xploitscan 1.2.2 → 1.3.1

package/README.md

@@ -155,6 +155,50 @@ legacy/**              scanner
 For a single reviewed-and-accepted finding, prefer an inline
 `// VC<id>-OK: <reason>` comment instead of a file- or path-wide rule.
 
+### Vendored and generated code
+
+Some of what a scanner finds isn't code you wrote. AI app builders copy
+shadcn/ui into your project verbatim; codegen writes into `__generated__/`;
+your README contains example code that exists to show what *not* to do.
+
+XploitScan scans all of it and reports everything it finds — but findings in
+these paths don't count toward your grade or the CI exit code:
+
+```
+**/components/ui/**      **/shadcn/**        **/ui/shadcn/**
+**/vendor/**             **/vendored/**      **/third_party/**
+**/generated/**          **/__generated__/**
+**/*.md                  **/*.mdx
+.claude/**  .agent/**  .cursor/**  .superpowers/**  .windsurf/**
+```
+
+They still appear in every report, tagged `[not graded]`, with the count shown
+next to the grade. Nothing is hidden — a grade that held findings out always
+says so.
+
+**Hardcoded credentials are the exception and are always graded**, in every
+path above. A key committed to your repository is live no matter which
+directory holds it, so "the generator wrote that file" doesn't apply. A
+service-role key in `__generated__/client.ts` or a plaintext Kubernetes Secret
+under `generated/` still counts against your grade.
+
+Why: shadcn's `chart.tsx` writes CSS custom properties through
+`dangerouslySetInnerHTML`, which trips a critical XSS rule. It ships
+byte-identically in a large share of AI-scaffolded projects, and one critical
+caps a project at grade D. Grading it means grading shadcn's code as yours.
+
+To opt out and grade everything:
+
+```bash
+xploitscan scan . --grade-vendored
+```
+
+Or persistently, in `.xploitscanrc`:
+
+```json
+{ "scan": { "gradeVendored": true } }
+```
+
 ## Web Dashboard
 
 Scan via the web at [xploitscan.com](https://xploitscan.com):

package/dist/{api-MFCSQQ2Y.js → api-6FD27EJY.js}

@@ -14,7 +14,7 @@ import {
   storeToken,
   syncUser,
   uploadScanResults
-} from "./chunk-4OFR3SIS.js";
+} from "./chunk-2VDAYFPC.js";
 export {
   checkUsage,
   clearProRulesCache,
@@ -29,4 +29,4 @@ export {
   syncUser,
   uploadScanResults
 };
-//# sourceMappingURL=api-MFCSQQ2Y.js.map
+//# sourceMappingURL=api-6FD27EJY.js.map

