@jikida/init 0.2.1 → 0.3.0

package/bin/init.js

@@ -12,7 +12,7 @@
  * Everything is idempotent: re-running skips already-done steps.
  */
 
-import { readFileSync, existsSync, writeFileSync, appendFileSync, mkdirSync } from 'node:fs';
+import { readFileSync, existsSync, writeFileSync, appendFileSync, mkdirSync, readdirSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { execSync, spawnSync } from 'node:child_process';
@@ -157,6 +157,20 @@ function installSkill() {
       warn(`Could not write ${rel}: ${e.message}`);
     }
   }
+  // Copy the bundled checklists (pre-deploy, supabase/firebase) next to the
+  // master skill so the assistant can walk them before a launch.
+  try {
+    const clSrc = join(here, '..', 'skill', 'checklists');
+    if (existsSync(clSrc)) {
+      const dstDir = join(cwd, '.claude', 'skills', 'jikida', 'checklists');
+      mkdirSync(dstDir, { recursive: true });
+      for (const f of readdirSync(clSrc)) {
+        writeFileSync(join(dstDir, f), readFileSync(join(clSrc, f), 'utf8'));
+      }
+      done('.claude/skills/jikida/checklists/'); wrote++;
+    }
+  } catch (e) { warn(`Could not copy checklists: ${e.message}`); }
+
   if (wrote > 0 || skipped > 0) {
     log('');
     if (skipped > 0) { log(`  ${skipped} file(s) already had the skill — left untouched.`); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jikida/init",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "One command to install a production Web Application Firewall. Detects Node (Next.js / Express / Fastify), PHP (Laravel / Symfony), and Python (Django / FastAPI / Flask), installs the right Jikida SDK, wires the middleware, writes JIKIDA_TOKEN to .env. $0 to start. Fails open. Playground + MCP for Claude Code / Cursor / Windsurf included.",
   "type": "module",
   "bin": {

package/skill/SKILL.md

@@ -359,3 +359,10 @@ Default to the lowest level that fixes the finding. Anything destructive or irre
 
 - **Score** — start at 100; subtract Critical 20 / High 10 / Medium 5 / Low 2, floored at 0. Grade: 90+ A, 70+ B, 50+ C, below 50 F. Non-applicable categories drop out and their weight redistributes.
 - **Memory** — persist the score, accepted risks and custom rules across scans (in the app, or a local `memory-security.md` for the CLI). Re-runs show the trend and never re-flag an accepted risk. User preferences always win over a generic recommendation.
+
+## Checklists
+
+Concrete runbooks bundled with this skill — walk them before a launch:
+
+- `checklists/pre-deploy.md` — the full pre-ship checklist across every category.
+- `checklists/supabase-firebase.md` — the #1 vibe-coder leak (open RLS / test-mode rules); check before any launch.

package/skill/checklists/pre-deploy.md

@@ -0,0 +1,46 @@
+# Pre-deploy security checklist
+
+Run this before every ship, merge, or "make the repo public". Each item maps to a Jikida check you can run with `npx @jikida/scan` or the MCP tools. Fix at the lowest safe level; ask before anything destructive.
+
+## Secrets
+- [ ] No API keys, tokens, or passwords committed (grep the diff; run a repo scan).
+- [ ] `.env`, `serviceAccountKey.json`, `*.pem`, `*.db` are in `.gitignore` and NOT tracked.
+- [ ] No `service_role`, admin, or private key used in client-side code or shipped in the bundle.
+- [ ] Rotate anything that was ever committed — removing it from HEAD is not enough.
+
+## Database
+- [ ] Supabase RLS is ON for every table holding user data (default-deny, then explicit policies).
+- [ ] Firebase rules are not `allow read, write: if true` (test mode).
+- [ ] No endpoint trusts a client-supplied `userId` / `ownerId` (IDOR — scope by the session).
+- [ ] PII columns are encrypted or access-controlled.
+
+## Auth & sessions
+- [ ] Session cookies are `HttpOnly`, `Secure`, `SameSite`.
+- [ ] Login and password-reset have brute-force limits.
+- [ ] JWTs verify the signature and reject `alg=none`; tokens have an expiry.
+
+## Transport & headers
+- [ ] HTTPS only; HSTS set.
+- [ ] CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy present.
+- [ ] CORS is an explicit origin allowlist — never `*` with credentials.
+
+## Input & injection
+- [ ] All queries are parameterized (no string-built SQL / NoSQL).
+- [ ] File uploads check real type (magic bytes), size, and a safe path.
+- [ ] User input rendered in HTML is escaped; no `dangerouslySetInnerHTML` on untrusted data.
+
+## Dependencies & config
+- [ ] No dependency with a known CVE (run the supply-chain check).
+- [ ] Lockfile committed and up to date.
+- [ ] Debug mode / verbose errors OFF in production.
+- [ ] Rate limiting on auth, write, and expensive endpoints.
+
+## After deploy
+- [ ] Uptime monitor + SSL/domain-expiry watch enabled on the live URL.
+- [ ] A surface pentest run against the deployed site comes back clean or triaged.
+
+Run it all at once:
+
+```
+$ npx @jikida/scan yourdomain.com --repo . --min-score 80
+```

package/skill/checklists/supabase-firebase.md

@@ -0,0 +1,38 @@
+# Supabase & Firebase checklist
+
+The single most common way an AI-built app leaks its whole database. Check this before any launch.
+
+## Supabase
+- [ ] **RLS is enabled on every table with user data.** A table with RLS off is world-readable through the anon key.
+  ```sql
+  -- 🔴 CRITICAL — RLS off: anyone with the public anon key reads every row
+  -- 🟢 CORRECT — enable RLS, then add explicit policies
+  ALTER TABLE public.profiles ENABLE ROW LEVEL SECURITY;
+  CREATE POLICY "own rows" ON public.profiles
+    FOR SELECT USING (auth.uid() = user_id);
+  ```
+- [ ] Policies are default-deny — a table with RLS on but no policy returns nothing, which is safe; a permissive `USING (true)` policy is not.
+- [ ] The `service_role` key is used ONLY on the server, never in client code or the bundle.
+- [ ] Storage buckets holding private files are not public.
+- [ ] Postgres functions marked `SECURITY DEFINER` are reviewed — they bypass RLS.
+
+## Firebase
+- [ ] Firestore/RTDB rules are not left in test mode.
+  ```
+  // 🔴 CRITICAL — test mode: the whole database is public read/write
+  match /{document=**} { allow read, write: if true; }
+  // 🟢 CORRECT — require auth and scope to the owner
+  match /users/{uid}/{doc=**} {
+    allow read, write: if request.auth != null && request.auth.uid == uid;
+  }
+  ```
+- [ ] `google-services.json` / `serviceAccountKey.json` is not committed.
+- [ ] Client API keys are restricted (referrer / bundle-id / API restrictions in the Google console) — a client key is public, so the rules are the real gate.
+- [ ] Cloud Functions validate `context.auth` before any privileged action.
+- [ ] Storage rules mirror the database rules — a locked DB with an open bucket still leaks.
+
+Run the automated version:
+
+```
+$ npx @jikida/scan --repo .   # flags open RLS/rules, committed keys, service_role in client
+```