websec-validator 0.8.0__tar.gz → 0.9.0__tar.gz

{websec_validator-0.8.0/src/websec_validator.egg-info → websec_validator-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: websec-validator
-Version: 0.8.0
+Version: 0.9.0
 Summary: Defensive, local-first security recon that briefs your AI coding agent on your own codebase — read-only by default (code in, artifacts out): facts + tailored probe scripts, no LLM, no server, no running app.
 Author: Ricardo Accioly
 License: MIT
@@ -25,7 +25,7 @@ turns a repo into a precise, fact-grounded security brief an AI agent (with a hu
 can act on — an auto-filled, repo-aware version of a senior pentester's "here's what to test and
 how" handoff. How it works + the reasoning behind every check: [`docs/METHODOLOGY.md`](docs/METHODOLOGY.md).
 
-## Quickstart — just point it at your repo
+## Getting Started — just point it at your repo
 
 **Simplest: tell your AI agent.** In Claude Code (or any coding agent), open your project and say:
 
@@ -89,7 +89,7 @@ Then point your agent at the output: **"Read `websec-out/AGENT-BRIEFING.md` and
 
 > That's the whole user surface: **`run`** (plus the optional, advanced **`dynamic`** live-probing step below). `recon`/`proof`/`calibrate` exist for developing the tool itself and are hidden from `--help` — you never need them.
 
-## What it extracts (19 deterministic extractors, no LLM)
+## What it extracts (20 deterministic extractors, no LLM)
 
 | | Dimension | Notable output |
 |---|---|---|
@@ -193,7 +193,7 @@ upload, cross-tenant BOLA, role/authz gaps).
 ## Tests
 
 ```bash
-python3 -m unittest discover -s tests    # stdlib only, no Noir/network — 139 tests
+python3 -m unittest discover -s tests    # stdlib only, no Noir/network — 232 tests
 ```
 
 ## Releasing (maintainer)
@@ -219,7 +219,10 @@ publisher** with project `websec-validator`, owner `raccioly`, repo `websec-vali
 
 ## Status / roadmap
 
-**Done:** 19-extractor recon (incl. an **authz-correctness data-flow extractor** — unsigned-cookie /
+**Done:** 20-extractor recon (incl. a **WebExtension client-trust extractor** — client-side entitlement
+gate / over-broad host permissions / `world:"MAIN"` / unvalidated external messages — a
+**license/entitlement verification-trust** pass — revocation-bypass + no per-license usage cap, provider-
+agnostic — **Deno/Supabase-edge + Chrome-extension** stack & route modeling, an **authz-correctness data-flow extractor** — unsigned-cookie /
 claim-keyed authz / transaction-local RLS — plus **CORS-misconfig**, **SRI**, **host-header
 open-redirect** and **SSRF-redirect-hardening** classes, schema/entity → mass-assignment targeting, the **AWS-CDK /
 managed-AppSync / VTL boundary**, **upload-security** + **PII-output-boundary** + **redirect-SSRF**
@@ -230,7 +233,7 @@ algorithms / predictable principal), **docker-compose host-takeover** + **`.gitl
 secret-suppression** audits, and a **reverse-proxy prefix-escape** detector), cross-tool de-dup +
 **bundled Semgrep rules**, **router-mount-auth modeling** (cuts the dominant Express-monorepo
 missing-auth false positive), tailored probe staging, agent briefing, traceable findings ledger with
-**calibrated confidence (CJE — Wilson CIs)**, proof harness, test suite (181), **Docker bundle** (all
+**calibrated confidence (CJE — Wilson CIs)**, proof harness, test suite (232), **Docker bundle** (all
 scanners + Noir, arch-aware), **dynamic phase v1** (authenticated read-only cross-tenant BOLA —
 validated live, reproduced a hand-pentest's 14/14). Validated against the **REF-PENTEST pen test +
 retest** and re-validated on a large real-world LLM-agent monorepo (HIGH-finding noise 178 → 15, AI +

{websec_validator-0.8.0 → websec_validator-0.9.0}/README.md

@@ -13,7 +13,7 @@ turns a repo into a precise, fact-grounded security brief an AI agent (with a hu
 can act on — an auto-filled, repo-aware version of a senior pentester's "here's what to test and
 how" handoff. How it works + the reasoning behind every check: [`docs/METHODOLOGY.md`](docs/METHODOLOGY.md).
 
-## Quickstart — just point it at your repo
+## Getting Started — just point it at your repo
 
 **Simplest: tell your AI agent.** In Claude Code (or any coding agent), open your project and say:
 
@@ -77,7 +77,7 @@ Then point your agent at the output: **"Read `websec-out/AGENT-BRIEFING.md` and
 
 > That's the whole user surface: **`run`** (plus the optional, advanced **`dynamic`** live-probing step below). `recon`/`proof`/`calibrate` exist for developing the tool itself and are hidden from `--help` — you never need them.
 
