diff --git a/apps/cli/src/commands/scan.ts b/apps/cli/src/commands/scan.ts
index 2bb84e1..edfbb57 100644
--- a/apps/cli/src/commands/scan.ts
+++ b/apps/cli/src/commands/scan.ts
@@ -36,6 +36,16 @@ export interface ScanCommandOptions {
   dependencies?: boolean;
   /** Globs to skip, merged with any `.threatcrushignore` at the scan root. */
   exclude?: readonly string[];
+  /**
+   * Also report security controls the tree shows no evidence of — headers,
+   * CSRF, rate limiting, body size limits.
+   *
+   * Off by default, and deliberately so. Every other finding points at a line;
+   * these point at an absence, which a reverse proxy or a gateway may already
+   * be covering from outside the repository. Opt-in keeps a normal scan made
+   * only of things that are actually there.
+   */
+  missingControls?: boolean;
 }
 
 interface ScanOutcome {
@@ -175,6 +185,7 @@ export async function scanCommand(
     let seen = 0;
     const report = scanPath(targetPath, {
       exclude: options.exclude,
+      missingControls: options.missingControls,
       onFile: () => {
         seen += 1;
         if (spinner) spinner.text = `Scanning files... (${seen} files)`;
diff --git a/apps/cli/src/index.ts b/apps/cli/src/index.ts
index 1e9299e..3f05416 100644
--- a/apps/cli/src/index.ts
+++ b/apps/cli/src/index.ts
@@ -260,6 +260,10 @@ program
     (value: string, previous: string[]) => [...previous, value],
     [] as string[],
   )
+  .option(
+    "--missing-controls",
+    "also report security controls the tree shows no evidence of (headers, CSRF, rate limiting, body size limits)",
+  )
   .option("-v, --verbose", "list the paths that could not be read")
   .action(async (targetPath: string, opts: {
     format?: string;
@@ -268,6 +272,7 @@ program
     pathPrefix?: string;
     deps?: boolean;
     exclude?: string[];
+    missingControls?: boolean;
     verbose?: boolean;
   }) => {
     const format = (opts.format ?? "text").toLowerCase();
@@ -291,6 +296,7 @@ program
       pathPrefix: opts.pathPrefix,
       dependencies: opts.deps,
       exclude: opts.exclude,
+      missingControls: opts.missingControls,
       verbose: opts.verbose,
     });
   });
diff --git a/packages/scan/src/__tests__/controls.test.ts b/packages/scan/src/__tests__/controls.test.ts
new file mode 100644
index 0000000..4650303
--- /dev/null
+++ b/packages/scan/src/__tests__/controls.test.ts
@@ -0,0 +1,93 @@
+import { describe, expect, it } from 'vitest';
+import { ControlAudit, SECURITY_CONTROLS } from '../controls';
+
+const auditOf = (files: Record<string, string>): ControlAudit => {
+  const audit = new ControlAudit();
+  for (const [path, text] of Object.entries(files)) audit.observe(path, text);
+  return audit;
+};
+
+const missingIds = (files: Record<string, string>): string[] =>
+  auditOf(files).missing().map((control) => control.id);
+
+describe('applicability', () => {
+  it('says nothing about a tree that serves no HTTP', () => {
+    // The most important test here. "This library has no CSRF token" is a
+    // category error, and reporting it is the fastest way to teach an operator
+    // that these findings are noise.
+    expect(missingIds({ 'sum.js': 'export const add = (a, b) => a + b;' })).toEqual([]);
+  });
+
+  it('reports nothing to anchor to when no server was found', () => {
+    expect(auditOf({ 'sum.js': 'export const add = (a, b) => a + b;' }).findings()).toEqual([]);
+  });
+
+  it('engages once a server is constructed', () => {
+    const missing = missingIds({ 'server.js': 'const app = express();\napp.listen(3000);' });
+    expect(missing).toHaveLength(SECURITY_CONTROLS.length);
+  });
+});
+
+describe('evidence', () => {
+  it('accepts a control installed in a different file from the server', () => {
+    // The whole reason this is a walk-wide accumulator rather than a per-file
+    // rule: the limiter in `app.js` protects the route in `routes/admin.js`.
+    const missing = missingIds({
+      'server.js': 'const app = express();',
+      'middleware/security.js': "const helmet = require('helmet');\napp.use(helmet());",
+    });
+    expect(missing).not.toContain('control-security-headers-absent');
+  });
+
+  it('accepts a SameSite cookie as anti-CSRF', () => {
+    // A cookie the browser refuses to send cross-site is not reachable by the
+    // attack the control exists to stop.
+    const missing = missingIds({
+      'server.js': "const app = express();\napp.use(session({ cookie: { sameSite: 'strict' } }));",
+    });
+    expect(missing).not.toContain('control-anti-csrf-absent');
+  });
+
+  it('accepts a rate limiter', () => {
+    const missing = missingIds({
+      'server.js': "const app = express();\nconst rateLimit = require('express-rate-limit');",
+    });
+    expect(missing).not.toContain('control-rate-limiting-absent');
+  });
+
+  it('accepts a body size limit', () => {
+    const missing = missingIds({
+      'server.js': "const app = express();\napp.use(express.json({ limit: '100kb' }));",
+    });
+    expect(missing).not.toContain('control-body-size-limit-absent');
+  });
+
+  it('reports the ones with no evidence anywhere', () => {
+    const missing = missingIds({
+      'server.js': "const app = express();\napp.use(helmet());",
+    });
+    expect(missing).not.toContain('control-security-headers-absent');
+    expect(missing).toContain('control-anti-csrf-absent');
+    expect(missing).toContain('control-rate-limiting-absent');
+  });
+});
+
+describe('findings', () => {
+  it('anchors to the file that builds the server', () => {
+    const findings = auditOf({
+      'lib/util.js': 'export const noop = () => {};',
+      'src/server.js': 'const app = express();',
+    }).findings();
+    expect(findings.every((finding) => finding.file === 'src/server.js')).toBe(true);
+    expect(findings.every((finding) => finding.line === 1)).toBe(true);
+  });
+
+  it('never claims more than `pattern` confidence', () => {
+    // An absence is not evidence. The confidence value is what caps the
+    // severity, and it is what the report shows the operator.
+    const findings = auditOf({ 'server.js': 'const app = express();' }).findings();
+    expect(findings.length).toBeGreaterThan(0);
+    expect(findings.every((finding) => finding.confidence === 'pattern')).toBe(true);
+    expect(findings.every((finding) => finding.severity === 'medium')).toBe(true);
+  });
+});
diff --git a/packages/scan/src/__tests__/node-rules.test.ts b/packages/scan/src/__tests__/node-rules.test.ts
new file mode 100644
index 0000000..b7928fe
--- /dev/null
+++ b/packages/scan/src/__tests__/node-rules.test.ts
@@ -0,0 +1,382 @@
+import { describe, expect, it } from 'vitest';
+import { scanText } from '../text';
+
+/**
+ * Same discipline as `code-rules.test.ts`: every class is tested as a *pair* —
+ * the vulnerable shape and the corrected shape that sits next to it in real
+ * code. A rule that only passes the first half has measured nothing, because a
+ * rule matching every line passes it too.
+ *
+ * Positives assert with `toContain` and negatives with `not.toContain` rather
+ * than on the length of the result. These sources deliberately look like real
+ * server code, so unrelated rules fire on them; asserting emptiness would make
+ * every test brittle to a rule it was not written about.
+ */
+const ruleIds = (path: string, source: string): string[] =>
+  scanText(path, source).map((finding) => finding.ruleId);
+
+describe('code execution', () => {
+  it('flags a vm script whose source can be influenced', () => {
+    const source = ['const script = req.body.script;', 'vm.runInNewContext(script, sandbox);'].join('\n');
+    expect(ruleIds('a.js', source)).toContain('js-vm-untrusted-execution');
+  });
+
+  it('stays silent on a vm script that is a constant', () => {
+    // A plugin loader evaluating a fixed expression is not this class.
+    expect(ruleIds('a.js', 'vm.runInNewContext("2 + 2", {});')).not.toContain(
+      'js-vm-untrusted-execution',
+    );
+  });
+
+  it('flags vm2 regardless of context', () => {
+    const source = "const { NodeVM } = require('vm2');";
+    expect(ruleIds('a.js', source)).toContain('js-vm2-sandbox');
+  });
+
+  it('flags a function-reconstructing deserialiser', () => {
+    const source = [
+      "const serialize = require('node-serialize');",
+      'const data = serialize.unserialize(input);',
+    ].join('\n');
+    expect(ruleIds('a.js', source)).toContain('js-function-deserialization');
+  });
+
+  it('stays silent on a project’s own deserialize helper', () => {
+    // Without the import there is no reason to think this call executes
+    // anything. `deserialize` is one of the most reused names in the ecosystem.
+    const source = [
+      'function deserialize(raw) { return JSON.parse(raw); }',
+      'const data = deserialize(input);',
+    ].join('\n');
+    expect(ruleIds('a.js', source)).not.toContain('js-function-deserialization');
+  });
+
+  it('flags a template compiled from request data', () => {
+    const source = [
+      'const source = req.body.template;',
+      'const render = handlebars.compile(source);',
+    ].join('\n');
+    expect(ruleIds('a.js', source)).toContain('js-template-injection');
+  });
+
+  it('stays silent on a template read from disk', () => {
+    const source = [
+      "const source = fs.readFileSync('views/email.hbs', 'utf-8');",
+      'const render = handlebars.compile(source);',
+    ].join('\n');
+    expect(ruleIds('a.js', source)).not.toContain('js-template-injection');
+  });
+
+  it('flags an interpolated shelljs command', () => {
+    const source = ["const shell = require('shelljs');", 'shell.exec(`git checkout ${branch}`);'].join('\n');
+    expect(ruleIds('a.js', source)).toContain('js-shelljs-command-execution');
+  });
+});
+
+describe('injection', () => {
+  it('flags a $where predicate assembled by concatenation', () => {
+    // The string holds the *other* quote character, which is the shape a
+    // single combined quote class silently fails to match.
+    const source = `const query = { $where: "this.name === '" + name + "'" };`;
+    expect(ruleIds('a.js', source)).toContain('js-nosql-where-expression');
+  });
+
+  it('stays silent on an operator query with no $where', () => {
+    const source = 'const query = { balance: { $gt: 100 } };';
+    expect(ruleIds('a.js', source)).not.toContain('js-nosql-where-expression');
+  });
+
+  it('flags an XPath predicate built by concatenation', () => {
+    // Backticks quote the fixture because the source line itself contains both
+    // a double and a single quote — the shape the rule exists to catch.
