3 people 1d7e219656 feat(fuzz): add fuzz harnesses for jwt, secrets and yaml parsing (#340) ...

* refactor(modules): extract parseYAMLModuleBytes from ParseYAMLModule

split the byte-parsing and validation core out of the file-reading
wrapper so module definitions can be parsed from memory. behavior is
unchanged: ParseYAMLModule reads the file then delegates.

* test(fuzz): add harnesses for parsers and extractors

cover the untrusted-input parsers that had no fuzz coverage: jwt
analysis and segment decode, js secret scanning, yaml module parsing,
openapi spec parsing, html title extraction and js endpoint extraction.
the secrets, openapi and endpoint harnesses assert invariants (match is
a substring of input, ok implies non-nil spec, results non-empty and
sorted); the rest are crash-only.

---------

Co-authored-by: vmfunc <vmfunc.lc@gmail.com>

2026-07-22 22:24:43 +00:00

..

frameworks

fix(scan): capture every chunk in next.js build manifest arrays (#345)

2026-07-22 21:54:46 +00:00

endpoints_fuzz_test.go

feat(fuzz): add fuzz harnesses for jwt, secrets and yaml parsing (#340)

2026-07-22 22:24:43 +00:00

endpoints_test.go

feat(js): extract secrets and endpoints from scanned javascript

2026-06-09 18:11:38 -07:00

endpoints.go

fix(js): supabase jwt base64url decode and per-project error isolation (#342)

2026-07-22 12:54:58 -07:00

probe2_test.go

fix(js): supabase jwt base64url decode and per-project error isolation (#342)

2026-07-22 12:54:58 -07:00

probe_test.go

fix(js): supabase jwt base64url decode and per-project error isolation (#342)

2026-07-22 12:54:58 -07:00

scan.go

fix(js): supabase jwt base64url decode and per-project error isolation (#342)

2026-07-22 12:54:58 -07:00

secrets_fuzz_test.go

feat(fuzz): add fuzz harnesses for jwt, secrets and yaml parsing (#340)

2026-07-22 22:24:43 +00:00

secrets_test.go

fix(scan): tune js secret rules for false positives and missed formats (#344)

2026-07-22 12:55:17 -07:00

secrets.go

fix(scan): tune js secret rules for false positives and missed formats (#344)

2026-07-22 12:55:17 -07:00

supabase_test.go

fix(scan): decode supabase jwt body as base64url (#348)

2026-07-22 22:06:32 +00:00

supabase.go

fix(scan): decode supabase jwt body as base64url (#348)

2026-07-22 22:06:32 +00:00