narvy-cli 1.0.2__tar.gz → 1.0.3__tar.gz

{narvy_cli-1.0.2/narvy_cli.egg-info → narvy_cli-1.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: narvy-cli
-Version: 1.0.2
+Version: 1.0.3
 Summary: Free, local SAST scanner for Android, iOS, and polyglot web/backend source - plus passive web, host-audit, and cloud-posture scanning.
 Author: Narvy
 License: Apache-2.0

{narvy_cli-1.0.2 → narvy_cli-1.0.3}/narvy/__init__.py

@@ -1,3 +1,3 @@
 """Narvy CLI - free, local SAST for Android, iOS and polyglot source."""
 
-__version__ = "1.0.2"
+__version__ = "1.0.3"

{narvy_cli-1.0.2 → narvy_cli-1.0.3}/narvy/android/source_analyzer.py

@@ -35,6 +35,102 @@ _SKIP_DIR_NAMES = frozenset({
 _NAMESPACE_RE = re.compile(r'\bnamespace\s*=?\s*["\']([\w.]+)["\']')
 _APPLICATION_ID_RE = re.compile(r'\bapplicationId\s*=?\s*["\']([\w.]+)["\']')
 
+# Name-based hardcoded-secret rules prone to preference-key / type-name echoes.
+_SECRET_NAME_RULE_IDS = frozenset({
+    "AND-S-001", "AND-S-002", "AND-S-010",
+    "android-hardcoded-credential-java", "android-hardcoded-credential-kotlin",
+})
+_TYPE_DECL_RE = re.compile(r'\b(?:class|interface|object|enum)\b\s+[A-Za-z_]')
+_QUOTED_RE = re.compile(r'"([^"\n]*)"')
+_IDENT_VALUE_RE = re.compile(r'^[a-z][a-z0-9_]*$')
+_LHS_NAME_RE = re.compile(r'([A-Za-z_][A-Za-z0-9_]*)\s*(?::[^=\n]*)?=\s*"')
+# Preference-key constant naming (KEY_.../PREF_...): its value is a settings-store
+# key string, not a secret.
+_PREFKEY_CONST_RE = re.compile(r'^(?:KEY|PREF|PREFS|PREFERENCE|SETTING|SETTINGS)_', re.IGNORECASE)
+
+# Test / fixture locations where a headline CRITICAL/HIGH is usually a fixture.
+_TEST_PATH_FRAGMENTS = (
+    "/test/", "/tests/", "/androidtest/", "/__tests__/", "/spec/", "/specs/",
+    "/fixtures/", "/fixture/", "/testdata/", "/mocks/", "/__mocks__/",
+)
+_TEST_FILE_RE = re.compile(
+    r"(?:^|[._-])(?:test|tests|spec|specs|mock|mocks|fixture|fixtures)(?:[._-]|$)",
+    re.IGNORECASE,
+)
+
+
+def _line_text(source_dir: str, rel_path: str, line: int) -> str:
+    try:
+        full = os.path.join(source_dir, rel_path)
+        with open(full, "r", encoding="utf-8", errors="ignore") as fh:
+            for i, text in enumerate(fh, start=1):
+                if i == line:
+                    return text
+    except OSError:
+        pass
+    return ""
+
+
+def _is_prefkey_echo_or_typename(line: str) -> bool:
+    """A preference-key-name literal echoing its constant, or a class/type name - not a real secret."""
+    if '"' not in line and _TYPE_DECL_RE.search(line):
+        return True
+    m = _QUOTED_RE.search(line)
+    if not m:
+        return False
+    val = m.group(1)
+    if not _IDENT_VALUE_RE.match(val):
+        return False
+    lhs = _LHS_NAME_RE.search(line)
+    if not lhs:
+        return False
+    name = lhs.group(1)
+    # Echo: the value repeats the constant name, or the constant is a KEY_*/PREF_*
+    # preference-key holding a settings-store key slug (e.g. KEY_SECRET_TOKEN =
+    # "secret_token_pref").
+    return val.lower() in name.lower() or bool(_PREFKEY_CONST_RE.match(name))
+
+
+def _has_no_string_literal_rhs(line: str) -> bool:
+    """A name-based secret match whose right-hand side has NO string literal - a
+    function call or identifier (e.g. `val apiKey = getApiKeyOrDefault()`), not a
+    hardcoded secret. A real hardcoded secret is always a quoted literal."""
+    return not _QUOTED_RE.search(line)
+
+
+def _drop_prefkey_echo_secrets(source_dir: str, findings: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
+    kept = []
+    for f in findings:
+        if f.get("rule_id") in _SECRET_NAME_RULE_IDS:
+            line = _line_text(source_dir, f.get("file_path", ""), f.get("line") or 0)
+            if line and (_has_no_string_literal_rhs(line) or _is_prefkey_echo_or_typename(line)):
+                continue
+        kept.append(f)
+    return kept
+
+
+def _is_test_path(rel_path: str) -> bool:
+    p = "/" + rel_path.replace("\\", "/").lstrip("/")
+    if any(frag in p.lower() for frag in _TEST_PATH_FRAGMENTS):
+        return True
+    return bool(_TEST_FILE_RE.search(p.rsplit("/", 1)[-1]))
+
+
+def _downrank_test_findings(findings: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
+    """Lower (never drop) CRITICAL/HIGH/MEDIUM findings in test/fixture paths to LOW and tag them."""
+    note = (
+        " [Narvy: this hit is in a test/fixture path, where such code is usually a "
+        "fixture rather than shipped app code, so severity is lowered - confirm it "
+        "is not a real production issue.]"
+    )
+    for f in findings:
+        if f.get("severity") in ("CRITICAL", "HIGH", "MEDIUM") and _is_test_path(f.get("file_path", "")):
+            f["severity"] = "LOW"
+            details = f.setdefault("details", {})
+            if isinstance(details, dict) and note.strip() not in (details.get("description") or ""):
+                details["description"] = (details.get("description") or "") + note
+    return findings
+
 # A module may use either source-root name, or both.
 _SRC_LEAF_DIRS = ("java", "kotlin")
 _MAX_INFER_DEPTH = 12
@@ -254,6 +350,9 @@ def analyze_source(source_dir: str, override_config: Optional[ScopeConfig] = Non
 
