1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
//! Killer — a fast, extensible code quality and security analysis engine.
//!
//! This library crate exposes the analysis engine so it can be embedded and
//! tested independently of the `killer` command-line binary.
//!
//! # Overview
//!
//! **Static analysis** — the `killer scan` pipeline:
//!
//! - [`scanner`] walks a directory, detects languages, and loads file contents.
//! - [`analyzer`] defines the [`analyzer::Rule`] trait and runs rules over files.
//! - [`rules`] contains the built-in security and quality rules.
//! - [`report`] turns findings into a scored terminal, JSON, Markdown, or HTML
//! report.
//! - [`config`] loads `.killer.toml` settings.
//!
//! **The `.klr` language and test framework** — `killer test`:
//!
//! - [`klr`] is the language itself: parser, AST, interpreter, the parallel
//! runner, and the static rule engine. The lexer behind [`klr::parse`] is an
//! internal detail and is not exposed.
//! - [`attacks`] holds the executors, including a zero-dependency HTTP client
//! behind the [`attacks::http::HttpClient`] trait.
//! - [`suites`] exposes the six built-in suites, embedded at compile time.
//! - [`results`] models a test run and persists it under `.killer/results/`.
//! - [`fuzz`] is the mutation-generator catalog shared by `.klr` `mutate` and
//! the `killer fuzz` command.
//!
//! **Project analysis and workflow** — everything else:
//!
//! - [`graph`] builds a structural import/dependency graph (not a data-flow one).
//! - [`dependencies`] inventories declared dependencies from local manifests
//! across six ecosystems — no CVE or advisory lookup.
//! - [`compliance`] maps detected findings onto OWASP Top 10 (2021) and CWE.
//! - [`intelligence`] records score snapshots and computes the trend.
//! - [`git`] parses `git diff` output for [`review`], which analyzes only the
//! lines a change touched.
//! - [`ci`] provides the gate helpers behind `killer ci` / `killer github enable`.
//! - [`watch`] is a dependency-free polling file watcher.
//! - [`explain`] is the knowledge base behind `killer explain <ISSUE_ID>`.
//!
//! # API stability
//!
//! The enums that model an open set are `#[non_exhaustive]`
//! ([`analyzer::Severity`], [`analyzer::Category`], [`scanner::Language`],
//! [`results::Verdict`], [`dependencies::Ecosystem`],
//! [`compliance::CategoryStatus`], [`git::DiffTarget`], [`fuzz::HitOutcome`],
//! and the AST's [`klr::ast::Value`] and [`klr::ast::Expectation`]). Match them
//! with a wildcard arm and fold it into the conservative branch: a [`Verdict`]
//! you do not recognize has not been shown secure.
//!
//! [`analyzer::Finding`] and [`klr::ast::Attack`] are `#[non_exhaustive]` too,
//! because both are going to gain fields; build them with
//! [`analyzer::Finding::new`] and [`klr::ast::Attack::empty`].
//!
//! [`analyzer::Rule`] is deliberately unsealed so third-party rules keep
//! working: only `id` and `check` are required, and any method added later will
//! also carry a default body.
//!
//! [`Verdict`]: results::Verdict
//!
//! # Example
//!
//! ```no_run
//! use std::path::Path;
//! use killer::{analyzer::Analyzer, config::Config, report::Report, scanner};
//!
//! let root = Path::new(".");
//! let config = Config::load(root).unwrap();
//! let scan = scanner::scan(root, &config);
//! let findings = Analyzer::with_default_rules(&config).analyze(&scan);
//! let report = Report::new("demo".into(), scan.stats, findings);
//! print!("{}", report.render_terminal());
//! ```