@nikhil_telkar/codeshield 0.0.0-stage → 0.1.0

package/dist/scanners/env.d.ts

@@ -0,0 +1,7 @@
+import { Finding, ScanContext, Scanner } from '../types.js';
+export declare function isRealEnvFile(filePath: string): boolean;
+export declare function isEnvExampleFile(filePath: string): boolean;
+export declare function isEnvIgnoredByGitignore(envRelativePath: string, gitignoreContent: string): boolean;
+export declare function scanEnv(context: ScanContext): Finding[];
+export declare const envScanner: Scanner;
+//# sourceMappingURL=env.d.ts.map

package/dist/scanners/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/scanners/env.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE5D,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAkBvD;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAU1D;AAED,wBAAgB,uBAAuB,CACrC,eAAe,EAAE,MAAM,EACvB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAmCT;AAqCD,wBAAgB,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,EAAE,CAyGvD;AAED,eAAO,MAAM,UAAU,EAAE,OAGxB,CAAC"}

package/dist/scanners/env.js

@@ -0,0 +1,195 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+export function isRealEnvFile(filePath) {
+    const base = path.basename(filePath).toLowerCase();
+    if (!base.startsWith('.env'))
+        return false;
+    if (base === '.env.example' ||
+        base === '.env.sample' ||
+        base === '.env.template' ||
+        base === '.env.dist' ||
+        base === '.env.defaults' ||
+        base.endsWith('.example') ||
+        base.endsWith('.sample') ||
+        base.endsWith('.template')) {
+        return false;
+    }
+    return true;
+}
+export function isEnvExampleFile(filePath) {
+    const base = path.basename(filePath).toLowerCase();
+    return (base === '.env.example' ||
+        base === '.env.sample' ||
+        base === '.env.template' ||
+        base.endsWith('.example') ||
+        base.endsWith('.sample') ||
+        base.endsWith('.template'));
+}
+export function isEnvIgnoredByGitignore(envRelativePath, gitignoreContent) {
+    const envFileName = path.basename(envRelativePath);
+    const normalizedEnvPath = envRelativePath.replace(/\\/g, '/');
+    const lines = gitignoreContent.split(/\r?\n/);
+    for (const rawLine of lines) {
+        let line = rawLine.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        if (line.startsWith('/')) {
+            line = line.slice(1);
+        }
+        if (line === envFileName || line === normalizedEnvPath)
+            return true;
+        if (line === '.env' && envFileName === '.env')
+            return true;
+        if (line === '.env*' && (envFileName === '.env' || envFileName.startsWith('.env.')))
+            return true;
+        if (line === '*.env' && envFileName.endsWith('.env'))
+            return true;
+        if (line === '.env.*' && envFileName.startsWith('.env.'))
+            return true;
+        if (line === '**/.env' && envFileName === '.env')
+            return true;
+        if (line.endsWith('/.env') && envFileName === '.env')
+            return true;
+        if (line.endsWith('/.env*') && (envFileName === '.env' || envFileName.startsWith('.env.')))
+            return true;
+        if (line.includes('*')) {
+            const escaped = line.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*');
+            try {
+                const re = new RegExp(`^${escaped}$`);
+                if (re.test(envFileName) || re.test(normalizedEnvPath))
+                    return true;
+            }
+            catch {
+                // ignore invalid regex
+            }
+        }
+    }
+    return false;
+}
+const BUILD_CONFIG_FILES = new Set([
+    'next.config.js',
+    'next.config.mjs',
+    'next.config.ts',
+    'next.config.cjs',
+    'vite.config.js',
+    'vite.config.ts',
+    'vite.config.mjs',
+    'vite.config.cjs',
+    'webpack.config.js',
+    'webpack.config.ts',
+    'webpack.config.mjs',
+    'webpack.config.cjs',
+]);
+const SOURCE_MAP_PATTERNS = [
+    {
+        name: 'Next.js productionBrowserSourceMaps',
+        regex: /\bproductionBrowserSourceMaps\s*:\s*true\b/,
+    },
+    {
+        name: 'Vite build sourcemap',
+        regex: /\bsourcemap\s*:\s*(?:true|['"]inline['"]|['"]hidden['"])\b/,
+    },
+    {
+        name: 'Webpack production devtool sourcemap',
+        regex: /\bdevtool\s*:\s*['"](?:source-map|inline-source-map|eval-source-map|cheap-module-source-map)['"]/,
+    },
+];
+export function scanEnv(context) {
+    const findings = [];
+    let gitignoreContent = null;
+    const gitignoreFile = context.files.find(f => path.basename(f.relativePath).toLowerCase() === '.gitignore');
+    if (gitignoreFile) {
+        gitignoreContent = gitignoreFile.content;
+    }
+    else {
+        try {
+            const diskPath = path.join(context.root, '.gitignore');
+            if (fs.existsSync(diskPath)) {
+                gitignoreContent = fs.readFileSync(diskPath, 'utf8');
+            }
+        }
+        catch {
+            gitignoreContent = null;
+        }
+    }
