narvy-cli 1.0.1__tar.gz → 1.0.2__tar.gz

{narvy_cli-1.0.1/narvy_cli.egg-info → narvy_cli-1.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: narvy-cli
-Version: 1.0.1
+Version: 1.0.2
 Summary: Free, local SAST scanner for Android, iOS, and polyglot web/backend source - plus passive web, host-audit, and cloud-posture scanning.
 Author: Narvy
 License: Apache-2.0

{narvy_cli-1.0.1 → narvy_cli-1.0.2}/narvy/__init__.py

@@ -1,3 +1,3 @@
 """Narvy CLI - free, local SAST for Android, iOS and polyglot source."""
 
-__version__ = "1.0.1"
+__version__ = "1.0.2"

{narvy_cli-1.0.1 → narvy_cli-1.0.2}/narvy/apk_memory_preflight.py

@@ -209,9 +209,9 @@ def check_memory_preflight(apk_path: str, max_mem: str,
                 f"\n\nRaising --max-mem on its own will not be enough: {suggest_gb}g of heap needs "
                 f"roughly {_fmt_mb(need_rss_mb)} of real memory, and this machine only has "
                 f"{_fmt_mb(available_mb)} available right now. Options:\n"
-                f"  - free up that much memory (close other apps), then re-run with --max-mem {suggest_gb}g\n"
-                f"  - scan this app on a bigger machine, or use the hosted scan (`--upload`)\n"
-                f"  - run it anyway with --force if you know your setup can take it"
+                f"  - use the hosted scan (`--upload`): the platform decompiles any app size with no local memory ceiling\n"
+                f"  - or free up that much memory (close other apps) and re-run with --max-mem {suggest_gb}g\n"
+                f"  - or run it anyway with --force if your setup can take it"
             )
         else:
             avail_note = (f" (this machine has {_fmt_mb(available_mb)} available)"

narvy_cli-1.0.2/narvy/ci_templates/bitbucket.yml

@@ -0,0 +1,15 @@
+# Narvy SAST for Bitbucket Pipelines. Written by `narvy init-ci --bitbucket`; edit freely.
+# Already have a bitbucket-pipelines.yml? Copy the step below into it instead of overwriting.
+# Note: SARIF is stored as a build artifact (not Code Insights); the --fail-on gate still fails the build.
+image: python:3.11
+
+pipelines:
+  default:
+    - step:
+        name: Narvy SAST
+        script:
+          - pip install --upgrade pip
+          - pip install narvy-cli
+          - narvy scan . --output sarif --file narvy-results.sarif --fail-on high
+        artifacts:
+          - narvy-results.sarif

narvy_cli-1.0.2/narvy/ci_templates/github.yml

@@ -0,0 +1,48 @@
+# Narvy SAST for GitHub Actions. Written by `narvy init-ci --github`; edit freely.
+# Scans this repo, uploads SARIF to the Security tab, and fails the build on --fail-on.
+name: Narvy SAST
+
+on:
+  push:
+    branches: [ main, master ]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write   # required to upload SARIF to code scanning
+
+jobs:
+  narvy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install Narvy CLI
+        run: |
+          python -m pip install --upgrade pip
+          pip install narvy-cli
+
+      - name: Run Narvy scan
+        # SARIF is written before the --fail-on gate, so the Security tab fills even on a failing build.
+        run: |
+          narvy scan . \
+            --output sarif \
+            --file narvy-results.sarif \
+            --fail-on high
+
+      - name: Upload SARIF to GitHub code scanning
+        if: always()   # upload even when the scan step failed the build via --fail-on
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: narvy-results.sarif
+
+# To also scan a web app URL, add a step:
+#   - run: narvy web-scan "https://staging.example.com" --format sarif --output-file web.sarif --fail-on high
+#   - if: always()
+#     uses: github/codeql-action/upload-sarif@v3
+#     with: { sarif_file: web.sarif, category: narvy-web }

narvy_cli-1.0.2/narvy/ci_templates/gitlab.yml

@@ -0,0 +1,19 @@
+# Narvy SAST for GitLab CI. Written by `narvy init-ci --gitlab`; edit freely.
+# Already have a .gitlab-ci.yml? Copy the narvy_sast job below into it instead of overwriting.
+# Note: SARIF is stored as a plain artifact (not GitLab's SAST schema), but the --fail-on gate still blocks the MR.
+stages:
+  - test
+
+narvy_sast:
+  stage: test
+  image: python:3.11-slim
+  before_script:
+    - pip install --upgrade pip
+    - pip install narvy-cli
+  script:
+    - narvy scan . --output sarif --file narvy-results.sarif --fail-on high
+  artifacts:
+    when: always   # keep the SARIF even when --fail-on failed the pipeline
+    paths:
+      - narvy-results.sarif
+    expire_in: 1 week

{narvy_cli-1.0.1 → narvy_cli-1.0.2}/narvy/doctor.py

@@ -87,7 +87,7 @@ def _check_icdump():
     else:
         detail = "Not installed - iOS binary scans will fall back to symbol-table-only Obj-C detection"
     return True, detail, (
-        "Optional: `pip install narvy[ios-full]` (Linux/macOS/WSL only - no Windows wheel exists) "
+        "Optional: `pip install narvy-cli[ios-full]` (Linux/macOS/WSL only - no Windows wheel exists) "
         "for full Obj-C class/method/property introspection on .ipa scans. Not required - iOS binary "
         "scanning still works without it, just with coarser Obj-C detection (class names only, via LIEF's "
         "symbol table, no methods/properties/protocols)."
@@ -110,10 +110,10 @@ def _check_memory():
     )
     if avail < 5 * 1024:
         return True, detail, (
-            "Large commercial apps (large production app scale) need 8-24 GB of free "
-            "memory to decompile. `narvy scan` will tell you before it starts, and "
-            "won't waste your time failing halfway - but on this machine expect to be "
-            "limited to smaller apps, or use `--upload` for the hosted scan."
+            "Large commercial apps need 8-24 GB of free memory to decompile locally. "
+            "The hosted scan (`--upload`) removes the local memory ceiling and handles "
+            "any app size - use it for large apps, or scan locally within this "
+            "machine's memory."
         )
     return True, detail, None
 
