{"_id":"@aegiskit/scanner","_rev":"3-50df9d677d79f5572875a58dab644896","name":"@aegiskit/scanner","dist-tags":{"latest":"0.3.0"},"versions":{"0.1.0":{"name":"@aegiskit/scanner","version":"0.1.0","keywords":["security","sast","static-analysis","taint-analysis","nextjs","supabase","rls","idor","owasp","appsec"],"author":{"name":"tomodahinata"},"license":"MIT","_id":"@aegiskit/scanner@0.1.0","maintainers":[{"name":"tomodahinata","email":"hikaru.hinata.hikari@icloud.com"}],"homepage":"https://github.com/tomodahinata/aegis/tree/main/packages/scanner#readme","bugs":{"url":"https://github.com/tomodahinata/aegis/issues"},"dist":{"shasum":"491d42cbe46d34f19b6139fccc1953caabbd8b7e","tarball":"https://registry.npmjs.org/@aegiskit/scanner/-/scanner-0.1.0.tgz","fileCount":5,"integrity":"sha512-uRx/z01qyuewM4TTG6S12OJX456H3HoItpOH5S8tOf6HucorwWVI53fECGVC0604jqL5jP2tS2A2vBGYiMggzw==","signatures":[{"sig":"MEQCIBoPLywuXAi8FanGJpUm7uU+xB6oQlZrCDwBFMRelzviAiB1KOZ5B84+gUY8Fhdzzalj98gfXNo6aJcyBmfuW14msg==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":140626},"main":"./dist/index.js","type":"module","_from":"file:aegiskit-scanner-0.1.0.tgz","types":"./dist/index.d.ts","engines":{"node":">=24.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"scripts":{"build":"tsup","typecheck":"tsc --noEmit"},"_npmUser":{"name":"tomodahinata","email":"hikaru.hinata.hikari@icloud.com"},"_resolved":"/tmp/96ce8ad9073178bc57f070a1fe6abca6/aegiskit-scanner-0.1.0.tgz","_integrity":"sha512-uRx/z01qyuewM4TTG6S12OJX456H3HoItpOH5S8tOf6HucorwWVI53fECGVC0604jqL5jP2tS2A2vBGYiMggzw==","repository":{"url":"git+https://github.com/tomodahinata/aegis.git","type":"git","directory":"packages/scanner"},"_npmVersion":"11.13.0","description":"Static analysis engine that finds the security gaps a runtime library can't fix — grounded in real vibe-coded Next.js/Supabase mistakes.","directories":{},"sideEffects":false,"_nodeVersion":"24.17.0","dependencies":{"typescript":"^6.0.3"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","vitest":"^4.1.9","fast-check":"^4.8.0","@types/node":"^24.0.0"},"_npmOperationalInternal":{"tmp":"tmp/scanner_0.1.0_1782540504508_0.8779517354723643","host":"s3://npm-registry-packages-npm-production"}},"0.2.0":{"name":"@aegiskit/scanner","version":"0.2.0","keywords":["security","sast","static-analysis","taint-analysis","nextjs","supabase","rls","idor","owasp","appsec"],"author":{"name":"tomodahinata"},"license":"MIT","_id":"@aegiskit/scanner@0.2.0","maintainers":[{"name":"tomodahinata","email":"hikaru.hinata.hikari@icloud.com"}],"homepage":"https://github.com/tomodahinata/aegis/tree/main/packages/scanner#readme","bugs":{"url":"https://github.com/tomodahinata/aegis/issues"},"dist":{"shasum":"f182701672c792d887967d2b33f53d19d3b744d1","tarball":"https://registry.npmjs.org/@aegiskit/scanner/-/scanner-0.2.0.tgz","fileCount":5,"integrity":"sha512-tgqEKWSYXd+GUEeeFkNajmCwbU4dBPGzd4JYFDs7lXIH6Kh8v3Z1BKQA2zx1tVn+jVFkGhTJpE4CMhk3b85bOQ==","signatures":[{"sig":"MEQCIDVRR0/dSLt9kJJ94246lnsUt8bBRkLdu51Bxm6mUNf0AiAXEje409IkKZn6uBrH4ITF3fdBVqugyDKgzGogEDzu0A==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@aegiskit%2fscanner@0.2.0","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":183972},"main":"./dist/index.js","type":"module","_from":"file:aegiskit-scanner-0.2.0.tgz","types":"./dist/index.d.ts","engines":{"node":">=24.