attackmap 0.3.2__tar.gz → 0.4.1__tar.gz

{attackmap-0.3.2/src/attackmap.egg-info → attackmap-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: attackmap
-Version: 0.3.2
+Version: 0.4.1
 Summary: AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints.
 Author: AttackMap Contributors
 Author-email: Matthew Davis <matthewd@matthewd.xyz>
@@ -75,7 +75,7 @@ managers who need to triage an unfamiliar codebase.
 [![Python: 3.11+](https://img.shields.io/badge/Python-3.11%2B-blue.svg)](https://www.python.org/)
 [![PyPI](https://img.shields.io/pypi/v/attackmap.svg)](https://pypi.org/project/attackmap/)
 
-> **Status: beta (v0.3.2).** Core engine and 14 analyzer plugins are published
+> **Status: beta (v0.4.0).** Core engine and 14 analyzer plugins are published
 > to PyPI, Homebrew, and GHCR and validated against real-world codebases.
 > AttackMap is heuristic by design — findings are confidence-tiered evidence,
 > not proof. See [Project status](#project-status) for what's solid and what's
@@ -205,6 +205,46 @@ jobs:
           category: attackmap
 ```
 
+### PR bot (reusable Action + summary comment)
+
+AttackMap ships a composite **GitHub Action** (`action.yml`) that installs it,
+scans, uploads SARIF (for inline annotations on the PR's *Files changed* tab),
+and renders a Markdown **PR summary comment** (new/resolved findings, gate
+status, and the top "most exploitable now"). Wire it up to post the comment on
+each PR:
+
+```yaml
+name: AttackMap PR review
+on: pull_request
+permissions:
+  contents: read
+  security-events: write   # SARIF upload
+  pull-requests: write     # summary comment
+jobs:
+  attackmap:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - id: scan
+        uses: mlaify/AttackMap@v1
+        with:
+          path: .
+          fail-on-new-high: "true"   # optional gate (needs a baseline)
+      - uses: actions/github-script@v7
+        if: always()
+        with:
+          script: |
+            const fs = require('fs');
+            const body = fs.readFileSync('${{ steps.scan.outputs.pr-comment-file }}', 'utf8');
+            await github.rest.issues.createComment({
+              owner: context.repo.owner, repo: context.repo.repo,
+              issue_number: context.issue.number, body,
+            });
+```
+
+The comment renderer is also available standalone: `attackmap analyze .
+--pr-comment pr.md` (add `--baseline prev.json` to include the diff).
+
 ### Diff mode (PR gating)
 
 For a lighter CI integration than Code Scanning — a bot comment, a JSON delta,
@@ -358,16 +398,16 @@ same sink two hops away. The score is:
   is shown. Contributing factors: sink danger (SQLi/RCE/deserialization highest),
   exposure (public/internal/unknown), auth at the entry route, reachability
   (fewer hops = higher), and data sensitivity at the sink (a co-located secret or
-  datastore), plus insecure-crypto / web-hardening gaps on the path as
-  amplifiers.
+  datastore), plus insecure-crypto / web-hardening gaps and **known-vulnerable
+  dependencies imported on the path** (from `--cve`, amplified by CVE severity)
+  as amplifiers.
 
 Scores land on the relevant taint findings (`exploitability` + `exploitability_tier`)
 and in a ranked **`attackmap-exploitability.md`** report plus the `exploitability`
 array in `attackmap-report.json`; the console summary leads with the top few. For
-example, `public + no-auth + taint-to-eval (0 hops)` scores 90/100 (CRITICAL).
-(Dependency CVEs are manifest-level, not attributable to a specific source path,
-so they inform the report but aren't folded into a path's score — path-attributed
-CVE fusion is future work.)
+example, `public + no-auth + taint-to-eval (0 hops)` scores 90/100 (CRITICAL), and
+a route reaching a sink through a known-vulnerable library version scores higher
+still.
 
 ### SBOM inventory
 
@@ -503,6 +543,9 @@ attackmap analyze <path> --cve           # cross-reference SBOM against OSV.dev
 attackmap analyze <path> --llm           # add LLM narrative (auto-resolve auth)
 attackmap analyze <path> --llm --llm-backend cli         # force Claude CLI
 attackmap analyze <path> --hunt          # LLM vulnerability-hypothesis hunt (leads to confirm)
+attackmap analyze <path> --hunt --verify # adjudicate each lead vs. source (confirmed/refuted/review)
+attackmap analyze <path> --remediate     # LLM review-first fix suggestions (remediation.md)
+attackmap analyze <path> --pr-comment pr.md   # Markdown PR summary comment for CI
 
 # CI / PR diff gating
 attackmap analyze <path> --baseline prev/attackmap-report.json \
