codejury 0.11.0__tar.gz → 0.12.0__tar.gz

codejury-0.12.0/PKG-INFO

@@ -0,0 +1,102 @@
+Metadata-Version: 2.4
+Name: codejury
+Version: 0.12.0
+Summary: AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules
+Author: AISecLabs
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/aiseclabs/codejury
+Project-URL: Repository, https://github.com/aiseclabs/codejury
+Keywords: security,appsec,static analysis,llm,owasp,asvs,code review
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pyyaml>=6.0
+Provides-Extra: anthropic
+Requires-Dist: anthropic>=0.40; extra == "anthropic"
+Provides-Extra: openai
+Requires-Dist: openai>=1.0; extra == "openai"
+Provides-Extra: litellm
+Requires-Dist: litellm>=1.0; extra == "litellm"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: jsonschema>=4.0; extra == "dev"
+Dynamic: license-file
+
+# codejury
+
+AI code security review, in two paths matched to their nature:
+
+- **Diff review** (coded): audit a pull request's diff for newly introduced,
+  exploitable risks. A single balanced LLM call, or an adversarial
+  Finder/Challenger/Judge pass for higher coverage and fewer false positives.
+- **Whole-repo review** (agent-driven): a methodology an interactive agent
+  (Claude Code, Codex) runs to traverse a codebase from its API entrypoints,
+  verify issues with a real PoC, and iterate over rounds with a persistent
+  memory. Too large for a single LLM call, so codejury ships the methodology and
+  scaffolds the workspace rather than running a pipeline.
+
+Security knowledge lives in **rich rules** (`codejury/data/rules/*.md`, with
+per-language vulnerable/secure examples), injected into the audit prompt, not
+buried in code.
+
+## Install
+
+```bash
+pip install codejury                 # core
+pip install "codejury[anthropic]"    # or [openai] / [litellm] for a backend
+```
+
+## Diff review
+
+```bash
+# audit a diff file
+codejury audit --diff-file changes.diff
+
+# audit a git range in a repo
+codejury audit --repo /path/to/app --git-range origin/main...HEAD
+
+# from stdin
+git diff HEAD~1 | codejury audit
+
+# adversarial mode: Finder + Challenger + Judge (higher coverage, lower FP, ~3x cost)
+codejury audit --diff-file changes.diff --mode adversarial
+
+# CI gate + SARIF
+codejury audit --diff-file changes.diff --format sarif --fail-on high
+```
+
+Configure a backend with `--provider`/`--model`/`--api-key`/`--api-base` or the
+`CODEJURY_API_KEY` / `CODEJURY_MODEL` / `CODEJURY_API_BASE` environment variables.
+`codejury dry-run` exercises the engine with a mock provider and no key.
+
+## Whole-repo review
+
+```bash
+codejury full-review /path/to/your/repo
+```
+
+This scaffolds a review workspace (`api/`, `issues/`, `analysis/`, and a
+`security-review-memory.md`), seeds the API inventory from a deterministic scan,
+and prints the methodology. Run it with an interactive agent: it reads the
+methodology and the rules, traverses the code from its API entrypoints, records
+high-confidence issues with a PoC, and asks you to confirm credentials or false
+positives along the way. Nothing runs against production.
+
+## Findings
+
+Each finding carries a file and line, a severity and category, a concrete
+exploit scenario, a recommendation, and a confidence. A false-positive filter
+drops test/mock-path and low-confidence noise; the model is also told not to
+report dependency CVEs, style notes, speculation, or config-leak-only risks.
+
+## Extending
+
+Add a vulnerability class by dropping a new `codejury/data/rules/<class>.md` with
+the standard frontmatter (title, impact, tags, triggers) and vulnerable/secure
+examples. It is data; no code change needed.