package/dist/{chunk-4OFR3SIS.js → chunk-2VDAYFPC.js}

@@ -43469,6 +43469,95 @@ function getSnippet(content, line, contextLines = 2) {
   }
   return out.join("\n");
 }
+var NON_APP_PATH_PATTERNS = [
+  // 1. vendored UI component libraries
+  "**/components/ui/**",
+  "**/ui/shadcn/**",
+  "**/shadcn/ui/**",
+  "**/shadcn/**",
+  // 2. documentation prose
+  "**/*.md",
+  "**/*.mdx",
+  // 3. AI-agent and editor tooling artifacts. Each gets a `**/`-prefixed form
+  //    as well as the root-anchored one: these directories turn up per-package
+  //    in a monorepo, and a finding's `file` is occasionally an absolute path,
+  //    which makes even a repo-root `.claude/` a nested segment.
+  ".claude/**",
+  ".agent/**",
+  ".cursor/**",
+  ".superpowers/**",
+  ".windsurf/**",
+  "**/.claude/**",
+  "**/.agent/**",
+  "**/.cursor/**",
+  "**/.superpowers/**",
+  "**/.windsurf/**",
+  // 4. explicitly third-party or machine-generated trees
+  "**/vendor/**",
+  "**/vendored/**",
+  "**/third_party/**",
+  "**/generated/**",
+  "**/__generated__/**"
+];
+function globToRegExp(pattern) {
+  const segments = pattern.split("/");
+  let src = "^";
+  for (let i = 0; i < segments.length; i++) {
+    const seg = segments[i];
+    const isLast = i === segments.length - 1;
+    if (seg === "**") {
+      src += isLast ? ".+" : "(?:[^/]+/)*";
+      continue;
+    }
+    src += seg.replace(/[.*+?^${}()|[\]\\]/g, (ch) => ch === "*" ? "[^/]*" : "\\" + ch);
+    if (!isLast) src += "/";
+  }
+  return new RegExp(src + "$", "i");
+}
+var NON_APP_MATCHERS = NON_APP_PATH_PATTERNS.map(globToRegExp);
+function normalizeScanPath(filePath) {
+  const raw = typeof filePath === "string" ? filePath : "";
+  const trimmed = raw.trim();
+  const looksWindows = !trimmed.includes("/") && trimmed.includes("\\");
+  const withForwardSlashes = (looksWindows ? trimmed.replace(/\\/g, "/") : trimmed).replace(/^[A-Za-z]:\//, "/");
+  const out = [];
+  for (const segment of withForwardSlashes.split("/")) {
+    if (segment === "" || segment === ".") continue;
+    if (segment === "..") {
+      if (out.length > 0 && out[out.length - 1] !== "..") out.pop();
+      else out.push("..");
+      continue;
+    }
+    out.push(segment);
+  }
+  return out.join("/");
+}
+function isVendoredPath(filePath) {
+  const normalized = normalizeScanPath(filePath);
+  if (!normalized) return false;
+  return NON_APP_MATCHERS.some((re) => re.test(normalized));
+}
+var HEURISTIC_SECRET_RULES = /* @__PURE__ */ new Set(["ENTROPY"]);
+var ALWAYS_GRADED_RULES = /* @__PURE__ */ new Set(["VC115", "VC062"]);
+function isAlwaysGraded(finding) {
+  const rule = finding?.rule ?? "";
+  if (ALWAYS_GRADED_RULES.has(rule)) return true;
+  if (finding?.category !== "Secrets") return false;
+  return !HEURISTIC_SECRET_RULES.has(rule);
+}
+function isVendoredFinding(finding) {
+  if (isAlwaysGraded(finding)) return false;
+  return isVendoredPath(finding?.file ?? "");
+}
+function vendoredReason(filePath) {
+  const normalized = normalizeScanPath(filePath);
+  if (!normalized) return null;
+  if (/\.mdx?$/.test(normalized)) return "documentation";
+  if (/(^|\/)(components\/ui|shadcn)(\/|$)/.test(normalized)) return "vendored UI component library";
+  if (/(^|\/)\.(claude|agent|cursor|superpowers|windsurf)(\/|$)/.test(normalized)) return "AI-agent tooling artifact";
+  if (isVendoredPath(normalized)) return "third-party or generated code";
+  return null;
+}
 var MAX_CACHE = 256;
 var cache = /* @__PURE__ */ new Map();
 function cacheKey(filename, contentHash) {
@@ -44174,8 +44263,8 @@ var hardcodedSecrets = {
           if (valMatch && nameMatch) {
             const value = valMatch[1];
             const isKeySuffix = nameMatch[1].endsWith("_KEY");
-            const isKebabIdentifier = value.length < 40 && /^[a-z0-9]+(-[a-z0-9]+)+$/.test(value);