@@ -541,7 +584,7 @@ introduces a new HIGH finding.
 
 ## Project status
 
-AttackMap is **beta** (v0.3.2) — published and validated on real codebases, but
+AttackMap is **beta** (v0.4.0) — published and validated on real codebases, but
 pre-1.0 and heuristic.
 
 **Solid today:**
@@ -549,34 +592,38 @@ pre-1.0 and heuristic.
 - Modular analyzer execution with entry-point discovery; 14 official plugins on PyPI.
 - Framework-aware route extraction (FastAPI/Flask/Express/Spring/axum/chi/…).
 - Asset + control modeling, cross-cutting insight engine, chain-aware threat model.
-- Injection / data-flow detection: SSRF, SSTI, NoSQL, unsafe deserialization,
-  eval/exec/shell, SQL, dynamic file open, open redirect — request-container-gated
-  for precision.
+- **Multi-language import-graph taint** — **Python, JS/TS, Go (module-path
+  resolution), and PHP (PSR-4 autoload)** — for injection sinks: SSRF, SSTI,
+  NoSQL, unsafe deserialization, eval/exec/shell, SQL (parameterized-query-gated),
+  dynamic file open, open redirect. Handler-aware seeding connects a route to
+  the module that defines its handler (no import-hub fan-out).
 - Novel vuln-class detectors: prototype pollution, mass assignment, JWT weakness,
   XXE, ReDoS, insecure upload, GraphQL exposure.
-- BOLA/IDOR authorization detection on path-template routes.
-- Insecure-crypto / weak-randomness and web-hardening (CORS/CSRF/cookies/CSP/debug)
-  detection.
-- Anomaly / outlier detection (the odd-one-out among sibling routes) and
-  **exploitability fusion** — a deterministic, explainable 0–100 "exploitable now"
-  score that ranks route→sink combinations.
-- **`--hunt`**: LLM vulnerability-hypothesis mode — evidence-cited, human-verifiable
-  exploit-chain leads (not detections).
+- BOLA/IDOR authorization detection (with custom-middleware / guard-arg awareness).
+- Insecure-crypto / weak-randomness (Python/JS/Go/PHP) and web-hardening
+  (CORS/CSRF/cookies/CSP/debug) detection.
+- Anomaly / outlier detection and **exploitability fusion** — a deterministic,
+  explainable 0–100 "exploitable now" score that ranks route→sink combinations
+  and folds in known-vulnerable dependencies on the path.
+- **`--hunt`** (LLM exploit-chain hypotheses) with **`--verify`** (adjudicate
+  each lead CONFIRMED/REFUTED/NEEDS-REVIEW against the actual source), and
+  **`--remediate`** (review-first fix suggestions).
 - SBOM inventory (5 ecosystems) + OSV.dev CVE cross-reference (`--cve`).
-- Output: Markdown + JSON + **SARIF 2.1.0** (GitHub Code Scanning) + **Mermaid /
-  Graphviz** diagrams; **diff/baseline** mode for PR gating; optional LLM narrative.
-- Live scan progress bar + ETA; test/spec files excluded from heuristic passes.
+- Output: Markdown + JSON + **SARIF 2.1.0** + **Mermaid / Graphviz** diagrams;
+  **diff/baseline** PR gating; a reusable **GitHub Action + PR bot**; optional
+  LLM narrative.
+- Live scan progress bar + ETA; test/spec/vendored/generated files excluded from
+  heuristic passes.
 - Distribution: `pip install attackmap[all]`, `brew install mlaify/tap/attackmap`,
   `docker pull ghcr.io/mlaify/attackmap`.
 
 **Still maturing:**
 
-- Taint + BOLA are Python + JS/TS and path-template scoped; query-param / RPC-method
+- Taint is Python/JS/TS/Go/PHP and path-template scoped; query-param / RPC-method
   authorization and more languages are planned.
 - The import-graph taint walk approximates call-edges with import-edges — precision
   over recall; findings are evidence, not proof.
-- CVE lookup resolves a best-effort concrete version, not full lockfile ranges, and
-  isn't yet fused into per-path exploitability scores.
+- CVE lookup resolves a best-effort concrete version, not full lockfile ranges.
 - Anomaly / exploitability reasoning is route-cohort and taint-chain scoped.
 
 ---

{attackmap-0.3.2 → attackmap-0.4.1}/README.md

@@ -16,7 +16,7 @@ managers who need to triage an unfamiliar codebase.
 [![Python: 3.11+](https://img.shields.io/badge/Python-3.11%2B-blue.svg)](https://www.python.org/)
 [![PyPI](https://img.shields.io/pypi/v/attackmap.svg)](https://pypi.org/project/attackmap/)
 
-> **Status: beta (v0.3.2).** Core engine and 14 analyzer plugins are published
+> **Status: beta (v0.4.0).** Core engine and 14 analyzer plugins are published
 > to PyPI, Homebrew, and GHCR and validated against real-world codebases.
 > AttackMap is heuristic by design — findings are confidence-tiered evidence,
 > not proof. See [Project status](#project-status) for what's solid and what's
@@ -146,6 +146,46 @@ jobs:
           category: attackmap
 ```
 
