codesecurity

type AIAnalysisConfig struct {
	Enabled             bool    `json:"enabled"`
	MaxFindings         int     `json:"max_findings"`         // Maximum findings to analyze (default: 50)
	ConfidenceThreshold float64 `json:"confidence_threshold"` // Threshold to mark as FP (default: 0.8)
}

type AIAnalyzer struct {
	// contains filtered or unexported fields
}

type APIConfig struct {
	Enabled        bool `json:"enabled"`
	CheckAuth      bool `json:"check_auth"`      // Check authentication issues
	CheckInjection bool `json:"check_injection"` // Check injection vulnerabilities
	CheckSSRF      bool `json:"check_ssrf"`      // Check SSRF issues
	CheckCORS      bool `json:"check_cors"`      // Check CORS misconfig
	CheckOpenAPI   bool `json:"check_openapi"`   // Validate OpenAPI specs
	CheckGraphQL   bool `json:"check_graphql"`   // Check GraphQL security
	CheckOWASPAPI  bool `json:"check_owasp_api"` // Map to OWASP API Top 10

	// Non-security API quality checks
	CheckDesign        bool `json:"check_design"`        // REST design patterns, naming conventions
	CheckPerformance   bool `json:"check_performance"`   // N+1 queries, pagination, caching
	CheckObservability bool `json:"check_observability"` // Logging, error handling, metrics
	CheckDocumentation bool `json:"check_documentation"` // API documentation completeness
}

type APIFinding struct {
	RuleID      string   `json:"rule_id"`
	Title       string   `json:"title"`
	Description string   `json:"description"`
	Severity    string   `json:"severity"`
	Confidence  string   `json:"confidence,omitempty"` // high, medium, low
	File        string   `json:"file"`
	Line        int      `json:"line"`
	Column      int      `json:"column,omitempty"`
	Snippet     string   `json:"snippet,omitempty"`
	Category    string   `json:"category"`
	OWASPApi    string   `json:"owasp_api,omitempty"`
	CWE         []string `json:"cwe,omitempty"`
	HTTPMethod  string   `json:"http_method,omitempty"` // GET, POST, PUT, DELETE, etc.
	Endpoint    string   `json:"endpoint,omitempty"`    // /api/users, /graphql, etc.
	Framework   string   `json:"framework,omitempty"`   // express, fastapi, django, etc.
	Remediation string   `json:"remediation,omitempty"`

	// Evidence for analyst review and rule improvement
	Evidence *findings.Evidence `json:"evidence,omitempty"`
}

type APIPattern struct {
	Name       string   // Pattern name from section header
	Category   string   // api-auth, api-injection, etc.
	Severity   string   // critical, high, medium, low
	Confidence int      // 0-100
	CWE        string   // CWE-89, CWE-78, etc.
	OWASPApi   string   // API1:2023, API2:2023, etc.
	Pattern    string   // regex pattern
	Languages  []string // javascript, typescript, python, etc.
	// contains filtered or unexported fields
}

type APIPatternLoader struct {
	// contains filtered or unexported fields
}

type APISummary struct {
	TotalFindings  int            `json:"total_findings"`
	Critical       int            `json:"critical"`
	High           int            `json:"high"`
	Medium         int            `json:"medium"`
	Low            int            `json:"low"`
	ByCategory     map[string]int `json:"by_category"`
	ByOWASPApi     map[string]int `json:"by_owasp_api,omitempty"`
	ByFramework    map[string]int `json:"by_framework,omitempty"`
	EndpointsFound int            `json:"endpoints_found,omitempty"`
	Error          string         `json:"error,omitempty"`
}

type CertFinding struct {
	Type        string `json:"type"`
	Severity    string `json:"severity"`
	File        string `json:"file"`
	Description string `json:"description"`
	Suggestion  string `json:"suggestion,omitempty"`
}

type CertInfo struct {
	File          string    `json:"file"`
	Subject       string    `json:"subject"`
	Issuer        string    `json:"issuer"`
	NotBefore     time.Time `json:"not_before"`
	NotAfter      time.Time `json:"not_after"`
	DaysUntilExp  int       `json:"days_until_expiry"`
	KeyType       string    `json:"key_type"`
	KeySize       int       `json:"key_size"`
	SignatureAlgo string    `json:"signature_algorithm"`
	IsSelfSigned  bool      `json:"is_self_signed"`
	IsCA          bool      `json:"is_ca"`
	DNSNames      []string  `json:"dns_names,omitempty"`
	Serial        string    `json:"serial"`
}

