xploitscan 1.1.11 → 1.2.1

package/dist/{chunk-HYXMH2H6.js → chunk-4OFR3SIS.js}

@@ -14,7 +14,11 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
 var __commonJS = (cb, mod) => function __require2() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
@@ -43420,15 +43424,50 @@ var import_parser = __toESM(require_lib(), 1);
 var import_traverse = __toESM(require_lib8(), 1);
 var import_traverse2 = __toESM(require_lib8(), 1);
 import Anthropic from "@anthropic-ai/sdk";
-function getSnippet(content, line, contextLines = 2) {
+var cacheContent = null;
+var cacheLines = [];
+var cacheOffsets = [];
+function lineIndex(content) {
+  if (content === cacheContent) return { lines: cacheLines, offsets: cacheOffsets };
   const lines = content.split("\n");
+  const offsets = new Array(lines.length);
+  let off = 0;
+  for (let i = 0; i < lines.length; i++) {
+    offsets[i] = off;
+    off += lines[i].length + 1;
+  }
+  cacheContent = content;
+  cacheLines = lines;
+  cacheOffsets = offsets;
+  return { lines, offsets };
+}
+function lineNumberAt(content, index) {
+  const { offsets } = lineIndex(content);
+  let lo = 0;
+  let hi = offsets.length - 1;
+  let ans = 0;
+  while (lo <= hi) {
+    const mid = lo + hi >> 1;
+    if (offsets[mid] <= index) {
+      ans = mid;
+      lo = mid + 1;
+    } else {
+      hi = mid - 1;
+    }
+  }
+  return ans + 1;
+}
+function getSnippet(content, line, contextLines = 2) {
+  const { lines } = lineIndex(content);
   const start = Math.max(0, line - 1 - contextLines);
   const end = Math.min(lines.length, line + contextLines);
-  return lines.slice(start, end).map((l, i) => {
-    const lineNum = start + i + 1;
+  const out = [];
+  for (let i = start; i < end; i++) {
+    const lineNum = i + 1;
     const marker = lineNum === line ? ">" : " ";
-    return `${marker} ${lineNum.toString().padStart(4)} | ${l}`;
-  }).join("\n");
+    out.push(`${marker} ${lineNum.toString().padStart(4)} | ${lines[i]}`);
+  }
+  return out.join("\n");
 }
 var MAX_CACHE = 256;
 var cache = /* @__PURE__ */ new Map();
@@ -43509,8 +43548,140 @@ var TAINTED_REQUEST_OBJECTS = /* @__PURE__ */ new Set([
   "event"
   // Lambda
 ]);
+var FS_READ_METHODS = /* @__PURE__ */ new Set(["readFile", "readFileSync"]);
+var PARSE_OBJECTS = /* @__PURE__ */ new Set([
+  "JSON",
+  "csv",
+  "papa",
+  "Papa",
+  "yaml",
+  "YAML",
+  "toml",
+  "qs",
+  "querystring"
+]);
+var PARSE_BARE = /* @__PURE__ */ new Set(["parse", "parseSync"]);
+var ARRAY_ELEMENT_METHODS = /* @__PURE__ */ new Set([
+  "map",
+  "filter",
+  "forEach",
+  "find",
+  "findIndex",
+  "flatMap",
+  "some",
+  "every"
+]);
+var ARRAY_REDUCE_METHODS = /* @__PURE__ */ new Set(["reduce", "reduceRight"]);
+function callPreservesTaint(node, rec) {
+  const callee = node.callee;
+  const anyArgTainted = () => node.arguments.some((a) => a.type !== "SpreadElement" && rec(a));
+  if (callee.type === "MemberExpression" && callee.property.type === "Identifier") {
+    const pname = callee.property.name;
+    if (FS_READ_METHODS.has(pname)) return anyArgTainted();
+    if (pname === "parse" || pname === "parseSync") {
+      const obj = callee.object;
+      if (obj.type === "Identifier" && PARSE_OBJECTS.has(obj.name)) return anyArgTainted();
