attackmap 0.6.4__py3-none-any.whl

attackmap/scanner.py

@@ -0,0 +1,1379 @@
+from __future__ import annotations
+
+import base64
+import binascii
+import math
+import re
+from pathlib import Path, PurePosixPath
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from .progress import ScanProgress
+
+from .srcpaths import JS_TS_SUFFIXES, in_skipped_dir, is_skipped_dir, line_number
+from .redact import mask_secret
+from .safe_fs import is_oversized, max_file_bytes, walk_repo
+from .anomalies import find_anomalies
+from .authz import analyze_authz
+from .crypto import find_crypto_weaknesses
+from .sbom import analyze_sbom
+from .supply_chain import scan_supply_chain
+from .workflow_scanner import scan_workflows
+from .srcpaths import is_test_file, is_vendored_file
+from .mass_assignment import analyze_mass_assignment
+from .weaknesses import find_code_weaknesses
+from .auth_protocol import _GO_JWT, _JS_JWT_DEFAULT, _JS_JWT_NAMED, find_jwt_issues, find_oauth_session_issues
+from .webhardening import find_jvm_csrf_disabled, find_web_hardening_issues, has_csrf_protection
+from .sdk.models import AuthHint, DatabaseHint, ExternalCall, Route, ScanResult, SecretHint
+from .taint import DEFAULT_RECALL, analyze_taint, recall_config
+
+# Scanner responsibilities are intentionally generic-only:
+# - file walking and suffix filtering
+# - route extraction
+# - external-call extraction
+# - datastore/auth/secret hint extraction
+# Ecosystem overlays (for example node-service and atproto service/protocol hints)
+# must be emitted by specialized analyzers, not by this module.
+
+CODE_EXTENSIONS = {
+    ".py": "python",
+    ".js": "javascript",
+    ".jsx": "javascript",
+    ".mjs": "javascript",
+    ".cjs": "javascript",
+    ".ts": "typescript",
+    ".tsx": "typescript",
+    ".go": "go",
+    ".php": "php",
+}
+
+# PHP route registrations (#103):
+#   Laravel:  Route::get('/x', ...)      / $router->get('/x', ...)
+#   Slim:     $app->get('/x', ...)
+#   Symfony:  #[Route('/x', ...)]        / @Route("/x", ...)
+# Leading-slash gated, same discipline as #99.
+PHP_ROUTE_PATTERN = re.compile(
+    r"(?:\bRoute::|\$\w+->)(get|post|put|delete|patch|options|head|any)\s*\(\s*['\"](/[^'\"]*)['\"]",
+    re.IGNORECASE,
+)
+PHP_SYMFONY_ROUTE_PATTERN = re.compile(
+    r"(?:#\[\s*Route|@Route)\s*\(\s*['\"](/[^'\"]*)['\"]",
+)
+_PHP_ANY_METHODS = {"any"}
+
+# Go web-router registrations across the common frameworks:
+#   net/http:      mux.HandleFunc("/x", h) / http.Handle("/x", h)
+#   gin/echo:      r.GET("/x", h)          (uppercase verbs)
+#   chi/fiber:     r.Get("/x", h)          (Title-case verbs)
+# Gated on a leading-slash path so `cache.Get("key")` / `http.Get(url)` (an
+# outbound call, not a route) don't match — same discipline as #99.
+GO_ROUTE_PATTERN = re.compile(
+    r"\b\w+\.(get|post|put|delete|patch|head|options|connect|trace|any|all|handle|handlefunc)"
+    r"\s*\(\s*\"(/[^\"]*)\"",
+    re.IGNORECASE,
+)
+_GO_ANY_METHODS = {"any", "all", "handle", "handlefunc"}
+
+# (?<!\w) + possessive \w++: never restart mid-word, so a long word can't
+# trigger quadratic backtracking (#236).
+FASTAPI_ROUTER_PATTERN = re.compile(
+    r"(?<!\w)(\w++)\s*+=\s*+APIRouter\(\s*(?:[^)]*?\bprefix\s*=\s*['\"]([^'\"]*)['\"])?",
+    re.IGNORECASE | re.DOTALL,
+)
+FASTAPI_INCLUDE_ROUTER_PATTERN = re.compile(
+    r"(?<!\w)(\w++)\.include_router\(\s*(\w+)(?:\s*,\s*prefix\s*=\s*['\"]([^'\"]*)['\"])?",
+    re.IGNORECASE,
+)
+FASTAPI_DECORATOR_PATTERN = re.compile(
+    r"@(\w+)\.(get|post|put|delete|patch|options|head)\(\s*['\"]([^'\"]+)['\"]",
+    re.IGNORECASE,
+)
+FASTAPI_API_ROUTE_PATTERN = re.compile(
+    r"@(\w+)\.api_route\(\s*['\"]([^'\"]+)['\"](?P<args>.*?)\)",
+    re.IGNORECASE | re.DOTALL,
+)
+FLASK_BLUEPRINT_PATTERN = re.compile(
+    r"(?<!\w)(\w++)\s*+=\s*+Blueprint\(\s*['\"][^'\"]+['\"]\s*,\s*[^,]+(?:,\s*url_prefix\s*=\s*['\"]([^'\"]*)['\"])?",
+    re.IGNORECASE | re.DOTALL,
+)
+FLASK_REGISTER_BLUEPRINT_PATTERN = re.compile(
+    r"(?<!\w)(\w++)\.register_blueprint\(\s*(\w+)(?:\s*,\s*url_prefix\s*=\s*['\"]([^'\"]*)['\"])?",
+    re.IGNORECASE,
+)
+FLASK_ROUTE_PATTERN = re.compile(
+    r"@(\w+)\.route\(\s*['\"]([^'\"]+)['\"](?P<args>.*?)\)",
+    re.IGNORECASE | re.DOTALL,
+)
+# aiohttp's `RouteTableDef.route(method, path)` takes the verb first:
+# `@routes.route("PATCH", "/users/{id}")`. Matched against the stripped
+# arguments that follow the first string in FLASK_ROUTE_PATTERN (#342).
+ROUTE_VERB_FIRST_ARGS_PATTERN = re.compile(r",\s*+['\"]([^'\"]+)['\"]")
+_ROUTE_VERBS = frozenset({"GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "*"})
+EXPRESS_DIRECT_ROUTE_PATTERN = re.compile(
+    r"\b(\w+)\.(get|post|put|delete|patch|options|head|all)\(\s*['\"]([^'\"]+)['\"]",
+    re.IGNORECASE,
+)
+EXPRESS_CHAIN_ROUTE_PATTERN = re.compile(
+    r"\b(\w+)\.route\(\s*['\"]([^'\"]+)['\"]\s*\)(?P<chain>[\s\S]*?)(?=(?:\n\s*\w+\.)|\Z)",
+    re.IGNORECASE,
+)
+EXPRESS_USE_PATTERN = re.compile(
+    r"\b(\w+)\.use\(\s*['\"]([^'\"]+)['\"]\s*,\s*(\w+)\s*\)",
+    re.IGNORECASE,
+)
+METHOD_LIST_PATTERN = re.compile(r"['\"](GET|POST|PUT|DELETE|PATCH|OPTIONS|HEAD|ALL)['\"]", re.IGNORECASE)
+
+# Named groups: `method` (the verb) and `url`. `requests`/`axios` carry the verb
+# in the call syntax; for `fetch` the verb lives in an optional init object
+# (`fetch(url, {method: "POST"})`), captured as `fmethod` when present — a bare
+# `fetch(url)` is a GET by the fetch spec. The method feeds cross-repo contract
+# linking (#146b).
+EXTERNAL_CALL_PATTERNS = [
+    re.compile(r"requests\.(?P<method>get|post|put|delete|patch)\(['\"](?P<url>[^'\"]+)['\"]"),
+    re.compile(r"axios\.(?P<method>get|post|put|delete|patch)\(['\"](?P<url>[^'\"]+)['\"]"),
+    re.compile(
+        r"fetch\(['\"](?P<url>[^'\"]+)['\"]"
+        r"(?:\s*,\s*\{[^}]*?method\s*:\s*['\"](?P<fmethod>[A-Za-z]+)['\"])?"
+    ),
+]
+
+
+def _external_call_fields(match: "re.Match[str]") -> tuple[str, str | None]:
+    """Extract (url, upper-cased method) from an EXTERNAL_CALL match.
+
+    `requests`/`axios` supply the verb directly. A `fetch` call resolves to its
+    init `method` when present, else GET (the fetch default) — never the
+    match-anything `None`, which would fan one call out to every route verb.
+    `None` is reserved for calls whose method is genuinely unknown (e.g. config
+    file URLs) and should match any verb.