     rule_defs = list(rules) + semgrep_rule_defs
 
+    all_findings = _drop_prefkey_echo_secrets(source_dir, all_findings)
+    all_findings = _downrank_test_findings(all_findings)
+
     return {
         "ok": True,
         "error": None,

{narvy_cli-1.0.2 → narvy_cli-1.0.3}/narvy/main.py

@@ -132,7 +132,20 @@ _WEB_SOURCE_MARKER_FILES = (
 _WEB_SOURCE_MARKER_SUFFIXES = (
     ".gemspec", ".csproj", ".fsproj", ".vbproj", ".sln", ".slnx",
 )
-_WEB_SOURCE_DETECT_MAX_DEPTH = 3
+# Fallback when a project ships no manifest at all (a classic PHP app is often
+# just .php files, no composer.json). Only reached after the iOS-source and
+# Android-source checks return False, so these extensions mean web/backend source.
+_WEB_SOURCE_CODE_EXTS = (
+    ".php", ".py", ".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx",
+    ".go", ".rb", ".rs", ".java", ".cs", ".vb", ".fs",
+)
+# 6 to match the iOS/Android detectors: monorepos nest a service's manifest
+# several levels deep (org/team/service/src), so a shallow cap missed them.
+_WEB_SOURCE_DETECT_MAX_DEPTH = 6
+
+# .NET manifests. A cross-platform .NET app (MAUI/Xamarin) ships a generated
+# AndroidManifest.xml but is C# at heart, so it must not route to android-source.
+_DOTNET_PROJECT_SUFFIXES = (".sln", ".slnx", ".csproj", ".fsproj", ".vbproj")
 
 
 def _looks_like_web_source_dir(path: str) -> bool:
@@ -146,7 +159,9 @@ def _looks_like_web_source_dir(path: str) -> bool:
         dirs[:] = [d for d in dirs if d not in _ANDROID_SKIP_DIR_NAMES and not d.startswith(".")
                    and d not in ("node_modules", "vendor")]
         for f in files:
-            if f in _WEB_SOURCE_MARKER_FILES or f.endswith(_WEB_SOURCE_MARKER_SUFFIXES):
+            if (f in _WEB_SOURCE_MARKER_FILES
+                    or f.endswith(_WEB_SOURCE_MARKER_SUFFIXES)
+                    or f.endswith(_WEB_SOURCE_CODE_EXTS)):
                 return True
     return False
 