+    }
+  }
+  if (callee.type === "Identifier") {
+    if (FS_READ_METHODS.has(callee.name)) return anyArgTainted();
+    if (PARSE_BARE.has(callee.name)) return anyArgTainted();
+  }
+  return false;
+}
+function isParamDerived(n, p) {
+  if (!n) return false;
+  if (n.type === "Identifier") return n.name === p;
+  if (n.type === "MemberExpression") return isParamDerived(n.object, p);
+  return false;
+}
+function formattedFlow(n, p) {
+  if (!n) return false;
+  switch (n.type) {
+    case "TemplateLiteral":
+      return n.expressions.some(
+        (e) => isParamDerived(e, p) || formattedFlow(e, p)
+      );
+    case "BinaryExpression":
+      if (n.operator !== "+") return false;
+      return isParamDerived(n.left, p) || isParamDerived(n.right, p) || formattedFlow(n.left, p) || formattedFlow(n.right, p);
+    case "ObjectExpression":
+      return n.properties.some(
+        (pr) => pr.type === "SpreadElement" && isParamDerived(pr.argument, p)
+      );
+    case "ArrayExpression":
+      return n.elements.some(
+        (el) => el != null && el.type === "SpreadElement" && isParamDerived(el.argument, p)
+      );
+    case "ConditionalExpression":
+      return formattedFlow(n.consequent, p) || formattedFlow(n.alternate, p);
+    case "AwaitExpression":
+      return formattedFlow(n.argument, p);
+    default:
+      return false;
+  }
+}
+function collectReturnArgs(fn) {
+  const out = [];
+  if (fn.type === "ArrowFunctionExpression" && fn.body.type !== "BlockStatement") {
+    out.push(fn.body);
+    return out;
+  }
+  const visit = (n) => {
+    if (!n || typeof n !== "object") return;
+    const node = n;
+    if (typeof node.type !== "string") return;
+    if (node.type === "ReturnStatement") {
+      const arg = node.argument;
+      if (arg) out.push(arg);
+      return;
+    }
+    if (node.type === "FunctionDeclaration" || node.type === "FunctionExpression" || node.type === "ArrowFunctionExpression") {
+      return;
+    }
+    for (const key of Object.keys(node)) {
+      const v = node[key];
+      if (Array.isArray(v)) v.forEach(visit);
+      else visit(v);
+    }
+  };
+  visit(fn.body);
+  return out;
+}
+function computePassthrough(fn) {
+  const params = fn.params ?? [];
+  const returns = collectReturnArgs(fn);
+  const out = /* @__PURE__ */ new Set();
+  for (let i = 0; i < params.length; i++) {
+    const param = params[i];
+    if (param.type !== "Identifier") continue;
+    const name = param.name;
+    if (returns.some((r) => formattedFlow(r, name))) out.add(i);
+  }
+  return out;
+}
 function buildTaintMap(parsed) {
   const tainted = /* @__PURE__ */ new Set();
+  function markPatternTainted(target) {
+    if (target.type === "Identifier") {
+      tainted.add(target.name);
+    } else if (target.type === "ObjectPattern") {
+      for (const prop of target.properties) {
+        if (prop.type === "ObjectProperty" && prop.value.type === "Identifier") {
+          tainted.add(prop.value.name);
+        } else if (prop.type === "RestElement" && prop.argument.type === "Identifier") {
+          tainted.add(prop.argument.name);
+        }
+      }
+    } else if (target.type === "ArrayPattern") {
+      for (const el of target.elements) {