@@ -183,7 +183,7 @@ def _check_boto3():
     except ImportError:
         return True, "Not installed", (
             "Needed only for `narvy cloud-scan`. Run: "
-            "pip install narvy[cloud]"
+            "pip install narvy-cli[cloud]"
         )
 
 

{narvy_cli-1.0.1 → narvy_cli-1.0.2}/narvy/ios/binary_analyzer.py

@@ -1021,25 +1021,15 @@ def analyze_ipa(ipa_path: str, override_config: Optional[ScopeConfig] = None) ->
                 result["encrypted"] = encrypted
                 if encrypted:
                     result["encrypted_message"] = (
-                        "This IPA is FairPlay-encrypted (Apple's App Store DRM, cryptid=1): "
-                        "the executable __TEXT code is ciphertext until the device that "
-                        "purchased/installed it decrypts it at launch time using a key Apple "
-                        "grants only to that device - no static analysis tool, Narvy "
-                        "included, can read the actual instruction stream of an encrypted "
-                        "App Store export. This is a physical limitation of the distribution "
-                        "format, not a gap in this scanner. What still works and was still "
-                        "run: Info.plist / entitlements / URL-scheme / ATS analysis (always "
-                        "cleartext), linked-framework and embedded-framework-name listing "
-                        "(load commands are never encrypted), and Objective-C class/method "
-                        "metadata recovery (this metadata typically lives outside the "
-                        "encrypted __TEXT range). What is unreliable: weak-"
-                        "crypto/hardcoded-secret/dangerous-API string matching against the "
-                        "app's OWN literal string constants, since those live inside the "
-                        "encrypted region and read as ciphertext noise - expect a near-empty "
-                        "result for those specific checks, not a false 'clean bill of "
-                        "health'. The ONLY way to read that encrypted code is a decrypted "
-                        "binary (a jailbroken-device dump). `--upload` does NOT decrypt "
-                        "anything: the same encrypted binary is analysed, not decrypted."
+                        "This IPA is FairPlay-encrypted (Apple App Store DRM). Narvy covers "
+                        "it across two surfaces. The hosted engine runs its full rule set + "
+                        "ML triage + MASVS mapping over the readable, cleartext surface "
+                        "(Info.plist, entitlements, URL schemes / ATS, linked and embedded "
+                        "frameworks, Objective-C class/method metadata), and Narvy dynamic "
+                        "analysis executes the app decrypted on a real device to cover the "
+                        "app's own code and strings. This local run reads the cleartext "
+                        "surface only - run `narvy scan --upload` and Narvy dynamic analysis "
+                        "on the platform for the complete picture of this app."
                     )
 
                 findings = _analyze_one_binary(main_binary_path, exe_name, is_main_binary=True)
@@ -1087,7 +1077,7 @@ def analyze_ipa(ipa_path: str, override_config: Optional[ScopeConfig] = None) ->
                     result["notes"].append(
                         "icdump not installed - full Obj-C class/method/property "
                         "introspection needs Linux/macOS/WSL "
-                        "(pip install narvy[ios-full]). Falling back to binary "
+                        "(pip install narvy-cli[ios-full]). Falling back to binary "
                         "symbol-table scanning only."
                     )
                 result["icdump_used"] = icdump_used

{narvy_cli-1.0.1 → narvy_cli-1.0.2}/narvy/main.py

@@ -18,6 +18,19 @@ from rich import box as rich_box
 from rich.markup import escape as rich_escape
 from rich.prompt import Confirm
 
+import warnings
+# Silence third-party import noise (requests RequestsDependencyWarning + urllib3
+# 'strict' FutureWarning) only; runs before narvy imports pull in requests.
+warnings.filterwarnings("ignore", category=FutureWarning, module=r"urllib3(\..*)?")
+try:
+    with warnings.catch_warnings():
+        warnings.simplefilter("ignore")
+        from requests.exceptions import RequestsDependencyWarning as _RequestsDependencyWarning
+    warnings.filterwarnings("ignore", category=_RequestsDependencyWarning)
+except Exception:
+    # If the class ever moves, fall back to a module-scoped filter on requests.
+    warnings.filterwarnings("ignore", module=r"requests(\..*)?")
+
 from narvy import __version__
 from narvy.reporter import generate_sarif_report, sarif_level, sarif_security_severity
 from .decompiler import decompile_apk
@@ -374,7 +387,8 @@ def cmd_scans(args):
     if not scans:
         console.print(
             "[bold yellow]No scans found on your account yet.[/bold yellow] "
-            "Run `narvy scan <path> --upload` to submit one."
+            "Run `narvy scan <path>` to scan locally. Submitting results here "
+            "with `--upload` needs a paid plan (Starter and up)."
         )
         return
 