type CertificatesConfig struct {
	Enabled             bool `json:"enabled"`
	ExpiryWarningDays   int  `json:"expiry_warning_days"` // Warn if expiring within N days
	CheckKeyStrength    bool `json:"check_key_strength"`
	CheckSignatureAlgo  bool `json:"check_signature_algo"`
	CheckSelfSigned     bool `json:"check_self_signed"`
	CheckValidityPeriod bool `json:"check_validity_period"`
}

type CertificatesResult struct {
	Certificates []CertInfo    `json:"certificates"`
	Findings     []CertFinding `json:"findings,omitempty"`
}

type CertificatesSummary struct {
	TotalCertificates int            `json:"total_certificates"`
	TotalFindings     int            `json:"total_findings"`
	ExpiringSoon      int            `json:"expiring_soon"`
	Expired           int            `json:"expired"`
	WeakKey           int            `json:"weak_key"`
	BySeverity        map[string]int `json:"by_severity"`
	Error             string         `json:"error,omitempty"`
}

type CipherFinding struct {
	Algorithm   string `json:"algorithm"`
	Severity    string `json:"severity"`
	File        string `json:"file"`
	Line        int    `json:"line"`
	Description string `json:"description"`
	Match       string `json:"match,omitempty"`
	Suggestion  string `json:"suggestion"`
	CWE         string `json:"cwe"`
	Source      string `json:"source"` // "semgrep" or "pattern"

	// Evidence for analyst review and rule improvement
	Evidence *findings.Evidence `json:"evidence,omitempty"`
}

type CiphersConfig struct {
	Enabled     bool `json:"enabled"`
	UseSemgrep  bool `json:"use_semgrep"`  // Use Semgrep for AST-based detection
	UsePatterns bool `json:"use_patterns"` // Use regex pattern matching
}

type CiphersSummary struct {
	TotalFindings int            `json:"total_findings"`
	BySeverity    map[string]int `json:"by_severity"`
	ByAlgorithm   map[string]int `json:"by_algorithm"`
	UsedSemgrep   bool           `json:"used_semgrep"`
	Error         string         `json:"error,omitempty"`
}

type CodeSecurityAnalyzer struct{}

type CommitInfo struct {
	Hash      string `json:"hash"`
	ShortHash string `json:"short_hash"`
	Author    string `json:"author"`
	Email     string `json:"email"`
	Date      string `json:"date"`
	Message   string `json:"message"`
	IsRemoved bool   `json:"is_removed"` // Was the secret later removed?
}

type EntropyAnalyzer struct {
	// contains filtered or unexported fields
}

type EntropyConfig struct {
	Enabled       bool    `json:"enabled"`
	MinLength     int     `json:"min_length"`     // Minimum string length to check (default: 16)
	HighThreshold float64 `json:"high_threshold"` // Entropy threshold for high confidence (default: 4.5)
	MedThreshold  float64 `json:"med_threshold"`  // Entropy threshold for medium confidence (default: 3.5)
}

type EntropyResult struct {
	Findings []SecretFinding
	Summary  struct {
		FilesScanned  int
		HighEntropy   int
		MediumEntropy int
	}
}

type FeatureConfig struct {
	Vulns   VulnsConfig   `json:"vulns"`
	Secrets SecretsConfig `json:"secrets"`
	API     APIConfig     `json:"api"`
	// Crypto features (merged from code-crypto)
	Ciphers      CiphersConfig      `json:"ciphers"`
	Keys         KeysConfig         `json:"keys"`
	Random       RandomConfig       `json:"random"`
	TLS          TLSConfig          `json:"tls"`
	Certificates CertificatesConfig `json:"certificates"`
}

type Findings struct {
	Vulns   []VulnFinding   `json:"vulns,omitempty"`
	Secrets []SecretFinding `json:"secrets,omitempty"`
	API     []APIFinding    `json:"api,omitempty"`
	// Crypto findings (merged from code-crypto)
	Ciphers      []CipherFinding     `json:"ciphers,omitempty"`
	Keys         []KeyFinding        `json:"keys,omitempty"`
	Random       []RandomFinding     `json:"random,omitempty"`
	TLS          []TLSFinding        `json:"tls,omitempty"`
	Certificates *CertificatesResult `json:"certificates,omitempty"`
}