+        if (el && el.type === "Identifier") tainted.add(el.name);
+        else if (el && el.type === "RestElement" && el.argument.type === "Identifier") {
+          tainted.add(el.argument.name);
+        }
+      }
+    }
+  }
   function reachesRequestIdent(node) {
     if (!node) return false;
     if (node.type === "Identifier") return TAINTED_REQUEST_OBJECTS.has(node.name);
@@ -43581,6 +43752,8 @@ function buildTaintMap(parsed) {
     }
     if (node.type === "CallExpression") {
       if (nodeIsTaintedSource(node)) return true;
+      if (callPreservesTaint(node, exprIsTainted)) return true;
+      if (localCallPropagates(node, exprIsTainted)) return true;
       if (node.callee.type === "MemberExpression") {
         if (exprIsTainted(node.callee.object)) return true;
         const obj = node.callee.object;
@@ -43601,8 +43774,46 @@ function buildTaintMap(parsed) {
     if (node.type === "AwaitExpression") {
       return exprIsTainted(node.argument);
     }
+    if (node.type === "ArrayExpression") {
+      return node.elements.some(
+        (el) => el != null && el.type === "SpreadElement" && exprIsTainted(el.argument)
+      );
+    }
+    if (node.type === "ObjectExpression") {
+      return node.properties.some(
+        (p) => p.type === "SpreadElement" && exprIsTainted(p.argument)
+      );
+    }
     return false;
   }
+  const fnPassthrough = /* @__PURE__ */ new Map();
+  const recordFn = (name, fn) => {
+    const pt = computePassthrough(fn);
+    if (pt.size > 0) fnPassthrough.set(name, pt);
+  };
+  traverse(parsed.ast, {
+    FunctionDeclaration(path) {
+      const n = path.node;
+      if (n.type === "FunctionDeclaration" && n.id && n.id.type === "Identifier") {
+        recordFn(n.id.name, n);
+      }
+    },
+    VariableDeclarator(path) {
+      const n = path.node;
+      if (n.type !== "VariableDeclarator" || n.id.type !== "Identifier" || !n.init) return;
+      if (n.init.type === "ArrowFunctionExpression" || n.init.type === "FunctionExpression") {
+        recordFn(n.id.name, n.init);
+      }
+    }
+  });
+  function localCallPropagates(node, rec) {
+    if (node.callee.type !== "Identifier") return false;
+    const pt = fnPassthrough.get(node.callee.name);
+    if (!pt) return false;
+    return node.arguments.some(
+      (a, i) => pt.has(i) && a.type !== "SpreadElement" && rec(a)
+    );
+  }
   traverse(parsed.ast, {
     VariableDeclarator(path) {
       const node = path.node;
@@ -43635,6 +43846,32 @@ function buildTaintMap(parsed) {
       if (exprIsTainted(node.right)) {
         tainted.add(node.left.name);
       }
+    },
+    // for (const row of <tainted>) → row tainted (and destructured names).
+    ForOfStatement(path) {
+      const node = path.node;
+      if (node.type !== "ForOfStatement") return;
+      if (!exprIsTainted(node.right)) return;
+      const decl = node.left;
+      const target = decl.type === "VariableDeclaration" && decl.declarations[0] ? decl.declarations[0].id : decl;
+      markPatternTainted(target);
+    },
+    // Array-iteration element taint: <tainted>.map((row) => …) marks `row`
+    // tainted inside the callback. Gated on the receiver already being
+    // tainted, so this never originates taint.