+    const source = [
+      "const xpath = require('xpath');",
+      `const nodes = xpath.select("//user[@name='" + name + "']", doc);`,
+    ].join('\n');
+    expect(ruleIds('a.js', source)).toContain('js-xpath-injection');
+  });
+
+  it('stays silent on a constant XPath expression', () => {
+    const source = ["const xpath = require('xpath');", `const nodes = xpath.select("//user[@id='42']", doc);`].join('\n');
+    expect(ruleIds('a.js', source)).not.toContain('js-xpath-injection');
+  });
+
+  it('flags a regular expression compiled from request data', () => {
+    const source = ['const pattern = req.query.filter;', 'const re = new RegExp(pattern);'].join('\n');
+    expect(ruleIds('a.js', source)).toContain('js-regex-from-input');
+  });
+
+  it('stays silent on a literal regular expression', () => {
+    expect(ruleIds('a.js', `const re = new RegExp('^[a-z]+$');`)).not.toContain('js-regex-from-input');
+  });
+});
+
+describe('XML', () => {
+  it('flags a parser told to resolve entities', () => {
+    expect(ruleIds('a.js', 'const doc = libxml.parseXml(body, { noent: true });')).toContain(
+      'js-xml-external-entities',
+    );
+  });
+
+  it('stays silent when entity resolution is left off', () => {
+    expect(ruleIds('a.js', 'const doc = libxml.parseXml(body, { noent: false });')).not.toContain(
+      'js-xml-external-entities',
+    );
+  });
+});
+
+describe('tokens', () => {
+  it('flags the none algorithm', () => {
+    expect(ruleIds('a.js', `const token = jwt.sign(claims, null, { algorithm: 'none' });`)).toContain(
+      'js-jwt-none-algorithm',
+    );
+  });
+
+  it('stays silent on a pinned real algorithm', () => {
+    expect(
+      ruleIds('a.js', `const claims = jwt.verify(token, pub, { algorithms: ['RS256'] });`),
+    ).not.toContain('js-jwt-none-algorithm');
+  });
+});
+
+describe('cryptography', () => {
+  it('flags a broken cipher', () => {
+    expect(ruleIds('a.js', `const c = crypto.createCipheriv('des-ede3-cbc', k, iv);`)).toContain(
+      'js-broken-cipher-algorithm',
+    );
+  });
+
+  it('stays silent on AES-GCM', () => {
+    expect(ruleIds('a.js', `const c = crypto.createCipheriv('aes-256-gcm', k, iv);`)).not.toContain(
+      'js-broken-cipher-algorithm',
+    );
+  });
+
+  it('flags ECB mode', () => {
+    expect(ruleIds('a.js', `const c = crypto.createCipheriv('aes-128-ecb', k, null);`)).toContain(
+      'js-ecb-mode-cipher',
+    );
+  });
+
+  it('flags the legacy passphrase-derived cipher API', () => {
+    expect(ruleIds('a.js', `const c = crypto.createCipher('aes-256-cbc', pass);`)).toContain(
+      'js-legacy-cipher-api',
+    );
+  });
+
+  it('stays silent on the explicit-IV replacement', () => {
+    // `createCipheriv` is the fix, and it shares a prefix with the defect.
+    expect(ruleIds('a.js', `const c = crypto.createCipheriv('aes-256-cbc', k, iv);`)).not.toContain(
+      'js-legacy-cipher-api',
+    );
+  });
+});
+
+describe('cross-site scripting', () => {
+  it('flags auto-escaping turned off', () => {
+    expect(ruleIds('a.js', `nunjucks.configure('views', { autoescape: false });`)).toContain(
+      'js-template-autoescape-disabled',
+    );
+  });
+
+  it('flags serialize-javascript in unsafe mode', () => {
+    const source = [
+      "const serialize = require('serialize-javascript');",
+      'const payload = serialize(state, { unsafe: true });',
+    ].join('\n');
+    expect(ruleIds('a.js', source)).toContain('js-serialize-javascript-unsafe');
+  });
+
+  it('flags an origin echoed back from the request', () => {
+    const source = `res.setHeader('Access-Control-Allow-Origin', req.headers.origin);`;
+    expect(ruleIds('a.js', source)).toContain('js-cors-origin-reflected');
+  });
+
+  it('stays silent on a constant allowed origin', () => {
+    const source = `res.setHeader('Access-Control-Allow-Origin', 'https://app.example.com');`;
+    expect(ruleIds('a.js', source)).not.toContain('js-cors-origin-reflected');
+  });
+
+  it('stays silent when the origin is checked against a list first', () => {
+    // The one correct way to echo an origin, and the reason this rule needs a
+    // guard of its own rather than the generic one.
+    const source = [
+      'if (allowedOrigins.includes(req.headers.origin)) {',
+      `  res.setHeader('Access-Control-Allow-Origin', req.headers.origin);`,
+      '}',
+    ].join('\n');
+    expect(ruleIds('a.js', source)).not.toContain('js-cors-origin-reflected');
+  });
+});
+
+describe('server-side request forgery', () => {
+  it('flags a headless browser sent to a computed URL', () => {
+    const source = [
+      "const puppeteer = require('puppeteer');",
+      'const target = req.query.url;',
+      'await page.goto(target);',
+    ].join('\n');
+    expect(ruleIds('a.js', source)).toContain('js-headless-browser-navigation');
+  });
+
+  it('stays silent on a constant URL', () => {
+    const source = ["const puppeteer = require('puppeteer');", `await page.goto('https://example.com/r');`].join('\n');
+    expect(ruleIds('a.js', source)).not.toContain('js-headless-browser-navigation');
+  });
+});
+
+describe('archive extraction', () => {
+  it('flags an entry name joined onto the destination', () => {
+    const source = [
+      "const unzipper = require('unzipper');",
+      'const dest = path.join(outDir, entry.path);',
+      'fs.writeFileSync(dest, await entry.buffer());',
+    ].join('\n');
+    expect(ruleIds('a.js', source)).toContain('js-archive-entry-path');
+  });
+
+  it('stays silent when containment is checked after the join', () => {
+    // The check necessarily comes *after* the path is built, which is why this
+    // rule looks forward as well as back.
+    const source = [
+      "const unzipper = require('unzipper');",
+      'const dest = path.join(outDir, entry.path);',
+      "if (!dest.startsWith(outDir + path.sep)) throw new Error('unsafe entry');",
+    ].join('\n');
+    expect(ruleIds('a.js', source)).not.toContain('js-archive-entry-path');
+  });
+});
+
+describe('Electron', () => {
+  it('flags node access in the renderer', () => {
+    expect(ruleIds('a.js', 'webPreferences: { nodeIntegration: true },')).toContain(
+      'js-electron-node-integration',
+    );
+  });
+
+  it('stays silent on the hardened defaults', () => {
+    expect(
+      ruleIds('a.js', 'webPreferences: { nodeIntegration: false, contextIsolation: true },'),
+    ).not.toContain('js-electron-node-integration');
+  });
+
+  it('flags web security switched off', () => {
+    expect(ruleIds('a.js', 'webPreferences: { webSecurity: false },')).toContain(
+      'js-electron-web-security-disabled',
+    );
+  });
+
+  it('flags openExternal with a computed target', () => {
+    const source = ['const target = req.query.next;', 'shell.openExternal(target);'].join('\n');
+    expect(ruleIds('a.js', source)).toContain('js-electron-open-external');
+  });
+});
+
+describe('hardening and resource limits', () => {
+  it('flags a security header explicitly disabled', () => {
+    expect(ruleIds('a.js', 'app.use(helmet({ frameguard: false }));')).toContain(
+      'js-helmet-protection-disabled',
+    );
+  });
+
+  it('flags a buffer write with bounds checking off', () => {
+    expect(ruleIds('a.js', 'buf.writeUInt32BE(value, 0, true);')).toContain(
+      'js-buffer-bounds-check-disabled',
+    );
+  });
+
+  it('stays silent on a checked buffer write', () => {
+    expect(ruleIds('a.js', 'buf.writeUInt32BE(value, 0);')).not.toContain(
+      'js-buffer-bounds-check-disabled',
+    );
+  });
+
+  it('flags an unzeroed allocation', () => {
+    expect(ruleIds('a.js', 'const buf = Buffer.allocUnsafe(1024);')).toContain(
+      'js-uninitialized-buffer',
+    );
+  });
+
+  it('stays silent on the zeroing allocator', () => {
+    expect(ruleIds('a.js', 'const buf = Buffer.alloc(1024);')).not.toContain('js-uninitialized-buffer');
+  });
+
+  it('flags an ineffective body limit', () => {
+    expect(ruleIds('a.js', `app.use(express.json({ limit: '50mb' }));`)).toContain(
+      'js-oversized-request-body-limit',
+    );
+  });
+
+  it('stays silent on a limit that actually limits', () => {
+    expect(ruleIds('a.js', `app.use(express.json({ limit: '1mb' }));`)).not.toContain(
+      'js-oversized-request-body-limit',
+    );
+  });
+});
+
+describe('information disclosure', () => {
+  it('flags a stack trace returned through a status chain', () => {
+    expect(ruleIds('a.js', 'res.status(500).send(err.stack);')).toContain('js-error-detail-returned');
+  });
+
+  it('stays silent on a generic error message', () => {
+    expect(ruleIds('a.js', `res.status(500).json({ message: 'Internal server error' });`)).not.toContain(
+      'js-error-detail-returned',
+    );
+  });
+});
+
+describe('the shared guard does not silence a whole neighbourhood', () => {
+  it('keeps reporting near a CORS header line', () => {
+    // Regression. `GENERIC_GUARD` is case-insensitive and its allow-list
+    // heuristic matched the "Allow" inside `Access-Control-Allow-Origin`.
+    // Since the guard is tested against an 8-line window, one header line
+    // suppressed every guardable rule around it — silently, and
+    // indistinguishably from having found nothing.
+    const source = [
+      "app.post('/restore', (req, res) => {",
+      "  res.setHeader('Access-Control-Allow-Origin', req.headers.origin);",
+      "  const token = jwt.sign({ sub: req.query.id }, null, { algorithm: 'none' });",
+      '  res.status(500).send(err.stack);',
+      '});',
+    ].join('\n');
+
+    const ids = ruleIds('a.js', source);
+    expect(ids).toContain('js-jwt-none-algorithm');
+    expect(ids).toContain('js-error-detail-returned');
+  });
+
+  it('still guards on a real allow-list in code', () => {
+    // The fix is scoped to the CORS header prefix, so an actual allow-list
+    // must keep guarding exactly as before. Asserted with code rather than a
+    // comment: comment lines are already excluded from the guard window on
+    // purpose, since a comment mentioning an allow-list is not one.