type GitHistoryConfig struct {
	Enabled     bool   `json:"enabled"`
	MaxCommits  int    `json:"max_commits"`  // Maximum commits to scan (default: 1000)
	MaxAge      string `json:"max_age"`      // Maximum age to scan, e.g., "90d", "1y" (default: "1y")
	ScanRemoved bool   `json:"scan_removed"` // Track if secrets were later removed
}

type GitHistoryResult struct {
	Findings       []SecretFinding
	CommitsScanned int
	SecretsFound   int
	SecretsRemoved int
}

type GitHistoryScanner struct {
	// contains filtered or unexported fields
}

type GitHistorySecurityConfig struct {
	Enabled              bool   `json:"enabled"`
	MaxCommits           int    `json:"max_commits"`            // Maximum commits to scan (default: 1000)
	MaxAge               string `json:"max_age"`                // Maximum age to scan, e.g., "90d", "1y" (default: "1y")
	ScanGitignoreHistory bool   `json:"scan_gitignore_history"` // Scan for gitignore violations in history
	ScanSensitiveFiles   bool   `json:"scan_sensitive_files"`   // Scan for sensitive file patterns
	GeneratePurgeReport  bool   `json:"generate_purge_report"`  // Generate purge recommendations
}

type GitHistorySecurityResult struct {
	// Files matching gitignore patterns found in history
	GitignoreViolations []GitignoreViolation `json:"gitignore_violations"`

	// Sensitive files found in history
	SensitiveFiles []SensitiveFileFinding `json:"sensitive_files"`

	// Purge recommendations
	PurgeRecommendations []PurgeRecommendation `json:"purge_recommendations"`

	// Timeline of when sensitive files were added
	Timeline []HistoricalEvent `json:"timeline"`

	// Summary statistics
	Summary GitHistorySecuritySummary `json:"summary"`
}

type GitHistorySecurityScanner struct {
	// contains filtered or unexported fields
}

type GitHistorySecuritySummary struct {
	TotalViolations     int            `json:"total_violations"`
	GitignoreViolations int            `json:"gitignore_violations"`
	SensitiveFilesFound int            `json:"sensitive_files_found"`
	FilesToPurge        int            `json:"files_to_purge"`
	CommitsScanned      int            `json:"commits_scanned"`
	ByCategory          map[string]int `json:"by_category"`
	BySeverity          map[string]int `json:"by_severity"`
	RiskScore           int            `json:"risk_score"`
	RiskLevel           string         `json:"risk_level"`
	Note                string         `json:"note,omitempty"` // Additional notes (e.g., shallow clone warning)
}

type GitignoreViolation struct {
	File           string      `json:"file"`
	GitignoreRule  string      `json:"gitignore_rule"`
	FirstCommit    *CommitInfo `json:"first_commit"`
	LastCommit     *CommitInfo `json:"last_commit,omitempty"`
	StillExists    bool        `json:"still_exists"`
	WasRemoved     bool        `json:"was_removed"`
	GitignoreAdded string      `json:"gitignore_added,omitempty"` // When the gitignore rule was added
}

type HistoricalEvent struct {
	Date        string `json:"date"`
	EventType   string `json:"event_type"` // "committed", "gitignored", "removed"
	File        string `json:"file"`
	CommitHash  string `json:"commit_hash"`
	Author      string `json:"author"`
	Description string `json:"description"`
}

type IaCSecretsConfig struct {
	Enabled bool `json:"enabled"` // Scan IaC files for hardcoded secrets
}

type KeyFinding struct {
	Type        string `json:"type"`
	Severity    string `json:"severity"`
	File        string `json:"file"`
	Line        int    `json:"line"`
	Description string `json:"description"`
	Match       string `json:"match,omitempty"`
	CWE         string `json:"cwe"`

	// Evidence for analyst review and rule improvement
	Evidence *findings.Evidence `json:"evidence,omitempty"`
}

type KeysConfig struct {
	Enabled       bool `json:"enabled"`
	CheckAPIKeys  bool `json:"check_api_keys"`
	CheckPrivate  bool `json:"check_private_keys"`
	CheckAWS      bool `json:"check_aws_keys"`
	CheckSigning  bool `json:"check_signing_keys"`
	RedactMatches bool `json:"redact_matches"` // Redact sensitive values in output
}

type KeysSummary struct {
	TotalFindings int            `json:"total_findings"`
	BySeverity    map[string]int `json:"by_severity"`
	ByType        map[string]int `json:"by_type"`
	Error         string         `json:"error,omitempty"`
}