+    const realEnvFiles = context.files.filter(f => isRealEnvFile(f.relativePath));
+    const hasExampleFile = context.files.some(f => isEnvExampleFile(f.relativePath)) ||
+        fs.existsSync(path.join(context.root, '.env.example')) ||
+        fs.existsSync(path.join(context.root, '.env.sample')) ||
+        fs.existsSync(path.join(context.root, '.env.template'));
+    for (const envFile of realEnvFiles) {
+        const baseName = path.basename(envFile.relativePath);
+        const isIgnored = gitignoreContent !== null && isEnvIgnoredByGitignore(envFile.relativePath, gitignoreContent);
+        if (!isIgnored) {
+            findings.push({
+                ruleId: 'ENV-001',
+                severity: 'critical',
+                title: `Unignored ${baseName} File Not Covered by .gitignore`,
+                cwe: 'CWE-798',
+                plainExplanation: `The environment file "${envFile.relativePath}" was found, but it is not ignored in .gitignore. Any API keys, database credentials, or auth secrets inside this file are at risk of being committed to Git and leaked publicly.`,
+                file: envFile.relativePath,
+                line: 1,
+                fix: `Add "${baseName}" or ".env*" to your .gitignore file immediately.`,
+                aiPrompt: `Add the following lines to .gitignore to ensure environment files are never committed:\n.env\n.env.*\n!.env.example\n!.env.sample`,
+            });
+            findings.push({
+                ruleId: 'ENV-002',
+                severity: 'high',
+                title: `Risk of Committed Secrets in ${baseName}`,
+                cwe: 'CWE-312',
+                plainExplanation: `The file "${envFile.relativePath}" exists in the repository without .gitignore protection. If this repository is shared or pushed to GitHub/GitLab, the secrets in this file may be permanently exposed in commit history.`,
+                file: envFile.relativePath,
+                line: 1,
+                fix: `Stop tracking the file with "git rm --cached ${envFile.relativePath}" and ensure it is listed in .gitignore.`,
+                aiPrompt: `Provide the git commands to untrack "${envFile.relativePath}" without deleting the local file:\ngit rm --cached ${envFile.relativePath}\ngit commit -m "Untrack ${baseName}"`,
+            });
+        }
+    }
+    if (realEnvFiles.length > 0 && !hasExampleFile) {
+        const primaryEnv = realEnvFiles[0];
+        findings.push({
+            ruleId: 'ENV-003',
+            severity: 'low',
+            title: 'Missing .env.example Template File',
+            cwe: 'CWE-1059',
+            plainExplanation: `A .env file was found, but no ".env.example" or ".env.sample" template exists. Without an example template, other developers or AI assistants cannot know which environment variables are required to run the project.`,
+            file: primaryEnv.relativePath,
+            line: 1,
+            fix: `Create a .env.example file containing all required variable names with dummy placeholder values (never real secrets).`,
+            aiPrompt: `Read ${primaryEnv.relativePath} and generate a safe .env.example file with all keys preserved, but with dummy values (e.g. DATABASE_URL="postgres://user:YOUR_PASSWORD@localhost:5432/mydb").`,
+        });
+    }
+    for (const file of context.files) {
+        const baseName = path.basename(file.relativePath).toLowerCase();
+        if (!BUILD_CONFIG_FILES.has(baseName)) {
+            continue;
+        }
+        for (let lineIdx = 0; lineIdx < file.lines.length; lineIdx++) {
+            const line = file.lines[lineIdx] ?? '';
+            if (line.trim().startsWith('//') || line.trim().startsWith('/*') || line.trim().startsWith('*')) {
+                continue;
+            }
+            for (const pattern of SOURCE_MAP_PATTERNS) {
+                if (pattern.regex.test(line)) {
+                    findings.push({
+                        ruleId: 'ENV-004',
+                        severity: 'medium',
+                        title: 'Production Source Maps Enabled in Build Config',
+                        cwe: 'CWE-540',
+                        plainExplanation: `Production source maps are enabled (${pattern.name}) on line ${lineIdx + 1} of "${file.relativePath}". When source maps are uploaded to production, anyone can open browser Developer Tools and view your original unminified source code, proprietary algorithms, and internal comments.`,
+                        file: file.relativePath,
+                        line: lineIdx + 1,
+                        fix: `Disable production source maps in "${baseName}" (set productionBrowserSourceMaps: false or sourcemap: false).`,
+                        aiPrompt: `In "${file.relativePath}", disable production source maps on line ${lineIdx + 1} by setting the option to false.`,
+                    });
+                }
+            }
+        }
+    }
+    return findings;
+}
+export const envScanner = {
+    name: 'env',
+    scan: scanEnv,
+};
+//# sourceMappingURL=env.js.map