+### PR bot (reusable Action + summary comment)
+
+AttackMap ships a composite **GitHub Action** (`action.yml`) that installs it,
+scans, uploads SARIF (for inline annotations on the PR's *Files changed* tab),
+and renders a Markdown **PR summary comment** (new/resolved findings, gate
+status, and the top "most exploitable now"). Wire it up to post the comment on
+each PR:
+
+```yaml
+name: AttackMap PR review
+on: pull_request
+permissions:
+  contents: read
+  security-events: write   # SARIF upload
+  pull-requests: write     # summary comment
+jobs:
+  attackmap:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - id: scan
+        uses: mlaify/AttackMap@v1
+        with:
+          path: .
+          fail-on-new-high: "true"   # optional gate (needs a baseline)
+      - uses: actions/github-script@v7
+        if: always()
+        with:
+          script: |
+            const fs = require('fs');
+            const body = fs.readFileSync('${{ steps.scan.outputs.pr-comment-file }}', 'utf8');
+            await github.rest.issues.createComment({
+              owner: context.repo.owner, repo: context.repo.repo,
+              issue_number: context.issue.number, body,
+            });
+```
+
+The comment renderer is also available standalone: `attackmap analyze .
+--pr-comment pr.md` (add `--baseline prev.json` to include the diff).
+
 ### Diff mode (PR gating)
 
 For a lighter CI integration than Code Scanning — a bot comment, a JSON delta,
@@ -299,16 +339,16 @@ same sink two hops away. The score is:
   is shown. Contributing factors: sink danger (SQLi/RCE/deserialization highest),
   exposure (public/internal/unknown), auth at the entry route, reachability
   (fewer hops = higher), and data sensitivity at the sink (a co-located secret or
-  datastore), plus insecure-crypto / web-hardening gaps on the path as
-  amplifiers.
+  datastore), plus insecure-crypto / web-hardening gaps and **known-vulnerable
+  dependencies imported on the path** (from `--cve`, amplified by CVE severity)
+  as amplifiers.
 
 Scores land on the relevant taint findings (`exploitability` + `exploitability_tier`)
 and in a ranked **`attackmap-exploitability.md`** report plus the `exploitability`
 array in `attackmap-report.json`; the console summary leads with the top few. For
-example, `public + no-auth + taint-to-eval (0 hops)` scores 90/100 (CRITICAL).
-(Dependency CVEs are manifest-level, not attributable to a specific source path,
-so they inform the report but aren't folded into a path's score — path-attributed
-CVE fusion is future work.)
+example, `public + no-auth + taint-to-eval (0 hops)` scores 90/100 (CRITICAL), and
+a route reaching a sink through a known-vulnerable library version scores higher
+still.
 