@@ -173,20 +188,19 @@ def _looks_like_ios_source_dir(path: str) -> bool:
 
 
 def _has_ios_project_marker(path: str) -> bool:
-    """Strong iOS signal: an Xcode project/workspace or SwiftPM Package.swift (a bare .swift/.m file is not enough)."""
-    base_depth = path.rstrip(os.sep).count(os.sep)
-    for root, dirs, files in os.walk(path):
-        depth = root.rstrip(os.sep).count(os.sep) - base_depth
-        if depth >= _IOS_DETECT_MAX_DEPTH:
-            dirs[:] = []
-            continue
-        dirs[:] = [d for d in dirs if d not in IOS_VENDOR_DIR_NAMES and d not in (".git", "node_modules")]
-        for d in dirs:
-            if d.endswith(_IOS_SOURCE_MARKER_EXTS):
-                return True
-        for f in files:
-            if f in _IOS_SOURCE_MARKER_FILES:
-                return True
+    """Strong iOS signal: an Xcode project/workspace or SwiftPM Package.swift AT
+    THE SCAN ROOT only. A .xcodeproj buried under examples/ (a mobile sample
+    inside a web/TS repo) must NOT flip the whole repo to iOS - a root-level web
+    manifest then wins, and a genuinely iOS-only project whose .xcodeproj is
+    nested is still caught by the weak _looks_like_ios_source_dir fallback that
+    runs after the web-source check."""
+    try:
+        entries = os.listdir(path)
+    except OSError:
+        return False
+    for e in entries:
+        if e.endswith(_IOS_SOURCE_MARKER_EXTS) or e in _IOS_SOURCE_MARKER_FILES:
+            return True
     return False
 
 
@@ -203,15 +217,82 @@ def _file_head_contains(path: str, needles, regex=None) -> bool:
     return bool(regex and regex.search(head))
 