codejury-0.12.0/README.md

@@ -0,0 +1,72 @@
+# codejury
+
+AI code security review, in two paths matched to their nature:
+
+- **Diff review** (coded): audit a pull request's diff for newly introduced,
+  exploitable risks. A single balanced LLM call, or an adversarial
+  Finder/Challenger/Judge pass for higher coverage and fewer false positives.
+- **Whole-repo review** (agent-driven): a methodology an interactive agent
+  (Claude Code, Codex) runs to traverse a codebase from its API entrypoints,
+  verify issues with a real PoC, and iterate over rounds with a persistent
+  memory. Too large for a single LLM call, so codejury ships the methodology and
+  scaffolds the workspace rather than running a pipeline.
+
+Security knowledge lives in **rich rules** (`codejury/data/rules/*.md`, with
+per-language vulnerable/secure examples), injected into the audit prompt, not
+buried in code.
+
+## Install
+
+```bash
+pip install codejury                 # core
+pip install "codejury[anthropic]"    # or [openai] / [litellm] for a backend
+```
+
+## Diff review
+
+```bash
+# audit a diff file
+codejury audit --diff-file changes.diff
+
+# audit a git range in a repo
+codejury audit --repo /path/to/app --git-range origin/main...HEAD
+
+# from stdin
+git diff HEAD~1 | codejury audit
+
+# adversarial mode: Finder + Challenger + Judge (higher coverage, lower FP, ~3x cost)
+codejury audit --diff-file changes.diff --mode adversarial
+
+# CI gate + SARIF
+codejury audit --diff-file changes.diff --format sarif --fail-on high
+```
+
+Configure a backend with `--provider`/`--model`/`--api-key`/`--api-base` or the
+`CODEJURY_API_KEY` / `CODEJURY_MODEL` / `CODEJURY_API_BASE` environment variables.
+`codejury dry-run` exercises the engine with a mock provider and no key.
+
+## Whole-repo review
+
+```bash
+codejury full-review /path/to/your/repo
+```
+
+This scaffolds a review workspace (`api/`, `issues/`, `analysis/`, and a
+`security-review-memory.md`), seeds the API inventory from a deterministic scan,
+and prints the methodology. Run it with an interactive agent: it reads the
+methodology and the rules, traverses the code from its API entrypoints, records
+high-confidence issues with a PoC, and asks you to confirm credentials or false
+positives along the way. Nothing runs against production.
+
+## Findings
+
+Each finding carries a file and line, a severity and category, a concrete
+exploit scenario, a recommendation, and a confidence. A false-positive filter
+drops test/mock-path and low-confidence noise; the model is also told not to
+report dependency CVEs, style notes, speculation, or config-leak-only risks.
+
+## Extending
+
+Add a vulnerability class by dropping a new `codejury/data/rules/<class>.md` with
+the standard frontmatter (title, impact, tags, triggers) and vulnerable/secure
+examples. It is data; no code change needed.

codejury-0.12.0/codejury/__init__.py

@@ -0,0 +1,14 @@
+"""codejury: an AI code security review tool.
+
+Two paths matched to their nature: a coded diff-audit engine (standard single
+call or adversarial Finder/Challenger/Judge), and a whole-repo review run as a
+methodology by an interactive agent. Security knowledge lives in rich markdown
+rules (data/rules) injected into the audit prompt, not in a rendered schema.
+"""
+
+from importlib.metadata import PackageNotFoundError, version
+
+try:
+    __version__ = version("codejury")
+except PackageNotFoundError:  # running from a source tree without an install
+    __version__ = "0.0.0"

{codejury-0.11.0 → codejury-0.12.0}/codejury/analysis/repo_model.py

@@ -51,12 +51,30 @@ def load_entrypoint_signatures(path: str | Path = ENTRYPOINTS_FILE) -> _Signatur
     return _Signatures(decorators=tuple(data.get("decorators", [])), calls=tuple(data.get("calls", [])))
 