package/dist/scanners/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/scanners/env.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAE3C,IACE,IAAI,KAAK,cAAc;QACvB,IAAI,KAAK,aAAa;QACtB,IAAI,KAAK,eAAe;QACxB,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,eAAe;QACxB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAC1B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,CACL,IAAI,KAAK,cAAc;QACvB,IAAI,KAAK,aAAa;QACtB,IAAI,KAAK,eAAe;QACxB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,eAAuB,EACvB,gBAAwB;IAExB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACnD,MAAM,iBAAiB,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAE9D,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9C,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAE5C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QAED,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,iBAAiB;YAAE,OAAO,IAAI,CAAC;QAEpE,IAAI,IAAI,KAAK,MAAM,IAAI,WAAW,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAC3D,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,WAAW,KAAK,MAAM,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjG,IAAI,IAAI,KAAK,OAAO,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAClE,IAAI,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACtE,IAAI,IAAI,KAAK,SAAS,IAAI,WAAW,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAC9D,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,WAAW,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAClE,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,KAAK,MAAM,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAExG,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAChF,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;gBACtC,IAAI,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC;oBAAE,OAAO,IAAI,CAAC;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,gBAAgB;IAChB,iBAAiB;IACjB,gBAAgB;IAChB,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,iBAAiB;IACjB,mBAAmB;IACnB,mBAAmB;IACnB,oBAAoB;IACpB,oBAAoB;CACrB,CAAC,CAAC;AAOH,MAAM,mBAAmB,GAAuB;IAC9C;QACE,IAAI,EAAE,qCAAqC;QAC3C,KAAK,EAAE,4CAA4C;KACpD;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,4DAA4D;KACpE;IACD;QACE,IAAI,EAAE,sCAAsC;QAC5C,KAAK,EAAE,kGAAkG;KAC1G;CACF,CAAC;AAEF,MAAM,UAAU,OAAO,CAAC,OAAoB;IAC1C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,IAAI,gBAAgB,GAAkB,IAAI,CAAC;IAC3C,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,KAAK,YAAY,CAClE,CAAC;IAEF,IAAI,aAAa,EAAE,CAAC;QAClB,gBAAgB,GAAG,aAAa,CAAC,OAAO,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YACvD,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,gBAAgB,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB,GAAG,IAAI,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9E,MAAM,cAAc,GAClB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACzD,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACtD,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACrD,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;IAE1D,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,gBAAgB,KAAK,IAAI,IAAI,uBAAuB,CAAC,OAAO,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;QAE/G,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,aAAa,QAAQ,iCAAiC;gBAC7D,GAAG,EAAE,SAAS;gBACd,gBAAgB,EAAE,yBAAyB,OAAO,CAAC,YAAY,mLAAmL;gBAClP,IAAI,EAAE,OAAO,CAAC,YAAY;gBAC1B,IAAI,EAAE,CAAC;gBACP,GAAG,EAAE,QAAQ,QAAQ,mDAAmD;gBACxE,QAAQ,EAAE,mIAAmI;aAC9I,CAAC,CAAC;YAEH,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,gCAAgC,QAAQ,EAAE;gBACjD,GAAG,EAAE,SAAS;gBACd,gBAAgB,EAAE,aAAa,OAAO,CAAC,YAAY,2LAA2L;gBAC9O,IAAI,EAAE,OAAO,CAAC,YAAY;gBAC1B,IAAI,EAAE,CAAC;gBACP,GAAG,EAAE,gDAAgD,OAAO,CAAC,YAAY,0CAA0C;gBACnH,QAAQ,EAAE,wCAAwC,OAAO,CAAC,YAAY,uDAAuD,OAAO,CAAC,YAAY,4BAA4B,QAAQ,GAAG;aACzL,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,oCAAoC;YAC3C,GAAG,EAAE,UAAU;YACf,gBAAgB,EAAE,wNAAwN;YAC1O,IAAI,EAAE,UAAU,CAAC,YAAY;YAC7B,IAAI,EAAE,CAAC;YACP,GAAG,EAAE,uHAAuH;YAC5H,QAAQ,EAAE,QAAQ,UAAU,CAAC,YAAY,gKAAgK;SAC1M,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QAChE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,SAAS;QACX,CAAC;QAED,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChG,SAAS;YACX,CAAC;YAED,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;gBAC1C,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7B,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,SAAS;wBACjB,QAAQ,EAAE,QAAQ;wBAClB,KAAK,EAAE,gDAAgD;wBACvD,GAAG,EAAE,SAAS;wBACd,gBAAgB,EAAE,uCAAuC,OAAO,CAAC,IAAI,aAAa,OAAO,GAAG,CAAC,QAAQ,IAAI,CAAC,YAAY,uLAAuL;wBAC7S,IAAI,EAAE,IAAI,CAAC,YAAY;wBACvB,IAAI,EAAE,OAAO,GAAG,CAAC;wBACjB,GAAG,EAAE,sCAAsC,QAAQ,iEAAiE;wBACpH,QAAQ,EAAE,OAAO,IAAI,CAAC,YAAY,6CAA6C,OAAO,GAAG,CAAC,kCAAkC;qBAC7H,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAY;IACjC,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,OAAO;CACd,CAAC"}