 
+def _has_android_gradle_marker(path: str) -> bool:
+    """True if path holds an Android Gradle build (AGP plugin id, `android {}` DSL, or AndroidX property)."""
+    base_depth = path.rstrip(os.sep).count(os.sep)
+    for root, dirs, files in os.walk(path):
+        depth = root.rstrip(os.sep).count(os.sep) - base_depth
+        if depth >= _ANDROID_DETECT_MAX_DEPTH:
+            dirs[:] = []
+            continue
+        dirs[:] = [d for d in dirs if d not in _ANDROID_SKIP_DIR_NAMES and not d.startswith(".")]
+        for f in files:
+            if f.endswith(_ANDROID_GRADLE_FILE_SUFFIXES) or f == _ANDROID_VERSION_CATALOG_FILENAME:
+                if _file_head_contains(os.path.join(root, f), _ANDROID_GRADLE_PLUGIN_IDS,
+                                       _ANDROID_GRADLE_DSL_RE):
+                    return True
+            elif f in _ANDROID_MARKER_PROPERTY_FILES:
+                if _file_head_contains(os.path.join(root, f), _ANDROID_MARKER_PROPERTIES):
+                    return True
+    return False
+
+
+def _has_android_manifest(path: str) -> bool:
+    """True if an AndroidManifest.xml exists anywhere in the (pruned) tree."""
+    base_depth = path.rstrip(os.sep).count(os.sep)
+    for root, dirs, files in os.walk(path):
+        depth = root.rstrip(os.sep).count(os.sep) - base_depth
+        if depth >= _ANDROID_DETECT_MAX_DEPTH:
+            dirs[:] = []
+            continue
+        dirs[:] = [d for d in dirs if d not in _ANDROID_SKIP_DIR_NAMES and not d.startswith(".")]
+        if _ANDROID_MANIFEST_FILENAME in files:
+            return True
+    return False
+
+
+def _has_dotnet_project_marker(path: str) -> bool:
+    """True if a .NET solution/project file exists (.sln/.csproj/.fsproj/.vbproj)."""
+    base_depth = path.rstrip(os.sep).count(os.sep)
+    for root, dirs, files in os.walk(path):
+        depth = root.rstrip(os.sep).count(os.sep) - base_depth
+        if depth >= _ANDROID_DETECT_MAX_DEPTH:
+            dirs[:] = []
+            continue
+        dirs[:] = [d for d in dirs if d not in _ANDROID_SKIP_DIR_NAMES and not d.startswith(".")]
+        for f in files:
+            if f.endswith(_DOTNET_PROJECT_SUFFIXES):
+                return True
+    return False
+
+
 def _looks_like_android_source_dir(path: str) -> bool:
     """True if path holds an AndroidManifest.xml or an Android Gradle marker."""
-    base_depth = path.rstrip(os.sep).count(os.sep)
+    return _has_android_manifest(path) or _has_android_gradle_marker(path)
+
+
+def _has_android_marker_outside_android_dirs(path: str) -> bool:
+    """True if an AndroidManifest.xml or Android Gradle marker is reachable
+    WITHOUT passing through a directory segment named 'android'. A native Android
+    project puts markers at the root / app/ (a Gradle project that IS the root);
+    a RN/Capacitor monorepo confines every native marker under an android/ dir
+    (the top-level android/, or a per-module modules/x/android/)."""
+    base = path.rstrip(os.sep)
+    base_depth = base.count(os.sep)
+
+    def outside_android(root: str) -> bool:
+        rel = os.path.relpath(root, path)
+        segs = [] if rel == "." else rel.split(os.sep)
+        return "android" not in segs
+
     for root, dirs, files in os.walk(path):
         depth = root.rstrip(os.sep).count(os.sep) - base_depth
         if depth >= _ANDROID_DETECT_MAX_DEPTH:
             dirs[:] = []
             continue
         dirs[:] = [d for d in dirs if d not in _ANDROID_SKIP_DIR_NAMES and not d.startswith(".")]
+        if not outside_android(root):
+            continue
         if _ANDROID_MANIFEST_FILENAME in files:
             return True
         for f in files:
@@ -225,6 +306,20 @@ def _looks_like_android_source_dir(path: str) -> bool:
     return False
 
 
+def _is_hybrid_web_primary(path: str) -> bool:
+    """A React Native / Capacitor monorepo: a root package.json plus real JS/TS
+    source, with every native Android marker confined under an android/ dir. The
+    JS/TS is the primary surface, so scan web-source and leave a loud note for
+    the uncovered native shell. A native Android app with a stray root
+    package.json keeps Android markers outside android/ (root / app/), so it is
+    NOT flipped."""
+    if not os.path.isfile(os.path.join(path, "package.json")):
+        return False
+    if not _has_code_outside(path, _JS_CODE_EXTS, _HYBRID_SKIP_DIRS):
+        return False
+    return not _has_android_marker_outside_android_dirs(path)
+
+
 def _looks_like_jvm_non_android_dir(path: str) -> bool:
     """Only valid after _looks_like_android_source_dir and _looks_like_web_source_dir said no."""
     base_depth = path.rstrip(os.sep).count(os.sep)
@@ -247,7 +342,17 @@ def _detect_scan_mode(target_path: str) -> str:
             return "ios-source"
         # Android/web manifests beat a stray .m/.mm/.swift file (e.g. a Cgo bridge in a Go repo).
         if _looks_like_android_source_dir(target_path):
-            return "android-source"
+            # RN/Capacitor monorepo: native lives only in a nested android/ subdir
+            # while the primary JS/TS surface sits at the root. Scan the JS/TS.
+            if _is_hybrid_web_primary(target_path):
+                return "web-source"
+            # A .NET cross-platform project (MAUI/Xamarin) has an AndroidManifest.xml
+            # but no Android Gradle build; its C# code belongs in web-source, not the
+            # java/kotlin-only Android analyzer.
+            if _has_dotnet_project_marker(target_path) and not _has_android_gradle_marker(target_path):
+                pass
+            else:
+                return "android-source"
         if _looks_like_web_source_dir(target_path):
             return "web-source"
         if _looks_like_jvm_non_android_dir(target_path):
@@ -281,6 +386,106 @@ def _detect_scan_mode(target_path: str) -> str:
     )
 