-            if (isKeySuffix && isKebabIdentifier) continue;
+            const isSlotIdentifier = value.length < 40 && /^[a-z0-9]+([_-][a-z0-9]+)+$/.test(value);
+            if (isKeySuffix && isSlotIdentifier) continue;
           }
         }
         matches.push(rm);
@@ -45209,12 +45298,20 @@ function detectPlatform(files) {
   }
   return [...platforms];
 }
-function calculateGrade(findings, _totalFiles) {
-  if (findings.length === 0) {
-    return { grade: "A+", score: 100, summary: "No security issues detected. Excellent." };
+function calculateGrade(findings, _totalFiles, options = {}) {
+  const scored = options.gradeVendored ? findings : findings.filter((f) => !isVendoredFinding(f));
+  const ungraded = findings.length - scored.length;
+  const holdout = ungraded > 0 ? ` ${ungraded} finding${ungraded === 1 ? "" : "s"} in vendored, generated, or documentation files ${ungraded === 1 ? "is" : "are"} reported but not graded.` : "";
+  if (scored.length === 0) {
+    return {
+      grade: "A+",
+      score: 100,
+      summary: (ungraded > 0 ? "No security issues detected in your own code." : "No security issues detected. Excellent.") + holdout,
+      ungraded
+    };
   }
   let critical = 0, high = 0, medium = 0, low = 0;
-  for (const f of findings) {
+  for (const f of scored) {
     if (f.severity === "critical") critical++;
     else if (f.severity === "high") high++;
     else if (f.severity === "medium") medium++;
@@ -45254,7 +45351,7 @@ function calculateGrade(findings, _totalFiles) {
   } else {
     summary = "No security issues detected.";
   }
-  return { grade, score: rawScore, summary };
+  return { grade, score: rawScore, summary: summary + holdout, ungraded };
 }
 var complianceMap = {
   VC001: { owasp: "A07:2021", cwe: "CWE-798" },
@@ -45684,13 +45781,16 @@ function runCustomRules(content, filePath, disabledRules = [], tier = "free", ex
   }
   if (maxLineLen > 5e4) return findings;
   if (/onboarding|demo-data|example-vulnerable|code-sample/i.test(filePath)) return findings;
+  const vendoredFile = isVendoredPath(filePath);
   const ruleset = tier === "pro" && extraRules.length > 0 ? [...freeRules, ...extraRules] : freeRules;
   for (const rule of ruleset) {
     if (disabledRules.includes(rule.id)) continue;
     const matches = rule.check(content, filePath);
     const compliance = complianceMap[rule.id];
+    const vendored = vendoredFile && isVendoredFinding({ file: filePath, rule: rule.id, category: rule.category });
     for (const match of matches) {
       findings.push({
+        ...vendored ? { vendored: true } : {},
         id: `${match.rule}-${match.file}:${match.line}`,
         rule: match.rule,
         severity: match.severity,
@@ -45720,6 +45820,7 @@ Common false positive patterns you should catch:
 - The comparison is a type check (typeof x === "string") not a secret comparison
 - The file is a test, mock, or fixture file
 - The "secret" is a publishable/public key (pk_test_, NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY) designed to be client-side
+- The value is a slot/name identifier, not a credential: a SCREAMING_CASE *_KEY constant assigned a short lowercase word string (e.g. INDEX_KEY = "mc_saves_index", CACHE_KEY = "user-prefs-v2") is a localStorage/cookie/cache key NAME, not a secret. Real secrets are high-entropy and mixed-case (sk_live_aBcD\u2026), not dictionary words joined by - or _
 - The innerHTML/dangerouslySetInnerHTML uses a static constant or JSON.stringify, not user input
 - The redirect URL has already been validated (isAllowedRedirect, validateRedirect)
 - The webhook endpoint is for a non-Stripe service but flagged as "Stripe webhook"
@@ -45738,6 +45839,14 @@ var MAX_TOTAL_FINDINGS = (() => {