-## What it extracts (19 deterministic extractors, no LLM)
+## What it extracts (20 deterministic extractors, no LLM)
 
 | | Dimension | Notable output |
 |---|---|---|
@@ -181,7 +181,7 @@ upload, cross-tenant BOLA, role/authz gaps).
 ## Tests
 
 ```bash
-python3 -m unittest discover -s tests    # stdlib only, no Noir/network — 139 tests
+python3 -m unittest discover -s tests    # stdlib only, no Noir/network — 232 tests
 ```
 
 ## Releasing (maintainer)
@@ -207,7 +207,10 @@ publisher** with project `websec-validator`, owner `raccioly`, repo `websec-vali
 
 ## Status / roadmap
 
-**Done:** 19-extractor recon (incl. an **authz-correctness data-flow extractor** — unsigned-cookie /
+**Done:** 20-extractor recon (incl. a **WebExtension client-trust extractor** — client-side entitlement
+gate / over-broad host permissions / `world:"MAIN"` / unvalidated external messages — a
+**license/entitlement verification-trust** pass — revocation-bypass + no per-license usage cap, provider-
+agnostic — **Deno/Supabase-edge + Chrome-extension** stack & route modeling, an **authz-correctness data-flow extractor** — unsigned-cookie /
 claim-keyed authz / transaction-local RLS — plus **CORS-misconfig**, **SRI**, **host-header
 open-redirect** and **SSRF-redirect-hardening** classes, schema/entity → mass-assignment targeting, the **AWS-CDK /
 managed-AppSync / VTL boundary**, **upload-security** + **PII-output-boundary** + **redirect-SSRF**
@@ -218,7 +221,7 @@ algorithms / predictable principal), **docker-compose host-takeover** + **`.gitl
 secret-suppression** audits, and a **reverse-proxy prefix-escape** detector), cross-tool de-dup +
 **bundled Semgrep rules**, **router-mount-auth modeling** (cuts the dominant Express-monorepo
 missing-auth false positive), tailored probe staging, agent briefing, traceable findings ledger with
-**calibrated confidence (CJE — Wilson CIs)**, proof harness, test suite (181), **Docker bundle** (all
+**calibrated confidence (CJE — Wilson CIs)**, proof harness, test suite (232), **Docker bundle** (all
 scanners + Noir, arch-aware), **dynamic phase v1** (authenticated read-only cross-tenant BOLA —
 validated live, reproduced a hand-pentest's 14/14). Validated against the **REF-PENTEST pen test +
 retest** and re-validated on a large real-world LLM-agent monorepo (HIGH-finding noise 178 → 15, AI +

{websec_validator-0.8.0 → websec_validator-0.9.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "websec-validator"
-version = "0.8.0"
+version = "0.9.0"
 description = "Defensive, local-first security recon that briefs your AI coding agent on your own codebase — read-only by default (code in, artifacts out): facts + tailored probe scripts, no LLM, no server, no running app."
 readme = "README.md"
 requires-python = ">=3.11"

{websec_validator-0.8.0 → websec_validator-0.9.0}/src/websec_validator/briefing.py

@@ -114,6 +114,23 @@ def render(facts: dict, scanners: dict, scan_results: list, probe_manifest: list
     wh_unverified = integ.get("webhooks_without_sig_verification", [])
     wh_line = (_section("⚠ Webhooks with NO signature-verification in their handler (verify)", wh_unverified)
                if wh_unverified else f"_{len(integ.get('webhook_endpoints', []))} webhook endpoint(s); signature code present or none found_")
+    # licensing / entitlement verification-trust gaps (revocation bypass + no per-license seat cap)
+    ent_finds = [f for f in integ.get("findings", [])
+                 if f.get("attack_class") in ("entitlement-revocation-bypass", "missing-usage-cap")]
+    ent_line = (_section("⚠ License/entitlement verification gaps (verify + fix)",
+                         [f"{f['severity']} {f['attack_class']}: {f['file']}" for f in ent_finds])
+                if ent_finds else "_no license/entitlement verification-trust gaps detected_")
+    # WebExtension client-trust surface (chrome.storage entitlement gate / host perms / world:MAIN)
+    wx = facts.get("webext", {})
+    if wx.get("is_extension"):
+        wx_finds = [f"{f['severity']} {f['attack_class']}: {f['file']}" for f in wx.get("findings", [])]
+        webext_line = (f"MV{wx.get('manifest_version')} extension · entitlement gates: "
+                       f"{', '.join(wx.get('client_entitlement_gates', [])) or 'none'}\n"
+                       + (_section("⚠ Extension client-trust (client storage is USER-EDITABLE — enforce paid "
+                                   "features server-side)", wx_finds)
+                          if wx_finds else "_no extension client-trust findings_"))
+    else:
+        webext_line = "_no WebExtension manifest detected_"
 
     avail = ", ".join(s["name"] for s in scanners.get("available", [])) or "none on PATH"
     missing = "\n".join(f"- **{s['name']}** ({s['category']}) — `{s.get('install','')}`"
@@ -241,6 +258,11 @@ Production source maps exposed: {client.get("production_source_maps", False)}
 **Third-party integrations:** {integ_line}
 {wh_line}
 