 ### SBOM inventory
 
@@ -444,6 +484,9 @@ attackmap analyze <path> --cve           # cross-reference SBOM against OSV.dev
 attackmap analyze <path> --llm           # add LLM narrative (auto-resolve auth)
 attackmap analyze <path> --llm --llm-backend cli         # force Claude CLI
 attackmap analyze <path> --hunt          # LLM vulnerability-hypothesis hunt (leads to confirm)
+attackmap analyze <path> --hunt --verify # adjudicate each lead vs. source (confirmed/refuted/review)
+attackmap analyze <path> --remediate     # LLM review-first fix suggestions (remediation.md)
+attackmap analyze <path> --pr-comment pr.md   # Markdown PR summary comment for CI
 
 # CI / PR diff gating
 attackmap analyze <path> --baseline prev/attackmap-report.json \
@@ -482,7 +525,7 @@ introduces a new HIGH finding.
 
 ## Project status
 
-AttackMap is **beta** (v0.3.2) — published and validated on real codebases, but
+AttackMap is **beta** (v0.4.0) — published and validated on real codebases, but
 pre-1.0 and heuristic.
 
 **Solid today:**
@@ -490,34 +533,38 @@ pre-1.0 and heuristic.
 - Modular analyzer execution with entry-point discovery; 14 official plugins on PyPI.
 - Framework-aware route extraction (FastAPI/Flask/Express/Spring/axum/chi/…).
 - Asset + control modeling, cross-cutting insight engine, chain-aware threat model.
-- Injection / data-flow detection: SSRF, SSTI, NoSQL, unsafe deserialization,
-  eval/exec/shell, SQL, dynamic file open, open redirect — request-container-gated
-  for precision.
+- **Multi-language import-graph taint** — **Python, JS/TS, Go (module-path
+  resolution), and PHP (PSR-4 autoload)** — for injection sinks: SSRF, SSTI,
+  NoSQL, unsafe deserialization, eval/exec/shell, SQL (parameterized-query-gated),
+  dynamic file open, open redirect. Handler-aware seeding connects a route to
+  the module that defines its handler (no import-hub fan-out).
 - Novel vuln-class detectors: prototype pollution, mass assignment, JWT weakness,
   XXE, ReDoS, insecure upload, GraphQL exposure.
-- BOLA/IDOR authorization detection on path-template routes.
-- Insecure-crypto / weak-randomness and web-hardening (CORS/CSRF/cookies/CSP/debug)
-  detection.
-- Anomaly / outlier detection (the odd-one-out among sibling routes) and
-  **exploitability fusion** — a deterministic, explainable 0–100 "exploitable now"
-  score that ranks route→sink combinations.
-- **`--hunt`**: LLM vulnerability-hypothesis mode — evidence-cited, human-verifiable
-  exploit-chain leads (not detections).
+- BOLA/IDOR authorization detection (with custom-middleware / guard-arg awareness).
+- Insecure-crypto / weak-randomness (Python/JS/Go/PHP) and web-hardening
+  (CORS/CSRF/cookies/CSP/debug) detection.
+- Anomaly / outlier detection and **exploitability fusion** — a deterministic,
+  explainable 0–100 "exploitable now" score that ranks route→sink combinations
+  and folds in known-vulnerable dependencies on the path.
+- **`--hunt`** (LLM exploit-chain hypotheses) with **`--verify`** (adjudicate
+  each lead CONFIRMED/REFUTED/NEEDS-REVIEW against the actual source), and
+  **`--remediate`** (review-first fix suggestions).
 - SBOM inventory (5 ecosystems) + OSV.dev CVE cross-reference (`--cve`).
-- Output: Markdown + JSON + **SARIF 2.1.0** (GitHub Code Scanning) + **Mermaid /
-  Graphviz** diagrams; **diff/baseline** mode for PR gating; optional LLM narrative.
-- Live scan progress bar + ETA; test/spec files excluded from heuristic passes.
+- Output: Markdown + JSON + **SARIF 2.1.0** + **Mermaid / Graphviz** diagrams;
+  **diff/baseline** PR gating; a reusable **GitHub Action + PR bot**; optional
+  LLM narrative.
+- Live scan progress bar + ETA; test/spec/vendored/generated files excluded from
+  heuristic passes.
 - Distribution: `pip install attackmap[all]`, `brew install mlaify/tap/attackmap`,
   `docker pull ghcr.io/mlaify/attackmap`.
 
