vulnfind 3.0.0__py3-none-any.whl

vulnfind/__init__.py

@@ -0,0 +1,3 @@
+"""vulnfind - find vulnerabilities in a project folder."""
+
+__version__ = "3.0.0"

vulnfind/__main__.py

@@ -0,0 +1,6 @@
+import sys
+
+from .cli import main
+
+if __name__ == "__main__":  # guard: worker processes re-import this module
+    sys.exit(main())

vulnfind/ai.py

@@ -0,0 +1,124 @@
+"""`vulnfind ai`: project-specific explanations and fix patches from Claude (optional).
+
+Requires the official SDK (`pip install "vulnfind[ai]"`, i.e. `anthropic`) and credentials
+(ANTHROPIC_API_KEY or an `ant auth login` profile). Sends each selected finding plus the
+surrounding source lines to the Claude API - nothing is sent unless you run this command.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from typing import Dict, Iterator, List, Optional, Tuple
+
+from .models import Finding
+
+MODEL = "claude-opus-5-5"
+CONTEXT_LINES = 30
+
+SYSTEM = """You are a senior application security engineer reviewing findings from an automated scanner (vulnfind) \
+in the user's own codebase. For each finding you get the scanner's output and the relevant source code.
+
+Answer in Markdown with exactly these sections:
+## Verdict
+One line: "Real issue", "Likely real", "Probably a false positive" or "Can't tell from this context", then one sentence why.
+## What could happen
+2-4 sentences, concrete to this code: who could do what, and what the impact is.
+## Fix
+The smallest correct change, as a unified diff against the file shown (use the real file path and line numbers). \
+Keep the project's style; don't refactor unrelated code. If dependencies need upgrading, give the exact command instead.
+## Check
+One or two ways to confirm the fix (a test case, a request to try, a command to run).
+
+If the code shown isn't enough to decide, say what else you would need to see instead of guessing."""
+
+
+class AIUnavailable(RuntimeError):
+    pass
+
+
+def check_available() -> None:
+    try:
+        import anthropic  # noqa: F401
+    except ImportError:
+        raise AIUnavailable("`vulnfind ai` needs the Anthropic SDK: pip install \"vulnfind[ai]\" (or pip install anthropic)")
+
+
+def _client():
+    try:
+        import anthropic
+    except ImportError:
+        raise AIUnavailable("`vulnfind ai` needs the Anthropic SDK: pip install \"vulnfind[ai]\" (or pip install anthropic)")
+    return anthropic, anthropic.Anthropic()
+
+
+def _context(root: str, rel: str, line: Optional[int]) -> Optional[str]:
+    path = os.path.join(root, rel)
+    if not line or not os.path.isfile(path):
+        return None
+    try:
+        with open(path, encoding="utf-8", errors="replace") as fh:
+            lines = fh.read().splitlines()
+    except OSError:
+        return None
+    lo, hi = max(1, line - CONTEXT_LINES), min(len(lines), line + CONTEXT_LINES)
+    return "\n".join(f"{n:>5}{'>' if n == line else ' '} {lines[n - 1]}" for n in range(lo, hi + 1))
+
+
+def build_prompt(f: Finding, root: str) -> str:
+    finding = {k: v for k, v in f.to_dict().items() if k not in ("fingerprint",) and v not in (None, "", [], {})}
+    parts = [f"Scanner finding:\n```json\n{json.dumps(finding, indent=2, default=str)}\n```"]
+    seen = set()
+    files: List[Tuple[str, Optional[int]]] = [(f.file, f.line)]
+    for step in f.extra.get("flow") or []:  # cross-file flows: "app/db.py:4: …"
+        head = step.split(": ", 1)[0]
+        if ".py:" in head or ".js:" in head or ".go:" in head or ".php:" in head:
+            path, _, ln = head.rpartition(":")
+            if ln.isdigit():
+                files.append((path, int(ln)))
+    for rel, line in files:
+        if (rel, line) in seen:
+            continue
+        seen.add((rel, line))
+        ctx = _context(root, rel, line)
+        if ctx:
+            parts.append(f"Source of {rel} around line {line} ('>' marks the line):\n```\n{ctx}\n```")
+    return "\n\n".join(parts)
+
+
+def explain(findings: List[Finding], root: str, model: str = MODEL, effort: str = "high") -> Iterator[Tuple[Finding, str]]:
+    anthropic, client = _client()
+    for f in findings:
+        try:
+            # Security-analysis prompts can trip safety classifiers on benign code; the server-side
+            # "default" fallback re-runs a declined request on Anthropic's recommended fallback model.
+            with client.beta.messages.stream(
+                model=model,
+                max_tokens=16000,
+                betas=["server-side-fallback-2026-07-01"],
+                fallbacks="default",
+                thinking={"type": "adaptive"},
+                output_config={"effort": effort},
+                system=SYSTEM,
+                messages=[{"role": "user", "content": build_prompt(f, root)}],
+            ) as stream:
+                message = stream.get_final_message()
+        except anthropic.AuthenticationError:
+            raise AIUnavailable("no valid Anthropic credentials: set ANTHROPIC_API_KEY or run `ant auth login`")
+        except anthropic.PermissionDeniedError as e:
+            raise AIUnavailable(f"API key lacks permission: {e.message}")
+        except anthropic.RateLimitError:
+            yield f, "_Rate limited by the Claude API - try again shortly or with fewer findings (--top)._"
+            continue
+        except anthropic.APIStatusError as e:
+            yield f, f"_Claude API error {e.status_code}: {e.message}_"
+            continue
+        except anthropic.APIConnectionError:
+            raise AIUnavailable("could not reach the Claude API (network error)")
+        if message.stop_reason == "refusal":
+            yield f, "_The model declined to analyse this finding._"
+            continue
+        text = "".join(b.text for b in message.content if b.type == "text").strip()
+        if message.stop_reason == "max_tokens":
+            text += "\n\n_(answer truncated at the output limit)_"
+        yield f, text or "_(empty response)_"