+**License / entitlement verification (revocation + seat-cap trust):** {ent_line}
+
+**Browser-extension client-trust (chrome.storage entitlement gate / host perms / world:MAIN):**
+{webext_line}
+
 **LLM / AI-agent surface (OWASP LLM Top 10 — prompt injection, insecure output, excessive agency, unbounded):**
 {llm_section}
 

{websec_validator-0.8.0 → websec_validator-0.9.0}/src/websec_validator/dynamic.py

@@ -73,11 +73,48 @@ def mint(cfg: dict, role: str) -> dict:
         return {"error": f"{type(e).__name__}: {e}"}
     token = _dig(d, cfg.get("token_json_path", "tokens.accessToken"))
     user = _dig(d, cfg.get("user_json_path", "user")) or {}
-    tenants = user.get(cfg.get("tenant_field", "groupIds")) or []
-    return {"token": token, "tenant": tenants[0] if tenants else None,
+    return {"token": token, "tenant": _first_tenant(user.get(cfg.get("tenant_field", "groupIds"))),
             "email": user.get("email"), "role": user.get("role")}
 
 
+def _first_tenant(raw):
+    """The first tenant id from a field that may be a list (`groupIds: [5]`) OR a singular scalar
+    (`groupId: 5` / "acme"). Coerce to a list before indexing — else a scalar int crashes (`5[0]`
+    TypeError, uncaught) and a scalar string silently yields a single-CHARACTER tenant."""
+    tenants = raw if isinstance(raw, list) else ([raw] if raw is not None else [])
+    return tenants[0] if tenants else None
+
+
+def _no_records(body: str) -> bool:
+    """True if a 200/206 response carries NO records (so a cross-tenant read is NOT a leak).
+
+    Parses JSON and tests emptiness STRUCTURALLY instead of string-matching a tiny allowlist
+    (`[]`/`{}`/`{"data":[]}`) — that allowlist misclassified common empty wrappers (`{"items":[]}`,
+    whitespace-formatted `{ "data": [] }`, paginated `{"data":[],"total":0}`) as LEAKs. Conservative:
+    anything that isn't provably empty is treated as DATA, so a real leak is never masked."""
+    if not body or not body.strip():
+        return True
+
+    def empty(x) -> bool:
+        if x is None or x == "" or x == []:
+            return True
+        if isinstance(x, list):
+            return len(x) == 0
+        if isinstance(x, dict):
+            if not x:
+                return True
+            cols = [v for v in x.values() if isinstance(v, (list, dict))]
+            # empty only when there's at least one data container and ALL of them are empty
+            # (scalar siblings like total/page/count are treated as pagination meta).
+            return bool(cols) and all(empty(c) for c in cols)
+        return False   # a bare scalar payload → treat as data, not empty
+
+    try:
+        return empty(json.loads(body))
+    except Exception:
+        return False   # opaque / non-JSON 200 content → can't prove empty; surface it as a lead
+
+
 def _tenant_only_get_endpoints(facts: dict, param: str) -> list:
     """GET endpoints whose ONLY path param is the tenant param — clean cross-tenant
     list targets that need no other fixture id."""
@@ -112,10 +149,8 @@ def cross_tenant_bola(cfg: dict, facts: dict) -> dict:
             code, body = _request("GET", url, atk["token"])
             if code in (401, 403, 404):
                 verdict = "blocked"
-            elif code in (200, 206) and body and body.strip() not in ("[]", "{}", '{"data":[]}'):
-                verdict = "LEAK"
             elif code in (200, 206):
-                verdict = "blocked-empty"   # 200 but no cross-tenant data returned
+                verdict = "blocked-empty" if _no_records(body) else "LEAK"  # structural, not string-match
             else:
                 verdict = "investigate"
             results.append({"path": path, "direction": direction, "status": code, "verdict": verdict})

{websec_validator-0.8.0 → websec_validator-0.9.0}/src/websec_validator/extractors/__init__.py

@@ -29,6 +29,7 @@ from .surface import SurfaceExtractor
 from .tenant import TenantExtractor
 from .transport_security import TransportSecurityExtractor
 from .upload_security import UploadSecurityExtractor
+from .webext import WebExtExtractor
 
 # Order matters: stack first (others read facts['stack']); authz after routes
 # (reads facts['routes']).
@@ -52,6 +53,7 @@ REGISTRY: list[Extractor] = [
     LlmSecurityExtractor(),
     CryptoUsageExtractor(),
     AuthzDataflowExtractor(),
+    WebExtExtractor(),
 ]
 