 
+_JS_CODE_EXTS = (".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx")
+_HYBRID_SKIP_DIRS = frozenset({
+    "node_modules", ".git", "build", "dist", "out", ".gradle", "Pods",
+    "android", "ios", "vendor", "__pycache__", ".dart_tool",
+})
+
+
+def _has_code_outside(target_path: str, exts, skip_dirs, max_depth: int = 4) -> bool:
+    """True if a source file with one of `exts` exists outside `skip_dirs`."""
+    base_depth = target_path.rstrip(os.sep).count(os.sep)
+    for root, dirs, files in os.walk(target_path):
+        depth = root.rstrip(os.sep).count(os.sep) - base_depth
+        if depth >= max_depth:
+            dirs[:] = []
+            continue
+        dirs[:] = [d for d in dirs if d not in skip_dirs and not d.startswith(".")]
+        if any(f.endswith(exts) for f in files):
+            return True
+    return False
+
+
+def _subdir_has(target_path: str, subdir: str, exts, names=(), max_depth: int = 4) -> bool:
+    root_dir = os.path.join(target_path, subdir)
+    if not os.path.isdir(root_dir):
+        return False
+    base_depth = root_dir.rstrip(os.sep).count(os.sep)
+    for root, dirs, files in os.walk(root_dir):
+        depth = root.rstrip(os.sep).count(os.sep) - base_depth
+        if depth >= max_depth:
+            dirs[:] = []
+            continue
+        dirs[:] = [d for d in dirs if not d.startswith(".") and d not in ("build", "Pods")]
+        for f in files:
+            if f.endswith(exts) or f in names:
+                return True
+        for d in dirs:
+            if d.endswith((".xcodeproj", ".xcworkspace")):
+                return True
+    return False
+
+
+def _uncovered_surface_notes(target_path: str, scan_mode: str) -> List[str]:
+    """Significant OTHER code surfaces present in a hybrid tree that the chosen
+    scan_mode does NOT cover (React Native / Flutter / Capacitor monorepos scan
+    only the native shell). Detection precedence is unchanged - this only makes
+    the gap loud instead of silent."""
+    if not os.path.isdir(target_path):
+        return []
+    notes: List[str] = []
+    covers_js = scan_mode == "web-source"
+    covers_android = scan_mode == "android-source"
+    covers_ios = scan_mode in ("ios-source", "ios-binary")
+
+    # JS/TS primary code (RN / Capacitor): root package.json + JS outside native shells.
+    if not covers_js and os.path.isfile(os.path.join(target_path, "package.json")) \
+       and _has_code_outside(target_path, _JS_CODE_EXTS, _HYBRID_SKIP_DIRS):
+        notes.append(
+            "JavaScript/TypeScript code (a root package.json and .js/.ts files) is "
+            "present but was NOT scanned - only the native shell was. Scan it with "
+            "`narvy scan <dir>/src` (or the JS/TS subdirectory)."
+        )
+    # Dart / Flutter primary code.
+    if scan_mode != "web-source" and os.path.isfile(os.path.join(target_path, "pubspec.yaml")) \
+       and _subdir_has(target_path, "lib", (".dart",)):
+        notes.append(
+            "Dart/Flutter code (pubspec.yaml and lib/*.dart) is present but was NOT "
+            "scanned - only the native shell was. Narvy has no Dart source analyzer; "
+            "scan the native android/ and ios/ shells separately for now."
+        )
+    # An ios/ tree not covered by an Android/web scan. Fall back to a tree-wide
+    # check for a hybrid whose native code is scattered (e.g. Expo modules/x/ios).
+    if not covers_ios:
+        if _subdir_has(target_path, "ios", (".swift", ".m", ".mm"), ("Info.plist",)):
+            notes.append(
+                "An ios/ project tree is present but was NOT scanned - this scan covered "
+                "a different surface. Scan it with `narvy scan <dir>/ios`."