type NativeSecretsScanner struct {
	// contains filtered or unexported fields
}

type OpenAPIComponents struct {
	SecuritySchemes map[string]SecurityScheme `json:"securitySchemes" yaml:"securitySchemes"`
}

type OpenAPIInfo struct {
	Title   string `json:"title" yaml:"title"`
	Version string `json:"version" yaml:"version"`
}

type OpenAPISpec struct {
	OpenAPI    string                `json:"openapi" yaml:"openapi"`
	Swagger    string                `json:"swagger" yaml:"swagger"`
	Info       OpenAPIInfo           `json:"info" yaml:"info"`
	Paths      map[string]PathItem   `json:"paths" yaml:"paths"`
	Components OpenAPIComponents     `json:"components" yaml:"components"`
	Security   []map[string][]string `json:"security" yaml:"security"`
}

type Operation struct {
	OperationID string                `json:"operationId" yaml:"operationId"`
	Summary     string                `json:"summary" yaml:"summary"`
	Description string                `json:"description" yaml:"description"`
	Security    []map[string][]string `json:"security" yaml:"security"`
	Deprecated  bool                  `json:"deprecated" yaml:"deprecated"`
	Tags        []string              `json:"tags" yaml:"tags"`
	Parameters  []Parameter           `json:"parameters" yaml:"parameters"`
	RequestBody *RequestBody          `json:"requestBody" yaml:"requestBody"`
	Responses   map[string]Response   `json:"responses" yaml:"responses"`
}

type Parameter struct {
	Name     string `json:"name" yaml:"name"`
	In       string `json:"in" yaml:"in"` // query, path, header, cookie
	Required bool   `json:"required" yaml:"required"`
	Schema   Schema `json:"schema" yaml:"schema"`
}

type PathItem struct {
	Get     *Operation `json:"get" yaml:"get"`
	Post    *Operation `json:"post" yaml:"post"`
	Put     *Operation `json:"put" yaml:"put"`
	Delete  *Operation `json:"delete" yaml:"delete"`
	Patch   *Operation `json:"patch" yaml:"patch"`
	Options *Operation `json:"options" yaml:"options"`
}

type PurgeRecommendation struct {
	File            string `json:"file"`
	Reason          string `json:"reason"`
	Severity        string `json:"severity"`
	Priority        int    `json:"priority"` // 1 = highest priority
	Command         string `json:"command"`  // BFG or git-filter-repo command
	Alternative     string `json:"alternative,omitempty"`
	AffectedCommits int    `json:"affected_commits"`
}

type RAGGitHistoryPattern struct {
	Name        string
	Pattern     *regexp.Regexp
	RawPattern  string
	Severity    string
	Category    string
	Description string
	Type        string // "filepath" for file path patterns
}

type RAGSecretPattern struct {
	Name        string
	Pattern     *regexp.Regexp
	RawPattern  string
	Severity    string
	Description string
	Technology  string
	Category    string
}

type RandomConfig struct {
	Enabled bool `json:"enabled"`
}

type RandomFinding struct {
	Type        string `json:"type"`
	Severity    string `json:"severity"`
	File        string `json:"file"`
	Line        int    `json:"line"`
	Description string `json:"description"`
	Match       string `json:"match,omitempty"`
	Suggestion  string `json:"suggestion"`
	CWE         string `json:"cwe"`

	// Evidence for analyst review and rule improvement
	Evidence *findings.Evidence `json:"evidence,omitempty"`
}

type RandomSummary struct {
	TotalFindings int            `json:"total_findings"`
	BySeverity    map[string]int `json:"by_severity"`
	ByType        map[string]int `json:"by_type"`
	Error         string         `json:"error,omitempty"`
}

type RequestBody struct {
	Required bool `json:"required" yaml:"required"`
}

type Response struct {
	Description string `json:"description" yaml:"description"`
}

type Result struct {
	FeaturesRun        []string                  `json:"features_run"`
	Summary            Summary                   `json:"summary"`
	Findings           Findings                  `json:"findings"`
	GitHistorySecurity *GitHistorySecurityResult `json:"git_history_security,omitempty"`
}