 

{websec_validator-0.8.0 → websec_validator-0.9.0}/src/websec_validator/extractors/iac_ci.py

@@ -102,7 +102,7 @@ class IacCiExtractor(Extractor):
                          "free-text injectable); verify, low exploitability" if sha_only else "")
                 findings.append({"severity": sev, "kind": "gha-script-injection", "file": rel,
                                  "detail": "untrusted context interpolated into a run: step — "
-                                           + ", ".join("github." + c for c in contexts[:4]) + extra})
+                                           + ", ".join(contexts[:4]) + extra})
             unpinned = sorted({f"{a}@{r}" for a, r in USES.findall(text)
                                if not SHA40.match(r) and not a.startswith("./")})
             if unpinned:

{websec_validator-0.8.0 → websec_validator-0.9.0}/src/websec_validator/extractors/integrations.py

@@ -26,6 +26,58 @@ SIG_VERIFY = re.compile(
     r"\bsvix\b|constant_time_compare|compare_digest|verifyWebhook|webhookSecret|"
     r"(?:verif|check|validate|assert|compute|expected|valid)\w*[_-]?[Ss]ignature", re.I)
 
+# --- License / subscription / payment providers called via a RAW fetch (not an npm SDK), so the
+# SDK-name scan below misses them. Detected by API host so an entitlement check surfaces as a
+# third-party trust boundary regardless of provider or naming. Add hosts freely — nothing here is
+# specific to any one app. ---
+VERIFY_PROVIDERS = {
+    "api.gumroad.com": "Gumroad", "api.lemonsqueezy.com": "Lemon Squeezy",
+    "api.paddle.com": "Paddle", "vendors.paddle.com": "Paddle", "checkout.paddle.com": "Paddle",
+    "sandbox-api.paddle.com": "Paddle", "api.stripe.com": "Stripe", "api.keygen.sh": "Keygen",
+    "api.paypal.com": "PayPal", "api-m.paypal.com": "PayPal", "api.chargebee.com": "Chargebee",
+    "api.fastspring.com": "FastSpring", "api.polar.sh": "Polar", "api.creem.io": "Creem",
+}
+# A handler that checks a paid entitlement — a license OR a subscription. Broad on purpose (any
+# provider, any naming); the findings below additionally require a truthy-grant tell.
+ENTITLEMENT_VERIFY = re.compile(
+    r"licen[sc]es?/(?:verify|validate|activate)|/v\d+/validate|verify_?licen[sc]e|verify_?key"
+    r"|activate_?licen[sc]e|licen[sc]e_?key|\bentitlement|subscriptions?/|/customers?/"
+    r"|checkout/sessions|has_?active_?subscription|is_?subscribed|verify_?subscription", re.I)
+# The grant keys on a truthy success/valid/activated flag …
+GRANT_ON_SUCCESS = re.compile(r"\.success\b|\.valid\b|\.activated\b|\.meta\.valid\b|['\"]valid['\"]\s*:", re.I)
+# … but a SOUND check ALSO inspects revocation/validity state. PROVIDER-AGNOSTIC concept vocabulary
+# (refund / chargeback / dispute / cancel / expire / revoke / suspend / a status compared to
+# active|paid), matched as CODE — a property access, a quoted key/value, or a *_at/status field —
+# never a bare prose word, so a comment ("no revocation check", "we still need refund handling") can't
+# SUPPRESS the finding (the comment-suppression FN trap the SIG_VERIFY note above learned the hard
+# way). This is intentionally not tied to any single provider's field spellings.
+_REVOKE = (r"refunded|chargebacked|charged_back|disputed|revoked|revocation|suspended|voided"
+           r"|cancell?ed|canceled|cancel_at_period_end|inactive|past_due|unpaid")
+# NOTE: expiry (`expires_at`/`ended_at`) is DELIBERATELY excluded from the bare-field match — it
+# collides with a row's OWN expiry data column (a real false negative: it would mark an uncapped app
+# safe). Expiry only counts when subscription-scoped (`subscription_ended_at`) or a property/quoted
+# revocation value, so a plain `row.expires_at` select can't suppress the finding.
+REVOCATION_CHECK = re.compile(
+    r"\.\s*(?:" + _REVOKE + r"|active|valid_?until|current_period_end)\b"
+    r"|['\"](?:" + _REVOKE + r"|active|paused|trialing)['\"]"
+    r"|\bsubscription_(?:cancell?ed|canceled|ended|failed|expires?)(?:_(?:at|on|date))?\b"
+    r"|\b(?:sub(?:scription)?_?)?status\b\s*[=!]==", re.I)
+# A per-principal usage cap — seat / device / machine / activation / quota / concurrency — OR a real
+# server-side use-count, named HOWEVER the app names it (provider-agnostic). Its ABSENCE (with no
+# rate-limiter) is finding #1. Matched as CODE idioms — compound identifiers, a table, a comparison —
+# never a bare word, so a comment ("no seat cap") can't suppress it. `uses` is excluded from the
+# compound (it collides with `increment_uses_count`); server-side use-counting is caught only by the
+# explicit `increment_uses_count: true` (the `"false"` opt-OUT must not read as a cap).
+USAGE_CAP = re.compile(
+    r"(?:max|per|distinct|active|registered|allowed|remaining|current|total)[_-]?"
+    r"(?:seats?|devices?|machines?|activations?|installs?|sessions?)"
+    r"|(?:seats?|devices?|machines?|activations?|installs?|sessions?|usage)[_-]?"
+    r"(?:count|counts?|limit|limits?|cap|caps?|max|quota|used|remaining|left)"
+    r"|\b\w+[_-](?:seats?|devices?|machines?|activations?)\b"
+    r"|\bseats?\b\s*(?:\.\s*(?:length|count|size)|[<>]=?)"
+    r"|\bquota\b|\bconcurren\w*|\bsimultaneous\b"
+    r"|increment_uses_count['\"]?\s*[:=]\s*['\"]?true", re.I)
+
 SDKS = {"stripe": "Stripe", "twilio": "Twilio", "@sendgrid": "SendGrid", "messagebird": "MessageBird/Bird",
         "@slack": "Slack", "openai": "OpenAI", "@anthropic": "Anthropic", "octokit": "GitHub",
         "plaid": "Plaid", "@aws-sdk": "AWS", "aws-sdk": "AWS", "firebase": "Firebase",
@@ -84,9 +136,45 @@ class IntegrationsExtractor(Extractor):
             if not (text and SIG_VERIFY.search(text)):
                 unverified.append(f"{e['method']} {e['path']}  ({ctx.rel(Path(cp)) if cp else '?'})")
 
