Metadata-Version: 2.4
Name: codefence
Version: 1.0.2
Summary: A tiny offline policy gate for code. Check AI-generated code before it reaches Git.
Author: CodeFence
License: CODEFENCE
        END USER LICENSE AGREEMENT (EULA)
        Version 1.0.0
        
        Copyright (c) 2026 CodeFence. All rights reserved.
        
        PLEASE READ THIS AGREEMENT CAREFULLY BEFORE USING THIS SOFTWARE.
        BY USING THIS SOFTWARE, YOU AGREE TO BE BOUND BY ITS TERMS.
        
        --------------------------------------------------------------------
        1. DEFINITIONS
        --------------------------------------------------------------------
        
        "Software" means the CodeFence command-line tool, its source
        code, documentation, rules file (rules.json), sample files, and any
        accompanying materials delivered together.
        
        "Licensor" means the copyright holder of the Software.
        
        "You" or "Licensee" means the individual person who purchased or
        acquired the Software.
        
        "Personal Use" means use of the Software by a single individual, on
        computers that the individual owns or controls, for that individual's
        own development work. Personal Use does not include use on behalf of
        a commercial entity as a service to third parties.
        
        --------------------------------------------------------------------
        2. GRANT OF LICENSE
        --------------------------------------------------------------------
        
        Subject to your compliance with this Agreement, the Licensor grants
        You a non-exclusive, non-transferable, worldwide, perpetual license
        to:
        
          (a) install and use the Software on up to three (3) devices that
              You personally own or control;
          (b) read, study, and audit the source code for Your own personal
              understanding of its behavior;
          (c) create private modifications of the source code for Your own
              personal use, provided such modifications remain strictly
              private and are not distributed.
        
        This is a license, not a sale. The Licensor retains all right, title,
        and interest in and to the Software.
        
        --------------------------------------------------------------------
        3. RESTRICTIONS
        --------------------------------------------------------------------
        
        You may NOT:
        
          (a) redistribute, sublicense, sell, resell, rent, lease, lend, or
              otherwise transfer the Software or any modification of it;
          (b) publish, share, or make available the source code, in original
              or modified form, on any public or private repository, forum,
              chat, file-sharing service, or bundle;
          (c) include the Software in any commercial product, bundle, or
              service offering;
          (d) remove, alter, or obscure any copyright, license, or
              attribution notice in the Software;
          (e) use the Software for any unlawful purpose;
          (f) use the Software to provide scanning-as-a-service to third
              parties on a commercial basis.
        
        --------------------------------------------------------------------
        4. SOURCE CODE AVAILABILITY
        --------------------------------------------------------------------
        
        The Software is delivered in human-readable source form. This is done
        intentionally so that any user can inspect exactly what the tool does,
        confirm that it performs no network calls, and verify that it does not
        touch files outside the scope documented in SECURITY.md.
        
        Availability of the source code under this Agreement does NOT make
        the Software open source. Open-source licenses grant redistribution
        rights; this Agreement does not.
        
        --------------------------------------------------------------------
        5. NO SUPPORT, NO UPDATES
        --------------------------------------------------------------------
        
        The Software is provided as-is at the time of purchase. The Licensor
        has no obligation to:
        
          (a) provide technical support, bug fixes, or updates;
          (b) maintain compatibility with future Python versions, operating
              systems, or third-party libraries;
          (c) respond to any communication regarding the Software.
        
        Any future updates, if ever released, are provided at the Licensor's
        sole discretion and do not extend the obligations of this Agreement.
        
        --------------------------------------------------------------------
        6. CONSUMER RIGHTS (EU/UK)
        --------------------------------------------------------------------
        
        If You are a consumer resident in the European Union or the United
        Kingdom, nothing in this Agreement limits or excludes any statutory
        right or remedy You have under applicable mandatory consumer law.
        
