universal-dev-security 1.0.0__py3-none-any.whl

universal_dev_security/findings.py

@@ -0,0 +1,199 @@
+"""Unified UDS findings schema shared by every scanner adapter and report.
+
+Design rules:
+
+* Severity is only assigned when the source scanner supplies one, or when a
+  documented public standard maps the scanner's value (for example the CVSS
+  v3 qualitative rating scale). Everything else is ``unclassified``.
+* Findings never carry secret values, matched text, or raw scanner output.
+* Scanner states distinguish "clean" from "not executed" so a scan is never
+  reported as successful when it did not run.
+"""
+from __future__ import annotations
+
+import hashlib
+from dataclasses import asdict, dataclass, field
+from enum import Enum
+from typing import Any
+
+
+class Severity(str, Enum):
+    CRITICAL = "critical"
+    HIGH = "high"
+    MEDIUM = "medium"
+    LOW = "low"
+    UNCLASSIFIED = "unclassified"
+
+    @property
+    def rank(self) -> int:
+        """Higher rank = more severe. Unclassified ranks below low."""
+        return _SEVERITY_RANK[self]
+
+    @classmethod
+    def parse(cls, value: Any) -> "Severity":
+        """Parse an already-normalized UDS severity label (never a guess)."""
+        try:
+            return cls(str(value).strip().lower())
+        except ValueError:
+            return cls.UNCLASSIFIED
+
+
+_SEVERITY_RANK = {
+    Severity.CRITICAL: 4,
+    Severity.HIGH: 3,
+    Severity.MEDIUM: 2,
+    Severity.LOW: 1,
+    Severity.UNCLASSIFIED: 0,
+}
+
+SEVERITY_ORDER = [Severity.CRITICAL, Severity.HIGH, Severity.MEDIUM, Severity.LOW, Severity.UNCLASSIFIED]
+
+
+class ScanStatus(str, Enum):
+    CLEAN = "clean"                    # executed, no findings
+    FINDINGS = "findings"              # executed, findings returned
+    NOT_INSTALLED = "not_installed"    # executable not found
+    NOT_APPLICABLE = "not_applicable"  # nothing in the project this scanner covers
+    SKIPPED = "skipped"                # deliberately not executed (policy, version, user choice)
+    ERROR = "error"                    # attempted but failed
+
+    @property
+    def executed(self) -> bool:
+        return self in (ScanStatus.CLEAN, ScanStatus.FINDINGS)
+
+
+class Category(str, Enum):
+    SECRET = "secret"
+    CODE = "code"
+    DEPENDENCY = "dependency"
+    CONFIGURATION = "configuration"
+
+
+def cvss_score_to_severity(score: Any) -> Severity:
+    """Map a numeric CVSS v3/v4 base score using the published qualitative scale.
+
+    FIRST CVSS v3.1 specification, section 5: 0.1-3.9 Low, 4.0-6.9 Medium,
+    7.0-8.9 High, 9.0-10.0 Critical. 0.0 ("None") and unparsable values are
+    left unclassified rather than guessed.
+    """
+    try:
+        value = float(score)
+    except (TypeError, ValueError):
+        return Severity.UNCLASSIFIED
+    if value >= 9.0:
+        return Severity.CRITICAL
+    if value >= 7.0:
+        return Severity.HIGH
+    if value >= 4.0:
+        return Severity.MEDIUM
+    if value > 0.0:
+        return Severity.LOW
+    return Severity.UNCLASSIFIED
+
+
+@dataclass
+class Finding:
+    tool: str
+    category: Category
+    rule_id: str
+    title: str
+    file: str = ""
+    start_line: int | None = None
+    end_line: int | None = None
+    severity: Severity = Severity.UNCLASSIFIED
+    severity_source: str = "none"      # e.g. "scanner", "cvss-v3-qualitative", "none"
+    scanner_severity: str | None = None
+    message: str = ""
+    package: str | None = None
+    installed_version: str | None = None
+    fixed_version: str | None = None
+    commit: str | None = None
+    references: list[str] = field(default_factory=list)
+    remediation: str = ""
+    fingerprint: str = ""
+    tracked_in_git: bool | None = None  # secrets only: True = committed, False = local-only, None = unknown
+
+    def __post_init__(self) -> None:
+        self.category = Category(self.category)
+        self.severity = Severity.parse(self.severity) if not isinstance(self.severity, Severity) else self.severity
+        self.start_line = _int_or_none(self.start_line)
+        self.end_line = _int_or_none(self.end_line)
+        self.file = self.file.replace("\\", "/")
+        self.references = list(dict.fromkeys(ref for ref in self.references if _is_http_url(ref)))[:10]
+        if not self.fingerprint:
+            self.fingerprint = self.compute_fingerprint()
+
+    def compute_fingerprint(self) -> str:
+        # Line numbers are excluded on purpose so moving code does not turn an
+        # existing finding into a "new" one when comparing scans.