vulnfind/automation.py

@@ -0,0 +1,250 @@
+"""Automation helpers: config files, CI templates, webhooks, report comparison, watch mode."""
+
+from __future__ import annotations
+
+import json
+import os
+import time
+import urllib.request
+from typing import Any, Callable, Dict, List, Optional, Tuple
+
+from . import __version__
+from .models import ScanResult, Severity
+
+# ---------------------------------------------------------------- config file
+
+CONFIG_NAMES = (".vulnfind.json", "vulnfind.json")
+CONFIG_KEYS = {
+    "scanners": str, "skip": str, "fail_on": str, "min_severity": str, "exclude": list, "output": list,
+    "offline": bool, "no_cache": bool, "no_dev": bool, "no_test_downgrade": bool, "baseline": str, "history": bool,
+    "history_depth": int, "no_deep": bool, "no_enrich": bool, "jobs": int, "notify": list, "notify_always": bool,
+    "include_vendor": bool, "no_gitignore": bool, "limit": int, "format": str, "rules": list,
+    "no_health": bool, "all_deps": bool,
+}
+
+DEFAULT_CONFIG = {
+    "scanners": "deps,secrets,code,config,files",
+    "fail_on": "high",
+    "min_severity": "low",
+    "exclude": [],
+    "history": False,
+    "no_dev": False,
+    "output": [],
+    "notify": [],
+}
+
+
+def find_config(root: str, explicit: Optional[str] = None) -> Optional[str]:
+    if explicit:
+        return explicit
+    for name in CONFIG_NAMES:
+        p = os.path.join(root, name)
+        if os.path.isfile(p):
+            return p
+    return None
+
+
+def load_config(path: str) -> Dict[str, Any]:
+    with open(path, encoding="utf-8") as fh:
+        data = json.load(fh)
+    if not isinstance(data, dict):
+        raise ValueError(f"{path}: expected a JSON object")
+    out: Dict[str, Any] = {}
+    for key, value in data.items():
+        k = key.replace("-", "_")
+        if k.startswith("$") or k == "comment":
+            continue
+        if k not in CONFIG_KEYS:
+            raise ValueError(f"{path}: unknown option {key!r} (valid: {', '.join(sorted(CONFIG_KEYS))})")
+        want = CONFIG_KEYS[k]
+        if want is list and isinstance(value, str):
+            value = [value]
+        if want is str and isinstance(value, list):
+            value = ",".join(value)
+        if not isinstance(value, want):
+            raise ValueError(f"{path}: option {key!r} should be {want.__name__}")
+        out[k] = value
+    return out
+
+
+# ---------------------------------------------------------------- CI templates
+
+def github_workflow(install: str) -> str:
+    return f"""# Generated by vulnfind {__version__} - security scan on every push, PR and nightly.
+name: vulnfind
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+  schedule:
+    - cron: "17 4 * * *"   # nightly: catches new CVEs in unchanged dependencies
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write   # upload SARIF to the Security tab
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0       # full history for --history and --diff
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install vulnfind
+        run: pip install "{install}"
+      - name: Scan (PR - only changed files)
+        if: github.event_name == 'pull_request'
+        run: vulnfind --diff "origin/${{{{ github.base_ref }}}}" --format github --fail-on high -o vulnfind.sarif -o vulnfind.md
+      - name: Scan (full + git history)
+        if: github.event_name != 'pull_request'
+        run: vulnfind --history --fail-on high --no-progress -o vulnfind.sarif -o vulnfind.md -o vulnfind.html
+      - name: Job summary
+        if: always()
+        run: cat vulnfind.md >> "$GITHUB_STEP_SUMMARY" || true
+      - uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: vulnfind.sarif
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: vulnfind-report
+          path: vulnfind.*
+"""
+
+
+def gitlab_job(install: str) -> str:
+    return f"""# Generated by vulnfind {__version__}. Add to .gitlab-ci.yml (or `include:` this file).
+vulnfind:
+  stage: test
+  image: python:3.12-slim
+  variables:
+    GIT_DEPTH: "0"
+  before_script:
+    - apt-get update -qq && apt-get install -y -qq git >/dev/null
+    - pip install "{install}"
+  script:
+    - |
+      if [ -n "$CI_MERGE_REQUEST_TARGET_BRANCH_NAME" ]; then
+        git fetch -q origin "$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"
+        vulnfind --diff "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME" --fail-on high -o vulnfind-junit.xml -o vulnfind.html
+      else
+        vulnfind --history --fail-on high -o vulnfind-junit.xml -o vulnfind.html -o vulnfind.json
+      fi