type RotationDatabase struct {
	// contains filtered or unexported fields
}

type RotationGuide struct {
	Priority       string   `json:"priority"`                  // "immediate", "high", "medium", "low"
	Steps          []string `json:"steps"`                     // Step-by-step rotation instructions
	RotationURL    string   `json:"rotation_url,omitempty"`    // Direct link to rotation page
	CLICommand     string   `json:"cli_command,omitempty"`     // CLI command to rotate
	AutomationHint string   `json:"automation_hint,omitempty"` // Vault, Secrets Manager, etc.
	ExpiresIn      string   `json:"expires_in,omitempty"`      // When the secret expires
}

type Schema struct {
	Type string `json:"type" yaml:"type"`
}

type SecretFinding struct {
	RuleID   string `json:"rule_id"`
	Type     string `json:"type"`
	Severity string `json:"severity"`
	Message  string `json:"message"`
	File     string `json:"file"`
	Line     int    `json:"line"`
	Column   int    `json:"column"`
	Snippet  string `json:"snippet"`

	// Confidence scoring
	Confidence        string             `json:"confidence"`                   // "high", "medium", "low"
	ConfidenceScore   float64            `json:"confidence_score,omitempty"`   // 0.0-1.0 numeric score
	ConfidenceReason  string             `json:"confidence_reason,omitempty"`  // Why this confidence level
	ConfidenceSignals map[string]float64 `json:"confidence_signals,omitempty"` // Individual factors

	// Detection source tracking
	Entropy         float64 `json:"entropy,omitempty"`          // Shannon entropy score (0-8)
	EntropyLevel    string  `json:"entropy_level,omitempty"`    // "low", "medium", "high"
	DetectionSource string  `json:"detection_source,omitempty"` // "semgrep", "entropy", "git_history", "iac-scanner", "native"
	IaCType         string  `json:"iac_type,omitempty"`         // terraform, kubernetes, cloudformation, github-actions, helm

	// Git history context
	CommitInfo *CommitInfo `json:"commit_info,omitempty"` // For git history findings

	// AI analysis results
	AIConfidence    float64 `json:"ai_confidence,omitempty"`     // 0.0-1.0
	AIReasoning     string  `json:"ai_reasoning,omitempty"`      // Why it's FP or real
	IsFalsePositive *bool   `json:"is_false_positive,omitempty"` // AI determination

	// Remediation guidance
	Rotation        *RotationGuide `json:"rotation,omitempty"`         // Rotation steps, URLs, commands
	ServiceProvider string         `json:"service_provider,omitempty"` // "aws", "github", "stripe", etc.

	// Evidence for analyst review and rule improvement
	Evidence *findings.Evidence `json:"evidence,omitempty"`
}

type SecretPattern struct {
	ID          string
	Name        string
	Pattern     *regexp.Regexp
	RawPattern  string
	Severity    string
	Confidence  string // "high", "medium", "low" - base confidence for this pattern
	Description string
	Category    string // aws, github, generic, database, etc.
	Rotation    string // Rotation guidance
}

type SecretsConfig struct {
	Enabled       bool `json:"enabled"`
	RedactSecrets bool `json:"redact_secrets"` // Redact secret values in output

	// Enhanced detection features
	EntropyAnalysis    EntropyConfig            `json:"entropy_analysis"`     // Entropy-based detection
	GitHistoryScan     GitHistoryConfig         `json:"git_history_scan"`     // Git history scanning
	GitHistorySecurity GitHistorySecurityConfig `json:"git_history_security"` // Git history security (gitignore violations, sensitive files)
	AIAnalysis         AIAnalysisConfig         `json:"ai_analysis"`          // Claude-powered FP reduction
	RotationGuidance   bool                     `json:"rotation_guidance"`    // Add rotation recommendations
	IaCSecrets         IaCSecretsConfig         `json:"iac_secrets"`          // IaC-specific secrets detection
}

type SecretsSummary struct {
	TotalFindings int            `json:"total_findings"`
	Critical      int            `json:"critical"`
	High          int            `json:"high"`
	Medium        int            `json:"medium"`
	Low           int            `json:"low"`
	RiskScore     int            `json:"risk_score"`
	RiskLevel     string         `json:"risk_level"`
	ByType        map[string]int `json:"by_type"`
	FilesAffected int            `json:"files_affected"`

	// Enhanced detection sources
	BySource        map[string]int `json:"by_source,omitempty"`        // semgrep, entropy, git_history
	EntropyFindings int            `json:"entropy_findings,omitempty"` // Findings from entropy analysis
	HistoryFindings int            `json:"history_findings,omitempty"` // Findings from git history
	RemovedSecrets  int            `json:"removed_secrets,omitempty"`  // Secrets later removed from history

