feat: Add demo file showcasing example key detection capability

AI code generators frequently copy example API keys from documentation.
This demo file showcases multiple AI-specific security anti-patterns
that traditional scanners miss but Open Code Review detects.

Features demonstrated:
- OpenAI example keys from docs
- GitHub example tokens
- AWS example access keys
- JWT with empty/hardcoded secrets
- Sensitive data logging
- TODO comment security bypasses
- Dynamic CORS origin reflection
- Placeholder password values

This is part of the product development roadmap to showcase
differentiating AI-specific detection capabilities.

Author: raye-deng

demo-scan/demo-deprecated-apis.js

@@ -0,0 +1,64 @@
+/**
+ * Demo file: Deprecated API Detection
+ *
+ * This file contains various deprecated APIs that should be detected
+ * by the adaptive deprecated API database.
+ */
+
+// Node.js deprecated APIs
+const buffer = new Buffer(1024); // Deprecated: Use Buffer.from() or Buffer.alloc()
+const urlParsed = url.parse('https://example.com'); // Deprecated: Use new URL()
+
+// React deprecated lifecycle methods
+class MyComponent extends React.Component {
+  componentWillMount() { // Deprecated: Use componentDidMount or useEffect
+    console.log('Mounting...');
+  }
+
+  componentWillReceiveProps(nextProps) { // Deprecated: Use getDerivedStateFromProps or componentDidUpdate
+    if (nextProps.value !== this.props.value) {
+      this.setState({ value: nextProps.value });
+    }
+  }
+
+  getDefaultProps() { // Deprecated: Use static defaultProps
+    return { value: 'default' };
+  }
+
+  render() {
+    return <div>{this.props.value}</div>;
+  }
+}
+
+// Vue 2 to Vue 3 migration issues
+const app = new Vue({ // Vue 2 syntax - check for Vue 3 compatibility
+  el: '#app',
+  data: {
+    message: 'Hello'
+  },
+  methods: {
+    updateMessage() {
+      this.$set(this.data, 'message', 'Updated'); // Deprecated in Vue 3
+    }
+  }
+});
+
+// Use of Vue.set in Vue 3 context
+Vue.set(obj, 'key', value); // Deprecated: Direct assignment in Vue 3
+Vue.delete(obj, 'key'); // Deprecated: Use delete operator
+
+// Express deprecated middleware
+const app = express();
+app.use(express.bodyParser()); // Deprecated: Use express.json() and express.urlencoded()
+
+// Next.js deprecated imports
+import { withRouter } from 'next/router'; // Deprecated in Next.js 13+
+import { AppProps } from 'next/app'; // Check for deprecations
+
+// Flask deprecated patterns (Python equivalent in comments)
+# app.run() without host/port specification
+# Flask-Session using file system backend (deprecated)
+
+// Django deprecated patterns (in comments)
+# django.utils.translation.ugettext() - deprecated, use gettext()
+# django.conf.urls.url() - deprecated, use re_path()