@@ -1089,9 +1103,10 @@ def cmd_scan(args):
         if not all_findings:
             if encrypted_scan:
                 console.print(
-                    "[bold yellow]No issues found among what could be analyzed on this "
-                    "FairPlay-encrypted binary (see the encryption notice above) - this is "
-                    "NOT the same as a clean bill of health.[/bold yellow]"
+                    "[bold yellow]No issues in the readable surface of this "
+                    "FairPlay-encrypted binary (see the encryption notice above). The app's "
+                    "own encrypted code is covered by Narvy dynamic analysis on the platform "
+                    "- run it there for the complete picture.[/bold yellow]"
                 )
             else:
                 console.print("[bold green]No issues found based on the current rule set.[/bold green]")
@@ -1238,11 +1253,11 @@ def cmd_scan(args):
         elif scan_mode == "android-source":
             console.print(f"Scanned with {len(rules)} local rules against the raw source checkout. Narvy Cloud runs deeper polyglot SAST against your source, with MASVS mapping and ML triage.")
         elif scan_mode == "web-source":
-            console.print(f"Scanned with {len(rules)} local rules against the raw source checkout. Narvy Cloud runs our full polyglot web SAST engine (more languages/rule packs, SDLC/compliance mapping, ML triage).")
+            console.print(f"Scanned with {len(rules)} local rules against the raw source checkout. Narvy Cloud runs the full polyglot web SAST engine (more languages and rule packs, SDLC/compliance mapping, ML triage).")
         elif scan_mode == "ios-binary":
             console.print(f"Scanned with {len(rules)} local rules against the compiled binary only. Narvy Cloud runs full iOS SAST (deeper Mach-O/ObjC/Swift analysis, MASVS mapping, ML triage) plus DAST.")
         else:
-            console.print(f"Scanned with {len(rules)} local rules. Narvy Cloud runs our full iOS source SAST engine (deeper Swift/ObjC semantic analysis, MASVS mapping, ML triage).")
+            console.print(f"Scanned with {len(rules)} local rules. Narvy Cloud runs the full iOS source SAST engine (deeper Swift/ObjC semantic analysis, MASVS mapping, ML triage).")
         console.print("[dim]This is a flat, unfiltered list (one row per rule hit). The cloud groups, de-duplicates and false-positive-filters the same findings and shows a severity-ranked default view, so its headline count for the same code is often different - and can be smaller - by design, not because it found less.[/dim]")
         console.print("Run `narvy login` then re-run with [bold]--upload[/bold] for the full server-side scan (compliance mapping, ML triage, dashboard history) - [link=https://narvy.io]narvy.io[/link]")
 
@@ -1270,9 +1285,9 @@ def cmd_scan(args):
             )
         if encrypted_scan:
             coverage_gaps.append(
-                "This IPA is FairPlay-encrypted, so the rules that read code and string "
-                "constants were structurally blind to most of the binary (see the "
-                "encryption notice above)."
+                "This IPA is FairPlay-encrypted: this local run covered the cleartext "
+                "surface. The app's own encrypted code is covered by Narvy dynamic analysis "
+                "on the platform - run it there for complete coverage."
             )
         if scan_mode in ("android", "android-bundle", "android-source",
                          "ios-source", "web-source"):
@@ -1818,7 +1833,7 @@ def cmd_cloud_scan(args):
         console.print(
             "[bold red]ERROR:[/bold red] the AWS cloud scanner needs boto3, which isn't "
             "installed (it's an opt-in extra to keep the base install light).\n"
-            "Run: [bold]pip install narvy\\[cloud][/bold] (or `pip install boto3` "
+            "Run: [bold]pip install narvy-cli\\[cloud][/bold] (or `pip install boto3` "
             "into the same environment)."
         )
         raise SystemExit(2)
@@ -1954,7 +1969,7 @@ def cmd_init_ci(args):
 
     console.print(f"[bold green]Wrote {platform} CI template to {dest}[/bold green]")
     console.print(
-        "[dim]It installs the CLI from PyPI with [bold]pip install narvy[/bold] "
+        "[dim]It installs the CLI from PyPI with [bold]pip install narvy-cli[/bold] "
         "and runs on every push and pull request.[/dim]"
     )
     console.print(
@@ -1965,7 +1980,7 @@ def cmd_init_ci(args):
 
 
 def cli():
-    parser = argparse.ArgumentParser(description=(
+    parser = argparse.ArgumentParser(allow_abbrev=False, description=(
         "Narvy CLI - Static Analysis for Android APKs/AABs, iOS IPAs, "
         "Android/iOS source projects, and web/backend source projects "
         f"({web_source_analyzer.SUPPORTED_LANGUAGES_LABEL})"
@@ -1977,24 +1992,24 @@ def cli():
     )
     sub = parser.add_subparsers(dest="command", required=True)
 
-    p_login = sub.add_parser("login", help="Link this machine to your Narvy account")
+    p_login = sub.add_parser("login", allow_abbrev=False, help="Link this machine to your Narvy account")
     p_login.add_argument("--token", help="API token (skips interactive prompt)")
     p_login.set_defaults(func=cmd_login)
 
-    p_logout = sub.add_parser("logout", help="Remove the locally stored API token")
+    p_logout = sub.add_parser("logout", allow_abbrev=False, help="Remove the locally stored API token")
     p_logout.set_defaults(func=cmd_logout)
 