+  artifacts:
+    when: always
+    paths: [vulnfind.html, vulnfind.json]
+    reports:
+      junit: vulnfind-junit.xml
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+    - if: $CI_PIPELINE_SOURCE == "schedule"
+"""
+
+
+def precommit_config() -> str:
+    return """# Add to .pre-commit-config.yaml (https://pre-commit.com)
+repos:
+  - repo: local
+    hooks:
+      - id: vulnfind
+        name: vulnfind security scan
+        entry: vulnfind --staged --scanners secrets,code,config --fail-on high --no-progress
+        language: system
+        pass_filenames: false
+        always_run: true
+"""
+
+
+# ---------------------------------------------------------------- webhooks
+
+def _summary_text(result: ScanResult, limit: int = 8, markdown: bool = True) -> str:
+    c = result.counts()
+    name = os.path.basename(result.root.rstrip("/")) or result.root
+    b = "*" if markdown else ""
+    head = (f"{b}vulnfind{b}: {b}{name}{b} - grade {b}{result.grade}{b} ({result.score}/100) · "
+            f"{c['CRITICAL']} critical, {c['HIGH']} high, {c['MEDIUM']} medium, {c['LOW']} low")
+    lines = [head]
+    for f in result.findings[:limit]:
+        what = f"{f.rule_id} {f.snippet}" if f.category == "dependency" else f.title
+        flag = " (exploited in the wild)" if f.extra.get("kev") else ""
+        lines.append(f"• [{f.severity.label}] {what}{flag} - {f.location}")
+    if len(result.findings) > limit:
+        lines.append(f"… and {len(result.findings) - limit} more")
+    return "\n".join(lines)
+
+
+def notify(url: str, result: ScanResult, timeout: float = 15) -> Tuple[bool, str]:
+    host = url.split("/")[2] if "://" in url else url
+    if "hooks.slack.com" in host:
+        payload: Dict[str, Any] = {"text": _summary_text(result)}
+    elif "discord" in host:
+        payload = {"content": _summary_text(result, markdown=True).replace("*", "**")[:1900]}
+    elif "office.com" in host or "logic.azure.com" in host:
+        payload = {"text": _summary_text(result).replace("\n", "<br>")}
+    else:
+        payload = {
+            "tool": "vulnfind", "version": __version__, "root": result.root, "grade": result.grade, "score": result.score,
+            "counts": result.counts(), "total": len(result.findings), "text": _summary_text(result, markdown=False),
+            "findings": [f.to_dict() for f in result.findings[:50]],
+        }
+    req = urllib.request.Request(url, data=json.dumps(payload).encode(), method="POST",
+                                 headers={"Content-Type": "application/json", "User-Agent": f"vulnfind/{__version__}"})
+    try:
+        with urllib.request.urlopen(req, timeout=timeout) as resp:
+            return True, f"HTTP {resp.status}"
+    except Exception as e:
+        return False, f"{e.__class__.__name__}: {e}"
+
+
+# ---------------------------------------------------------------- compare two JSON reports
+
+def load_report(path: str) -> Dict[str, Any]:
+    with open(path, encoding="utf-8") as fh:
+        data = json.load(fh)
+    if isinstance(data, list):  # multi-path report: merge
+        merged = {"findings": []}
+        for r in data:
+            merged["findings"] += r.get("findings", [])
+        return merged
+    return data
+
+
+def compare(old: Dict[str, Any], new: Dict[str, Any]) -> Dict[str, List[dict]]:
+    old_f = {f["fingerprint"]: f for f in old.get("findings", [])}
+    new_f = {f["fingerprint"]: f for f in new.get("findings", [])}
+    order = lambda f: (-Severity.parse(f["severity"]), f["file"], f.get("line") or 0)
+    return {
+        "new": sorted((f for k, f in new_f.items() if k not in old_f), key=order),
+        "fixed": sorted((f for k, f in old_f.items() if k not in new_f), key=order),
+        "unchanged": sorted((f for k, f in new_f.items() if k in old_f), key=order),
+    }
+
+
+# ---------------------------------------------------------------- watch mode
+
+def snapshot(root: str, files) -> Dict[str, Tuple[float, int]]:
+    out = {}
+    for f in files:
+        try:
+            st = os.stat(f.path)
+        except OSError:
+            continue
+        out[f.rel] = (st.st_mtime, st.st_size)
+    return out
+
+
+def watch(root: str, list_files: Callable[[], list], on_change: Callable[[set], None], interval: float = 1.5) -> None:
+    prev = snapshot(root, list_files())
+    while True:
+        time.sleep(interval)
+        cur = snapshot(root, list_files())
+        changed = {k for k in cur if prev.get(k) != cur[k]} | {k for k in prev if k not in cur}
+        if changed:
+            on_change(changed)
+            prev = cur

