ubs-scanner

# Scan current directory, critical issues only
ubs scan . --severity=critical

# Scan specific files
ubs scan src/auth.rs src/parser.rs --severity=high

# Full scan with all rules
ubs scan . --all-rules

# With SARIF output for CI
ubs scan . --format=sarif > ubs-report.sarif

# With JSON for processing
ubs scan . --format=json > ubs-findings.json

# Rust-focused scan
ubs scan . --lang=rust --include-unsafe

# TypeScript scan
ubs scan . --lang=typescript --strict

# Get only vital-few findings
ubs scan . --severity=high,critical --confidence=90

### Static Analysis (UBS)

**Status**: ✅ Pass | ⚠️ Pass with Follow-ups | ❌ Fail

**Findings Summary**: {critical}/{high}/{medium} issues

**Critical (Blocking)**:
- [{rule-id}] {description} at `{file}:{line}` - {remediation}

**High (Should Fix)**:
- [{rule-id}] {description} at `{file}:{line}` - {remediation}

**Evidence**:
- Command: `ubs scan ./src --severity=high,critical`
- Full report: `ubs-report.sarif`

**UBS Finding**: [{severity}] {rule-id}
**Location**: `{file}:{line}`
**Issue**: {description}
**Impact**: {what could go wrong}
**Fix**: {how to remediate}

```{language}
// Before (vulnerable)
{problematic code}

// After (fixed)
{corrected code}

## Common UBS Findings and Fixes

### Null/Undefined Access (JS/TS)
```javascript
// UBS-JS-001: Unguarded property access
// Before
const name = user.profile.name;

// After
const name = user?.profile?.name ?? 'Unknown';

// UBS-JS-042: Missing await on async function
// Before
function process() {
    fetchData(); // Silent failure if this rejects
}

// After
async function process() {
    await fetchData();
}

// UBS-RUST-017: Unbounded Vec from untrusted input
// Before
fn parse(count: usize) -> Vec<Item> {
    Vec::with_capacity(count) // DoS vector
}

// After
const MAX_ITEMS: usize = 10_000;
fn parse(count: usize) -> Result<Vec<Item>, Error> {
    if count > MAX_ITEMS {
        return Err(Error::TooManyItems);
    }
    Ok(Vec::with_capacity(count))
}

# UBS-PY-SEC-003: SQL injection via string formatting
# Before
cursor.execute(f"SELECT * FROM users WHERE name = '{name}'")

# After
cursor.execute("SELECT * FROM users WHERE name = ?", (name,))

// UBS-GO-012: Unclosed file handle
// Before
func read(path string) []byte {
    f, _ := os.Open(path)
    data, _ := io.ReadAll(f)
    return data // f never closed
}

// After
func read(path string) ([]byte, error) {
    f, err := os.Open(path)
    if err != nil {
        return nil, err
    }
    defer f.Close()
    return io.ReadAll(f)
}

# Via curl (recommended)
curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/ultimate_bug_scanner/main/install.sh | bash

# Via Homebrew
brew install ultimate-bug-scanner

# Via Docker
docker pull dicklesworthstone/ubs