 
-def build_repo_model_from_dir(root: str | Path, *, signatures: _Signatures | None = None) -> RepoModel:
-    """Build a RepoModel by reading a directory. Reuses RepoSource's safe walk."""
-    from codejury.sources.repo import RepoSource
+_SKIP_DIRS = frozenset({".git", ".venv", "venv", "node_modules", "__pycache__", ".mypy_cache", ".pytest_cache"})
+
+
+def _read_python_files(root: Path) -> dict[str, str]:
+    """{relative path: content} for .py files under root, skipping noise dirs and
+    symlinks that escape the tree."""
+    root = root.resolve()
+    files: dict[str, str] = {}
+    for path in root.rglob("*.py"):
+        rel = path.relative_to(root)
+        if any(part in _SKIP_DIRS for part in rel.parts):
+            continue
+        try:
+            if not path.resolve().is_relative_to(root):
+                continue  # symlink escaping the tree
+            files[str(rel)] = path.read_text(encoding="utf-8")
+        except (OSError, UnicodeDecodeError, ValueError):
+            continue
+    return files
 
-    files = RepoSource(root, extensions=(".py",)).read_files()
-    return build_repo_model(root, files, signatures=signatures)
+
+def build_repo_model_from_dir(root: str | Path, *, signatures: _Signatures | None = None) -> RepoModel:
+    """Build a RepoModel by reading the .py files under a directory."""
+    return build_repo_model(root, _read_python_files(Path(root)), signatures=signatures)
 
 
 def build_repo_model(root: str | Path, files: dict[str, str], *, signatures: _Signatures | None = None) -> RepoModel:

codejury-0.12.0/codejury/cli.py

@@ -0,0 +1,142 @@
+"""codejury CLI.
+
+Two entry points matched to their nature:
+
+- ``audit`` runs the coded diff engine over a unified diff: a single balanced
+  call (standard) or the adversarial Finder/Challenger/Judge pass.
+- ``full-review`` scaffolds a workspace and prints the methodology for an
+  interactive agent to run a whole-repo review (it does not run an LLM pipeline,
+  which a single call cannot do for a whole codebase).
+
+``dry-run`` exercises the diff engine with a mock provider and no API key.
+"""
+
+from __future__ import annotations
+
+import argparse
+import subprocess
+import sys
+
+from codejury.diff.debate import AdversarialAuditRunner
+from codejury.diff.engine import AuditRunner
+from codejury.diff.findings_filter import FindingsFilter
+from codejury.diff.report import gate, render
+from codejury.domain.finding import Finding
+from codejury.fullreview.scaffold import scaffold
+from codejury.providers.factory import (
+    DEFAULT_API_BASE,
+    DEFAULT_API_KEY,
+    DEFAULT_MODEL,
+    PROVIDERS,
+    make_provider,
+)
+from codejury.providers.mock import MockProvider
+
+_FORMATS = ("text", "markdown", "json", "sarif")
+_FAIL_ON = ("critical", "high", "medium", "low")
+
+
+def audit_diff(
+    diff: str,
+    *,
+    provider,
+    model: str,
+    mode: str = "standard",
+    max_rounds: int = 3,
+    filter_findings: bool = True,
+) -> tuple[list[Finding], list[tuple[Finding, str]]]:
+    """Audit a diff and return (kept findings, dropped (finding, reason))."""
+    if mode == "adversarial":
+        findings = AdversarialAuditRunner(provider=provider, model=model).run(diff, max_rounds=max_rounds).findings
+    else:
+        findings = AuditRunner(provider=provider, model=model).run(diff)
+    if filter_findings:
+        return FindingsFilter().filter(findings)
+    return findings, []
+
+
+def _read_diff(args) -> str:
+    if args.diff_file:
+        with open(args.diff_file, encoding="utf-8") as f:
+            return f.read()
+    if args.git_range:
+        return subprocess.run(
+            ["git", "-C", args.repo or ".", "diff", args.git_range],
+            capture_output=True, text=True, check=True,
+        ).stdout
+    return sys.stdin.read()
+
+
+def _dry_run_diff() -> str:
+    return "+++ b/app.py\n@@ -0,0 +1 @@\n+cursor.execute('SELECT * FROM u WHERE n=' + name)\n"
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(prog="codejury")
+    sub = parser.add_subparsers(dest="command")
+
+    sub.add_parser("dry-run", help="run the diff engine with a mock provider, no key")
+
+    a = sub.add_parser("audit", help="audit a unified diff for security findings")
+    a.add_argument("--diff-file", default=None, help="unified diff file (default: read stdin)")
+    a.add_argument("--repo", default=None, help="repo path for --git-range")
+    a.add_argument("--git-range", default=None, help="git range to diff, e.g. origin/main...HEAD")
+    a.add_argument("--mode", choices=("standard", "adversarial"), default="standard")
+    a.add_argument("--rounds", type=int, default=3, help="adversarial debate rounds")
+    a.add_argument("--provider", choices=PROVIDERS, default="anthropic")
+    a.add_argument("--model", default=DEFAULT_MODEL)
+    a.add_argument("--api-base", default=DEFAULT_API_BASE)
+    a.add_argument("--api-key", default=DEFAULT_API_KEY)
+    a.add_argument("--retries", type=int, default=0)
+    a.add_argument("--format", choices=_FORMATS, default="text", dest="fmt")
+    a.add_argument("--no-filter", action="store_true", help="skip the false-positive filter")
+    a.add_argument("--fail-on", choices=_FAIL_ON, default=None, dest="fail_on")
+
+    fr = sub.add_parser("full-review", help="scaffold a whole-repo review for an interactive agent")
+    fr.add_argument("directory", help="target repository to review")
+    fr.add_argument("--workspace", default="codejury-review", help="where to create the review workspace")
+
+    args = parser.parse_args(argv)
+    try:
+        return _dispatch(args, parser)
+    except Exception as exc:
+        print(f"{args.command or 'codejury'} failed: {exc}", file=sys.stderr)
+        return 1
+
+
+def _dispatch(args, parser) -> int:
+    if args.command == "audit":
+        provider = make_provider(args.provider, api_key=args.api_key, api_base=args.api_base, retries=args.retries)
+        kept, _ = audit_diff(
+            _read_diff(args), provider=provider, model=args.model,
+            mode=args.mode, max_rounds=args.rounds, filter_findings=not args.no_filter,
+        )
+        print(render(args.fmt, kept))
+        return 1 if gate(kept, args.fail_on) else 0
+
+    if args.command == "full-review":
+        res = scaffold(args.directory, args.workspace)
+        print(f"Workspace: {res.workspace}", file=sys.stderr)
+        print(f"Seeded {res.entrypoints} entrypoints into {res.workspace}/api/_entrypoints.md", file=sys.stderr)
+        print(f"Memory: {res.memory_path}", file=sys.stderr)
+        print("\nRun this review with an interactive agent (Claude Code / Codex) using the methodology below.\n")
+        print(res.methodology)
+        return 0
+
+    if args.command in (None, "dry-run"):
+        kept, _ = audit_diff(
+            _dry_run_diff(),
+            provider=MockProvider(default='{"findings": [{"file": "app.py", "line": 1, "severity": "HIGH", '
+                                          '"category": "sql_injection", "description": "[mock] no backend called", '
+                                          '"confidence": 0.9}]}'),
+            model="mock",
+        )
+        print(render("text", kept))
+        return 0
+
+    parser.print_help()
+    return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