+        basis = "|".join([
+            self.tool, self.rule_id, self.file, self.package or "", self.installed_version or "",
+        ])
+        return hashlib.sha256(basis.encode("utf-8")).hexdigest()[:24]
+
+    def to_dict(self) -> dict[str, Any]:
+        data = asdict(self)
+        data["category"] = self.category.value
+        data["severity"] = self.severity.value
+        return data
+
+    @classmethod
+    def from_dict(cls, data: dict[str, Any]) -> "Finding":
+        allowed = {f for f in cls.__dataclass_fields__}  # type: ignore[attr-defined]
+        return cls(**{key: value for key, value in data.items() if key in allowed})
+
+
+@dataclass
+class ScanResult:
+    tool: str
+    status: ScanStatus
+    findings: list[Finding] = field(default_factory=list)
+    version: str | None = None
+    message: str = ""
+    reason: str | None = None
+    duration_seconds: float | None = None
+
+    def __post_init__(self) -> None:
+        self.status = ScanStatus(self.status)
+        if self.status is ScanStatus.CLEAN and self.findings:
+            self.status = ScanStatus.FINDINGS
+        if not self.status.executed and self.findings:
+            raise ValueError("A scanner that did not execute cannot return findings")
+
+    @property
+    def finding_count(self) -> int:
+        return len(self.findings)
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "tool": self.tool,
+            "status": self.status.value,
+            "executed": self.status.executed,
+            "version": self.version,
+            "message": self.message,
+            "reason": self.reason,
+            "duration_seconds": self.duration_seconds,
+            "finding_count": self.finding_count,
+            "findings": [finding.to_dict() for finding in self.findings],
+        }
+
+
+def severity_counts(findings: list[Finding]) -> dict[str, int]:
+    counts = {severity.value: 0 for severity in SEVERITY_ORDER}
+    for finding in findings:
+        counts[finding.severity.value] += 1
+    return counts
+
+
+def _int_or_none(value: Any) -> int | None:
+    if isinstance(value, bool):
+        return None
+    try:
+        number = int(value)
+    except (TypeError, ValueError):
+        return None
+    return number if number >= 0 else None
+
+
+def _is_http_url(value: Any) -> bool:
+    return isinstance(value, str) and value.lower().startswith(("https://", "http://")) and len(value) < 2048

universal_dev_security/fixes.py

@@ -0,0 +1,138 @@
+"""Safe, reversible automatic fixes.
+
+Risk policy (mandatory global policy, section 10):
+* low risk    – may be applied with `uds fix --apply` (and config permitting);
+* medium risk – applied only with explicit `--include-medium`;
+* high risk   – never automatic; reported as manual recommendations.
+
+Every applied fix creates a recovery checkpoint, then the project's tests are
+run. If the tests fail, the checkpoint is restored automatically.