+    """
+    groups = match.groupdict()
+    if groups.get("method"):
+        return groups["url"], groups["method"].upper()
+    if match.group(0).lstrip().startswith("fetch"):
+        fmethod = groups.get("fmethod")
+        return groups["url"], (fmethod.upper() if fmethod else "GET")
+    return groups["url"], None
+
+DB_KEYWORDS = {
+    "postgres": "postgresql",
+    "psycopg": "postgresql",
+    "sqlalchemy": "sql",
+    "mongodb": "mongodb",
+    "mongo": "mongodb",
+    "redis": "redis",
+    "sqlite": "sqlite",
+    "mysql": "mysql",
+}
+
+DB_PATTERNS = [
+    # SQL — SQLAlchemy / raw / Django / Prisma / Drizzle
+    (re.compile(r"create_engine\(\s*['\"](?:postgresql|mysql|sqlite|mssql|oracle)\+?", re.IGNORECASE), "sql"),
+    (re.compile(r"create_async_engine\(", re.IGNORECASE), "sql"),
+    (re.compile(r"\bsessionmaker\s*\(", re.IGNORECASE), "sql"),
+    (re.compile(r"\bAsyncSession\s*\(", re.IGNORECASE), "sql"),
+    (re.compile(r"\bdeclarative_base\s*\(", re.IGNORECASE), "sql"),
+    (re.compile(r"new\s+PrismaClient\(", re.IGNORECASE), "sql"),
+    (re.compile(r"\bdrizzle\s*\(", re.IGNORECASE), "sql"),
+    (re.compile(r"\bknex\s*\(", re.IGNORECASE), "sql"),
+    # Raw SQL usage — cursor.execute with a SQL verb literal is a strong
+    # signal that raw SQL (not an ORM) is in play, which matters for
+    # injection review. #2.
+    (re.compile(r"\.execute\(\s*['\"]\s*(?:SELECT|INSERT|UPDATE|DELETE|CREATE|DROP|ALTER)\b", re.IGNORECASE), "sql"),
+    (re.compile(r"\.executemany\(\s*['\"]", re.IGNORECASE), "sql"),
+    # PostgreSQL
+    (re.compile(r"psycopg(?:2|3)?\.connect\(", re.IGNORECASE), "postgresql"),
+    (re.compile(r"\basyncpg\.connect\(", re.IGNORECASE), "postgresql"),
+    (re.compile(r"new\s+Pool\(", re.IGNORECASE), "postgresql"),
+    # SQLite
+    (re.compile(r"sqlite3\.connect\(", re.IGNORECASE), "sqlite"),
+    (re.compile(r"\bbetter-sqlite3\b|new\s+SQLite3?\b", re.IGNORECASE), "sqlite"),
+    # MySQL
+    (re.compile(r"\bmysql\.connector\.connect\(", re.IGNORECASE), "mysql"),
+    (re.compile(r"\bMySQLdb\.connect\(", re.IGNORECASE), "mysql"),
+    (re.compile(r"\baiomysql\.connect\(", re.IGNORECASE), "mysql"),
+    # MongoDB
+    (re.compile(r"(?:AsyncIOMotorClient|MongoClient)\(", re.IGNORECASE), "mongodb"),
+    (re.compile(r"\bpymongo\.MongoClient\(", re.IGNORECASE), "mongodb"),
+    (re.compile(r"mongoose\.connect\(", re.IGNORECASE), "mongodb"),
+    # Redis
+    (re.compile(r"redis\.(?:Redis|StrictRedis)\(", re.IGNORECASE), "redis"),
+    (re.compile(r"\bredis\.from_url\(", re.IGNORECASE), "redis"),
+    (re.compile(r"\baioredis\b|from\s+redis\s+import", re.IGNORECASE), "redis"),
+    (re.compile(r"redis\.createClient\(", re.IGNORECASE), "redis"),
+]
+
+# Kept intentionally short — noisy naked words (`session`, `password`,
+# `token`, `mfa`, `bearer`) were dropped in #2. They fired across
+# unrelated code and turned the file-level auth-signal set into
+# indistinguishable noise (see Bluesky FINDINGS.md §55). Specific
+# compound patterns in AUTH_PATTERNS below carry the real signal. `jwt` went
+# the same way in #325: an import, a comment or a `jwtSecret` name isn't a check.
+AUTH_KEYWORDS = [
+    "oauth",
+    "auth0",
+    "apikey",
+    "api_key",
+]
+
+AUTH_PATTERNS = [
+    # Decorator-based
+    (re.compile(r"@login_required\b", re.IGNORECASE), "login_required"),
+    (re.compile(r"@jwt_required\b", re.IGNORECASE), "jwt"),
+    (re.compile(r"@UseGuards\("), "auth_guard"),
+    # JWT verification only (#325). `jwt.decode` (jsonwebtoken), `jwt.sign` /
+    # `encode` and the library name don't authenticate a caller. An unpinned
+    # `jwt.verify(` still checks a signature (its missing `algorithms` is
+    # `jwt-alg-confusion`); a pinned one, jose `jwtVerify`, golang-jwt and
+    # PyJWT `decode(..., algorithms=…)` come from auth_protocol as `jwt_verified`.
+    (re.compile(r"\bjwt\.verify\(", re.IGNORECASE), "jwt"),
+    # Calls and middleware that verify: jose / @fastify/jwt `jwtVerify()`,
+    # firebase/php-jwt `JWT::decode` (it always checks the signature),
+    # golang-jwt `Parse`/`ParseWithClaims` (not `ParseUnverified`), express-jwt /
+    # koa-jwt, flask-jwt-extended, Tuupola JwtAuthentication, NestJS
+    # JwtAuthGuard, passport-jwt JwtStrategy, DRF simplejwt JWTAuthentication.
+    (re.compile(r"\bjwtVerify\s*\(|\bJWT::decode\s*\(|\bjwt\.Parse(?:WithClaims)?\s*\("), "jwt"),
+    (re.compile(r"\b(?:express|koa)jwt\s*\(|\bverify_jwt_in_request\s*\(", re.IGNORECASE), "jwt"),
+    (re.compile(r"\b(?:Jwt|JSONWebToken)(?:Authentication|AuthGuard|Strategy)\b", re.IGNORECASE), "jwt"),
+    # echo-jwt / echo's JWT middleware, tymon/jwt-auth's verifying calls.
+    (re.compile(r"\bechojwt\.(?:JWT|WithConfig)\s*\(|\bmiddleware\.JWT(?:WithConfig)?\s*\("), "jwt"),
+    (re.compile(r"\bJWTAuth::(?:parseToken|authenticate|toUser|getPayload|check)\b"), "jwt"),
+    # OAuth / OIDC library forms
+    (re.compile(r"OAuth2PasswordBearer\(", re.IGNORECASE), "oauth"),
+    (re.compile(r"\bauthlib\.\w+", re.IGNORECASE), "oauth"),
+    # FastAPI Depends-based auth
+    (re.compile(r"Depends\(\s*(?:oauth2_scheme|get_current_user|current_user|verify_token)\s*\)", re.IGNORECASE), "depends_auth"),
+    # Authorization header access — Python, JS, Node
+    (re.compile(r"request\.authorization\b", re.IGNORECASE), "authorization"),
+    (re.compile(r"request\.headers\.get\(\s*['\"]authorization['\"]", re.IGNORECASE), "authorization"),
+    (re.compile(r"req\.headers\[\s*['\"]authorization['\"]", re.IGNORECASE), "authorization"),
+    (re.compile(r"req\.get\(\s*['\"]authorization['\"]", re.IGNORECASE), "authorization"),
+    (re.compile(r"Authorization['\"]?\s*\]", re.IGNORECASE), "authorization"),
+    # Bearer-token access (context, not naked word)
+    (re.compile(r"\bBearer\s+\$\{?[a-z_]"), "bearer_token"),
+    (re.compile(r"['\"]Bearer\s"), "bearer_token"),
+    # Middleware / guard naming conventions
+    (re.compile(r"passport\.authenticate\(", re.IGNORECASE), "passport"),
+    (re.compile(r"\bpassport\.use\(", re.IGNORECASE), "passport"),
+    (re.compile(r"\b(?:verify|require)Token\s*\(", re.IGNORECASE), "verify_token"),
+    (re.compile(r"\bisAuthenticated\s*\(", re.IGNORECASE), "auth_middleware"),
+    (re.compile(r"\bensureLoggedIn\s*\(", re.IGNORECASE), "auth_middleware"),
+    (re.compile(r"\brequire(?:Auth|Login)\s*\(", re.IGNORECASE), "auth_middleware"),
+    (re.compile(r"\bwithAuth\s*[(<]", re.IGNORECASE), "auth_middleware"),
+    (re.compile(r"\bauthMiddleware\b", re.IGNORECASE), "auth_middleware"),
+    (re.compile(r"\bauthGuard\b|\bAuthGuard\b"), "auth_guard"),
+    # Custom middleware factories / guards (#100): CamelCase names ending in
+    # Auth/Guard called as a function — e.g. webhookAuth({secret}), apiKeyAuth(),
+    # tenantGuard(). Case-sensitive so `Author(`/`Guardian(` don't match.
+    (re.compile(r"\b\w+(?:Auth|Guard)\s*\("), "auth_middleware"),
+    # Auth middleware installed globally: app.use(requireAuth) / router.use(authz).