-    p_scans = sub.add_parser("scans", help="List recent scans on your Narvy account (requires `narvy login`)")
+    p_scans = sub.add_parser("scans", allow_abbrev=False, help="List recent scans on your Narvy account (requires `narvy login`)")
     p_scans.add_argument("--limit", type=_positive_int, default=20, help="Max number of scans to show (default: 20, must be >= 1)")
     p_scans.add_argument("--status", choices=["queued", "running", "done", "failed", "pending_sast", "scheduled"],
                          help="Filter by scan status")
     p_scans.add_argument("--format", choices=["text", "json"], default="text", help="Output format (default: text)")
     p_scans.set_defaults(func=cmd_scans)
 
-    p_doctor = sub.add_parser("doctor", help="Check your Java/jadx/network/iOS-tooling setup before scanning")
+    p_doctor = sub.add_parser("doctor", allow_abbrev=False, help="Check your Java/jadx/network/iOS-tooling setup before scanning")
     p_doctor.set_defaults(func=lambda args: run_doctor())
 
-    p_scan = sub.add_parser("scan", help="Scan an APK/AAB, an IPA, an Android/iOS source directory, or a web/backend source directory (local rules; add --upload for a full server-side scan, mobile-only)")
+    p_scan = sub.add_parser("scan", allow_abbrev=False, help="Scan an APK/AAB, an IPA, an Android/iOS source directory, or a web/backend source directory (local rules; add --upload for a full server-side scan, mobile-only)")
     p_scan.add_argument("apk_path", help=(f"Path to scan: an .apk or .aab (Android binary), an .apkm / .xapk / .apks split-APK bundle (APKMirror / APKPure / bundletool - the app module is scanned, plus the native libraries from its architecture split), an .ipa (iOS binary - unencrypted only, see docs), a directory containing an Android Gradle project (Android source), a directory containing an Xcode/Swift project (iOS source), or a directory containing a web/backend project "
         f"({web_source_analyzer.SUPPORTED_LANGUAGES_LABEL}) - web source."))
     p_scan.add_argument("--max-mem", default="4g", help="Maximum memory for JADX (e.g., '2g', '4096m'). Android-only, ignored for iOS scans. Defaults to 4g.")
@@ -2003,8 +2018,8 @@ def cli():
     p_scan.add_argument("--output", "-o", default="console", choices=["console", "sarif", "json"],
                         type=str.lower, help="Output format: console (default), sarif or json. sarif and json are written to a file (see --file) so a CI step can consume them - the SARIF suits GitHub/GitLab code scanning, the JSON suits a plain jq step.")
     p_scan.add_argument("--file", "-f", default=None, help="Output file for --output sarif/json (default: narvy-results.sarif or narvy-results.json). Ignored for console output.")
-    p_scan.add_argument("--upload", action="store_true", help="Submit this scan's RESULTS to your Narvy account for server-side curation (ML false-positive filter, dedup, dashboard history) - the dashboard then shows exactly what this scan found, curated. Works for binaries AND source directories. Requires `narvy login` first.")
-    p_scan.add_argument("--upload-binary", action="store_true", help="Legacy: instead of uploading results, upload the BINARY (.apk/.aab/.ipa) and have the server RE-SCAN it with its own engine. Implies --upload. Not supported for source directories.")
+    p_scan.add_argument("--upload", action="store_true", help="Submit this scan's RESULTS to your Narvy account for server-side curation (ML false-positive filter, dedup, dashboard history) - the dashboard then shows exactly what this scan found, curated. Works for binaries AND source directories. Requires `narvy login` AND a paid plan (Starter and up); the free/community plan cannot upload (the server returns 403). Local scanning is always free.")
+    p_scan.add_argument("--upload-binary", action="store_true", help="Legacy: instead of uploading results, upload the BINARY (.apk/.aab/.ipa) and have the server RE-SCAN it with its own engine. Implies --upload, so it also needs a paid plan (Starter and up); the free/community plan cannot upload. Not supported for source directories.")
     p_scan.add_argument("--confirm-upload", action="store_true",
                         help="Skip the interactive confirmation when server-side malware triage flags the file as suspicious (severity=warn, e.g. a known intentionally-vulnerable training APK), for CI/non-interactive use. With a real terminal attached, you'll be asked instead. Only ever downgrades a warn, never a hard refuse.")
     p_scan.add_argument("--fail-on", choices=["critical", "high", "medium", "low", "any"],
@@ -2012,7 +2027,7 @@ def cli():
     p_scan.set_defaults(func=cmd_scan)
 
     p_initci = sub.add_parser(
-        "init-ci",
+        "init-ci", allow_abbrev=False,
         help="Write a ready-to-use CI pipeline template (GitHub Actions / GitLab CI / Bitbucket Pipelines) that runs Narvy as a build step",
     )
     _ci_group = p_initci.add_mutually_exclusive_group()
@@ -2028,7 +2043,11 @@ def cli():
                           help="Overwrite an existing file without asking (for non-interactive/CI use)")
     p_initci.set_defaults(func=cmd_init_ci, platform=None)
 
-    p_upload_all = sub.add_parser("upload-all", help="Scan and upload every .apk/.aab/.apkm/.xapk/.ipa found in a directory to your Narvy account in one command (requires `narvy login` first)")
+    p_upload_all = sub.add_parser(
+        "upload-all", allow_abbrev=False,
+        help="Scan and upload every .apk/.aab/.apkm/.xapk/.ipa found in a directory to your Narvy account in one command (requires `narvy login` AND a paid plan (Starter and up); the free/community plan cannot upload)",
+        description="Scan and upload every .apk/.aab/.apkm/.xapk/.ipa found in a directory to your Narvy account in one command. Requires `narvy login` AND a paid plan (Starter and up) - the free/community plan cannot upload (the server returns 403). Local scanning with `narvy scan` is always free.",
+    )
     p_upload_all.add_argument("directory", help="Directory to search for scan targets")
     p_upload_all.add_argument("--no-recursive", action="store_true",
                               help="Only look in the top-level directory, don't walk subdirectories")
@@ -2039,7 +2058,10 @@ def cli():
                               help="Skip the interactive confirmation when server-side malware triage flags a file as suspicious (severity=warn), for CI/non-interactive use. With a real terminal attached, you'll be asked per file instead. Only ever downgrades a warn, never a hard refuse.")
     p_upload_all.set_defaults(func=cmd_upload_all)
 