package/dist/scanners/helper.d.ts

@@ -0,0 +1,27 @@
+import { Finding, Severity } from '../types.js';
+export interface RuleContext {
+    file: string;
+    content: string;
+    lines: string[];
+}
+export interface Rule {
+    id: string;
+    name: string;
+    severity: Severity;
+    description: string;
+    remediation: string;
+    check: (context: RuleContext) => Finding[];
+}
+export interface RegexRuleOptions {
+    id: string;
+    name: string;
+    severity: Severity;
+    description: string;
+    remediation: string;
+    regex: RegExp;
+    isSecret?: boolean;
+    extensions?: string[];
+    customMessage?: (match: RegExpExecArray) => string;
+}
+export declare function createLineRegexRule(options: RegexRuleOptions): Rule;
+//# sourceMappingURL=helper.d.ts.map

package/dist/scanners/helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../../src/scanners/helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAwB,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGtE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,MAAM,CAAC;CACpD;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAsDnE"}

package/dist/scanners/helper.js

@@ -0,0 +1,50 @@
+import { maskSecret, sanitize } from '../utils/sanitize.js';
+export function createLineRegexRule(options) {
+    return {
+        id: options.id,
+        name: options.name,
+        severity: options.severity,
+        description: options.description,
+        remediation: options.remediation,
+        check(context) {
+            if (options.extensions && options.extensions.length > 0) {
+                const matchesExt = options.extensions.some(ext => context.file.toLowerCase().endsWith(ext.toLowerCase()));
+                if (!matchesExt)
+                    return [];
+            }
+            const findings = [];
+            for (let lineIdx = 0; lineIdx < context.lines.length; lineIdx++) {
+                const line = context.lines[lineIdx] ?? '';
+                const re = new RegExp(options.regex.source, options.regex.flags);
+                let match;
+                while ((match = re.exec(line)) !== null) {
+                    let snippet = sanitize(line.trim());
+                    if (options.isSecret) {
+                        const secretValue = match[1] ?? match[0];
+                        snippet = snippet.replace(secretValue, maskSecret(secretValue));
+                    }
+                    const message = options.customMessage
+                        ? options.customMessage(match)
+                        : options.description;
+                    findings.push({
+                        ruleId: options.id,
+                        severity: options.severity,
+                        title: options.name,
+                        plainExplanation: message,
+                        file: context.file,
+                        line: lineIdx + 1,
+                        fix: options.remediation,
+                        aiPrompt: `Fix security issue "${options.name}" (${options.id}): ${message}. Remediation: ${options.remediation}. Code: ${snippet}`,
+                    });
+                    if (!re.global)
+                        break;
+                    if (match.index === re.lastIndex) {
+                        re.lastIndex++;
+                    }
+                }
+            }
+            return findings;
+        },
+    };
+}
+//# sourceMappingURL=helper.js.map

package/dist/scanners/helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../../src/scanners/helper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AA6B5D,MAAM,UAAU,mBAAmB,CAAC,OAAyB;IAC3D,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,CAAC,OAAoB;YACxB,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC/C,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CACvD,CAAC;gBACF,IAAI,CAAC,UAAU;oBAAE,OAAO,EAAE,CAAC;YAC7B,CAAC;YAED,MAAM,QAAQ,GAAc,EAAE,CAAC;YAE/B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;gBAChE,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAC1C,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAEjE,IAAI,KAA6B,CAAC;gBAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACxC,IAAI,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;oBACpC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;wBACrB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;wBACzC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;oBAClE,CAAC;oBAED,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa;wBACnC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC;wBAC9B,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;oBAExB,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,OAAO,CAAC,EAAE;wBAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,KAAK,EAAE,OAAO,CAAC,IAAI;wBACnB,gBAAgB,EAAE,OAAO;wBACzB,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,IAAI,EAAE,OAAO,GAAG,CAAC;wBACjB,GAAG,EAAE,OAAO,CAAC,WAAW;wBACxB,QAAQ,EAAE,uBAAuB,OAAO,CAAC,IAAI,MAAM,OAAO,CAAC,EAAE,MAAM,OAAO,kBAAkB,OAAO,CAAC,WAAW,WAAW,OAAO,EAAE;qBACpI,CAAC,CAAC;oBAEH,IAAI,CAAC,EAAE,CAAC,MAAM;wBAAE,MAAM;oBACtB,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC,SAAS,EAAE,CAAC;wBACjC,EAAE,CAAC,SAAS,EAAE,CAAC;oBACjB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/scanners/index.d.ts