 **Still maturing:**
 
-- Taint + BOLA are Python + JS/TS and path-template scoped; query-param / RPC-method
+- Taint is Python/JS/TS/Go/PHP and path-template scoped; query-param / RPC-method
   authorization and more languages are planned.
 - The import-graph taint walk approximates call-edges with import-edges — precision
   over recall; findings are evidence, not proof.
-- CVE lookup resolves a best-effort concrete version, not full lockfile ranges, and
-  isn't yet fused into per-path exploitability scores.
+- CVE lookup resolves a best-effort concrete version, not full lockfile ranges.
 - Anomaly / exploitability reasoning is route-cohort and taint-chain scoped.
 
 ---

{attackmap-0.3.2 → attackmap-0.4.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "attackmap"
-version = "0.3.2"
+version = "0.4.1"
 description = "AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints."
 readme = "README.md"
 requires-python = ">=3.11"

{attackmap-0.3.2 → attackmap-0.4.1}/src/attackmap/__init__.py

@@ -1,2 +1,2 @@
 __all__ = ["__version__"]
-__version__ = "0.3.2"
+__version__ = "0.4.1"

{attackmap-0.3.2 → attackmap-0.4.1}/src/attackmap/cli.py

@@ -25,9 +25,9 @@ from .diff import (
 )
 from .graph import build_graph
 from .llm_review import LlmReviewError, generate_llm_review
-from .progress import ScanProgress
+from .progress import create_progress
 from .recon_to_analysis import translate_recon
-from .report import render_console_summary, write_reports
+from .report import render_console_summary, render_pr_comment, write_reports
 from .suggest import detect_ecosystems
 
 app = typer.Typer(help="AttackMap: understand your system and map your attack surface.")
@@ -42,6 +42,16 @@ HUNT_BANNER = (
     "> no CVE assignment, no exploitation instructions.\n\n"
 )
 
+# Prepended to remediation.md (#106): suggestions are review-first, not
+# auto-applied.
+REMEDIATION_BANNER = (
+    "> 🛠️ **Suggested fixes to review, not auto-applied.**\n"
+    "> LLM-proposed remediations grounded in AttackMap's static evidence. Each is\n"
+    "> the smallest change to remove a weakness class; review the diff, confirm the\n"
+    "> intent (e.g. whether a route should require auth), and run the verification\n"
+    "> step before applying. No exploit code.\n\n"
+)
+
 
 @app.command()
 def analyze(
@@ -79,6 +89,16 @@ def analyze(
         "--hunt",
         help="Vulnerability-hypothesis mode (#80): have Claude reason over the full evidence pack as a red-team analyst and propose ranked, human-verifiable exploit-chain HYPOTHESES (leads, not detections) to vulnerability-hypotheses.md. Uses the same LLM auth/backend as --llm.",
     ),
+    verify: bool = typer.Option(
+        False,
+        "--verify",
+        help="With --hunt: adjudicate each hypothesis against the actual source at cited locations — CONFIRMED / REFUTED / NEEDS HUMAN REVIEW (#hunt-verify). AttackMap feeds the code excerpts to the model.",
+    ),
+    remediate: bool = typer.Option(
+        False,
+        "--remediate",
+        help="Remediation mode (#106): have Claude propose concrete, review-first fixes per finding (suggested diffs / precise instructions, grounded in evidence) to remediation.md. Uses the same LLM auth/backend as --llm.",
+    ),
     baseline: str | None = typer.Option(
         None,
         "--baseline",
@@ -104,6 +124,16 @@ def analyze(
         "--no-progress",
         help="Disable the live progress bar / ETA during scanning. Progress auto-disables when stderr isn't a terminal (CI, piped output).",
     ),
+    progress_format: str = typer.Option(
+        "auto",
+        "--progress-format",
+        help="Progress reporting: 'auto' (TTY bar when stderr is a terminal), 'json' (newline-delimited JSON events on stderr, for GUI/tool front-ends), or 'none'. --no-progress is equivalent to 'none'.",
+    ),
+    pr_comment: str | None = typer.Option(
+        None,
+        "--pr-comment",
+        help="Write a Markdown PR summary comment to this path (for the GitHub Action / bot to post). Includes the baseline diff and top exploitability when available.",
+    ),
 ) -> None:
     repo_path = Path(path).resolve()
     if not repo_path.exists():
@@ -123,8 +153,10 @@ def analyze(
         except ValueError as exc:
             raise typer.BadParameter(str(exc)) from exc
 
