proofctl 0.5.7__tar.gz → 0.6.0__tar.gz

{proofctl-0.5.7 → proofctl-0.6.0}/MANIFEST.in

@@ -11,8 +11,6 @@ prune examples
 prune build
 prune dist
 prune .github
-exclude AUDIT_AND_ROADMAP.md
-exclude AUDIT_VERIFICATION_v0.1.11.md
 
 global-exclude __pycache__
 global-exclude *.py[cod]

{proofctl-0.5.7/proofctl.egg-info → proofctl-0.6.0}/PKG-INFO

@@ -1,10 +1,14 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.5.7
-Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
-Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
+Version: 0.6.0
+Summary: DevOps linter and security scanner for AI slop and misconfigurations — runs in pre-commit, CI, or post-commit; no external tools required
+Author: Kolawolu Odunola
 License: MIT
-Keywords: linter,security,terraform,kubernetes,ai,static-analysis,pre-commit
+Project-URL: Homepage, https://github.com/devopscatalyst/proofctl
+Project-URL: Repository, https://github.com/devopscatalyst/proofctl
+Project-URL: Changelog, https://github.com/devopscatalyst/proofctl/blob/main/HISTORY.md
+Project-URL: Issues, https://github.com/devopscatalyst/proofctl/issues
+Keywords: linter,security-scanner,sast,iac,secrets-detection,terraform,kubernetes,ai,static-analysis,pre-commit,ci-cd,devops
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
@@ -13,6 +17,7 @@ Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Software Development :: Quality Assurance
 Classifier: Topic :: Security
 Requires-Python: >=3.11
@@ -24,27 +29,29 @@ Requires-Dist: pyyaml>=6
 Provides-Extra: dev
 Requires-Dist: pytest>=8; extra == "dev"
 Requires-Dist: pytest-mock>=3; extra == "dev"
+Requires-Dist: mypy>=1.8; extra == "dev"
+Requires-Dist: ruff>=0.4; extra == "dev"
 Dynamic: license-file
 
 # proofctl
 
-A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **268 rules**, zero dependencies, runs in under a second.
+A static-analysis linter and security scanner for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **267 rules**, no external tools, runs in under a second.
 
 ```
 proofctl check .
 ```
 
-```
-PROOFCTL-S-001     module/auth.py:42                 SQL injection via string format in .execute()           ERROR
-PROOFCTL-Q-001     module/models.py:17               Mutable default argument — list assigned at def time    ERROR
-PROOFCTL-S-AI-006  module/loaders.py:88              Empty `except Exception:` swallows all errors silently  WARNING
-PROOFCTL-TF-A024   infra/sg.tf:14                    SG rule 0.0.0.0/0 ingress on port 22                    ERROR
-PROOFCTL-YAML-022  k8s/deployment.yaml:8             Workload uses default namespace                         WARNING
-PROOFCTL-YAML-007  .github/workflows/release.yml:23  Action not pinned to SHA                                ERROR
-PROOFCTL-SECRET-001 infra/lambda.tf:8                AWS access key (AKIA...)                                ERROR
-──────────────────────────────────────────────────────────────────
-7 findings (4 ERROR, 3 WARNING) — exit 2
-```
+| Rule | Location | Issue | Severity |
+|------|----------|-------|:--------:|
+| `PROOFCTL-S-001` | `module/auth.py:42` | SQL injection via string format in `.execute()` | **ERROR** |
+| `PROOFCTL-Q-001` | `module/models.py:17` | Mutable default argument — list assigned at def time | **ERROR** |
+| `PROOFCTL-Q-002` | `module/loaders.py:88` | Empty `except Exception:` swallows all errors silently | WARNING |
+| `PROOFCTL-TF-A024` | `infra/sg.tf:14` | SG rule `0.0.0.0/0` ingress on port 22 | **ERROR** |
+| `PROOFCTL-YAML-022` | `k8s/deployment.yaml:8` | Workload uses default namespace | WARNING |
+| `PROOFCTL-YAML-007` | `.github/workflows/release.yml:23` | Action not pinned to SHA | **ERROR** |
+| `PROOFCTL-SECRET-001` | `infra/lambda.tf:8` | AWS access key (`AKIA...`) | **ERROR** |
+
+> **7 findings** (4 ERROR, 3 WARNING) — exits non-zero (`exit 2`) so CI fails the build.
 
 ---
 
@@ -53,11 +60,11 @@ PROOFCTL-SECRET-001 infra/lambda.tf:8                AWS access key (AKIA...)
 LLM coding assistants ship code that compiles and looks correct but fails in predictable ways:
 
 - **Insecure** — SQL/command injection, hardcoded credentials, weak crypto, JWT signature bypass, public S3 buckets, K8s default namespaces.
-- **Broken** — hallucinated imports, phantom methods, type-hint vs implementation mismatch, `pass`-bodied functions shipped as real implementations.
+- **Broken** — hallucinated imports, type-hint vs implementation mismatch, `pass`-bodied functions shipped as real implementations.
 - **Fragile** — broad `except Exception:`, no timeouts, mutable defaults, defensive guards for impossible states, unused configuration kwargs.
 - **Wasteful** — single-method classes that should be functions, near-duplicate files, sprawling kwargs surface.
 