+    CallExpression(path) {
+      const node = path.node;
+      if (node.type !== "CallExpression") return;
+      const callee = node.callee;
+      if (callee.type !== "MemberExpression" || callee.property.type !== "Identifier") return;
+      const method = callee.property.name;
+      const isReduce = ARRAY_REDUCE_METHODS.has(method);
+      if (!ARRAY_ELEMENT_METHODS.has(method) && !isReduce) return;
+      if (!exprIsTainted(callee.object)) return;
+      const cb = node.arguments[0];
+      if (!cb || cb.type !== "ArrowFunctionExpression" && cb.type !== "FunctionExpression") return;
+      const elemParam = cb.params[isReduce ? 1 : 0];
+      if (elemParam) markPatternTainted(elemParam);
     }
   });
   const isTainted = (node) => {
@@ -43660,6 +43897,8 @@ function buildTaintMap(parsed) {
       return isTainted(node.object);
     }
     if (node.type === "CallExpression") {
+      if (callPreservesTaint(node, isTainted)) return true;
+      if (localCallPropagates(node, isTainted)) return true;
       if (node.callee.type === "MemberExpression") {
         if (isTainted(node.callee.object)) return true;
         const obj = node.callee.object;
@@ -43677,6 +43916,16 @@ function buildTaintMap(parsed) {
         }
       }
     }
+    if (node.type === "ArrayExpression") {
+      return node.elements.some(
+        (el) => el != null && el.type === "SpreadElement" && isTainted(el.argument)
+      );
+    }
+    if (node.type === "ObjectExpression") {
+      return node.properties.some(
+        (p) => p.type === "SpreadElement" && isTainted(p.argument)
+      );
+    }
     return false;
   };
   return {
@@ -43725,9 +43974,12 @@ var SERVER_SIDE_PATH_RE = new RegExp(
   ].join("|"),
   "i"
 );
-function isServerSideFile(filePath) {
+var SERVER_SIDE_CONTENT_RE = /\b(?:req|request)\.(?:body|query|params|headers|cookies)\b|\b(?:app|router)\.(?:get|post|put|patch|delete|use|all)\s*\(|\bctx\.request\b|\bevent\.(?:body|queryStringParameters|pathParameters)\b|\(\s*req\s*,\s*res\b|(?:import|require)\b[^;\n]{0,200}['"]express['"]|\bNextFunction\b/;
+function isServerSideFile(filePath, content) {
   if (isTestFile(filePath)) return false;
-  return SERVER_SIDE_PATH_RE.test(filePath);
+  if (SERVER_SIDE_PATH_RE.test(filePath)) return true;
+  if (content && SERVER_SIDE_CONTENT_RE.test(content)) return true;
+  return false;
 }
 var CONFIG_FILE_PATTERN = new RegExp(
   [
@@ -43748,7 +44000,7 @@ function isCommentLine(content, matchIndex) {
 function isInsideFixMessage(content, matchIndex) {
   const lineStart = content.lastIndexOf("\n", matchIndex - 1) + 1;
   const lineText = content.substring(lineStart, content.indexOf("\n", matchIndex));
-  return /(?:fix|description|message|suggestion|hint|help|example|doc|comment)\s*[:=(]/i.test(lineText) || /return\s*["'`].*\b(?:Use|Replace|Add|Move|Set|Enable|Disable|Never|Don't|Do not|Instead)\b/i.test(lineText);
+  return /(?:fix|description|message|suggestion|hint|help|example|doc|comment)\s*[:=]\s*["'`]/i.test(lineText) || /return\s*["'`].*\b(?:Use|Replace|Add|Move|Set|Enable|Disable|Never|Don't|Do not|Instead)\b/i.test(lineText);
 }
 function isInlineSilenced(content, matchIndex, ruleId) {
   const lines = content.split("\n");
@@ -43763,13 +44015,23 @@ function isInlineSilenced(content, matchIndex, ruleId) {
 }
 function findMatches(content, pattern, rule, filePath, fixTemplate) {
   const matches = [];
-  const lines = content.split("\n");
   let m;
   const re = new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`);
+  let scanned = 0;
+  let lineNum = 1;
+  let lastMatchIndex = -1;
+  const MAX_MATCHES = 500;
   while ((m = re.exec(content)) !== null) {
+    if (m.index === lastMatchIndex && m[0].length === 0) {
+      re.lastIndex++;
+      continue;
+    }
+    lastMatchIndex = m.index;
     if (isCommentLine(content, m.index)) continue;
     if (isInsideFixMessage(content, m.index)) continue;
-    const lineNum = content.substring(0, m.index).split("\n").length;
+    for (; scanned < m.index; scanned++) {
+      if (content.charCodeAt(scanned) === 10) lineNum++;
+    }
     matches.push({
       rule: rule.id,
       title: rule.title,
@@ -43780,6 +44042,7 @@ function findMatches(content, pattern, rule, filePath, fixTemplate) {
       snippet: getSnippet(content, lineNum),
       fix: fixTemplate?.(m)
     });
+    if (matches.length >= MAX_MATCHES) break;