+    const source = ["const allowlist = ['a.example.com'];", 'const re = new RegExp(req.query.q);'].join('\n');
+    expect(ruleIds('a.js', source)).not.toContain('js-regex-from-input');
+  });
+});
+
+describe('confidence model', () => {
+  it('caps a bare construct at medium and escalates only with visible input', () => {
+    const bare = scanText('a.js', 'const re = new RegExp(pattern);').find(
+      (f) => f.ruleId === 'js-regex-from-input',
+    );
+    // `needsContext` means the bare form is not reported at all, which is the
+    // stronger version of the cap.
+    expect(bare).toBeUndefined();
+
+    const withInput = scanText(
+      'a.js',
+      ['const pattern = req.query.filter;', 'const re = new RegExp(pattern);'].join('\n'),
+    ).find((f) => f.ruleId === 'js-regex-from-input');
+    expect(withInput?.confidence).toBe('contextual');
+  });
+
+  it('reports an inherent rule as evidence at its declared severity', () => {
+    const finding = scanText('a.js', "const { NodeVM } = require('vm2');").find(
+      (f) => f.ruleId === 'js-vm2-sandbox',
+    );
+    expect(finding?.confidence).toBe('evidence');
+    expect(finding?.severity).toBe('high');
+  });
+});
diff --git a/packages/scan/src/__tests__/template-rules.test.ts b/packages/scan/src/__tests__/template-rules.test.ts
new file mode 100644
index 0000000..5e754d3
--- /dev/null
+++ b/packages/scan/src/__tests__/template-rules.test.ts
@@ -0,0 +1,142 @@
+import { describe, expect, it } from 'vitest';
+import { SCAN_EXTENSIONS, scanText } from '../text';
+import { TEMPLATE_EXTENSIONS } from '../template-rules';
+
+/**
+ * Each engine is tested as a pair: the syntax that skips escaping, and the
+ * neighbouring syntax that does not. Getting the second half wrong is how a
+ * template rule ends up reporting every line of every view.
+ */
+const ruleIds = (path: string, source: string): string[] =>
+  scanText(path, source).map((finding) => finding.ruleId);
+
+describe('Handlebars and Mustache', () => {
+  it('flags a triple-stache', () => {
+    expect(ruleIds('v.hbs', '<div>{{{ comment.body }}}</div>')).toContain('tpl-handlebars-unescaped');
+  });
+
+  it('flags the ampersand form', () => {
+    expect(ruleIds('v.mustache', '<div>{{& comment.body }}</div>')).toContain(
+      'tpl-handlebars-unescaped',
+    );
+  });
+
+  it('stays silent on an escaped interpolation', () => {
+    expect(ruleIds('v.hbs', '<div>{{ comment.body }}</div>')).not.toContain('tpl-handlebars-unescaped');
+  });
+
+  it('stays silent on the layout slot', () => {
+    // Every project using layouts has exactly one of these, and it is not a
+    // variable — it is where the rendered child template is spliced in.
+    expect(ruleIds('layout.hbs', '<body>{{{body}}}</body>')).not.toContain('tpl-handlebars-unescaped');
+  });
+});
+
+describe('Vue', () => {
+  it('flags a v-html binding', () => {
+    expect(ruleIds('C.vue', '<div v-html="post.html"></div>')).toContain('tpl-vue-v-html');
+  });
+
+  it('stays silent on a moustache interpolation', () => {
+    expect(ruleIds('C.vue', '<div>{{ post.title }}</div>')).not.toContain('tpl-vue-v-html');
+  });
+});
+
+describe('Pug', () => {
+  it('flags unescaped buffered output', () => {
+    expect(ruleIds('v.pug', 'p!= user.bio')).toContain('tpl-pug-unescaped');
+  });
+
+  it('flags unescaped interpolation', () => {
+    expect(ruleIds('v.pug', 'p Hello !{user.name}')).toContain('tpl-pug-unescaped');
+  });
+
+  it('stays silent on escaped output', () => {
+    expect(ruleIds('v.pug', 'p= user.bio')).not.toContain('tpl-pug-unescaped');
+  });
+
+  it('stays silent on a strict-inequality comparison', () => {
+    // `!==` contains `!=`. Anchoring to the tag position is what keeps inline
+    // JavaScript in a Pug file from reading as unescaped output.
+    expect(ruleIds('v.pug', '- if (a !== b)')).not.toContain('tpl-pug-unescaped');
+  });
+});
+
+describe('EJS', () => {
+  it('flags the raw output tag', () => {
+    expect(ruleIds('v.ejs', '<div><%- comment.body %></div>')).toContain('tpl-ejs-raw-output');
+  });
+
+  it('stays silent on the escaping tag', () => {
+    // In EJS `<%= %>` escapes — the reverse of Underscore's convention, which
+    // is why that engine is in KNOWN_GAPS rather than covered here.
+    expect(ruleIds('v.ejs', '<div><%= comment.body %></div>')).not.toContain('tpl-ejs-raw-output');
+  });
+
+  it('stays silent on a partial include', () => {
+    expect(ruleIds('v.ejs', `<%- include('partials/header') %>`)).not.toContain('tpl-ejs-raw-output');
+  });
+});
+
+describe('Dust', () => {
+  it('flags a suppressed escape filter', () => {
+    expect(ruleIds('v.dust', '<div>{body|s}</div>')).toContain('tpl-dust-escape-filter-off');
+  });
+
+  it('stays silent on a plain reference', () => {
+    expect(ruleIds('v.dust', '<div>{body}</div>')).not.toContain('tpl-dust-escape-filter-off');
+  });
+});
+
+describe('Nunjucks, Twig and Jinja', () => {
+  it('flags the safe filter', () => {
+    expect(ruleIds('v.njk', '<div>{{ post.body | safe }}</div>')).toContain('tpl-jinja-safe-filter');
+  });
+
+  it('flags an autoescape block turned off', () => {
+    expect(ruleIds('v.njk', '{% autoescape false %}')).toContain('tpl-jinja-safe-filter');
+  });
+
+  it('stays silent on a plain interpolation', () => {
+    expect(ruleIds('v.njk', '<div>{{ post.body }}</div>')).not.toContain('tpl-jinja-safe-filter');
+  });
+});
+
+describe('Haml', () => {
+  it('flags unescaped output from a tag', () => {
+    expect(ruleIds('v.haml', '%p!= user.bio')).toContain('tpl-haml-unescaped');
+  });
+
+  it('stays silent on escaped output', () => {
+    expect(ruleIds('v.haml', '%p= user.bio')).not.toContain('tpl-haml-unescaped');
+  });
+});
+
+describe('engine wiring', () => {
+  it('makes every template extension scannable', () => {
+    // A rule whose files the walker skips is a rule that silently never fires.
+    for (const extension of TEMPLATE_EXTENSIONS) {
+      expect(SCAN_EXTENSIONS.has(extension)).toBe(true);
+    }
+  });
+
+  it('caps a template finding at medium', () => {
+    // A template cannot show that the value is attacker-controlled. Reporting
+    // these as high would fill a report with claims nobody can triage.
+    const finding = scanText('v.hbs', '<div>{{{ comment.body }}}</div>')[0];
+    expect(finding?.confidence).toBe('pattern');
+    expect(finding?.severity).toBe('medium');
+  });
+
+  it('still applies the JavaScript rules to a Vue file', () => {
+    // `.vue` is both a template and a script. Reaching the template rules must
+    // not cost it the code rules.
+    const source = ['<script>', 'const el = document.querySelector("#a");', 'el.innerHTML = req.query.q;', '</script>'].join('\n');
+    expect(ruleIds('C.vue', source)).toContain('js-unescaped-html-sink');
+  });
+
+  it('honours an inline suppression on a template line', () => {
+    const source = ['{{!-- threatcrush-disable-next-line tpl-handlebars-unescaped --}}', '{{{ trusted.html }}}'].join('\n');
+    expect(ruleIds('v.hbs', source)).not.toContain('tpl-handlebars-unescaped');
+  });
+});
diff --git a/packages/scan/src/code-rules.ts b/packages/scan/src/code-rules.ts
index 84104e1..6931a62 100644
--- a/packages/scan/src/code-rules.ts
+++ b/packages/scan/src/code-rules.ts
@@ -37,6 +37,7 @@
  * rule that would flag every session read in the codebase. See KNOWN_GAPS.
  */
 
+import { NODE_RULES } from './node-rules';
 import type { Confidence, ScanLanguage, Severity } from './types';
 import { severityFor } from './types';
 
@@ -206,7 +207,20 @@ export const GENERIC_GUARD =
   // The identifier must END at the escaper (with at most a known output-context
   // suffix). An earlier, looser form also matched `describe(`, which would have
   // silenced findings across every test file in every repository.
-  /\ballow(?:ed|list|_list|ed_hosts)?\b|\bwhitelist\b|\b\w{0,6}[Ee]sc(?:ape)?(?:[Hh]tml|HTML|[Xx]ml|XML|[Ss]ql|[Aa]ttr|[Jj]s|[Uu]ri|[Uu]rl)?\s*\(|\bhtml_escape\b|\bhtmlspecialchars\s*\(|\bsanitiz\w*\b|\bencoded\b|\brealpath\b|\bcommonpath\b|\bresolve\(\)\.startsWith\b|\bprocess\.env\b|\bos\.environ\b|\bgetenv\b|\bENV\s*\[|setObjectInputFilter|ObjectInputFilter/i;
+  // The `Access-Control-` lookbehind is not a nicety. This regex is
+  // case-insensitive, and `Access-Control-Allow-Origin` contains the word
+  // "Allow" followed by a non-word character — so the CORS header name matched
+  // the allow-list heuristic. Because the guard is tested against an 8-line
+  // *window*, one header line silently disabled every guardable rule near it:
+  // in a four-line Express error handler, the header on one line suppressed
+  // both the `none`-algorithm JWT finding and the returned stack trace below
+  // it. The failure mode is the dangerous kind — not fewer findings, none, and
+  // indistinguishable from clean code.
+  //
+  // Scoped to the header prefix rather than to a bare `allow(?!-)`, because
+  // this guard also runs over `.yml` and `.conf` files, where `allow-list:`
+  // and `allowed-hosts:` are ordinary keys that should still guard.