+    if progress_format not in {"auto", "tty", "json", "none"}:
+        raise typer.BadParameter("--progress-format must be one of: auto, json, none.")
     active_analyzers = resolve_run_analyzers(repo_path, analyzers=selected_analyzers)
-    scan_progress = ScanProgress(enabled=not no_progress)
+    scan_progress = create_progress(progress_format, no_progress=no_progress)
     scan = analyze_repository(repo_path, analyzers=active_analyzers, progress=scan_progress)
     if cve and scan.dependencies:
         typer.echo(f"Checking {len(scan.dependencies)} dependencies against OSV.dev…")
@@ -170,6 +202,7 @@ def analyze(
     typer.echo(f"Reports written to: {Path(output).resolve()}")
 
     diff_exit_code = 0
+    diff = None
     if baseline is not None:
         baseline_path = Path(baseline)
         try:
@@ -199,6 +232,12 @@ def analyze(
                 typer.echo(f"  - {t}", err=True)
             diff_exit_code = 1
 
+    if pr_comment is not None:
+        pr_path = Path(pr_comment)
+        pr_path.parent.mkdir(parents=True, exist_ok=True)
+        pr_path.write_text(render_pr_comment(findings, diff), encoding="utf-8")
+        typer.echo(f"PR comment written to: {pr_path.resolve()}")
+
     if llm:
         try:
             effort_value = None
@@ -263,8 +302,10 @@ def analyze(
                     f"Invalid --llm-backend '{llm_backend}'. Use one of: auto, api, cli."
                 )
             typer.echo("")
+            hunt_mode = "hunt_verify" if verify else "hunt"
             typer.echo(
-                f"Hunting for vulnerability hypotheses via Claude (backend={llm_backend}, may take a minute)..."
+                f"Hunting for vulnerability hypotheses via Claude "
+                f"({'adjudicated against source, ' if verify else ''}backend={llm_backend}, may take a minute)..."
             )
             hunt_result = generate_llm_review(
                 scan,
@@ -274,7 +315,7 @@ def analyze(
                 model=llm_model,
                 effort=hunt_effort_value,  # type: ignore[arg-type]
                 backend=llm_backend,  # type: ignore[arg-type]
-                mode="hunt",
+                mode=hunt_mode,  # type: ignore[arg-type]
             )
         except LlmReviewError as exc:
             typer.echo(f"Vulnerability hunt skipped: {exc}", err=True)
@@ -301,6 +342,58 @@ def analyze(
                 f"(backend={hunt_result.backend})"
             )
 