+"""
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Callable
+
+from universal_dev_security.config import ProjectConfig
+from universal_dev_security.recovery import RecoveryManager, safe_write
+from universal_dev_security.testing import run_tests
+
+GITIGNORE_SECRET_ENTRIES = [
+    ".env", ".env.*", "!.env.example", "!.env.sample", "!.env.template",
+    "*.pem", "*.key", "*.p12", "*.pfx", "id_rsa", "id_ed25519",
+    ".uds/reports/", ".uds/history/", ".uds/backups/", ".uds/cache/",
+]
+_ENV_LINE = re.compile(r"^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_.-]*)\s*=")
+
+
+@dataclass
+class Fix:
+    fix_id: str
+    risk: str
+    title: str
+    files: list[str]
+    plan: Callable[[Path], dict[str, str]]     # returns {relative_path: new_content}
+
+
+def _gitignore_plan(root: Path) -> dict[str, str]:
+    path = root / ".gitignore"
+    current = path.read_text(encoding="utf-8") if path.is_file() else ""
+    existing = {line.strip() for line in current.splitlines()}
+    missing = [entry for entry in GITIGNORE_SECRET_ENTRIES if entry not in existing]
+    if not missing:
+        return {}
+    prefix = current if current.endswith("\n") or not current else current + "\n"
+    block = "\n# Added by Universal Dev Security: keep credentials and UDS artifacts out of Git\n" + "\n".join(missing) + "\n"
+    return {".gitignore": prefix + block}
+
+
+def _env_example_plan(root: Path) -> dict[str, str]:
+    env, example = root / ".env", root / ".env.example"
+    if not env.is_file() or example.exists():
+        return {}
+    keys = []
+    for line in env.read_text(encoding="utf-8", errors="replace").splitlines():
+        match = _ENV_LINE.match(line)
+        if match and match.group(1) not in keys:
+            keys.append(match.group(1))
+    if not keys:
+        return {}
+    # Only variable names are copied; values are never read into the output.
+    body = "# Generated by UDS from .env variable names. Values intentionally omitted.\n"
+    return {".env.example": body + "".join(f"{key}=\n" for key in keys)}
+
+
+FIXES = [
+    Fix("gitignore-secrets", "low", "Ignore credential files and UDS artifacts in .gitignore", [".gitignore"], _gitignore_plan),
+    Fix("env-example", "medium", "Create .env.example with variable names only (no values)", [".env.example"], _env_example_plan),
+]
+
+
+def manual_recommendations(scan: dict[str, Any] | None) -> list[dict[str, str]]:
+    """High-risk remediations that UDS never applies automatically."""
+    if not scan:
+        return []
+    recs = []
+    for f in scan.get("findings", []):
+        if f.get("category") == "dependency" and f.get("fixed_version"):
+            recs.append({"risk": "high", "title": f"Upgrade {f.get('package')} {f.get('installed_version')} → {f.get('fixed_version')}",
+                         "reason": "Dependency upgrades can break compatibility; review, upgrade and test manually."})
+        elif f.get("category") == "secret":
+            recs.append({"risk": "critical", "title": f"Rotate the credential found in {f.get('file')}",
+                         "reason": "Credential rotation and history rewrites require explicit human action."})
+    unique = {r["title"]: r for r in recs}
+    return list(unique.values())[:100]
+
+
+def plan_fixes(root: Path) -> list[dict[str, Any]]:
+    root = root.expanduser().resolve()
+    planned = []
+    for fix in FIXES:
+        changes = fix.plan(root)
+        if changes:
+            planned.append({"id": fix.fix_id, "risk": fix.risk, "title": fix.title, "files": sorted(changes)})
+    return planned
+
+
+def apply_fixes(root: Path, config: ProjectConfig, *, include_medium: bool = False, run_test_suite: bool = True,
+                approved: bool = False) -> dict[str, Any]:
+    root = root.expanduser().resolve()
+    allowed_risks = {"low"} | ({"medium"} if include_medium else set())
+    if not config.allow_automatic_low_risk_fixes and not approved:
+        return {"status": "approval_required", "applied": [],
+                "message": "Automatic fixes are disabled by policy.allow_automatic_low_risk_fixes; "
+                           "re-run with --approve to confirm."}
+    selected = [f for f in FIXES if f.risk in allowed_risks]
+    changes: dict[str, str] = {}
+    applied = []
+    for fix in selected:
+        planned = fix.plan(root)
+        if planned:
+            changes.update(planned)
+            applied.append(fix.fix_id)
+    if not changes:
+        return {"status": "nothing_to_do", "applied": [], "checkpoint": None}
+    if run_test_suite:
+        baseline = run_tests(root, config)
+        if baseline["passed"] is False:
+            # A fix cannot be verified against a suite that already fails.
