From fcddd8192ea2d94015d83c22fc143b988cb3b255 Mon Sep 17 00:00:00 2001
From: Josh Larson <josh.larson@shopify.com>
Date: Tue, 15 Sep 2026 10:43:12 -0500
Subject: [PATCH] Remove the dependency CVE audit check from app doctor

Co-authored-by: AI (Pi/GPT-6 Astra) <noreply@pi.dev>
---
 .changeset/remove-app-doctor-cve-audit.md     |   4 +
 .../app/src/cli/commands/app/doctor.test.ts   |   2 -
 packages/app/src/cli/commands/app/doctor.ts   |   4 +-
 .../checks/KNOWN_CVE_IN_DEPENDENCY.md         |   9 -
 .../app-doctor-engine/checks/embedded.ts      |   1 -
 .../app-doctor-engine/rules/catalog.ts        |   9 -
 .../rules/dependency-rules.ts                 | 822 ------------------
 .../services/app-doctor-engine/rules/types.ts |  14 -
 .../app-doctor-engine/scanners/discover.ts    |  16 +-
 .../app-doctor-engine/scanners/index.ts       |  54 +-
 .../app-doctor-engine/scanners/types.ts       |   2 -
 .../app-doctor-engine/tests/checks.test.ts    |   6 +-
 .../tests/deterministic-rules.test.ts         |  59 +-
 .../tests/discovery-safety.test.ts            |  47 -
 .../fixtures/submission-forbidden-values.json |   2 +-
 .../tests/fixtures/submission-trace.ts        |  22 +-
 .../tests/fixtures/submission.json            |  18 +-
 .../tests/rule-analysis.test.ts               | 497 +----------
 .../tests/scan-contract.test.ts               |   2 -
 .../tests/submission.test.ts                  |   8 +-
 .../services/app-doctor-engine/trace/index.ts |   3 +-
 .../cli/services/app-doctor-engine/types.ts   |   3 +-
 packages/cli/oclif.manifest.json              |   4 +-
 23 files changed, 45 insertions(+), 1563 deletions(-)
 create mode 100644 .changeset/remove-app-doctor-cve-audit.md
 delete mode 100644 packages/app/src/cli/services/app-doctor-engine/checks/KNOWN_CVE_IN_DEPENDENCY.md
 delete mode 100644 packages/app/src/cli/services/app-doctor-engine/rules/dependency-rules.ts

diff --git a/.changeset/remove-app-doctor-cve-audit.md b/.changeset/remove-app-doctor-cve-audit.md
new file mode 100644
index 00000000000..47049e37158
--- /dev/null
+++ b/.changeset/remove-app-doctor-cve-audit.md
@@ -0,0 +1,4 @@
+---
+'@shopify/app': patch
+---
+Remove the dependency CVE audit check from `shopify app doctor`.
diff --git a/packages/app/src/cli/commands/app/doctor.test.ts b/packages/app/src/cli/commands/app/doctor.test.ts
index d93320d911e..35edf81fdc3 100644
--- a/packages/app/src/cli/commands/app/doctor.test.ts
+++ b/packages/app/src/cli/commands/app/doctor.test.ts
@@ -62,8 +62,6 @@ describe('app doctor command', () => {
     expect(Doctor.descriptionWithMarkdown).toContain('copy the coding-agent instructions')
     expect(Doctor.descriptionWithMarkdown).toContain('copying is the default')
     expect(Doctor.descriptionWithMarkdown).toContain('shopify app doctor instructions')
-    expect(Doctor.descriptionWithMarkdown).toContain('npm audit')
-    expect(Doctor.descriptionWithMarkdown).toContain('https://registry.npmjs.org/')
   })
 
   test('allows --yes in JSON mode while preserving non-interactive output behavior', async () => {
diff --git a/packages/app/src/cli/commands/app/doctor.ts b/packages/app/src/cli/commands/app/doctor.ts
index 8fa19782ed5..a4026ecb5a4 100644
--- a/packages/app/src/cli/commands/app/doctor.ts
+++ b/packages/app/src/cli/commands/app/doctor.ts
@@ -15,9 +15,7 @@ export default class Doctor extends BaseCommand {
 
   static descriptionWithMarkdown = `Runs Shopify App Doctor locally and creates its review pack and trace.
 
-Pass \`--findings\` after completing the review pack to validate agent findings and compile them into the trace. In interactive terminals, the command offers to copy the coding-agent instructions, print them, or choose nothing; copying is the default. In CI and other non-interactive environments, instructions aren't offered unless you pass \`--yes\`, which prints them. JSON output never prompts or prints those instructions. You can also run \`shopify app doctor instructions\` to print, copy, or write them later.
-
-CVE detection runs \`npm audit\` (or the pnpm/yarn equivalent) in an isolated sandbox and sends package names and versions to the public npm registry at https://registry.npmjs.org/.`
+Pass \`--findings\` after completing the review pack to validate agent findings and compile them into the trace. In interactive terminals, the command offers to copy the coding-agent instructions, print them, or choose nothing; copying is the default. In CI and other non-interactive environments, instructions aren't offered unless you pass \`--yes\`, which prints them. JSON output never prompts or prints those instructions. You can also run \`shopify app doctor instructions\` to print, copy, or write them later.`
 
   static description = this.descriptionWithoutMarkdown()
 
diff --git a/packages/app/src/cli/services/app-doctor-engine/checks/KNOWN_CVE_IN_DEPENDENCY.md b/packages/app/src/cli/services/app-doctor-engine/checks/KNOWN_CVE_IN_DEPENDENCY.md
deleted file mode 100644
index 38d7494daee..00000000000
--- a/packages/app/src/cli/services/app-doctor-engine/checks/KNOWN_CVE_IN_DEPENDENCY.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-id: KNOWN_CVE_IN_DEPENDENCY
-version: 3
-severity: medium
----
-
-# Known Cve In Dependency
-
-When deterministic package-manager audit is unavailable, inspect the JavaScript manifest and lockfile statically for known vulnerable dependency versions. Do not execute the repository's package manager, scripts, plugins, binaries, or configuration. Distinguish version exposure from reachable impact: when source evidence allows it, check whether the app actually uses the vulnerable API or helper and whether the relevant configuration is enabled, especially for Shopify SDK behavior that depends on how a helper is called. If static evidence cannot confirm either the vulnerable version or the vulnerable API/helper reachability, mark the check unresolved instead of running repository-controlled code.
diff --git a/packages/app/src/cli/services/app-doctor-engine/checks/embedded.ts b/packages/app/src/cli/services/app-doctor-engine/checks/embedded.ts
index 3b9dd05e602..e2ae6adcdb0 100644
--- a/packages/app/src/cli/services/app-doctor-engine/checks/embedded.ts
+++ b/packages/app/src/cli/services/app-doctor-engine/checks/embedded.ts
@@ -16,7 +16,6 @@ export const EMBEDDED_CHECK_SOURCES: ReadonlyArray<string> = [
   "---\nid: EOL_API_VERSION\nversion: 1\nseverity: low\n---\n\n# Eol Api Version\n\nInspect every unresolved `shopify.app*.toml` plus React Router `app/shopify.server.*` declarations. Shopify publishes quarterly versions in January, April, July, and October and supports each stable version for 12 months; App Doctor allows a documented 30-day extension grace period before reporting it as end-of-life. Cite the exact declaration. For malformed config, computed `ApiVersion` values, or a Shopify-announced exceptional extension, inspect the source and current lifecycle policy rather than inferring from unrelated constants.\n",
   "---\nid: EXPIRING_OFFLINE_TOKEN\nversion: 1\nseverity: medium\n---\n\n# Expiring Offline Token\n\nFor supported React Router apps, verify `expiringOfflineAccessTokens` is enabled and the selected session storage persists `expires`, `refreshToken`, and `refreshTokenExpires` metadata needed for refresh and rotation. `isOnline: false` selects an offline session; it does not disable token expiry and is not a finding. Report an explicit `expiringOfflineAccessTokens: false`. Treat absent or computed flags, custom storage, and ambiguous Prisma schemas as unresolved investigation: inspect storage adapters, migrations, and serialization before returning a clean result. Config-only and unsupported frameworks are handled by the runtime applicability boundary.\n",
   "---\nid: INSECURE_WEBHOOK_URL\nversion: 2\nseverity: high\n---\n\n# Insecure Configured Callback Url\n\nInspect webhook destinations and OAuth redirect URLs in every unresolved Shopify app configuration. Relative Shopify paths and valid pubsub/eventbridge webhook destinations are allowed. Report HTTP, malformed, credential-bearing, wildcard-host, wildcard-path, or otherwise unsafe configured callback URLs.\n",
-  "---\nid: KNOWN_CVE_IN_DEPENDENCY\nversion: 3\nseverity: medium\n---\n\n# Known Cve In Dependency\n\nWhen deterministic package-manager audit is unavailable, inspect the JavaScript manifest and lockfile statically for known vulnerable dependency versions. Do not execute the repository's package manager, scripts, plugins, binaries, or configuration. Distinguish version exposure from reachable impact: when source evidence allows it, check whether the app actually uses the vulnerable API or helper and whether the relevant configuration is enabled, especially for Shopify SDK behavior that depends on how a helper is called. If static evidence cannot confirm either the vulnerable version or the vulnerable API/helper reachability, mark the check unresolved instead of running repository-controlled code.\n",
   "---\nid: LIQUID_UNSAFE_RENDER\nversion: 1\nseverity: medium\n---\n\n# Liquid Unsafe Render\n\nInspect only theme-extension Liquid/HTML files the parser could not analyze. Liquid output is not automatically HTML-escaped. Check the destination: use `escape`/`escape_once` for HTML text and ordinary attributes, `json` when embedding a value as JavaScript data, and `metafield_tag` only for supported rich metafield rendering in HTML content. HTML escaping is not sufficient for event handlers, `srcdoc`, or a `<script src>` URL; avoid merchant-controlled output there and validate any dynamic URL. An ordinary non-script `src` attribute is not itself an executable sink. `{% raw %}` suppresses Liquid parsing, so apparent output inside it is literal text. Follow rendered snippets and inspect ambiguous filters or parser failures before reporting.\n",
   "---\nid: METAFIELD_OFFLINE_TOKEN\nversion: 1\nseverity: high\n---\n\n# Metafield Offline Token\n\nTrace metafield writes and determine whether they use an offline Admin API context where an authenticated online context is required. Confirm token provenance and compensating authorization before reporting.\n",
   "---\nid: MISSING_AUTHORIZATION_CHECK\nversion: 2\nseverity: high\n---\n\nFind controller actions or route handlers that access resources without\nchecking whether the current user is authorized to access them, beyond\nauthentication. Authentication verifies WHO you are; authorization verifies\nWHAT you can do. An app can be authenticated but still access resources\nbelonging to another merchant if authorization checks are missing.\n\nThis is distinct from `MISSING_TENANT_ISOLATION` (database query\nscoping) — this check looks for missing policy/permission checks on\nactions, even when the data access is scoped. For example, an app might\nscope queries by shop but not check whether the merchant has the right to\ndelete a resource, or whether a staff member can access admin-only\nactions.\n\n## What to look for\n\n1. **Find authorization frameworks.** Check what the app uses:\n   - Rails: Pundit (`authorize`, `policy`, `Pundit`), CanCanCan\n     (`can?`, `ability`), action_access filters\n   - Remix/Express: middleware that checks roles/permissions\n   - Custom: `before_action :check_admin`, `if current_user.can?`\n\n2. **Find actions without authorization checks.** For each controller\n   action or route handler, determine:\n   - Is there a `before_action` that checks authorization (not just\n     authentication)?\n   - Is there a Pundit `authorize` call?\n   - Is there a CanCanCan `authorize!` or `can?` check?\n   - Is there a custom permission check?\n\n3. **Check for `skip_idor_protection` or equivalent opt-outs.** These\n   disable IDOR/authorization checks. For each, determine:\n   - Is the skip justified? (e.g., public endpoint, webhook, health check)\n   - Does the skip expose a state-changing action to unauthorised users?\n   - Is there a compensating control (HMAC, session token, etc.)?\n\n4. **Check for admin-only functionality reachable by merchants.** Look for:\n   - Controllers under `admin/` namespace that don't check staff vs merchant\n   - Actions that modify app configuration without checking the caller's role\n   - Staff-only operations accessible through the merchant-facing UI\n\n5. **Check for missing object-level authorization.** Even if the query\n   is scoped by shop, does the handler verify that the specific resource\n   belongs to the current merchant?\n   - `Order.find(params[:id])` scoped by shop — but does it check the\n     merchant can access this specific order?\n   - `Product.find(params[:id])` — is there a policy check, or just\n     tenant scoping?\n\n6. **Compare authorization across state transitions.** Do not stop at one\n   handler. Compare create/read/update/delete paths, replay after role or UI\n   changes, direct URLs that survive permission downgrades, and backend actions\n   that remain callable after a feature is hidden or disabled in the UI.\n\n## What to report\n\nFor each action that exposes a concrete unauthorized operation beyond authentication:\n\n```json\n{\n  \"file\": \"app/controllers/orders_controller.rb\",\n  \"line\": 15,\n  \"message\": \"Destroy action has no authorization check beyond authentication\",\n  \"snippet\": \"def destroy\\n  Order.find(params[:id]).destroy\\nend\",\n  \"evidence\": [\n    {\n      \"file\": \"app/controllers/orders_controller.rb\",\n      \"line\": 15,\n      \"quote\": \"def destroy\"\n    },\n    {\n      \"file\": \"app/controllers/orders_controller.rb\",\n      \"line\": 5,\n      \"quote\": \"before_action :authenticate_user (no authorize check)\"\n    }\n  ],\n  \"confidence\": \"medium\",\n  \"reasoning\": \"The destroy action authenticates the user but does not call authorize or check a policy. Any authenticated merchant can delete any order within their shop, even if they shouldn't have delete permissions.\"\n}\n```\n\nOnly report when you can show an unauthorized operation is actually reachable;\ndifferent helper names or inconsistent UI affordances are not enough by themselves.\n\nDo not report:\n\n- Actions with explicit `authorize` / `can?` / policy checks\n- Actions protected by a `before_action` that checks authorization\n- Public endpoints (health checks, static content)\n- Webhook handlers (HMAC is the authorization)\n- Actions that only read data the merchant owns (scoped by session.shop\n  AND no object-level access control needed)\n- Internal/staff-only controllers (under `Internal::` namespace, behind\n  employee SSO like `EmployeeIdentity`, `IdentityClient`, etc.)\n- Test files (under test/ or \\*\\_test.rb)\n- Test controllers\n",
diff --git a/packages/app/src/cli/services/app-doctor-engine/rules/catalog.ts b/packages/app/src/cli/services/app-doctor-engine/rules/catalog.ts
index 527680d39cc..1ff1fd4e694 100644
--- a/packages/app/src/cli/services/app-doctor-engine/rules/catalog.ts
+++ b/packages/app/src/cli/services/app-doctor-engine/rules/catalog.ts
@@ -105,15 +105,6 @@ export const RULE_CATALOG: RuleCatalogEntry[] = [
     description: 'Detects direct credential flows into responses, loaders, globals, DOM, and external requests.',
     fix: 'Keep credentials server-side and return only non-sensitive derived data.',
   },
-  {
-    id: 'KNOWN_CVE_IN_DEPENDENCY',
-    title: 'Known CVE in dependency',
-    severity: 'high',
-    points: -20,
-    description:
-      'Runs the selected JavaScript package manager audit against production dependencies in the committed lockfile.',
-    fix: 'Upgrade the dependency to a patched version.',
-  },
 
