eras-security

Eras Security

AI-native application security scanner + remediation engine. Finds vulnerabilities in code, explains them, generates a validated fix, and tracks them over time — with audit-ready output.

MVP scope: JavaScript/TypeScript, five high-value vulnerability classes, CLI-first. Runs free in dry-run; the only paid ingredient is the AI-fix API (opt-in).

Quickstart

npm install
npm run scan -- tests/fixtures        # scan the built-in vulnerable sample
npm run scan -- ./your/code           # scan your own code
npm run qa                            # the QA gate: typecheck + lint + tests + self-scan

Commands

npm run scan -- <path>                # detect (free)
npm run scan -- <path> --fix          # + remediation guidance (free, dry-run)
npm run scan -- <path> --fix --live   # + real AI fixes (uses the API — paid)
npm run scan -- <path> --sarif out.sarif   # SARIF for GitHub code scanning
npm run eras -- history              # list past scans (from SQLite)
npm run eras -- baseline <path>      # accept current findings as baseline

Scan flags: --min-severity, --exclude <ids>, --no-persist, -r/--report, -j/--json, -s/--sarif.

What's free vs. paid

The model for live fixes is claude-fable-5 (premium). Set ANTHROPIC_API_KEY in .env to enable it. For cheap bulk tuning, switch ERAS_MODEL to a Haiku model.

Features

• Detection engine — Babel parser (swappable), rule pack, dedupe, fail-soft.
• AI remediation — context → generate → validate (re-scan confirms the fix).
• Scan history + diff — SQLite; every scan reports new vs. resolved findings.
• Baseline suppression — accept legacy findings so CI stays green.
• SARIF output — drop straight into GitHub code scanning.
• QA gate — corpus tests auto-generated from tests/corpus/**, enforced on push.
• Config file — eras.config.json (see eras.config.example.json).

Project layout

src/
  types/  engine/  remediation/  report/  store/  core/  cli/
tests/
  corpus/<rule-id>/*.vuln.*  *.safe.*     ← auto-generated tests
docs/
  engine.md  rules.md  remediation.md  security.md  attack-map.md
CLAUDE.md  HISTORY.md  ARCHITECTURE.md  ROADMAP.md  DECISIONS.md

Docs

• CLAUDE.md — guide for AI agents working on the repo (read first)
• docs/attack-map.md — attack taxonomy, coverage matrix, project map
• ARCHITECTURE.md · ROADMAP.md · DECISIONS.md · HISTORY.md

Requirements

Node 22+ (for built-in SQLite). No native builds, no services, no database server.