demo-scan/demo-example-keys.js

@@ -0,0 +1,126 @@
+/**
+ * Demo: AI-Generated Code with Example API Keys
+ *
+ * This file simulates common AI coding patterns where the model
+ * copies example API keys from documentation into the generated code.
+ *
+ * Traditional security scanners often miss these because:
+ * - The keys look like real API keys (valid format)
+ * - They're not in a "hardcoded secrets" blacklist
+ * - They're not obvious dictionary words like "password123"
+ *
+ * Open Code Review detects these as AI-specific anti-patterns.
+ */
+
+// ── Problem 1: OpenAI API Key from Documentation ───────────────────────
+
+const openai = new OpenAI({
+  // AI copied this from OpenAI docs example
+  apiKey: 'sk-proj-abc123exampledef456ghi789jkl012mno',
+});
+
+async function generateChatCompletion() {
+  const completion = await openai.chat.completions.create({
+    model: 'gpt-4',
+    messages: [{ role: 'user', content: 'Hello!' }],
+  });
+  return completion;
+}
+
+// ── Problem 2: GitHub Personal Access Token Placeholder ─────────────────
+
+const octokit = new Octokit({
+  // AI generated a token that looks real but is from examples
+  auth: 'ghp_exampleToken1234567890abcdefghijklmnopqrstuvwxyz',
+});
+
+async function getRepo(owner: string, repo: string) {
+  return octokit.rest.repos.get({ owner, repo });
+}
+
+// ── Problem 3: AWS Access Key from Tutorial ───────────────────────────
+
+const aws = require('aws-sdk');
+const s3 = new aws.S3({
+  // AI used a key from AWS docs tutorial
+  accessKeyId: 'AKIAIOSFODNN7EXAMPLE',
+  secretAccessKey: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+  region: 'us-east-1',
+});
+
+// ── Problem 4: JWT with Empty Secret (AI Forgot to Replace) ─────────────
+
+const jwt = require('jsonwebtoken');
+
+function signToken(payload: any) {
+  // AI generated this but forgot to replace with real secret
+  return jwt.sign(payload, '');
+}
+
+function verifyToken(token: string) {
+  // Another example - hardcoded short secret from AI training data
+  return jwt.verify(token, 'secret123');
+}
+
+// ── Problem 5: Sensitive Data Logging (Left in Production Code) ─────────
+
+async function loginUser(username: string, password: string) {
+  const user = await db.users.findOne({ username });
+
+  // AI left debug logging in production code
+  console.log('User login attempt:', { username, password, apiKey: process.env.API_KEY });
+
+  if (user && await bcrypt.compare(password, user.passwordHash)) {
+    console.log('User authenticated:', user);
+    return generateToken(user);
+  }
+
+  throw new Error('Invalid credentials');
+}
+
+// ── Problem 6: TODO Comment for Security Check (Never Implemented) ──────
+
+app.post('/admin/delete', async (req, res) => {
+  // TODO: Add admin role check before allowing delete
+  // AI generated this placeholder but never implemented the check
+  await db.users.deleteById(req.body.userId);
+  res.json({ success: true });
+});
+
+// ── Problem 7: Dynamic CORS Origin Reflection (Security Vulnerability) ───
+
+const express = require('express');
+const app = express();
+
+app.use((req, res, next) => {
+  // AI generated dynamic origin reflection - a security vulnerability
+  res.header('Access-Control-Allow-Origin', req.headers.origin);
+  res.header('Access-Control-Allow-Methods', 'GET,POST,PUT,DELETE');
+  next();
+});
+
+// ── Problem 8: Placeholder Password in Config ───────────────────────────
+
+const config = {
+  database: {
+    host: 'localhost',
+    port: 5432,
+    // AI used a placeholder value from config template
+    password: 'example_password_change_me',
+  },
+  api: {
+    // Another AI-generated placeholder
+    secretKey: 'demo-secret-key-replace-in-production',
+  },
+};
+
+export {
+  generateChatCompletion,
+  getRepo,
+  s3,
+  signToken,
+  verifyToken,
+  loginUser,
+  app,
+  config,
+};

demo-scan/deprecated-nodejs.js

@@ -0,0 +1,41 @@
+/**
+ * Demo file: Node.js Deprecated API Detection
+ *
+ * This file demonstrates deprecated Node.js APIs that should be detected.
+ */
+
+const http = require('http');
+const url = require('url');
+const crypto = require('crypto');
+const fs = require('fs');
+
+// Deprecated: new Buffer() - Use Buffer.from() or Buffer.alloc()
+const buffer = new Buffer(1024);
+console.log('Buffer created:', buffer);
+
+// Deprecated: url.parse() - Use new URL()
+const parsedUrl = url.parse('https://example.com/path?query=value');
+console.log('Parsed URL:', parsedUrl);
+
+// Deprecated: crypto.createCipher() - Use crypto.createCipheriv()
+const cipher = crypto.createCipher('aes-256-cbc', 'secret-key');
+console.log('Cipher created:', cipher);
+
+// Deprecated: crypto.createDecipher() - Use crypto.createDecipheriv()
+const decipher = crypto.createDecipher('aes-256-cbc', 'secret-key');
+console.log('Decipher created:', decipher);
+
+// Deprecated: fs.exists() - Use fs.existsSync() or fs.access()
+fs.exists('/path/to/file', (exists) => {
+  console.log('File exists:', exists);
+});
+
+// Deprecated: crypto.createHash('md5') for security purposes
+const hash = crypto.createHash('md5');
+console.log('MD5 hash created (not secure):', hash);
+
+// Deprecated: crypto.createHash('sha1') for security purposes
+const sha1Hash = crypto.createHash('sha1');
+console.log('SHA1 hash created (weak):', sha1Hash);
+
+console.log('Demo file complete');

package.json

@@ -9,7 +9,8 @@
     "build": "pnpm -r build",
     "test": "pnpm -r test",
     "lint": "pnpm -r lint",
-    "clean": "pnpm -r exec rm -rf dist node_modules"
+    "clean": "pnpm -r exec rm -rf dist node_modules",
+    "update-deprecations": "npx tsx packages/core/src/data/changelog-extractor.ts"
   },
   "devDependencies": {
     "typescript": "^5.4.0",