+  /(?<!Access-Control-)\ballow(?:ed|list|_list|ed_hosts)?\b|\bwhitelist\b|\b\w{0,6}[Ee]sc(?:ape)?(?:[Hh]tml|HTML|[Xx]ml|XML|[Ss]ql|[Aa]ttr|[Jj]s|[Uu]ri|[Uu]rl)?\s*\(|\bhtml_escape\b|\bhtmlspecialchars\s*\(|\bsanitiz\w*\b|\bencoded\b|\brealpath\b|\bcommonpath\b|\bresolve\(\)\.startsWith\b|\bprocess\.env\b|\bos\.environ\b|\bgetenv\b|\bENV\s*\[|setObjectInputFilter|ObjectInputFilter/i;
 
 /** Evidence that an XML parser factory has been hardened against XXE. */
 const XXE_GUARD =
@@ -1362,6 +1376,12 @@ export const CODE_RULES: readonly CodeRule[] = [
   // answer. It flagged legitimate merges in Capacitor and in this repo's own
   // web app. `js-prototype-pollution` still catches the explicit `__proto__`
   // literal; the recursive-merge case is left to KNOWN_GAPS.
+
+  // Node-ecosystem classes — vm2, Electron, JWT, archive extraction, headless
+  // browsers — are kept in their own table because each has to know which
+  // package it is looking at before it can claim anything. Folded in here so
+  // there stays exactly one rule list for every consumer to iterate.
+  ...NODE_RULES,
 ];
 
 /**
diff --git a/packages/scan/src/controls.ts b/packages/scan/src/controls.ts
new file mode 100644
index 0000000..1a5c6fd
--- /dev/null
+++ b/packages/scan/src/controls.ts
@@ -0,0 +1,156 @@
+/**
+ * Missing security controls: findings about what is *not* there.
+ *
+ * Every other rule in this package reports a construct it can point at. This
+ * one reports an absence — no rate limiter anywhere in an HTTP service, no
+ * CSRF token, no security headers — which is a different kind of claim and
+ * needs different handling in three ways.
+ *
+ *   **It is whole-project, not per-line.** A rate limiter installed in
+ *   `app.js` protects a route defined in `routes/admin.js`. Any per-file rule
+ *   would report the second file while the first sits three directories away
+ *   with the answer in it. So this accumulates across the whole walk and
+ *   reports once, at the end.
+ *
+ *   **It is weaker evidence.** "We did not see a CSRF token" is not the same
+ *   statement as "we saw a SQL query built by concatenation". The control may
+ *   be installed by a framework, by a reverse proxy, by an API gateway, or by
+ *   a package whose name nobody here has heard of. So these are opt-in — the
+ *   CLI asks for them with `--missing-controls` — and they report at
+ *   confidence `pattern`, which the shared cap in `types.ts` holds at medium.
+ *
+ *   **It needs an applicability test.** "This library has no CSRF protection"
+ *   is not a finding, it is a category error. Nothing is reported unless the
+ *   tree contains something that answers HTTP requests.
+ *
+ * Provenance: the idea of inverting rules to report absent controls is
+ * njsscan's, and the four controls checked here are the ones it covers. The
+ * mechanism is not — njsscan detects controls with its ordinary rule engine
+ * and subtracts the hits afterwards, while this accumulates evidence during
+ * the walk so no file has to be held in memory. Patterns and prose are
+ * original; see the licence note at the top of `node-rules.ts`.
+ */
+
+import type { ScanFinding, Severity } from './types';
+import { severityFor } from './types';
+
+export interface SecurityControl {
+  id: string;
+  title: string;
+  /** What the absence costs. */
+  consequence: string;
+  cwe: string;
+  severity: Severity;
+  /** Anything matching this, anywhere in the tree, counts as installed. */
+  evidence: RegExp;
+}
+
+/**
+ * Evidence that this tree serves HTTP.
+ *
+ * The gate for the whole module. A CLI, a library or a batch job has no
+ * business being told it is missing a CSRF token, and reporting one is the
+ * fastest way to teach an operator that these findings are noise.
+ *
+ * Deliberately narrow: constructing the server, not merely importing
+ * something HTTP-shaped. A build script that requires `express` to type a
+ * config object is not a web service.
+ */
+const SERVER_FRAMEWORK =
+  /\bexpress\s*\(\s*\)|\bnew\s+Koa\s*\(|\bfastify\s*\(|\brequire\s*\(\s*['"](?:express|koa|@hapi\/hapi|restify)['"]\s*\)|\bfrom\s+['"](?:express|koa|@hapi\/hapi|restify)['"]|\bhttp\s*\.\s*createServer\s*\(|\bNestFactory\s*\.\s*create\s*\(/;
+
+export const SECURITY_CONTROLS: readonly SecurityControl[] = [
+  {
+    id: 'control-security-headers-absent',
+    title: 'no security header middleware',
+    consequence:
+      'Without them the browser applies no framing protection, sniffs content types, sends full referrers cross-origin and never learns to require HTTPS — a set of defences that cost one line to enable.',
+    cwe: 'CWE-693',
+    severity: 'medium',
+    evidence:
+      /\bhelmet\b|\bkoa-helmet\b|\b@fastify\/helmet\b|\blusca\b|Strict-Transport-Security|Content-Security-Policy|X-Frame-Options|X-Content-Type-Options/i,
+  },
+  {
+    id: 'control-anti-csrf-absent',
+    title: 'no cross-site request forgery protection',
+    consequence:
+      'A cookie-authenticated endpoint with no token check can be driven by a form on any other site — the browser attaches the session automatically, so the victim only has to visit a page.',
+    cwe: 'CWE-352',
+    severity: 'medium',
+    // SameSite counts. A cookie the browser refuses to send cross-site is not
+    // reachable by the attack this control exists to stop, so a project that
+    // chose that route instead of tokens has the control, not a gap.
+    evidence:
+      /\bcsurf\b|\bcsrf\b|\bxsrf\b|\blusca\b|\b@fastify\/csrf\b|\bdouble-csrf\b|\bsameSite\s*:\s*['"](?:strict|lax)['"]/i,
+  },
+  {
+    id: 'control-rate-limiting-absent',
+    title: 'no request rate limiting',
+    consequence:
+      'Login and password-reset endpoints with no limiter can be tried at the speed of the network — credential stuffing, token brute force and enumeration all become a matter of waiting.',
+    cwe: 'CWE-770',
+    severity: 'medium',
+    evidence:
+      /\bexpress-rate-limit\b|\brateLimit\b|\brate-limiter\b|\bratelimit\b|\bexpress-slow-down\b|\bslowDown\b|\bbottleneck\b|\bthrottle\b/i,
+  },
+  {
+    id: 'control-body-size-limit-absent',
+    title: 'no request body size limit',
+    consequence:
+      'The body is parsed into memory before any handler — and before any authentication check — so unbounded parsing lets a few concurrent requests exhaust the process.',
+    cwe: 'CWE-400',
+    severity: 'medium',
+    evidence: /\blimit\s*:\s*['"]?\d+\s*(?:kb|mb|b)\b|\bbodyLimit\b|\bmaxRequestBodySize\b|\bclient_max_body_size\b/i,
+  },
+];
+
+/**
+ * Accumulates control evidence over a walk, then reports what was never seen.
+ *
+ * Holds four booleans and one path, not the files — a whole-project question
+ * answered without a whole-project buffer, which matters because the walker is
+ * otherwise streaming and a repository can be large.
+ */
+export class ControlAudit {
+  private readonly seen = new Set<string>();
+  /** Where the server is built. Anchors the findings somewhere meaningful. */
+  private serverFile: string | null = null;
+
+  observe(relativePath: string, text: string): void {
+    if (this.serverFile === null && SERVER_FRAMEWORK.test(text)) {
+      this.serverFile = relativePath;
+    }
+    for (const control of SECURITY_CONTROLS) {
+      if (this.seen.has(control.id)) continue;
+      if (control.evidence.test(text)) this.seen.add(control.id);
+    }
+  }
+
+  /** Controls with no evidence anywhere. Empty when the tree serves no HTTP. */
+  missing(): readonly SecurityControl[] {
+    if (this.serverFile === null) return [];
+    return SECURITY_CONTROLS.filter((control) => !this.seen.has(control.id));
+  }
+
+  findings(): ScanFinding[] {
+    const anchor = this.serverFile;
+    if (anchor === null) return [];
+
+    return this.missing().map((control) => ({
+      ruleId: control.id,
+      title: control.title,
+      file: anchor,
+      line: 1,
+      // `pattern` is doing real work here: it caps the severity, and it says
+      // in the report itself how much the scanner is claiming. An absence is
+      // never `evidence`.
+      severity: severityFor(control.severity, 'pattern'),
+      confidence: 'pattern' as const,
+      message: `${control.title} — no evidence of one anywhere in the scanned tree (${control.cwe})`,
+      consequence: control.consequence,
+      cwe: control.cwe,
+      excerpt: '',
+      category: 'code' as const,
+    }));
+  }
+}
diff --git a/packages/scan/src/index.ts b/packages/scan/src/index.ts
index 6ef6299..be92786 100644
--- a/packages/scan/src/index.ts
+++ b/packages/scan/src/index.ts
@@ -14,6 +14,14 @@
 export { CODE_RULES, evaluateRule, GENERIC_GUARD, proseLines, untrustedPatternFor } from './code-rules';
 export type { CodeRule } from './code-rules';
 
+export { NODE_RULES } from './node-rules';
+
+export { evaluateTemplateRules, TEMPLATE_EXTENSIONS, TEMPLATE_RULES } from './template-rules';
+export type { TemplateMatch, TemplateRule } from './template-rules';
+
+export { ControlAudit, SECURITY_CONTROLS } from './controls';
+export type { SecurityControl } from './controls';
+
 export { scanPackageJson, scanRequirementsTxt, detectTyposquat, editDistance } from './manifest-rules';
 export type { ManifestFinding, SquatVerdict } from './manifest-rules';
 
diff --git a/packages/scan/src/node-rules.ts b/packages/scan/src/node-rules.ts
new file mode 100644
index 0000000..c891946
--- /dev/null
+++ b/packages/scan/src/node-rules.ts
@@ -0,0 +1,516 @@
+/**
+ * Node.js-specific vulnerability rules.