+    (re.compile(r"\.use\(\s*[\w$.]*(?:[Aa]uth|[Gg]uard|passport)", re.IGNORECASE), "auth_middleware"),
+    # Auth-ish guard passed as a middleware ARGUMENT in a route registration:
+    # router.get('/x', requireAuth, handler) — the guard is a bare reference.
+    (
+        re.compile(
+            r"\.(?:get|post|put|delete|patch|all)\(\s*['\"][^'\"]*['\"]\s*,[^)\n]*"
+            r"\b\w*(?:[Aa]uth|[Gg]uard|authenticate|authorize)\w*\b",
+            re.IGNORECASE,
+        ),
+        "auth_middleware",
+    ),
+    # Session-based auth — specific compound tokens, not the bare word "session"
+    (re.compile(r"\bexpress-session\b|require\(['\"]express-session['\"]"), "session_middleware"),
+    (re.compile(r"\breq\.session\.\w"), "session_state"),
+    (re.compile(r"\brequest\.session\.\w"), "session_state"),
+    (re.compile(r"\bcookie-session\b"), "session_middleware"),
+    (re.compile(r"\bflask_login\b|from\s+flask_login\s+import"), "session_middleware"),
+    (re.compile(r"\bdjango\.contrib\.auth\b"), "session_middleware"),
+    # MFA / 2FA — compound tokens only
+    (re.compile(r"\bmfa_required\b|\btwo_factor\b|\btotp_verify\b", re.IGNORECASE), "mfa"),
+    # Password-handling — compound tokens only
+    (re.compile(r"\bpassword_hash\b|\bpassword_reset\b|\bcheck_password\b", re.IGNORECASE), "password_flow"),
+    (re.compile(r"\bbcrypt\.(?:hash|compare)\s*\(", re.IGNORECASE), "password_flow"),
+    (re.compile(r"\bargon2\b"), "password_flow"),
+]
+
+SECRET_PATTERNS = [
+    re.compile(r"os\.getenv\(['\"]([^'\"]*(SECRET|TOKEN|KEY|PASSWORD)[^'\"]*)['\"]", re.IGNORECASE),
+    re.compile(r"process\.env\.([A-Z0-9_]*(SECRET|TOKEN|KEY|PASSWORD)[A-Z0-9_]*)", re.IGNORECASE),
+]
+
+# ---------------------------------------------------------------------------
+# Hard-coded secret literals (#39). Each entry is (regex, kind).
+# The regex captures the FULL secret in group 0 or its main group; the
+# `kind` becomes SecretHint.kind and the finder reads it as the display
+# name. Values are redacted before being included in evidence_text — the
+# raw secret must never appear in reports.
+# ---------------------------------------------------------------------------
+
+HARDCODED_SECRET_PATTERNS: list[tuple[re.Pattern[str], str]] = [
+    # AWS
+    (re.compile(r"\b(AKIA[0-9A-Z]{16})\b"), "aws_access_key"),
+    (re.compile(r"\b(ASIA[0-9A-Z]{16})\b"), "aws_temporary_key"),
+    # GitHub — classic PATs and the newer prefixes (fine-grained tokens,
+    # OAuth apps, server tokens, refresh tokens).
+    (re.compile(r"\b(ghp_[A-Za-z0-9]{36,})\b"), "github_pat"),
+    (re.compile(r"\b(gho_[A-Za-z0-9]{36,})\b"), "github_oauth_token"),
+    (re.compile(r"\b(ghu_[A-Za-z0-9]{36,})\b"), "github_user_token"),
+    (re.compile(r"\b(ghs_[A-Za-z0-9]{36,})\b"), "github_server_token"),
+    (re.compile(r"\b(ghr_[A-Za-z0-9]{36,})\b"), "github_refresh_token"),
+    # Slack bot / user / app tokens
+    (re.compile(r"\b(xox[bpsare]-[0-9A-Za-z-]{10,})\b"), "slack_token"),
+    # Stripe live / test keys
+    (re.compile(r"\b((?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9]{24,})\b"), "stripe_key"),
+    # SendGrid
+    (re.compile(r"\b(SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43})\b"), "sendgrid_key"),
+    # Mailgun
+    (re.compile(r"\b(key-[a-f0-9]{32})\b"), "mailgun_key"),
+    # Twilio account SID — AC followed by 32 hex. Narrow enough to avoid
+    # false-positives on random 34-char strings starting with AC.
+    (re.compile(r"\b(AC[a-f0-9]{32})\b"), "twilio_account_sid"),
+    # Google API key — most are 35 chars after AIza; some Cloud variants
+    # run slightly longer.
+    (re.compile(r"\b(AIza[A-Za-z0-9_-]{35,42})\b"), "google_api_key"),
+    # Anthropic API key (long, characteristic prefix)
+    (re.compile(r"\b(sk-ant-[A-Za-z0-9_-]{40,})\b"), "anthropic_key"),
+    # OpenAI API keys, one pattern per documented shape so each enforces
+    # its own length/charset (a loose `sk-…{20,}` would classify hyphenated
+    # placeholders like `sk-this-is-a-placeholder` as a live credential).
+    #   - project keys:         `sk-proj-<token>`
+    #   - service-account keys: `sk-svcacct-<token>`
+    #   - legacy keys:          `sk-<48 alphanumerics>` (no `-`/`_`, which
+    #     also keeps Anthropic's hyphenated `sk-ant-…` on its own kind).
+    (re.compile(r"\b(sk-proj-[A-Za-z0-9_-]{20,})\b"), "openai_key"),
+    (re.compile(r"\b(sk-svcacct-[A-Za-z0-9_-]{20,})\b"), "openai_key"),
+    (re.compile(r"\b(sk-[A-Za-z0-9]{48,})\b"), "openai_key"),
+    # GitLab personal / project / group access tokens.
+    (re.compile(r"\b(glpat-[A-Za-z0-9_-]{20,})\b"), "gitlab_pat"),
+    # npm automation / publish tokens.
+    (re.compile(r"\b(npm_[A-Za-z0-9]{36})\b"), "npm_token"),
+    # PEM private-key block — match `-----BEGIN [<algo> ]PRIVATE KEY-----`,
+    # covering both bare `-----BEGIN PRIVATE KEY-----` and prefixed forms
+    # (`RSA`, `EC`, `DSA`, `OPENSSH`, `ENCRYPTED`). Capture just the header
+    # line as evidence; never emit key material.
+    (re.compile(r"(-----BEGIN (?:[A-Z0-9]+ )?PRIVATE KEY-----)"), "pem_private_key"),
+    # JWT — three base64url segments separated by dots, first decoding
+    # to a JSON header. Recognized by shape here; verified for shape
+    # (base64url + non-trivial length) in the extractor below.
+    (re.compile(r"\b(eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,})\b"), "jwt"),
+    # --- #252: credential families without a classic prefix -------------
+    # AWS secret access key: 40 chars, only trusted next to its key name.
+    (re.compile(r"(?i)aws_?secret_?(?:access_?)?key['\"]?\s{0,5}(?::=|=>|[:=])\s{0,5}['\"]?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])"), "aws_secret_access_key"),
+    # Azure storage / Service Bus connection-string keys.
+    (re.compile(r"(?i)\bAccountKey=([A-Za-z0-9+/]{40,100}={0,2})"), "azure_storage_account_key"),
+    (re.compile(r"(?i)\bSharedAccessKey=([A-Za-z0-9+/]{40,64}={0,2})"), "azure_shared_access_key"),
+    # Azure AD (Entra) client secret: 3 chars, a digit, `Q~`, 31-34 chars.
+    (re.compile(r"(?<![A-Za-z0-9_~.-])([A-Za-z0-9_~.]{3}\dQ~[A-Za-z0-9_~.-]{31,34})(?![A-Za-z0-9_~.-])"), "azure_ad_client_secret"),
+    # Datadog API / application keys (hex, keyed by name).
+    (re.compile(r"(?i)\b(?:dd|datadog)_?(?:api|app(?:lication)?)_?key['\"]?\s{0,5}[:=]\s{0,5}['\"]?([a-f0-9]{32}(?:[a-f0-9]{8})?)\b"), "datadog_key"),
+    # Heroku platform API key (new format).
+    (re.compile(r"\b(HRKU-AA[0-9A-Za-z_-]{58})\b"), "heroku_api_key"),
+    # DigitalOcean personal / OAuth / refresh tokens.
+    (re.compile(r"\b(do[opr]_v1_[a-f0-9]{64})\b"), "digitalocean_token"),
+    # HashiCorp Vault service / batch tokens.
+    (re.compile(r"\b(hv[sb]\.[A-Za-z0-9_-]{24,})\b"), "vault_token"),
+    # .npmrc registry auth: `//registry.npmjs.org/:_authToken=…`, `_auth=`/`_password=`.