   {
     id: 'EXPIRING_OFFLINE_TOKEN',
diff --git a/packages/app/src/cli/services/app-doctor-engine/rules/dependency-rules.ts b/packages/app/src/cli/services/app-doctor-engine/rules/dependency-rules.ts
deleted file mode 100644
index a39cf255aa5..00000000000
--- a/packages/app/src/cli/services/app-doctor-engine/rules/dependency-rules.ts
+++ /dev/null
@@ -1,822 +0,0 @@
-import {readOptionalRepositoryFile} from '../scanners/discover.js'
-import {dirname, isAbsolutePath, joinPath, relativePath, resolvePath} from '@shopify/cli-kit/node/path'
-import {treeKill} from '@shopify/cli-kit/node/tree-kill'
-// eslint-disable-next-line no-restricted-imports -- cli-kit's executor merges process.env, which violates this audit boundary.
-import {spawn, type ChildProcess} from 'node:child_process'
-import {existsSync} from 'node:fs'
-import {tmpdir} from 'node:os'
-import {lstat, mkdir, mkdtemp, rm, unlink, writeFile} from 'node:fs/promises'
-import type {Readable} from 'node:stream'
-import type {Issue, Severity} from '../types.js'
-import type {AuditCommandResult, AuditExecutor, ManifestFile} from './types.js'
-
-export type {AuditExecutor} from './types.js'
-
-interface DependencyAuditResult {
-  issues: Issue[]
-  unresolvedReason?: string
-  inspectedFiles: string[]
-}
-
-interface AuditSelection {
-  command: 'npm' | 'pnpm' | 'yarn' | 'corepack'
-  args: string[]
-  outputFormat: 'npm' | 'pnpm' | 'yarn-classic' | 'yarn-berry'
-  lockfile: string
-  packageManager?: string
-}
-
-interface ParsedAdvisory {
-  packageName: string
-  severity: string
-  cves: string[]
-  topLevelParents: string[]
-}
-
-const PATH_DELIMITER = process.platform === 'win32' ? ';' : ':'
-const MAX_AUDIT_STREAM_BYTES = 1_048_576
-const PROCESS_ESCALATION_MILLISECONDS = 2_000
-
-function delay(milliseconds: number): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, milliseconds))
-}
-
-function killProcessTree(pid: number, signal: NodeJS.Signals): Promise<void> {
-  return new Promise((resolve) => {
-    treeKill(pid, signal, true, () => resolve())
-  })
-}
-
-function collectBoundedStream(stream: Readable | null, onOverflow: () => void): {text(): string} {
-  let text = ''
-  let size = 0
-  let overflowed = false
-  if (!stream) return {text: () => text}
-
-  stream.setEncoding('utf8')
-  stream.on('data', (chunk: string) => {
-    if (overflowed) return
-    const chunkSize = Buffer.byteLength(chunk)
-    if (size + chunkSize > MAX_AUDIT_STREAM_BYTES) {
-      const remaining = MAX_AUDIT_STREAM_BYTES - size
-      if (remaining > 0) text += Buffer.from(chunk, 'utf8').subarray(0, remaining).toString('utf8')
-      size = MAX_AUDIT_STREAM_BYTES
-      overflowed = true
-      onOverflow()
-      return
-    }
-    text += chunk
-    size += chunkSize
-  })
-  return {text: () => text}
-}
-
-function processHasExited(child: ChildProcess): boolean {
-  return child.exitCode !== null || child.signalCode !== null
-}
-
-function waitForProcessExit(child: ChildProcess): Promise<void> {
-  if (processHasExited(child)) return Promise.resolve()
-  return new Promise((resolve) => {
-    child.once('close', () => resolve())
-  })
-}
-
-async function terminateProcessTree(child: ChildProcess): Promise<void> {
-  if (child.pid === undefined || processHasExited(child)) return
-  await killProcessTree(child.pid, 'SIGTERM')
-  await Promise.race([delay(PROCESS_ESCALATION_MILLISECONDS), waitForProcessExit(child)])
-  if (child.pid !== undefined && !processHasExited(child)) {
-    await killProcessTree(child.pid, 'SIGKILL')
-  }
-}
-
-function quoteWindowsAuditArgument(value: string): string {
-  return `"${value.replace(/%/g, '%%').replace(/"/g, '""')}"`
-}
-
-function windowsCmdAuditArguments(command: string, args: string[]): string[] {
-  const commandLine = [command, ...args].map(quoteWindowsAuditArgument).join(' ')
-  // cmd /s /c strips the first and last quote of the remainder. Wrap the quoted
-  // command line so per-argument quotes survive instead of becoming `npm" "audit`.
-  return ['/d', '/s', '/c', `"${commandLine}"`]
-}
-
-function needsWindowsCmdShim(command: string): boolean {
-  if (process.platform !== 'win32') return false
-  if (/\.(?:exe|com)$/i.test(command)) return false
-  return !isAbsolutePath(command) || /\.(?:cmd|bat)$/i.test(command)
-}
-
-function resolveWindowsAuditCommand(command: string, pathValue: string | undefined): string {
-  // npm.cmd uses %~dp0 to find npm-prefix.js. Invoking `npm` without a path makes
-  // %~dp0 the sandbox cwd, so resolve to an absolute .cmd/.bat/.exe first.
-  if (isAbsolutePath(command)) return command
-  const extensions = ['.cmd', '.bat', '.exe']
-  const hasExtension = extensions.some((extension) => command.toLowerCase().endsWith(extension))
-  const names = hasExtension ? [command] : extensions.map((extension) => `${command}${extension}`)
-  const directories = [dirname(process.execPath), ...(pathValue ?? '').split(PATH_DELIMITER)]
-  for (const directory of directories) {
-    if (!directory || !isAbsolutePath(directory)) continue
-    for (const name of names) {
-      const candidate = resolvePath(directory, name)
-      if (existsSync(candidate)) return candidate
-    }
-  }
-  return command
-}
-
-function spawnAuditProcess(
-  command: string,
-  args: string[],
-  options: {cwd: string; env: Record<string, string | undefined>},
-): ChildProcess {
-  const spawnOptions = {
-    cwd: options.cwd,
-    env: options.env,
-    shell: false,
-    stdio: ['ignore', 'pipe', 'pipe'] as ['ignore', 'pipe', 'pipe'],
-    windowsHide: true,
-  }
-  const resolved = process.platform === 'win32' ? resolveWindowsAuditCommand(command, options.env.PATH) : command
-  if (!needsWindowsCmdShim(resolved)) return spawn(resolved, args, spawnOptions)
-
-  return spawn(process.env.ComSpec ?? 'cmd.exe', windowsCmdAuditArguments(resolved, args), {
-    ...spawnOptions,
-    windowsVerbatimArguments: true,
-  })
-}
-
-export const executeAuditCommand: AuditExecutor = (command, args, options) =>
-  new Promise((resolve, reject) => {
-    // Do not pass AbortSignal to spawn: Node would kill only the immediate child.
-    // Audits must terminate the process tree, wait for close, then resolve.
-    const child = spawnAuditProcess(command, args, options)
-    let settled = false
-    let terminating = false
-
-    const finish = (result: AuditCommandResult) => {
-      if (settled) return
-      settled = true
-      resolve(result)
-    }
-
-    const terminate = () => {
-      if (terminating || settled) return
-      terminating = true
-      // Termination continues in the background until `close` settles the executor.
-      // eslint-disable-next-line @typescript-eslint/no-floating-promises
-      terminateProcessTree(child)
-    }
-
-    const stdout = collectBoundedStream(child.stdout, terminate)
-    const stderr = collectBoundedStream(child.stderr, terminate)
-
-    child.once('error', (error) => {
-      if (settled) return
-      settled = true
-      reject(error)
-    })
-    child.once('close', (exitCode) => finish({stdout: stdout.text(), stderr: stderr.text(), exitCode: exitCode ?? 1}))
-
-    if (options.signal.aborted) terminate()
-    else options.signal.addEventListener('abort', terminate, {once: true})
-  })
-const TRUSTED_REGISTRY = 'https://registry.npmjs.org/'
-const LOCKFILE_MANAGERS = new Map<string, 'npm' | 'pnpm' | 'yarn'>([
-  ['package-lock.json', 'npm'],
-  ['pnpm-lock.yaml', 'pnpm'],
-  ['yarn.lock', 'yarn'],
-])
-
-export async function auditKnownCves(
-  appRoot: string,
-  manifests: ManifestFile[],
-  executor: AuditExecutor = executeAuditCommand,
-  timeoutMilliseconds = 15_000,
-): Promise<DependencyAuditResult> {
-  const packageManifest = manifests.find((manifest) => manifest.path === 'package.json')
-  if (!packageManifest)
-    return {issues: [], unresolvedReason: 'No root JavaScript package.json was available.', inspectedFiles: []}
-
-  const lockfileContents = new Map<string, Buffer>()
-  for (const path of LOCKFILE_MANAGERS.keys()) {
-    const result = readOptionalRepositoryFile(appRoot, joinPath(appRoot, path))
-    if (result.ok) lockfileContents.set(path, result.content)
-  }
-  const lockfiles = [...lockfileContents.keys()]
-  if (lockfiles.length === 0)
-    return {
-      issues: [],
-      unresolvedReason: 'No supported JavaScript lockfile was found.',
-      inspectedFiles: ['package.json'],
-    }
-
-  const selection = selectPackageManager(lockfiles, packageManifest.packageManager)
-  if ('error' in selection)
-    return {issues: [], unresolvedReason: selection.error, inspectedFiles: ['package.json', ...lockfiles]}
-  const inspectedFiles = ['package.json', selection.lockfile]
-  const selectedLockfile = lockfileContents.get(selection.lockfile)!
-
-  let sandbox: AuditSandbox
-  try {
-    sandbox = await createAuditSandbox(
-      appRoot,
-      packageManifest,
-      selection.lockfile,
-      selectedLockfile,
-      selection.packageManager,
-    )
-    // Sandbox setup failures are expected coverage gaps, never a reason to fall back to the app root.
-    // eslint-disable-next-line no-catch-all/no-catch-all
-  } catch (error) {
-    return {
-      issues: [],
-      unresolvedReason: `Dependency audit sandbox could not be created: ${redactAuditText(error instanceof Error ? error.message : String(error))}`,
-      inspectedFiles,
-    }
-  }
-
-  const controller = new AbortController()
-  const timedOut = Symbol('audit-timeout')
-  const escalationMilliseconds = Math.min(PROCESS_ESCALATION_MILLISECONDS, Math.max(200, timeoutMilliseconds * 5))
-  const timeout = setTimeout(() => controller.abort(), timeoutMilliseconds)
-  let hardTimeout: ReturnType<typeof setTimeout> | undefined
-  const hardStop = new Promise<typeof timedOut>((resolve) => {
-    hardTimeout = setTimeout(() => resolve(timedOut), timeoutMilliseconds + escalationMilliseconds)
-  })
-
-  let execution: AuditCommandResult | typeof timedOut
-  try {
-    execution = await Promise.race([
-      executor(selection.command, auditArguments(selection, sandbox.userConfigPath), {
-        cwd: sandbox.workspace,
-        signal: controller.signal,
-        env: auditEnvironment(appRoot, sandbox),
-      }),
-      hardStop,
-    ])
-    // Command absence, network failures, and aborts are expected audit outcomes.
-    // eslint-disable-next-line no-catch-all/no-catch-all
-  } catch (error) {
-    if (controller.signal.aborted) {
-      return {issues: [], unresolvedReason: 'Dependency audit timed out.', inspectedFiles}
-    }
-    return {
-      issues: [],
-      unresolvedReason: `Dependency audit could not run: ${redactAuditText(error instanceof Error ? error.message : String(error))}`,
-      inspectedFiles,
-    }
-  } finally {
-    clearTimeout(timeout)
-    clearTimeout(hardTimeout)
-    await removeAuditSandbox(sandbox.root)
-  }
-
-  if (execution === timedOut || controller.signal.aborted) {
-    return {issues: [], unresolvedReason: 'Dependency audit timed out.', inspectedFiles}
-  }
-
-  const parsed = parseAuditOutput(execution.stdout, selection.outputFormat)
-  if (!parsed) {
-    const operationalMessage = redactAuditText(execution.stderr || execution.stdout).slice(0, 240)
-    return {
-      issues: [],
-      unresolvedReason: `Dependency audit returned unusable output${operationalMessage ? `: ${operationalMessage}` : '.'}`,
-      inspectedFiles,
-    }
-  }
-  if (execution.exitCode !== 0 && parsed.length === 0)
-    return {issues: [], unresolvedReason: 'Dependency audit failed operationally.', inspectedFiles}
-
-  return {
-    issues: collapseAdvisories(parsed.filter((advisory) => isProductionAdvisory(advisory, packageManifest))).map(
-      (advisory) => toCveIssue(advisory, selection.lockfile),
-    ),
-    inspectedFiles,
-  }
-}
-
-export function parseAuditOutput(
-  output: string,
-  packageManager: 'npm' | 'pnpm' | 'yarn' | 'yarn-classic' | 'yarn-berry' | string,
-): ParsedAdvisory[] | null {
-  const trimmed = output.trim()
-  if (!trimmed) return null
-  try {
-    if (packageManager === 'yarn-berry' && trimmed.includes('\n')) {
-      try {
-        return trimmed.split('\n').flatMap((line) => berryAdvisories(JSON.parse(line)))
-        // Parsing each JSON line is speculative because pretty-printed JSON also contains newlines.
-        // eslint-disable-next-line no-catch-all/no-catch-all
-      } catch {
-        // Fall through to the normal single-document parser.
-      }
-    }
-    if (packageManager === 'yarn' || packageManager === 'yarn-classic') {
-      const records = trimmed.split('\n').map((line) => JSON.parse(line) as Record<string, unknown>)
-      const recognized = records.some((record) => record.type === 'auditAdvisory' || record.type === 'auditSummary')
-      if (!recognized) return null
-      return records.flatMap((record) => {
-        if (record.type !== 'auditAdvisory') return []
-        const data = record.data as {
-          advisory?: {
-            module_name?: string
-            severity?: string
-            cves?: string[]
-            url?: string
-            title?: string
-            github_advisory_id?: string
-          }
-          resolution?: {path?: string}
-        }
-        const advisory = data.advisory
-        if (!advisory?.module_name) return []
-        const parent = data.resolution?.path ? topLevelParentFromPath(data.resolution.path) : undefined
-        return [
-          {
-            packageName: advisory.module_name,
-            severity: advisory.severity ?? 'unknown',
-            cves: identifiersFromText(advisory.cves, advisory.url, advisory.title, advisory.github_advisory_id),
-            topLevelParents: parent ? [parent] : [],
-          },
-        ]
-      })
-    }
-
-    const report = JSON.parse(trimmed) as {
-      error?: unknown
-      vulnerabilities?: Record<string, {severity?: string; via?: unknown}>
-      advisories?: Record<
-        string,
-        {
-          module_name?: string
-          severity?: string
-          cves?: string[]
-          url?: string
-          title?: string
-          findings?: {paths?: string[]}[]
-        }
-      >
-      metadata?: {vulnerabilities?: Record<string, number>}
-      children?: unknown
-    }
-    if (report.error) return null
-    if (report.vulnerabilities) return npmAdvisories(report.vulnerabilities)
-    if (report.advisories) return pnpmAdvisories(report.advisories)
-    if (report.children) return berryAdvisories(report)
-    if (report.metadata?.vulnerabilities) return []
-    return null
-    // Audit tools emit malformed or partial JSON on operational failures.
-    // eslint-disable-next-line no-catch-all/no-catch-all
-  } catch {
-    return null
-  }
-}
-
-function npmAdvisories(vulnerabilities: Record<string, {severity?: string; via?: unknown}>): ParsedAdvisory[] {
-  return Object.entries(vulnerabilities).map(([packageName, vulnerability]) => ({
-    packageName,
-    severity: vulnerability.severity ?? 'unknown',
-    cves: identifiersFromText(...viaIdentifierSources(vulnerability.via)),
-    topLevelParents: [],
-  }))
-}
-
-function pnpmAdvisories(
-  advisories: Record<
-    string,
-    {
-      module_name?: string
-      severity?: string
-      cves?: string[]
-      url?: string
-      title?: string
-      findings?: {paths?: string[]}[]
-    }
-  >,
-): ParsedAdvisory[] {
-  return Object.values(advisories).flatMap((advisory) => {
-    if (!advisory.module_name) return []
-    const paths = (advisory.findings ?? []).flatMap((finding) => finding.paths ?? [])
-    return [
-      {
-        packageName: advisory.module_name,
-        severity: advisory.severity ?? 'unknown',
-        cves: identifiersFromText(advisory.cves, advisory.url, advisory.title),
-        topLevelParents: unique(
-          paths.map(topLevelParentFromPath).filter((parent): parent is string => Boolean(parent)),
-        ),
-      },
-    ]
-  })
-}
-
-function berryAdvisories(value: unknown, inheritedName?: string): ParsedAdvisory[] {
-  if (!value || typeof value !== 'object') return []
-  if (Array.isArray(value)) return value.flatMap((item) => berryAdvisories(item, inheritedName))
-