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"scripts":{"bench":"tsx bench/run.ts","build":"tsup","typecheck":"tsc --noEmit","bench:json":"tsx bench/run.ts --json","bench:check":"tsx bench/run.ts --check","bench:update":"tsx bench/run.ts --update","coverage:matrix":"tsx bench/coverage.ts","coverage:matrix:write":"tsx bench/coverage.ts --write"},"_npmUser":{"name":"tomodahinata","email":"hikaru.hinata.hikari@icloud.com"},"_resolved":"/tmp/264b611542da8382fd3f192c0b8b5f27/aegiskit-scanner-0.2.0.tgz","_integrity":"sha512-tgqEKWSYXd+GUEeeFkNajmCwbU4dBPGzd4JYFDs7lXIH6Kh8v3Z1BKQA2zx1tVn+jVFkGhTJpE4CMhk3b85bOQ==","repository":{"url":"git+https://github.com/tomodahinata/aegis.git","type":"git","directory":"packages/scanner"},"_npmVersion":"11.13.0","description":"Static analysis engine that finds the security gaps a runtime library can't fix — grounded in real vibe-coded Next.js/Supabase mistakes.","directories":{},"sideEffects":false,"_nodeVersion":"24.17.0","dependencies":{"typescript":"^6.0.3"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.20.6","tsup":"^8.5.1","vitest":"^4.1.9","fast-check":"^4.8.0","@types/node":"^24.0.0"},"_npmOperationalInternal":{"tmp":"tmp/scanner_0.2.0_1782659676731_0.1635035196065746","host":"s3://npm-registry-packages-npm-production"}},"0.3.0":{"name":"@aegiskit/scanner","version":"0.3.0","description":"Static analysis engine that finds the security gaps a runtime library can't fix — grounded in real vibe-coded Next.js/Supabase mistakes.","license":"MIT","type":"module","sideEffects":false,"main":"./dist/index.js","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"dependencies":{"typescript":"^6.0.3"},"devDependencies":{"@types/node":"^26.0.1","fast-check":"^4.8.0","tsup":"^8.5.1","tsx":"^4.20.6","vitest":"^4.1.9"},"engines":{"node":">=24.0.0"},"keywords":["security","sast","static-analysis","taint-analysis","nextjs","supabase","rls","idor","owasp","appsec"],"author":{"name":"tomodahinata"},"homepage":"https://github.com/tomodahinata/aegis/tree/main/packages/scanner#readme","repository":{"type":"git","url":"git+https://github.com/tomodahinata/aegis.git","directory":"packages/scanner"},"bugs":{"url":"https://github.com/tomodahinata/aegis/issues"},"publishConfig":{"access":"public"},"scripts":{"build":"tsup","typecheck":"tsc --noEmit","bench":"tsx bench/run.ts","bench:json":"tsx bench/run.ts --json","bench:check":"tsx bench/run.ts --check","bench:update":"tsx bench/run.ts --update","coverage:matrix":"tsx bench/coverage.ts","coverage:matrix:write":"tsx bench/coverage.ts --write"},"_id":"@aegiskit/scanner@0.3.0","_integrity":"sha512-1RAB8sDDuXdJI4RdpaemIdmWAgqW7jUJq1VM98vmWJmhMEnfk/A5uC9BEvccG6EKhGPpSdrlnQLtKtDp/RquZg==","_resolved":"/tmp/48b27428aac3b4d995a7b8012fc916f5/aegiskit-scanner-0.3.0.tgz","_from":"file:aegiskit-scanner-0.3.0.tgz","_nodeVersion":"24.18.0","_npmVersion":"11.16.0","dist":{"integrity":"sha512-1RAB8sDDuXdJI4RdpaemIdmWAgqW7jUJq1VM98vmWJmhMEnfk/A5uC9BEvccG6EKhGPpSdrlnQLtKtDp/RquZg==","shasum":"cd7d57d8a5211bea551cc4765492f36994e0e72e","