codejury-0.12.0/codejury/data/agent/full-review.md

@@ -0,0 +1,102 @@
+# Full Security Review — Agent Methodology
+
+A whole-repository security audit, run by an interactive coding agent (Claude
+Code, Codex, etc.), not a one-shot LLM call. It traverses the codebase from its
+API entrypoints, reasons across files, verifies issues with a real PoC, and
+iterates over multiple rounds with a persistent memory. One round is roughly
+30 minutes; run as many rounds as needed.
+
+Target repository: the directory you were given.
+Workspace: `<workspace>/<project>/` (created for you), holding `api/`,
+`issues/`, `analysis/`, and `security-review-memory.md`.
+
+---
+
+## On start (do this first)
+
+1. Read `security-review-memory.md` in the workspace if it exists:
+   - skip every pattern under "Confirmed false positives";
+   - do not re-report anything under "Fixed";
+   - weight the files under "High-risk areas" more heavily.
+2. Read `api/_entrypoints.md` (seeded for you from a deterministic scan) as the
+   starting map of HTTP routes and CLI commands.
+3. Read the relevant rule files under the shipped `rules/` for the target's stack
+   (sql-injection, idor, ssrf, authentication-jwt, insecure-deserialization, ...).
+
+## Analysis
+
+Start from the API entrypoints and read the implementation of each one. For every
+endpoint ask:
+
+- What inputs can the attacker control?
+- Is authentication, authorization, signature verification, tenant isolation, or
+  a business-state check bypassed or missing?
+- IDOR: can a user reach another user's, tenant's, or service's resource by a
+  supplied id?
+- Do privileged operations (payment, signing, approval, state change) allow state
+  bypass or replay (no nonce / time window)?
+- Mass assignment: is a user-controlled body bound wholesale into a model?
+- Signature: is a caller-supplied key trusted as the trust anchor?
+
+Record the API inventory in `api/` (one file per module: route + auth method +
+review status ✅/⚠️/❌). Record architecture understanding and high-risk paths in
+`analysis/`.
+
+## Scope
+
+Report only HIGH / CRITICAL, exploitable, high-confidence issues. **Do not report**
+(regardless of severity): dependency CVEs, style or best-practice notes,
+speculative issues you cannot tie to a concrete exploit, and risks that only
+matter if production config is leaked.
+
+## Recording an issue
+
+Write one `issues/<name>.md` per confirmed issue. Do not write an issue you cannot
+confirm with high confidence. Each must have:
+
+```markdown
+# <title>
+
+- Risk: HIGH | CRITICAL
+- Type: IDOR | auth bypass | signature flaw | business logic | ...
+- Endpoint: `<METHOD> <path>`
+
+## Analysis
+(cite exact file paths and line numbers)
+
+## Attack path
+(end-to-end, actionable steps)
+
+## PoC
+(a curl command or script that actually triggers it)
+
+## Verification
+(result of actually running the PoC in a sandbox / dev environment)
+
+## Fix
+```
+
+## PoC verification (human in the loop)
+
+Confirm each issue by running the PoC against a sandbox / dev environment. When
+you need something only the operator has, stop and ask:
+
+- an auth cookie or token,
+- an MFA step,
+- specific test data or an account.
+
+Never run a PoC against production, and never use real credentials or perform a
+destructive action without the operator's explicit go-ahead.
+
+## Iteration
+
+Each round, read the workspace history first and do not repeat finished work.
+Process leftover TODOs; otherwise pick an unreviewed (❌) or to-deepen (⚠️)
+endpoint from the API inventory. When every endpoint is ✅ and there are no TODOs,
+report the review complete.
+
+## On finish
+
+Append a row to the audit history in `security-review-memory.md`, and ask the
+operator which findings were false positives. Record those under "Confirmed false
+positives" so future rounds skip them.

codejury-0.12.0/codejury/data/agent/security-review-memory.md

@@ -0,0 +1,30 @@
+# Security Review Memory — <project>
+
+> Maintained by the security-review agent. Read at the start of every round,
+> updated at the end. It skips confirmed false positives, avoids re-reporting
+> fixed issues, and focuses on historically risky areas.
+
+## Confirmed false positives (skip, do not report)
+
+<!-- FP-001 <short description>
+- Date: YYYY-MM-DD
+- Path/pattern: `tests/` or `apps/payment/mock_*.py`
+- Type: sql_injection / auth_bypass / ...
+- Why not a real issue: <reason>
+-->
+
+## Fixed (do not report again)
+
+<!-- FIXED-001 <issue title>
+- Date / commit: YYYY-MM-DD / abc1234
+- Original issue: <summary>
+-->
+
+## High-risk areas (weight every round)
+
+<!-- - `<path>` — <reason, e.g. past auth bypass> -->
+
+## Audit history
+
+| Date | Mode | HIGH | MEDIUM | Notes |
+|------|------|------|--------|-------|