vulnfind/bench/__init__.py

@@ -0,0 +1,86 @@
+"""`vulnfind bench`: precision / recall of the scanner on a labelled corpus.
+
+Labels live in comments of the case files:
+  `expect: RULE-ID`        this line must produce a finding with that rule
+  `expect-above: RULE-ID`  the previous non-comment line must (for formats without trailing comments)
+  `safe`                   this line must produce no finding at all (false-positive check)
+Unlabelled lines are not scored.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import shutil
+import tempfile
+from dataclasses import dataclass, field
+from typing import Dict, List, Set, Tuple
+
+CASES = os.path.join(os.path.dirname(os.path.abspath(__file__)), "cases")
+PLACEMENT = {"ci.yml": ".github/workflows/ci.yml"}
+LABEL = re.compile(r"(?:#|//)\s*(expect|expect-above):\s*([A-Z0-9][A-Z0-9-]+)|(?:#|//)\s*safe\b")
+
+
+@dataclass
+class Score:
+    tp: List[Tuple[str, int, str]] = field(default_factory=list)
+    fn: List[Tuple[str, int, str]] = field(default_factory=list)
+    fp: List[Tuple[str, int, str]] = field(default_factory=list)
+    safe_lines: int = 0
+
+    @property
+    def recall(self) -> float:
+        return len(self.tp) / max(1, len(self.tp) + len(self.fn))
+
+    @property
+    def precision(self) -> float:
+        return len(self.tp) / max(1, len(self.tp) + len(self.fp))
+
+
+def labels(path: str, rel: str) -> Tuple[Dict[int, Set[str]], Set[int]]:
+    expected: Dict[int, Set[str]] = {}
+    safe: Set[int] = set()
+    with open(path, encoding="utf-8") as fh:
+        lines = fh.read().splitlines()
+    last_code = 0
+    for i, line in enumerate(lines, 1):
+        for m in LABEL.finditer(line):
+            if m.group(1) == "expect":
+                expected.setdefault(i, set()).add(m.group(2))
+            elif m.group(1) == "expect-above":
+                expected.setdefault(last_code, set()).add(m.group(2))
+            else:
+                safe.add(i)
+        if line.strip() and not line.lstrip().startswith(("#", "//")):
+            last_code = i
+    return expected, safe
+
+
+def run() -> Score:
+    from ..engine import ScanOptions, scan
+    score = Score()
+    with tempfile.TemporaryDirectory(prefix="vulnfind-bench-") as root:
+        layout: Dict[str, str] = {}
+        for name in sorted(os.listdir(CASES)):
+            rel = PLACEMENT.get(name, name)
+            dest = os.path.join(root, rel)
+            os.makedirs(os.path.dirname(dest), exist_ok=True)
+            shutil.copy(os.path.join(CASES, name), dest)
+            layout[rel] = dest
+        result = scan(root, ScanOptions(offline=True, scanners=["secrets", "code", "config"], use_gitignore=False,
+                                        downgrade_tests=False))
+        by_line: Dict[Tuple[str, int], Set[str]] = {}
+        for f in result.findings:
+            if f.line:
+                by_line.setdefault((f.file, f.line), set()).add(f.rule_id)
+        for rel, path in layout.items():
+            expected, safe = labels(path, rel)
+            score.safe_lines += len(safe)
+            for line, rules in expected.items():
+                got = by_line.get((rel, line), set())
+                for r in rules:
+                    (score.tp if r in got else score.fn).append((rel, line, r))
+            for line in safe:
+                for r in by_line.get((rel, line), set()):
+                    score.fp.append((rel, line, r))
+    return score