+            )
+        elif scan_mode == "web-source" and _looks_like_ios_source_dir(target_path):
+            notes.append(
+                "Native iOS code (Swift/Obj-C) is present in this repo but was NOT "
+                "scanned - only the JS/TS surface was. Scan each native module or "
+                "the ios/ shell separately with `narvy scan <path>`."
+            )
+    # An android/ tree not covered by an iOS/web scan, with the same fallback.
+    if not covers_android:
+        if _subdir_has(target_path, "android", (".java", ".kt"),
+                       ("AndroidManifest.xml", "build.gradle")):
+            notes.append(
+                "An android/ project tree is present but was NOT scanned - this scan "
+                "covered a different surface. Scan it with `narvy scan <dir>/android`."
+            )
+        elif scan_mode == "web-source" and _looks_like_android_source_dir(target_path):
+            notes.append(
+                "Native Android code (AndroidManifest.xml / *.kt / *.java) is present "
+                "in this repo but was NOT scanned - only the JS/TS surface was. Scan "
+                "each native module or the android/ shell separately with `narvy scan <path>`."
+            )
+    return notes
+
+
 def _positive_int(value):
     """argparse type: a whole number >= 1. Rejects 0 and negatives client-side
     with a clean exit-2 error rather than forwarding a nonsense --limit."""
@@ -565,17 +770,32 @@ def _sca_coverage(stats):
         reasons.append("osv_dependency_cap")
     if stats.get("github_rate_limited"):
         reasons.append("github_advisory_rate_limit")
+    # A manifest present in the tree whose deps never reached OSV (e.g. a Gemfile
+    # without a lockfile, an unsupported lock format) makes 'complete' a false
+    # all-clear: degrade to 'partial' and name what was left unresolved.
+    unparsed = stats.get("unparsed_manifests") or []
+    if unparsed:
+        reasons.append("unparsed_manifest")
     # An OSV outage / cold cache means "0 CVEs" is UNKNOWN, not clean: degrade, don't pass.
     unreachable = bool(stats.get("osv_unreachable"))
     if unreachable:
         reasons.append("osv_unreachable")
+    # 0 resolved dependencies is never 'complete' coverage: a manifest we don't
+    # yet parse (Gradle version catalogs, gemspec-only, pyproject without a lock)
+    # produces 0 deps, and claiming 'complete' there is a false all-clear.
+    if not detected and not unreachable and not reasons:
+        status = "none"
+    else:
+        status = "degraded" if unreachable else ("partial" if reasons else "complete")
     cov = {
-        "status": "degraded" if unreachable else ("partial" if reasons else "complete"),
+        "status": status,
         "dependencies_detected": detected,
         "dependencies_checked": checked,
     }
     if reasons:
         cov["degraded_reasons"] = reasons
+    if unparsed:
+        cov["unparsed_manifests"] = unparsed
     if stats.get("osv_dependencies_unresolved"):
         cov["dependencies_unresolved"] = stats["osv_dependencies_unresolved"]
     return cov
@@ -982,6 +1202,9 @@ def _scan_to_json(all_findings, rules, scan_mode, target_path, encrypted, scan_m
     sca_cov = (scan_meta or {}).get("sca_coverage")
     if sca_cov is not None:
         summary["sca_coverage"] = sca_cov
+    uncovered = (scan_meta or {}).get("uncovered_surfaces")
+    if uncovered:
+        summary["uncovered_surfaces"] = uncovered
     return {
         "tool": "Narvy CLI",
         "version": __version__,
@@ -1071,6 +1294,14 @@ def cmd_scan(args):
         scan_meta = {}
     encrypted_scan = bool(scan_meta.get("encrypted"))
 
