attackmap 0.4.10__tar.gz → 0.4.21__tar.gz

{attackmap-0.4.10/src/attackmap.egg-info → attackmap-0.4.21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: attackmap
-Version: 0.4.10
+Version: 0.4.21
 Summary: AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints.
 Author: AttackMap Contributors
 Author-email: Matthew Davis <matthewd@matthewd.xyz>
@@ -77,12 +77,24 @@ managers who need to triage an unfamiliar codebase.
 [![Python: 3.11+](https://img.shields.io/badge/Python-3.11%2B-blue.svg)](https://www.python.org/)
 [![PyPI](https://img.shields.io/pypi/v/attackmap.svg)](https://pypi.org/project/attackmap/)
 
-> **Status: beta (v0.4.0).** Core engine and 14 analyzer plugins are published
+> **Status: beta (v0.4.18).** Core engine and 14 analyzer plugins are published
 > to PyPI, Homebrew, and GHCR and validated against real-world codebases.
 > AttackMap is heuristic by design — findings are confidence-tiered evidence,
 > not proof. See [Project status](#project-status) for what's solid and what's
 > still maturing.
 
+### The macOS app
+
+Prefer a GUI? AttackMap ships a native macOS front-end that drives this CLI and
+renders every result view — install with `brew install --cask mlaify/tap/attackmap-app`
+(the cask depends on the `attackmap` formula, so this pulls the CLI too).
+
+| Overview | Exploitability |
+|---|---|
+| [![AttackMap macOS app — overview](https://raw.githubusercontent.com/mlaify/AttackMap/main/docs/screenshots/04-overview.png)](https://docs.matthewd.xyz/gui/) | [![AttackMap macOS app — exploitability](https://raw.githubusercontent.com/mlaify/AttackMap/main/docs/screenshots/06-exploitability-ranked.png)](https://docs.matthewd.xyz/gui/) |
+
+*Scanning OWASP Juice Shop. Full walkthrough in the [macOS app docs](https://docs.matthewd.xyz/gui/); source at [mlaify/AttackMap-mac](https://github.com/mlaify/AttackMap-mac).*
+
 ---
 
 ## Quickstart
@@ -187,6 +199,7 @@ Every `attackmap analyze` run writes:
 | `defensive-review-llm.md` *(with `--llm`)* | Claude-narrated review |
 | `defensive-review-llm.meta.json` *(with `--llm`)* | Backend, model, token usage |
 | `vulnerability-hypotheses.md` *(with `--hunt`)* | LLM-generated, evidence-cited exploit-chain **hypotheses** to confirm (leads, not detections) |
+| `triage.md` *(with `--triage`)* | Clustered, de-duplicated, ranked shortlist of the existing findings (LLM-backed; deterministic fallback) |
 
 ### GitHub Code Scanning integration
 
@@ -345,7 +358,11 @@ left on).
 
 Sinks that are only dangerous with attacker-controlled input (SSRF, SSTI, NoSQL,
 open redirect, `open`) are gated on a request-shaped identifier in the call — a constant URL or
-template is not flagged. It's a heuristic (import-edge ≠ call-edge), so findings
+template is not flagged. The walk is **call-graph-aware** (#138): for Python and
+JS/TS an import edge is kept only when the imported symbol is actually used in
+the file, so a dead import no longer fans a route out to that module's sinks
+(the plain import-graph remains the fallback for namespace/star/side-effect
+imports and for Go/PHP). It's still a heuristic (use ≉ proven call), so findings
 are evidence, not proof; confidence tapers with hop distance. Chains appear in
 `attackmap-report.json` under `scan.taint_chains`.
 
@@ -367,6 +384,27 @@ excluded from all the heuristic passes above by default, since dangerous
 patterns in test scaffolding are rarely real exposure. Set
 `ATTACKMAP_INCLUDE_TESTS=1` to scan them too (e.g. for test-quality reviews).
 
+**Recall mode (`--recall`).** Aggressiveness is only useful *behind* a verifier —
+so `--recall` widens taint discovery and marks the extra reach **speculative**
+instead of asserting it. It:
+
+- raises the max import-hop depth (2 → 4) and per-route visit budget;
+- surfaces reaches the default pass conservatively hides, like a
+  static-literal-looking `eval`/`exec`/deserialize argument;
+- **enumerates capability-reach**: every reach to a powerful capability —
+  network (`requests`/`httpx`/`axios`/`fetch`/`urlopen`), template
+  (`render_template_string`/`Template`), filesystem (`open`), redirect
+  (`redirect`/`res.redirect`) — even with **no known-bad pattern**, i.e. the
+  bare call without a request-derived argument (a genuine request-derived sink
+  still fires once, as a confirmed finding, not a duplicate).
+
+Speculative chains carry downgraded confidence, get their own LOW-severity
+finding (`SPECULATIVE (recall mode)…`), are excluded from every asserted
+downstream pass (exploitability, BOLA, attack paths), and are kept **out of
+`--fail-on-new-high`** — they are leads for `--hunt --verify` / `--triage` to
+adjudicate, not detections. Default behavior is unchanged; pair `--recall` with
+`--hunt --verify` to widen the net and then adjudicate what it catches.
+
 ### Web hardening gaps
 
 Route- and config-level checks for common web misconfigurations, each an
@@ -403,6 +441,32 @@ identifier; cipher/ECB tokens are matched case-sensitively so algorithm names
 aren't confused with prose (e.g. the French word "des"). Results appear under
 `scan.crypto_weaknesses`.
 