+    if remediate:
+        try:
+            rem_effort_value = None
+            if llm_effort is not None:
+                if llm_effort not in {"low", "medium", "high", "xhigh", "max"}:
+                    raise typer.BadParameter(
+                        f"Invalid --llm-effort '{llm_effort}'. Use one of: low, medium, high, xhigh, max."
+                    )
+                rem_effort_value = llm_effort  # type: ignore[assignment]
+            if llm_backend not in {"auto", "api", "cli"}:
+                raise typer.BadParameter(
+                    f"Invalid --llm-backend '{llm_backend}'. Use one of: auto, api, cli."
+                )
+            typer.echo("")
+            typer.echo(
+                f"Generating remediation suggestions via Claude (backend={llm_backend}, may take a minute)..."
+            )
+            rem_result = generate_llm_review(
+                scan,
+                attack_surfaces,
+                findings,
+                attack_paths,
+                model=llm_model,
+                effort=rem_effort_value,  # type: ignore[arg-type]
+                backend=llm_backend,  # type: ignore[arg-type]
+                mode="remediate",
+            )
+        except LlmReviewError as exc:
+            typer.echo(f"Remediation skipped: {exc}", err=True)
+        else:
+            output_path = Path(output)
+            rem_md_path = output_path / "remediation.md"
+            rem_md_path.write_text(REMEDIATION_BANNER + rem_result.markdown + "\n", encoding="utf-8")
+            rem_meta_path = output_path / "remediation.meta.json"
+            rem_meta_path.write_text(
+                json.dumps(
+                    {
+                        "backend": rem_result.backend,
+                        "model": rem_result.model,
+                        "stop_reason": rem_result.stop_reason,
+                        "usage": rem_result.usage,
+                    },
+                    indent=2,
+                )
+                + "\n",
+                encoding="utf-8",
+            )
+            typer.echo(
+                f"Remediation suggestions written to: {rem_md_path.resolve()} "
+                f"(backend={rem_result.backend})"
+            )
+
     if diff_exit_code:
         raise typer.Exit(code=diff_exit_code)
 

{attackmap-0.3.2 → attackmap-0.4.1}/src/attackmap/crypto.py

@@ -145,6 +145,57 @@ _CRYPTO_PATTERNS: tuple[tuple[str, str, re.Pattern[str]], ...] = (
         # deprecated protocols
         _rx(r"PROTOCOL_TLSv1(?:_1)?\b|PROTOCOL_SSLv[23]\b|SSLv3|\bTLSv1\.0\b"),
     ),
+    # --- Go-specific (#102 follow-up) ------------------------------------
+    (
+        # Go weak hash: md5.New()/md5.Sum(...) / sha1.* over a security value.
+        "weak_password_hash",
+        "high",
+        _rx(rf"\b(?:md5|sha1)\.(?:New|Sum)\s*\([^;\n]*{_SECURITY_CTX}"),
+    ),
+    (
+        "weak_password_hash",
+        "high",
+        _rx(rf"{_SECURITY_CTX}[^;\n]*\b(?:md5|sha1)\.(?:New|Sum)\s*\("),
+    ),
+    (
+        # Go weak cipher: des.NewCipher / rc4.NewCipher / crypto/des|rc4 import.
+        # `.New…(` / `crypto/` context (not prose) makes lowercase safe.
+        "weak_cipher",
+        "high",
+        re.compile(r"\b(?:des|rc4)\.New(?:Cipher|TripleDESCipher)?\s*\(|\bcrypto/(?:des|rc4)\b"),
+    ),
+    (
+        # Go insecure RNG for a security value — math/rand-exclusive funcs only
+        # (rand.Int/Read are ambiguous with the secure crypto/rand, so excluded).
+        "insecure_random",
+        "medium",
+        _rx(rf"{_SECURITY_CTX}[^;\n]*\brand\.(?:Intn|Int31n?|Int63n?|Float64|Float32|Perm|Shuffle)\s*\("),
+    ),
+    (
+        "insecure_random",
+        "medium",
+        _rx(rf"\brand\.(?:Intn|Int31n?|Int63n?|Float64|Float32|Perm|Shuffle)\s*\([^;\n]*{_SECURITY_CTX}"),
+    ),
+    # --- PHP-specific (#103 follow-up) -----------------------------------
+    (
+        # PHP mcrypt weak ciphers (mcrypt is removed/insecure) + DES/RC4/Blowfish
+        # constants (which the \bDES\b token misses after the `MCRYPT_` prefix).
+        "weak_cipher",
+        "high",
+        re.compile(
+            r"\bMCRYPT_(?:DES|3DES|TRIPLEDES|RC4|RC2|BLOWFISH)\b"
+            r"|\bmcrypt_(?:encrypt|decrypt|module_open)\s*\("
+        ),
+    ),
+    (
+        # PHP disabled TLS verification (cURL / stream context).
+        "insecure_tls",
+        "high",
+        _rx(
+            r"CURLOPT_SSL_VERIFY(?:PEER|HOST)\s*(?:,|=>)\s*(?:false|0)\b"
+            r"|['\"]verify(?:_peer(?:_name)?)?['\"]\s*=>\s*false"
+        ),
+    ),
 )