codejury-0.12.0/codejury/data/rules/SKILL.md

@@ -0,0 +1,41 @@
+---
+name: code-security-review
+description: "Application security rules for reviewing code for exploitable vulnerabilities. Use when reviewing a diff or a codebase for security issues, or when writing code that handles untrusted input, authentication, authorization, file paths, database queries, network requests, deserialization, or cryptography. Consult the relevant rule file before judging whether code is vulnerable."
+---
+
+# Code Security Review Rules
+
+Generic application-security rules, one file per vulnerability class under `rules/`.
+Each rule states the impact, the patterns to hunt, and vulnerable-vs-secure code
+examples. Used both by the diff-audit engine (the relevant rules are injected into
+the prompt) and by the full-review agent (read the rules for the target's stack).
+
+## How to use
+
+1. Identify what the code does: handle input, query a DB, read files, fetch URLs,
+   authenticate, authorize, deserialize, render output?
+2. Read the matching rule files below, Critical and High first.
+3. Apply the secure pattern when writing; flag the vulnerable pattern when reviewing.
+4. Report only real, exploitable, high-confidence issues with a concrete exploit
+   path. Do not report dependency CVEs, style, speculation, or config-leak-only risks.
+
+## Rules
+
+### Critical
+- SQL Injection — `rules/sql-injection.md`
+- Command Injection — `rules/command-injection.md`
+- Insecure Deserialization — `rules/insecure-deserialization.md`
+
+### High
+- IDOR / object-level access — `rules/idor.md`
+- Broken Access Control / function-level authz — `rules/broken-access-control.md`
+- JWT / Authentication — `rules/authentication-jwt.md`
+- SSRF — `rules/ssrf.md`
+- Path Traversal — `rules/path-traversal.md`
+- XSS — `rules/xss.md`
+- Mass Assignment — `rules/mass-assignment.md`
+- Insecure Cryptography — `rules/insecure-crypto.md`
+- Hardcoded Secrets — `rules/secrets.md`
+
+The set is data: add a rule by dropping a new `rules/<class>.md` with the same
+frontmatter (title, impact, tags, triggers) and vulnerable/secure examples.

codejury-0.12.0/codejury/data/rules/authentication-jwt.md

@@ -0,0 +1,21 @@
+---
+title: JWT / Authentication Flaws
+impact: HIGH
+tags: [authentication, jwt, cwe-347, cwe-287, owasp-a07]
+triggers: ["jwt.decode", "verify=False", "verify_signature", "algorithms", "none", "HS256", "decode("]
+---
+
+## JWT and Authentication Flaws
+
+Accepting a token without verifying its signature, allowing the "none" algorithm, or trusting claims before verification lets an attacker forge identity. Verify the signature and validate iss/aud/exp before using any claim.
+
+### Python
+Vulnerable:
+```python
+claims = jwt.decode(token, options={"verify_signature": False})
+jwt.decode(token, key, algorithms=["none"])
+```
+Secure:
+```python
+claims = jwt.decode(token, key, algorithms=["RS256"], audience=AUD, issuer=ISS)
+```