+### Hard-coded secret detection
+
+Two layers, precision-first. **Typed provider-signature detectors** recognize the
+distinctive shapes of leaked keys and fire at high confidence with a
+provider-specific `kind`:
+
+| Provider | Prefix / shape |
+|---|---|
+| AWS | `AKIA…` / `ASIA…` |
+| GitHub | `ghp_` / `gho_` / `ghu_` / `ghs_` / `ghr_` |
+| OpenAI | `sk-…` / `sk-proj-…` / `sk-svcacct-…` |
+| Anthropic | `sk-ant-…` |
+| GitLab / npm | `glpat-…` / `npm_…` |
+| Stripe / Slack / Google | `sk_live_…` / `xox[bpsare]-…` / `AIza…` |
+| SendGrid / Mailgun / Twilio | `SG.…` / `key-…` / `AC…` SID |
+| PEM / JWT | `-----BEGIN … PRIVATE KEY-----` / `eyJ….eyJ….…` (header verified) |
+
+Below the typed layer, a **Shannon-entropy fallback** catches high-entropy
+literals that don't match a known provider. It is calibrated to stay quiet:
+pure-hex hashes, URLs, version/number strings, base64/base32 alphabet constants
+(#96), Subresource-Integrity / lockfile digests (`sha384-…`), and UUIDs are
+suppressed, and a typed match always takes precedence over the entropy hit for
+the same span. Values are redacted (`ghp_…6789`) before they reach any report —
+the raw secret never appears. No liveness verification is performed. Results
+appear as `scan.secret_hints`.
+
 ### GitHub Actions / CI workflow security
 
 CI config is a real attack surface. AttackMap parses `.github/workflows/*.yml`
@@ -442,18 +506,22 @@ adds the general mutating-endpoint case, with the resolved chain as evidence.
 OWASP API Security #1. AttackMap flags a route as a BOLA/IDOR candidate when it
 composes three signals it already has:
 
-1. the route takes a **resource id** in the path (`/users/{id}`,
-   `/orders/:orderId`, `/docs/<int:doc_id>`), and
-2. it **reaches a datastore** — a DB hint in the same file/module, or a taint
-   chain from the route to a SQL execute sink, and
+1. the route takes a **resource id** — via a **path** template (`/users/{id}`,
+   `/orders/:orderId`), an id-bearing **query parameter** (`?orderId=`), an
+   **RPC method** (XRPC `/xrpc/…getRecord`, tRPC `user.byId`), or a **GraphQL
+   field** (`user(id: ID!)`) — and
+2. it **reaches a datastore** — a DB hint in the same file/module, a taint chain
+   from the route to a SQL execute sink, or (for RPC/GraphQL) an object-access
+   operation, and
 3. **no ownership/authorization check** is visible near the handler
-   (`current_user`, `request.user`, `authorize`, a policy/guard, or a
-   `filter_by(user_id=…)`-style scoped query).
+   (`current_user`, `request.user`, `authorize`, a policy/guard, a
+   `filter_by(user_id=…)`-style scoped query, or a GraphQL `@auth`/`@hasRole`
+   schema directive on the field).
 
-Write routes (POST/PUT/PATCH/DELETE) are HIGH, reads MEDIUM. Candidates appear
-under `scan.authz_candidates`; the ownership-marker scan is the main
-false-positive reducer, so a well-scoped handler is not flagged. Path-template
-routes today; query-parameter and RPC-method ids are future work.
+Write operations (POST/PUT/PATCH/DELETE, GraphQL mutations) are HIGH, reads
+MEDIUM. Candidates appear under `scan.authz_candidates` (each carrying its
+`surface`); the ownership-marker scan is the main false-positive reducer, so a
+well-scoped handler or an `@auth`-guarded field is not flagged.
 
 ### Anomaly / outlier detection
 
@@ -469,6 +537,20 @@ within each cohort the odd-one-out is reported:
 | `auth_outlier` | siblings carry an auth/authorization signal near the handler; this route doesn't | HIGH |
 | `validation_outlier` | among a cohort's state-changing handlers, peers validate input and this one shows no validation marker | LOW |
 | `method_outlier` | a lone state-changing method in an otherwise read-only cohort | MEDIUM |
+| `invariant_violation` | a mined-invariant outlier: among handlers that reach the same dangerous sink kind, the majority guard the request *before* the sink and this one doesn't — evidence cites the mined rule | HIGH |
+
+The `invariant_violation` kind is the **mined-invariant** pass (#149a): its
+cohort is not a route-path prefix but the set of handlers that reach the same
+dangerous sink (from the taint pass). When a strong majority guard the request
+before the sink, that pattern is mined as an implicit invariant and the handler
+that reaches the same sink kind with no preceding guard is flagged, citing the
+mined rule (e.g. "9 of 10 handlers that reach a database (SQL execute) sink
+apply an auth/validation guard before it"). It reasons only about **same-file**
+flows, where guard-before-sink ordering is actually verifiable (a cross-file
+sink could be called before an `authorize(...)` that textually follows it), and
+counts one handler per declaration regardless of how many verbs it exposes.
+Sanitized chains are excluded so only genuinely undefended flows form the cohort
+— it measures the code against its own norm and needs no signature.
 