-proofctl runs as a pre-commit linter and catches these patterns before they merge. The top-firing rules on real AI-authored code are **Q-002 broad except**, **Q-005 complexity**, **Q-006 long functions**, **YAML-007 / YAML-GHA-006 GitHub Actions hygiene**, and **YAML-GHA-003 missing permissions**.
+proofctl runs in pre-commit hooks, CI pipelines, or against an existing tree, catching these patterns before they merge. The top-firing rules on real AI-authored code are **Q-002 broad except**, **Q-005 complexity**, **Q-006 long functions**, **YAML-007 / YAML-GHA-006 GitHub Actions hygiene**, and **YAML-GHA-003 missing permissions**.
 
 ---
 
@@ -165,23 +172,23 @@ git commit -m "chore: add proofctl baseline"
 
 ## Rules
 
-269 rules across 14 families. Run `proofctl rules` after install to enumerate.
+267 rules across 13 families. Run `proofctl rules` after install to enumerate.
 
 | Family | Count | What it covers |
 |---|---|---|
 | Python — Quality (`Q`) | 17 | Mutable defaults, broad `except`, complexity, long functions, AI-slop patterns (echo docstrings, single-method classes, stale kwargs, defensive guards) |
 | Python — Security (`S`) | 24 | OWASP Top-10 + CWE coverage: SQLi, command injection, weak crypto, JWT bypass, path traversal, XSS, SSRF, file upload, CSRF, missing authz, XPath injection, open redirect, TLS bypass |
 | Secrets (`SECRET`) | 13 | AWS / GCP / GitHub / Slack / Stripe / private keys / JWTs / hardcoded passwords / K8s Secret YAML / connection strings with embedded creds |
-| Python — Other | 11 | Placeholders, leakage (cross-language idioms, PII), import hallucination, variant detection, LLM guardrails (OWASP LLM Top-10) |
-| Terraform — General + AI (`TF-T`, `TF-AI`) | 29 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata, unused variable declarations |
-| Terraform — AWS (`TF-A`) | 40 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
-| Terraform — GCP (`TF-G`) | 52 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |
+| Python — Other | 15 | Placeholders, leakage (cross-language idioms, PII), import hallucination, variant detection, LLM guardrails (OWASP LLM Top-10) |
+| Terraform — General + AI (`TF-T`, `TF-AI`) | 25 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata, unused variable declarations |
+| Terraform — AWS (`TF-A`) | 36 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
+| Terraform — GCP (`TF-G`) | 46 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |
 | Terraform — Azure (`TF-AZ`) | 14 | Storage public blob, SQL public network, AKS RBAC, Key Vault purge protection, NSG SSH/RDP, managed disk CMK |
-| Terraform — Mechanics + Lifecycle (`TF-M`, `TF-V`) | 12 | SG inline mixing, `force_destroy`, mutable module refs, lifecycle antipatterns |
+| Terraform — Mechanics + Lifecycle (`TF-M`, `TF-V`) | 10 | SG inline mixing, `force_destroy`, mutable module refs, lifecycle antipatterns |
 | Terragrunt (`TG`) | 6 | HCL inputs, mock_outputs, remote state encryption |
 | Dockerfile (`DF`) | 15 | Latest tag, root user, secret leakage, OCI labels, HEALTHCHECK, legacy ENV form |
-| Kubernetes YAML (`YAML`) | 26 | Pod Security Standards, hostPath, default namespace, image digest pinning, RBAC wildcards |
-| GitHub Actions (`YAML-GHA`) | — | SHA pinning, expression injection, missing permissions, secret env-var leakage, missing timeouts |
+| Kubernetes YAML (`YAML`) | 32 | Pod Security Standards, hostPath, default namespace, image digest pinning, RBAC wildcards |
+| GitHub Actions (`YAML-GHA`) | 6 | SHA pinning, expression injection, missing permissions, secret env-var leakage, missing timeouts |
 | Shell (`SH`) | 8 | Dangerous globbing, missing `set -euo pipefail` |
 
 ```bash
@@ -280,7 +287,7 @@ Options:
   --format / -f        terminal | json | html           (default: terminal)
   --output / -o        Write report to file
   --changed-only       Only scan git-changed files
-  --families           P,Q,S,L,I,M,V,LLM,TF,TG,DF,YAML,SH,SECRET
+  --families           P,Q,S,L,I,V,LLM,TF,TG,DF,YAML,SH,SECRET
   --min-severity       INFO | WARNING | ERROR
   --fail-on            Exit non-zero at this severity (default: WARNING)
   --no-pypi            Skip PyPI lookups (faster, works offline)

{proofctl-0.5.7 → proofctl-0.6.0}/README.md

@@ -1,22 +1,22 @@
 # proofctl
 
-A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **268 rules**, zero dependencies, runs in under a second.
+A static-analysis linter and security scanner for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **267 rules**, no external tools, runs in under a second.
 