	// AI analysis results
	FalsePositives   int `json:"false_positives,omitempty"`   // AI-identified false positives
	ConfirmedSecrets int `json:"confirmed_secrets,omitempty"` // AI-confirmed real secrets

	Error string `json:"error,omitempty"`
}

type SecurityScheme struct {
	Type         string `json:"type" yaml:"type"`
	Scheme       string `json:"scheme" yaml:"scheme"`
	BearerFormat string `json:"bearerFormat" yaml:"bearerFormat"`
	In           string `json:"in" yaml:"in"`
	Name         string `json:"name" yaml:"name"`
}

type SensitiveFileFinding struct {
	File        string      `json:"file"`
	Category    string      `json:"category"`
	Severity    string      `json:"severity"`
	Description string      `json:"description"`
	FirstCommit *CommitInfo `json:"first_commit"`
	LastCommit  *CommitInfo `json:"last_commit,omitempty"`
	StillExists bool        `json:"still_exists"`
	WasRemoved  bool        `json:"was_removed"`
	SizeBytes   int64       `json:"size_bytes,omitempty"`
}

type Summary struct {
	Vulns   *VulnsSummary   `json:"vulns,omitempty"`
	Secrets *SecretsSummary `json:"secrets,omitempty"`
	API     *APISummary     `json:"api,omitempty"`
	// Crypto summaries (merged from code-crypto)
	Ciphers      *CiphersSummary      `json:"ciphers,omitempty"`
	Keys         *KeysSummary         `json:"keys,omitempty"`
	Random       *RandomSummary       `json:"random,omitempty"`
	TLS          *TLSSummary          `json:"tls,omitempty"`
	Certificates *CertificatesSummary `json:"certificates,omitempty"`
	Errors       []string             `json:"errors,omitempty"`
}

type TLSConfig struct {
	Enabled           bool `json:"enabled"`
	CheckProtocols    bool `json:"check_protocols"`     // Check for deprecated SSL/TLS versions
	CheckVerification bool `json:"check_verification"`  // Check for disabled cert verification
	CheckCipherSuites bool `json:"check_cipher_suites"` // Check for weak cipher suites
	CheckInsecureURLs bool `json:"check_insecure_urls"` // Check for HTTP URLs
}

type TLSFinding struct {
	Type        string `json:"type"`
	Severity    string `json:"severity"`
	File        string `json:"file"`
	Line        int    `json:"line"`
	Description string `json:"description"`
	Match       string `json:"match,omitempty"`
	Suggestion  string `json:"suggestion"`
	CWE         string `json:"cwe"`

	// Evidence for analyst review and rule improvement
	Evidence *findings.Evidence `json:"evidence,omitempty"`
}

type TLSSummary struct {
	TotalFindings int            `json:"total_findings"`
	BySeverity    map[string]int `json:"by_severity"`
	ByType        map[string]int `json:"by_type"`
	Error         string         `json:"error,omitempty"`
}

type VulnFinding struct {
	RuleID      string   `json:"rule_id"`
	Title       string   `json:"title"`
	Description string   `json:"description"`
	Severity    string   `json:"severity"`
	File        string   `json:"file"`
	Line        int      `json:"line"`
	Column      int      `json:"column"`
	Category    string   `json:"category,omitempty"`
	CWE         []string `json:"cwe,omitempty"`
	OWASP       []string `json:"owasp,omitempty"`
	Fix         string   `json:"fix,omitempty"`

	// Evidence for analyst review and rule improvement
	Evidence *findings.Evidence `json:"evidence,omitempty"`
}

type VulnsConfig struct {
	Enabled         bool     `json:"enabled"`
	IncludeOWASP    bool     `json:"include_owasp"`    // Include OWASP Top 10 rules
	IncludeCWE      bool     `json:"include_cwe"`      // Include CWE-mapped rules
	SeverityMinimum string   `json:"severity_minimum"` // low, medium, high, critical
	ExcludeRules    []string `json:"exclude_rules"`    // Rule IDs to skip
}

type VulnsSummary struct {
	TotalFindings int            `json:"total_findings"`
	Critical      int            `json:"critical"`
	High          int            `json:"high"`
	Medium        int            `json:"medium"`
	Low           int            `json:"low"`
	ByCWE         map[string]int `json:"by_cwe,omitempty"`
	ByCategory    map[string]int `json:"by_category,omitempty"`
	Error         string         `json:"error,omitempty"`
}