   if (!Number.isFinite(n) || n < 1) return DEFAULT_MAX_TOTAL_FINDINGS;
   return Math.min(n, 1e3);
 })();
+var DEFAULT_MAX_CONCURRENT = 6;
+var MAX_CONCURRENT = (() => {
+  const raw = process.env.XPLOITSCAN_AI_CONCURRENCY;
+  if (!raw) return DEFAULT_MAX_CONCURRENT;
+  const n = parseInt(raw, 10);
+  if (!Number.isFinite(n) || n < 1) return DEFAULT_MAX_CONCURRENT;
+  return Math.min(n, 20);
+})();
 var SEVERITY_PRIORITY = {
   critical: 0,
   high: 1,
@@ -45789,7 +45898,7 @@ function parseReviewResponse(text) {
   }
 }
 async function filterFalsePositives(findings, fileContents) {
-  const empty = { findings, filteredFindings: [], aiReviewed: false, removedCount: 0, totalBefore: findings.length };
+  const empty = { findings, filteredFindings: [], aiReviewed: false, removedCount: 0, totalBefore: findings.length, unreviewedCount: 0 };
   if (!process.env.ANTHROPIC_API_KEY) return empty;
   if (findings.length === 0) return empty;
   const prioritized = [...findings].sort((a, b) => {
@@ -45813,32 +45922,85 @@ async function filterFalsePositives(findings, fileContents) {
     return empty;
   }
   const fpMap = /* @__PURE__ */ new Map();
+  let reviewedAny = false;
+  let firstError = null;
+  let failedBatches = 0;
+  let unreviewedCount = 0;
+  const tasks = [];
   for (const [file, fileFindings] of byFile) {
     const content = fileContents.get(file);
     if (!content) continue;
     for (let i = 0; i < fileFindings.length; i += MAX_FINDINGS_PER_BATCH) {
-      const batch = fileFindings.slice(i, i + MAX_FINDINGS_PER_BATCH);
+      tasks.push({ batch: fileFindings.slice(i, i + MAX_FINDINGS_PER_BATCH), content });
+    }
+  }
+  const reviewBatch = async (task) => {
+    const { batch, content } = task;
+    try {
       const prompt = buildReviewPrompt(batch, content);
-      try {
-        const response = await client.messages.create({
+      const response = await client.messages.create(
+        {
           model: "claude-haiku-4-5-20251001",
           max_tokens: 1024,
+          // Pinned, NOT left to the API default of 1.0. This is a binary
+          // classification (real vs. false positive), not generation — there
+          // is no upside to sampling variety and a real downside to it: a
+          // filtered finding is a finding the user never sees, so drift here
+          // means scanning the same unchanged code twice can yield different
+          // results. Temperature 0 does not make the model bit-deterministic
+          // (Anthropic makes no such guarantee), but it removes the one
+          // variance source that was ours to control. See
+          // scripts/fp-filter-repeatability.cjs for the measured flip rate,
+          // and the assertion in ai-fp-filter.test.ts that keeps it pinned.
+          temperature: 0,
           system: REVIEW_SYSTEM_PROMPT,
           messages: [{ role: "user", content: prompt }]
-        });
-        const text = response.content.filter((b) => b.type === "text").map((b) => b.text).join("");
-        const results = parseReviewResponse(text);
-        for (const r of results) {
-          if (r.verdict === "fp" && r.index >= 0 && r.index < batch.length) {
-            const globalIndex = toReview.indexOf(batch[r.index]);
-            if (globalIndex !== -1) {
-              fpMap.set(globalIndex, r.reason);
-            }
+        },
+        // Cap a single call well under any serverless function timeout — the
+        // SDK default is 10 minutes, long enough for one hung connection to
+        // hold a worker until the platform SIGKILLs the whole scan request
+        // (which would skip the graceful-degradation fallback). A timeout
+        // turns a stuck batch into an unreviewed batch, handled below.
+        { timeout: 2e4 }
+      );