+    (re.compile(r":_authToken\s{0,5}=\s{0,5}([A-Za-z0-9._~+/=-]{8,})"), "npm_auth_token"),
+    (re.compile(r"(?m)^\s{0,8}(?:\S{0,200}:)?_(?:auth|password)\s{0,5}=\s{0,5}([A-Za-z0-9+/=]{8,})"), "npm_basic_auth"),
+    # Docker registry auth blob in `.dockercfg` / `config.json`.
+    (re.compile(r"\"auth\"\s{0,5}:\s{0,5}\"([A-Za-z0-9+/]{12,}={0,2})\""), "docker_registry_auth"),
+]
+
+# Minimum length for the high-entropy fallback. Under this, entropy
+# calculations aren't statistically meaningful, and shorter secrets
+# tend to be caught by explicit provider patterns anyway.
+_ENTROPY_MIN_LENGTH = 32
+_ENTROPY_MAX_LENGTH = 256  # very long strings are usually inline assets
+_ENTROPY_THRESHOLD = 4.5   # bits per character
+# Extracts quoted string literals (single or double quoted) for entropy
+# fallback. Kept intentionally narrow: no multi-line strings.
+_QUOTED_LITERAL = re.compile(r"['\"]([A-Za-z0-9+/_=-]{32,256})['\"]")
+
+
+_SNIPPET_MAX_CHARS = 160
+
+
+def _line_of(content: str, offset: int) -> int:
+    """1-indexed line number for a character offset within content."""
+    return line_number(content, offset)
+
+
+def _line_snippet(content: str, offset: int, *, max_chars: int = _SNIPPET_MAX_CHARS) -> str:
+    """Return the line containing `offset`, stripped and length-capped."""
+    line_start = content.rfind("\n", 0, offset) + 1
+    line_end = content.find("\n", offset)
+    if line_end == -1:
+        line_end = len(content)
+    line = content[line_start:line_end].strip()
+    if len(line) > max_chars:
+        line = line[: max_chars - 1] + "…"
+    return line
+
+
+def _redacted_snippet(
+    content: str, offset: int, literal: str, *, redact: bool = True
+) -> str:
+    """Line snippet with the matched secret masked in place. Evidence text
+    is serialized into report.json, so the raw credential must never survive
+    into it. (Every other credential on the line is masked too, by the
+    evidence redaction in ``models`` — #235.)"""
+    snippet = _line_snippet(content, offset)
+    if redact and literal in snippet:
+        snippet = snippet.replace(literal, _redact_secret(literal))
+    return snippet
+
+
+# Package-manager trees (pnpm, venvs) are full of symlinks; don't list those
+# as scan limitations.
+# Prefix of the limitation recorded for a directory skipped because of an
+# output marker; the diff reads it back to classify vanished findings.
+EXCLUDED_DIR_LIMITATION = "directory skipped (output marker): "
+_NOISY_SYMLINK_PARTS = {"node_modules", ".git", ".venv", "venv", "dist", "build", "__pycache__"}
+
+
+def should_scan(path: Path) -> bool:
+    """``path`` is relative to the scanned root (#215): only directories
+    inside the repo decide whether a file is skipped."""
+    if path.name.startswith("."):
+        return False
+    if in_skipped_dir(path):
+        return False
+    return path.suffix in CODE_EXTENSIONS
+
+
+def should_scan_with_suffixes(path: Path, suffixes: set[str] | None = None) -> bool:
+    if not should_scan(path):
+        return False
+    if suffixes is None:
+        return True
+    return path.suffix in suffixes
+
+
+def _normalize_path(path: str) -> str:
+    """Ensure path is non-empty and starts with a single forward slash.
+
+    This guarantees consistent path output across frameworks: FastAPI, Flask,
+    and Express can all be invoked with or without a leading ``/``, but
+    downstream consumers (path joining, prefix concatenation, attack-surface
+    display) rely on a canonical ``/foo/bar`` shape.
+    """
+    cleaned = (path or "").strip()
+    if not cleaned:
+        return "/"
+    if not cleaned.startswith("/"):
+        cleaned = f"/{cleaned}"
+    # Collapse runs of slashes so ``//a//b`` -> ``/a/b``.
+    while "//" in cleaned:
+        cleaned = cleaned.replace("//", "/")
+    return cleaned
+
+
+def _join_route_parts(prefix: str, path: str) -> str:
+    base = _normalize_path(prefix)
+    suffix = _normalize_path(path)
+
+    if base == "/":
+        return suffix
+    if suffix == "/":
+        return base
+    return f"{base.rstrip('/')}/{suffix.lstrip('/')}"
+
+
+def _extract_methods(args: str, default_method: str = "ANY") -> list[str]:
+    methods = [match.upper() for match in METHOD_LIST_PATTERN.findall(args)]
+    # "ALL" is a non-standard alias sometimes used in API code; normalize it
+    # to the canonical Route(method="ANY") sentinel.
+    methods = ["ANY" if m == "ALL" else m for m in methods]
+    return methods or [default_method]
+
+
+def _python_route_prefixes(content: str) -> dict[str, str]:
+    local_prefixes: dict[str, str] = {}
+
+    for match in FASTAPI_ROUTER_PATTERN.finditer(content):
+        local_prefixes[match.group(1)] = match.group(2) or ""
+
+    for match in FLASK_BLUEPRINT_PATTERN.finditer(content):
+        local_prefixes[match.group(1)] = match.group(2) or ""
+
+    prefixes = dict(local_prefixes)
+    updated = True
+    while updated:
+        updated = False
+
+        for match in FASTAPI_INCLUDE_ROUTER_PATTERN.finditer(content):
+            parent_name, child_name, extra_prefix = match.groups()
+            parent_prefix = prefixes.get(parent_name, "")
+            child_prefix = local_prefixes.get(child_name, "")
+            combined = _join_route_parts(parent_prefix, _join_route_parts(extra_prefix or "", child_prefix))
+            if prefixes.get(child_name) != combined:
+                prefixes[child_name] = combined
+                updated = True
+
+        for match in FLASK_REGISTER_BLUEPRINT_PATTERN.finditer(content):
+            parent_name, child_name, extra_prefix = match.groups()
+            parent_prefix = prefixes.get(parent_name, "")
+            child_prefix = local_prefixes.get(child_name, "")
+            combined = _join_route_parts(parent_prefix, _join_route_parts(extra_prefix or "", child_prefix))
+            if prefixes.get(child_name) != combined:
+                prefixes[child_name] = combined
+                updated = True
+
+    return prefixes
+
+
+def _extract_python_routes(content: str, file: str) -> list[Route]:
+    routes: list[Route] = []
+    prefixes = _python_route_prefixes(content)
+
+    for match in FASTAPI_DECORATOR_PATTERN.finditer(content):
+        router_name, method, route_path = match.groups()
+        routes.append(
+            Route(
+                path=_join_route_parts(prefixes.get(router_name, ""), route_path),
+                method=method.upper(),
+                file=file,
+                line=_line_of(content, match.start()),
+            )
+        )
+
+    for match in FASTAPI_API_ROUTE_PATTERN.finditer(content):
+        router_name, route_path, args = match.group(1), match.group(2), match.group("args")
+        full_path = _join_route_parts(prefixes.get(router_name, ""), route_path)
+        line = _line_of(content, match.start())
+        for method in _extract_methods(args, default_method="ANY"):
+            routes.append(Route(path=full_path, method=method, file=file, line=line))
+
+    for match in FLASK_ROUTE_PATTERN.finditer(content):
+        router_name, route_path, args = match.group(1), match.group(2), match.group("args")
+        line = _line_of(content, match.start())
+        verb_first = ROUTE_VERB_FIRST_ARGS_PATTERN.match(args.lstrip())
+        if route_path.upper() in _ROUTE_VERBS and verb_first is not None:
+            # aiohttp `@routes.route("PATCH", "/x")`: the first string is the
+            # verb and the path comes second — not Flask's `GET /PATCH` (#342).
+            method = "ANY" if route_path == "*" else route_path.upper()
+            full_path = _join_route_parts(prefixes.get(router_name, ""), verb_first.group(1))
+            routes.append(Route(path=full_path, method=method, file=file, line=line))
+            continue
+        full_path = _join_route_parts(prefixes.get(router_name, ""), route_path)
+        for method in _extract_methods(args, default_method="GET"):
+            routes.append(Route(path=full_path, method=method, file=file, line=line))
+
+    return routes
+
+
+def _express_prefixes(content: str) -> dict[str, str]:
+    """Mount prefix of each router: `app.use('/api', apiRouter)` → `/api`,
+    following nested mounts (`api.use('/v1', v1)` → `/api/v1`).
+
+    The first mount of a router wins. A name mounted at several paths
+    (`app.use('/api/auth/*', csrf); app.use('/api/trpc/*', csrf)`, usually
+    middleware) used to make the fixpoint below flip between its mounts
+    forever, hanging the scan; mount cycles grew the prefix forever. Each
+    router now has one mount, self-mounts are skipped, and each name is
+    resolved once by walking its parent links (linear in the number of
+    mounts); the members of a mount cycle get no prefix, since no request
+    path reaches them from the app.