@@ -0,0 +1,6 @@
+export * from './helper.js';
+export * from './secrets.js';
+export * from './env.js';
+export * from './dependencies.js';
+export * from './code.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/scanners/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/scanners/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,cAAc,mBAAmB,CAAC;AAClC,cAAc,WAAW,CAAC"}

package/dist/scanners/index.js

@@ -0,0 +1,6 @@
+export * from './helper.js';
+export * from './secrets.js';
+export * from './env.js';
+export * from './dependencies.js';
+export * from './code.js';
+//# sourceMappingURL=index.js.map

package/dist/scanners/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/scanners/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,cAAc,mBAAmB,CAAC;AAClC,cAAc,WAAW,CAAC"}

package/dist/scanners/secrets.d.ts

@@ -0,0 +1,19 @@
+import { Finding, ScanContext, Scanner, Severity } from '../types.js';
+export declare function isPlaceholder(val: string): boolean;
+export declare function isLineIgnored(line: string): boolean;
+export declare function isTestOrFixture(relativePath: string, content: string): boolean;
+export interface SecretRuleDefinition {
+    id: string;
+    severity: Severity;
+    title: string;
+    cwe?: string;
+    plainExplanation: string;
+    fix: string;
+    aiPromptTemplate: string;
+    regex: RegExp;
+    extractSecret?: (match: RegExpExecArray) => string | null;
+}
+export declare const SECRET_RULES: SecretRuleDefinition[];
+export declare function scanSecrets(context: ScanContext): Finding[];
+export declare const secretsScanner: Scanner;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/scanners/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/scanners/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAkCtE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAKlD;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAG9E;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,MAAM,GAAG,IAAI,CAAC;CAC3D;AAED,eAAO,MAAM,YAAY,EAAE,oBAAoB,EAmI9C,CAAC;AAEF,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,EAAE,CAyD3D;AAED,eAAO,MAAM,cAAc,EAAE,OAG5B,CAAC"}