 ```
 proofctl check .
 ```
 
-```
-PROOFCTL-S-001     module/auth.py:42                 SQL injection via string format in .execute()           ERROR
-PROOFCTL-Q-001     module/models.py:17               Mutable default argument — list assigned at def time    ERROR
-PROOFCTL-S-AI-006  module/loaders.py:88              Empty `except Exception:` swallows all errors silently  WARNING
-PROOFCTL-TF-A024   infra/sg.tf:14                    SG rule 0.0.0.0/0 ingress on port 22                    ERROR
-PROOFCTL-YAML-022  k8s/deployment.yaml:8             Workload uses default namespace                         WARNING
-PROOFCTL-YAML-007  .github/workflows/release.yml:23  Action not pinned to SHA                                ERROR
-PROOFCTL-SECRET-001 infra/lambda.tf:8                AWS access key (AKIA...)                                ERROR
-──────────────────────────────────────────────────────────────────
-7 findings (4 ERROR, 3 WARNING) — exit 2
-```
+| Rule | Location | Issue | Severity |
+|------|----------|-------|:--------:|
+| `PROOFCTL-S-001` | `module/auth.py:42` | SQL injection via string format in `.execute()` | **ERROR** |
+| `PROOFCTL-Q-001` | `module/models.py:17` | Mutable default argument — list assigned at def time | **ERROR** |
+| `PROOFCTL-Q-002` | `module/loaders.py:88` | Empty `except Exception:` swallows all errors silently | WARNING |
+| `PROOFCTL-TF-A024` | `infra/sg.tf:14` | SG rule `0.0.0.0/0` ingress on port 22 | **ERROR** |
+| `PROOFCTL-YAML-022` | `k8s/deployment.yaml:8` | Workload uses default namespace | WARNING |
+| `PROOFCTL-YAML-007` | `.github/workflows/release.yml:23` | Action not pinned to SHA | **ERROR** |
+| `PROOFCTL-SECRET-001` | `infra/lambda.tf:8` | AWS access key (`AKIA...`) | **ERROR** |
+
+> **7 findings** (4 ERROR, 3 WARNING) — exits non-zero (`exit 2`) so CI fails the build.
 
 ---
 
@@ -25,11 +25,11 @@ PROOFCTL-SECRET-001 infra/lambda.tf:8                AWS access key (AKIA...)
 LLM coding assistants ship code that compiles and looks correct but fails in predictable ways:
 
 - **Insecure** — SQL/command injection, hardcoded credentials, weak crypto, JWT signature bypass, public S3 buckets, K8s default namespaces.
-- **Broken** — hallucinated imports, phantom methods, type-hint vs implementation mismatch, `pass`-bodied functions shipped as real implementations.
+- **Broken** — hallucinated imports, type-hint vs implementation mismatch, `pass`-bodied functions shipped as real implementations.
 - **Fragile** — broad `except Exception:`, no timeouts, mutable defaults, defensive guards for impossible states, unused configuration kwargs.
 - **Wasteful** — single-method classes that should be functions, near-duplicate files, sprawling kwargs surface.
 
-proofctl runs as a pre-commit linter and catches these patterns before they merge. The top-firing rules on real AI-authored code are **Q-002 broad except**, **Q-005 complexity**, **Q-006 long functions**, **YAML-007 / YAML-GHA-006 GitHub Actions hygiene**, and **YAML-GHA-003 missing permissions**.
+proofctl runs in pre-commit hooks, CI pipelines, or against an existing tree, catching these patterns before they merge. The top-firing rules on real AI-authored code are **Q-002 broad except**, **Q-005 complexity**, **Q-006 long functions**, **YAML-007 / YAML-GHA-006 GitHub Actions hygiene**, and **YAML-GHA-003 missing permissions**.
 
 ---
 
@@ -137,23 +137,23 @@ git commit -m "chore: add proofctl baseline"
 
 ## Rules
 
-269 rules across 14 families. Run `proofctl rules` after install to enumerate.
+267 rules across 13 families. Run `proofctl rules` after install to enumerate.
 
 | Family | Count | What it covers |
 |---|---|---|
 | Python — Quality (`Q`) | 17 | Mutable defaults, broad `except`, complexity, long functions, AI-slop patterns (echo docstrings, single-method classes, stale kwargs, defensive guards) |
 | Python — Security (`S`) | 24 | OWASP Top-10 + CWE coverage: SQLi, command injection, weak crypto, JWT bypass, path traversal, XSS, SSRF, file upload, CSRF, missing authz, XPath injection, open redirect, TLS bypass |
 | Secrets (`SECRET`) | 13 | AWS / GCP / GitHub / Slack / Stripe / private keys / JWTs / hardcoded passwords / K8s Secret YAML / connection strings with embedded creds |
-| Python — Other | 11 | Placeholders, leakage (cross-language idioms, PII), import hallucination, variant detection, LLM guardrails (OWASP LLM Top-10) |
-| Terraform — General + AI (`TF-T`, `TF-AI`) | 29 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata, unused variable declarations |
-| Terraform — AWS (`TF-A`) | 40 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
-| Terraform — GCP (`TF-G`) | 52 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |
+| Python — Other | 15 | Placeholders, leakage (cross-language idioms, PII), import hallucination, variant detection, LLM guardrails (OWASP LLM Top-10) |
+| Terraform — General + AI (`TF-T`, `TF-AI`) | 25 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata, unused variable declarations |
+| Terraform — AWS (`TF-A`) | 36 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
+| Terraform — GCP (`TF-G`) | 46 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |
 | Terraform — Azure (`TF-AZ`) | 14 | Storage public blob, SQL public network, AKS RBAC, Key Vault purge protection, NSG SSH/RDP, managed disk CMK |
-| Terraform — Mechanics + Lifecycle (`TF-M`, `TF-V`) | 12 | SG inline mixing, `force_destroy`, mutable module refs, lifecycle antipatterns |
+| Terraform — Mechanics + Lifecycle (`TF-M`, `TF-V`) | 10 | SG inline mixing, `force_destroy`, mutable module refs, lifecycle antipatterns |
 | Terragrunt (`TG`) | 6 | HCL inputs, mock_outputs, remote state encryption |
 | Dockerfile (`DF`) | 15 | Latest tag, root user, secret leakage, OCI labels, HEALTHCHECK, legacy ENV form |
-| Kubernetes YAML (`YAML`) | 26 | Pod Security Standards, hostPath, default namespace, image digest pinning, RBAC wildcards |
-| GitHub Actions (`YAML-GHA`) | — | SHA pinning, expression injection, missing permissions, secret env-var leakage, missing timeouts |
+| Kubernetes YAML (`YAML`) | 32 | Pod Security Standards, hostPath, default namespace, image digest pinning, RBAC wildcards |
+| GitHub Actions (`YAML-GHA`) | 6 | SHA pinning, expression injection, missing permissions, secret env-var leakage, missing timeouts |
 | Shell (`SH`) | 8 | Dangerous globbing, missing `set -euo pipefail` |
 