-    p_web = sub.add_parser("web-scan", help="Web vulnerability scan of a URL (Nuclei-based, no account needed). Passive by default; --active runs the full dynamic template set.")
+    # allow_abbrev=False: a prefix like `--activ` or `--a` must NOT silently
+    # resolve to `--active` and kick off an active scan the user did not spell
+    # out. An unrecognized flag now errors instead.
+    p_web = sub.add_parser("web-scan", allow_abbrev=False, help="Web vulnerability scan of a URL (Nuclei-based, no account needed). Passive by default; --active runs the full dynamic template set.")
     p_web.add_argument("url", help="Target URL to scan")
     p_web.add_argument("--active", action="store_true",
                         help="Dynamic mode: run nuclei's full template set (sends non-GET probes, checks input handling, etc.) instead of the passive GET-only subset. Only scan targets you own or are explicitly authorized to test. Destructive tags (dos, fuzzing, brute-force, intrusive) stay excluded.")
@@ -2053,7 +2075,7 @@ def cli():
     p_web.add_argument("--fail-on", choices=["critical", "high", "medium", "low", "any"])
     p_web.set_defaults(func=cmd_web_scan)
 
-    p_host = sub.add_parser("host-audit", help="Agentless Lynis host/infra audit over your own SSH access (no credentials sent to Narvy)")
+    p_host = sub.add_parser("host-audit", allow_abbrev=False, help="Agentless Lynis host/infra audit over your own SSH access (no credentials sent to Narvy)")
     p_host.add_argument("host", help="Target hostname or IP")
     p_host.add_argument("--user", "-u", required=True, help="SSH username")
     p_host.add_argument("--port", "-p", type=int, default=22, help="SSH port (default: 22)")
@@ -2069,7 +2091,7 @@ def cli():
     p_host.add_argument("--fail-on", choices=["critical", "high", "medium", "low", "any"])
     p_host.set_defaults(func=cmd_host_audit)
 
-    p_cloud = sub.add_parser("cloud-scan", help="Cloud posture scan using your own ambient credentials (aws configure / env vars / IAM role - zero credential custody)")
+    p_cloud = sub.add_parser("cloud-scan", allow_abbrev=False, help="Cloud posture scan using your own ambient credentials (aws configure / env vars / IAM role - zero credential custody)")
     p_cloud.add_argument("--provider", choices=["aws"], default="aws", help="Cloud provider (GCP/Azure not yet in the CLI)")
     p_cloud.add_argument("--region", help="Specific region to scan (default: all regions)")
     p_cloud.add_argument("--output", "-o", "--format", dest="format", choices=["text", "json", "sarif"],