+            return {"status": "baseline_tests_failing", "applied": [], "checkpoint": None,
+                    "tests": {k: v for k, v in baseline.items() if k != "output_tail"},
+                    "message": "Tests fail before any change; fix them first or re-run with --skip-tests."}
+    manager = RecoveryManager(root)
+    checkpoint = manager.create("uds fix: " + ", ".join(applied), sorted(changes))
+    for relative, content in changes.items():
+        safe_write(root, relative, content)
+    manager.seal(checkpoint)
+    result: dict[str, Any] = {"status": "applied", "applied": applied, "files": sorted(changes), "checkpoint": checkpoint}
+    if run_test_suite:
+        tests = run_tests(root, config)
+        result["tests"] = {k: v for k, v in tests.items() if k != "output_tail"}
+        if tests["passed"] is False:
+            restore = manager.restore(checkpoint)
+            result["status"] = "rolled_back"
+            result["rollback"] = restore
+            result["tests"]["output_tail"] = tests.get("output_tail", "")
+    return result

universal_dev_security/gitguard.py

@@ -0,0 +1,269 @@
+"""Git protection: pre-commit and pre-push secret scanning hooks.
+
+Local hooks are defense in depth — they can be bypassed with ``--no-verify``
+(which the UDS policy denies for AI agents). Use CI scanning as well.
+"""
+from __future__ import annotations
+
+import json
+import os
+import re
+import shutil
+import stat
+import subprocess
+import tempfile
+from pathlib import Path
+from typing import Any
+
+from universal_dev_security.integrations import apply_changes
+from universal_dev_security.redaction import find_secrets
+from universal_dev_security.scanners.base import ScannerExecutionError, run_tool
+from universal_dev_security.scanners.gitleaks import GitleaksAdapter, build_exclusion_config
+
+HOOK_MARKER = "UDS-MANAGED-HOOK"
+HOOK_NAMES = ("pre-commit", "pre-push")
+_SHA_RE = re.compile(r"^[0-9a-f]{40}([0-9a-f]{24})?$")
+_REMOTE_RE = re.compile(r"^[A-Za-z0-9._/-]{1,100}$")
+_SAFE_SH_PATH = re.compile(r"^[A-Za-z0-9 _.:/\\()+-]+$")
+MAX_STAGED_FILE_BYTES = 2 * 1024 * 1024
+
+
+class GitError(RuntimeError):
+    pass
+
+
+def _git_executable() -> str:
+    git = shutil.which("git")
+    if not git:
+        raise GitError("Git is not installed or not on PATH.")
+    return git
+
+
+def git(root: Path, *args: str, timeout: int = 120) -> subprocess.CompletedProcess[str]:
+    try:
+        return run_tool([_git_executable(), *args], cwd=root, timeout=timeout)
+    except ScannerExecutionError as exc:
+        raise GitError(str(exc)) from exc
+
+
+def repo_root(path: Path) -> Path:
+    completed = git(path, "rev-parse", "--show-toplevel")
+    if completed.returncode != 0:
+        raise GitError(f"Not a Git repository: {path}")
+    return Path(completed.stdout.strip()).resolve()
+
+
+def hooks_path_config(root: Path) -> str | None:
+    completed = git(root, "config", "--get", "core.hooksPath")
+    value = completed.stdout.strip()
+    return value or None
+
+
+def hooks_dir(root: Path) -> Path:
+    completed = git(root, "rev-parse", "--git-path", "hooks")
+    if completed.returncode != 0:
+        raise GitError("Could not determine the Git hooks directory.")
