{"engine_version":"1.1.0","counts":{"python":22,"javascript":23,"total_engine_rules":45},"note":"Engine rules are shown above; additional pattern detectors run alongside them and report the same finding schema.","python":[{"rule_id":"PY-DANGEROUS-COMPILE","severity":"high","category":"dynamic_execution","message":"compile() into exec/eval mode detected.","remediation":"Avoid compiling code from runtime data; use static functions."},{"rule_id":"PY-DANGEROUS-EVAL","severity":"critical","category":"dynamic_execution","message":"Dynamic eval() invocation detected.","remediation":"Replace eval() with an explicit allowlisted operation or literal parsing (ast.literal_eval)."},{"rule_id":"PY-DANGEROUS-EXEC","severity":"critical","category":"dynamic_execution","message":"Dynamic exec() invocation detected.","remediation":"Replace dynamic execution with an explicit allowlisted operation."},{"rule_id":"PY-DYNAMIC-ATTRIBUTE","severity":"high","category":"dynamic_attribute","message":"A callable attribute name is resolved dynamically and cannot be proven safe.","remediation":"Replace dynamic getattr()/attribute dispatch with an explicit allowlisted mapping."},{"rule_id":"PY-DYNAMIC-IMPORT","severity":"medium","category":"dynamic_import","message":"Dynamic import (__import__/importlib) detected.","remediation":"Import modules statically where possible; validate any dynamic module name against an allowlist."},{"rule_id":"PY-FS-DESTRUCTIVE","severity":"high","category":"filesystem","message":"Destructive filesystem operation (rmtree/remove/unlink) detected.","remediation":"Guard destructive operations behind explicit, validated paths."},{"rule_id":"PY-FS-WRITE","severity":"medium","category":"filesystem","message":"Filesystem write detected.","remediation":"Restrict writes to a sandboxed path and validate the target."},{"rule_id":"PY-HARDCODED-SECRET","severity":"high","category":"secret","message":"Likely hardcoded credential/secret detected.","remediation":"Move secrets to environment variables or a secret manager."},{"rule_id":"PY-NETWORK","severity":"medium","category":"network","message":"Outbound network request detected.","remediation":"Validate destinations against an allowlist; avoid exfiltration channels."},{"rule_id":"PY-OBFUSCATION","severity":"high","category":"obfuscation","message":"Encoded/obfuscated payload detected.","remediation":"Do not decode-and-execute payloads; keep logic in plain source."},{"rule_id":"PY-OS-SYSTEM","severity":"critical","category":"shell_execution","message":"os.system() shell invocation detected.","remediation":"Use subprocess with an argument list and shell=False, validating inputs."},{"rule_id":"PY-PARSER-ABUSE","severity":"high","category":"parser_abuse","message":"Excessive nesting / parser-stress input detected.","remediation":"Simplify deeply nested structures; reject machine-generated abuse input."},{"rule_id":"PY-PRIVATE-KEY","severity":"critical","category":"secret","message":"Private key material detected in source.","remediation":"Never embed private keys; load from a secure secret store at runtime."},{"rule_id":"PY-SCANNER-BYPASS","severity":"high","category":"scanner_bypass","message":"Attempt to disable/bypass a scanner or tamper with builtins detected.","remediation":"Remove scanner-suppression directives and builtin tampering."},{"rule_id":"PY-SEED-PHRASE","severity":"critical","category":"secret","message":"Likely BIP39 seed phrase / mnemonic detected.","remediation":"Never embed seed phrases; load from a secure secret store."},{"rule_id":"PY-SENSITIVE-MODULE","severity":"medium","category":"sensitive_module","message":"Security-sensitive module import detected.","remediation":"Confirm this low-level module is required; prefer higher-level safe APIs."},{"rule_id":"PY-SHELL-EXEC","severity":"critical","category":"shell_execution","message":"Shell execution via shell=True or os.popen detected.","remediation":"Pass an argument list with shell=False and never interpolate untrusted input."},{"rule_id":"PY-SUBPROCESS","severity":"medium","category":"process_spawn","message":"subprocess invocation detected.","remediation":"Ensure arguments are an explicit list, shell=False, and inputs are validated."},{"rule_id":"PY-SYNTAX-ERROR","severity":"high","category":"syntax","message":"Source is not valid Python; deterministic AST analysis is incomplete.","remediation":"Fix the syntax error and resubmit so the code can be fully analyzed."},{"rule_id":"PY-TEMPFILE","severity":"medium","category":"tempfile","message":"Insecure temporary-file handling detected.","remediation":"Use tempfile.NamedTemporaryFile/mkstemp instead of mktemp or hardcoded /tmp paths."},{"rule_id":"PY-UNSAFE-DESERIALIZE","severity":"critical","category":"deserialization","message":"Unsafe deserialization (pickle/marshal/shelve) detected.","remediation":"Use a safe format (JSON) or validate/authenticate serialized data before loading."},{"rule_id":"PY-UNSAFE-YAML","severity":"high","category":"deserialization","message":"yaml.load without SafeLoader detected.","remediation":"Use yaml.safe_load() or Loader=yaml.SafeLoader."}],"javascript":[{"rule_id":"JS-DANGEROUS-EVAL","severity":"critical","category":"dynamic_execution","message":"Dynamic eval() invocation detected.","remediation":"Replace eval() with an explicit allowlisted operation or JSON.parse for data."