-  const node = value as Record<string, unknown>
-  const nodeName = [node.ident, node.value, node.name, inheritedName].find(
-    (candidate): candidate is string => typeof candidate === 'string',
-  )
-  const children = node.children && typeof node.children === 'object' ? (node.children as Record<string, unknown>) : {}
-  const severity = [node.severity, node.Severity, children.Severity].find(
-    (candidate): candidate is string => typeof candidate === 'string',
-  )
-  const current = severity && nodeName ? [{packageName: nodeName, severity, cves: [], topLevelParents: []}] : []
-  const descendants = Object.entries(children).flatMap(([name, child]) =>
-    name === 'Severity' ? [] : berryAdvisories(child, name),
-  )
-  return [...current, ...descendants]
-}
-
-function viaIdentifierSources(via: unknown): (string | string[] | undefined)[] {
-  if (!Array.isArray(via)) return []
-  return via.flatMap((item) => {
-    if (typeof item === 'string') return [item]
-    if (!item || typeof item !== 'object') return []
-    const record = item as Record<string, unknown>
-    return [
-      Array.isArray(record.cves)
-        ? record.cves.filter((value): value is string => typeof value === 'string')
-        : undefined,
-      typeof record.url === 'string' ? record.url : undefined,
-      typeof record.title === 'string' ? record.title : undefined,
-    ]
-  })
-}
-
-function collapseAdvisories(advisories: ParsedAdvisory[]): ParsedAdvisory[] {
-  const collapsed = new Map<string, ParsedAdvisory>()
-  for (const advisory of advisories) {
-    const existing = collapsed.get(advisory.packageName)
-    if (!existing) {
-      collapsed.set(advisory.packageName, {
-        packageName: advisory.packageName,
-        severity: advisory.severity,
-        cves: unique(advisory.cves),
-        topLevelParents: unique(advisory.topLevelParents),
-      })
-      continue
-    }
-    const higher = severityRank(advisory.severity) > severityRank(existing.severity)
-    collapsed.set(advisory.packageName, {
-      packageName: existing.packageName,
-      severity: higher ? advisory.severity : existing.severity,
-      cves: unique(higher ? [...advisory.cves, ...existing.cves] : [...existing.cves, ...advisory.cves]),
-      topLevelParents: unique([...existing.topLevelParents, ...advisory.topLevelParents]),
-    })
-  }
-  return [...collapsed.values()]
-}
-
-function isProductionAdvisory(advisory: ParsedAdvisory, manifest: ManifestFile): boolean {
-  if (advisory.topLevelParents.length === 0) return true
-  const production = new Set(Object.keys(manifest.dependencies ?? {}))
-  const development = new Set(Object.keys(manifest.devDependencies ?? {}))
-  return advisory.topLevelParents.some((parent) => production.has(parent) || !development.has(parent))
-}
-
-function toCveIssue(advisory: ParsedAdvisory, lockfile: string): Issue {
-  const packageName = redactAuditText(advisory.packageName).slice(0, 160)
-  const classification = classifySeverity(advisory.severity)
-  const cves = unique(advisory.cves.map((identifier) => redactAuditText(identifier)).filter(Boolean))
-  const parents = unique(
-    advisory.topLevelParents.map((parent) => redactAuditText(parent).slice(0, 160)).filter(Boolean),
-  )
-  return {
-    id: 'KNOWN_CVE_IN_DEPENDENCY',
-    severity: classification.severity,
-    points: classification.points,
-    title: cveIssueTitle(packageName, classification.severity, cves),
-    message: cveIssueMessage(packageName, classification.severity, cves, parents),
-    location: {file: lockfile},
-    fix: {
-      automated: false,
-      description: `Upgrade ${packageName} to a patched version and regenerate the lockfile.`,
-    },
-  }
-}
-
-function cveIssueTitle(packageName: string, severity: Severity, cves: string[]): string {
-  if (cves.length === 0) return `${packageName} has a ${severity} vulnerability`
-  if (cves.length === 1) return `${packageName} has a ${severity} vulnerability (${cves[0]})`
-  return `${packageName} has a ${severity} vulnerability (${cves[0]} + ${cves.length - 1} more)`
-}
-
-function cveIssueMessage(packageName: string, severity: Severity, cves: string[], parents: string[]): string {
-  const identifiers = cves.length > 0 ? ` (${cves.join(', ')})` : ''
-  const via = parents.length > 0 ? ` Pulled in via ${parents.join(', ')}.` : ''
-  return `${packageName} has a ${severity} vulnerability in the production dependency tree${identifiers}.${via}`
-}
-
-function identifiersFromText(...values: (string | string[] | undefined)[]): string[] {
-  const cves: string[] = []
-  const ghsas: string[] = []
-  const seen = new Set<string>()
-  for (const value of values) {
-    const texts = (Array.isArray(value) ? value : [value]).filter((text): text is string => typeof text === 'string')
-    for (const text of texts) {
-      for (const match of text.matchAll(/CVE-\d{4}-\d+/gi)) {
-        const identifier = match[0].toUpperCase()
-        if (!seen.has(identifier)) {
-          seen.add(identifier)
-          cves.push(identifier)
-        }
-      }
-      for (const match of text.matchAll(/GHSA-[a-z0-9]+-[a-z0-9]+-[a-z0-9]+/gi)) {
-        if (!seen.has(match[0])) {
-          seen.add(match[0])
-          ghsas.push(match[0])
-        }
-      }
-    }
-  }
-  return cves.length > 0 ? cves : ghsas
-}
-
-function topLevelParentFromPath(path: string): string | undefined {
-  return path
-    .split('>')
-    .map((part) => part.trim())
-    .find((part) => part.length > 0 && part !== '.')
-}
-
-function unique(values: string[]): string[] {
-  return [...new Set(values)]
-}
-
-function severityRank(value: string): number {
-  switch (value.toLowerCase()) {
-    case 'critical':
-      return 4
-    case 'high':
-      return 3
-    case 'moderate':
-    case 'medium':
-      return 2
-    case 'low':
-      return 1
-    case 'info':
-      return 0
-    default:
-      return 2
-  }
-}
-
-function classifySeverity(value: string): {severity: Severity; points: number} {
-  switch (value.toLowerCase()) {
-    case 'critical':
-    case 'high':
-      return {severity: 'high', points: -20}
-    case 'moderate':
-    case 'medium':
-      return {severity: 'medium', points: -10}
-    case 'low':
-    case 'info':
-      return {severity: 'low', points: -5}
-    default:
-      return {severity: 'medium', points: -10}
-  }
-}
-
-function selectPackageManager(lockfiles: string[], declaration?: string): AuditSelection | {error: string} {
-  const managers = new Set(lockfiles.map((lockfile) => LOCKFILE_MANAGERS.get(lockfile)!))
-  const declared = declaration?.split('@')[0]
-  if (declared && !['npm', 'pnpm', 'yarn'].includes(declared))
-    return {error: `Unsupported packageManager declaration: ${declared}.`}
-  if (declared && !managers.has(declared as 'npm' | 'pnpm' | 'yarn'))
-    return {error: 'packageManager conflicts with the available lockfile.'}
-  if (!declared && managers.size !== 1)
-    return {error: 'Multiple package-manager lockfiles make audit selection ambiguous.'}
-
-  const command = (declared ?? [...managers][0]) as 'npm' | 'pnpm' | 'yarn'
-  const lockfile = [...LOCKFILE_MANAGERS].find(([, manager]) => manager === command)?.[0]
-  if (!lockfile || !lockfiles.includes(lockfile))
-    return {error: 'The selected package manager has no matching lockfile.'}
-  if (command === 'npm') return {command, args: ['audit', '--json'], outputFormat: 'npm', lockfile}
-  if (command === 'pnpm') return {command, args: ['audit', '--json'], outputFormat: 'pnpm', lockfile}
-  const berry = /^yarn@((?:[2-9]|\d{2,})\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)$/.exec(declaration ?? '')
-  if (/^yarn@(?:[2-9]|\d{2,})(?:\.|$)/.test(declaration ?? '') && !berry)
-    return {error: 'Yarn Berry packageManager must declare an exact supported version.'}
-  return berry
-    ? {
-        command: 'corepack',
-        args: [`yarn@${berry[1]}`, 'npm', 'audit', '--all', '--json'],
-        outputFormat: 'yarn-berry',
-        lockfile,
-        packageManager: declaration,
-      }
-    : {command, args: ['audit', '--json'], outputFormat: 'yarn-classic', lockfile}
-}
-
-interface AuditSandbox {
-  root: string
-  workspace: string
-  home: string
-  temporaryDirectory: string
-  cache: string
-  userConfigPath: string
-  globalConfigPath: string
-}
-
-function isWithin(root: string, path: string): boolean {
-  const relative = relativePath(root, path)
-  return relative === '' || (!relative.startsWith('../') && relative !== '..' && !isAbsolutePath(relative))
-}
-
-function sanitizedPath(appRoot: string): string | undefined {
-  const value = process.env.PATH
-  if (!value) return undefined
-  return value
-    .split(PATH_DELIMITER)
-    .filter((entry) => {
-      if (!entry || !isAbsolutePath(entry)) return false
-      const absoluteEntry = resolvePath(entry)
-      const normalizedEntry = absoluteEntry.replace(/\\/g, '/')
-      return !isWithin(appRoot, absoluteEntry) && !normalizedEntry.includes('/node_modules/.bin')
-    })
-    .join(PATH_DELIMITER)
-}
-
-function isRegistryDependency(name: string, specification: string): boolean {
-  if (!/^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/i.test(name)) return false
-  if (
-    specification.startsWith('.') ||
-    specification.startsWith('/') ||
-    specification.includes('\\') ||
-    specification.includes(':') ||
-    specification.includes('://') ||
-    /^(?:file|link|portal|patch|workspace|git|ssh|github|gitlab|bitbucket):/i.test(specification)
-  )
-    return false
-  // Bare owner/repository shorthands resolve through a forge rather than the forced npm registry.
-  return !specification.includes('/')
-}
-
-function sanitizedDependencies(value: Record<string, string> | undefined): Record<string, string> {
-  return Object.fromEntries(
-    Object.entries(value ?? {}).filter(
-      (entry): entry is [string, string] =>
-        typeof entry[0] === 'string' && typeof entry[1] === 'string' && isRegistryDependency(entry[0], entry[1]),
-    ),
-  )
-}
-
-async function createAuditSandbox(
-  appRoot: string,
-  manifest: ManifestFile,
-  lockfile: string,
-  lockfileContent: Buffer,
-  packageManager?: string,
-): Promise<AuditSandbox> {
-  const systemTemporaryDirectory = resolvePath(tmpdir())
-  const parent = isWithin(appRoot, systemTemporaryDirectory) ? dirname(appRoot) : systemTemporaryDirectory
-  const root = await mkdtemp(joinPath(parent, 'shopify-app-doctor-audit-'))
-  try {
-    const workspace = joinPath(root, 'workspace')
-    const home = joinPath(root, 'home')
-    const temporaryDirectory = joinPath(root, 'tmp')
-    const cache = joinPath(root, 'cache')
-    const userConfigPath = joinPath(root, 'empty-user-config')
-    const globalConfigPath = joinPath(root, 'empty-global-config')
-    await Promise.all([
-      mkdir(workspace, {mode: 0o700}),
-      mkdir(home, {mode: 0o700}),
-      mkdir(temporaryDirectory, {mode: 0o700}),
-      mkdir(cache, {mode: 0o700}),
-    ])
-    const packageJson = JSON.stringify({
-      name: 'shopify-app-doctor-audit',
-      version: '0.0.0',
-      private: true,
-      ...(packageManager ? {packageManager} : {}),
-      dependencies: sanitizedDependencies(manifest.dependencies),
-      devDependencies: sanitizedDependencies(manifest.devDependencies),
-    })
-    await Promise.all([
-      writeFile(joinPath(workspace, 'package.json'), packageJson, {mode: 0o600}),
-      writeFile(joinPath(workspace, lockfile), lockfileContent, {mode: 0o600}),
-      writeFile(userConfigPath, '', {mode: 0o600}),
-      writeFile(globalConfigPath, '', {mode: 0o600}),
-      writeFile(
-        joinPath(workspace, '.app-doctor-yarnrc.yml'),
-        `enableScripts: false\nenableTelemetry: false\nnpmRegistryServer: "${TRUSTED_REGISTRY}"\n`,
-        {mode: 0o600},
-      ),
-    ])
-    return {root, workspace, home, temporaryDirectory, cache, userConfigPath, globalConfigPath}
-  } catch (error) {
-    // Never strand a partially initialized sandbox after a filesystem failure.
-    await removeAuditSandbox(root)
-    throw error
-  }
-}
-
-async function tryRemoveAuditSandbox(root: string): Promise<boolean> {
-  try {
-    const stats = await lstat(root)
-    if (stats.isSymbolicLink() || !stats.isDirectory()) await unlink(root)
-    else await rm(root, {recursive: true, force: true})
-    return true
-    // Cleanup is best-effort and must not hide an audit result.
-    // eslint-disable-next-line no-catch-all/no-catch-all
-  } catch {
-    return false
-  }
-}
-
-async function removeAuditSandbox(root: string): Promise<void> {
-  if (await tryRemoveAuditSandbox(root)) return
-  if (process.platform !== 'win32') return
-  await delay(50)
-  if (await tryRemoveAuditSandbox(root)) return
-  await delay(150)
-  if (await tryRemoveAuditSandbox(root)) return
-  await delay(400)
-  await tryRemoveAuditSandbox(root)
-}
-
-function productionAuditFlags(selection: AuditSelection): string[] {
-  if (selection.command === 'npm') return ['--omit=dev']
-  if (selection.command === 'pnpm') return ['--prod']
-  if (selection.outputFormat === 'yarn-classic') return ['--groups', 'dependencies']
-  if (selection.outputFormat === 'yarn-berry') return ['--environment', 'production']
-  return []
-}
-
-function auditArguments(selection: AuditSelection, userConfigPath: string): string[] {
-  if (selection.command === 'npm')
-    return [
-      ...selection.args,
-      ...productionAuditFlags(selection),
-      '--ignore-scripts',
-      `--registry=${TRUSTED_REGISTRY}`,
-      `--userconfig=${userConfigPath}`,
-      '--no-color',
-    ]
-  if (selection.command === 'pnpm')
-    return [
-      ...selection.args,
-      ...productionAuditFlags(selection),
-      '--config.ignore-scripts=true',
-      `--config.registry=${TRUSTED_REGISTRY}`,
-      `--config.userconfig=${userConfigPath}`,
-      '--color=false',
-    ]
-  if (selection.outputFormat === 'yarn-classic')
-    return [
-      ...selection.args,
-      ...productionAuditFlags(selection),
-      '--ignore-scripts',
-      '--no-default-rc',
-      '--non-interactive',
-      '--no-progress',
-      '--registry',
-      TRUSTED_REGISTRY,
-    ]
-  return [...selection.args, ...productionAuditFlags(selection)]
-}
-
-function auditEnvironment(appRoot: string, sandbox: AuditSandbox): Record<string, string | undefined> {
-  const executionEnvironment = Object.fromEntries(
-    ['PATHEXT', 'SystemRoot', 'COMSPEC', 'WINDIR'].flatMap((key) =>
-      process.env[key] === undefined ? [] : [[key, process.env[key]]],
-    ),
-  )
-  return {
-    ...executionEnvironment,
-    PATH: sanitizedPath(appRoot),
-    HOME: sandbox.home,
-    USERPROFILE: sandbox.home,
-    TMPDIR: sandbox.temporaryDirectory,
-    TMP: sandbox.temporaryDirectory,
-    TEMP: sandbox.temporaryDirectory,
-    NO_COLOR: '1',
-    FORCE_COLOR: '0',
-    NPM_CONFIG_USERCONFIG: sandbox.userConfigPath,
-    NPM_CONFIG_GLOBALCONFIG: sandbox.globalConfigPath,
-    NPM_CONFIG_REGISTRY: TRUSTED_REGISTRY,
-    NPM_CONFIG_IGNORE_SCRIPTS: 'true',
-    NPM_CONFIG_FUND: 'false',
-    NPM_CONFIG_UPDATE_NOTIFIER: 'false',
-    NPM_CONFIG_CACHE: sandbox.cache,
-    YARN_RC_FILENAME: '.app-doctor-yarnrc.yml',
-    YARN_IGNORE_PATH: '1',
-    YARN_ENABLE_SCRIPTS: 'false',
-    YARN_ENABLE_TELEMETRY: '0',
-    YARN_NPM_REGISTRY_SERVER: TRUSTED_REGISTRY,
-    YARN_CACHE_FOLDER: sandbox.cache,
-    COREPACK_HOME: sandbox.cache,
-    COREPACK_ENABLE_PROJECT_SPEC: '0',
-    COREPACK_ENABLE_DOWNLOAD_PROMPT: '0',
-  }
-}
-
-function redactAuditText(value: string): string {
-  return value
-    .replace(/https?:\/\/[^\s/@:]+:[^\s/@]+@/g, 'https://[redacted]@')
-    .replace(/(_authToken|token|authorization)\s*[=:]\s*[^\s]+/gi, '$1=[redacted]')
-    .replace(/https?:\/\/[^\s]+/g, '[registry-url]')
-}
diff --git a/packages/app/src/cli/services/app-doctor-engine/rules/types.ts b/packages/app/src/cli/services/app-doctor-engine/rules/types.ts
index 2247634ff47..bbd93d3f3af 100644
--- a/packages/app/src/cli/services/app-doctor-engine/rules/types.ts
+++ b/packages/app/src/cli/services/app-doctor-engine/rules/types.ts
@@ -3,18 +3,6 @@ import type {AppTomlContent, ExtensionInfo, ManifestFile, SourceFile} from '../s
 