+    path = Path(completed.stdout.strip())
+    return (root / path).resolve() if not path.is_absolute() else path.resolve()
+
+
+def _sh_quote_path(path: str) -> str | None:
+    if not _SAFE_SH_PATH.match(path):
+        return None
+    return '"' + path.replace("\\", "/") + '"'
+
+
+def hook_script(hook: str, python: str | None = None) -> str:
+    quoted = _sh_quote_path(python) if python else None
+    lines = [
+        "#!/bin/sh",
+        f"# {HOOK_MARKER} v1 - installed by Universal Dev Security.",
+        "# Remove with `uds hooks uninstall`. Do not edit: UDS may update this file.",
+    ]
+    if quoted:
+        lines += [f"UDS_PY={quoted}",
+                  'if [ -f "$UDS_PY" ]; then exec "$UDS_PY" -m universal_dev_security hook git-' + hook + ' "$@"; fi']
+    lines += [
+        "if command -v uds >/dev/null 2>&1; then exec uds hook git-" + hook + ' "$@"; fi',
+        f'echo "UDS: the uds command was not found, so the {hook} security check cannot run. Blocking." >&2',
+        'echo "UDS: reinstall UDS or run \'uds hooks uninstall\' to remove this hook." >&2',
+        "exit 1",
+    ]
+    return "\n".join(lines) + "\n"
+
+
+def _hook_relpaths(root: Path) -> dict[str, str]:
+    directory = hooks_dir(root)
+    try:
+        relative = directory.relative_to(root)
+    except ValueError as exc:
+        raise GitError(f"The hooks directory {directory} is outside the repository; UDS will not modify it.") from exc
+    return {hook: (relative / hook).as_posix() for hook in HOOK_NAMES}
+
+
+def hooks_status(root: Path) -> dict[str, Any]:
+    root = repo_root(root)
+    custom = hooks_path_config(root)
+    status: dict[str, Any] = {"repository": str(root), "core_hooks_path": custom, "hooks": {}}
+    try:
+        paths = _hook_relpaths(root)
+    except GitError as exc:
+        status["error"] = str(exc)
+        return status
+    for hook, relative in paths.items():
+        path = root / relative
+        if not path.exists():
+            state = "missing"
+        elif HOOK_MARKER in path.read_text(encoding="utf-8", errors="replace"):
+            state = "uds"
+        else:
+            state = "foreign"
+        status["hooks"][hook] = {"path": relative, "state": state}
+    return status
+
+
+def install_hooks(path: Path, *, apply: bool = False, uninstall: bool = False,
+                  python: str | None = None) -> dict[str, Any]:
+    root = repo_root(path)
+    custom = hooks_path_config(root)
+    if custom:
+        raise GitError(
+            f"core.hooksPath is set to {custom!r} (another hook manager is in use). UDS will not change it. "
+            "Call `uds hook git-pre-commit` and `uds hook git-pre-push` from your existing hooks instead."
+        )
+    paths = _hook_relpaths(root)
+    changes: dict[str, str | None] = {}
+    conflicts = []
+    for hook, relative in paths.items():
+        target = root / relative
+        existing = target.read_text(encoding="utf-8", errors="replace") if target.is_file() else None
+        if existing is not None and HOOK_MARKER not in existing:
+            conflicts.append({"hook": hook, "path": relative,
+                              "message": "An existing non-UDS hook is present and was left unchanged. "
+                                         f"Add `uds hook git-{hook} \"$@\"` to it manually."})
+            continue
+        if uninstall:
+            if existing is not None:
+                changes[relative] = None
+        else:
+            changes[relative] = hook_script(hook, python)
+    result = apply_changes(root, changes, "git hooks " + ("uninstall" if uninstall else "install"), apply)
+    if result["applied"] and not uninstall and os.name != "nt":
+        for relative in changes:
+            p = root / relative
+            p.chmod(p.stat().st_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
+    result["conflicts"] = conflicts
+    result["repository"] = str(root)
+    return result
+
+
+# ---------------------------------------------------------------------------
+# Hook runtime
+# ---------------------------------------------------------------------------
+
+def _gitleaks_git(root: Path, extra: list[str]) -> list[dict[str, Any]] | None:
+    """Run `gitleaks git` and return sanitized findings, or None if Gitleaks is unavailable."""
+    adapter = GitleaksAdapter()
+    executable, _ = adapter.locate()
+    if not executable or not adapter.is_compatible(adapter.detect_version(executable, root)):
+        return None
+    with tempfile.TemporaryDirectory(prefix="uds-hook-") as temp:
+        report = Path(temp) / "report.json"
+        command = [executable, "git", "--no-banner", "--redact", "--exit-code", "1",
+                   "--report-format", "json", "--report-path", str(report)]
+        if not (root / ".gitleaks.toml").is_file():
+            config = Path(temp) / "uds.toml"
+            config.write_text(build_exclusion_config([]), encoding="utf-8")
+            command += ["--config", str(config)]
+        completed = run_tool(command + extra + ["."], cwd=root, timeout=600)
+        if completed.returncode not in (0, 1):
+            raise GitError(f"Gitleaks failed with exit code {completed.returncode}; output suppressed.")