+    """
+    mounts: dict[str, tuple[str, str]] = {}
+    for match in EXPRESS_USE_PATTERN.finditer(content):
+        parent_name, mount_path, child_name = match.groups()
+        if child_name != parent_name:
+            mounts.setdefault(child_name, (parent_name, mount_path))
+
+    prefixes: dict[str, str] = {}
+    for start in mounts:
+        # Walk up to a resolved name, a root, or back into this walk (a cycle).
+        chain: list[str] = []
+        position: dict[str, int] = {}
+        node = start
+        while node in mounts and node not in prefixes:
+            if node in position:
+                for member in chain[position[node]:]:
+                    prefixes[member] = ""
+                del chain[position[node]:]
+                break
+            position[node] = len(chain)
+            chain.append(node)
+            node = mounts[node][0]
+        for name in reversed(chain):
+            parent_name, mount_path = mounts[name]
+            prefixes[name] = _join_route_parts(prefixes.get(parent_name, ""), _join_route_parts(mount_path, ""))
+    return prefixes
+
+
+# Receiver names that identify an Express/Koa-style app or router (so
+# `x.get("s")` is a route registration, not an unrelated method call like
+# `headers.get(...)` / `params.get(...)` / `map.get(...)`). Exact names plus
+# the common `…Router` / `…App` suffixes.
+_ROUTER_RECEIVERS = frozenset(
+    {"app", "application", "router", "route", "routes", "api", "apirouter",
+     "server", "srv", "http", "https", "express", "r", "rt"}
+)
+
+
+def _looks_like_route(receiver: str, raw_path: str) -> bool:
+    """True when `<receiver>.<verb>("<raw_path>")` is plausibly a real HTTP
+    route: either the path is URL-shaped (leading `/` or a `*` wildcard) or the
+    receiver looks like an app/router. Cuts the `xxx.get("config-key")` and
+    `headers.delete("content-type")` false routes (#99)."""
+    if raw_path.startswith("/") or raw_path == "*":
+        return True
+    lower = receiver.lower()
+    return lower in _ROUTER_RECEIVERS or lower.endswith("router") or lower.endswith("app")
+
+
+def _extract_javascript_routes(content: str, file: str) -> list[Route]:
+    routes: list[Route] = []
+    prefixes = _express_prefixes(content)
+
+    for match in EXPRESS_DIRECT_ROUTE_PATTERN.finditer(content):
+        router_name, method, route_path = match.groups()
+        if not _looks_like_route(router_name, route_path):
+            continue
+        method_normalized = method.upper()
+        if method_normalized == "ALL":
+            method_normalized = "ANY"
+        full_path = _join_route_parts(prefixes.get(router_name, ""), route_path)
+        routes.append(
+            Route(
+                path=full_path,
+                method=method_normalized,
+                file=file,
+                line=_line_of(content, match.start()),
+            )
+        )
+
+    for match in EXPRESS_CHAIN_ROUTE_PATTERN.finditer(content):
+        router_name, route_path, chain = match.group(1), match.group(2), match.group("chain")
+        if not _looks_like_route(router_name, route_path):
+            continue
+        full_path = _join_route_parts(prefixes.get(router_name, ""), route_path)
+        chain_offset = match.start("chain")
+        for method_match in re.finditer(r"\.(get|post|put|delete|patch|options|head|all)\s*\(", chain, re.IGNORECASE):
+            method = method_match.group(1).upper()
+            if method == "ALL":
+                method = "ANY"
+            routes.append(
+                Route(
+                    path=full_path,
+                    method=method,
+                    file=file,
+                    line=_line_of(content, chain_offset + method_match.start()),
+                )
+            )
+
+    return routes
+
+
+def _extract_go_routes(content: str, file: str) -> list[Route]:
+    routes: list[Route] = []
+    for match in GO_ROUTE_PATTERN.finditer(content):
+        verb = match.group(1).lower()
+        method = "ANY" if verb in _GO_ANY_METHODS else verb.upper()
+        routes.append(
+            Route(
+                path=match.group(2),
+                method=method,
+                file=file,
+                line=_line_of(content, match.start()),
+            )
+        )
+    return routes
+
+
+def _extract_php_routes(content: str, file: str) -> list[Route]:
+    routes: list[Route] = []
+    for match in PHP_ROUTE_PATTERN.finditer(content):
+        verb = match.group(1).lower()
+        method = "ANY" if verb in _PHP_ANY_METHODS else verb.upper()
+        routes.append(
+            Route(path=match.group(2), method=method, file=file, line=_line_of(content, match.start()))
+        )
+    for match in PHP_SYMFONY_ROUTE_PATTERN.finditer(content):
+        # Symfony attribute/annotation — method lives in `methods:`; default ANY.
+        routes.append(
+            Route(path=match.group(1), method="ANY", file=file, line=_line_of(content, match.start()))
+        )
+    return routes
+
+
+def extract_routes(content: str, file: str, suffix: str) -> list[Route]:
+    if suffix == ".py":
+        return _extract_python_routes(content, file)
+    if suffix in JS_TS_SUFFIXES:
+        return _extract_javascript_routes(content, file)
+    if suffix == ".go":
+        return _extract_go_routes(content, file)
+    if suffix == ".php":
+        return _extract_php_routes(content, file)
+    return []
+
+
+def _append_unique_database_hints(result: ScanResult, relative: str, content: str, lowered: str) -> None:
+    seen = {(hint.kind, hint.file) for hint in result.databases}
+
+    for pattern, kind in DB_PATTERNS:
+        match = pattern.search(content)
+        if match and (kind, relative) not in seen:
+            result.databases.append(
+                DatabaseHint(
+                    kind=kind,
+                    file=relative,
+                    line=_line_of(content, match.start()),
+                    evidence_text=_line_snippet(content, match.start()),
+                )
+            )
+            seen.add((kind, relative))
+
+    for keyword, kind in DB_KEYWORDS.items():
+        idx = lowered.find(keyword)
+        if idx != -1 and (kind, relative) not in seen:
+            result.databases.append(
+                DatabaseHint(
+                    kind=kind,
+                    file=relative,
+                    line=_line_of(content, idx),
+                    evidence_text=_line_snippet(content, idx),
+                )
+            )
+            seen.add((kind, relative))
+
+
+# JWT verification whose call name alone is too generic to trust (#325):
+# middleware called as `jwt({ secret })` counts only in a file that imports
+# express-jwt, koa-jwt or hono's jwt; `<name>.verify(` / `<name>.Parse(` and a
+# bare `verify(` only when the name is bound to jsonwebtoken / golang-jwt by an
+# import (auth_protocol's import patterns, so any alias works and a named
+# `{ decode: verify }` doesn't).
+_JWT_MIDDLEWARE_IMPORT_RE = re.compile(r"""['"](?:express-jwt|koa-jwt|hono/jwt|@hono/[\w-]{0,40}jwt)['"]""")
+_JWT_MIDDLEWARE_CALL_RE = re.compile(r"\b(?:jwt|expressjwt|expressJwt|koaJwt|koajwt)\s*\(\s*\{")
+_NAMED_CALL_SCAN_LIMIT = 50
+_GO_JWT_VERIFY_METHODS = ("Parse(", "ParseWithClaims(")
+
+
+def _call_at(content: str, needle: str, start: int) -> int | None:
+    """First `needle` (a callee ending in `(`) at or after ``start`` that isn't
+    the tail of a longer name or member (`xverify(`, `a.verify(` for `verify(`)."""
+    pos = start
+    for _ in range(_NAMED_CALL_SCAN_LIMIT):
+        pos = content.find(needle, pos)
+        if pos < 0:
+            return None
+        before = content[pos - 1] if pos else ""
+        if not (before.isalnum() or before in "_$."):
+            return pos
+        pos += len(needle)
+    return None
+
+
+def _named_verify_aliases(members: str) -> set[str]:
+    """Local names bound to jsonwebtoken's `verify` in a `{ … }` import list
+    (`verify`, `verify as check`, `verify: check`; not `decode: verify`)."""
+    out: set[str] = set()
+    for part in members.split(","):
+        pieces = part.replace(":", " as ").split(" as ")
+        source = pieces[0].strip()
+        local = pieces[-1].strip() if len(pieces) > 1 else source
+        if source == "verify" and local:
+            out.add(local)
+    return out
+
+
+def _gated_jwt_verification(content: str) -> int | None:
+    """Offset of a JWT verification that only counts with its import (see above)."""