-        # #5 outbound-action endpoints + #6 redundant secret fetches (one shared code walk)
+        # #5 outbound-action endpoints + #6 redundant secret fetches + entitlement-trust (one code walk)
         findings = []
+        providers: set = set()
         for _p, rel, text in ctx.iter_code():
+            hit_provider = False
+            for host, label in VERIFY_PROVIDERS.items():
+                if host in text:
+                    providers.add(label)
+                    hit_provider = True
+
+            # --- License / subscription entitlement verification trust (provider-agnostic) ---
+            if ((hit_provider or ENTITLEMENT_VERIFY.search(text)) and not SKIP_ACTION_FILE.search(rel)
+                    and (HANDLER_CTX.search(text) or HANDLER_DIR.search(rel))):
+                # #2 — grants on success alone, never inspecting revocation state (HIGH confidence:
+                # a concrete dataflow tell). /verify returns success:true after a refund.
+                if GRANT_ON_SUCCESS.search(text) and not REVOCATION_CHECK.search(text):
+                    findings.append({"severity": "HIGH", "confidence": "HIGH",
+                                     "kind": "entitlement-revocation-not-checked",
+                                     "attack_class": "entitlement-revocation-bypass", "file": rel,
+                                     "detail": f"{rel} grants access on a truthy license/subscription result "
+                                               "(success/valid/activated) but never inspects REVOCATION state "
+                                               "(refunded / chargebacked / disputed / cancelled / expired / a "
+                                               "status compared to active). Most providers still report the "
+                                               "license as valid after a refund or chargeback, so buy → use → "
+                                               "refund/chargeback → keep access works indefinitely. Inspect the "
+                                               "purchase/subscription object and reject revoked states before granting."})
+                # #1 — entitlement-gated feature with NO per-license seat/device cap, rate limit, or
+                # server-side use-count (LOW confidence: verify the control isn't in middleware).
+                if not RATE_LIMIT.search(text) and not USAGE_CAP.search(text):
+                    findings.append({"severity": "MEDIUM", "confidence": "LOW",
+                                     "kind": "no-per-license-usage-cap",
+                                     "attack_class": "missing-usage-cap", "file": rel,
+                                     "detail": f"{rel} gates a server-backed feature on a valid entitlement with NO "
+                                               "per-principal seat/device/activation cap, rate limit, or server-side "
+                                               "use-count — one shared or leaked credential works from unlimited "
+                                               "devices indefinitely. Track distinct devices/seats/activations per "
+                                               "license and reject beyond the limit, or rate-limit per license "
+                                               "(never per IP alone). Verify the cap isn't applied in middleware."})
+
             if (SEND_CALL.search(text) and not SKIP_ACTION_FILE.search(rel)
                     and (HANDLER_CTX.search(text) or HANDLER_DIR.search(rel))):
                 has_auth = bool(AUTH_GUARD.search(text))
@@ -116,7 +204,7 @@ class IntegrationsExtractor(Extractor):
 
         blob = " ".join(ctx.text(p) for p in ctx.glob("**/package.json", 80)).lower()
         blob += " ".join(ctx.text(p) for p in (ctx.glob("**/requirements*.txt", 40) + ctx.glob("**/pyproject.toml", 40))).lower()
-        detected = sorted({label for dep, label in SDKS.items() if dep.lower() in blob})
+        detected = sorted({label for dep, label in SDKS.items() if dep.lower() in blob} | providers)
 
         return {
             "webhook_endpoints": [f"{e['method']} {e['path']}" for e in webhook_eps],