 Everything is peer-relative and **confidence scales with how consistent the
 cohort is** — a lone deviation among many agreeing siblings is likelier a mistake
@@ -520,8 +602,27 @@ of the common manifest files:
 | Composer (PHP) | `composer.json` (require + require-dev; platform reqs skipped) |
 
 Each entry appears in `attackmap-report.json` under `scan.dependencies` with
-`{name, version, ecosystem, file, dev}`. Version ranges are kept verbatim
-(`^4.16.0`, `>=2,<3`, `latest`) — this slice does not resolve lockfiles.
+`{name, version, ecosystem, file, dev, resolved, direct, via}`. Manifest ranges
+are kept verbatim (`^4.16.0`, `>=2,<3`, `latest`).
+
+**Lockfile resolution (#143).** When a lockfile is present it is parsed for
+*exact* resolved versions and the full **transitive** tree — where most
+known-vulnerable dependencies actually live. Resolved entries set
+`resolved=true`, mark `direct`/transitive, and carry a `via` resolution path
+(`express > body-parser > qs`). A lockfile supersedes the range-only manifest
+in its **own directory** (so a monorepo's per-service lockfiles don't shadow
+each other).
+
+| Lockfile | Ecosystem |
+|---|---|
+| `package-lock.json` (v1/v2/v3), `pnpm-lock.yaml` | npm |
+| `poetry.lock`, `uv.lock` | PyPI |
+| `Cargo.lock` | Cargo |
+
+Go needs no lockfile pass: `go.mod` already pins exact versions and flags
+`// indirect` (transitive) deps, so it's treated as resolved directly.
+(`go.sum` is a checksum history, not the build list, so it is not used for
+inventory.)
 
 ### CVE cross-reference (opt-in)
 
@@ -542,9 +643,12 @@ attackmap analyze . --cve
   the network.
 - **Offline-tolerant.** If the network's unavailable but the cache is warm,
   cached results still surface; only fresh queries are skipped.
-- **Version resolution is best-effort.** Manifest ranges (`^4.16.0`,
-  `>=2.28,<3`) resolve to a queryable lower-bound; OSV does the range math.
-  Unpinned specs (`*`, `latest`) are skipped.
+- **Exact when a lockfile exists.** Lockfile-resolved dependencies (direct and
+  transitive) are queried at their pinned version, and a vulnerable transitive
+  dep is reported with its resolution path. For range-only manifests with no
+  lockfile, version resolution is best-effort — ranges (`^4.16.0`, `>=2.28,<3`)
+  resolve to a queryable lower-bound and OSV does the range math; unpinned specs
+  (`*`, `latest`) are skipped.
 
 The structured vulnerability list is available under
 `scan.vulnerabilities` in `attackmap-report.json` with
@@ -595,9 +699,35 @@ to confirm, not detections.** The same grounding contract as the review applies
 assignment, no exploit code, confidence-tiered, and each lead lists exactly what
 a human must verify. Uses the same auth/backend resolution as `--llm`.
 
+With `--verify`, each hypothesis is adjudicated against the actual source at its
+cited locations. **`--verify-votes N`** (default 3) turns that into a jury: **N
+independent skeptics** each adjudicate the same fixed hypothesis list. A lead is
+**CONFIRMED only on a strict majority** (NEEDS_REVIEW only when a majority flags
+the evidence as insufficient); ties and uncertainty are **REFUTED** — so a lead
+only one skeptic would confirm is dropped. **`--hunt-lenses N`** additionally
+fans generation out into N independent passes, each specialised in one failure
+mode (auth-bypass, TOCTOU/race, IDOR, deserialization, SSRF-to-internal,
+secret-misuse), and dedupes the leads across passes before verifying — more
+unique novel leads than a single generalist pass. **`--hunt-rounds N`** loops
+generation for up to N rounds, accumulating new (deduped) leads while a
+completeness critic seeds each next round with untried angles, and stops early
+once a round finds nothing new; **`--hunt-budget T`** caps the multi-round output
+tokens.
+This is the verifier the unknown-bug initiative
+([`docs/unknown-bug-epic.md`](docs/unknown-bug-epic.md)) is built on;
+`--verify-votes 1` is the classic single pass.
+
 Layered on top: **MITRE ATT&CK technique mappings** on every insight and
 **detection opportunities** (Sigma/KQL/Splunk-style hints) for each weakness.
 