 ```bash
@@ -252,7 +252,7 @@ Options:
   --format / -f        terminal | json | html           (default: terminal)
   --output / -o        Write report to file
   --changed-only       Only scan git-changed files
-  --families           P,Q,S,L,I,M,V,LLM,TF,TG,DF,YAML,SH,SECRET
+  --families           P,Q,S,L,I,V,LLM,TF,TG,DF,YAML,SH,SECRET
   --min-severity       INFO | WARNING | ERROR
   --fail-on            Exit non-zero at this severity (default: WARNING)
   --no-pypi            Skip PyPI lookups (faster, works offline)

{proofctl-0.5.7 → proofctl-0.6.0}/proofctl/__init__.py

@@ -1,4 +1,4 @@
-"""proofctl — zero-dependency linter for AI-generated slop and security misconfig."""
+"""proofctl — linter and security scanner for AI slop and misconfig."""
 from __future__ import annotations
 
 from importlib.metadata import PackageNotFoundError, version as _pkg_version

{proofctl-0.5.7 → proofctl-0.6.0}/proofctl/baseline.py

@@ -3,7 +3,7 @@
 Older versions used `(rule_id, file, message)` as the fingerprint, which broke
 the moment a message embedded numerics ("complexity 23", "17 parameters") —
 a trivial edit that nudged the number defeated the match and the finding
-re-surfaced as "new". The H-10 fix is to *normalise* the message before
+re-surfaced as "new". The fix is to *normalise* the message before
 hashing: strip embedded numbers and quoted identifiers so semantically
 identical findings collide regardless of their printed values.
 