{websec_validator-0.8.0 → websec_validator-0.9.0}/src/websec_validator/extractors/policy_consistency.py

@@ -33,8 +33,12 @@ VALIDATION_SIGNAL = re.compile(
 _LA = r"\(\?=[^)]{0,40}"
 _RE_MIN = re.compile(r"\.min\(\s*(\d{1,3})|minLength\s*[:=]\s*(\d{1,3})|@MinLength\(\s*(\d{1,3})"
                      r"|\.length\s*>=?\s*(\d{1,3})|\{\s*(\d{1,3})\s*,")
-_RE_UPPER = re.compile(_LA + r"\[[^\]]*A-Z|minUppercase\s*:\s*[1-9]|requireUppercase\s*[:=]\s*true", re.I)
-_RE_LOWER = re.compile(_LA + r"\[[^\]]*a-z|minLowercase\s*:\s*[1-9]|requireLowercase\s*[:=]\s*true", re.I)
+# The char-class branch must be case-SENSITIVE: under re.I a literal `A-Z` also matches `a-z`, so a
+# lowercase-only rule `(?=.*[a-z])` was mis-counted as ALSO requiring uppercase — inflating the class
+# set and masking real drift (a lower-only sibling looked equal to an upper+lower policy). `(?-i:...)`
+# locally disables re.I for just the range token; the keyword branches keep re.I for casing tolerance.
+_RE_UPPER = re.compile(_LA + r"\[[^\]]*(?-i:A-Z)|minUppercase\s*:\s*[1-9]|requireUppercase\s*[:=]\s*true", re.I)
+_RE_LOWER = re.compile(_LA + r"\[[^\]]*(?-i:a-z)|minLowercase\s*:\s*[1-9]|requireLowercase\s*[:=]\s*true", re.I)
 _RE_DIGIT = re.compile(_LA + r"(?:\\d|\[[^\]]*0-9)|minNumbers\s*:\s*[1-9]|requireDigit\s*[:=]\s*true", re.I)
 _RE_SPECIAL = re.compile(_LA + r"(?:\\W|\[\^[A-Za-z0-9\\w]|\[[^\]]*[!@#$%^&*])|minSymbols\s*:\s*[1-9]"
                          r"|require[_]?Symbol", re.I)

{websec_validator-0.8.0 → websec_validator-0.9.0}/src/websec_validator/extractors/routes.py

@@ -151,7 +151,30 @@ ROUTER_ON = re.compile(r"\b\w+\.on\s*\(\s*['\"]([A-Za-z]+)['\"]\s*,\s*['\"`](/[^
 HANDLER_SIG = re.compile(
     r"\(\s*req\s*,\s*res\b|\(\s*request\s*,\s*(?:res|reply|env|ctx|context)\b|\(\s*c\s*\)\s*=>"
     r"|async\s*\(\s*c\s*\)|\(\s*ctx\s*\)\s*=>|export\s+default\s*\{[^}]*\bfetch\b"
-    r"|addEventListener\(\s*['\"]fetch['\"]", re.I)
+    r"|addEventListener\(\s*['\"]fetch['\"]|Deno\.serve\s*\(", re.I)
+
+# Supabase Edge Functions: a supabase/functions/<name>/index.ts with a Deno.serve (or deno-std serve)
+# handler is an HTTP endpoint at /functions/v1/<name>. Noir + the regex frameworks don't model
+# Deno.serve, so without this every edge function is INVISIBLE (0 routes → no authz/tenant/probes).
+_EDGE_INDEX = re.compile(r"supabase/functions/([^/]+)/index\.[tj]s$", re.I)
+_DENO_METHOD = re.compile(r"req\.method\s*(?:!==?|===?)\s*['\"]([A-Za-z]+)['\"]")
+
+
+def _supabase_edge_routes(ctx: RepoContext) -> list:
+    rows = []
+    for p in ctx.glob("supabase/functions/**/index.ts", 200) + ctx.glob("supabase/functions/**/index.js", 200):
+        text = ctx.text(p)
+        has_serve = "Deno.serve" in text or ("deno.land/std" in text and re.search(r"\bserve\s*\(", text))
+        if not has_serve:
+            continue
+        m = _EDGE_INDEX.search(ctx.rel(p).replace("\\", "/"))
+        if not m or m.group(1).startswith("_"):        # supabase/functions/_shared → helper, not a route
+            continue
+        methods = {mm.upper() for mm in _DENO_METHOD.findall(text)} - {"OPTIONS", "HEAD"}
+        for method in (sorted(methods) or ["POST"]):    # Supabase invokes edge functions via POST
+            rows.append({"method": method, "path": f"/functions/v1/{m.group(1)}", "params": [],
+                         "technology": "supabase-edge", "code_path": ctx.rel(p), "source": "supabase-edge"})
+    return rows
 