package/dist/scanners/secrets.js

@@ -0,0 +1,213 @@
+import { maskSecret, sanitize } from '../utils/sanitize.js';
+const PLACEHOLDER_STRINGS = new Set([
+    'your_api_key',
+    'your_secret_key',
+    'your_jwt_secret',
+    'your_password',
+    'your_token',
+    'your_key_here',
+    'my_api_key',
+    'my_secret_key',
+    'changeme',
+    'replace_me',
+    'placeholder',
+    'dummy_token',
+    'example_key',
+    'test_secret',
+    'undefined',
+    'null',
+]);
+const PLACEHOLDER_REGEXES = [
+    /your[_-]?(?:api[_-]?)?(?:key|secret|token|password)/i,
+    /replace[_-]?me/i,
+    /enter[_-]?your/i,
+    /insert[_-]?here/i,
+    /<[^>]+>/,
+    /\.{3,}/,
+    /0{12,}/,
+    /x{12,}/i,
+    /^1234567890*$/,
+];
+export function isPlaceholder(val) {
+    const clean = val.trim().toLowerCase();
+    if (clean.length < 6)
+        return true;
+    if (PLACEHOLDER_STRINGS.has(clean))
+        return true;
+    return PLACEHOLDER_REGEXES.some(re => re.test(clean));
+}
+export function isLineIgnored(line) {
+    return /codeshield-ignore|@codeshield-ignore|codeshield-disable/i.test(line);
+}
+export function isTestOrFixture(relativePath, content) {
+    if (content.includes('codeshield-ignore-file'))
+        return true;
+    return false;
+}
+export const SECRET_RULES = [
+    {
+        id: 'SEC-001',
+        severity: 'critical',
+        title: 'Hardcoded AWS Access Key',
+        cwe: 'CWE-798',
+        plainExplanation: 'An Amazon Web Services (AWS) Access Key ID was found directly in your source code. If committed to GitHub or shared, attackers can scan for this key and access your cloud infrastructure, potentially deleting services or incurring thousands of dollars in unauthorized usage.',
+        fix: 'Store the AWS Access Key in an environment variable (such as AWS_ACCESS_KEY_ID) or use IAM Roles instead of hardcoded credentials.',
+        aiPromptTemplate: 'Refactor this code to remove the hardcoded AWS Access Key on line {LINE}. Use process.env.AWS_ACCESS_KEY_ID and update .env.example with a placeholder.',
+        regex: /\b(AKIA[0-9A-Z]{16})\b/g,
+        extractSecret: m => m[1] ?? null,
+    },
+    {
+        id: 'SEC-002',
+        severity: 'critical',
+        title: 'Hardcoded Stripe Live Secret Key',
+        cwe: 'CWE-798',
+        plainExplanation: 'A live Stripe secret API key was found in your code. Live Stripe keys have full administrative access to your Stripe account, allowing anyone who finds them to view customer payment details, initiate refunds, or charge cards.',
+        fix: 'Move your Stripe secret key to a server-side environment variable (e.g., STRIPE_SECRET_KEY in a .env file that is ignored by Git). Never commit live secret keys.',
+        aiPromptTemplate: 'Remove the hardcoded Stripe live key on line {LINE}. Use process.env.STRIPE_SECRET_KEY and document how to configure it in .env.',
+        regex: /\b(sk_live_[0-9a-zA-Z]{24,})\b/g,
+        extractSecret: m => m[1] ?? null,
+    },
+    {
+        id: 'SEC-003',
+        severity: 'critical',
+        title: 'Hardcoded GitHub Personal Access Token',
+        cwe: 'CWE-798',
+        plainExplanation: 'A GitHub personal access token (PAT) or OAuth token was found in your code. Anyone with this token can access your private GitHub repositories, alter code, or delete repositories.',
+        fix: 'Revoke this token immediately in your GitHub developer settings, generate a new one, and inject it securely via environment variables or CI/CD secrets (e.g. GITHUB_TOKEN).',
+        aiPromptTemplate: 'Replace the hardcoded GitHub token on line {LINE} with process.env.GITHUB_TOKEN.',
+        regex: /\b(ghp_[0-9a-zA-Z]{36}|gho_[0-9a-zA-Z]{36}|github_pat_[0-9a-zA-Z_]{22,})\b/g,
+        extractSecret: m => m[1] ?? null,
+    },
+    {
+        id: 'SEC-004',
+        severity: 'critical',
+        title: 'Hardcoded AI Provider API Key (OpenAI / Anthropic)',
+        cwe: 'CWE-798',
+        plainExplanation: 'An API key for an AI model provider (OpenAI or Anthropic) was found hardcoded in this file. Exposed AI keys are frequently scraped by bots within minutes of being pushed, resulting in immediate unauthorized API usage and billing fees.',
+        fix: 'Move the key to your .env file as OPENAI_API_KEY or ANTHROPIC_API_KEY, and make sure .env is included in your .gitignore.',
+        aiPromptTemplate: 'Refactor this code to remove the hardcoded AI API key on line {LINE}. Load it from process.env.OPENAI_API_KEY (or ANTHROPIC_API_KEY) and verify that error handling exists if the environment variable is missing.',
+        regex: /\b(sk-(?:proj-|ant-)?[0-9a-zA-Z_-]{20,})\b/g,
+        extractSecret: m => m[1] ?? null,
+    },
+    {
+        id: 'SEC-005',
+        severity: 'critical',
+        title: 'Hardcoded Supabase service_role Key',
+        cwe: 'CWE-798',
+        plainExplanation: 'A Supabase service_role key was found hardcoded in your code. The service_role key completely bypasses all Supabase Row Level Security (RLS) policies and grants full administrative access to your entire database. It must NEVER be hardcoded or exposed to the frontend.',
+        fix: 'Store the service_role key in a secure server-side environment variable (SUPABASE_SERVICE_ROLE_KEY). For client-side code, use only the public anon key with strict RLS policies.',
+        aiPromptTemplate: 'Refactor line {LINE} to remove the hardcoded Supabase service_role key. Use process.env.SUPABASE_SERVICE_ROLE_KEY on the backend, and ensure this key is never passed to frontend components.',
+        regex: /(?:service_role|supabase_service)[^=\n]{0,30}=\s*['"](eyJ[A-Za-z0-9_-]{15,}\.[A-Za-z0-9_-]{15,}\.[A-Za-z0-9_-]{15,})['"]/i,
+        extractSecret: m => m[1] ?? null,
+    },
+    {
+        id: 'SEC-006',
+        severity: 'critical',
+        title: 'Hardcoded Private Cryptographic Key',
+        cwe: 'CWE-321',
+        plainExplanation: 'An unencrypted private encryption or signing key block was found in this file. Private keys are meant to be kept secret; exposing them allows attackers to decrypt private communications, forge signatures, or impersonate your server.',
+        fix: 'Store private keys in a secrets manager or load them at runtime from a secure file path specified in an environment variable (e.g. PRIVATE_KEY_PATH).',