+**6. Triage (`--triage`).** Where `--hunt` finds *new* leads, `--triage`
+distills the *existing* heuristic findings: `attackmap analyze . --triage` has
+the LLM cluster them by root cause, de-duplicate, and rank into a prioritized
+shortlist that cites real finding IDs (it organizes, it never invents). Output
+goes to `triage.md`. When no LLM backend is available it degrades to a
+**deterministic**, score-ordered, clustered shortlist — reproducible enough to
+diff across runs — rather than erroring.
+
 ---
 
 ## Supported ecosystems
@@ -645,7 +775,11 @@ attackmap analyze <path> --llm --llm-provider openai     # use OpenAI/Codex (OPE
 attackmap analyze <path> --llm --llm-provider openai --llm-model gpt-5.5   # any OpenAI model ID, passed through
 attackmap analyze <path> --hunt          # LLM vulnerability-hypothesis hunt (leads to confirm)
 attackmap analyze <path> --hunt --verify # adjudicate each lead vs. source (confirmed/refuted/review)
+attackmap analyze <path> --hunt --verify --verify-votes 3   # majority vote of N independent skeptics (default 3; 1 = single pass)
+attackmap analyze <path> --hunt --verify --hunt-lenses 4     # N lens-specialised generation passes, deduped, then verified
+attackmap analyze <path> --hunt --verify --hunt-rounds 4     # loop-until-dry generation (completeness critic seeds each round)
 attackmap analyze <path> --remediate     # LLM review-first fix suggestions (remediation.md)
+attackmap analyze <path> --triage        # cluster/dedupe/rank existing findings (triage.md; deterministic fallback)
 attackmap analyze <path> --pr-comment pr.md   # Markdown PR summary comment for CI
 
 # CI / PR diff gating
@@ -679,9 +813,10 @@ introduces a new HIGH finding.
   Dependabot go deeper on transitive resolution and lockfiles. AttackMap's
   value is folding the CVE signal into an architecture-aware narrative
   ("this public route reaches this vulnerable ORM").
-- **A true taint engine.** The data-flow pass is a heuristic import-graph walk
-  (import-edge ≈ call-edge), not sound interprocedural taint analysis. It
-  favors precision over recall; findings are evidence, not proof.
+- **A true taint engine.** The data-flow pass is a heuristic call-graph-refined
+  import-graph walk (edges pruned to used symbols, but symbol *use* ≉ a proven
+  data-carrying call), not sound interprocedural taint analysis. It favors
+  precision over recall; findings are evidence, not proof.
 - **Exhaustive.** AttackMap is heuristic by design. Findings are confidence-tiered
   with explicit guardrails for stale signals.
 
@@ -689,7 +824,7 @@ introduces a new HIGH finding.
 
 ## Project status
 
-AttackMap is **beta** (v0.4.0) — published and validated on real codebases, but
+AttackMap is **beta** (v0.4.18) — published and validated on real codebases, but
 pre-1.0 and heuristic.
 
 **Solid today:**
@@ -711,8 +846,9 @@ pre-1.0 and heuristic.
   explainable 0–100 "exploitable now" score that ranks route→sink combinations
   and folds in known-vulnerable dependencies on the path.
 - **`--hunt`** (LLM exploit-chain hypotheses) with **`--verify`** (adjudicate
-  each lead CONFIRMED/REFUTED/NEEDS-REVIEW against the actual source), and
-  **`--remediate`** (review-first fix suggestions).
+  each lead CONFIRMED/REFUTED/NEEDS-REVIEW against the actual source),
+  **`--remediate`** (review-first fix suggestions), and **`--triage`**
+  (cluster/dedupe/rank existing findings, with a deterministic fallback).
 - SBOM inventory (5 ecosystems) + OSV.dev CVE cross-reference (`--cve`).
 - Output: Markdown + JSON + **SARIF 2.1.0** + **Mermaid / Graphviz** diagrams;
   **diff/baseline** PR gating; a reusable **GitHub Action + PR bot**; optional
@@ -724,11 +860,16 @@ pre-1.0 and heuristic.
 
 **Still maturing:**
 
-- Taint is Python/JS/TS/Go/PHP and path-template scoped; query-param / RPC-method
-  authorization and more languages are planned.
-- The import-graph taint walk approximates call-edges with import-edges — precision
+- BOLA/IDOR authorization now covers path templates, query parameters, RPC
+  methods (XRPC/tRPC), and GraphQL fields; deeper resolver-level GraphQL
+  ownership analysis and more languages are planned.
+- The taint walk is call-graph-aware for Python/JS/TS (import edges are pruned to
+  symbols actually used in the file) but still approximates: symbol *use* is not a
+  proven data-carrying call, and Go/PHP keep the plain import-graph. Precision
   over recall; findings are evidence, not proof.
-- CVE lookup resolves a best-effort concrete version, not full lockfile ranges.
+- CVE lookup uses exact lockfile-resolved versions (direct + transitive) when a
+  lockfile is present; range-only manifests without a lockfile still fall back to
+  a best-effort concrete version.
 - Anomaly / exploitability reasoning is route-cohort and taint-chain scoped.
 