},{"rule_id":"JS-DANGEROUS-EXEC","severity":"critical","category":"shell_execution","message":"Shell command execution via child_process.exec() detected.","remediation":"Use child_process.execFile() with an explicit argument list, validating all inputs."},{"rule_id":"JS-DANGEROUS-EXEC-SYNC","severity":"critical","category":"shell_execution","message":"Synchronous shell execution via execSync()/spawnSync() detected.","remediation":"Use async execFile() with validated arguments instead."},{"rule_id":"JS-DANGEROUS-FUNCTION","severity":"critical","category":"dynamic_execution","message":"new Function() constructor detected — equivalent to eval().","remediation":"Never construct functions from runtime strings; use static functions."},{"rule_id":"JS-DANGEROUS-REGEX","severity":"medium","category":"regex","message":"Regular expression constructed from a variable — potential ReDoS vector.","remediation":"Use static regex literals where possible; validate and limit dynamic patterns."},{"rule_id":"JS-DANGEROUS-SETTIMEOUT","severity":"high","category":"dynamic_execution","message":"setTimeout/setInterval with a string argument detected — equivalent to eval().","remediation":"Pass a function reference, not a string, to setTimeout/setInterval."},{"rule_id":"JS-DANGEROUS-SPAWN","severity":"critical","category":"shell_execution","message":"Process spawning via child_process.spawn() detected.","remediation":"Ensure arguments are an explicit list, shell option is false, and inputs are validated."},{"rule_id":"JS-DYNAMIC-IMPORT","severity":"medium","category":"dynamic_import","message":"Dynamic import() with a non-literal argument detected.","remediation":"Import modules statically where possible; validate dynamic module names against an allowlist."},{"rule_id":"JS-DYNAMIC-REQUIRE","severity":"medium","category":"dynamic_import","message":"require() with a non-literal argument detected.","remediation":"Use static import statements; validate any dynamic require against an allowlist."},{"rule_id":"JS-FS-DESTRUCTIVE","severity":"high","category":"filesystem","message":"Destructive filesystem operation (rm/rmSync/unlink/unlinkSync) detected.","remediation":"Guard destructive operations behind explicit, validated paths."},{"rule_id":"JS-FS-WRITE","severity":"medium","category":"filesystem","message":"Filesystem write detected.","remediation":"Restrict writes to a sandboxed path and validate the target."},{"rule_id":"JS-HARDCODED-SECRET","severity":"high","category":"secret","message":"Likely hardcoded credential/secret detected.","remediation":"Move secrets to environment variables (process.env) or a secret manager."},{"rule_id":"JS-NETWORK","severity":"medium","category":"network","message":"Outbound network request detected.","remediation":"Validate destinations against an allowlist; avoid exfiltration channels."},{"rule_id":"JS-OBFUSCATION","severity":"high","category":"obfuscation","message":"Encoded/obfuscated payload detected (atob, btoa, Buffer.from base64).","remediation":"Do not decode-and-execute payloads; keep logic in plain source."},{"rule_id":"JS-PARSER-ABUSE","severity":"high","category":"parser_abuse","message":"Excessive nesting / parser-stress input detected.","remediation":"Simplify deeply nested structures; reject machine-generated abuse input."},{"rule_id":"JS-PRIVATE-KEY","severity":"critical","category":"secret","message":"Private key material detected in source.","remediation":"Never embed private keys; load from a secure secret store at runtime."},{"rule_id":"JS-PROTOTYPE-POLLUTION","severity":"high","category":"prototype","message":"Potential prototype pollution via __proto__ or constructor.prototype assignment.","remediation":"Use Object.create(null) for user-controlled keys; freeze Object.prototype."},{"rule_id":"JS-SCANNER-BYPASS","severity":"high","category":"scanner_bypass","message":"Attempt to disable/bypass a scanner or linter detected.","remediation":"Remove scanner-suppression directives."},{"rule_id":"JS-SEED-PHRASE","severity":"critical","category":"secret","message":"Likely BIP39 seed phrase / mnemonic detected.","remediation":"Never embed seed phrases; load from a secure secret store."},{"rule_id":"JS-SENSITIVE-MODULE","severity":"medium","category":"sensitive_module","message":"Security-sensitive module import detected.","remediation":"Confirm this module is required; prefer higher-level safe APIs."},{"rule_id":"JS-SYNTAX-ERROR","severity":"high","category":"syntax","message":"Source is not valid JavaScript/TypeScript; deterministic AST analysis is incomplete.","remediation":"Fix the syntax error and resubmit so the code can be fully analyzed."},{"rule_id":"JS-UNSAFE-DESERIALIZE","severity":"high","category":"deserialization","message":"Potentially unsafe deserialization pattern detected.","remediation":"Use JSON.parse with schema validation; never eval() or new Function() on untrusted data."},{"rule_id":"JS-VM-EXECUTION","severity":"critical","category":"dynamic_execution","message":"vm.runInNewContext() or similar VM execution detected.","remediation":"Avoid running untrusted code in VM contexts; use sandboxed Web Workers if needed."}]}