+    # Honesty: if this scan mode left a significant other code surface uncovered
+    # (a hybrid RN/Flutter/Capacitor monorepo scans only the native shell), say so
+    # loudly instead of exiting 0 in silence. Detection precedence is unchanged.
+    uncovered_notes = _uncovered_surface_notes(target_path, scan_mode)
+    if uncovered_notes:
+        scan_meta = dict(scan_meta)
+        scan_meta["uncovered_surfaces"] = uncovered_notes
+
     if args.output in ('sarif', 'json'):
         # Written to a file, never stdout: progress notes would interleave.
         if args.output == 'sarif':
@@ -1143,6 +1374,14 @@ def cmd_scan(args):
                     "it - see the '.narvy-scope.yml' section of the CLI's SETUP.md[/dim]"
                 )
 
+    if uncovered_notes:
+        console.print(
+            "\n[bold yellow]COVERAGE NOTICE: this scan did not cover the whole "
+            f"project.[/bold yellow] Scanned mode: [bold]{scan_mode}[/bold]."
+        )
+        for note in uncovered_notes:
+            console.print(f"[bold yellow]  - {note}[/bold yellow]")
+
     if args.upload and not getattr(args, "upload_binary", False):
         _submit_results_ingest(all_findings, scan_mode, target_path)
     elif args.upload:

{narvy_cli-1.0.2 → narvy_cli-1.0.3}/narvy/rules/web/python.yml

@@ -2506,14 +2506,12 @@ rules:
     - Hard-coded Secrets
   paths:
     exclude:
-    - '**/test*/**'
-    - '**/tests/**'
-    - '**/*test*.py'
+    # Test/fixture paths are NOT excluded: a real credential committed there is a
+    # common leak vector; it is emitted then down-ranked to LOW. Only example/doc
+    # code (whose literals are illustrative, not live) stays excluded.
     - '**/*example*.py'
     - '**/docs_src/**'
     - '**/examples/**'
-    - '**/conftest.py'
-    - '**/fixtures/**'
   patterns:
   - pattern-either:
     - pattern: $VAR = "$LITERAL"

{narvy_cli-1.0.2 → narvy_cli-1.0.3}/narvy/rules/web/secrets.yml

@@ -1163,6 +1163,15 @@ rules:
   - pattern-not-regex: (?i)(user|username|xxxx|\$\{|%s|<[a-z_]+>|localhost)
   languages:
   - generic
+  # Template env files (.env.example/.sample/.dist) and CI workflow yml carry
+  # placeholder creds, not real leaks; real .env stays in scope.
+  paths:
+    exclude:
+    - '*.example'
+    - '*.sample'
+    - '*.dist'
+    - '.github/workflows/*'
+    - '**/.github/workflows/*'
   message: A connection string / URL embeds a username:password before the host (scheme://user:pass@host).
     Database, message-queue, and API URIs with inline credentials leak into logs, shell history, and process
     listings. Pass credentials via a separate auth mechanism or env var instead.

{narvy_cli-1.0.2 → narvy_cli-1.0.3}/narvy/rules/web/secrets_supplement.yml

@@ -327,6 +327,12 @@ rules:
     - '*Podfile.lock'
     - '*cargo.lock'
     - '*.xcscmblueprint'
+    # Template env files and CI workflow yml hold placeholder keys, not real ones.
+    - '*.example'
+    - '*.sample'
+    - '*.dist'
+    - '.github/workflows/*'
+    - '**/.github/workflows/*'
 
 - id: narvy.secrets.generic-high-entropy-assignment
   patterns:
@@ -377,7 +383,5 @@ rules:
     - '*bundle.js'
     - '*vendor/*'
     - '*node_modules/*'
-    - '*test*'
-    - '*spec*'
-    - '*mock*'
-    - '*fixture*'
+    # Test/spec/mock/fixture paths are NOT excluded: a real secret committed to a
+    # test fixture is a common leak vector; it is emitted then down-ranked to LOW.