   }
   return matches;
 }
@@ -43795,10 +44058,26 @@ function astMatch(content, filePath, line, rule, fix) {
     fix
   };
 }
+var parseCacheContent = null;
+var parseCachePath = null;
+var parseCacheResult = null;
+var parseCacheValid = false;
 function tryParse(content, filePath) {
-  const parsed = parseFile(content, filePath);
-  if (!parsed) return null;
-  return { parsed, taint: buildTaintMap(parsed) };
+  if (parseCacheValid && content === parseCacheContent && filePath === parseCachePath) {
+    return parseCacheResult;
+  }
+  let result = null;
+  try {
+    const parsed = parseFile(content, filePath);
+    result = parsed ? { parsed, taint: buildTaintMap(parsed) } : null;
+  } catch {
+    result = null;
+  }
+  parseCacheResult = result;
+  parseCacheContent = content;
+  parseCachePath = filePath;
+  parseCacheValid = true;
+  return result;
 }
 var hardcodedSecrets = {
   id: "VC001",
@@ -43934,7 +44213,7 @@ var missingAuthMiddleware = {
   category: "Authentication",
   description: "API routes without authentication checks allow unauthorized access.",
   check(content, filePath) {
-    if (!isServerSideFile(filePath)) return [];
+    if (!isServerSideFile(filePath, content)) return [];
     const routePatterns = [
       // Express/Hono style
       /\.(get|post|put|patch|delete)\s*\(\s*["'`][^"'`]+["'`]\s*,\s*(?:async\s+)?\(?(?:req|c|ctx)/gi,
@@ -44118,6 +44397,41 @@ var sqlInjection = {
         matches.push(m);
       }
     }
+    if (/\.\s*(?:query|execute|raw|queryRawUnsafe|executeRawUnsafe|\$queryRawUnsafe|\$executeRawUnsafe)\s*\(/.test(content)) {
+      const ctx = tryParse(content, filePath);
+      if (ctx) {
+        const { parsed, taint } = ctx;
+        const SQL_SINKS = /* @__PURE__ */ new Set([
+          "query",
+          "execute",
+          "raw",
+          "queryRawUnsafe",
+          "executeRawUnsafe",
+          "$queryRawUnsafe",
+          "$executeRawUnsafe"
+        ]);
+        visitCalls(
+          parsed,
+          (callee) => callee.type === "MemberExpression" && callee.property.type === "Identifier" && SQL_SINKS.has(callee.property.name),
+          (call, line) => {
+            const first = call.arguments[0];
+            if (!first || first.type === "SpreadElement") return;
+            if (first.type === "StringLiteral" || first.type === "TemplateLiteral") return;
+            if (!taint.isTainted(first)) return;
+            if (matches.some((m) => m.line === line)) return;
+            matches.push(
+              astMatch(
+                content,
+                filePath,
+                line,
+                sqlInjection,
+                "Use parameterized queries instead of building SQL from user input in a variable. Example: db.query('SELECT * FROM users WHERE login = ?', [req.body.login])"
+              )
+            );
+          }
+        );
+      }
+    }
     return matches;
   }
 };
@@ -44128,9 +44442,10 @@ var xssVulnerability = {
   category: "Injection",
   description: "Rendering user input without sanitization allows attackers to inject malicious scripts.",
   check(content, filePath) {
+    const hasSanitizerBypass = /bypassSecurityTrust(?:Html|Script|Style|Url|ResourceUrl)\s*\(/.test(content);
     if (/(?:sanitize|purify|escape|xss)/i.test(filePath)) return [];
-    if (/DOMPurify\.sanitize|sanitizeHtml|xss\(|escapeHtml/i.test(content)) return [];
-    if (/(?:import|require)\s*\(?.*(?:DOMPurify|dompurify|sanitize|sanitizer)/i.test(content)) return [];
+    if (!hasSanitizerBypass && /DOMPurify\.sanitize|sanitizeHtml|xss\(|escapeHtml/i.test(content)) return [];
+    if (!hasSanitizerBypass && /(?:import|require)\s*\(?[^\n]{0,200}(?:DOMPurify|dompurify|sanitize|sanitizer)/i.test(content)) return [];
     const patterns = [
       // React dangerouslySetInnerHTML
       /dangerouslySetInnerHTML\s*=\s*\{\s*\{\s*__html\s*:/g,
@@ -44141,7 +44456,12 @@ var xssVulnerability = {
       // v-html in Vue
       /v-html\s*=/g,
       // {@html} in Svelte
-      /\{@html\s/g
+      /\{@html\s/g,
+      // Angular DomSanitizer escape hatches — bypassSecurityTrustHtml /
+      // bypassSecurityTrustScript / ...Url / ...ResourceUrl / ...Style. These
+      // mark a value as trusted and skip Angular's built-in sanitization;
+      // passing user input through one is the canonical Angular DOM-XSS sink.