+    if _JWT_MIDDLEWARE_IMPORT_RE.search(content):
+        call = _JWT_MIDDLEWARE_CALL_RE.search(content)
+        if call:
+            return call.start()
+    for imp in _JS_JWT_DEFAULT.finditer(content):
+        name = imp.group(1) or imp.group(2)
+        found = _call_at(content, f"{name}.verify(", imp.end()) if name else None
+        if found is not None:
+            return found
+    for imp in _JS_JWT_NAMED.finditer(content):
+        for name in sorted(_named_verify_aliases(imp.group(1) or imp.group(2) or "")):
+            found = _call_at(content, f"{name}(", imp.end())
+            if found is not None:
+                return found
+    for imp in _GO_JWT.finditer(content):
+        name = (imp.group(1) or "jwt").strip()
+        for method in _GO_JWT_VERIFY_METHODS:
+            found = _call_at(content, f"{name}.{method}", imp.end())
+            if found is not None:
+                return found
+    return None
+
+
+def _append_unique_auth_hints(result: ScanResult, relative: str, content: str, lowered: str) -> None:
+    seen = {(hint.hint, hint.file) for hint in result.auth_hints}
+
+    for pattern, hint in AUTH_PATTERNS:
+        match = pattern.search(content)
+        if match and (hint, relative) not in seen:
+            result.auth_hints.append(
+                AuthHint(
+                    hint=hint,
+                    file=relative,
+                    line=_line_of(content, match.start()),
+                    evidence_text=_line_snippet(content, match.start()),
+                    confidence=0.85,
+                )
+            )
+            seen.add((hint, relative))
+
+    if ("jwt", relative) not in seen:
+        offset = _gated_jwt_verification(content)
+        if offset is not None:
+            result.auth_hints.append(
+                AuthHint(
+                    hint="jwt",
+                    file=relative,
+                    line=_line_of(content, offset),
+                    evidence_text=_line_snippet(content, offset),
+                    confidence=0.85,
+                )
+            )
+            seen.add(("jwt", relative))
+
+    for keyword in AUTH_KEYWORDS:
+        idx = lowered.find(keyword)
+        if idx != -1 and (keyword, relative) not in seen:
+            result.auth_hints.append(
+                AuthHint(
+                    hint=keyword,
+                    file=relative,
+                    line=_line_of(content, idx),
+                    evidence_text=_line_snippet(content, idx),
+                    confidence=0.5,
+                )
+            )
+            seen.add((keyword, relative))
+
+
+def scan_repo(
+    root: str | Path,
+    suffixes: set[str] | None = None,
+    progress: "ScanProgress | None" = None,
+    recall: bool = False,
+) -> ScanResult:
+    """Per-file signal extraction plus the whole-repo passes, for callers that
+    scan a repo directly. ``analyze_repository`` instead runs ``scan_files``
+    per analyzer and ``run_repo_passes`` once on the merged result (#219)."""
+    result = scan_files(root, suffixes=suffixes, progress=progress)
+    run_repo_passes(result, Path(result.root), progress=progress, recall=recall)
+    if progress is not None:
+        progress.done()
+    return result
+
+
+def scan_files(
+    root: str | Path,
+    suffixes: set[str] | None = None,
+    progress: "ScanProgress | None" = None,
+) -> ScanResult:
+    """The per-file pass: routes, calls, hints, secrets and per-file weakness
+    detectors for files with ``suffixes``. No whole-repo passes (#219)."""
+    root_path = Path(root).resolve()
+    result = ScanResult(root=str(root_path))
+
+    # Materialize the scannable file list first so progress has a total to
+    # compute a percentage and ETA against. The extra directory walk is cheap
+    # next to reading + regex-scanning each file.
+    # Symlinks are never followed out of the repo (#234); the ones skipped
+    # are recorded so the report says what wasn't analyzed.
+    def _record_symlink(path: Path) -> None:
+        rel = path.relative_to(root_path)
+        if not any(part in _NOISY_SYMLINK_PARTS for part in rel.parts):
+            result.limitations.append(f"symlink not followed: {rel.as_posix()}")
+
+    def _record_prune(path: Path) -> None:
+        # A directory carrying an output marker is never scanned (#216); say so,
+        # since a committed marker would otherwise hide code silently
+        # (GHSA-j544-8x8g-c3mw).
+        result.limitations.append(f"{EXCLUDED_DIR_LIMITATION}{path.relative_to(root_path).as_posix()}")
+
+    scan_files = []
+    for p in walk_repo(root_path, prune=is_skipped_dir, on_symlink=_record_symlink, on_prune=_record_prune):
+        if not should_scan_with_suffixes(p.relative_to(root_path), suffixes):
+            continue
+        if is_oversized(p):
+            # #236: a multi-MB file is generated or hostile; reading and
+            # regex-scanning it can stall the whole scan.
+            result.limitations.append(
+                f"oversized file skipped (> {max_file_bytes()} bytes): "
+                f"{p.relative_to(root_path).as_posix()}"
+            )
+            continue
+        scan_files.append(p)
+    if progress is not None:
+        progress.begin(len(scan_files))
+
+    csrf_protected = False
+    server_session_store = False
+    for file_path in scan_files:
+        if progress is not None:
+            progress.advance(str(file_path.relative_to(root_path)))
+
+        result.files_scanned += 1
+        language = CODE_EXTENSIONS[file_path.suffix]
+        if language not in result.languages:
+            result.languages.append(language)
+
+        try:
+            content = file_path.read_text(encoding="utf-8")
+        except UnicodeDecodeError:
+            continue
+        except OSError as exc:
+            # An unreadable file (permissions, vanished mid-scan, …) must not
+            # abort the whole scan (#217): skip it and say so in the report.
+            result.limitations.append(
+                f"unreadable file skipped ({type(exc).__name__}): {file_path.relative_to(root_path).as_posix()}"
+            )
+            continue
+
+        relative = str(file_path.relative_to(root_path))
+        # Routes declared in test/spec or vendored files aren't real attack
+        # surface — Laravel/Go/pytest test helpers call `.get('/x')` heavily
+        # (#113). Skip them by default (ATTACKMAP_INCLUDE_TESTS / _VENDORED opt in).
+        if not is_test_file(relative) and not is_vendored_file(relative):
+            file_routes = extract_routes(content, relative, file_path.suffix)
+            result.routes.extend(file_routes)
+
+        for pattern in EXTERNAL_CALL_PATTERNS:
+            for match in pattern.finditer(content):
+                target, method = _external_call_fields(match)
+                result.external_calls.append(
+                    ExternalCall(
+                        target=target,
+                        method=method,
+                        file=relative,
+                        line=_line_of(content, match.start()),
+                        evidence_text=_line_snippet(content, match.start()),
+                    )
+                )
+
+        lowered = content.lower()
+        _append_unique_database_hints(result, relative, content, lowered)
+        _append_unique_auth_hints(result, relative, content, lowered)
+
+        for pattern in SECRET_PATTERNS:
+            for match in pattern.finditer(content):
+                result.secret_hints.append(
+                    SecretHint(
+                        name=match.groups()[0],
+                        file=relative,
+                        line=_line_of(content, match.start()),
+                        evidence_text=_line_snippet(content, match.start()),
+                        kind="env_reference",
+                    )
+                )
+
+        # The keyword-proximity and URL-credential rules (#252) are skipped in
+        # test/vendored code, where fake credential fixtures are the norm.
+        first_party = not is_test_file(relative) and not is_vendored_file(relative)
+        # The high-entropy fallback is a guess, and test fixtures are full of
+        # random-looking ids and hashes (#385). Provider-shaped credentials
+        # (AWS keys, PEM blocks, verified JWTs, …) are still reported there.
+        _append_hardcoded_secret_hints(
+            result, relative, content, entropy=first_party, generic=first_party, urls=first_party
+        )
+
+        # The weakness passes below are noise in test scaffolding (#67) and in
+        # vendored/minified third-party code (#95) — a bug in a dependency the
+        # project doesn't maintain isn't this repo's finding. Skip both by
+        # default (ATTACKMAP_INCLUDE_TESTS / ATTACKMAP_INCLUDE_VENDORED opt in).
+        if not is_test_file(relative) and not is_vendored_file(relative):
+            # Insecure crypto / weak randomness (#70). Content is already
+            # read, so this rides the per-file pass rather than re-walking.
+            result.crypto_weaknesses.extend(find_crypto_weaknesses(content, relative))
+            # Web-hardening gaps (#71): CORS, CSRF, cookies, CSP, debug.
+            result.web_hardening_issues.extend(find_web_hardening_issues(content, relative))
+            csrf_protected = csrf_protected or has_csrf_protection(content)
+            # Novel vuln classes (#77): proto pollution, mass assignment, JWT, XXE.
+            result.code_weaknesses.extend(find_code_weaknesses(content, relative))
+            # JWT verification (#243): library-aware checks, plus the
+            # `jwt_verified` hint that credits the "JWT verification" control.
+            jwt_weaknesses, jwt_verified = find_jwt_issues(content, relative)
+            result.code_weaknesses.extend(jwt_weaknesses)
+            result.auth_hints.extend(jwt_verified)
+            # OAuth clients and sessions (#243, part 2).
+            oauth_session, file_server_store = find_oauth_session_issues(content, relative)
+            result.code_weaknesses.extend(oauth_session)
+            server_session_store = server_session_store or file_server_store
+
+    if not server_session_store:
+        # Session fixation needs a server-side session id; with cookie
+        # sessions (cookie-session) there is none to fix. PHP's $_SESSION is
+        # always server-side.