+ *
+ * Why this file exists
+ * --------------------
+ * `code-rules.ts` is deliberately cross-language: SQL injection, path
+ * traversal and weak hashing look much the same in six languages, so one rule
+ * covers all of them. That breadth is also its limit. A whole set of classes
+ * only exist inside the Node ecosystem — `vm2` sandbox escapes, Electron's
+ * renderer settings, `node-serialize`'s function-executing deserialiser, JWT's
+ * `none` algorithm, headless-browser navigation — and each one needs to know
+ * which package it is looking at before it can say anything useful.
+ *
+ * Those live here, evaluated by the same engine and obeying the same
+ * confidence model. Splitting them out keeps the cross-language table readable
+ * and gives the ecosystem-specific rules one place to document their
+ * preconditions.
+ *
+ * Provenance and licence
+ * ----------------------
+ * The *list of classes* covered here was drawn up by reading what njsscan
+ * (github.com/ajinabraham/njsscan) reports on, to close a coverage gap against
+ * an established Node scanner. Nothing was copied. njsscan is LGPL-3.0 and
+ * this package is MIT, so its rule definitions could not be reused even in
+ * translation; a set of vulnerability class names is a fact about the
+ * ecosystem, not an expression of it. Every pattern, guard, title and
+ * consequence below was written from scratch against this engine's semantics,
+ * which are not njsscan's — it delegates to semgrep for AST matching, while
+ * these are line-oriented regexes with guard windows and a severity cap.
+ *
+ * That difference shapes the rules. Where njsscan can write "this call, inside
+ * a file that imported this module, not wrapped in an escaper", the closest
+ * honest equivalent here is `fileRequires` for the import plus a narrow
+ * pattern. Classes that genuinely need AST scope — entity-expansion limits,
+ * taint through a router — are absent rather than approximated. See KNOWN_GAPS
+ * at the foot of this file.
+ */
+
+import type { CodeRule } from './code-rules';
+
+/**
+ * A path is being assembled with containment already checked.
+ *
+ * Zip-slip is the one class in this file where the safe and unsafe forms are
+ * the *same call* — `join(dest, entry.fileName)` — distinguished only by
+ * whether the result is verified to stay under `dest`. So the guard has to
+ * recognise containment checks specifically, which the generic guard does not:
+ * a bare `startsWith` is too weak a signal to exonerate arbitrary rules, but
+ * next to a path join it is exactly the check that matters.
+ */
+const PATH_CONTAINMENT_GUARD =
+  /\bstartsWith\s*\(|\brelative\s*\(|\bnormalize\s*\(|\brealpath\b|\bisInside\b|\bwithin\s*\(|\bsanitiz\w*\b/i;
+
+/** Packages whose archive entries carry an attacker-chosen path. */
+const ARCHIVE_LIBRARY =
+  /\b(?:adm-zip|unzipper|yauzl|node-stream-zip|extract-zip|decompress|tar-stream|tar-fs)\b|require\s*\(\s*['"]tar['"]|from\s+['"]tar['"]/;
+
+/** Packages that drive a real browser, where a URL becomes a request from the server. */
+const HEADLESS_BROWSER =
+  /\b(?:puppeteer|playwright|phantom|phantomjs|wkhtmltopdf|wkhtmltoimage|chrome-aws-lambda|html-pdf)\b/;
+
+/**
+ * Evidence that a reflected origin was checked before being echoed.
+ *
+ * This rule cannot use the generic guard, and the reason is worth recording.
+ * `Access-Control-Allow-Origin` contains the word "Allow"; the generic guard's
+ * allow-list heuristic is case-insensitive and accepts a following `-`, so the
+ * *header name itself* matched it. The rule was silently unable to ever fire —
+ * it did not report fewer findings, it reported none, and only a failing test
+ * distinguished that from "no vulnerable code here".
+ *
+ * What genuinely exonerates a reflected origin is a membership test on the
+ * value, which is also the shape of the one correct implementation.
+ */
+const ORIGIN_ALLOWLIST_GUARD = /\b(?:includes|indexOf|has|test|find|some)\s*\(/;
+
+/** Deserialisers that reconstruct functions, not just data. */
+const FUNCTION_DESERIALIZER = /\b(?:node-serialize|serialize-to-js|funcster|cryo)\b/;
+
+/**
+ * A string literal being concatenated onto — either quote style, separately.
+ *
+ * One character class cannot do this. The interesting strings are the ones
+ * containing the *other* quote:
+ *
+ *     "this.name === '" + name + "'"
+ *     "//user[@id='" + id + "']"
+ *
+ * A combined `['"][^'"]*['"]` class stops dead at that inner quote and matches
+ * nothing, which silently drops the most common injection shape. `code-rules.ts`
+ * hit this with SQL and split the class per quote character; the same split is
+ * needed everywhere a rule looks for assembled strings, so it lives here once.
+ */
+const CONCATENATED_STRING = String.raw`(?:"[^"\n]*"|'[^'\n]*')\s*\+`;
+
+// A template literal with at least one interpolation. Written as a quoted
+// string rather than with `String.raw`, because the pattern has to contain a
+// backtick and a raw template literal cannot hold one unescaped.
+const INTERPOLATED_TEMPLATE = '`[^`\\n]*\\$\\{';
+
+export const NODE_RULES: readonly CodeRule[] = [
+  // ── Code execution ───────────────────────────────────────────────────────
+  {
+    id: 'js-vm-untrusted-execution',
+    title: 'script compiled and run by the `vm` module',
+    consequence:
+      'Node’s `vm` is not a security boundary — it isolates globals, not the process. Code reaching it can walk back out through any object it is handed and runs with the server’s full privileges.',
+    cwe: 'CWE-94',
+    severity: 'critical',
+    languages: ['javascript', 'typescript'],
+    pattern:
+      /\bvm\s*\.\s*(?:runInNewContext|runInThisContext|runInContext|compileFunction)\s*\(|\bnew\s+vm\s*\.\s*Script\s*\(/,
+    // A `vm` call whose source is a build-time constant is a plugin loader, not
+    // a vulnerability. The class only becomes real once the script text can be
+    // influenced, so require that evidence before reporting at full severity.
+    needsContext: true,
+  },
+  {
+    id: 'js-vm2-sandbox',
+    title: '`vm2` used as a sandbox',
+    consequence:
+      'vm2 was discontinued after a series of escapes that its maintainer judged unfixable by design. Any code it runs should be assumed to run on the host.',
+    cwe: 'CWE-1104',
+    severity: 'high',
+    languages: ['javascript', 'typescript'],
+    pattern: /\bnew\s+(?:NodeVM|VMScript)\s*\(|\bfrom\s+['"]vm2['"]|require\s*\(\s*['"]vm2['"]\s*\)/,
+    // Nothing on the surrounding lines changes the answer: the package itself
+    // is the finding, the same way a broken cipher is.
+    inherent: true,
+  },
+  {
+    id: 'js-function-deserialization',
+    title: 'deserialiser that reconstructs functions',
+    consequence:
+      'These formats encode functions alongside data and invoke them on load, so parsing an attacker’s payload is executing it. No amount of validation after the parse call helps — the code has already run.',
+    cwe: 'CWE-502',
+    severity: 'critical',
+    languages: ['javascript', 'typescript'],
+    pattern: /\b(?:unserialize|deepDeserialize|deserialize)\s*\(/,
+    // Without this the rule fires on every project that happens to own a
+    // function called `deserialize`, which is most of them. The import is what
+    // makes the call the dangerous one.
+    fileRequires: FUNCTION_DESERIALIZER,
+    // The parse *is* the execution, so nearby input cannot make it worse and
+    // its absence cannot make it safe. Nobody round-trips a constant through
+    // these libraries.
+    inherent: true,
+  },
+  {
+    id: 'js-template-injection',
+    title: 'template compiled from a non-constant source',
+    consequence:
+      'Template languages are programming languages. A user-supplied template body is remote code execution, not cross-site scripting — the expression runs on the server before any output is escaped.',
+    cwe: 'CWE-1336',
+    severity: 'critical',
+    languages: ['javascript', 'typescript'],
+    pattern:
+      /\b(?:handlebars|Handlebars|hbs|ejs|pug|jade|nunjucks|eta|twig|dot|doT|liquid|mustache)\s*\.\s*(?:compile|compileFile|render|renderString)\s*\(\s*(?:`[^`\n]*\$\{|[a-zA-Z_$][\w$.]*\s*[,)]|[a-zA-Z_$][\w$.]*\s*\+)/,
+    // Rendering a template held in a variable is the normal case — it was read
+    // from a file at boot. Only the version where request data reaches the
+    // template *body* is this class.
+    needsContext: true,
+  },
+  {
+    id: 'js-shelljs-command-execution',
+    title: 'shelljs command assembled from a string',
+    consequence:
+      '`shell.exec` runs its argument through a shell, so a `;` or backtick in an interpolated value runs as the server user.',
+    cwe: 'CWE-78',
+    severity: 'critical',
+    languages: ['javascript', 'typescript'],
+    pattern: new RegExp(
+      `\\b(?:shell|shelljs|sh)\\s*\\.\\s*exec\\s*\\(\\s*(?:${INTERPOLATED_TEMPLATE}|${CONCATENATED_STRING}|[a-zA-Z_$][\\w$]*\\s*\\+)`,
+    ),
+    fileRequires: /\bshelljs\b/,
+  },
+
+  // ── Injection ────────────────────────────────────────────────────────────
+  {
+    id: 'js-nosql-where-expression',
+    title: 'MongoDB `$where` built by string assembly',
+    consequence:
+      '`$where` is evaluated as JavaScript by the database server, once per document. An interpolated value can rewrite the predicate to `true` or run a denial-of-service loop inside the database.',
+    cwe: 'CWE-943',
+    severity: 'critical',
+    languages: ['javascript', 'typescript'],
+    pattern: new RegExp(
+      `\\$where\\s*['"]?\\s*:\\s*(?:${INTERPOLATED_TEMPLATE}|${CONCATENATED_STRING})` +
+        `|\\.\\s*\\$where\\s*=\\s*(?:${INTERPOLATED_TEMPLATE}|${CONCATENATED_STRING})`,
+    ),
+  },
+  {
+    id: 'js-xpath-injection',
+    title: 'XPath expression built by concatenation',
+    consequence:
+      'A quote in the interpolated value closes the predicate early, so the query selects nodes the caller was never meant to read — the XML equivalent of `OR 1=1`.',
+    cwe: 'CWE-643',
+    severity: 'high',
+    languages: ['javascript', 'typescript'],
+    // An XPath expression is recognisable by its own syntax — a descendant
+    // axis or an attribute predicate. Matching on the *call* name alone would
+    // flag every `select(` in the ecosystem. The quoted forms are split per
+    // quote character for the reason given at CONCATENATED_STRING: the
+    // predicate that makes it XPath usually contains the other quote.