+      /bypassSecurityTrust(?:Html|Script|Style|Url|ResourceUrl)\s*\(/g
     ];
     const allLines = content.split("\n");
     const matches = [];
@@ -44154,9 +44474,9 @@ var xssVulnerability = {
         () => "Sanitize user input before rendering as HTML. Use a library like DOMPurify: DOMPurify.sanitize(userInput). If this site is intentional (JSON-LD structured data, a const boot script, a sandboxed preview), add an inline `// VC007-OK: <reason>` comment above the line to silence."
       );
       for (const m of raw) {
-        const lineText = allLines[m.line - 1] || "";
+        const lineText = (allLines[m.line - 1] || "").slice(0, 4e3);
         if (/\.innerHTML\s*=\s*['"]/.test(lineText) && !/\$\{/.test(lineText)) continue;
-        if (/\.innerHTML\s*=\s*['"][^'"]*['"]\s*$/.test(lineText)) continue;
+        if (/\.innerHTML\s*=\s*['"][^'"]{0,2000}['"]\s*$/.test(lineText)) continue;
         if (/dangerouslySetInnerHTML/.test(lineText)) {
           const windowText = allLines.slice(m.line - 1, m.line + 2).join("\n");
           if (/JSON\.stringify/i.test(windowText)) continue;
@@ -44355,7 +44675,7 @@ var evalUsage = {
       /new\s+Function\s*\(\s*(?!["'`])/g
     ];
     const hasEvalInString = /["'`]eval(?:-source-map|["'`])/i.test(content);
-    if (hasEvalInString && !/\beval\s*\([^)]*(?:req\.|body\.|input|params|user|data)/i.test(content)) return [];
+    if (hasEvalInString && !/\beval\s*\([^)]{0,500}(?:req\.|body\.|input|params|user|data)/i.test(content)) return [];
     const matches = [];
     for (const p of patterns) {
       const rawMatches = findMatches(
@@ -44396,7 +44716,7 @@ var unvalidatedRedirect = {
       const isPureLiteral = /^["'`][^"'`]*["'`]$/.test(value);
       if (!hasInterpolation && isPureLiteral) continue;
       if (isInlineSilenced(content, m.index, "VC016")) continue;
-      const line = content.substring(0, m.index).split("\n").length;
+      const line = lineNumberAt(content, m.index);
       matches.push({
         rule: "VC016",
         title: unvalidatedRedirect.title,
@@ -44686,7 +45006,7 @@ var exposedStackTraces = {
   category: "Information Leakage",
   description: "Returning error.stack or detailed error messages in API responses reveals internal code paths, file structure, and dependencies to attackers.",
   check(content, filePath) {
-    if (!isServerSideFile(filePath)) return [];
+    if (!isServerSideFile(filePath, content)) return [];
     const matches = [];
     const patterns = [
       // Sending stack trace in response
@@ -44831,7 +45151,7 @@ var dangerousInnerHTML = {
       if (/^[A-Z][A-Z0-9_]+$/.test(value)) continue;
       if (/^["'`][^$]*["'`]$/.test(value)) continue;
       if (/JSON\.stringify/i.test(value)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC063",
         title: dangerousInnerHTML.title,
@@ -44864,6 +45184,31 @@ function detectFramework(files) {