 export type {AppTomlContent, ExtensionInfo, ManifestFile, SourceFile} from '../scanners/types.js'
 
-export interface AuditCommandResult {
-  stdout: string
-  stderr: string
-  exitCode: number
-}
-
-export type AuditExecutor = (
-  command: string,
-  args: string[],
-  options: {cwd: string; signal: AbortSignal; env: Record<string, string | undefined>},
-) => Promise<AuditCommandResult>
-
 /**
  * A rule defines:
  * - Which capability gates it (skip if not applicable)
@@ -60,6 +48,4 @@ export interface ScanContext {
   detection: ProjectDetection
   /** Path-only inventory, including unsupported source candidates. */
   sourceCandidates: SourceCandidate[]
-  /** Test seam for running audits without invoking a package-manager process. */
-  dependencyAuditExecutor?: AuditExecutor
 }
diff --git a/packages/app/src/cli/services/app-doctor-engine/scanners/discover.ts b/packages/app/src/cli/services/app-doctor-engine/scanners/discover.ts
index 03b49b6c9e9..e8676379371 100644
--- a/packages/app/src/cli/services/app-doctor-engine/scanners/discover.ts
+++ b/packages/app/src/cli/services/app-doctor-engine/scanners/discover.ts
@@ -355,7 +355,6 @@ interface RepositoryReadFailure {
   reason: 'too_large' | 'unreadable'
   sizeBytes?: number
   detail?: string
-  errorCode?: string
 }
 
 type RepositoryReadResult = RepositoryReadSuccess | RepositoryReadFailure
@@ -405,40 +404,30 @@ function readBoundedFile(path: string): RepositoryReadResult {
     // Discovery records unreadable files for trace coverage.
     // eslint-disable-next-line no-catch-all/no-catch-all
   } catch (error) {
-    const errorCode = (error as NodeJS.ErrnoException).code
     return {
       ok: false,
       reason: 'unreadable',
       detail: error instanceof Error ? error.message : String(error),
-      ...(errorCode && /^[A-Z0-9_]+$/.test(errorCode) ? {errorCode} : {}),
     }
   }
 }
 
-function cachedRepositoryFile(appRoot: string, path: string, recordMissing: boolean): RepositoryReadResult {
+function readRepositoryFile(appRoot: string, path: string): RepositoryReadResult {
   const absolutePath = resolvePath(path)
   const cached = repositoryFileCache.get(absolutePath)
   if (cached) return cached
 
   const result = readBoundedFile(absolutePath)
   repositoryFileCache.set(absolutePath, result)
-  if (!result.ok && (recordMissing || result.errorCode !== 'ENOENT')) recordSkippedFile(appRoot, path, result)
+  if (!result.ok) recordSkippedFile(appRoot, path, result)
   return result
 }
 
-function readRepositoryFile(appRoot: string, path: string): RepositoryReadResult {
-  return cachedRepositoryFile(appRoot, path, true)
-}
-
 function readRepositoryText(appRoot: string, path: string): string | undefined {
   const result = readRepositoryFile(appRoot, path)
   return result.ok ? result.content.toString() : undefined
 }
 
-export function readOptionalRepositoryFile(appRoot: string, path: string): RepositoryReadResult {
-  return cachedRepositoryFile(appRoot, path, false)
-}
-
 const SOURCE_LANGUAGES = {
   '.js': {name: 'javascript', supported: true},
   '.jsx': {name: 'javascript', supported: true},
@@ -641,7 +630,6 @@ export function findManifests(appRoot: string, discoveredPaths = findManifestPat
         content,
         dependencies: pkg.dependencies ?? {},
         devDependencies: pkg.devDependencies ?? {},
-        packageManager: typeof pkg.packageManager === 'string' ? pkg.packageManager : undefined,
       })
       // Invalid repository JSON is a coverage gap, not a scanner crash.
       // eslint-disable-next-line no-catch-all/no-catch-all
diff --git a/packages/app/src/cli/services/app-doctor-engine/scanners/index.ts b/packages/app/src/cli/services/app-doctor-engine/scanners/index.ts
index f4816ee85ca..c6a8d0bc98b 100644
--- a/packages/app/src/cli/services/app-doctor-engine/scanners/index.ts
+++ b/packages/app/src/cli/services/app-doctor-engine/scanners/index.ts
@@ -10,7 +10,6 @@ import {
   getSkippedFiles,
   findManifests,
   findManifestPaths,
-  readOptionalRepositoryFile,
 } from './discover.js'
 import {detectCapabilities, detectProject} from '../capabilities/detect.js'
 import {calculateScore, computeScanMetadata} from '../scorer/index.js'
@@ -24,7 +23,6 @@ import {
 } from '../rules/js-rules.js'
 import {scanLiquidSecurity} from '../rules/liquid-rules.js'
 import {redactText, scanCommittedSecrets} from '../rules/secret-rules.js'
-import {auditKnownCves} from '../rules/dependency-rules.js'
 import {scanDeprecatedScriptTagApi} from '../rules/shopify-rules.js'
 import {missingComplianceWebhooks, scanEolApiVersions} from '../rules/compliance-rules.js'
 import {scanAppProxyLiquidInjection} from '../rules/proxy-rules.js'
@@ -36,7 +34,6 @@ import {getEngineVersion} from '../version.js'
 import {basename, joinPath, relativePath} from '@shopify/cli-kit/node/path'
 import {sha256} from '@shopify/cli-kit/node/crypto'
 import {captureOutputWithExitCode} from '@shopify/cli-kit/node/system'
-import type {AuditExecutor} from '../rules/dependency-rules.js'
 import type {Rule, ScanContext} from '../rules/types.js'
 import type {SourceFile} from './types.js'
 import type {
@@ -50,15 +47,7 @@ import type {
   SkippedFile,
 } from '../types.js'
 
