xploitscan 1.1.11 → 1.2.1

package/README.md

@@ -5,7 +5,7 @@
 
 **Security scanner for AI-generated code.** Find vulnerabilities before attackers do.
 
-Built for developers shipping code via Cursor, Lovable, Bolt, Replit, and Claude Code. 210 security rules. Plain-English results. Copy-paste fixes.
+Built for developers shipping code via Cursor, Lovable, Bolt, Replit, and Claude Code. 210+ security rules. Plain-English results. Copy-paste fixes.
 
 ## Quick Start
 
@@ -17,7 +17,7 @@ No install, no config, no account required. Your code stays 100% local.
 
 ## What It Catches
 
-210 rules across 15+ categories:
+210+ rules across 15+ categories:
 
 | Category | Examples | Rules |
 |----------|---------|-------|
@@ -36,8 +36,8 @@ Every finding includes OWASP Top 10 and CWE compliance mappings.
 
 Detection is scored publicly on a labeled fixture corpus that's refreshed on every commit. Current numbers live at **[xploitscan.com/benchmark](https://xploitscan.com/benchmark)**:
 
-- **100% precision** (zero false positives) across 151 labeled fixtures covering 25+ vulnerability classes
-- **80%+ recall** on rules with active test coverage
+- **100% precision** (zero false positives) across a 200+ fixture labeled corpus covering 25+ vulnerability classes
+- **98%+ recall** — live numbers at [xploitscan.com/benchmark](https://xploitscan.com/benchmark)
 - Side-by-side comparison with Semgrep (community rulesets) and Bearer on the same corpus
 
 The scanner uses a two-layer architecture: a fast regex pre-filter for pattern-based rules (secrets, missing headers, container misconfigs), and a Babel-parsed AST layer with local taint tracking for data-flow rules (SSRF, prototype pollution, mass assignment, SSTI, command injection from user input). Recognized taint sources: Express / Fastify / Koa / Next.js App Router / Web Fetch API / AWS Lambda.
@@ -131,6 +131,30 @@ Create a `.xploitscanrc` file in your project root:
 }
 ```
 
+### `.xploitscanignore`
+
+A `.gitignore`-style file in your project root. Plain lines exclude whole
+files from scanning (negate with `!`). A line may also carry a trailing
+rule-ID list to suppress **only those rules** on matching paths while still
+scanning the files for everything else:
+
+```gitignore
+# Don't scan generated code at all
+generated/**
+
+# Allow log-injection (VC044) in internal cron scripts only
+scripts/cron/**        VC044
+
+# Silence two rules across all test files
+**/*.test.ts           VC031, VC043
+
+# Suppress every rule on a legacy tree (the `scanner` wildcard)
+legacy/**              scanner
+```
+
+For a single reviewed-and-accepted finding, prefer an inline
+`// VC<id>-OK: <reason>` comment instead of a file- or path-wide rule.
+
 ## Web Dashboard
 
 Scan via the web at [xploitscan.com](https://xploitscan.com):
@@ -142,7 +166,7 @@ Scan via the web at [xploitscan.com](https://xploitscan.com):
 - SOC2/ISO27001 compliance mapping
 - Slack and Discord webhook notifications
 
-**Free**: 5 scans/day, 30 core rules. **Indie** ($9/mo): 500 scans/month, all 210 rules, scan history. **Pro** ($19/mo): unlimited scans, all 210 rules, PDF reports, compliance mapping, webhooks, AI false-positive filter. **Team** ($99/mo): everything in Pro plus 5 seats, shared scan history, RBAC, and portfolio reports. Annual plans save 40%.
+**Free**: 5 scans/day, 30 core rules. **Indie** ($9/mo): 500 scans/month, all 210+ rules, scan history. **Pro** ($19/mo): unlimited scans, all 210+ rules, PDF reports, compliance mapping, webhooks, AI false-positive filter. **Team** ($99/mo): everything in Pro plus 5 seats, shared scan history, RBAC, and portfolio reports. Annual plans save 40%.
 
 ## Supported Languages
 

package/dist/{api-GHG3FCFB.js → api-MFCSQQ2Y.js}

@@ -14,7 +14,7 @@ import {
   storeToken,
   syncUser,
   uploadScanResults
-} from "./chunk-HYXMH2H6.js";
+} from "./chunk-4OFR3SIS.js";
 export {
   checkUsage,
   clearProRulesCache,
@@ -29,4 +29,4 @@ export {
   syncUser,
   uploadScanResults
 };
-//# sourceMappingURL=api-GHG3FCFB.js.map
+//# sourceMappingURL=api-MFCSQQ2Y.js.map