 ---

{attackmap-0.4.10 → attackmap-0.4.21}/README.md

@@ -16,12 +16,24 @@ managers who need to triage an unfamiliar codebase.
 [![Python: 3.11+](https://img.shields.io/badge/Python-3.11%2B-blue.svg)](https://www.python.org/)
 [![PyPI](https://img.shields.io/pypi/v/attackmap.svg)](https://pypi.org/project/attackmap/)
 
-> **Status: beta (v0.4.0).** Core engine and 14 analyzer plugins are published
+> **Status: beta (v0.4.18).** Core engine and 14 analyzer plugins are published
 > to PyPI, Homebrew, and GHCR and validated against real-world codebases.
 > AttackMap is heuristic by design — findings are confidence-tiered evidence,
 > not proof. See [Project status](#project-status) for what's solid and what's
 > still maturing.
 
+### The macOS app
+
+Prefer a GUI? AttackMap ships a native macOS front-end that drives this CLI and
+renders every result view — install with `brew install --cask mlaify/tap/attackmap-app`
+(the cask depends on the `attackmap` formula, so this pulls the CLI too).
+
+| Overview | Exploitability |
+|---|---|
+| [![AttackMap macOS app — overview](https://raw.githubusercontent.com/mlaify/AttackMap/main/docs/screenshots/04-overview.png)](https://docs.matthewd.xyz/gui/) | [![AttackMap macOS app — exploitability](https://raw.githubusercontent.com/mlaify/AttackMap/main/docs/screenshots/06-exploitability-ranked.png)](https://docs.matthewd.xyz/gui/) |
+
+*Scanning OWASP Juice Shop. Full walkthrough in the [macOS app docs](https://docs.matthewd.xyz/gui/); source at [mlaify/AttackMap-mac](https://github.com/mlaify/AttackMap-mac).*
+
 ---
 
 ## Quickstart
@@ -126,6 +138,7 @@ Every `attackmap analyze` run writes:
 | `defensive-review-llm.md` *(with `--llm`)* | Claude-narrated review |
 | `defensive-review-llm.meta.json` *(with `--llm`)* | Backend, model, token usage |
 | `vulnerability-hypotheses.md` *(with `--hunt`)* | LLM-generated, evidence-cited exploit-chain **hypotheses** to confirm (leads, not detections) |
+| `triage.md` *(with `--triage`)* | Clustered, de-duplicated, ranked shortlist of the existing findings (LLM-backed; deterministic fallback) |
 
 ### GitHub Code Scanning integration
 
@@ -284,7 +297,11 @@ left on).
 
 Sinks that are only dangerous with attacker-controlled input (SSRF, SSTI, NoSQL,
 open redirect, `open`) are gated on a request-shaped identifier in the call — a constant URL or
-template is not flagged. It's a heuristic (import-edge ≠ call-edge), so findings
+template is not flagged. The walk is **call-graph-aware** (#138): for Python and
+JS/TS an import edge is kept only when the imported symbol is actually used in
+the file, so a dead import no longer fans a route out to that module's sinks
+(the plain import-graph remains the fallback for namespace/star/side-effect
+imports and for Go/PHP). It's still a heuristic (use ≉ proven call), so findings
 are evidence, not proof; confidence tapers with hop distance. Chains appear in
 `attackmap-report.json` under `scan.taint_chains`.
 
@@ -306,6 +323,27 @@ excluded from all the heuristic passes above by default, since dangerous
 patterns in test scaffolding are rarely real exposure. Set
 `ATTACKMAP_INCLUDE_TESTS=1` to scan them too (e.g. for test-quality reviews).
 
+**Recall mode (`--recall`).** Aggressiveness is only useful *behind* a verifier —
+so `--recall` widens taint discovery and marks the extra reach **speculative**
+instead of asserting it. It:
+
+- raises the max import-hop depth (2 → 4) and per-route visit budget;
+- surfaces reaches the default pass conservatively hides, like a
+  static-literal-looking `eval`/`exec`/deserialize argument;
+- **enumerates capability-reach**: every reach to a powerful capability —
+  network (`requests`/`httpx`/`axios`/`fetch`/`urlopen`), template
+  (`render_template_string`/`Template`), filesystem (`open`), redirect
+  (`redirect`/`res.redirect`) — even with **no known-bad pattern**, i.e. the
+  bare call without a request-derived argument (a genuine request-derived sink
+  still fires once, as a confirmed finding, not a duplicate).
+
+Speculative chains carry downgraded confidence, get their own LOW-severity
+finding (`SPECULATIVE (recall mode)…`), are excluded from every asserted
+downstream pass (exploitability, BOLA, attack paths), and are kept **out of
+`--fail-on-new-high`** — they are leads for `--hunt --verify` / `--triage` to
+adjudicate, not detections. Default behavior is unchanged; pair `--recall` with
+`--hunt --verify` to widen the net and then adjudicate what it catches.
+
 ### Web hardening gaps
 
 Route- and config-level checks for common web misconfigurations, each an
@@ -342,6 +380,32 @@ identifier; cipher/ECB tokens are matched case-sensitively so algorithm names
 aren't confused with prose (e.g. the French word "des"). Results appear under
 `scan.crypto_weaknesses`.
 