        In particular:
        
          (a) RIGHT OF WITHDRAWAL (EU): You have the right to withdraw from
              the purchase within fourteen (14) days of delivery, without
              giving any reason, provided that You have not downloaded the
              Software file. Once digital content has been downloaded, the
              withdrawal right is typically waived under the EU Consumer
              Rights Directive (2011/83/EU), Article 16(m), unless the
              vendor has obtained Your prior express consent and
              acknowledgement of that waiver.
        
          (b) CONFORMITY: If the Software does not conform to its
              description, You may be entitled to a remedy under the
              applicable EU/UK consumer legislation.
        
        To exercise the right of withdrawal, follow the process documented
        in REFUND_POLICY.md.
        
        --------------------------------------------------------------------
        7. DISCLAIMER OF WARRANTY
        --------------------------------------------------------------------
        
        THE SOFTWARE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTY
        OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
        WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND
        NON-INFRINGEMENT.
        
        THE LICENSOR DOES NOT WARRANT THAT:
        
          (a) the Software will detect every issue in the scanned code;
          (b) the Software will produce no false positives or false negatives;
          (c) a clean scan means the scanned code is secure, correct, or
              complete;
          (d) the Software will run uninterrupted or error-free on every
              environment.
        
        The Software is a pattern-based sanity checker. It is NOT a security
        audit, NOT a substitute for professional security review, and NOT a
        guarantee of code quality.
        
        --------------------------------------------------------------------
        8. LIMITATION OF LIABILITY
        --------------------------------------------------------------------
        
        TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE TOTAL
        AGGREGATE LIABILITY OF THE LICENSOR ARISING OUT OF OR RELATING TO
        THIS AGREEMENT OR THE SOFTWARE SHALL NOT EXCEED THE AMOUNT ACTUALLY
        PAID BY YOU FOR THE SOFTWARE.
        
        IN NO EVENT SHALL THE LICENSOR BE LIABLE FOR ANY INDIRECT,
        INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR ANY
        LOSS OF PROFITS, DATA, BUSINESS, OR GOODWILL, ARISING OUT OF OR
        RELATING TO THE USE OR INABILITY TO USE THE SOFTWARE.
        
        NOTHING IN THIS SECTION EXCLUDES OR LIMITS LIABILITY THAT CANNOT BE
        EXCLUDED OR LIMITED UNDER APPLICABLE MANDATORY LAW.
        
        --------------------------------------------------------------------
        9. TERMINATION
        --------------------------------------------------------------------
        
        This Agreement is effective until terminated. Your rights under this
        Agreement terminate automatically if You materially breach any of its
        terms. Upon termination, You must stop using the Software and delete
        all copies in Your possession or control.
        
        Sections 3, 4, 7, 8, 10, and 11 survive termination.
        
        --------------------------------------------------------------------
        10. GOVERNING LAW
        --------------------------------------------------------------------
        
        This Agreement is governed by the laws of England and Wales, without
        regard to its conflict of law rules. Any dispute that cannot be
        resolved amicably shall be subject to the exclusive jurisdiction of
        the courts of England and Wales, except that mandatory consumer
        protections in Your country of residence may grant You the right to
        bring proceedings in Your local courts.
        
        --------------------------------------------------------------------
        11. ENTIRE AGREEMENT
        --------------------------------------------------------------------
        
        This Agreement, together with TERMS_OF_USE.md, REFUND_POLICY.md, and
        SECURITY.md, constitutes the entire agreement between You and the
        Licensor concerning the Software.
        
        If any provision is held unenforceable, the remaining provisions
        remain in full force and effect.
        
        --------------------------------------------------------------------
        END OF LICENSE
        --------------------------------------------------------------------
        
Project-URL: Homepage, https://codefence.dev
Project-URL: Source, https://github.com/USERNAME/codefence
Project-URL: Issues, https://github.com/USERNAME/codefence/issues
Project-URL: Changelog, https://github.com/USERNAME/codefence/blob/main/CHANGELOG.md
Keywords: security,static-analysis,pre-commit,git-hook,ai-generated-code,sast,sarif,offline,policy
Classifier: Development Status :: 5 - Production/Stable
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Software Development :: Quality Assurance
Classifier: Topic :: Software Development :: Testing
Classifier: Topic :: Security
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE.txt
License-File: LICENSE_FAQ.md
License-File: NOTICE.md
Dynamic: license-file

# CodeFence

**A tiny offline policy gate for code.**

Check AI-generated code before it reaches Git.