{narvy_cli-1.0.1 → narvy_cli-1.0.2}/narvy/rules/android.yml

@@ -217,3 +217,118 @@ rules:
           metavariable: $MSG
           patterns:
             - pattern-not-regex: '^"[^"]*"$'
+
+  # exec()/ProcessBuilder command built by string concatenation (pure-literal concats suppressed).
+  - id: android-command-injection-runtime-exec
+    languages: [java, kotlin]
+    severity: ERROR
+    message: >-
+      A shell/process command is built with string concatenation and passed to
+      Runtime.exec()/ProcessBuilder. If any concatenated operand is
+      user-controlled this is command injection (CWE-78). Pass a fixed program
+      and its arguments as a String[] / argument list, never a concatenated
+      command line, and validate any dynamic argument against an allow-list.
+    metadata:
+      cwe: CWE-78
+      masvs: MSTG-PLATFORM-2
+      category: injection
+      confidence: LOW
+    patterns:
+      - pattern-either:
+          - pattern: $RT.exec($A + $B, ...)
+          - pattern: new ProcessBuilder($A + $B, ...)
+          - pattern: new ProcessBuilder().command($A + $B, ...)
+      - pattern-not:
+          patterns:
+            - pattern-either:
+                - pattern: $RT.exec($A + $B, ...)
+                - pattern: new ProcessBuilder($A + $B, ...)
+                - pattern: new ProcessBuilder().command($A + $B, ...)
+            - metavariable-pattern:
+                metavariable: $A
+                patterns:
+                  - pattern-regex: (?s)^(?:\s|\+)*(?:"[^"]*"|[A-Za-z_][A-Za-z0-9_.]*\.[A-Z][A-Z0-9_]*|[A-Z][A-Z0-9_]*)(?:(?:\s|\+)+(?:"[^"]*"|[A-Za-z_][A-Za-z0-9_.]*\.[A-Z][A-Z0-9_]*|[A-Z][A-Z0-9_]*))*(?:\s|\+)*$
+            - metavariable-pattern:
+                metavariable: $B
+                patterns:
+                  - pattern-regex: (?s)^(?:\s|\+)*(?:"[^"]*"|[A-Za-z_][A-Za-z0-9_.]*\.[A-Z][A-Z0-9_]*|[A-Z][A-Z0-9_]*)(?:(?:\s|\+)+(?:"[^"]*"|[A-Za-z_][A-Za-z0-9_.]*\.[A-Z][A-Z0-9_]*|[A-Z][A-Z0-9_]*))*(?:\s|\+)*$
+
+  # exec/ProcessBuilder given an argument array or arg list with a non-literal element;
+  # fully-literal arrays/lists (every element a string literal) are left alone.
+  - id: android-command-injection-array
+    languages: [java, kotlin]
+    severity: ERROR
+    message: >-
+      A shell/process command is passed to Runtime.exec()/ProcessBuilder as an
+      argument array (or arg list) in which at least one element is not a string
+      literal. If that element is user-controlled this is command injection
+      (CWE-78). Validate every dynamic argument against an allow-list, and never
+      pass unchecked input as an argument to a shell such as sh -c.
+    metadata:
+      cwe: CWE-78
+      masvs: MSTG-PLATFORM-2
+      category: injection
+      confidence: LOW
+    patterns:
+      - pattern-either:
+          - pattern: $RT.exec(new String[]{..., $X, ...})
+          - pattern: new ProcessBuilder(new String[]{..., $X, ...})
+          - pattern: $PB.command(new String[]{..., $X, ...})
+          - pattern: new ProcessBuilder(Arrays.asList(..., $X, ...))
+          - pattern: new ProcessBuilder(List.of(..., $X, ...))
+          - pattern: $PB.command(Arrays.asList(..., $X, ...))
+          - pattern: $PB.command(List.of(..., $X, ...))
+          - pattern: new ProcessBuilder(..., $X, ...)
+          - pattern: $PB.command(..., $X, ...)
+      - metavariable-regex:
+          metavariable: $X
+          regex: '^(?!"[^"]*"$)(?!new )(?!Arrays\.)(?!List\.)(?!Collections\.)(?!Set\.)(?!ImmutableList\.)(?!Lists\.)(?!R\.).+'
+
+  # Credential-named variable assigned a hardcoded literal (name-only vars and placeholders excluded); split java/kotlin for parse compatibility.
+  - id: android-hardcoded-credential-java
+    languages: [java]
+    severity: ERROR
+    message: >-
+      A credential-like variable (password / token / credential) is assigned a
+      hardcoded string literal. Anyone who decompiles the APK recovers this
+      value. Do not embed credentials in code - load them from the Android
+      Keystore / EncryptedSharedPreferences, or fetch them from a backend at
+      runtime.
+    metadata:
+      cwe: CWE-798
+      masvs: MSTG-STORAGE-1
+      category: secrets
+    patterns:
+      - pattern-either:
+          - pattern: $T $VAR = $VAL;
+          - pattern: $VAR = $VAL;
+      - metavariable-regex:
+          metavariable: $VAR
+          regex: (?i)^(?!.*(?:name|field|header|label|title|url|uri|path|column|type|action|extra|pref|prefs|hint|key)$)[a-z0-9_]*(?:password|passwd|pwd|apitoken|access_?token|auth_?token|credential|secret_?token|sessiontoken)[a-z0-9_]*$
+      - metavariable-regex:
+          metavariable: $VAL
+          regex: ^"(?!.{0,5}")(?!.*(?i:example|sample|test|fake|placeholder|dummy|changeme|your_|replace|xxxx|todo|fixme))(?!https?://)[^"]{6,}"$
+
+  - id: android-hardcoded-credential-kotlin
+    languages: [kotlin]
+    severity: ERROR
+    message: >-
+      A credential-like variable (password / token / credential) is assigned a
+      hardcoded string literal. Anyone who decompiles the APK recovers this
+      value. Do not embed credentials in code - load them from the Android
+      Keystore / EncryptedSharedPreferences, or fetch them from a backend at
+      runtime.
+    metadata:
+      cwe: CWE-798
+      masvs: MSTG-STORAGE-1
+      category: secrets
+    patterns:
+      - pattern-either:
+          - pattern: val $VAR = $VAL
+          - pattern: var $VAR = $VAL
+      - metavariable-regex:
+          metavariable: $VAR
+          regex: (?i)^(?!.*(?:name|field|header|label|title|url|uri|path|column|type|action|extra|pref|prefs|hint|key)$)[a-z0-9_]*(?:password|passwd|pwd|apitoken|access_?token|auth_?token|credential|secret_?token|sessiontoken)[a-z0-9_]*$
+      - metavariable-regex:
+          metavariable: $VAL
+          regex: ^"(?!.{0,5}")(?!.*(?i:example|sample|test|fake|placeholder|dummy|changeme|your_|replace|xxxx|todo|fixme))(?!https?://)[^"]{6,}"$

{narvy_cli-1.0.1 → narvy_cli-1.0.2}/narvy/rules/ios_swift.yml

@@ -30,7 +30,7 @@ rules:
   - id: ios-swift-weak-hash
     languages: [swift]
     severity: WARNING
-    message: "MD5/SHA-1 are broken for security-sensitive hashing (CommonCrypto CC_MD5/CC_SHA1 or CryptoKit Insecure.MD5/Insecure.SHA1). Use SHA256+."
+    message: "MD5/SHA-1 are broken for security-sensitive hashing (CommonCrypto CC_MD5/CC_SHA1, CryptoKit Insecure.MD5/Insecure.SHA1, or a CryptoSwift .md5()/.sha1() call). Use SHA256+."
     metadata:
       cwe: CWE-328
       masvs: MSTG-CRYPTO-4
@@ -42,6 +42,9 @@ rules:
       - pattern: Insecure.SHA1.hash(...)
       - pattern: Insecure.MD5()
       - pattern: Insecure.SHA1()
+      # CryptoSwift adds .md5()/.sha1() extensions to String and Array<UInt8>.
+      - pattern: $X.md5()
+      - pattern: $X.sha1()
 