+### Hard-coded secret detection
+
+Two layers, precision-first. **Typed provider-signature detectors** recognize the
+distinctive shapes of leaked keys and fire at high confidence with a
+provider-specific `kind`:
+
+| Provider | Prefix / shape |
+|---|---|
+| AWS | `AKIA…` / `ASIA…` |
+| GitHub | `ghp_` / `gho_` / `ghu_` / `ghs_` / `ghr_` |
+| OpenAI | `sk-…` / `sk-proj-…` / `sk-svcacct-…` |
+| Anthropic | `sk-ant-…` |
+| GitLab / npm | `glpat-…` / `npm_…` |
+| Stripe / Slack / Google | `sk_live_…` / `xox[bpsare]-…` / `AIza…` |
+| SendGrid / Mailgun / Twilio | `SG.…` / `key-…` / `AC…` SID |
+| PEM / JWT | `-----BEGIN … PRIVATE KEY-----` / `eyJ….eyJ….…` (header verified) |
+
+Below the typed layer, a **Shannon-entropy fallback** catches high-entropy
+literals that don't match a known provider. It is calibrated to stay quiet:
+pure-hex hashes, URLs, version/number strings, base64/base32 alphabet constants
+(#96), Subresource-Integrity / lockfile digests (`sha384-…`), and UUIDs are
+suppressed, and a typed match always takes precedence over the entropy hit for
+the same span. Values are redacted (`ghp_…6789`) before they reach any report —
+the raw secret never appears. No liveness verification is performed. Results
+appear as `scan.secret_hints`.
+
 ### GitHub Actions / CI workflow security
 
 CI config is a real attack surface. AttackMap parses `.github/workflows/*.yml`
@@ -381,18 +445,22 @@ adds the general mutating-endpoint case, with the resolved chain as evidence.
 OWASP API Security #1. AttackMap flags a route as a BOLA/IDOR candidate when it
 composes three signals it already has:
 
-1. the route takes a **resource id** in the path (`/users/{id}`,
-   `/orders/:orderId`, `/docs/<int:doc_id>`), and
-2. it **reaches a datastore** — a DB hint in the same file/module, or a taint
-   chain from the route to a SQL execute sink, and
+1. the route takes a **resource id** — via a **path** template (`/users/{id}`,
+   `/orders/:orderId`), an id-bearing **query parameter** (`?orderId=`), an
+   **RPC method** (XRPC `/xrpc/…getRecord`, tRPC `user.byId`), or a **GraphQL
+   field** (`user(id: ID!)`) — and
+2. it **reaches a datastore** — a DB hint in the same file/module, a taint chain
+   from the route to a SQL execute sink, or (for RPC/GraphQL) an object-access
+   operation, and
 3. **no ownership/authorization check** is visible near the handler
-   (`current_user`, `request.user`, `authorize`, a policy/guard, or a
-   `filter_by(user_id=…)`-style scoped query).
+   (`current_user`, `request.user`, `authorize`, a policy/guard, a
+   `filter_by(user_id=…)`-style scoped query, or a GraphQL `@auth`/`@hasRole`
+   schema directive on the field).
 
-Write routes (POST/PUT/PATCH/DELETE) are HIGH, reads MEDIUM. Candidates appear
-under `scan.authz_candidates`; the ownership-marker scan is the main
-false-positive reducer, so a well-scoped handler is not flagged. Path-template
-routes today; query-parameter and RPC-method ids are future work.
+Write operations (POST/PUT/PATCH/DELETE, GraphQL mutations) are HIGH, reads
+MEDIUM. Candidates appear under `scan.authz_candidates` (each carrying its
+`surface`); the ownership-marker scan is the main false-positive reducer, so a
+well-scoped handler or an `@auth`-guarded field is not flagged.
 
 ### Anomaly / outlier detection
 
@@ -408,6 +476,20 @@ within each cohort the odd-one-out is reported:
 | `auth_outlier` | siblings carry an auth/authorization signal near the handler; this route doesn't | HIGH |
 | `validation_outlier` | among a cohort's state-changing handlers, peers validate input and this one shows no validation marker | LOW |
 | `method_outlier` | a lone state-changing method in an otherwise read-only cohort | MEDIUM |
+| `invariant_violation` | a mined-invariant outlier: among handlers that reach the same dangerous sink kind, the majority guard the request *before* the sink and this one doesn't — evidence cites the mined rule | HIGH |
+
+The `invariant_violation` kind is the **mined-invariant** pass (#149a): its
+cohort is not a route-path prefix but the set of handlers that reach the same
+dangerous sink (from the taint pass). When a strong majority guard the request
+before the sink, that pattern is mined as an implicit invariant and the handler
+that reaches the same sink kind with no preceding guard is flagged, citing the
+mined rule (e.g. "9 of 10 handlers that reach a database (SQL execute) sink
+apply an auth/validation guard before it"). It reasons only about **same-file**
+flows, where guard-before-sink ordering is actually verifiable (a cross-file
+sink could be called before an `authorize(...)` that textually follows it), and
+counts one handler per declaration regardless of how many verbs it exposes.
+Sanitized chains are excluded so only genuinely undefended flows form the cohort
+— it measures the code against its own norm and needs no signature.
 