 
 def _router_calls(ctx: RepoContext) -> list:
@@ -211,7 +234,11 @@ def _fallback_next_app_router(ctx: RepoContext) -> list:
 
 def _fallback_regex(ctx: RepoContext) -> list:
     rows = []
-    flask = re.compile(r"@\w+\.route\s*\(\s*['\"]([^'\"]+)['\"](?:.*methods\s*=\s*\[([^\]]*)\])?", re.S)
+    # `[^)]*?` (not `.*` with re.S) keeps the optional methods= group INSIDE this one route() call:
+    # a greedy DOTALL `.*` reaches across the file to the LAST methods=[...], mis-assigning it to the
+    # first route and silently swallowing every route in between (only routes after the final
+    # methods=[...] survived). Staying within the call parens fixes both the mislabel and the drop.
+    flask = re.compile(r"@\w+\.route\s*\(\s*['\"]([^'\"]+)['\"](?:[^)]*?methods\s*=\s*\[([^\]]*)\])?")
     fastapi = re.compile(r"@\w+\.(get|post|put|patch|delete)\s*\(\s*['\"]([^'\"]+)")
     for _p, rel, text in ctx.iter_code():
         for verb, path in fastapi.findall(text):
@@ -292,6 +319,19 @@ class RoutesExtractor(Extractor):
                     existing.add(k)
                     routes.append(r)
 
+        # Supabase Edge Functions (Deno.serve) — synthesize /functions/v1/<name> routes in EVERY
+        # engine path (noir-found, noir-zero, noir-absent), since none of them model Deno.serve.
+        edge_existing = {(r["method"], r["path"]) for r in routes}
+        for r in _supabase_edge_routes(ctx):
+            if getattr(ctx, "excludes", None) and ctx._excluded(r.get("code_path", "")):
+                continue
+            k = (r["method"], r["path"])
+            if k not in edge_existing:
+                edge_existing.add(k)
+                routes.append(r)
+                if engine.startswith("noir (0 routes)"):
+                    engine = "noir (0 routes) → supabase-edge"
+
         by_method: dict = {}
         by_tech: dict = {}
         for r in routes:

{websec_validator-0.8.0 → websec_validator-0.9.0}/src/websec_validator/extractors/schemas.py

@@ -29,7 +29,13 @@ SENSITIVE = re.compile(
     r"^(roles?|is_?admin|admin|permissions?|scopes?|password|password_?hash|pwd|"
     r"owner|owner_?id|user_?id|group_?id|tenant_?id|org_?id|organization_?id|account_?id|"
     r"balance|credits?|is_?verified|verified|status|plan|tier|enabled|active|api_?key|"
-    r"secret|token|email_?verified|stripe_?customer|subscription)$", re.I)
+    r"secret|token|email_?verified|stripe_?customer|subscription|"
+    # licensed/extension ownership keys — the BOLA isolation boundary for per-license/per-device apps
+    r"license_?hash|license_?key|licence_?key|visitor_?id|device_?id|subscription_?id|customer_?id)$", re.I)
+
+# CREATE TABLE [IF NOT EXISTS] [schema.]<name> ( — a plain SQL schema file (not an ORM), globbed
+# separately because `.sql` isn't in CODE_EXT.
+SQL_TABLE = re.compile(r"CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?[\"`]?(?:\w+\.)?([A-Za-z_]\w*)[\"`]?\s*\(", re.I)
 
 MODELISH_PATH = re.compile(r"/models?/|/schemas?/|/entit|\.prisma$|\.model\.|\.entity\.", re.I)
 IDENT = re.compile(r"\b([A-Za-z_]\w*)\b")
@@ -57,6 +63,20 @@ class SchemasExtractor(Extractor):
                     if SENSITIVE.match(w):
                         sensitive.add(w)
 