+    pattern: new RegExp(
+      '\\b(?:xpath|xpathSelect|select|selectNodes|selectSingleNode|evaluate|find)\\s*\\(\\s*(?:' +
+        '`[^`\\n]*(?:\\/\\/|\\[@)[^`\\n]*\\$\\{' +
+        '|"[^"\\n]*(?:\\/\\/|\\[@)[^"\\n]*"\\s*\\+' +
+        "|'[^'\\n]*(?:\\/\\/|\\[@)[^'\\n]*'\\s*\\+" +
+        ')',
+    ),
+    fileRequires: /\bxpath\b|\bxmldom\b|\blibxmljs\b|\bxpath\.js\b/,
+  },
+  {
+    id: 'js-regex-from-input',
+    title: 'regular expression compiled from a variable',
+    consequence:
+      'A caller who controls the pattern controls the matcher: they can supply catastrophic backtracking to hang the event loop, or a permissive pattern that defeats whatever the regex was validating.',
+    cwe: 'CWE-1333',
+    severity: 'medium',
+    languages: ['javascript', 'typescript'],
+    pattern: new RegExp(
+      `\\bnew\\s+RegExp\\s*\\(\\s*(?:${INTERPOLATED_TEMPLATE}|${CONCATENATED_STRING}|(?!['"\`/])[a-zA-Z_$][\\w$.]*\\s*[,)])`,
+    ),
+    needsContext: true,
+  },
+
+  // ── XML ──────────────────────────────────────────────────────────────────
+  {
+    id: 'js-xml-external-entities',
+    title: 'XML parser configured to resolve entities',
+    consequence:
+      'An entity declaration in the document body makes the parser fetch a local file or an internal URL and paste the result into the parsed output — file disclosure and server-side request forgery from a document upload.',
+    cwe: 'CWE-611',
+    severity: 'high',
+    languages: ['javascript', 'typescript'],
+    // The option name is the finding. Every parser in the ecosystem defaults
+    // these off, so an explicit `true` is a deliberate re-enable.
+    pattern: /\b(?:noent|resolveEntities|expandEntities|externalEntities|resolveExternals)\s*:\s*(?:true|1)\b/,
+    inherent: true,
+  },
+
+  // ── Authentication and tokens ────────────────────────────────────────────
+  {
+    id: 'js-jwt-none-algorithm',
+    title: 'JWT algorithm set to `none`',
+    consequence:
+      'The `none` algorithm means the signature is not checked. Anyone can mint a token with any claims — including another user’s id or an admin role — by base64-encoding a header and a body.',
+    cwe: 'CWE-347',
+    severity: 'critical',
+    languages: ['javascript', 'typescript'],
+    pattern: /\balgorithms?\s*:\s*\[?\s*['"]none['"]/i,
+    inherent: true,
+  },
+
+  // ── Cryptography ─────────────────────────────────────────────────────────
+  {
+    id: 'js-broken-cipher-algorithm',
+    title: 'broken cipher selected',
+    consequence:
+      'DES, 3DES, RC2, RC4, Blowfish and IDEA are all breakable with commodity hardware or have practical plaintext-recovery attacks. Data encrypted with them should be treated as encoded, not encrypted.',
+    cwe: 'CWE-327',
+    severity: 'high',
+    languages: ['javascript', 'typescript'],
+    pattern:
+      /\bcreate(?:Cipher|Decipher)(?:iv)?\s*\(\s*['"](?:des|des3|des-ede\w*|3des|rc2|rc4|bf|blowfish|cast5?|idea|seed)\b/i,
+    inherent: true,
+  },
+  {
+    id: 'js-ecb-mode-cipher',
+    title: 'block cipher in ECB mode',
+    consequence:
+      'ECB encrypts every block independently, so identical plaintext blocks produce identical ciphertext. Structure in the data survives encryption and blocks can be reordered or replayed without detection.',
+    cwe: 'CWE-327',
+    severity: 'high',
+    languages: ['javascript', 'typescript'],
+    pattern: /\bcreate(?:Cipher|Decipher)(?:iv)?\s*\(\s*['"][^'"\n]*-ecb\b/i,
+    inherent: true,
+  },
+  {
+    id: 'js-legacy-cipher-api',
+    title: 'deprecated `createCipher` used',
+    consequence:
+      '`createCipher` derives the key from a passphrase with a single unsalted MD5 pass and uses a fixed all-zero IV, so the same passphrase always produces the same keystream. It was removed in Node 22.',
+    cwe: 'CWE-327',
+    severity: 'high',
+    languages: ['javascript', 'typescript'],
+    // `createCipheriv` is the correct API and shares the prefix, so the
+    // negative look-ahead is what separates the finding from the fix.
+    pattern: /\bcrypto\s*\.\s*create(?:Cipher|Decipher)\s*\(/,
+    lineGuard: /create(?:Cipher|Decipher)iv\s*\(/,
+    inherent: true,
+  },
+
+  // ── Cross-site scripting ─────────────────────────────────────────────────
+  {
+    id: 'js-template-autoescape-disabled',
+    title: 'template auto-escaping turned off',
+    consequence:
+      'Auto-escaping is the control that makes a template engine safe by default. Disabling it globally means every interpolation in every template becomes an injection point, including ones written later by someone who assumed the default.',
+    cwe: 'CWE-79',
+    severity: 'high',
+    languages: ['javascript', 'typescript'],
+    pattern: /\bautoescape\s*:\s*false\b|\bescape\s*:\s*false\b|\bnoEscape\s*:\s*true\b/,
+    inherent: true,
+  },
+  {
+    id: 'js-serialize-javascript-unsafe',
+    title: '`serialize-javascript` in unsafe mode',
+    consequence:
+      'The `unsafe` flag turns off escaping of HTML-significant characters in the output. Embedding the result in a `<script>` block lets a string value close the tag and start a new one.',
+    cwe: 'CWE-79',
+    severity: 'high',
+    languages: ['javascript', 'typescript'],
+    pattern: /\bunsafe\s*:\s*true\b/,
+    fileRequires: /\bserialize-javascript\b/,
+    inherent: true,
+  },
+  {
+    id: 'js-cors-origin-reflected',
+    title: 'CORS origin reflected from the request',
+    consequence:
+      'Echoing the caller’s `Origin` header back as `Access-Control-Allow-Origin` allows every site, while looking like an allow-list. Combined with credentials, any page the victim visits can read their authenticated responses.',
+    cwe: 'CWE-942',
+    severity: 'high',
+    languages: ['javascript', 'typescript'],
+    // Both spellings of the same mistake: writing the header directly, and
+    // handing the request's origin to a CORS middleware's `origin` option.
+    //
+    // An earlier draft also matched a bare variable — `setHeader('…', origin)`
+    // — which is wrong. A variable holding a *validated* origin is exactly
+    // what the correct implementation looks like, and the rule cannot tell the
+    // two apart. Only the visible read from the request qualifies.
+    pattern:
+      /\bAccess-Control-Allow-Origin['"]\s*,\s*(?:req|request|ctx)\s*\.|\borigin\s*:\s*(?:req|request|ctx)\s*\./,
+    // Reflecting the header is the defect whatever surrounds it; there is no
+    // arrangement of nearby lines that makes an echoed origin safe — except a
+    // membership test on the value, which is what the guard looks for.
+    inherent: true,
+    guard: ORIGIN_ALLOWLIST_GUARD,
+  },
+
+  // ── Server-side request forgery ──────────────────────────────────────────
+  {
+    id: 'js-headless-browser-navigation',
+    title: 'headless browser sent to a non-constant URL',
+    consequence:
+      'The browser runs on the server, inside the private network. A controlled URL reaches the cloud metadata endpoint, localhost admin panels and internal services — and `file://` reads the disk.',
+    cwe: 'CWE-918',
+    severity: 'high',
+    languages: ['javascript', 'typescript'],
+    pattern:
+      /\.\s*(?:goto|setContent|navigate)\s*\(\s*(?:`[^`\n]*\$\{|(?!['"`])[a-zA-Z_$][\w$.]*\s*[,)])/,
+    fileRequires: HEADLESS_BROWSER,
+    needsContext: true,
+  },
+
+  // ── Path handling ────────────────────────────────────────────────────────
+  {
+    id: 'js-archive-entry-path',
+    title: 'archive entry written to a path built from its own name',
+    consequence:
+      'An entry named `../../etc/cron.d/x` escapes the extraction directory when its name is joined to the destination. Overwriting a file outside the target — a systemd unit, an SSH key, a deployed script — is code execution on the next run.',
+    cwe: 'CWE-22',
+    severity: 'high',
+    languages: ['javascript', 'typescript'],
+    pattern:
+      /\b(?:join|resolve)\s*\(\s*[^,\n)]+,\s*[a-zA-Z_$][\w$]*\s*\.\s*(?:entryName|fileName|filename|name|path)\b/,
+    fileRequires: ARCHIVE_LIBRARY,
+    guard: PATH_CONTAINMENT_GUARD,
+    // The containment check comes *after* the join — you build the path, then
+    // verify it stayed inside. A backwards-only window would miss every
+    // correct implementation and report the safe code alongside the unsafe.