vulnfind/bench/cases/Dockerfile

@@ -0,0 +1,9 @@
+# Labelled benchmark case.
+FROM python:3.8
+# expect-above: RUNTIME-EOL
+ENV API_TOKEN=abc123secret
+# expect-above: DOCKER-SECRET-ENV
+RUN curl -fsSL https://get.example.com/setup | bash
+# expect-above: SH-CURL-PIPE
+COPY . /app
+CMD ["python", "app.py"]

vulnfind/bench/cases/ci.yml

@@ -0,0 +1,14 @@
+# Labelled benchmark case (lives at .github/workflows/ci.yml in the corpus).
+on:
+  pull_request_target:
+jobs:
+  t:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}  # expect: GHA-PWN-REQUEST
+      - uses: some/action@v1  # expect: GHA-UNPINNED-ACTION
+      - uses: pinned/action@0123456789abcdef0123456789abcdef01234567  # safe
+      - run: echo "${{ github.event.issue.title }}"  # expect: GHA-SCRIPT-INJECTION
+      - run: echo "${{ github.sha }}"  # safe

vulnfind/bench/cases/flask_app.py

@@ -0,0 +1,42 @@
+# Labelled benchmark case: `expect: RULE` = must be flagged on this line, `safe` = must not be.
+import os, pickle, subprocess, yaml, requests
+from flask import Flask, request, redirect, render_template_string
+
+app = Flask(__name__)
+
+
+def build(name):
+    return "SELECT * FROM users WHERE name = '%s'" % name
+
+
+@app.route("/a")
+def a(db):
+    q = build(request.args.get("name"))
+    db.cursor().execute(q)  # expect: PY-TAINT-SQLI
+    db.cursor().execute("SELECT * FROM t WHERE id = %s", (request.args.get("id"),))  # safe
+    n = int(request.args.get("n"))
+    os.system("echo %d" % n)  # safe
+
+
+@app.route("/b/<fname>")
+def b(fname):
+    return open(os.path.join("/srv", fname)).read()  # expect: PY-TAINT-PATH
+
+
+@app.route("/c")
+def c():
+    subprocess.run("ping " + request.args["h"], shell=True)  # expect: PY-TAINT-CMDI
+    data = pickle.loads(request.data)  # expect: PY-TAINT-DESER
+    cfg = yaml.load(request.form["c"])  # expect: PY-TAINT-DESER
+    safe_cfg = yaml.safe_load(request.form["c"])  # safe
+    requests.get(request.form["url"], timeout=3)  # expect: PY-TAINT-SSRF
+    render_template_string("Hi " + request.args["n"])  # expect: PY-TAINT-SSTI
+    x = "constant"
+    eval(x)  # safe
+    return redirect(request.args.get("next"))  # expect: PY-TAINT-REDIRECT
+
+
+def helpers():
+    hashlib.md5(b"x")  # expect: PY-WEAK-HASH
+    requests.get("https://example.com", verify=False, timeout=3)  # expect: PY-TLS-VERIFY-OFF
+    msg = "never call eval(x) here"  # safe