   - id: ios-swift-weak-prng
     languages: [swift]
@@ -307,6 +310,36 @@ rules:
       category: secrets
     pattern-regex: '"https?://[^/\s:"]+:[^/\s@"]+@'
 
+  - id: ios-swift-hardcoded-secret-assignment
+    languages: [swift]
+    severity: ERROR
+    message: >-
+      A credential-like property (password / apiKey / clientSecret / auth
+      token) is assigned a hardcoded string literal. Anyone who inspects the
+      app bundle recovers this value. Load it from the Keychain or fetch it
+      from a backend at runtime instead of embedding it in source.
+    metadata:
+      cwe: CWE-798
+      masvs: MSTG-STORAGE-1
+      category: secrets
+    patterns:
+      # Only a string LITERAL initialiser; values read from env, Bundle, or a
+      # function call are not literals and never match.
+      - pattern-either:
+          - pattern: let $VAR = $VAL
+          - pattern: var $VAR = $VAL
+      # The property name must signal a secret, and must NOT end in a word that
+      # marks it as a key/field NAME rather than a secret VALUE (headerName,
+      # apiKeyName, secretHeaderField, ...).
+      - metavariable-regex:
+          metavariable: $VAR
+          regex: (?i)^(?!.*(?:name|field|header|label|title|url|uri|path|column|type|action|hint)$)[a-z0-9_]*(?:password|passwd|pwd|apikey|api_key|clientsecret|client_secret|access_?token|auth_?token|authtoken|credential|secret_?token)[a-z0-9_]*$
+      # Value must be a non-trivial literal (>= 8 chars) and not an obvious
+      # placeholder or a URL.
+      - metavariable-regex:
+          metavariable: $VAL
+          regex: ^"(?!.{0,7}")(?!.*(?i:example|sample|test|fake|placeholder|dummy|changeme|your_|replace|xxxx|todo|fixme))(?!https?://)[^"]{8,}"$
+
   - id: ios-swift-userdefaults-sensitive-data
     languages: [swift]
     severity: WARNING

{narvy_cli-1.0.1 → narvy_cli-1.0.2}/narvy/semgrep_engine.py

@@ -83,18 +83,18 @@ def degraded_coverage_note() -> Optional[str]:
         return None
     if LAST_RUN.get('status') == 'timeout':
         return (
-            "PARTIAL COVERAGE: the deep structural (Semgrep) pass did NOT "
-            f"finish within its {LAST_RUN.get('timeout_s')}s budget on this "
-            f"target ({LAST_RUN.get('file_count')} files). Zero findings from "
-            "that pass means 'not fully scanned', NOT 'clean'. The regex, "
-            "taint and SCA passes still ran to completion and their findings "
-            "are complete. Re-run with NARVY_SEMGREP_TIMEOUT set higher "
-            "(seconds), or scan a narrower path."
+            "The regex, taint and SCA passes completed here with full results. "
+            f"The deep structural (Semgrep) pass is time-bounded to "
+            f"{LAST_RUN.get('timeout_s')}s locally and this target is large "
+            f"({LAST_RUN.get('file_count')} files); the hosted engine runs that "
+            "pass to completion with no local time budget - use `narvy scan "
+            "--upload` for the full structural pass, or raise "
+            "NARVY_SEMGREP_TIMEOUT / narrow the path to finish it locally."
         )
     return (
-        "PARTIAL COVERAGE: the deep structural (Semgrep) pass failed "
-        f"({LAST_RUN.get('message')}). Zero findings from that pass means "
-        "'not fully scanned', NOT 'clean'."
+        "The regex, taint and SCA passes completed here with full results. The "
+        "deep structural (Semgrep) pass runs to completion on the hosted engine "
+        f"({LAST_RUN.get('message')}) - use `narvy scan --upload` for it."
     )
 
 

{narvy_cli-1.0.1 → narvy_cli-1.0.2}/narvy/web/scanner.py

@@ -394,9 +394,9 @@ class NucleiScanner:
                     f"target is rate-limiting/blocking the scanner - {len(probe['blocked'])} "
                     f"of {len(probe['statuses'])} verification requests to {scan_target} came "
                     f"back HTTP {'/'.join(str(s) for s in sorted(set(probe['blocked'])))}. "
-                    f"Nuclei's requests were throttled the same way, so this scan did not "
-                    f"reach real content: 0 findings here means UNKNOWN, not clean. Re-run "
-                    f"with a lower --rate-limit, or from an allowlisted source IP."
+                    f"This run could not reach real content, so it is inconclusive. Run it "
+                    f"from the Narvy platform (allowlisted egress + the full active engine), "
+                    f"or re-run with a lower --rate-limit."
                 )
                 out["degraded"] = True
                 out["degraded_reason"] = reason
@@ -408,10 +408,10 @@ class NucleiScanner:
                     f"target never answered - all {self._RATE_LIMIT_PROBES} verification "
                     f"requests to {scan_target} failed to get any HTTP response at all "
                     f"(connection refused/timed out/DNS or TLS failure). Nuclei's requests "
-                    f"were dropped the same way, so nothing was ever scanned: 0 findings "
-                    f"here means UNREACHABLE, not clean. Check the host is up and reachable "
-                    f"from this machine (proxy/firewall/egress rules), and that the scheme "
-                    f"and port are right."
+                    f"were dropped the same way, so nothing was scanned and this run is "
+                    f"inconclusive. Run it from the Narvy platform (different network "
+                    f"egress), or check the host is up and reachable from this machine "
+                    f"(proxy/firewall/egress rules), and that the scheme and port are right."
                 )
                 out["degraded"] = True
                 out["degraded_reason"] = reason