---

## What it does

CodeFence is a single-file, zero-dependency Python CLI that scans
source code for selected dangerous patterns before you commit. It
runs a curated set of rules and reports findings with:

- severity (critical / high / medium / low / info)
- exact location (file:line:column)
- code snippet
- short remediation
- typical before/after fix example

It is designed around the risks commonly encountered in AI-assisted
development, but scans ordinary source code regardless of how it
was written.

**The gate workflow:**

    AI writes code
         |
         v
    CodeFence runs on staged files
         |
         v
    policy evaluation (allow / warn / block)
         |
         v
    PASS or BLOCKED
         |
         v
    git commit

## What it does NOT do

- Not an autofixer. It shows a typical fix; it does not edit files.
- Not a security audit. It is a pattern-based sanity checker.
- Not a replacement for Semgrep, CodeQL, or professional review.
- Not interprocedural. No dataflow, no taint analysis.
- Not a guarantee. A clean scan does not mean the code is secure.

## Install

    pip install codefence

Or run it directly:

    python3 codefence.py app.py

## Quick start

**One-time setup in a git repository:**

    codefence init

This installs a pre-commit hook and creates .codefence/config.json.
Every commit is then gated automatically.

**Daily usage:**

    codefence --staged          # scan only what is staged
    codefence --staged --diff   # only NEW findings since baseline
    codefence baseline          # snapshot current findings

**One-off scans:**

    codefence src/
    codefence --format json --output report.json src/
    codefence --format html --output report.html src/
    codefence --format sarif --output results.sarif .

**Policy-as-code:**

    codefence --policy company-policy.json --staged
    codefence policy validate company-policy.json

**Explanation:**

    codefence explain R002
## The 30 rules

Rules are shipped in rules.json (human-readable JSON). You can
inspect them, and you can add or disable rules for your own use.

### Secrets
- R001 - Hardcoded API keys / secrets
- R011 - Hardcoded database credentials
- R028 - Env var with hardcoded fallback secret

### Injection
- R002 - SQL injection via string concatenation (Python)
- R003 - eval() / exec() on untrusted input (Python)
- R004 - Command injection via shell=True (Python)
- R005 - innerHTML with unsanitized data (JavaScript)
- R010 - Path traversal
- R014 - Prototype pollution (JavaScript)
- R019 - Unsafe deserialization (pickle, yaml.load)

### Authentication
- R006 - Missing authentication on endpoints
- R015 - Missing rate limiting on public endpoints
- R018 - Open redirect
- R020 - Never-expiring tokens / JWT

### Cryptography
- R008 - Insecure random for security tokens (Python)
- R009 - Disabled TLS/SSL verification
- R016 - MD5 / SHA1 for password hashing

### Configuration
- R007 - Overly permissive CORS (*)
- R017 - Debug mode left enabled
- R021 - Missing security headers (Express)

### Reliability
- R022 - Race conditions (check-then-act)
- R026 - HTTP request without timeout
- R027 - Naive datetime (no timezone, context-aware)

### Quality
- R012 - Broad except: pass
- R013 - Mutable default arguments
- R023 - Logging sensitive data
- R024 - Unused imports / dead code
- R025 - Promise rejection ignored (JavaScript)

### AI-specific
- R030 - Typosquatted package imports
- R031 - TODO / FIXME / HACK in new code

Each rule carries a confidence level and a stable rule_version +
fingerprint for baseline stability.

## Configuration

Options can be passed as CLI flags or through a JSON config file
(auto-discovered at .codefence/config.json after 'codefence init').

