owasp: "A06:2021", cwe: "CWE-1104" }
+  VC131: { owasp: "A06:2021", cwe: "CWE-1104" },
+  // VC132–VC145: Service-specific API key detection
+  VC132: { owasp: "A07:2021", cwe: "CWE-798" },
+  VC133: { owasp: "A07:2021", cwe: "CWE-798" },
+  VC134: { owasp: "A07:2021", cwe: "CWE-798" },
+  VC135: { owasp: "A07:2021", cwe: "CWE-798" },
+  VC136: { owasp: "A07:2021", cwe: "CWE-798" },
+  VC137: { owasp: "A07:2021", cwe: "CWE-798" },
+  VC138: { owasp: "A07:2021", cwe: "CWE-798" },
+  VC139: { owasp: "A07:2021", cwe: "CWE-798" },
+  VC140: { owasp: "A07:2021", cwe: "CWE-798" },
+  VC141: { owasp: "A07:2021", cwe: "CWE-798" },
+  VC142: { owasp: "A07:2021", cwe: "CWE-798" },
+  VC143: { owasp: "A07:2021", cwe: "CWE-798" },
+  VC144: { owasp: "A07:2021", cwe: "CWE-798" },
+  VC145: { owasp: "A07:2021", cwe: "CWE-798" },
+  // VC146–VC151: Secret exposure path analysis
+  VC146: { owasp: "A07:2021", cwe: "CWE-598" },
+  VC147: { owasp: "A09:2021", cwe: "CWE-532" },
+  VC148: { owasp: "A09:2021", cwe: "CWE-209" },
+  VC149: { owasp: "A07:2021", cwe: "CWE-798" },
+  VC150: { owasp: "A07:2021", cwe: "CWE-615" },
+  VC151: { owasp: "A07:2021", cwe: "CWE-214" }
 };
 var consoleLogProduction = {
   id: "VC097",
@@ -3820,7 +3848,7 @@ async function cursorInstallCommand(opts = {}) {
 var program = new Command();
 program.name("xploitscan").description(
   "AI security scanner for vibe-coded apps. Find vulnerabilities before attackers do."
-).version("1.0.7");
+).version("1.0.8");
 program.command("scan").description("Scan a directory for security vulnerabilities").argument("[directory]", "Directory to scan", ".").option("--no-ai", "Skip AI-powered analysis").option("-f, --format <format>", "Output format: terminal, json, sarif", "terminal").option("-v, --verbose", "Show detailed output", false).option("--diff [base]", "Scan only files changed vs base branch (default: main)").option("-w, --watch", "Watch for file changes and re-scan automatically", false).action(async (directory, opts) => {
   await scanCommand(directory, {
     directory,