+      const text = response.content.filter((b) => b.type === "text").map((b) => b.text).join("");
+      const results = parseReviewResponse(text);
+      reviewedAny = true;
+      for (const r of results) {
+        if (r.verdict === "fp" && r.index >= 0 && r.index < batch.length) {
+          const globalIndex = toReview.indexOf(batch[r.index]);
+          if (globalIndex !== -1) {
+            fpMap.set(globalIndex, r.reason);
           }
         }
-      } catch {
-        continue;
       }
+    } catch (err) {
+      failedBatches++;
+      unreviewedCount += batch.length;
+      if (!firstError) firstError = err;
+    }
+  };
+  let next = 0;
+  const workerCount = Math.min(MAX_CONCURRENT, tasks.length);
+  const workers = Array.from({ length: workerCount }, async () => {
+    while (next < tasks.length) {
+      const cur = next++;
+      await reviewBatch(tasks[cur]);
+    }
+  });
+  await Promise.all(workers);
+  if (firstError) {
+    const msg = firstError instanceof Error ? firstError.message : String(firstError);
+    if (!reviewedAny) {
+      console.error(
+        "[ai-fp-filter] AI review unavailable \u2014 every model call failed; returning unreviewed findings:",
+        msg
+      );
+    } else {
+      console.warn(
+        `[ai-fp-filter] partial AI review \u2014 ${failedBatches} of ${tasks.length} batch(es) failed; those findings were not reviewed:`,
+        msg
+      );
     }
   }
   const filtered = toReview.filter((_, i) => !fpMap.has(i));
@@ -45849,9 +46011,10 @@ async function filterFalsePositives(findings, fileContents) {
   return {
     findings: [...filtered, ...overflow],
     filteredFindings,
-    aiReviewed: true,
+    aiReviewed: reviewedAny,
     removedCount: fpMap.size,
-    totalBefore
+    totalBefore,
+    unreviewedCount
   };
 }
 function shannonEntropy(str) {
@@ -45970,6 +46133,7 @@ function scanEntropy(files) {
     if (filePath.includes(".min.")) continue;
     if (/pro-rules-bundle|\.bundle\.|\.chunk\./i.test(filePath)) continue;
     if (/(?:\.test\.|\.spec\.|__tests__|__mocks__|fixtures?\/)/i.test(filePath)) continue;
+    const vendored = isVendoredPath(filePath);
     const lines = content.split("\n");
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
@@ -46000,6 +46164,7 @@ function scanEntropy(files) {
         if (entropy < 4.5 && !isLikelySecret) continue;
         const masked = value.substring(0, 6) + "..." + value.substring(value.length - 4);
         findings.push({
+          ...vendored ? { vendored: true } : {},
           id: `ENTROPY-${filePath}:${i + 1}`,
           rule: "ENTROPY",
           severity: isLikelySecret ? "critical" : "high",
@@ -46110,8 +46275,11 @@ async function incrementUsage() {
 async function uploadScanResults(result) {
   const apiKey = getApiKey();
   if (!apiKey) return;
+  const gradedFindings = result.findings.filter(
+    (f) => !isVendoredFinding(f)
+  );
   let critical = 0, high = 0, medium = 0, low = 0;
-  for (const f of result.findings) {
+  for (const f of gradedFindings) {
     switch (f.severity) {
       case "critical":
         critical++;
@@ -46140,6 +46308,9 @@ async function uploadScanResults(result) {
     highCount: high,
     mediumCount: medium,
     lowCount: low,
+    // Held out of the grade, not out of the record: every finding is still in
+    // `findings`, each flagged `vendored`.
+    ungradedCount: result.findings.length - gradedFindings.length,
     grade,
     score,
     duration: result.duration
@@ -46239,6 +46410,8 @@ function clearProRulesCache() {
 }
 
 export {
+  isVendoredFinding,
+  vendoredReason,
   detectFramework,
   detectPlatform,
   calculateGrade,
@@ -46258,4 +46431,4 @@ export {
   loadCachedProRules,
   clearProRulesCache
 };
-//# sourceMappingURL=chunk-4OFR3SIS.js.map
+//# sourceMappingURL=chunk-2VDAYFPC.js.map