   if (frameworks.size === 0) frameworks.add("unknown");
   return [...frameworks];
 }
+function detectPlatform(files) {
+  const platforms = /* @__PURE__ */ new Set();
+  for (const { path, content } of files) {
+    const p = path.toLowerCase();
+    if (/(^|\/)lovable\.config\./.test(p) || /lovable-tagger/i.test(content) || /lovable\.dev/i.test(content)) {
+      platforms.add("lovable");
+    }
+    if (/(^|\/)\.bolt\//.test(p) || /(^|\/)\.stackblitzrc$/.test(p) || /bolt\.new/i.test(content)) {
+      platforms.add("bolt");
+    }
+    if (/(^|\/)\.replit$/.test(p) || /(^|\/)replit\.nix$/.test(p)) {
+      platforms.add("replit");
+    }
+    if (/(^|\/)\.cursorrules$/.test(p) || /(^|\/)\.cursor\//.test(p)) {
+      platforms.add("cursor");
+    }
+    if (/(^|\/)claude\.md$/.test(p) || /(^|\/)\.claude\//.test(p)) {
+      platforms.add("claude-code");
+    }
+    if (/v0\.dev/i.test(content) || /generated by v0\b/i.test(content)) {
+      platforms.add("v0");
+    }
+  }
+  return [...platforms];
+}
 function calculateGrade(findings, _totalFiles) {
   if (findings.length === 0) {
     return { grade: "A+", score: 100, summary: "No security issues detected. Excellent." };
@@ -45185,8 +45530,13 @@ var complianceMap = {
   // VC209–VC210: advisory heuristics
   VC209: { owasp: "A04:2021", cwe: "CWE-799" },
   // webhook missing idempotency
-  VC210: { owasp: "A01:2021", cwe: "CWE-862" }
+  VC210: { owasp: "A01:2021", cwe: "CWE-862" },
   // middleware matcher excludes /api
+  // VC211–VC212: hardcoded sensitive personal data (PII) in source
+  VC211: { owasp: "A02:2021", cwe: "CWE-540" },
+  // hardcoded credit card number
+  VC212: { owasp: "A02:2021", cwe: "CWE-540" }
+  // hardcoded US SSN
 };
 var consoleLogProduction = {
   id: "VC097",
@@ -45322,6 +45672,17 @@ function runCustomRules(content, filePath, disabledRules = [], tier = "free", ex
     return findings;
   }
   if (/pro-rules-bundle|\.bundle\./i.test(filePath)) return findings;
+  let maxLineLen = 0;
+  {
+    let lineStart = 0;
+    for (let i = 0; i <= content.length; i++) {
+      if (i === content.length || content.charCodeAt(i) === 10) {
+        if (i - lineStart > maxLineLen) maxLineLen = i - lineStart;
+        lineStart = i + 1;
+      }
+    }
+  }
+  if (maxLineLen > 5e4) return findings;
   if (/onboarding|demo-data|example-vulnerable|code-sample/i.test(filePath)) return findings;
   const ruleset = tier === "pro" && extraRules.length > 0 ? [...freeRules, ...extraRules] : freeRules;
   for (const rule of ruleset) {
@@ -45879,6 +46240,7 @@ function clearProRulesCache() {
 
 export {
   detectFramework,
+  detectPlatform,
   calculateGrade,
   runCustomRules,
   filterFalsePositives,
@@ -45896,4 +46258,4 @@ export {
   loadCachedProRules,
   clearProRulesCache
 };
-//# sourceMappingURL=chunk-HYXMH2H6.js.map
+//# sourceMappingURL=chunk-4OFR3SIS.js.map