codejury-0.12.0/codejury/data/rules/broken-access-control.md

@@ -0,0 +1,27 @@
+---
+title: Broken Access Control (Function-Level Authorization)
+impact: HIGH
+tags: [access-control, authorization, cwe-862, cwe-285, owasp-a01]
+triggers: ["@app.route", "@router", "def ", "is_admin", "role", "permission", "@login_required", "requires_", "admin"]
+---
+
+## Broken Access Control
+
+A privileged or state-changing endpoint is reachable without the authorization check its peers enforce, or the role/permission is derived from a client-controlled value. Enforce authorization server-side per request, from a trusted store; never trust a client-supplied role.
+
+### Python
+Vulnerable:
+```python
+@app.route("/admin/users/<uid>", methods=["DELETE"])
+def delete_user(uid):            # no auth check, unlike sibling routes
+    delete(uid)
+
+is_admin = request.json["is_admin"]   # client-controlled privilege
+```
+Secure:
+```python
+@app.route("/admin/users/<uid>", methods=["DELETE"])
+@requires_admin
+def delete_user(uid):
+    delete(uid)
+```

codejury-0.12.0/codejury/data/rules/command-injection.md

@@ -0,0 +1,25 @@
+---
+title: Command Injection
+impact: CRITICAL
+tags: [injection, command, cwe-78, owasp-a03]
+triggers: ["os.system", "os.popen", "subprocess", "shell=True", "exec(", "Runtime.getRuntime", "child_process", "popen"]
+---
+
+## Command Injection
+
+Passing untrusted input to a shell lets an attacker run arbitrary commands. Never build a shell string from input; pass an argument list with the shell disabled.
+
+### Python
+Vulnerable:
+```python
+os.system("ping " + host)
+subprocess.run(f"convert {name}", shell=True)
+```
+Secure:
+```python
+subprocess.run(["ping", "-c", "1", host], shell=False)
+```
+
+### Node.js
+Vulnerable: `child_process.exec(`ping ${host}`)`
+Secure: `child_process.execFile("ping", ["-c", "1", host])`

codejury-0.12.0/codejury/data/rules/idor.md

@@ -0,0 +1,24 @@
+---
+title: Insecure Direct Object Reference (IDOR)
+impact: HIGH
+tags: [access-control, idor, authorization, cwe-639, owasp-a01]
+triggers: ["objects.get(", "findById", "get_object_or_404", "/<id>", "/:id", "request.args", "params[", "pk=", "where id ="]
+---
+
+## Insecure Direct Object Reference (IDOR)
+
+A resource is fetched or mutated by a user-supplied id without checking the caller owns or may access it. An authenticated user reads or changes another user's, tenant's, or service's data by changing the id. Always scope the lookup to the caller's identity / tenant.
+
+### Python (Django)
+Vulnerable:
+```python
+account = BankAccount.objects.get(id=request.GET["account_id"])
+```
+Secure:
+```python
+account = get_object_or_404(BankAccount, id=request.GET["account_id"], org_id=request.user.org_id)
+```
+
+### Node.js (Express)
+Vulnerable: `const doc = await Document.findById(req.params.id)`
+Secure: `const doc = await Document.findOne({ _id: req.params.id, userId: req.user.id })`

codejury-0.12.0/codejury/data/rules/insecure-crypto.md

@@ -0,0 +1,22 @@
+---
+title: Insecure Cryptography
+impact: HIGH
+tags: [crypto, cwe-327, cwe-916, owasp-a02]
+triggers: ["hashlib.md5", "hashlib.sha1", "DES", "ECB", "random.random", "random.randint", "MODE_ECB", "md5(", "sha1("]
+---
+
+## Insecure Cryptography
+
+Weak algorithms (MD5, SHA-1, DES, RC4), ECB mode, fast hashes for passwords, static IVs, and non-cryptographic randomness for security values are all exploitable. Use AES-GCM / ChaCha20-Poly1305, bcrypt/argon2 for passwords, fresh random nonces, and a CSPRNG (secrets / os.urandom).
+
+### Python
+Vulnerable:
+```python
+hashlib.md5(password.encode()).hexdigest()
+token = str(random.randint(0, 999999))
+```
+Secure:
+```python
+bcrypt.hashpw(password.encode(), bcrypt.gensalt())
+token = secrets.token_urlsafe(32)
+```