+    guardForward: 3,
+  },
+
+  // ── Electron ─────────────────────────────────────────────────────────────
+  {
+    id: 'js-electron-node-integration',
+    title: 'Electron renderer given Node access',
+    consequence:
+      'With node integration on — or context isolation off — any script that reaches the page reaches `require`. A single XSS in rendered content becomes `child_process.exec` on the user’s machine.',
+    cwe: 'CWE-1188',
+    severity: 'high',
+    languages: ['javascript', 'typescript'],
+    pattern:
+      /\bnodeIntegration(?:InWorker|InSubFrames)?\s*:\s*true\b|\bcontextIsolation\s*:\s*false\b|\benableRemoteModule\s*:\s*true\b|\bsandbox\s*:\s*false\b/,
+    inherent: true,
+  },
+  {
+    id: 'js-electron-web-security-disabled',
+    title: 'Electron web security disabled',
+    consequence:
+      'Turning off `webSecurity` drops the same-origin policy for the window, so remote content can read local files and every other origin the app has loaded.',
+    cwe: 'CWE-1173',
+    severity: 'high',
+    languages: ['javascript', 'typescript'],
+    pattern: /\bwebSecurity\s*:\s*false\b|\ballowRunningInsecureContent\s*:\s*true\b|\bwebviewTag\s*:\s*true\b/,
+    inherent: true,
+  },
+  {
+    id: 'js-electron-open-external',
+    title: 'Electron `openExternal` with a non-constant URL',
+    consequence:
+      '`shell.openExternal` hands the string to the operating system’s handler. A `file://` path executes a local binary and, on Windows, an SMB path executes a remote one.',
+    cwe: 'CWE-749',
+    severity: 'high',
+    languages: ['javascript', 'typescript'],
+    pattern: /\bshell\s*\.\s*openExternal\s*\(\s*(?:`[^`\n]*\$\{|(?!['"`])[a-zA-Z_$][\w$.]*\s*[,)])/,
+    needsContext: true,
+  },
+
+  // ── Hardening and resource limits ────────────────────────────────────────
+  {
+    id: 'js-helmet-protection-disabled',
+    title: 'security header explicitly disabled',
+    consequence:
+      'Each of these switches off a browser-side protection that was already on. The header stops being sent, so the defence it enables — framing, sniffing, referrer leakage, transport downgrade — is available to an attacker again.',
+    cwe: 'CWE-693',
+    severity: 'medium',
+    languages: ['javascript', 'typescript'],
+    pattern:
+      /\b(?:contentSecurityPolicy|frameguard|hsts|noSniff|xssFilter|hidePoweredBy|referrerPolicy|dnsPrefetchControl|ieNoOpen|permittedCrossDomainPolicies|crossOriginEmbedderPolicy|crossOriginOpenerPolicy|crossOriginResourcePolicy|originAgentCluster)\s*:\s*false\b/,
+    inherent: true,
+  },
+  {
+    id: 'js-buffer-bounds-check-disabled',
+    title: 'buffer bounds checking turned off',
+    consequence:
+      'With `noAssert` the read or write is not range-checked, so an offset past the end of the buffer returns adjacent heap memory or corrupts it instead of throwing.',
+    cwe: 'CWE-125',
+    severity: 'medium',
+    languages: ['javascript', 'typescript'],
+    // The trailing `true` on a Buffer numeric accessor *is* `noAssert` — it is
+    // the last positional parameter of every one of these methods. Anchoring
+    // on the accessor name is what keeps this from matching `, true)` on any
+    // call in the codebase.
+    pattern:
+      /\b(?:read|write)(?:U?Int(?:8|16|32)(?:[BL]E)?|U?Int[BL]E|Float[BL]E|Double[BL]E)\s*\([^)\n]*,\s*true\s*\)|\bnoAssert\s*:\s*true\b/,
+    inherent: true,
+  },
+  {
+    id: 'js-uninitialized-buffer',
+    title: 'buffer allocated without zeroing',
+    consequence:
+      '`allocUnsafe` and the old `new Buffer(size)` hand back whatever was previously in that heap memory — keys, session tokens, other users’ request bodies. Anything not overwritten before the buffer is sent leaks it.',
+    cwe: 'CWE-908',
+    severity: 'medium',
+    languages: ['javascript', 'typescript'],
+    pattern: /\bBuffer\s*\.\s*allocUnsafe(?:Slow)?\s*\(|\bnew\s+Buffer\s*\(\s*(?![`'"])[a-zA-Z_$0-9]/,
+    inherent: true,
+  },
+  {
+    id: 'js-oversized-request-body-limit',
+    title: 'request body limit raised to a very large value',
+    consequence:
+      'A body limit in the tens of megabytes lets a handful of concurrent requests exhaust memory, and the parse happens before any authentication check the route performs.',
+    cwe: 'CWE-400',
+    severity: 'medium',
+    languages: ['javascript', 'typescript'],
+    // Two or more digits before `mb` — 50mb and up. A limit is a *good* thing;
+    // only an ineffective one is the finding.
+    pattern: /\blimit\s*:\s*['"]\s*(?:[5-9]\d|\d{3,})\s*mb\s*['"]|\blimit\s*:\s*['"]\s*\d+\s*gb\s*['"]/i,
+    inherent: true,
+  },
+
+  // ── Information disclosure ───────────────────────────────────────────────
+  {
+    id: 'js-error-detail-returned',
+    title: 'error object or stack trace sent to the client',
+    consequence:
+      'A stack trace names absolute paths, package versions and internal function names, and framework errors often carry the failing query or connection string with them. It is a map of the server, handed out on request.',
+    cwe: 'CWE-209',
+    severity: 'medium',
+    languages: ['javascript', 'typescript'],
+    // `res.status(500).send(…)` is the overwhelmingly common spelling, so the
+    // optional `.status(…)` hop is not a nicety — without it the rule misses
+    // nearly every real occurrence.
+    pattern:
+      /\bres\s*\.\s*(?:status\s*\([^)\n]*\)\s*\.\s*)?(?:send|json|end|write)\s*\(\s*(?:[a-zA-Z_$][\w$]*\s*\.\s*stack\b|(?:error|err|e)\s*[,)])|\.\s*(?:send|json)\s*\(\s*\{[^}\n]*\b(?:stack|err|error)\s*:\s*(?:error|err|e)\s*[,}]/,
+    inherent: true,
+  },
+];
+
+/**
+ * KNOWN_GAPS — Node classes deliberately not implemented here.
+ *
+ * Each of these needs analysis this engine does not do, and the regex that
+ * would approximate it fires on ordinary code often enough to make the whole
+ * rule set less useful. They are listed rather than silently omitted so the
+ * next person does not have to rediscover why.
+ *
+ *   XML entity-expansion DoS (CWE-776)
+ *     The defect is the *absence* of an expansion limit, which is a property
+ *     of parser configuration spread across a file, not a line.
+ *
+ *   Missing anti-CSRF, rate limiting, security headers (CWE-352, CWE-770)
+ *     Also absence-of-evidence, and genuinely whole-project. Handled instead
+ *     by `controls.ts`, which accumulates across the walk and reports once —
+ *     and only when asked, because a missing control is a weaker claim than a
+ *     present defect.
+ *
+ *   JWT tokens not revocable, sensitive claims in the payload
+ *     Requires knowing what a claim means. `{ ssn: user.ssn }` and
+ *     `{ sub: user.id }` are the same shape.
+ *
+ *   Prototype-pollution gadget chains
+ *     The direct assignment forms are covered by `js-prototype-pollution` in
+ *     the cross-language table. Reaching a gadget through a merge helper needs
+ *     interprocedural reasoning.
+ *
+ *   Sequelize / driver TLS options
+ *     `rejectUnauthorized: false` is already reported by
+ *     `tls-verification-disabled`, which is language-agnostic and catches it
+ *     wherever it appears. A driver-specific duplicate would double-report.
+ */
diff --git a/packages/scan/src/node/walk.ts b/packages/scan/src/node/walk.ts
index 2a9fe16..eecc667 100644
--- a/packages/scan/src/node/walk.ts
+++ b/packages/scan/src/node/walk.ts
@@ -12,6 +12,7 @@ import {
   closeSync, fstatSync, openSync, readdirSync, readFileSync, readSync, statSync,
 } from 'node:fs';
 import { basename, dirname, extname, join, relative, sep } from 'node:path';
+import { ControlAudit } from '../controls';
 import { SENSITIVE_FILES } from '../secret-rules';
 import {
   collectSuppressions,
@@ -45,6 +46,14 @@ export interface ScanOptions {
    * broad glob cannot be mistaken for a clean one.
    */
   exclude?: readonly string[];
+  /**
+   * Also report security controls the tree has no evidence of.
+   *
+   * Opt-in, because an absence is a weaker claim than a present defect and
+   * this one is answered from the whole tree rather than from a line — see
+   * `../controls.ts`. Silently produces nothing when the tree serves no HTTP.
+   */
+  missingControls?: boolean;
 }
 
 /**
@@ -213,6 +222,7 @@ export function scanPath(targetPath: string, options: ScanOptions = {}): ScanRep
   const maxFileBytes = options.maxFileBytes ?? 1024 * 1024;
   const allowed = options.categories ? new Set(options.categories) : null;
   const findings: ScanFinding[] = [];
+  const controls = new ControlAudit();
   const unreadable: string[] = [];
   let filesScanned = 0;
   let suppressed = 0;
@@ -306,6 +316,11 @@ export function scanPath(targetPath: string, options: ScanOptions = {}): ScanRep
     options.onFile?.(relativePath);
     suppressed += collectSuppressions(text.split('\n')).count;
 
+    // Observed before the per-file rules run, and unconditionally: the audit
+    // keeps four booleans, so the cost of always collecting is nil, and
+    // gating it on the option would make the evidence depend on flag order.
+    controls.observe(relativePath, text);
+
     const fileFindings = [
       ...scanText(relativePath, text, declared ?? languageOf(filename)),
       ...(isManifest ? scanManifest(relativePath, filename, text) : []),
@@ -357,6 +372,10 @@ export function scanPath(targetPath: string, options: ScanOptions = {}): ScanRep
     scanFile(targetPath, basename(targetPath));
   }
 
+  // After the walk, because the question is "anywhere in this tree" and only
+  // the last file can settle it.
+  if (options.missingControls) findings.push(...controls.findings());
+
   const filtered = allowed ? findings.filter((f) => allowed.has(f.category)) : findings;
   filtered.sort(
     (a, b) =>
diff --git a/packages/scan/src/template-rules.ts b/packages/scan/src/template-rules.ts
new file mode 100644
index 0000000..9dc8b8a
--- /dev/null
+++ b/packages/scan/src/template-rules.ts
@@ -0,0 +1,208 @@
+/**
+ * Template-file rules: unescaped output, per engine.
+ *
+ * Why this is a separate engine
+ * -----------------------------
+ * `code-rules.ts` reasons about source code — it knows what a call looks like,
+ * what a string literal looks like, and which identifiers carry request data.
+ * A Handlebars file has none of that. It is markup with holes in it, and the
+ * only security question worth asking is which holes skip escaping.
+ *
+ * That question is answered by *syntax*, and every engine spells it
+ * differently: Handlebars has a triple-stache, Pug prefixes with `!`, EJS uses
+ * a different tag character from the one that escapes, Dust hangs an `|s`
+ * filter on the end. So a template rule is selected by file extension rather
+ * than by language — the extension is what identifies the engine, and nothing
+ * inside the file reliably does.
+ *
+ * Extension, not language, for a second reason: `.vue` and `.ejs` are already
+ * mapped to `javascript` so their `<script>` halves get the full code rule
+ * set. Remapping them to a `template` language to reach these rules would take
+ * that away. Running the two engines over the same file, keyed differently, is
+ * what njsscan does as well, and for the same reason.