{proofctl-0.5.7 → proofctl-0.6.0}/proofctl/checkers/dockerfile.py

@@ -362,8 +362,8 @@ def _df008(instructions: list[tuple[int, str, str]], path: Path) -> list[Finding
             severity=Severity.ERROR,
             message=f"ADD fetches '{url}' without checksum verification — supply chain integrity risk",
             hint="Use ADD with --checksum=sha256:<hash>, or RUN curl ... && sha256sum -c to verify before using.",
-            authority="OWASP CICD-SEC-6 – Insufficient Artifact Integrity Validation",
-            docs_url="https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-06-Insufficient_Credential_Hygiene",
+            authority="OWASP CICD-SEC-9 – Improper Artifact Integrity Validation",
+            docs_url="https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-09-Improper_Artifact_Integrity_Validation",
         ))
     return findings
 
@@ -510,7 +510,9 @@ def _df_ai002(instructions: list[tuple[int, str, str]], path: Path) -> list[Find
         if instr != "ENV":
             continue
         # Legacy form has no '=' in the first token pair: ENV PATH /usr/bin
-        if "=" not in args.split()[0] if args.split() else True:
+        tokens = args.split()
+        first_has_eq = bool(tokens) and "=" in tokens[0]
+        if not first_has_eq:
             if _LEGACY_ENV_RE.match(args.strip()):
                 findings.append(Finding(
                     file=str(path),

{proofctl-0.5.7 → proofctl-0.6.0}/proofctl/checkers/hcl_utils.py

@@ -160,7 +160,7 @@ def _parse(lines: list[str], base: int, skip_outer: bool) -> list[HclBlock]:
             # side allowed for `<<-` indented heredocs). The previous loose
             # `rstrip("-~")` matched lines like `EOF~~~` as terminators, which
             # could prematurely close a heredoc whose body legitimately ended
-            # with `~`. C-11 fix: strict whole-line match after .strip().
+            # with `~`. Fix: strict whole-line match after .strip().
             if line.strip() == heredoc_end:
                 heredoc_end = None
             continue

{proofctl-0.5.7 → proofctl-0.6.0}/proofctl/checkers/imports.py

@@ -4,8 +4,6 @@ import ast
 import functools
 import json
 import re
-import shutil
-import subprocess
 import sys
 import time
 import urllib.error

{proofctl-0.5.7 → proofctl-0.6.0}/proofctl/checkers/leakage.py

@@ -51,7 +51,7 @@ _JS_ATTR_NAMES = {
     "length": ("Use len(x) instead of .length.", "PROOFCTL-L-001"),
 }
 # Sub-set of _JS_ATTR_NAMES whose severity is governed by the
-# `l001_strict_idioms` toggle (see H-20).
+# `l001_strict_idioms` toggle.
 _JS_FUZZY_ATTRS: frozenset[str] = frozenset({"push", "length"})
 _JS_CALL_NAMES = {
     "console": {"log", "warn", "error", "info", "debug"},
@@ -117,7 +117,7 @@ class _LeakageVisitor(ast.NodeVisitor):
         # JS: .push(), .length
         if attr in _JS_ATTR_NAMES:
             hint, rule_id = _JS_ATTR_NAMES[attr]
-            # H-20: `.push()` / `.length` produced too many false positives
+            # Background: `.push()` / `.length` produced too many false positives
             # against Python objects that legitimately expose those names
             # (queues, ORM cursors, PyMongo). Demote to INFO unless the
             # caller explicitly opts into strict cross-language idiom
@@ -178,7 +178,7 @@ class _LeakageVisitor(ast.NodeVisitor):
     def visit_ClassDef(self, node: ast.ClassDef) -> None:
         """PROOFCTL-L-002d: Java-style getter/setter pairs.
 
-        H-21: Only flag when getX AND setX both exist for the same suffix X.
+        Only flag when getX AND setX both exist for the same suffix X.
         Two unrelated methods like `getInfo` + `setColor` are not a Java
         pattern; only matched pairs (`getFoo` + `setFoo`) are.
         """
@@ -233,7 +233,7 @@ class _LeakageVisitor(ast.NodeVisitor):
 
 class LeakageChecker(FileChecker):
     def __init__(self, l001_strict_idioms: bool = False) -> None:
-        # H-20: When True, `.push()` / `.length` are reported as ERROR.
+        # When True, `.push()` / `.length` are reported as ERROR.
         # Default False keeps them at INFO to avoid noise on Python objects
         # that legitimately expose those names (queues, ORMs, etc.).
         self._l001_strict_idioms = l001_strict_idioms