+        result.code_weaknesses = [
+            w for w in result.code_weaknesses
+            if not (w.kind == "session_fixation" and PurePosixPath(w.file).suffix.lower() in JS_TS_SUFFIXES)
+        ]
+    if csrf_protected:
+        # A CSRF defence anywhere in the repo (#244) — session config and CSRF
+        # middleware often live in different files — clears the inference.
+        result.web_hardening_issues = [
+            i for i in result.web_hardening_issues if i.kind != "csrf_unprotected_session"
+        ]
+    result.languages.sort()
+    return result
+
+
+def run_repo_passes(
+    result: ScanResult,
+    root_path: Path,
+    progress: "ScanProgress | None" = None,
+    recall: bool = False,
+) -> ScanResult:
+    """Whole-repo passes over an assembled result — run once per scan, after
+    every analyzer's per-file output is merged, so taint/authz/anomalies see
+    the full route set (#219)."""
+    # Taint pass runs after regular signal extraction — it needs the
+    # route list to know where to seed source flows from (#45). This is the
+    # slow tail on big monorepos (import-graph walk), so it gets its own
+    # progress stage.
+    if progress is not None:
+        progress.stage("Taint / data-flow analysis")
+    result.taint_chains = result.taint_chains + analyze_taint(
+        result, root_path, recall=recall_config() if recall else DEFAULT_RECALL
+    )
+    # SBOM inventory: direct-dep parse of manifest files (#48, slice 1).
+    if progress is not None:
+        progress.stage("Dependency inventory (SBOM)")
+    result.dependencies = result.dependencies + analyze_sbom(root_path)
+    # Supply-chain risk beyond CVEs (#247): offline, over the same manifests.
+    if progress is not None:
+        progress.stage("Dependency supply-chain risk")
+    result.supply_chain_issues = result.supply_chain_issues + scan_supply_chain(
+        root_path, result.dependencies
+    )
+    # CI workflow security (#142): parse .github/workflows for unpinned actions,
+    # pull_request_target checkouts, secrets/injectable context in run steps,
+    # over-broad permissions, and self-hosted runners on PR triggers.
+    if progress is not None:
+        progress.stage("CI workflow security")
+    result.workflow_issues = result.workflow_issues + scan_workflows(root_path)
+    # BOLA/IDOR: routes with an id param reaching a datastore with no
+    # ownership check nearby (#69). Runs after taint so it can reuse
+    # sql_execute reachability.
+    if progress is not None:
+        progress.stage("Authorization (BOLA/IDOR)")
+    result.authz_candidates = result.authz_candidates + analyze_authz(result, root_path)
+    # Field-level mass assignment (#242): binders and models live in
+    # different files, so this can't ride the per-file weakness pass.
+    result.code_weaknesses = result.code_weaknesses + analyze_mass_assignment(root_path)
+    # Spring Security `csrf_disabled` in Java/Kotlin config (#341): the
+    # per-file pass doesn't read JVM sources.
+    seen = {(i.kind, i.file, i.line) for i in result.web_hardening_issues}
+    result.web_hardening_issues = result.web_hardening_issues + [
+        i for i in find_jvm_csrf_disabled(root_path) if (i.kind, i.file, i.line) not in seen
+    ]
+    # Anomaly / outlier pass (#78): the odd-one-out among sibling routes.
+    # Runs last so the full route list is assembled into cohorts. It drives its
+    # own determinate per-cohort progress (the slow tail on big route surfaces).
+    result.anomalies = result.anomalies + find_anomalies(result, root_path, progress=progress)
+    return result
+
+
+def _redact_secret(value: str) -> str:
+    """Display form of a secret: at most its first 4 characters (#235)."""
+    return mask_secret(value)
+
+
+def _shannon_entropy(value: str) -> float:
+    if not value:
+        return 0.0
+    frequencies: dict[str, int] = {}
+    for ch in value:
+        frequencies[ch] = frequencies.get(ch, 0) + 1
+    length = len(value)
+    entropy = 0.0
+    for count in frequencies.values():
+        p = count / length
+        entropy -= p * math.log2(p)
+    return entropy
+
+
+# Multiformat content identifiers: CIDv1 in base32 (multibase `b`, version 1
+# → `baf…`/`bag…`) and CIDv0 (46-char base58btc starting `Qm`).
+_CID_RE = re.compile(r"ba[fg][a-z2-7]{50,120}$|Qm[1-9A-HJ-NP-Za-km-z]{44}$")
+
+
+def _looks_like_secret_candidate(value: str) -> bool:
+    """Reject obvious non-secret shapes that would otherwise clear the
+    entropy bar (hex hashes in comments, URLs, etc.)."""
+    if len(value) < _ENTROPY_MIN_LENGTH or len(value) > _ENTROPY_MAX_LENGTH:
+        return False
+    if all(c in "0123456789abcdef" for c in value.lower()):
+        # Pure hex — commit SHAs, hashes. Not a secret in code.
+        return False
+    if _is_integrity_digest(value):
+        # Subresource-integrity / lockfile integrity digests
+        # (`sha384-…`, `sha512-…`). High-entropy base64, but they are
+        # published fingerprints of public assets, not secrets (#141). The
+        # body is verified as a correct-length base64 digest so a real
+        # credential that merely starts with `sha256-` is not suppressed.
+        return False
+    if _UUID_RE.match(value):
+        # Canonical UUID — an identifier, not a credential.
+        return False
+    if _CID_RE.match(value):
+        # An IPLD/IPFS content identifier (`bafy…`, `bafk…`, `bafyrei…`,
+        # CIDv0 `Qm…`): a public content hash, not a credential (#385).
+        return False
+    if "/" in value and value.count("/") > 2:
+        # Looks like a URL path fragment.
+        return False
+    if value.startswith(("http://", "https://", "data:", "file:")):
+        return False
+    if value.replace(".", "").replace("-", "").replace("_", "").isdigit():
+        # Version strings, phone numbers, etc.
+        return False
+    return True
+
+
+# --- #252: prefix-less credentials ----------------------------------------
+
+# Credentials embedded in a URL (`https://user:pass@host`). Kept out of the
+# redaction token list: `redact._URI_USERINFO` already masks userinfo.
+_BASIC_AUTH_URL_RE = re.compile(
+    r"\b(?P<scheme>[a-zA-Z][a-zA-Z0-9+.-]{1,15})://[^\s:/@'\"]{1,128}:(?P<secret>[^\s/@'\"]{3,256})@[A-Za-z0-9.\[-]"
+)
+# Keyword-proximity assignment of a quoted literal to a credential-named key.
+_CREDENTIAL_ASSIGN_RE = re.compile(
+    r"(?<![\w.-])(?P<key>[\w.-]{0,40}?(?:password|passwd|pwd|secret|token|api[_-]?key)[\w.-]{0,40}?)['\"]?"
+    r"\s{0,5}(?::=|=>|[:=])\s{0,5}(?P<q>['\"])(?P<secret>[^'\"\s]{8,128})(?P=q)",
+    re.IGNORECASE,
+)
+# GCP service-account key file: the type marker plus an embedded private key.
+_GCP_SA_TYPE_RE = re.compile(r"\"type\"\s{0,5}:\s{0,5}\"service_account\"")
+_GCP_SA_KEY_RE = re.compile(r"\"private_key\"\s{0,5}:\s{0,5}\"(?P<secret>-----BEGIN [A-Z ]{0,20}PRIVATE KEY-----[^\"]{0,8000})\"")
+
+# Values that are placeholders, templates or references, not credentials.
+_PLACEHOLDER_WORDS = (
+    "changeme", "change_me", "change-me", "example", "placeholder", "dummy", "sample", "your_", "your-",
+    "yourpass", "xxxx", "redacted", "replace", "secret_here", "token_here", "password_here", "insert",
+    "fake", "mock",
+)
+_PLACEHOLDER_EXACT = frozenset({
+    "password", "passwd", "secret", "token", "apikey", "api_key", "api-key", "pass", "none", "null",
+    "undefined", "test", "testing", "default", "notasecret",
+})
+# Key names that carry a secret's *metadata*, not the secret.
+_NON_SECRET_KEY_PARTS = (
+    "name", "field", "header", "param", "type", "url", "uri", "path", "file", "_id", "env", "var",
+    "label", "prompt", "length", "regex", "pattern", "prefix", "endpoint", "hash", "policy",
+    "expir", "ttl", "count", "format", "placeholder", "message", "error", "hint", "reset", "column",
+    "table", "kind", "mode", "style", "class", "selector", "route", "template", "strength", "rule",
+)
+_IDENTIFIER_VALUE_RE = re.compile(
+    r"^(?:[a-z][a-z0-9]*(?:[_-][a-z0-9]+)+|[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+|[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)+|[a-z]+(?:[A-Z][a-z0-9]+)+)$"
+)
+
+
+def is_placeholder_secret(value: str) -> bool:
+    """A credential-shaped value that is a placeholder, template, env lookup
+    or masked value rather than a real secret."""