-type CheckTarget =
-  | 'config'
-  | 'source'
-  | 'app_source'
-  | 'theme'
-  | 'manifest'
-  | 'secrets'
-  | 'config_and_source'
-  | 'source_and_theme'
+type CheckTarget = 'config' | 'source' | 'app_source' | 'theme' | 'secrets' | 'config_and_source' | 'source_and_theme'
 interface RunnerImplementationResult {
   id: string
   analysisMode: AnalysisMode
@@ -79,7 +68,7 @@ export interface DeterministicCheckDefinition {
   id: string
   version: number
   lifecycle: 'active' | 'planned' | 'investigate'
-  analysisMode: Extract<AnalysisMode, 'regex' | 'structured_config' | 'audit' | 'ast'>
+  analysisMode: Extract<AnalysisMode, 'regex' | 'structured_config' | 'ast'>
   target: CheckTarget
   requires?: keyof ScanContext['capabilities']
   guidance: string
@@ -88,7 +77,6 @@ export interface DeterministicCheckDefinition {
 }
 
 const JAVASCRIPT_EXTENSIONS = ['.js', '.jsx', '.mjs', '.cjs', '.ts', '.tsx', '.mts', '.cts']
-const JAVASCRIPT_LOCKFILES = new Set(['package-lock.json', 'pnpm-lock.yaml', 'yarn.lock'])
 
 const configRule = (rule: Rule, version = 1): DeterministicCheckDefinition => ({
   id: rule.id,
@@ -169,19 +157,6 @@ const DETERMINISTIC_CHECK_DEFINITIONS: ReadonlyArray<DeterministicCheckDefinitio
   },
   jsCheck('CREDENTIAL_LOG_LEAKAGE', (context) => scanCredentialLogLeakage(context.sourceFiles)),
   jsCheck('CREDENTIAL_BROWSER_LEAKAGE', (context) => scanCredentialBrowserLeakage(context.sourceFiles)),
-  {
-    id: 'KNOWN_CVE_IN_DEPENDENCY',
-    version: 3,
-    lifecycle: 'active',
-    analysisMode: 'audit',
-    target: 'manifest',
-    guidance:
-      'Run the matching version 3 dependency prompt for static lockfile review without executing repository-controlled code.',
-    runner: async (context) => {
-      const result = await auditKnownCves(context.appRoot, context.manifests, context.dependencyAuditExecutor)
-      return {issues: result.issues, unresolvedReason: result.unresolvedReason, inspectedFiles: result.inspectedFiles}
-    },
-  },
   {
     id: 'LIQUID_UNSAFE_RENDER',
     version: 1,
@@ -387,7 +362,6 @@ async function gitProject(appRoot: string): Promise<ScanResult['project']> {
 function selectedFiles(definition: DeterministicCheckDefinition, context: ScanContext): string[] {
   const configurations = context.appTomls.map((toml) => relativePath(context.appRoot, toml.path).replace(/\\/g, '/'))
   if (definition.target === 'config') return configurations
-  if (definition.target === 'manifest') return context.manifests.map((manifest) => manifest.path)
   if (definition.target === 'secrets')
     return context.sensitiveFiles.filter((file) => file.content !== undefined).map((file) => file.path)
   let files = definition.target === 'app_source' ? appSourceFiles(context) : reactRouterFiles(context)
@@ -508,7 +482,7 @@ function executionDisposition(
       reason: {code: 'parser_unavailable', message: 'No readable Shopify app configuration was available.'},
     }
   if (
-    ['source', 'app_source', 'theme', 'manifest', 'secrets', 'source_and_theme'].includes(definition.target) &&
+    ['source', 'app_source', 'theme', 'secrets', 'source_and_theme'].includes(definition.target) &&
     files.length === 0
   )
     return {
@@ -536,7 +510,6 @@ function skippedInputsForCheck(
   const isSourcePath = (path: string) =>
     !isThemePath(path) && Boolean(definition.extensions?.some((extension) => path.endsWith(extension)))
   const isConfig = (path: string) => /^shopify\.app(?:\.[^/]+)?\.toml$/.test(path)
-  const isManifest = (path: string) => path.endsWith('package.json')
   const isSecretInput = (file: SkippedFile) =>
     !file.detail?.includes('could not be parsed') &&
     (context.sourceCandidates.some((candidate) => candidate.path === file.path) ||
@@ -549,7 +522,6 @@ function skippedInputsForCheck(
     if (definition.target === 'source' || definition.target === 'app_source') return isSourcePath(file.path)
     if (definition.target === 'theme') return isThemePath(file.path)
     if (definition.target === 'source_and_theme') return isSourcePath(file.path) || isThemePath(file.path)
-    if (definition.target === 'manifest') return isManifest(file.path)
     return isSecretInput(file)
   })
 }
@@ -580,10 +552,7 @@ function normalizeRunnerResult(value: Issue[] | RunnerResult): RunnerResult {
   return Array.isArray(value) ? {issues: value} : value
 }
 
-export async function scan(
-  startPath?: string,
-  options: {dependencyAuditExecutor?: AuditExecutor} = {},
-): Promise<ScanResult> {
+export async function scan(startPath?: string): Promise<ScanResult> {
   const appRoot = findAppRoot(startPath)
   resetSkippedFiles()
   const appTomls = findAppTomls(appRoot)
@@ -618,7 +587,6 @@ export async function scan(
     capabilities,
     detection,
     sourceCandidates,
-    dependencyAuditExecutor: options.dependencyAuditExecutor,
   }
 
   let issues: Issue[] = []
@@ -640,7 +608,7 @@ export async function scan(
           required: true,
           applicable: true,
           reason: {
-            code: definition.analysisMode === 'audit' ? 'audit_unavailable' : 'parser_unavailable',
+            code: 'parser_unavailable',
             message: output.unresolvedReason,
           },
         }
@@ -711,22 +679,10 @@ export async function scan(
   const fileHashMap: Record<string, string> = {}
   for (const file of [...sourceFiles, ...sensitiveFiles])
     if (file.content !== undefined) fileHashMap[redactText(file.path)] = contentDigest(file.content)
-  const auditedLockfiles =
-    checksExecuted
-      .find((execution) => execution.id === 'KNOWN_CVE_IN_DEPENDENCY')
-      ?.inspected_files.filter((path) => JAVASCRIPT_LOCKFILES.has(path)) ?? []
-  const selectedAuditInputs =
-    auditedLockfiles.length === 1
-      ? auditedLockfiles.map((path) => {
-          const input = readOptionalRepositoryFile(appRoot, joinPath(appRoot, path))
-          return {absolutePath: joinPath(appRoot, path), content: input.ok ? input.content : undefined}
-        })
-      : []
   const configFiles = [
     ...appTomls.map((toml) => ({absolutePath: toml.path, content: toml.content})),
     ...extensions.map((extension) => ({absolutePath: joinPath(appRoot, extension.path), content: extension.content})),
     ...manifests.map((manifest) => ({absolutePath: manifest.absolutePath, content: manifest.content})),
-    ...selectedAuditInputs,
   ]
   for (const {absolutePath, content} of configFiles)
     if (content !== undefined) {
diff --git a/packages/app/src/cli/services/app-doctor-engine/scanners/types.ts b/packages/app/src/cli/services/app-doctor-engine/scanners/types.ts
index a2c1fad99e3..eeb7bfbb999 100644
--- a/packages/app/src/cli/services/app-doctor-engine/scanners/types.ts
+++ b/packages/app/src/cli/services/app-doctor-engine/scanners/types.ts
@@ -51,6 +51,4 @@ export interface ManifestFile {
   /** Parsed dependencies, keyed by name with version specifications as values. */
   dependencies: Record<string, string>
   devDependencies?: Record<string, string>
-  /** packageManager declared by package.json, for example pnpm version 10. */
-  packageManager?: string
 }
diff --git a/packages/app/src/cli/services/app-doctor-engine/tests/checks.test.ts b/packages/app/src/cli/services/app-doctor-engine/tests/checks.test.ts
index 93191067373..de209aafcba 100644
--- a/packages/app/src/cli/services/app-doctor-engine/tests/checks.test.ts
+++ b/packages/app/src/cli/services/app-doctor-engine/tests/checks.test.ts
@@ -25,7 +25,6 @@ const EXPECTED_CHECK_IDS = [
   'EOL_API_VERSION',
   'EXPIRING_OFFLINE_TOKEN',
   'INSECURE_WEBHOOK_URL',
-  'KNOWN_CVE_IN_DEPENDENCY',
   'LIQUID_UNSAFE_RENDER',
   'METAFIELD_OFFLINE_TOKEN',
   'MISSING_AUTHORIZATION_CHECK',
@@ -82,7 +81,7 @@ describe('check loading', () => {
   test('loads all versioned checks with frontmatter parsed', () => {
     const checks = loadChecks()
     expect([...checks.keys()]).toEqual(EXPECTED_CHECK_IDS)
-    expect(checks.size).toBe(34)
+    expect(checks.size).toBe(33)
     const tenant = checks.get('MISSING_TENANT_ISOLATION')
     expect(tenant).toBeDefined()
     expect(tenant!.version).toBeGreaterThanOrEqual(1)
@@ -109,7 +108,7 @@ describe('review pack', () => {
   test('contains prompts, not candidates', () => {
     const pack = buildReviewPack('0.1.0')
     expect(pack.checks.map((check) => check.id)).toEqual(EXPECTED_CHECK_IDS)
-    expect(pack.checks).toHaveLength(34)
+    expect(pack.checks).toHaveLength(33)
     expect((pack as unknown as Record<string, unknown>).candidates).toBeUndefined()
     const tenant = pack.checks.find((c) => c.id === 'MISSING_TENANT_ISOLATION')
     expect(tenant).toBeDefined()
@@ -137,7 +136,6 @@ describe('review pack', () => {
     expect(checks.get('APP_PROXY_UNVERIFIED_SIGNATURE')!.prompt).toContain('victim-signed request path')
     expect(checks.get('OVERBROAD_DATA_ACCESS')!.prompt).toContain('public shop domains')
     expect(checks.get('UNSAFE_INNERHTML')!.prompt).toContain('email and PDF rendering')
-    expect(checks.get('KNOWN_CVE_IN_DEPENDENCY')!.prompt).toContain('vulnerable API or helper')
     expect(checks.get('OPEN_REDIRECT')!.prompt).toContain('sensitive trust transition')
     expect(checks.get('CSRF_MISSING_PROTECTION')!.prompt).toContain('concrete sensitive action')
     expect(checks.get('MISSING_EMBEDDED_CSP')!.prompt).toContain('concrete clickjacking impact')
diff --git a/packages/app/src/cli/services/app-doctor-engine/tests/deterministic-rules.test.ts b/packages/app/src/cli/services/app-doctor-engine/tests/deterministic-rules.test.ts
index 339c4b32080..0b5cadb715d 100644
--- a/packages/app/src/cli/services/app-doctor-engine/tests/deterministic-rules.test.ts
+++ b/packages/app/src/cli/services/app-doctor-engine/tests/deterministic-rules.test.ts
@@ -1,4 +1,3 @@
-/* eslint-disable no-restricted-imports -- deterministic scanners use real temporary repositories */
 import {getRegistry} from '../registry/index.js'
 import {DETERMINISTIC_CHECKS} from '../scanners/index.js'
 import {RULE_CATALOG} from '../rules/catalog.js'
@@ -11,13 +10,9 @@ import {
   scanUnsafeInnerHTML,
 } from '../rules/js-rules.js'
 import {scanLiquidSecurity} from '../rules/liquid-rules.js'
-import {auditKnownCves, parseAuditOutput} from '../rules/dependency-rules.js'
 import {scanStaticFrameAncestors} from '../rules/csp-rules.js'
 import {describe, expect, test} from 'vitest'
-import {mkdtemp, rm, writeFile} from 'node:fs/promises'
-import {join} from 'node:path'
-import {tmpdir} from 'node:os'
-import type {ManifestFile, SourceFile} from '../rules/types.js'
+import type {SourceFile} from '../rules/types.js'
 
 const ACTIVE_IDS = [
   'MISSING_COMPLIANCE_WEBHOOKS',
@@ -30,7 +25,6 @@ const ACTIVE_IDS = [
   'COMMITTED_SECRET',
   'CREDENTIAL_LOG_LEAKAGE',
   'CREDENTIAL_BROWSER_LEAKAGE',
-  'KNOWN_CVE_IN_DEPENDENCY',
   'LIQUID_UNSAFE_RENDER',
   'UNSAFE_INNERHTML',
   'APP_PROXY_LIQUID_INJECTION',
@@ -45,7 +39,7 @@ const source = (content: string, path = 'app/routes/example.tsx'): SourceFile =>
 })
 