+        if not report.is_file():
+            return []
+        data = json.loads(report.read_text(encoding="utf-8") or "[]")
+    return [{"rule_id": str(i.get("RuleID")), "file": str(i.get("File", "")), "line": i.get("StartLine"),
+             "commit": str(i.get("Commit") or "")[:12]} for i in data if isinstance(i, dict)]
+
+
+def _builtin_staged_scan(root: Path) -> list[dict[str, Any]]:
+    listing = git(root, "diff", "--cached", "--name-only", "-z", "--diff-filter=ACMR")
+    findings = []
+    for name in [n for n in listing.stdout.split("\0") if n]:
+        shown = git(root, "show", f":{name}")
+        if shown.returncode != 0 or len(shown.stdout) > MAX_STAGED_FILE_BYTES or "\x00" in shown.stdout[:8000]:
+            continue
+        for match in find_secrets(shown.stdout):
+            findings.append({"rule_id": match.rule_id, "file": name, "line": match.line, "commit": ""})
+    return findings
+
+
+def _builtin_range_scan(root: Path, rev_args: list[str]) -> list[dict[str, Any]]:
+    log = git(root, "log", "-p", "--no-color", "--no-ext-diff", "--format=commit %H", *rev_args)
+    findings, commit, file = [], "", ""
+    added: list[str] = []
+
+    def flush() -> None:
+        if added:
+            for match in find_secrets("\n".join(added)):
+                findings.append({"rule_id": match.rule_id, "file": file, "line": None, "commit": commit[:12]})
+        added.clear()
+
+    for line in log.stdout.splitlines():
+        if line.startswith("commit "):
+            flush()
+            commit = line.split(" ", 1)[1]
+        elif line.startswith("+++ "):
+            flush()
+            file = line[6:] if line.startswith("+++ b/") else line[4:]
+        elif line.startswith("+") and not line.startswith("+++"):
+            added.append(line[1:])
+    flush()
+    return findings
+
+
+def _report(findings: list[dict[str, Any]], context: str, engine: str) -> str:
+    lines = [f"UDS: {len(findings)} potential secret(s) found in {context} ({engine}). Blocked."]
+    for f in findings[:50]:
+        where = f["file"] + (f":{f['line']}" if f.get("line") else "") + (f" @ {f['commit']}" if f.get("commit") else "")
+        lines.append(f"  - {f['rule_id']}: {where}")
+    lines.append("UDS: remove the secret, rotate it if it was ever pushed, and use environment variables or a secret manager.")
+    return "\n".join(lines)
+
+
+def pre_commit(path: Path) -> tuple[int, str]:
+    root = repo_root(path)
+    findings = _gitleaks_git(root, ["--pre-commit", "--staged"])
+    engine = "Gitleaks"
+    if findings is None:
+        findings, engine = _builtin_staged_scan(root), "UDS built-in patterns; install Gitleaks for full coverage"
+    if findings:
+        return 1, _report(findings, "staged changes", engine)
+    return 0, f"UDS: no secrets detected in staged changes ({engine})."
+
+
+def pre_push(path: Path, remote: str, stdin_text: str) -> tuple[int, str]:
+    root = repo_root(path)
+    if not _REMOTE_RE.match(remote or "origin"):
+        return 1, "UDS: unexpected remote name; push blocked."
+    all_findings: list[dict[str, Any]] = []
+    engine = "Gitleaks"
+    for raw in stdin_text.splitlines():
+        parts = raw.split()
+        if len(parts) != 4:
+            continue
+        _, local_sha, _, remote_sha = parts
+        if not (_SHA_RE.match(local_sha) and _SHA_RE.match(remote_sha)):
+            return 1, "UDS: unexpected pre-push input; push blocked."
+        if set(local_sha) == {"0"}:
+            continue  # branch deletion: nothing outgoing
+        if set(remote_sha) == {"0"}:
+            rev_args = [local_sha, "--not", f"--remotes={remote or 'origin'}"]
+        else:
+            rev_args = [f"{remote_sha}..{local_sha}"]
+        findings = _gitleaks_git(root, ["--log-opts=" + " ".join(rev_args)])
+        if findings is None:
+            findings, engine = _builtin_range_scan(root, rev_args), "UDS built-in patterns; install Gitleaks for full coverage"
+        all_findings.extend(findings)
+    if all_findings:
+        return 1, _report(all_findings, "outgoing commits", engine)
+    return 0, f"UDS: no secrets detected in outgoing commits ({engine})."