vulnfind/bench/cases/handler.go

@@ -0,0 +1,16 @@
+// Labelled benchmark case.
+package main
+
+import ("database/sql"; "fmt"; "net/http"; "os"; "os/exec"; "strconv"; "crypto/tls")
+
+func h(w http.ResponseWriter, r *http.Request, db *sql.DB) {
+	name := r.URL.Query().Get("name")
+	db.Query(fmt.Sprintf("SELECT * FROM u WHERE name = '%s'", name)) // expect: GO-TAINT-SQLI
+	db.Query("SELECT * FROM u WHERE name = $1", name) // safe
+	id, _ := strconv.Atoi(r.FormValue("id"))
+	db.Query(fmt.Sprintf("SELECT * FROM t WHERE id = %d", id)) // safe
+	exec.Command("sh", "-c", "ping "+r.FormValue("host")).Run() // expect: GO-TAINT-CMDI
+	os.ReadFile("/srv/" + r.FormValue("f")) // expect: GO-TAINT-PATH
+	http.Redirect(w, r, r.URL.Query().Get("next"), 302) // expect: GO-TAINT-REDIRECT
+	_ = &tls.Config{InsecureSkipVerify: true} // expect: GO-TLS-INSECURE
+}

vulnfind/bench/cases/index.php

@@ -0,0 +1,12 @@
+<?php
+// Labelled benchmark case.
+$id = $_GET['id'];
+mysqli_query($c, "SELECT * FROM u WHERE id = $id"); // expect: PHP-TAINT-SQLI
+$n = intval($_GET['n']);
+mysqli_query($c, "SELECT * FROM t WHERE n = " . $n); // safe
+include($_GET['page'] . ".php"); // expect: PHP-TAINT-LFI
+echo htmlspecialchars($_GET['q'], ENT_QUOTES); // safe
+echo 'Hello ' . $_GET['q']; // expect: PHP-TAINT-XSS
+system("ping " . $_POST['host']); // expect: PHP-TAINT-CMDI
+$data = unserialize($_COOKIE['prefs']); // expect: PHP-TAINT-DESER
+$stmt = $pdo->prepare('SELECT * FROM u WHERE id = ?'); // safe

vulnfind/bench/cases/server.js

@@ -0,0 +1,35 @@
+// Labelled benchmark case.
+const express = require('express');
+const { exec } = require('child_process');
+const app = express();
+
+app.get('/a', async (req, res) => {
+  const { id, name: userName } = req.query;
+  const sql = `SELECT * FROM users WHERE id = ${id}`;
+  await db.query(sql); // expect: JS-TAINT-SQLI
+  res.sendFile(path.join('/srv', userName)); // expect: JS-TAINT-PATH
+  res.send(`<h1>Hello ${userName}</h1>`); // expect: JS-TAINT-XSS
+});
+
+app.post('/b', (req, res) => {
+  const n = parseInt(req.body.n);
+  db.query(`SELECT * FROM t WHERE id = ${n}`); // safe
+  exec('ping -c1 ' + req.body.host); // expect: JS-TAINT-CMDI
+  const m = /^Bearer (.+)$/.exec(req.headers.authorization); // safe
+  fetch('/api/local'); // safe
+  axios.get(req.body.url); // expect: JS-TAINT-SSRF
+  res.redirect(new URL('/', req.url)); // safe
+  res.redirect(req.query.next); // expect: JS-TAINT-REDIRECT
+});
+
+function other() {
+  const id = 5;
+  db.query(`SELECT ${id}`); // safe
+  el.innerHTML = userHtml; // expect: JS-XSS-INNERHTML
+  const token = jwt.sign({ u: 1 }, 'hunter2-secret'); // expect: JS-HARDCODED-JWT-SECRET
+}
+
+function tooltip(point) {
+  el.innerHTML = `
+    <b>${point.label}</b>`; // expect-above: JS-XSS-INNERHTML
+}

vulnfind/bench/cases/settings.py

@@ -0,0 +1,9 @@
+# Labelled benchmark case (fake credentials).
+AWS_KEY = "AKIAQ3EGRQFAKE7DEMO1"  # expect: SECRET-AWS-ACCESS-KEY
+GITHUB = "ghp_aB3dE6gH9jK2mN5pQ8sT1vW4yZ7bC0eF3hJ6"  # expect: SECRET-GITHUB-TOKEN
+DB = "postgres://admin:Sup3rS3cretPw@db.internal:5432/prod"  # expect: SECRET-DB-URL
+DOCS_DB = "postgres://user:hunter2pw@host:5432/app"  # safe
+db_password = "Winter2026!"  # expect: SECRET-GENERIC
+api_key = "your-api-key-here"  # safe
+EXAMPLE = "AKIAIOSFODNN7EXAMPLE"  # safe
+password = os.environ["DB_PASSWORD"]  # safe