 describe('deterministic rules product contract', () => {
-  test('has exactly fifteen active executable deterministic identities', () => {
+  test('has exactly fourteen active executable deterministic identities', () => {
     expect([...DETERMINISTIC_CHECKS.keys()].sort()).toEqual(ACTIVE_IDS)
     expect([...DETERMINISTIC_CHECKS.values()].every((check) => check.lifecycle === 'active' && check.runner)).toBe(true)
     const registry = getRegistry()
@@ -337,52 +331,3 @@ describe('Liquid AST mode', () => {
     ])
   })
 })
-
-describe('package-manager audit', () => {
-  test('parses npm and yarn machine output', () => {
-    expect(parseAuditOutput(JSON.stringify({vulnerabilities: {lodash: {severity: 'high'}}}), 'npm')).toEqual([
-      {packageName: 'lodash', severity: 'high', cves: [], topLevelParents: []},
-    ])
-    expect(parseAuditOutput('{not-json', 'npm')).toBeNull()
-    expect(
-      parseAuditOutput(
-        `${JSON.stringify({type: 'auditAdvisory', data: {advisory: {module_name: 'x', severity: 'medium'}}})}\n${JSON.stringify({type: 'auditSummary', data: {}})}`,
-        'yarn',
-      ),
-    ).toEqual([{packageName: 'x', severity: 'medium', cves: [], topLevelParents: []}])
-  })
-
-  test('uses an injected non-mutating executor and surfaces operational failure', async () => {
-    const directory = await mkdtemp(join(tmpdir(), 'app-doctor-audit-'))
-    try {
-      await writeFile(join(directory, 'package-lock.json'), '{}')
-      const manifest: ManifestFile = {
-        path: 'package.json',
-        absolutePath: join(directory, 'package.json'),
-        type: 'npm',
-        dependencies: {},
-      }
-      const success = await auditKnownCves(directory, [manifest], async (command, args, options) => {
-        expect(command).toBe('npm')
-        expect(args.slice(0, 2)).toEqual(['audit', '--json'])
-        expect(args).toContain('--omit=dev')
-        expect(args).toContain('--ignore-scripts')
-        expect(args).toContain('--registry=https://registry.npmjs.org/')
-        expect(options.env.NPM_CONFIG_USERCONFIG).toBeTruthy()
-        expect(options.env.NPM_CONFIG_GLOBALCONFIG).toBeTruthy()
-        expect(options.env.NPM_CONFIG_USERCONFIG).not.toBe(options.env.NPM_CONFIG_GLOBALCONFIG)
-        return {stdout: JSON.stringify({vulnerabilities: {lodash: {severity: 'high'}}}), stderr: '', exitCode: 1}
-      })
-      expect(success.issues.map((finding) => finding.id)).toEqual(['KNOWN_CVE_IN_DEPENDENCY'])
-      expect(success.issues[0]?.title).toBe('lodash has a high vulnerability')
-      const failure = await auditKnownCves(directory, [manifest], async () => ({
-        stdout: 'bad',
-        stderr: 'network unavailable',
-        exitCode: 1,
-      }))
-      expect(failure.unresolvedReason).toMatch(/unusable output/)
-    } finally {
-      await rm(directory, {recursive: true, force: true})
-    }
-  })
-})
diff --git a/packages/app/src/cli/services/app-doctor-engine/tests/discovery-safety.test.ts b/packages/app/src/cli/services/app-doctor-engine/tests/discovery-safety.test.ts
index 4044323e4d7..0c5a1ee4262 100644
--- a/packages/app/src/cli/services/app-doctor-engine/tests/discovery-safety.test.ts
+++ b/packages/app/src/cli/services/app-doctor-engine/tests/discovery-safety.test.ts
@@ -6,15 +6,9 @@ import {afterEach, describe, expect, test} from 'vitest'
 import {mkdir, mkdtemp, rm, writeFile} from 'node:fs/promises'
 import {tmpdir} from 'node:os'
 import {join} from 'node:path'
-import type {AuditExecutor} from '../rules/dependency-rules.js'
 
 const temporaryDirectories: string[] = []
 const appConfiguration = 'name = "Discovery safety"\napplication_url = "https://example.com"\n'
-const harmlessAudit: AuditExecutor = async () => ({
-  stdout: JSON.stringify({metadata: {vulnerabilities: {total: 0}}}),
-  stderr: '',
-  exitCode: 0,
-})
 
 afterEach(async () => {
   await Promise.all(temporaryDirectories.splice(0).map((directory) => rm(directory, {recursive: true, force: true})))
@@ -168,44 +162,3 @@ describe('repository discovery exclusions', () => {
     )
   })
 })
-
-describe('dependency audit input hashes', () => {
-  for (const [manager, lockfile, content] of [
-    ['npm@10.0.0', 'package-lock.json', '{"lockfileVersion":3}'],
-    ['pnpm@10.0.0', 'pnpm-lock.yaml', 'lockfileVersion: 9'],
-    ['yarn@4.1.0', 'yarn.lock', '# yarn lock'],
-  ] as const) {
-    test(`hashes the selected ${lockfile} bytes`, async () => {
-      const root = await makeDirectory()
-      await writeFiles(root, {
-        'shopify.app.toml': appConfiguration,
-        'package.json': JSON.stringify({packageManager: manager}),
-        [lockfile]: content,
-      })
-      const options = {dependencyAuditExecutor: harmlessAudit}
-      const before = await scan(root, options)
-      await writeFile(join(root, lockfile), `${content}\nchanged`)
-      const after = await scan(root, options)
-
-      expect(before.scan.file_hashes?.[lockfile]).toMatch(/^sha256:[0-9a-f]{64}$/)
-      expect(after.scan.file_hashes?.[lockfile]).not.toBe(before.scan.file_hashes?.[lockfile])
-      expect(after.scan.input_hash).not.toBe(before.scan.input_hash)
-    })
-  }
-
-  test('hashes only the lockfile selected by packageManager when candidates coexist', async () => {
-    const root = await makeDirectory()
-    await writeFiles(root, {
-      'shopify.app.toml': appConfiguration,
-      'package.json': JSON.stringify({packageManager: 'yarn@4.1.0'}),
-      'package-lock.json': '{"lockfileVersion":3}',
-      'pnpm-lock.yaml': 'lockfileVersion: 9',
-      'yarn.lock': '# selected yarn lock',
-    })
-    const result = await scan(root, {dependencyAuditExecutor: harmlessAudit})
-
-    expect(result.scan.file_hashes).toHaveProperty('yarn.lock')
-    expect(result.scan.file_hashes).not.toHaveProperty('package-lock.json')
-    expect(result.scan.file_hashes).not.toHaveProperty('pnpm-lock.yaml')
-  })
-})
diff --git a/packages/app/src/cli/services/app-doctor-engine/tests/fixtures/submission-forbidden-values.json b/packages/app/src/cli/services/app-doctor-engine/tests/fixtures/submission-forbidden-values.json
index 175419b85fd..c453dea7a85 100644
--- a/packages/app/src/cli/services/app-doctor-engine/tests/fixtures/submission-forbidden-values.json
+++ b/packages/app/src/cli/services/app-doctor-engine/tests/fixtures/submission-forbidden-values.json
@@ -4,7 +4,7 @@
   "web/package.json",
   "extensions/private.liquid",
   "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-  "LEAK_MESSAGE_DEPENDENCY_CHAIN",
+  "LEAK_DETERMINISTIC_MESSAGE",
   "LEAK_EVIDENCE_QUOTE",
   "LEAK_CODE_SNIPPET",
   "LEAK_FIX_DESCRIPTION",
diff --git a/packages/app/src/cli/services/app-doctor-engine/tests/fixtures/submission-trace.ts b/packages/app/src/cli/services/app-doctor-engine/tests/fixtures/submission-trace.ts
index df578935ce8..122a2e5c9fb 100644
--- a/packages/app/src/cli/services/app-doctor-engine/tests/fixtures/submission-trace.ts
+++ b/packages/app/src/cli/services/app-doctor-engine/tests/fixtures/submission-trace.ts
@@ -50,13 +50,13 @@ const traceWithLeakageSentinels = {
     {
       fingerprint: deterministicFingerprint,
       source: 'deterministic',
-      rule_id: 'KNOWN_CVE_IN_DEPENDENCY',
+      rule_id: 'UNSAFE_INNERHTML',
       rule_version: 2,
       severity: 'high',
-      title: 'Vulnerable package lodash (CVE-2026-0001)',
-      message: 'LEAK_MESSAGE_DEPENDENCY_CHAIN',
-      location: {file: 'web/package.json', line: 12},
-      evidence: [{location: {file: 'web/package.json', line: 12}, quote: 'LEAK_EVIDENCE_QUOTE'}],
+      title: 'Unsafe HTML assignment',
+      message: 'LEAK_DETERMINISTIC_MESSAGE',
+      location: {file: 'web/app/routes/private.ts', line: 12},
+      evidence: [{location: {file: 'web/app/routes/private.ts', line: 12}, quote: 'LEAK_EVIDENCE_QUOTE'}],
       snippet: 'LEAK_CODE_SNIPPET',
       fix: {automated: false, guide: 'https://example.com/private-fix', description: 'LEAK_FIX_DESCRIPTION'},
       suppressed: true,
@@ -94,7 +94,7 @@ const traceWithLeakageSentinels = {
   ],
   checks_executed: [
     {
-      id: 'KNOWN_CVE_IN_DEPENDENCY',
+      id: 'UNSAFE_INNERHTML',
       version: 2,
       kind: 'deterministic',
       status: 'executed',
@@ -103,17 +103,17 @@ const traceWithLeakageSentinels = {
       languages: ['typescript'],
       framework: 'react_router',
       surface: 'mixed',
-      inspected_files: ['web/package.json'],
+      inspected_files: ['web/app/routes/private.ts'],
       findings: 1,
-      analysis_mode: 'audit',
+      analysis_mode: 'regex',
       prompt: 'LEAK_DETERMINISTIC_PROMPT',
       guidance: 'LEAK_DETERMINISTIC_GUIDANCE',
       implementations: [
         {
-          id: 'npm-audit',
-          analysis_mode: 'audit',
+          id: 'react-router-js-regex',
+          analysis_mode: 'regex',
           status: 'executed',
-          inspected_files: ['web/package.json'],
+          inspected_files: ['web/app/routes/private.ts'],
           findings: 1,
         },
       ],
diff --git a/packages/app/src/cli/services/app-doctor-engine/tests/fixtures/submission.json b/packages/app/src/cli/services/app-doctor-engine/tests/fixtures/submission.json
index 5aed363aed3..85c1cc54eb4 100644
--- a/packages/app/src/cli/services/app-doctor-engine/tests/fixtures/submission.json
+++ b/packages/app/src/cli/services/app-doctor-engine/tests/fixtures/submission.json
@@ -28,11 +28,11 @@
     },
     "findings": [
       {
-        "fingerprint": "sha256:298c67d67fe725a4636e1650ef5ff8149dac7d911d647b566073b3ff7a7614aa",
+        "fingerprint": "sha256:8bfe4e8f36ca45199354ef12f217c041e1d682d30e1c4a0ccd08bef080eaf7c5",
         "source": "deterministic",
         "severity": "high",
-        "title": "Vulnerable package lodash (CVE-2026-0001)",
-        "rule_id": "KNOWN_CVE_IN_DEPENDENCY",
+        "title": "Unsafe HTML assignment",
+        "rule_id": "UNSAFE_INNERHTML",
         "rule_version": 2,
         "suppressed": true,
         "suppression_id": "accepted-migration-risk"
@@ -59,19 +59,19 @@
     ],
     "checks_executed": [
       {
-        "id": "KNOWN_CVE_IN_DEPENDENCY",
+        "id": "UNSAFE_INNERHTML",
         "version": 2,
         "kind": "deterministic",
         "status": "executed",
         "required": true,
         "applicable": true,
-        "analysis_mode": "audit",
+        "analysis_mode": "regex",
         "finding_count": 1,
         "inspected_file_count": 1,
         "implementations": [
           {
-            "id": "npm-audit",
-            "analysis_mode": "audit",
+            "id": "react-router-js-regex",
+            "analysis_mode": "regex",
             "status": "executed",
             "finding_count": 1,
             "inspected_file_count": 1
@@ -130,7 +130,7 @@
     "suppressions": [
       {
         "id": "accepted-migration-risk",
-        "finding_fingerprint": "sha256:298c67d67fe725a4636e1650ef5ff8149dac7d911d647b566073b3ff7a7614aa",
+        "finding_fingerprint": "sha256:8bfe4e8f36ca45199354ef12f217c041e1d682d30e1c4a0ccd08bef080eaf7c5",
         "provenance": {"source": "human", "created_at": "2026-08-31T11:00:00.000Z"}
       }
     ],
@@ -141,7 +141,7 @@
       "gaps": [{"code": "skipped_file"}, {"code": "unresolved_check", "check_id": "UNREPORTED_AGENT_CHECK"}]
     },
     "attestation": {
-      "trace_digest": "sha256:d21dc8ca875f71ef87c386edcef6f6b97df81719425c7a398d430d32034064cc"
+      "trace_digest": "sha256:59f98a434b24a9b6e9fd08337fb29c0986cc677718d557d0d97531b2df1690c5"
     }
   }
 }
diff --git a/packages/app/src/cli/services/app-doctor-engine/tests/rule-analysis.test.ts b/packages/app/src/cli/services/app-doctor-engine/tests/rule-analysis.test.ts
index 63716fd617d..aca081967be 100644
--- a/packages/app/src/cli/services/app-doctor-engine/tests/rule-analysis.test.ts
+++ b/packages/app/src/cli/services/app-doctor-engine/tests/rule-analysis.test.ts
@@ -1,6 +1,4 @@
-/* eslint-disable no-restricted-imports -- scanners are tested with real temporary repositories */
 import {scanEolApiVersions, isEolApiVersion} from '../rules/compliance-rules.js'
-import {auditKnownCves, executeAuditCommand, parseAuditOutput} from '../rules/dependency-rules.js'
 import {
   scanCredentialBrowserLeakage,
   scanCredentialLogLeakage,
@@ -11,11 +9,9 @@ import {scanLiquidSecurity} from '../rules/liquid-rules.js'
 import {scanDeprecatedScriptTagApi} from '../rules/shopify-rules.js'
 import {scanAppProxyLiquidInjection} from '../rules/proxy-rules.js'
 import {scanExpiringOfflineTokens} from '../rules/token-rules.js'
-import {describe, expect, test, vi} from 'vitest'
-import {mkdtemp, readFile, rm, writeFile} from 'node:fs/promises'
-import {delimiter, extname, join, relative} from 'node:path'
-import {tmpdir} from 'node:os'
-import type {ManifestFile, ScanContext, SourceFile} from '../rules/types.js'
+import {extname} from '@shopify/cli-kit/node/path'
+import {describe, expect, test} from 'vitest'
+import type {ScanContext, SourceFile} from '../rules/types.js'
 
 const source = (content: string, path = 'app/routes/example.tsx'): SourceFile => ({
   path,
@@ -24,25 +20,6 @@ const source = (content: string, path = 'app/routes/example.tsx'): SourceFile =>
   content,
 })
 