 Everything is peer-relative and **confidence scales with how consistent the
 cohort is** — a lone deviation among many agreeing siblings is likelier a mistake
@@ -459,8 +541,27 @@ of the common manifest files:
 | Composer (PHP) | `composer.json` (require + require-dev; platform reqs skipped) |
 
 Each entry appears in `attackmap-report.json` under `scan.dependencies` with
-`{name, version, ecosystem, file, dev}`. Version ranges are kept verbatim
-(`^4.16.0`, `>=2,<3`, `latest`) — this slice does not resolve lockfiles.
+`{name, version, ecosystem, file, dev, resolved, direct, via}`. Manifest ranges
+are kept verbatim (`^4.16.0`, `>=2,<3`, `latest`).
+
+**Lockfile resolution (#143).** When a lockfile is present it is parsed for
+*exact* resolved versions and the full **transitive** tree — where most
+known-vulnerable dependencies actually live. Resolved entries set
+`resolved=true`, mark `direct`/transitive, and carry a `via` resolution path
+(`express > body-parser > qs`). A lockfile supersedes the range-only manifest
+in its **own directory** (so a monorepo's per-service lockfiles don't shadow
+each other).
+
+| Lockfile | Ecosystem |
+|---|---|
+| `package-lock.json` (v1/v2/v3), `pnpm-lock.yaml` | npm |
+| `poetry.lock`, `uv.lock` | PyPI |
+| `Cargo.lock` | Cargo |
+
+Go needs no lockfile pass: `go.mod` already pins exact versions and flags
+`// indirect` (transitive) deps, so it's treated as resolved directly.
+(`go.sum` is a checksum history, not the build list, so it is not used for
+inventory.)
 
 ### CVE cross-reference (opt-in)
 
@@ -481,9 +582,12 @@ attackmap analyze . --cve
   the network.
 - **Offline-tolerant.** If the network's unavailable but the cache is warm,
   cached results still surface; only fresh queries are skipped.
-- **Version resolution is best-effort.** Manifest ranges (`^4.16.0`,
-  `>=2.28,<3`) resolve to a queryable lower-bound; OSV does the range math.
-  Unpinned specs (`*`, `latest`) are skipped.
+- **Exact when a lockfile exists.** Lockfile-resolved dependencies (direct and
+  transitive) are queried at their pinned version, and a vulnerable transitive
+  dep is reported with its resolution path. For range-only manifests with no
+  lockfile, version resolution is best-effort — ranges (`^4.16.0`, `>=2.28,<3`)
+  resolve to a queryable lower-bound and OSV does the range math; unpinned specs
+  (`*`, `latest`) are skipped.
 
 The structured vulnerability list is available under
 `scan.vulnerabilities` in `attackmap-report.json` with
@@ -534,9 +638,35 @@ to confirm, not detections.** The same grounding contract as the review applies
 assignment, no exploit code, confidence-tiered, and each lead lists exactly what
 a human must verify. Uses the same auth/backend resolution as `--llm`.
 
+With `--verify`, each hypothesis is adjudicated against the actual source at its
+cited locations. **`--verify-votes N`** (default 3) turns that into a jury: **N
+independent skeptics** each adjudicate the same fixed hypothesis list. A lead is
+**CONFIRMED only on a strict majority** (NEEDS_REVIEW only when a majority flags
+the evidence as insufficient); ties and uncertainty are **REFUTED** — so a lead
+only one skeptic would confirm is dropped. **`--hunt-lenses N`** additionally
+fans generation out into N independent passes, each specialised in one failure
+mode (auth-bypass, TOCTOU/race, IDOR, deserialization, SSRF-to-internal,
+secret-misuse), and dedupes the leads across passes before verifying — more
+unique novel leads than a single generalist pass. **`--hunt-rounds N`** loops
+generation for up to N rounds, accumulating new (deduped) leads while a
+completeness critic seeds each next round with untried angles, and stops early
+once a round finds nothing new; **`--hunt-budget T`** caps the multi-round output
+tokens.
+This is the verifier the unknown-bug initiative
+([`docs/unknown-bug-epic.md`](docs/unknown-bug-epic.md)) is built on;
+`--verify-votes 1` is the classic single pass.
+
 Layered on top: **MITRE ATT&CK technique mappings** on every insight and
 **detection opportunities** (Sigma/KQL/Splunk-style hints) for each weakness.
 
