xploitscan-shared-rules

Shared XploitScan rule definitions, helpers, compliance mappings, the AI false-positive filter, and the entropy-based secret scanner.

This package is the source of truth for XploitScan's detection logic. It's consumed by the XploitScan CLI, the XploitScan MCP server, the web scan API at xploitscan.com, and the XploitScan GitHub Action — so detection behavior can't drift between surfaces.

What's in here

• 210 security rules — pattern + AST-based detection for hardcoded secrets, SQL injection, XSS, SSRF, prototype pollution, crypto misuse, deserialization, JWT alg confusion, and more.
• Compliance mappings — each rule tagged with the SOC2, ISO 27001, and OWASP Top 10 controls it covers.
• AI false-positive filter — optional Claude Haiku integration that re-evaluates findings to suppress benign matches before reporting.
• Entropy-based secret scanner — detects high-entropy strings that look like credentials but don't match a known service-key pattern.

Installation

npm install xploitscan-shared-rules
# or
pnpm add xploitscan-shared-rules

Usage

import { getAllRules, scanContent, calculateGrade } from "xploitscan-shared-rules";

const rules = getAllRules();
const findings = scanContent(sourceCode, filePath, rules);
const { grade, score } = calculateGrade(findings);

For the full API surface, see the TypeScript definitions in dist/index.d.ts (shipped with the package).

Most users want the CLI, not this package

If you're scanning code, install the CLI instead:

npx xploitscan scan .

This package is published as a building block for the official XploitScan surfaces and for advanced users who want to call the detection engine directly from their own tooling.

Links

• XploitScan website
• Documentation
• Detection benchmark — live precision/recall numbers vs Semgrep and Bearer
• CLI on npm
• Changelog

License

MIT — see LICENSE.

Built by Cipherline LLC — [email protected]