Static analysis engine for JavaScript and TypeScript trees. Detects hardcoded secrets, high-entropy tokens, and sensitive API paths, then emits table, JSON, CSV, SARIF, or Markdown. Fails CI when a severity threshold or cumulative impact score is exceeded. Serialized reports mask matched values.