+**6. Triage (`--triage`).** Where `--hunt` finds *new* leads, `--triage`
+distills the *existing* heuristic findings: `attackmap analyze . --triage` has
+the LLM cluster them by root cause, de-duplicate, and rank into a prioritized
+shortlist that cites real finding IDs (it organizes, it never invents). Output
+goes to `triage.md`. When no LLM backend is available it degrades to a
+**deterministic**, score-ordered, clustered shortlist — reproducible enough to
+diff across runs — rather than erroring.
+
 ---
 
 ## Supported ecosystems
@@ -584,7 +714,11 @@ attackmap analyze <path> --llm --llm-provider openai     # use OpenAI/Codex (OPE
 attackmap analyze <path> --llm --llm-provider openai --llm-model gpt-5.5   # any OpenAI model ID, passed through
 attackmap analyze <path> --hunt          # LLM vulnerability-hypothesis hunt (leads to confirm)
 attackmap analyze <path> --hunt --verify # adjudicate each lead vs. source (confirmed/refuted/review)
+attackmap analyze <path> --hunt --verify --verify-votes 3   # majority vote of N independent skeptics (default 3; 1 = single pass)
+attackmap analyze <path> --hunt --verify --hunt-lenses 4     # N lens-specialised generation passes, deduped, then verified
+attackmap analyze <path> --hunt --verify --hunt-rounds 4     # loop-until-dry generation (completeness critic seeds each round)
 attackmap analyze <path> --remediate     # LLM review-first fix suggestions (remediation.md)
+attackmap analyze <path> --triage        # cluster/dedupe/rank existing findings (triage.md; deterministic fallback)
 attackmap analyze <path> --pr-comment pr.md   # Markdown PR summary comment for CI
 
 # CI / PR diff gating
@@ -618,9 +752,10 @@ introduces a new HIGH finding.
   Dependabot go deeper on transitive resolution and lockfiles. AttackMap's
   value is folding the CVE signal into an architecture-aware narrative
   ("this public route reaches this vulnerable ORM").
-- **A true taint engine.** The data-flow pass is a heuristic import-graph walk
-  (import-edge ≈ call-edge), not sound interprocedural taint analysis. It
-  favors precision over recall; findings are evidence, not proof.
+- **A true taint engine.** The data-flow pass is a heuristic call-graph-refined
+  import-graph walk (edges pruned to used symbols, but symbol *use* ≉ a proven
+  data-carrying call), not sound interprocedural taint analysis. It favors
+  precision over recall; findings are evidence, not proof.
 - **Exhaustive.** AttackMap is heuristic by design. Findings are confidence-tiered
   with explicit guardrails for stale signals.
 
@@ -628,7 +763,7 @@ introduces a new HIGH finding.
 
 ## Project status
 
-AttackMap is **beta** (v0.4.0) — published and validated on real codebases, but
+AttackMap is **beta** (v0.4.18) — published and validated on real codebases, but
 pre-1.0 and heuristic.
 
 **Solid today:**
@@ -650,8 +785,9 @@ pre-1.0 and heuristic.
   explainable 0–100 "exploitable now" score that ranks route→sink combinations
   and folds in known-vulnerable dependencies on the path.
 - **`--hunt`** (LLM exploit-chain hypotheses) with **`--verify`** (adjudicate
-  each lead CONFIRMED/REFUTED/NEEDS-REVIEW against the actual source), and
-  **`--remediate`** (review-first fix suggestions).
+  each lead CONFIRMED/REFUTED/NEEDS-REVIEW against the actual source),
+  **`--remediate`** (review-first fix suggestions), and **`--triage`**
+  (cluster/dedupe/rank existing findings, with a deterministic fallback).
 - SBOM inventory (5 ecosystems) + OSV.dev CVE cross-reference (`--cve`).
 - Output: Markdown + JSON + **SARIF 2.1.0** + **Mermaid / Graphviz** diagrams;
   **diff/baseline** PR gating; a reusable **GitHub Action + PR bot**; optional
@@ -663,11 +799,16 @@ pre-1.0 and heuristic.
 
 **Still maturing:**
 
-- Taint is Python/JS/TS/Go/PHP and path-template scoped; query-param / RPC-method
-  authorization and more languages are planned.
-- The import-graph taint walk approximates call-edges with import-edges — precision
+- BOLA/IDOR authorization now covers path templates, query parameters, RPC
+  methods (XRPC/tRPC), and GraphQL fields; deeper resolver-level GraphQL
+  ownership analysis and more languages are planned.
+- The taint walk is call-graph-aware for Python/JS/TS (import edges are pruned to
+  symbols actually used in the file) but still approximates: symbol *use* is not a
+  proven data-carrying call, and Go/PHP keep the plain import-graph. Precision
   over recall; findings are evidence, not proof.
-- CVE lookup resolves a best-effort concrete version, not full lockfile ranges.
+- CVE lookup uses exact lockfile-resolved versions (direct + transitive) when a
+  lockfile is present; range-only manifests without a lockfile still fall back to
+  a best-effort concrete version.
 - Anomaly / exploitability reasoning is route-cohort and taint-chain scoped.
 
 ---

{attackmap-0.4.10 → attackmap-0.4.21}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "attackmap"
-version = "0.4.10"
+version = "0.4.21"
 description = "AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints."
 readme = "README.md"
 requires-python = ">=3.11"

{attackmap-0.4.10 → attackmap-0.4.21}/src/attackmap/__init__.py

@@ -1,2 +1,2 @@
 __all__ = ["__version__"]
-__version__ = "0.4.10"
+__version__ = "0.4.21"