Feature: Built-in static security scanner #234

Feature: Built-in Static Security Scanner

Problem

Cora relies entirely on LLM for security review. LLMs can miss deterministic patterns (hardcoded secrets, weak crypto, known CVE patterns) that static scanners catch reliably.

Proposed Solution

Add a deterministic pre-scan phase before LLM review. Static scanner catches what's guaranteed to be a finding; LLM handles nuance and context.

Two-Phase Architecture

Phase 1: Static Scan (deterministic, <1s)
├── Secret detection (API keys, tokens, passwords)
├── Weak crypto (MD5, SHA1 for passwords)
├── Known anti-patterns (eval(), exec(), SQL string concat)
├── Dependency vulnerability patterns
└── Output: List of guaranteed findings

Phase 2: LLM Review (semantic, context-aware)
├── Receives static scan results as additional context
├── Can reference and expand on static findings
├── Handles logic bugs, architecture issues, performance
└── Output: Combined findings (static + LLM)

Final: Merged SARIF with both sources

Detection Rules

Why v0.5

• High value-add for security positioning
• Independent of Uteke integration — pure Cora feature
• Complements quality profiles (feat: quality profiles — preset and configurable rule sets per project #208)

Acceptance Criteria

• Pre-scan detects hardcoded secrets with <1% false positive
• Pre-scan catches weak crypto usage (MD5, SHA1, DES)
• Pre-scan catches injection patterns (SQL concat, eval)
• Static findings merged into LLM review context
• SARIF output marks source: "static" vs "llm"
• Config toggle: scanner.enabled = true (default)
• Each scan adds <500ms overhead