+        aiPromptTemplate: 'Remove the hardcoded private key block starting at line {LINE}. Load the key securely from an environment variable or file system path configured via process.env.',
+        regex: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g,
+        extractSecret: m => m[0],
+    },
+    {
+        id: 'SEC-007',
+        severity: 'high',
+        title: 'Database Connection String with Embedded Password',
+        cwe: 'CWE-798',
+        plainExplanation: 'A database connection string containing a raw username and password was found in your code. Exposing database credentials allows unauthorized users to read, modify, or drop your database tables.',
+        fix: 'Extract the database connection string into a DATABASE_URL environment variable in your .env file, and ensure .env is listed in .gitignore.',
+        aiPromptTemplate: 'Remove the hardcoded database connection string on line {LINE}. Use process.env.DATABASE_URL instead and provide a .env.example with dummy credentials.',
+        regex: /\b(?:postgres|postgresql|mysql|mongodb|mongodb\+srv|redis|mariadb):\/\/[^:\s'"]+:([^@\s'"]+)@[^\s'"]+/g,
+        extractSecret: m => m[1] ?? null,
+    },
+    {
+        id: 'SEC-008',
+        severity: 'high',
+        title: 'Hardcoded or Weak JWT Secret',
+        cwe: 'CWE-798',
+        plainExplanation: 'A JSON Web Token (JWT) secret key was found hardcoded as a plain string. Attackers can use this secret to forge authentication tokens and impersonate any user, including administrators.',
+        fix: 'Move the JWT secret to process.env.JWT_SECRET and ensure it is generated using a cryptographically secure random value with at least 256 bits of entropy.',
+        aiPromptTemplate: 'Update line {LINE} to remove the hardcoded JWT secret. Use process.env.JWT_SECRET and throw an error if the environment variable is not set.',
+        regex: /\b(?:jwt(?:Secret|_secret)?|JWT_SECRET)\s*[:=]\s*['"]([^'"]{4,})['"]|\bjwt\.sign\s*\([^,]+,\s*['"]([^'"]{4,})['"]/g,
+        extractSecret: m => m[1] ?? m[2] ?? null,
+    },
+    {
+        id: 'SEC-009',
+        severity: 'high',
+        title: 'Hardcoded Generic API Secret or Token',
+        cwe: 'CWE-798',
+        plainExplanation: 'A generic secret key, API token, or access credential was found hardcoded. Anyone who views this source code will have access to the associated third-party service.',
+        fix: 'Store this secret in an environment variable and load it via process.env.',
+        aiPromptTemplate: 'Extract the hardcoded API credential on line {LINE} into an environment variable loaded through process.env.',
+        regex: /\b(?:api_key|apiKey|api_secret|apiSecret|access_token|accessToken|secret_key|secretKey|private_token)\s*[:=]\s*['"]([0-9a-zA-Z_\-]{24,})['"]/g,
+        extractSecret: m => m[1] ?? null,
+    },
+    {
+        id: 'SEC-010',
+        severity: 'critical',
+        title: 'Private Key or Secret Leaked to Public Client Variable',
+        cwe: 'CWE-200',
+        plainExplanation: 'Environment variables prefixed with NEXT_PUBLIC_ or VITE_ are embedded into the client-side JavaScript bundle during build and sent to every browser that visits your website. A private key, service role key, or administrative secret was assigned to a public variable name, exposing it directly to all site visitors.',
+        fix: 'Remove the NEXT_PUBLIC_ or VITE_ prefix so the secret remains strictly on the server, and only access it in server-side routes (e.g. Next.js API routes or server components).',
+        aiPromptTemplate: 'The secret on line {LINE} is prefixed with NEXT_PUBLIC_ or VITE_, which bundles it into client-side code sent to users. Refactor this to remove the public prefix, move the secret to server-only code, and handle any necessary operations via a backend API route.',
+        regex: /\b(NEXT_PUBLIC_[A-Z0-9_]*(?:SECRET|PRIVATE_KEY|SERVICE_ROLE|ADMIN_KEY|TOKEN)|VITE_[A-Z0-9_]*(?:SECRET|PRIVATE_KEY|SERVICE_ROLE|ADMIN_KEY|TOKEN))\s*[:=]\s*['"]?([^'"\s;,\n]+)/g,
+        extractSecret: m => m[2] ?? null,
+    },
+];
+export function scanSecrets(context) {
+    const findings = [];
+    for (const file of context.files) {
+        if (isTestOrFixture(file.relativePath, file.content)) {
+            continue;
+        }
+        for (let lineIdx = 0; lineIdx < file.lines.length; lineIdx++) {
+            const line = file.lines[lineIdx] ?? '';
+            if (isLineIgnored(line)) {
+                continue;
+            }
+            for (const rule of SECRET_RULES) {
+                const re = new RegExp(rule.regex.source, rule.regex.flags);
+                let match;
+                while ((match = re.exec(line)) !== null) {
+                    const rawSecret = rule.extractSecret ? rule.extractSecret(match) : match[0];
+                    if (!rawSecret || isPlaceholder(rawSecret)) {
+                        if (!re.global)
+                            break;
+                        if (match.index === re.lastIndex)
+                            re.lastIndex++;
+                        continue;
+                    }
+                    const maskedVal = maskSecret(rawSecret);
+                    const sanitizedLine = sanitize(line.trim());
+                    const maskedSnippet = sanitizedLine.replace(rawSecret, maskedVal);
+                    const aiPrompt = `${rule.aiPromptTemplate.replace('{LINE}', String(lineIdx + 1))} Code: ${maskedSnippet}`;
+                    const finding = {
+                        ruleId: rule.id,
+                        severity: rule.severity,
+                        title: rule.title,
+                        plainExplanation: rule.plainExplanation,
+                        file: file.relativePath,
+                        line: lineIdx + 1,
+                        fix: rule.fix,
+                        aiPrompt,
+                        snippet: maskedSnippet,
+                        ...(rule.cwe ? { cwe: rule.cwe } : {}),
+                    };
+                    findings.push(finding);
+                    if (!re.global)
+                        break;
+                    if (match.index === re.lastIndex)
+                        re.lastIndex++;
+                }
+            }
+        }
+    }
+    return findings;
+}
+export const secretsScanner = {
+    name: 'secrets',
+    scan: scanSecrets,
+};
+//# sourceMappingURL=secrets.js.map