+ *
+ * What these rules claim
+ * ----------------------
+ * Only that the interpolation does not escape. Not that the value is
+ * attacker-controlled — a template cannot show that, and the variable is very
+ * often a CMS body that was sanitised on the way in, which is the legitimate
+ * reason to reach for unescaped output at all.
+ *
+ * So every rule here reports at confidence `pattern`, which the shared cap in
+ * `types.ts` holds at `medium` however high the rule declares itself. That is
+ * the honest ceiling for "this line opts out of the engine's escaping" with no
+ * further evidence, and it keeps a template-heavy repository from filling a
+ * report with `high` findings that nobody can triage.
+ *
+ * Provenance: the set of engines covered was chosen by looking at what njsscan
+ * (LGPL-3.0) reports on, so this MIT package would not have a blind spot an
+ * established Node scanner covers. The patterns, guards and prose are written
+ * from scratch — see the note at the top of `node-rules.ts`.
+ */
+
+import type { Severity } from './types';
+import { severityFor } from './types';
+
+export interface TemplateRule {
+  id: string;
+  title: string;
+  consequence: string;
+  cwe: string;
+  severity: Severity;
+  /** Extensions this engine owns, lowercase and dot-prefixed. */
+  extensions: readonly string[];
+  pattern: RegExp;
+  /** Evidence on the matched line that this occurrence is not user data. */
+  lineGuard?: RegExp;
+}
+
+/**
+ * The layout slot, which is not a variable.
+ *
+ * `{{{body}}}` in a Handlebars layout is where the rendered child template is
+ * spliced in — it is unescaped because it is already HTML, by design, and
+ * every project using layouts has exactly one. Reporting it means every
+ * express-handlebars app opens its report with a false positive.
+ */
+const LAYOUT_SLOT = /\{\{\{\s*(?:body|content|outlet|children)\s*\}\}\}/;
+
+const XSS_CONSEQUENCE =
+  'The value is written into the page as markup rather than as text, so a `<script>` or an `onerror=` attribute in it executes in the visitor’s session — with their cookies, and their privileges.';
+
+export const TEMPLATE_RULES: readonly TemplateRule[] = [
+  {
+    id: 'tpl-handlebars-unescaped',
+    title: 'Handlebars/Mustache interpolation that skips escaping',
+    consequence: XSS_CONSEQUENCE,
+    cwe: 'CWE-79',
+    severity: 'high',
+    extensions: ['.hbs', '.handlebars', '.hdbs', '.mustache', '.ms'],
+    // Two spellings of the same opt-out: the triple-stache and the `&` prefix.
+    pattern: /\{\{\{(?!\{)[^}]*\}\}\}|\{\{\s*&\s*[^}]+\}\}/,
+    lineGuard: LAYOUT_SLOT,
+  },
+  {
+    id: 'tpl-vue-v-html',
+    title: '`v-html` binding',
+    consequence: XSS_CONSEQUENCE,
+    cwe: 'CWE-79',
+    severity: 'high',
+    extensions: ['.vue', '.html', '.htm'],
+    pattern: /\bv-html\s*=|\s:inner-html\.prop\s*=/,
+  },
+  {
+    id: 'tpl-pug-unescaped',
+    title: 'Pug/Jade unescaped interpolation',
+    consequence: XSS_CONSEQUENCE,
+    cwe: 'CWE-79',
+    severity: 'high',
+    extensions: ['.pug', '.jade'],
+    // `!{…}` is unescaped interpolation anywhere on the line. `!=` is
+    // unescaped buffered code, but only in the tag position — anchored to the
+    // start of the line and preceded by nothing but tag, class and id
+    // characters, so the `!==` inside `- if (a !== b)` cannot reach it.
+    pattern: /!\{[^}\n]*\}|^\s*[\w.#%-]*!=(?!=)\s*\S/,
+  },
+  {
+    id: 'tpl-ejs-raw-output',
+    title: 'EJS/ECT raw output tag',
+    consequence: XSS_CONSEQUENCE,
+    cwe: 'CWE-79',
+    severity: 'high',
+    extensions: ['.ejs', '.ect'],
+    // In EJS `<%= %>` escapes and `<%-` does not, which is the reverse of
+    // Underscore's convention — see KNOWN_GAPS.
+    pattern: /<%-(?!\s*(?:include|-))/,
+    // `<%- include('partial') %>` splices another template, not user data.
+    lineGuard: /<%-\s*(?:include|partial)\s*\(/,
+  },
+  {
+    id: 'tpl-dust-escape-filter-off',
+    title: 'Dust reference with escaping suppressed',
+    consequence: XSS_CONSEQUENCE,
+    cwe: 'CWE-79',
+    severity: 'high',
+    extensions: ['.dust', '.tl'],
+    // The `|s` filter means "suppress the default HTML escape".
+    pattern: /\{[^{}\n]+\|\s*s\s*\}/,
+  },
+  {
+    id: 'tpl-jinja-safe-filter',
+    title: 'Nunjucks/Twig/Jinja `safe` filter or autoescape block off',
+    consequence: XSS_CONSEQUENCE,
+    cwe: 'CWE-79',
+    severity: 'high',
+    extensions: ['.njk', '.nunjucks', '.twig', '.jinja', '.jinja2', '.j2'],
+    pattern: /\|\s*(?:safe|raw)\s*(?:\}\}|\|)|\{%\s*autoescape\s+(?:false|off)\s*%\}/,
+  },
+  {
+    id: 'tpl-haml-unescaped',
+    title: 'Haml unescaped output',
+    consequence: XSS_CONSEQUENCE,
+    cwe: 'CWE-79',
+    severity: 'high',
+    extensions: ['.haml'],
+    pattern: /^\s*[\w.#%-]*!=(?!=)\s*\S/,
+  },
+];
+
+/** Extensions any template rule owns. Folded into `SCAN_EXTENSIONS`. */
+export const TEMPLATE_EXTENSIONS: ReadonlySet<string> = new Set(
+  TEMPLATE_RULES.flatMap((rule) => rule.extensions),
+);
+
+export interface TemplateMatch {
+  rule: TemplateRule;
+  severity: Severity;
+  line: number;
+}
+
+/**
+ * Run the rules that own this extension over the file's lines.
+ *
+ * Returns matches rather than findings so the caller keeps sole ownership of
+ * how a finding is shaped — the same split the code rules use.
+ */
+export function evaluateTemplateRules(
+  extension: string,
+  lines: readonly string[],
+): TemplateMatch[] {
+  const ext = extension.toLowerCase();
+  const applicable = TEMPLATE_RULES.filter((rule) => rule.extensions.includes(ext));
+  if (applicable.length === 0) return [];
+
+  const matches: TemplateMatch[] = [];
+  lines.forEach((line, index) => {
+    for (const rule of applicable) {
+      if (!rule.pattern.test(line)) continue;
+      if (rule.lineGuard?.test(line)) continue;
+      matches.push({
+        rule,
+        // A template cannot show that the value is untrusted, so the claim
+        // never rises above `pattern` and the shared cap holds it at medium.
+        severity: severityFor(rule.severity, 'pattern'),
+        line: index + 1,
+      });
+    }
+  });
+  return matches;
+}
+
+/**
+ * KNOWN_GAPS — template classes deliberately not covered.
+ *
+ *   Underscore / Lodash templates
+ *     `<%= %>` is *unescaped* in Underscore and *escaped* in EJS, and the two
+ *     share the `.html` and `.tpl` extensions. Since the engine is what
+ *     decides which meaning applies, and nothing in the file says which engine
+ *     will render it, a rule for either convention is wrong half the time.
+ *
+ *   Liquid
+ *     Liquid does not escape by default at all, so every interpolation would
+ *     match. A rule that fires on every line of every template is a rule
+ *     nobody leaves switched on.
+ *
+ *   Whether the interpolated value is attacker-controlled
+ *     Needs the controller that renders the template, which is a different
+ *     file. This is the reason for the confidence ceiling, not an oversight.
+ */
diff --git a/packages/scan/src/text.ts b/packages/scan/src/text.ts
index 3e30c66..1ae82df 100644
--- a/packages/scan/src/text.ts
+++ b/packages/scan/src/text.ts
@@ -17,6 +17,7 @@
 import { CODE_RULES, evaluateRule, proseLines } from './code-rules';
 import { scanPackageJson, scanRequirementsTxt } from './manifest-rules';
 import { isKnownPlaceholder, redactSecret, SECRET_RULES, SENSITIVE_FILES } from './secret-rules';
+import { evaluateTemplateRules, TEMPLATE_EXTENSIONS } from './template-rules';
 import type { ScanFinding, ScanLanguage, Severity } from './types';
 import { severityRank } from './types';
 
@@ -55,6 +56,11 @@ export const SCAN_EXTENSIONS = new Set([
   '.yml', '.yaml', '.json', '.toml', '.ini', '.cfg', '.conf', '.env',
   '.sh', '.bash', '.zsh', '.tf', '.hcl', '.xml', '.properties', '.gradle',
   '.txt', '.md', '.sql', '.erb', '.ejs', '.vue', '.svelte',
+  // Template files, so the engine in `template-rules.ts` has something to
+  // read. Sourced from the rules themselves rather than repeated here: an
+  // engine added there becomes scannable without a second edit that could be
+  // forgotten, which is how a rule ends up quietly never firing.
+  ...TEMPLATE_EXTENSIONS,
 ]);
 
 const LANGUAGE_BY_EXTENSION: Record<string, ScanLanguage> = {
@@ -281,6 +287,31 @@ export function scanText(
     }
   });
 
+  // ── Template output ────────────────────────────────────────────────────
+  //
+  // Keyed on the extension rather than on `language`, because the extension is
+  // what names the engine and the engine is what decides which syntax skips
+  // escaping. This runs *in addition to* the code rules above, so a `.vue`
+  // file is checked both as JavaScript and as a template.
+  for (const match of evaluateTemplateRules(extensionOf(relativePath), lines)) {
+    const index = match.line - 1;
+    if (isSuppressed(suppressions, index, match.rule.id)) continue;
+
+    findings.push({
+      ruleId: match.rule.id,
+      title: match.rule.title,
+      file: relativePath,
+      line: match.line,
+      severity: match.severity,
+      confidence: 'pattern',
+      message: `${match.rule.title} (${match.rule.cwe})`,
+      consequence: match.rule.consequence,
+      cwe: match.rule.cwe,
+      excerpt: (lines[index] ?? '').trim().slice(0, 200),
+      category: 'code',
+    });
+  }
+
   return findings;
 }