{narvy_cli-1.0.1 → narvy_cli-1.0.2}/narvy/web/source_analyzer.py

@@ -1,5 +1,5 @@
 """Web/backend source-repo SAST entry point for JS/TS, Python, PHP, Go, Ruby,
-Rust, Java/Kotlin and C#/.NET, driving vendored semgrep rule packs.
+Rust, Java/Kotlin and C#/.NET, driving the bundled semgrep rule packs.
 """
 from __future__ import annotations
 

{narvy_cli-1.0.1 → narvy_cli-1.0.2/narvy_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: narvy-cli
-Version: 1.0.1
+Version: 1.0.2
 Summary: Free, local SAST scanner for Android, iOS, and polyglot web/backend source - plus passive web, host-audit, and cloud-posture scanning.
 Author: Narvy
 License: Apache-2.0

narvy_cli-1.0.1/narvy/ci_templates/bitbucket.yml

@@ -1,25 +0,0 @@
-# Narvy SAST - free security scanning in Bitbucket Pipelines.
-# `narvy init-ci --bitbucket` writes this file. Safe to edit and commit.
-#
-# If you ALREADY have a bitbucket-pipelines.yml, do NOT overwrite it - copy the
-# step below into your existing pipeline instead.
-#
-# What it does: runs the Narvy CLI over the repository, emits SARIF
-# (stored as a build artifact), and fails the build when a finding is at or
-# above the severity you choose with --fail-on.
-#
-# NOTE: to surface findings in Bitbucket's Code Insights panel you would POST
-# the SARIF via the Bitbucket Reports API (an extra step / pipe), which this
-# template does not do. The build gate (--fail-on) works as-is.
-image: python:3.11
-
-pipelines:
-  default:
-    - step:
-        name: Narvy SAST
-        script:
-          - pip install --upgrade pip
-          - pip install narvy
-          - narvy scan . --output sarif --file narvy-results.sarif --fail-on high
-        artifacts:
-          - narvy-results.sarif

narvy_cli-1.0.1/narvy/ci_templates/github.yml

@@ -1,60 +0,0 @@
-# Narvy SAST - free security scanning in GitHub Actions.
-# `narvy init-ci --github` writes this file. Safe to edit and commit.
-#
-# What it does: runs the Narvy CLI over this repository (mobile / web /
-# backend source SAST + SCA), emits SARIF, uploads it to GitHub code scanning
-# (the repo's Security tab), and fails the build when a finding is at or above
-# the severity you choose with --fail-on.
-name: Narvy SAST
-
-on:
-  push:
-    branches: [ main, master ]
-  pull_request:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  security-events: write   # required to upload SARIF to code scanning
-
-jobs:
-  narvy:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.11'
-
-      - name: Install Narvy CLI
-        run: |
-          python -m pip install --upgrade pip
-          pip install narvy
-
-      - name: Run Narvy scan
-        # The SARIF file is written before the --fail-on gate runs, so the
-        # Security tab is populated even on a failing build (see the upload
-        # step's `if: always()`).
-        run: |
-          narvy scan . \
-            --output sarif \
-            --file narvy-results.sarif \
-            --fail-on high
-
-      - name: Upload SARIF to GitHub code scanning
-        if: always()   # upload even when the scan step failed the build via --fail-on
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: narvy-results.sarif
-
-# ---------------------------------------------------------------------------
-# Scanning a web app URL too? Add a second step (needs no account):
-#   - name: Narvy passive web scan
-#     run: narvy web-scan "https://staging.example.com" --format sarif --output-file web.sarif --fail-on high
-#   - if: always()
-#     uses: github/codeql-action/upload-sarif@v3
-#     with:
-#       sarif_file: web.sarif
-#       category: narvy-web
-# ---------------------------------------------------------------------------

narvy_cli-1.0.1/narvy/ci_templates/gitlab.yml

@@ -1,32 +0,0 @@
-# Narvy SAST - free security scanning in GitLab CI.
-# `narvy init-ci --gitlab` writes this file. Safe to edit and commit.
-#
-# If you ALREADY have a .gitlab-ci.yml, do NOT overwrite it - copy the
-# `narvy_sast` job below into your existing pipeline instead.
-#
-# What it does: runs the Narvy CLI over the repository, emits SARIF,
-# saves it as a job artifact, and fails the pipeline when a finding is at or
-# above the severity you choose with --fail-on.
-#
-# NOTE on GitLab's Security Dashboard: native ingestion
-# (artifacts:reports:sast) expects GitLab's OWN SAST report schema, which this
-# CLI does not emit. The SARIF is stored as a plain downloadable artifact and
-# the pipeline gate (--fail-on) still blocks the MR. Surfacing findings inside
-# the Security tab would require converting SARIF -> GitLab SAST schema, which
-# this template does not do.
-stages:
-  - test
-
-narvy_sast:
-  stage: test
-  image: python:3.11-slim
-  before_script:
-    - pip install --upgrade pip
-    - pip install narvy
-  script:
-    - narvy scan . --output sarif --file narvy-results.sarif --fail-on high
-  artifacts:
-    when: always   # keep the SARIF even when --fail-on failed the pipeline
-    paths:
-      - narvy-results.sarif
-    expire_in: 1 week