+        # Plain SQL schema files (schema.sql / migrations) — globbed explicitly since `.sql` isn't in
+        # CODE_EXT. A CREATE TABLE with a license_hash / owner column is exactly the ownership boundary
+        # BOLA must isolate, and it's invisible to every iter_code()-based extractor without this.
+        for sf in ctx.glob("**/*.sql", 60):
+            stext = ctx.text(sf)
+            srel = ctx.rel(sf)
+            for m in SQL_TABLE.finditer(stext):
+                orms.add("sql-ddl")
+                if len(entities) < 80:
+                    entities.append({"name": m.group(1), "type": "sql-table", "file": srel})
+            for w in IDENT.findall(stext):
+                if SENSITIVE.match(w):
+                    sensitive.add(w)
+
         # de-dup entities by (name,type)
         seen, ents = set(), []
         for e in entities:

{websec_validator-0.8.0 → websec_validator-0.9.0}/src/websec_validator/extractors/stack.py

@@ -96,6 +96,59 @@ class StackExtractor(Extractor):
         if ctx.manifest("serverless.yml") + ctx.manifest("serverless.yaml"):
             frameworks.add("serverless")
 
+        # --- Manifest-LESS stacks a package.json/requirements scan misses entirely.
+        # A browser extension + Deno/Supabase edge functions ship NO package.json, so without this
+        # the whole app reads as `languages: ?` — which zeroes out every downstream extractor.
+        # File-extension fallback + Deno/Supabase/WebExtension/SQL-schema detection restore a real
+        # stack model for these manifest-less stacks. ---
+        code_exts = {p.suffix.lower() for p in ctx.code_files}
+        if not langs:                                   # nothing from manifests → infer from source
+            if code_exts & {".ts", ".tsx", ".mts", ".cts"}:
+                langs.update({"node", "typescript"})
+            elif code_exts & {".js", ".jsx", ".mjs", ".cjs"}:
+                langs.add("node")
+            if ".py" in code_exts:
+                langs.add("python")
+            if ".go" in code_exts:
+                langs.add("go")
+            if ".rb" in code_exts:
+                langs.add("ruby")
+
+        # Deno + Supabase edge functions — `Deno.serve` handlers are HTTP endpoints (routes.py maps them).
+        deno_sig = bool(ctx.glob("**/deno.json", 1) or ctx.glob("**/deno.jsonc", 1))
+        supabase_fns = bool(ctx.glob("supabase/functions/**/index.ts", 1)
+                            or ctx.glob("supabase/functions/**/index.js", 1))
+        supabase_cfg = ctx.exists("supabase/config.toml") or bool(ctx.glob("supabase/**/*.sql", 1))
+        if not deno_sig:
+            for _p, _rel, text in ctx.iter_code():
+                if "Deno.serve" in text or "Deno.env" in text:
+                    deno_sig = True
+                    break
+        if deno_sig:
+            langs.update({"node", "typescript"})
+            frameworks.add("deno")
+        if supabase_fns:
+            frameworks.add("supabase-edge")
+        if supabase_fns or supabase_cfg or "@supabase/supabase-js" in node_text:
+            frameworks.add("supabase")
+            datastores.add("postgres")                  # Supabase is Postgres-backed
+
+        # WebExtension / Chrome extension (MV2/MV3): a manifest.json declaring manifest_version.
+        for mf in ctx.glob("**/manifest.json", 40):
+            if '"manifest_version"' in ctx.text(mf):
+                frameworks.add("webextension")
+                langs.add("node")                       # extension code is JS
+                break
+
+        # SQL schema / migration files imply a SQL datastore even with no ORM dependency.
+        for sf in ctx.glob("**/*.sql", 60):
+            stext = ctx.text(sf)
+            if re.search(r"\bCREATE\s+TABLE\b", stext, re.I):
+                datastores.add("postgres" if re.search(
+                    r"gen_random_uuid|timestamptz|\bjsonb\b|ROW LEVEL SECURITY|CREATE POLICY", stext, re.I)
+                    else "sql")
+                break
+
         result = {
             "languages": sorted(langs),
             "frameworks": sorted(frameworks),

{websec_validator-0.8.0 → websec_validator-0.9.0}/src/websec_validator/extractors/tenant.py

@@ -11,7 +11,13 @@ from .base import Extractor, RepoContext
 TENANT_KEYS = ["groupId", "group_id", "orgId", "org_id", "organizationId",
                "tenantId", "tenant_id", "workspaceId", "workspace_id",
                "accountId", "account_id", "companyId", "company_id",
-               "teamId", "team_id", "projectId", "project_id"]
+               "teamId", "team_id", "projectId", "project_id",
+               # per-license / per-device ownership keys — the isolation boundary for licensed and
+               # browser-extension apps (Gumroad/Stripe/Paddle). license_hash keying a per-user row
+               # (e.g. alert_configs) IS the BOLA boundary here, even though it isn't classic SaaS tenancy.
+               "licenseHash", "license_hash", "licenseKey", "license_key",
+               "visitorId", "visitor_id", "deviceId", "device_id",
+               "subscriptionId", "subscription_id", "customerId", "customer_id"]
 
 
 class TenantExtractor(Extractor):