-function processExists(pid: number): boolean {
-  try {
-    process.kill(pid, 0)
-    return true
-  } catch (error) {
-    const code = (error as NodeJS.ErrnoException).code
-    if (code === 'ESRCH' || code === 'EINVAL') return false
-    if (code === 'EPERM') return true
-    throw error
-  }
-}
-
-const javascriptManifest = (directory: string): ManifestFile => ({
-  path: 'package.json',
-  absolutePath: join(directory, 'package.json'),
-  type: 'npm',
-  dependencies: {},
-})
-
 function context(
   input: {
     files?: SourceFile[]
@@ -609,474 +586,6 @@ describe('EXPIRING_OFFLINE_TOKEN supported React Router analysis', () => {
   })
 })
 
-describe('dependency audit selection and output handling', () => {
-  test('packageManager selects one conflicting lockfile and uses correct commands', async () => {
-    const directory = await mkdtemp(join(tmpdir(), 'app-doctor-audit-selection-'))
-    try {
-      await Promise.all([
-        writeFile(join(directory, 'package-lock.json'), '{}'),
-        writeFile(join(directory, 'pnpm-lock.yaml'), 'lockfileVersion: 9'),
-        writeFile(join(directory, 'yarn.lock'), '# lock'),
-      ])
-      const run = async (
-        packageManager: string,
-        expectedCommand: string,
-        expectedArgs: string[],
-        stdout = JSON.stringify({metadata: {vulnerabilities: {total: 0}}}),
-      ) => {
-        const manifest: ManifestFile = {
-          path: 'package.json',
-          absolutePath: join(directory, 'package.json'),
-          type: 'npm',
-          dependencies: {},
-          packageManager,
-        }
-        const result = await auditKnownCves(directory, [manifest], async (command, args, options) => {
-          expect(command).toBe(expectedCommand)
-          expect(args.slice(0, expectedArgs.length)).toEqual(expectedArgs)
-          if (command === 'npm') expect(args).toContain('--omit=dev')
-          if (command === 'pnpm') expect(args).toContain('--prod')
-          if (command === 'yarn') expect(args.slice(2, 4)).toEqual(['--groups', 'dependencies'])
-          if (command === 'corepack') expect(args.slice(-2)).toEqual(['--environment', 'production'])
-          expect(options.cwd).not.toBe(directory)
-          expect(options.env).not.toHaveProperty('NODE_AUTH_TOKEN')
-          expect(options.env.NPM_CONFIG_REGISTRY).toBe('https://registry.npmjs.org/')
-          expect(options.env.NPM_CONFIG_IGNORE_SCRIPTS).toBe('true')
-          return {stdout, stderr: '', exitCode: 0}
-        })
-        expect(result.unresolvedReason).toBeUndefined()
-        expect(result.inspectedFiles).toHaveLength(2)
-      }
-      await run('npm@10.0.0', 'npm', ['audit', '--json'])
-      await run('pnpm@10.0.0', 'pnpm', ['audit', '--json'])
-      await run(
-        'yarn@1.22.22',
-        'yarn',
-        ['audit', '--json'],
-        JSON.stringify({type: 'auditSummary', data: {vulnerabilities: {}}}),
-      )
-      await run(
-        'yarn@4.1.0',
-        'corepack',
-        ['yarn@4.1.0', 'npm', 'audit', '--all', '--json'],
-        JSON.stringify({children: {}}),
-      )
-    } finally {
-      await rm(directory, {recursive: true, force: true})
-    }
-  })
-
-  test('isolates package-manager audit from repository config, scripts, and secret environment', async () => {
-    const directory = await mkdtemp(join(tmpdir(), 'app-doctor-audit-boundary-'))
-    vi.stubEnv('SHOPIFY_TEST_AUDIT_SECRET', 'must-not-cross-audit-boundary')
-    vi.stubEnv('PATH', `${join(directory, 'node_modules', '.bin')}${delimiter}${process.env.PATH ?? ''}`)
-    try {
-      await Promise.all([
-        writeFile(join(directory, 'yarn.lock'), '# exact selected lock bytes\n'),
-        writeFile(join(directory, '.yarnrc.yml'), 'yarnPath: ./malicious.cjs\nplugins:\n  - ./malicious.cjs\n'),
-        writeFile(join(directory, 'malicious.cjs'), 'throw new Error("repository script executed")\n'),
-        writeFile(
-          join(directory, 'package.json'),
-          JSON.stringify({
-            scripts: {preaudit: 'node malicious.cjs'},
-            packageManager: 'yarn@4.1.0',
-            dependencies: {local: `file:${directory}`, remote: 'https://registry.invalid/package.tgz'},
-          }),
-        ),
-      ])
-      const manifest: ManifestFile = {
-        path: 'package.json',
-        absolutePath: join(directory, 'package.json'),
-        type: 'npm',
-        content: JSON.stringify({scripts: {preaudit: 'node malicious.cjs'}, packageManager: 'yarn@4.1.0'}),
-        dependencies: {
-          safe: '1.0.0',
-          local: `file:${directory}`,
-          remote: 'https://registry.invalid/package.tgz',
-        },
-        packageManager: 'yarn@4.1.0',
-      }
-      let sandboxPath = ''
-      const result = await auditKnownCves(directory, [manifest], async (command, args, options) => {
-        sandboxPath = options.cwd
-        expect(command).toBe('corepack')
-        expect(args).toEqual(['yarn@4.1.0', 'npm', 'audit', '--all', '--json', '--environment', 'production'])
-        expect(relative(directory, options.cwd).startsWith('..')).toBe(true)
-        expect(options.env.PATH).not.toContain(directory)
-        await expect(readFile(join(options.cwd, 'yarn.lock'), 'utf8')).resolves.toBe('# exact selected lock bytes\n')
-        const sandboxManifest = JSON.parse(await readFile(join(options.cwd, 'package.json'), 'utf8'))
-        expect(sandboxManifest).not.toHaveProperty('scripts')
-        expect(sandboxManifest.packageManager).toBe('yarn@4.1.0')
-        expect(sandboxManifest.dependencies).toEqual({safe: '1.0.0'})
-        await expect(readFile(join(options.cwd, '.yarnrc.yml'), 'utf8')).rejects.toThrow()
-        await expect(readFile(join(options.cwd, 'malicious.cjs'), 'utf8')).rejects.toThrow()
-        expect(options.env).not.toHaveProperty('SHOPIFY_TEST_AUDIT_SECRET')
-        expect(options.env).not.toHaveProperty('NODE_OPTIONS')
-        expect(options.env.HOME).not.toBe(process.env.HOME)
-        expect(options.env.YARN_IGNORE_PATH).toBe('1')
-        expect(options.env.YARN_ENABLE_SCRIPTS).toBe('false')
-        expect(options.env.YARN_NPM_REGISTRY_SERVER).toBe('https://registry.npmjs.org/')
-        return {stdout: JSON.stringify({children: {}}), stderr: '', exitCode: 0}
-      })
-      expect(result.unresolvedReason).toBeUndefined()
-      await expect(readFile(join(sandboxPath, 'package.json'), 'utf8')).rejects.toThrow()
-    } finally {
-      vi.unstubAllEnvs()
-      await rm(directory, {recursive: true, force: true})
-    }
-  })
-
-  test('enforces timeout when an executor ignores AbortSignal', async () => {
-    const directory = await mkdtemp(join(tmpdir(), 'app-doctor-audit-timeout-'))
-    try {
-      await writeFile(join(directory, 'package-lock.json'), '{}')
-      const manifest: ManifestFile = {
-        path: 'package.json',
-        absolutePath: join(directory, 'package.json'),
-        type: 'npm',
-        dependencies: {},
-      }
-      const started = Date.now()
-      const result = await auditKnownCves(directory, [manifest], () => new Promise(() => {}), 10)
-      expect(result.unresolvedReason).toBe('Dependency audit timed out.')
-      expect(Date.now() - started).toBeLessThan(1000)
-    } finally {
-      await rm(directory, {recursive: true, force: true})
-    }
-  })
-
-  test('bounds noisy audit output without hanging', async () => {
-    const directory = await mkdtemp(join(tmpdir(), 'app-doctor-audit-noisy-'))
-    try {
-      await writeFile(join(directory, 'package-lock.json'), '{}')
-      const started = Date.now()
-      const result = await auditKnownCves(
-        directory,
-        [javascriptManifest(directory)],
-        (_command, _args, options) =>
-          executeAuditCommand(
-            process.execPath,
-            [
-              '-e',
-              `
-setInterval(() => {
-  process.stdout.write('x'.repeat(65536))
-  process.stderr.write('x'.repeat(65536))
-}, 10)
-`,
-            ],
-            options,
-          ),
-        400,
-      )
-      expect(result.issues).toEqual([])
-      expect(result.unresolvedReason).toMatch(/timed out|unusable output/)
-      expect(Date.now() - started).toBeLessThan(4000)
-    } finally {
-      await rm(directory, {recursive: true, force: true})
-    }
-  })
-
-  test('kills descendant audit processes before removing the sandbox', async () => {
-    const directory = await mkdtemp(join(tmpdir(), 'app-doctor-audit-tree-'))
-    const pidFile = join(directory, 'descendant.pid')
-    try {
-      await writeFile(join(directory, 'package-lock.json'), '{}')
-      const result = await auditKnownCves(
-        directory,
-        [javascriptManifest(directory)],
-        (_command, _args, options) =>
-          executeAuditCommand(
-            process.execPath,
-            [
-              '-e',
-              `
-const {spawn} = require('node:child_process')
-const {writeFileSync} = require('node:fs')
-const child = spawn(${JSON.stringify(process.execPath)}, ['-e', 'setInterval(() => {}, 1000)'], {stdio: 'ignore'})
-writeFileSync(${JSON.stringify(pidFile)}, String(child.pid))
-setInterval(() => {}, 1000)
-`,
-            ],
-            options,
-          ),
-        400,
-      )
-      expect(result.unresolvedReason).toBe('Dependency audit timed out.')
-      const pid = Number(await readFile(pidFile, 'utf8'))
-      expect(Number.isInteger(pid)).toBe(true)
-      await expect.poll(() => processExists(pid), {timeout: 3000}).toBe(false)
-    } finally {
-      await rm(directory, {recursive: true, force: true})
-    }
-  })
-
-  test('parses package-manager fixtures and separates advisories from failures', async () => {
-    expect(
-      parseAuditOutput(
-        JSON.stringify({advisories: {'1': {module_name: 'pnpm-package', severity: 'moderate'}}}),
-        'pnpm',
-      ),
-    ).toEqual([{packageName: 'pnpm-package', severity: 'moderate', cves: [], topLevelParents: []}])
-    expect(
-      parseAuditOutput(
-        JSON.stringify({children: {one: {ident: 'berry-package', severity: 'critical', children: {}}}}),
-        'yarn-berry',
-      ),
-    ).toEqual([{packageName: 'berry-package', severity: 'critical', cves: [], topLevelParents: []}])
-    expect(
-      parseAuditOutput(
-        JSON.stringify({value: 'tree-package', children: {Issue: 'advisory', Severity: 'high'}}),
-        'yarn-berry',
-      ),
-    ).toEqual([{packageName: 'tree-package', severity: 'high', cves: [], topLevelParents: []}])
-    expect(parseAuditOutput(JSON.stringify({error: {code: 'ENETUNREACH'}}), 'npm')).toBeNull()
-
-    const directory = await mkdtemp(join(tmpdir(), 'app-doctor-audit-severity-'))
-    try {
-      await writeFile(join(directory, 'package-lock.json'), '{}')
-      const manifest: ManifestFile = {
-        path: 'package.json',
-        absolutePath: join(directory, 'package.json'),
-        type: 'npm',
-        dependencies: {},
-      }
-      const result = await auditKnownCves(directory, [manifest], async () => ({
-        stdout: JSON.stringify({
-          vulnerabilities: {
-            criticalPackage: {severity: 'critical'},
-            moderatePackage: {severity: 'moderate'},
-            infoPackage: {severity: 'info'},
-          },
-        }),
-        stderr: '',
-        exitCode: 1,
-      }))
-      expect(result.issues.map(({severity, points}) => ({severity, points}))).toEqual([
-        {severity: 'high', points: -20},
-        {severity: 'medium', points: -10},
-        {severity: 'low', points: -5},
-      ])
-      expect(result.issues.every((finding) => finding.location.file === 'package-lock.json')).toBe(true)
-
-      const operational = await auditKnownCves(directory, [manifest], async () => ({
-        stdout: JSON.stringify({metadata: {vulnerabilities: {total: 0}}}),
-        stderr: 'offline',
-        exitCode: 1,
-      }))
-      expect(operational.unresolvedReason).toMatch(/operationally/)
-    } finally {
-      await rm(directory, {recursive: true, force: true})
-    }
-  })
-
-  test('collapses same-package advisories and puts CVE identity in the default title', async () => {
-    const directory = await mkdtemp(join(tmpdir(), 'app-doctor-audit-collapse-'))
-    try {
-      await writeFile(join(directory, 'package-lock.json'), '{}')
-      const manifest: ManifestFile = {
-        path: 'package.json',
-        absolutePath: join(directory, 'package.json'),
-        type: 'npm',
-        dependencies: {lodash: '4.17.23'},
-      }
-      const result = await auditKnownCves(directory, [manifest], async () => ({
-        stdout: JSON.stringify({
-          vulnerabilities: {
-            lodash: {
-              severity: 'high',
-              via: [
-                {
-                  title: 'lodash template injection',
-                  url: 'https://github.com/advisories/GHSA-r5fr-rjxr-66jc',
-                  cves: ['CVE-2026-4800'],
-                  severity: 'high',
-                },
-                {
-                  title: 'lodash prototype pollution',
-                  url: 'https://github.com/advisories/GHSA-f23m-r3pf-42rh',
-                  cves: ['CVE-2026-2950'],
-                  severity: 'moderate',
-                },
-              ],
-            },
-          },
-        }),
-        stderr: '',
-        exitCode: 1,
-      }))
-      expect(result.unresolvedReason).toBeUndefined()
-      expect(result.issues).toHaveLength(1)
-      expect(result.issues[0]).toMatchObject({
-        id: 'KNOWN_CVE_IN_DEPENDENCY',
-        severity: 'high',
-        points: -20,
-        title: 'lodash has a high vulnerability (CVE-2026-4800 + 1 more)',
-        location: {file: 'package-lock.json'},
-      })
-      expect(result.issues[0]?.message).toContain('CVE-2026-4800')
-      expect(result.issues[0]?.message).toContain('CVE-2026-2950')
-    } finally {
-      await rm(directory, {recursive: true, force: true})
-    }
-  })
-
-  test('drops dev-only lockfile hits, collapses remaining packages, and treats zero production vulns as clean', async () => {
-    const directory = await mkdtemp(join(tmpdir(), 'app-doctor-audit-prod-'))
-    try {
-      await writeFile(join(directory, 'pnpm-lock.yaml'), 'lockfileVersion: 9')
-      const manifest: ManifestFile = {
-        path: 'package.json',
-        absolutePath: join(directory, 'package.json'),
-        type: 'npm',
-        packageManager: 'pnpm@10.0.0',
-        dependencies: {prisma: '^6.16.3'},
-        devDependencies: {
-          '@typescript-eslint/eslint-plugin': '^6.21.0',
-          '@shopify/api-codegen-preset': '^2.0.0',
-        },
-      }
-      const pnpmReport = {
-        advisories: {
-          '1113465': {
-            module_name: 'minimatch',
-            severity: 'high',
-            cves: ['CVE-2026-26996'],
-            url: 'https://github.com/advisories/GHSA-3ppc-4f35-3m26',
-            findings: [
-              {
-                paths: ['.>@typescript-eslint/eslint-plugin>@typescript-eslint/typescript-estree>minimatch'],
-              },
-            ],
-          },
-          '1113544': {
-            module_name: 'minimatch',
-            severity: 'high',
-            cves: ['CVE-2026-27903'],
-            findings: [
-              {
-                paths: ['.>@typescript-eslint/eslint-plugin>@typescript-eslint/typescript-estree>minimatch'],
-              },
-            ],
-          },
-          '1113552': {
-            module_name: 'minimatch',
-            severity: 'high',
-            cves: ['CVE-2026-27904'],
-            findings: [
-              {
-                paths: ['.>@typescript-eslint/eslint-plugin>@typescript-eslint/typescript-estree>minimatch'],
-              },
-            ],
-          },
-          '1115806': {
-            module_name: 'lodash',
-            severity: 'high',
-            cves: ['CVE-2026-4800'],
-            findings: [
-              {
-                paths: ['.>@shopify/api-codegen-preset>@graphql-codegen/cli>lodash'],
-              },
-            ],
-          },
-          '1115810': {
-            module_name: 'lodash',
-            severity: 'moderate',
-            cves: ['CVE-2026-2950'],
-            findings: [
-              {
-                paths: ['.>@shopify/api-codegen-preset>@graphql-codegen/cli>lodash'],
-              },
-            ],
-          },
-          '1145093': {
-            module_name: 'deepmerge-ts',
-            severity: 'high',
-            cves: ['CVE-2026-40345'],
-            findings: [{paths: ['.>prisma>@prisma/config>deepmerge-ts']}],
-          },
-        },
-      }
-      const result = await auditKnownCves(directory, [manifest], async (command, args) => {
-        expect(command).toBe('pnpm')
-        expect(args).toContain('--prod')
-        return {stdout: JSON.stringify(pnpmReport), stderr: '', exitCode: 1}
-      })
-      expect(result.unresolvedReason).toBeUndefined()
-      expect(result.issues).toHaveLength(1)
-      expect(result.issues[0]).toMatchObject({
-        id: 'KNOWN_CVE_IN_DEPENDENCY',
-        severity: 'high',
-        points: -20,
-        title: 'deepmerge-ts has a high vulnerability (CVE-2026-40345)',
-        location: {file: 'pnpm-lock.yaml'},
-      })
-      expect(result.issues[0]?.message).toContain('Pulled in via prisma')
-
-      const clean = await auditKnownCves(directory, [manifest], async () => ({
-        stdout: JSON.stringify({
-          advisories: {
-            '1113465': pnpmReport.advisories['1113465'],
-            '1115806': pnpmReport.advisories['1115806'],
-          },
-        }),
-        stderr: '',
-        exitCode: 1,
-      }))
-      expect(clean.unresolvedReason).toBeUndefined()
-      expect(clean.issues).toEqual([])
-    } finally {
-      await rm(directory, {recursive: true, force: true})
-    }
-  })
-
-  test('isolated npm config does not double-load user and global config', async () => {
-    const directory = await mkdtemp(join(tmpdir(), 'app-doctor-audit-npm-'))
-    try {
-      await Promise.all([
-        writeFile(
-          join(directory, 'package.json'),
-          JSON.stringify({name: 'app-doctor-audit-npm', version: '0.0.0', private: true}),
-        ),
-        writeFile(join(directory, 'package-lock.json'), JSON.stringify({lockfileVersion: 3, packages: {}})),
-      ])
-      const manifest: ManifestFile = {
-        path: 'package.json',
-        absolutePath: join(directory, 'package.json'),
-        type: 'npm',
-        dependencies: {},
-      }
-      const result = await auditKnownCves(directory, [manifest], async (command, args, options) => {
-        expect(command).toBe('npm')
-        expect(args.filter((argument) => argument.startsWith('--userconfig='))).toHaveLength(1)
-        expect(options.env.NPM_CONFIG_USERCONFIG).toBeTruthy()
-        expect(options.env.NPM_CONFIG_GLOBALCONFIG).toBeTruthy()
-        expect(options.env.NPM_CONFIG_USERCONFIG).not.toBe(options.env.NPM_CONFIG_GLOBALCONFIG)
-
-        const configResult = await executeAuditCommand(
-          command,
-          [
-            'config',
-            'list',
-            '--json',
-            ...args.filter((argument) => argument.startsWith('--userconfig=')),
-            '--no-color',
-          ],
-          options,
-        )
-        expect(configResult.exitCode).toBe(0)
-        expect(configResult.stderr).not.toMatch(/double-loading/i)
-
-        return {stdout: JSON.stringify({metadata: {vulnerabilities: {total: 0}}}), stderr: '', exitCode: 0}
-      })
-      expect(result.unresolvedReason).toBeUndefined()
-      expect(result.issues).toEqual([])
-    } finally {
-      await rm(directory, {recursive: true, force: true})
-    }
-  })
-})
-
 describe('Liquid public AST analysis', () => {
   test('distinguishes ordinary src attributes from executable contexts', () => {
     const ordinary = scanLiquidSecurity([
diff --git a/packages/app/src/cli/services/app-doctor-engine/tests/scan-contract.test.ts b/packages/app/src/cli/services/app-doctor-engine/tests/scan-contract.test.ts
index 8e8fd377d33..bb731be6113 100644
--- a/packages/app/src/cli/services/app-doctor-engine/tests/scan-contract.test.ts
+++ b/packages/app/src/cli/services/app-doctor-engine/tests/scan-contract.test.ts
@@ -48,8 +48,6 @@ describe('framework and surface detection', () => {
     const result = await scan(directory)
 
