Add permanent FP suppression layer (_FP_SUPPRESSIONS)

Eliminates all recurring false positive categories at the architecture
level — no more per-repo patches after every scan:

- Dynamic ? placeholder: emails.map(()=>'?') → bound values, not injected
- Ternary SQL keyword: ${flag ? 'UNIQUE' : ''} → fixed literals
- file:// SSRF: local module loading, not HTTP vector
- Type-only File Upload: import type / : BusboyFileStream declarations
- CREATE INDEX boolean flag: internal flag, not user input
- Open Redirect: variable assignment line ≠ redirect issuance

Architecture: _is_suppressed(vuln, line) called once per match before
any finding is emitted. New FP categories can be added to _FP_SUPPRESSIONS
without touching any other code.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app.py

@@ -1522,6 +1522,65 @@ _SQL_KEYWORDS = re.compile(r'\b(SELECT|INSERT|UPDATE|DELETE|FROM|WHERE|JOIN)\b',
 _TEMPLATE_VAR = re.compile(r'[$][{][^}]+[}]')   # JS/TS template literals: ${var}
 _FSTRING_VAR  = re.compile(r'[{][a-zA-Z_]\w*[^}]*[}]')  # Python f-strings: {var}
 
+# ══════════════════════════════════════════════════════════
+#  PERMANENT FALSE-POSITIVE SUPPRESSION LAYER
+#  Applied per-line before any finding is emitted.
+#  Each entry: (vuln_type_or_None, compiled_regex, reason)
+#  vuln_type=None  → applies to ALL vulnerability types
+# ══════════════════════════════════════════════════════════
+_FP_SUPPRESSIONS = [
+
+    # ── SQL: dynamic ? placeholder builder ─────────────────
+    # emails.map(() => '?')  /  ids.map((_) => '?')
+    # Generates "?,?,?" bound values — never injects user data
+    (None,
+     re.compile(r'\$\{[^}]+\.map\s*\(\s*[^)]*\)\s*\.?(join\s*\(|map\s*\()?[^}]*\?[^}]*\}', re.IGNORECASE),
+     "Dynamic ? placeholder builder — values are bound, not interpolated"),
+
+    # ── SQL: ternary returning SQL keyword literals only ────
+    # ${isUnique ? 'UNIQUE ' : ''}  /  ${desc ? 'DESC' : 'ASC'}
+    (None,
+     re.compile(r'\$\{\s*\w+\s*\?\s*[\'"][A-Z_\s]*[\'"]\s*:\s*[\'"][A-Z_\s]*[\'"]\s*\}', re.IGNORECASE),
+     "Ternary returning fixed SQL keyword literals — not user-controlled"),
+
+    # ── SSRF: file:// scheme used for module/script loading ─
+    # file://${entrypointPath}  — local filesystem, not HTTP
+    ("SSRF",
+     re.compile(r'file://\$\{', re.IGNORECASE),
+     "file:// URL scheme for local module loading — not an HTTP SSRF vector"),
+
+    # ── File Upload: type-only declarations, not handlers ───
+    # import type { BusboyFileStream }  /  : BusboyFileStream
+    ("Insecure File Upload",
+     re.compile(r'(?:import\s+type\b|:\s*(?:BusboyFileStream|Readable|Stream|FileStream)\b)', re.IGNORECASE),
+     "Type-only reference — no actual upload handler present on this line"),
+
+    # ── SQL: CREATE INDEX with boolean flag only ────────────
+    # CREATE ${flag ? 'UNIQUE ' : ''}INDEX  — flag is internal boolean
+    (None,
+     re.compile(r'CREATE\s+\$\{\s*\w+\s*\?\s*[\'"]UNIQUE\s*[\'"]\s*:\s*[\'"][\'"]', re.IGNORECASE),
+     "CREATE INDEX with internal boolean flag — not user-controlled"),
+
+    # ── Open Redirect: variable assigned but not yet used ───
+    # let redirect = req.query[...]  — assignment line alone is not a redirect
+    ("Open Redirect",
+     re.compile(r'^\s*(let|const|var)\s+\w+\s*=\s*req\.(query|body|params)', re.IGNORECASE),
+     "Variable assignment only — redirect not issued on this line"),
+]
+
+
+def _is_suppressed(vuln: str, line: str) -> tuple:
+    """
+    Returns (True, reason) if this finding should be suppressed as a known false positive.
+    Returns (False, '') otherwise.
+    """
+    for fp_vuln, fp_re, reason in _FP_SUPPRESSIONS:
+        if fp_vuln and fp_vuln != vuln:
+            continue
+        if fp_re.search(line):
+            return True, reason
+    return False, ""
+
 
 def scan_file_content(content, filename):
     findings  = []
@@ -1537,6 +1596,11 @@ def scan_file_content(content, filename):
                 if not re.search(pattern, line):
                     continue
 
+                # ── Permanent FP suppression layer ──────────────
+                suppressed, _ = _is_suppressed(vuln, line)
+                if suppressed:
+                    continue
+
                 # ── Fix 1: SQL Injection mislabeled as Hardcoded Secret ──
                 # If the matched line contains SQL keywords AND a template/f-string
                 # interpolation with user input, it's SQL Injection, not a secret.