{proofctl-0.5.7 → proofctl-0.6.0}/proofctl/checkers/quality.py

@@ -60,7 +60,7 @@ class _Q001Visitor(ast.NodeVisitor):
                 type_name = (
                     type(default).__name__
                     if isinstance(default, (ast.List, ast.Dict, ast.Set))
-                    else (default.func.id if isinstance(default.func, ast.Name) else "mutable")
+                    else (default.func.id if isinstance(default, ast.Call) and isinstance(default.func, ast.Name) else "mutable")
                 )
                 # Sync `fixable` with fixer.py capability: the auto-fixer can only
                 # rewrite single-line default expressions. Multi-line literals
@@ -128,13 +128,13 @@ class _Q002Visitor(ast.NodeVisitor):
             msg = "Bare except: catches KeyboardInterrupt, SystemExit, and all exceptions silently"
             hint = "Catch specific exceptions: except (ValueError, KeyError) as e:"
         elif is_suppressed or is_log_only:
-            # Tier 1 (WARNING): obvious swallow — body is `pass` or a single call (likely log).
+            # WARNING case: obvious swallow — body is `pass` or a single call (likely log).
             rule_id = "PROOFCTL-Q-002"
             sev = Severity.WARNING
             msg = "Broad except Exception with no re-raise swallows all errors"
             hint = "Catch specific exceptions or re-raise: except Exception as e: ... raise"
         else:
-            # Tier 2 (INFO, H-16): any other broad-except that doesn't re-raise.
+            # INFO case: any other broad-except that doesn't re-raise.
             # Catches the wider "swallows but does five lines of dummy recovery"
             # pattern that the WARNING tier misses.
             rule_id = "PROOFCTL-Q-002"
@@ -157,7 +157,7 @@ class _Q002Visitor(ast.NodeVisitor):
             severity=sev,
             message=msg,
             hint=hint,
-            authority="OWASP A10:2025 – Mishandling of Exceptional Conditions",
+            authority="CWE-703 – Improper Check or Handling of Exceptional Conditions",
             docs_url="https://owasp.org/www-community/vulnerabilities/Improper_Error_Handling",
         ))
         self.generic_visit(node)
@@ -247,7 +247,7 @@ def _cyclomatic_complexity(func: ast.FunctionDef | ast.AsyncFunctionDef) -> int:
             complexity += len(node.values) - 1
         elif isinstance(node, (ast.ListComp, ast.SetComp, ast.DictComp, ast.GeneratorExp)):
             complexity += 1
-        # H-17: count match/case statements toward complexity.
+        # count match/case statements toward complexity.
         # `match` itself adds 1 (the dispatch decision); each `case` arm adds 1
         # (each is a distinct execution path).
         elif match_node is not None and isinstance(node, match_node):
@@ -345,7 +345,7 @@ class _Q007Visitor(ast.NodeVisitor):
         # Remove self / cls for methods
         if params and params[0].arg in ("self", "cls"):
             params = params[1:]
-        # H-18: keyword-only arguments are real parameters too — `def f(*, a, b,
+        # keyword-only arguments are real parameters too — `def f(*, a, b,
         # c, d, e, f, g, h)` is just as overloaded as a positional version.
         params += list(args.kwonlyargs)
         count = len(params)
@@ -599,6 +599,16 @@ class QualityChecker(FileChecker):
                 v9.visit(tree)
                 findings.extend(v9.findings)
 
+            AiVisitor: type[
+                _QAi001Visitor | _QAi002Visitor | _QAi003Visitor
+                | _QAi004Visitor | _QAi005Visitor | _QAi006Visitor
+                | _QAi007Visitor | _QAi008Visitor
+            ]
+            v: (
+                _QAi001Visitor | _QAi002Visitor | _QAi003Visitor
+                | _QAi004Visitor | _QAi005Visitor | _QAi006Visitor
+                | _QAi007Visitor | _QAi008Visitor
+            )
             for AiVisitor in (_QAi001Visitor, _QAi002Visitor, _QAi003Visitor):
                 v = AiVisitor(path)
                 v.visit(tree)
@@ -1123,8 +1133,8 @@ class _QAi005Visitor(ast.NodeVisitor):
         for arg, default in zip(defaulted, defaults):
             if isinstance(default, ast.Constant) and default.value is None:
                 names.add(arg.arg)
-        for arg, default in zip(fn.args.kwonlyargs, fn.args.kw_defaults or []):
-            if isinstance(default, ast.Constant) and default.value is None:
+        for arg, kw_default in zip(fn.args.kwonlyargs, fn.args.kw_defaults or []):
+            if isinstance(kw_default, ast.Constant) and kw_default.value is None:
                 names.add(arg.arg)
         # Also include any param annotated with `... | None` or `Optional[...]`.
         for arg in positional + list(fn.args.kwonlyargs):
@@ -1396,11 +1406,10 @@ class AbstractionChecker(DirectoryChecker):
         abstract_classes: dict[str, _AbstractClassInfo] = {}
         all_classes: dict[str, list[str]] = {}  # class_name -> list of base names
 
-        # TODO(perf): re-parses every Python file from disk even though the
+        # Note(perf): re-parses every Python file from disk even though the
         # engine already parsed each tree once for FileChecker passes. Proper
         # fix requires extending the DirectoryChecker API to receive parsed
         # trees from the engine; deferred to a separate PR.
-        # Audit reference: AUDIT_AND_ROADMAP.md §1.3 — AbstractionChecker re-parse.
         for path in py_files:
             try:
                 source = path.read_text(encoding="utf-8", errors="replace")