     expect(result.detection).toMatchObject({framework: 'react_router', surface: 'react_router'})
-    expect(result.scan.coverage_complete).toBe(false)
-    expect(result.scan.coverage_gaps.some((gap) => gap.check_id === 'KNOWN_CVE_IN_DEPENDENCY')).toBe(true)
   })
 
   test('detects config-only, theme extension, mixed, and unknown surfaces', async () => {
diff --git a/packages/app/src/cli/services/app-doctor-engine/tests/submission.test.ts b/packages/app/src/cli/services/app-doctor-engine/tests/submission.test.ts
index 66d18ba6475..0f3135da881 100644
--- a/packages/app/src/cli/services/app-doctor-engine/tests/submission.test.ts
+++ b/packages/app/src/cli/services/app-doctor-engine/tests/submission.test.ts
@@ -114,7 +114,7 @@ describe('buildSubmission', () => {
     mutableEngine.name = `engine-${secret}`
     mutableEngine.version = `version-${secret}`
     mutableEngine.ruleset = `ruleset-${secret}`
-    trace.findings[0]!.title = `CVE detected: ${secret}`
+    trace.findings[0]!.title = `Unsafe HTML assignment: ${secret}`
 
     const submission = buildSubmission(trace, {
       cliVersion: '3.99.0',
@@ -135,10 +135,4 @@ describe('buildSubmission', () => {
 
     expect(submission.report.feedback).toBe(feedback)
   })
-
-  test('keeps the public package and CVE identifiers in a known-CVE title', () => {
-    const submission = buildSubmission(structuredClone(submissionTraceFixture), options)
-
-    expect(submission.report.findings[0]!.title).toBe('Vulnerable package lodash (CVE-2026-0001)')
-  })
 })
diff --git a/packages/app/src/cli/services/app-doctor-engine/trace/index.ts b/packages/app/src/cli/services/app-doctor-engine/trace/index.ts
index 6bfec284924..db49e113cdb 100644
--- a/packages/app/src/cli/services/app-doctor-engine/trace/index.ts
+++ b/packages/app/src/cli/services/app-doctor-engine/trace/index.ts
@@ -27,14 +27,13 @@ const EXECUTION_STATUSES = new Set<CheckExecutionStatus>([
   'unsupported_framework',
   'unresolved',
 ])
-const ANALYSIS_MODES = new Set<AnalysisMode>(['regex', 'structured_config', 'audit', 'ast', 'agent', 'external'])
+const ANALYSIS_MODES = new Set<AnalysisMode>(['regex', 'structured_config', 'ast', 'agent', 'external'])
 const REASON_CODES = new Set([
   'capability_absent',
   'no_relevant_files',
   'unsupported_framework',
   'unsupported_language',
   'parser_unavailable',
-  'audit_unavailable',
   'agent_investigation_required',
   'not_reported',
   'input_rejected',
diff --git a/packages/app/src/cli/services/app-doctor-engine/types.ts b/packages/app/src/cli/services/app-doctor-engine/types.ts
index 17934439ddb..7a917422138 100644
--- a/packages/app/src/cli/services/app-doctor-engine/types.ts
+++ b/packages/app/src/cli/services/app-doctor-engine/types.ts
@@ -106,7 +106,7 @@ export interface SkippedFile {
 
 export type CheckExecutionKind = 'deterministic' | 'agent' | 'external'
 export type CheckExecutionStatus = 'executed' | 'not_applicable' | 'unsupported_framework' | 'unresolved'
-export type AnalysisMode = 'regex' | 'structured_config' | 'audit' | 'ast' | 'agent' | 'external'
+export type AnalysisMode = 'regex' | 'structured_config' | 'ast' | 'agent' | 'external'
 
 export type CheckExecutionReasonCode =
   | 'capability_absent'
@@ -114,7 +114,6 @@ export type CheckExecutionReasonCode =
   | 'unsupported_framework'
   | 'unsupported_language'
   | 'parser_unavailable'
-  | 'audit_unavailable'
   | 'agent_investigation_required'
   | 'not_reported'
   | 'input_rejected'
diff --git a/packages/cli/oclif.manifest.json b/packages/cli/oclif.manifest.json
index e643cbb6194..e4a05fe1529 100644
--- a/packages/cli/oclif.manifest.json
+++ b/packages/cli/oclif.manifest.json
@@ -1309,8 +1309,8 @@
       "args": {
       },
       "customPluginName": "@shopify/app",
-      "description": "Runs Shopify App Doctor locally and creates its review pack and trace.\n\nPass `--findings` after completing the review pack to validate agent findings and compile them into the trace. In interactive terminals, the command offers to copy the coding-agent instructions, print them, or choose nothing; copying is the default. In CI and other non-interactive environments, instructions aren't offered unless you pass `--yes`, which prints them. JSON output never prompts or prints those instructions. You can also run `shopify app doctor instructions` to print, copy, or write them later.\n\nCVE detection runs `npm audit` (or the pnpm/yarn equivalent) in an isolated sandbox and sends package names and versions to the public npm registry at https://registry.npmjs.org/.",
-      "descriptionWithMarkdown": "Runs Shopify App Doctor locally and creates its review pack and trace.\n\nPass `--findings` after completing the review pack to validate agent findings and compile them into the trace. In interactive terminals, the command offers to copy the coding-agent instructions, print them, or choose nothing; copying is the default. In CI and other non-interactive environments, instructions aren't offered unless you pass `--yes`, which prints them. JSON output never prompts or prints those instructions. You can also run `shopify app doctor instructions` to print, copy, or write them later.\n\nCVE detection runs `npm audit` (or the pnpm/yarn equivalent) in an isolated sandbox and sends package names and versions to the public npm registry at https://registry.npmjs.org/.",
+      "description": "Runs Shopify App Doctor locally and creates its review pack and trace.\n\nPass `--findings` after completing the review pack to validate agent findings and compile them into the trace. In interactive terminals, the command offers to copy the coding-agent instructions, print them, or choose nothing; copying is the default. In CI and other non-interactive environments, instructions aren't offered unless you pass `--yes`, which prints them. JSON output never prompts or prints those instructions. You can also run `shopify app doctor instructions` to print, copy, or write them later.",
+      "descriptionWithMarkdown": "Runs Shopify App Doctor locally and creates its review pack and trace.\n\nPass `--findings` after completing the review pack to validate agent findings and compile them into the trace. In interactive terminals, the command offers to copy the coding-agent instructions, print them, or choose nothing; copying is the default. In CI and other non-interactive environments, instructions aren't offered unless you pass `--yes`, which prints them. JSON output never prompts or prints those instructions. You can also run `shopify app doctor instructions` to print, copy, or write them later.",
       "enableJsonFlag": false,
       "flags": {
         "blocking": {