+    trimmed = value.strip()
+    lowered = trimmed.lower()
+    if not trimmed or lowered in _PLACEHOLDER_EXACT:
+        return True
+    if trimmed.startswith(("${", "{{", "<", "%(", "$", "%", "#{", "@{")) or trimmed.endswith(("}", ">")):
+        return True
+    if any(word in lowered for word in _PLACEHOLDER_WORDS):
+        return True
+    if len(set(trimmed)) <= 2 or "***" in trimmed or "…" in trimmed:
+        return True
+    return False
+
+
+def _credential_assignment_ok(key: str, value: str) -> bool:
+    key_l = key.lower()
+    if any(part in key_l for part in _NON_SECRET_KEY_PARTS):
+        return False
+    if is_placeholder_secret(value) or value.lower() == key_l:
+        return False
+    if _IDENTIFIER_VALUE_RE.match(value):
+        return False  # an identifier / env-var name / dotted reference
+    if "/" in value or "://" in value or value.startswith(("http", ".")):
+        return False
+    if value.replace(".", "").replace("-", "").replace("_", "").isdigit():
+        return False
+    return True
+
+
+def iter_secret_matches(
+    content: str, *, entropy: bool = True, generic: bool = True, urls: bool = True
+):
+    """Yield ``(kind, literal, offset, confidence)`` for every hard-coded
+    credential in ``content``: provider patterns, URL userinfo passwords,
+    GCP service-account keys, then (opt.) the keyword-proximity assignment
+    and the high-entropy fallback. ``literal`` is the raw secret — callers
+    must mask it before it leaves the process (#235)."""
+    matched_spans: list[tuple[int, int]] = []
+
+    def _overlaps(start: int, end: int) -> bool:
+        return any(s < end and start < e for s, e in matched_spans)
+
+    # A GCP service-account key file is reported as such, not as a bare PEM.
+    if _GCP_SA_TYPE_RE.search(content):
+        key = _GCP_SA_KEY_RE.search(content)
+        if key:
+            matched_spans.append((key.start("secret"), key.end("secret")))
+            yield "gcp_service_account_key", key.group("secret"), key.start(), 1.0
+
+    for pattern, kind in HARDCODED_SECRET_PATTERNS:
+        for match in pattern.finditer(content):
+            literal = match.group(1)
+            if kind == "pem_private_key" and _overlaps(match.start(1), match.end(1)):
+                continue
+            # JWT shape needs additional verification — the base-64 header
+            # segment must decode to something starting with `{` and
+            # containing an "alg" key.
+            if kind == "jwt" and not _is_jwt_shape(literal):
+                continue
+            if kind in {"npm_auth_token", "npm_basic_auth", "docker_registry_auth"} and is_placeholder_secret(literal):
+                continue
+            matched_spans.append((match.start(1), match.end(1)))
+            yield kind, literal, match.start(), 1.0
+
+    for match in (_BASIC_AUTH_URL_RE.finditer(content) if urls else ()):
+        literal = match.group("secret")
+        if is_placeholder_secret(literal) or _overlaps(match.start("secret"), match.end("secret")):
+            continue
+        host = content[match.end("secret") + 1 : match.end("secret") + 64].split("/", 1)[0].split(":", 1)[0]
+        if host.lower() in {"localhost", "127.0.0.1", "0.0.0.0", "[::1]"}:
+            continue  # a local dev DSN
+        matched_spans.append((match.start("secret"), match.end("secret")))
+        yield "basic_auth_url", literal, match.start("secret"), 0.9
+
+    # High-entropy fallback — only where no stronger match already fired.
+    for match in (_QUOTED_LITERAL.finditer(content) if entropy else ()):
+        literal = match.group(1)
+        pos = match.start(1)
+        if _overlaps(pos, match.end(1)):
+            continue
+        if not _looks_like_secret_candidate(literal):
+            continue
+        if _looks_like_charset(literal):
+            continue  # base64/base32/hex alphabet constant, not a secret (#96)
+        if _shannon_entropy(literal) < _ENTROPY_THRESHOLD:
+            continue
+        matched_spans.append((pos, match.end(1)))
+        yield "high_entropy", literal, pos, 0.7
+
+    if generic:
+        for match in _CREDENTIAL_ASSIGN_RE.finditer(content):
+            literal = match.group("secret")
+            if _overlaps(match.start("secret"), match.end("secret")):
+                continue
+            if not _credential_assignment_ok(match.group("key"), literal):
+                continue
+            matched_spans.append((match.start("secret"), match.end("secret")))
+            yield "credential_assignment", literal, match.start("secret"), 0.5
+
+
+def _append_hardcoded_secret_hints(
+    result: ScanResult, relative: str, content: str, *, entropy: bool = True, generic: bool = True,
+    urls: bool = True,
+) -> None:
+    """Emit SecretHint records for literals pasted into source or config
+    (#39, #252). Every value is redacted before it lands in a hint."""
+    seen: set[tuple[str, str, int]] = {
+        (hint.kind, hint.file, hint.line or 0) for hint in result.secret_hints
+    }
+    # A line that already carries a secret hint (e.g. a config DB URL
+    # password) doesn't get a second, weaker one.
+    lines_with_hint = {hint.line for hint in result.secret_hints if hint.file == relative}
+    for kind, literal, offset, confidence in iter_secret_matches(content, entropy=entropy, generic=generic, urls=urls):
+        line = _line_of(content, offset)
+        key = (kind, relative, line)
+        if key in seen or (confidence < 1.0 and line in lines_with_hint):
+            continue
+        seen.add(key)
+        lines_with_hint.add(line)
+        # PEM only captures the (non-secret) header line — keep it verbatim.
+        # Everything else is redacted in both the name *and* the evidence
+        # snippet so the raw credential never reaches report.json.
+        redact = kind != "pem_private_key"
+        result.secret_hints.append(
+            SecretHint(
+                name=_redact_secret(literal) if redact else literal,
+                file=relative,
+                line=line,
+                evidence_text=_redacted_snippet(content, offset, literal, redact=redact),
+                confidence=confidence,
+                kind=kind,
+            )
+        )
+
+
+# Sequential alphabet runs that mark a well-known charset/alphabet constant
+# (base64/base32/base16 digit strings) — high-entropy but not a secret (#96).
+_CHARSET_MARKERS = (
+    "abcdefghijklmnop",  # lowercase alphabet run (base64/base32/base36)
+    "ABCDEFGHIJKLMNOP",  # uppercase alphabet run
+    "0123456789abcdef",  # lower hex
+    "0123456789ABCDEF",  # upper hex
+)
+
+
+def _looks_like_charset(value: str) -> bool:
+    return any(marker in value for marker in _CHARSET_MARKERS)
+
+
+# Integrity-digest algorithms (Subresource Integrity, lockfile `integrity`
+# fields) and their raw digest byte-lengths. These are high-entropy base64
+# but are public asset fingerprints, not credentials.
+_INTEGRITY_DIGEST_BYTES = {"md5": 16, "sha1": 20, "sha256": 32, "sha384": 48, "sha512": 64}
+
+
+def _is_integrity_digest(value: str) -> bool:
+    """True if ``value`` is an `<algo>-<base64>` integrity digest whose body
+    decodes to the algorithm's expected length. Length-checking the body
+    keeps a genuine secret that merely starts with `sha256-` from being
+    suppressed as if it were a public fingerprint."""
+    algo, sep, body = value.partition("-")
+    if not sep:
+        return False
+    expected = _INTEGRITY_DIGEST_BYTES.get(algo.lower())
+    if expected is None or not body:
+        return False
+    stripped = body.rstrip("=")
+    padding = "=" * ((4 - len(stripped) % 4) % 4)
+    try:
+        decoded = base64.b64decode(stripped + padding, validate=True)
+    except (ValueError, binascii.Error):
+        return False
+    return len(decoded) == expected
+
+
+# Canonical UUID (8-4-4-4-12 hex). An identifier, not a credential.
+_UUID_RE = re.compile(
+    r"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-"
+    r"[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
+)
+
+
+def _is_jwt_shape(literal: str) -> bool:
+    """Verify the header segment of a candidate JWT decodes to a JSON
+    object with an `alg` field. Cheap and precise enough to keep the
+    shape regex from spamming."""
+    parts = literal.split(".")
+    if len(parts) != 3:
+        return False
+    header_b64 = parts[0]
+    # base64url decode with padding tolerance
+    padding = "=" * ((4 - len(header_b64) % 4) % 4)
+    try:
+        header_bytes = base64.urlsafe_b64decode(header_b64 + padding)
+    except (ValueError, binascii.Error):
+        return False
+    try:
+        header_text = header_bytes.decode("utf-8")
+    except UnicodeDecodeError:
+        return False
+    if not header_text.startswith("{") or "alg" not in header_text.lower():
+        return False
+    return True