Example .codefence/config.json:

    {
      "schema": "codefence/config-v1",
      "format": "json",
      "severity": "medium",
      "include": ["*.py", "*.js"],
      "exclude": ["node_modules", ".git", "venv", "samples"],
      "max_size": 2097152,
      "cache": false
    }

Priority: CLI flags > config file > built-in defaults.

### Optional cache

Pass --cache to enable a local cache at ~/.cache/codefence/. The
cache is keyed by SHA-256 of the file content plus a fingerprint
of rules.json. It is off by default. See SECURITY.md for how the
cache is protected.

### Optional history

Pass --history to record this scan in a local SQLite database at
~/.local/share/codefence/history.db. Off by default.

Set CODEFENCE_NO_HISTORY=1 to disable history entirely, even when
--history is set.

Query history:

    codefence history
    codefence stats
## Security and privacy

- Zero network calls. Zero.
- Zero telemetry.
- Zero data upload.
- Writes only to --output, and optionally to:
    ~/.cache/codefence/            (only when --cache is set)
    ~/.local/share/codefence/      (only when --history is set)
- Never writes to the files you scan.
- Never executes the code you scan.

The full threat model is documented in SECURITY.md.

## Verifying the download

Every shipped file is hashed in CHECKSUMS.txt. To verify:

    sha256sum codefence.py rules.json

Compare the output with the corresponding lines in CHECKSUMS.txt.
If the hashes do not match, do not use the file.

## Payment and pricing

**$12 USD, one-time.**

Includes the current major version (v1.x) and its maintenance
releases. No subscription. No support. No account.

Payments are available in cryptocurrency only:

- USDT (TRC20 or BEP20)
- USDC
- BTC
- TRX
- XRP

Official purchase channels:

- Getly
- SilkRoadx402
- ctlx.cc

If you find CodeFence on any other site claiming to sell it,
treat that site as unofficial.

## License

Source-available. Not open source.

Summary:

- Personal use on up to 3 devices that you own or control.
- Read, study, and privately modify the source.
- No redistribution. No resale. No bundling.
- No scanning-as-a-service on a commercial basis.

For plain-language answers to common questions, see LICENSE_FAQ.md.
For the full legal terms, see LICENSE.txt and TERMS_OF_USE.md.

**Governing law:** England and Wales. Mandatory consumer
protections in your country of residence remain fully applicable.

## Support

There is no support.

- No email. No chat. No issue tracker.
- No guaranteed updates.
- No bug-fix commitments.

If you need a product with ongoing support, please look elsewhere.

## FAQ

**Q: Will this find every security issue in my code?**
A: No. It finds a curated set of dangerous patterns. It is a
   sanity check, not a security audit.

**Q: Can I use it in CI?**
A: Yes. JSON and SARIF outputs are pure on stdout. Exit codes are
   stable.

**Q: Does it phone home?**
A: No. Zero network calls. You can verify by reading the source
   or by running it under strace.

**Q: Does it fix my code?**
A: No. It shows a typical before/after fix. You apply it yourself.

**Q: Does it support TypeScript?**
A: No. Python, JavaScript (.js, .mjs, .cjs).

**Q: What about false positives?**
A: Pattern-based scanners always produce some. Rules with lower
   confidence are flagged as such. You can disable any rule in
   rules.json or via policy overrides.

**Q: Can I modify the source?**
A: Yes, privately. See LICENSE_FAQ.md.

**Q: Can my team use it?**
A: Each developer using CodeFence on their own machine needs
   their own license. One license covers one individual on up to
   three devices.

**Q: How do I get updates?**
A: There are no guaranteed updates.

**Q: Can I get a refund?**
A: See REFUND_POLICY.md.

## A note on honesty

This product is built to do a specific, limited thing well. It
does not overstate what it can do. Every claim in this README is
traceable to a line of code or a test. If you find a claim that
is not supported by what the tool actually does, please report
it.

*End of README.*