{proofctl-0.5.7 → proofctl-0.6.0}/proofctl/checkers/secrets.py

@@ -689,14 +689,22 @@ class SecretChecker(FileChecker):
         findings.extend(_scan_k8s_secrets(path, source))
 
         # SECRET-012: heredoc secrets (skip lines where SECRET-001..010 already fired)
-        already = {f.line for f in findings if f.rule_id != "PROOFCTL-SECRET-011"}
+        already = {
+            f.line
+            for f in findings
+            if f.rule_id != "PROOFCTL-SECRET-011" and f.line is not None
+        }
         findings.extend(_scan_heredoc_secrets(path, source, already))
 
         # SECRET-007/013: Python AST-aware detection (kwargs, tuple-auth,
         # module-level constants, connection strings). Skip lines that already
         # fired a SECRET-* via line-scan to avoid double-reporting.
         if path.suffix == ".py":
-            already_lines = {f.line for f in findings if f.rule_id != "PROOFCTL-SECRET-011"}
+            already_lines = {
+                f.line
+                for f in findings
+                if f.rule_id != "PROOFCTL-SECRET-011" and f.line is not None
+            }
             findings.extend(_scan_python_ast(path, source, already_lines))
 
         return findings

{proofctl-0.5.7 → proofctl-0.6.0}/proofctl/checkers/security.py

@@ -1,7 +1,7 @@
 """Security checker — rules PROOFCTL-S-*
 
-AI models introduce these vulnerabilities at high rates (Veracode 2024: 2.7× higher
-density than human-written code). All rules are AST-based for precision.
+AI-generated code introduces these vulnerability classes at elevated rates relative
+to human-written code. All rules are AST-based for precision.
 
 S-001  SQL injection — string interpolation/concatenation in .execute() calls
 S-002  Command injection — subprocess/os.system with shell=True + variable arg
@@ -440,16 +440,16 @@ class _S004Visitor(ast.NodeVisitor):
                     docs_url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf",
                 ))
             elif chain[1] == "new" and node.args:
-                algo = node.args[0]
-                if isinstance(algo, ast.Constant) and str(algo.value).lower() in ("md5", "sha1", "sha-1"):
+                algo_node = node.args[0]
+                if isinstance(algo_node, ast.Constant) and str(algo_node.value).lower() in ("md5", "sha1", "sha-1"):
                     self.findings.append(Finding(
                         file=str(self.path),
                         line=node.lineno,
                         col=node.col_offset,
                         rule_id="PROOFCTL-S-004",
-                        rule_name=f"Weak hash algorithm: {algo.value}",
+                        rule_name=f"Weak hash algorithm: {str(algo_node.value)}",
                         severity=Severity.ERROR,
-                        message=f'hashlib.new("{algo.value}") uses a weak algorithm',
+                        message=f'hashlib.new("{str(algo_node.value)}") uses a weak algorithm',
                         hint="Use hashlib.new('sha256') or stronger.",
                         authority="CWE-327",
                         docs_url="https://cwe.mitre.org/data/definitions/327.html",
@@ -527,7 +527,7 @@ class _S004Visitor(ast.NodeVisitor):
 