tarball":"https://registry.npmjs.org/@aegiskit/scanner/-/scanner-0.3.0.tgz","fileCount":5,"unpackedSize":229674,"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@aegiskit%2fscanner@0.3.0","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIDhphEQ8IaJHkW22GmA8pmWKts6bj/htNA6+JfytmQ7qAiEAkQ8bcLk3vno9SXSyJVFyi16ODehPsoFTtk5sWNxNs0w="}]},"_npmUser":{"name":"tomodahinata","email":"hikaru.hinata.hikari@icloud.com"},"directories":{},"maintainers":[{"name":"tomodahinata","email":"hikaru.hinata.hikari@icloud.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/scanner_0.3.0_1783680188373_0.9179089220448071"},"_hasShrinkwrap":false}},"time":{"created":"2026-06-27T06:08:24.414Z","modified":"2026-07-10T10:43:08.755Z","0.1.0":"2026-06-27T06:08:24.639Z","0.2.0":"2026-06-28T15:14:36.865Z","0.3.0":"2026-07-10T10:43:08.513Z"},"bugs":{"url":"https://github.com/tomodahinata/aegis/issues"},"author":{"name":"tomodahinata"},"license":"MIT","homepage":"https://github.com/tomodahinata/aegis/tree/main/packages/scanner#readme","keywords":["security","sast","static-analysis","taint-analysis","nextjs","supabase","rls","idor","owasp","appsec"],"repository":{"type":"git","url":"git+https://github.com/tomodahinata/aegis.git","directory":"packages/scanner"},"description":"Static analysis engine that finds the security gaps a runtime library can't fix — grounded in real vibe-coded Next.js/Supabase mistakes.","maintainers":[{"name":"tomodahinata","email":"hikaru.hinata.hikari@icloud.com"}],"readme":"# @aegiskit/scanner\n\nThe static-analysis engine behind [`@aegiskit/cli`](../cli). It finds the security gaps a runtime library can't fix — grounded in real vibe-coded Next.js/Supabase mistakes — while keeping false positives low.\n\nMost people use this via the `aegis` CLI; import it directly to embed scanning in your own tooling.\n\n```ts\nimport { scan, toSarif } from '@aegiskit/scanner';\n\nconst result = scan({ files: ['/abs/app/api/ai/route.ts', /* … */] });\nconsole.log(result.summary); // { BLOCKER, HIGH, MEDIUM, LOW, INFO }\nconst sarif = toSarif(result);\n```\n\n## How it stays trustworthy\n\n- Parses TypeScript/JSX and classifies each file's **runtime context** (server/client/edge) and **client-reachability** from the import graph — so \"secret read in client code\" is AST evidence, not a filename guess.\n- Each finding carries a **confidence**; the CLI fails CI only on high-confidence findings by default.\n- A **zero-false-positive gate** in the test suite asserts that a corpus of known-good code produces *no* findings — a new rule that lights up good code fails our own build.\n\n## The built-in rules\n\n`csp/unsafe-inline` · `csp/nonce-minted-unused` · `headers/missing-security-headers` · `ratelimit/missing-on-ai-route` · `env/public-secret` · `env/secret-in-client` · `supabase/service-role-outside-admin` · `csrf/missing-origin-check` · plus the full `rls/*` SQL family (`rls/table-without-rls`, `rls/policy-not-owner-scoped`, `rls/anon-writable`, …) — see [`docs/coverage.md`](../../docs/coverage.md) for the complete, generated rule registry.\n\nAdding a rule is one file implementing the `Rule` interface.\n\n## License\n\nMIT\n","readmeFilename":"README.md"}