     def visit_Assign(self, node: ast.Assign) -> None:
         self.generic_visit(node)
-        # H-12: handle both ast.Name and ast.Attribute targets.
+        # Handle both ast.Name and ast.Attribute targets.
         for t in node.targets:
             target_name = _assign_target_name(t)
             if target_name:
@@ -1232,8 +1232,8 @@ class _S010Visitor(ast.NodeVisitor):
     def _flag_info_exposure(self, node: ast.AST, detail: str) -> None:
         self.findings.append(Finding(
             file=str(self.path),
-            line=node.lineno,
-            col=node.col_offset,
+            line=node.lineno,  # type: ignore[attr-defined]  # concrete AST node passed in always has position info
+            col=node.col_offset,  # type: ignore[attr-defined]  # concrete AST node passed in always has position info
             rule_id="PROOFCTL-S-010",
             rule_name="Information exposure via exception/error",
             severity=Severity.WARNING,
@@ -1854,6 +1854,8 @@ class _S015Visitor(ast.NodeVisitor):
         if not self._SENSITIVE_RE.search(target_name):
             return
         for node in ast.walk(value):
+            if not isinstance(node, ast.Call):
+                continue
             fn = self._is_random_call(node)
             if fn:
                 self._flag(node, fn, target_name)
@@ -1877,11 +1879,13 @@ class _S015Visitor(ast.NodeVisitor):
             for sub in ast.walk(node):
                 if isinstance(sub, ast.Return) and sub.value is not None:
                     fn = self._is_random_call(sub.value)
-                    if fn:
+                    if fn and isinstance(sub.value, ast.Call):
                         self._flag(sub.value, fn, node.name)
                     else:
                         # Walk into expressions like ''.join(random.choice(..) for _)
                         for inner in ast.walk(sub.value):
+                            if not isinstance(inner, ast.Call):
+                                continue
                             fn = self._is_random_call(inner)
                             if fn:
                                 self._flag(inner, fn, node.name)
@@ -2147,8 +2151,8 @@ class _S017Visitor(_BaseTaintVisitor):
     def _flag(self, node: ast.AST, what: str) -> None:
         self.findings.append(Finding(
             file=str(self.path),
-            line=node.lineno,
-            col=node.col_offset,
+            line=node.lineno,  # type: ignore[attr-defined]  # concrete AST node passed in always has position info
+            col=node.col_offset,  # type: ignore[attr-defined]  # concrete AST node passed in always has position info
             rule_id="PROOFCTL-S-017",
             rule_name="Cross-site scripting (XSS)",
             severity=Severity.ERROR,
@@ -2396,8 +2400,8 @@ class _S019Visitor(ast.NodeVisitor):
     def _flag(self, node: ast.AST, what: str) -> None:
         self.findings.append(Finding(
             file=str(self.path),
-            line=node.lineno,
-            col=node.col_offset,
+            line=node.lineno,  # type: ignore[attr-defined]  # concrete AST node passed in always has position info
+            col=node.col_offset,  # type: ignore[attr-defined]  # concrete AST node passed in always has position info
             rule_id="PROOFCTL-S-019",
             rule_name="Unrestricted file upload",
             severity=Severity.WARNING,
@@ -2522,8 +2526,8 @@ class _S020Visitor(_BaseTaintVisitor):
     def _flag(self, node: ast.AST, message: str, hint: str) -> None:
         self.findings.append(Finding(
             file=str(self.path),
-            line=node.lineno,
-            col=node.col_offset,
+            line=node.lineno,  # type: ignore[attr-defined]  # concrete AST node passed in always has position info
+            col=node.col_offset,  # type: ignore[attr-defined]  # concrete AST node passed in always has position info
             rule_id="PROOFCTL-S-020",
             rule_name="Insufficiently protected credentials",
             severity=Severity.ERROR,
@@ -2637,8 +2641,8 @@ class _S022Visitor(_BaseTaintVisitor):
             ):
                 # Only flag if the query is interpolated AND uses XPath-like syntax with a predicate
                 if isinstance(sub.args[0], (ast.JoinedStr, ast.BinOp)):
-                    q = sub.args[0]
-                    if self._has_xpath_predicate(q) and self._is_interpolated_with_taint(q):
+                    fmt_query = sub.args[0]
+                    if self._has_xpath_predicate(fmt_query) and self._is_interpolated_with_taint(fmt_query):
                         target = sub
 
             if target is None or not target.args:
@@ -2731,7 +2735,8 @@ class _S022Visitor(_BaseTaintVisitor):
 class _S023Visitor(ast.NodeVisitor):
     """CSRF — Django @csrf_exempt on a POST handler.
 
-    Note: cross-file Flask CSRF detection is out of scope for this rule. TODO.
+    Note: this rule is intra-file only; cross-file Flask CSRF detection is
+    intentionally out of scope (it would require whole-project taint tracking).
     """
 
     def __init__(self, path: Path):

{proofctl-0.5.7 → proofctl-0.6.0}/proofctl/checkers/terraform.py

@@ -2674,7 +2674,6 @@ class TerraformChecker(HclFileChecker):
     def _a024(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
         """A-024 — Security group ingress on sensitive ports from 0.0.0.0/0."""
         out = []
-        port_re = re.compile(r'(?:from_port|to_port)\s*=\s*(\d+)')
         for b in blocks:
             if b.kind != "resource":
                 continue

{proofctl-0.5.7 → proofctl-0.6.0}/proofctl/checkers/variants.py

@@ -38,7 +38,7 @@ def _token_multiset(source: str) -> collections.Counter:
 
 
 def _bucket_keys(counter: collections.Counter, threshold: float) -> list[str]:
-    """Hash-bucket keys for cheap near-duplicate pre-filtering (H-22).
+    """Hash-bucket keys for cheap near-duplicate pre-filtering.
 
     Two files with Jaccard similarity >= `threshold` must share at least one
     of these bucket keys; files that share none cannot meet the threshold,
@@ -167,7 +167,7 @@ class VariantChecker(DirectoryChecker):
                 except OSError:
                     pass
 
-            # H-22: hash-bucket pre-pass replaces the old 20-file cap.
+            # Hash-bucket pre-pass replaces an earlier 20-file cap.
             # Build buckets keyed by (rounded-size-band, top-token-hash).
             # Only files that share a bucket are eligible for the expensive
             # Jaccard comparison.