package/dist/scanners/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/scanners/secrets.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAE5D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,cAAc;IACd,iBAAiB;IACjB,iBAAiB;IACjB,eAAe;IACf,YAAY;IACZ,eAAe;IACf,YAAY;IACZ,eAAe;IACf,UAAU;IACV,YAAY;IACZ,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,WAAW;IACX,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG;IAC1B,sDAAsD;IACtD,iBAAiB;IACjB,iBAAiB;IACjB,kBAAkB;IAClB,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,eAAe;CAChB,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,0DAA0D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,YAAoB,EAAE,OAAe;IACnE,IAAI,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAcD,MAAM,CAAC,MAAM,YAAY,GAA2B;IAClD;QACE,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,0BAA0B;QACjC,GAAG,EAAE,SAAS;QACd,gBAAgB,EACd,mRAAmR;QACrR,GAAG,EAAE,oIAAoI;QACzI,gBAAgB,EACd,yJAAyJ;QAC3J,KAAK,EAAE,yBAAyB;QAChC,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;KACjC;IACD;QACE,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,GAAG,EAAE,SAAS;QACd,gBAAgB,EACd,mOAAmO;QACrO,GAAG,EAAE,mKAAmK;QACxK,gBAAgB,EACd,kIAAkI;QACpI,KAAK,EAAE,iCAAiC;QACxC,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;KACjC;IACD;QACE,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,wCAAwC;QAC/C,GAAG,EAAE,SAAS;QACd,gBAAgB,EACd,qLAAqL;QACvL,GAAG,EAAE,6KAA6K;QAClL,gBAAgB,EACd,kFAAkF;QACpF,KAAK,EAAE,6EAA6E;QACpF,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;KACjC;IACD;QACE,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,oDAAoD;QAC3D,GAAG,EAAE,SAAS;QACd,gBAAgB,EACd,4OAA4O;QAC9O,GAAG,EAAE,2HAA2H;QAChI,gBAAgB,EACd,oNAAoN;QACtN,KAAK,EAAE,6CAA6C;QACpD,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;KACjC;IACD;QACE,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,qCAAqC;QAC5C,GAAG,EAAE,SAAS;QACd,gBAAgB,EACd,6QAA6Q;QAC/Q,GAAG,EAAE,mLAAmL;QACxL,gBAAgB,EACd,+LAA+L;QACjM,KAAK,EAAE,2HAA2H;QAClI,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;KACjC;IACD;QACE,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,qCAAqC;QAC5C,GAAG,EAAE,SAAS;QACd,gBAAgB,EACd,0OAA0O;QAC5O,GAAG,EAAE,uJAAuJ;QAC5J,gBAAgB,EACd,oKAAoK;QACtK,KAAK,EAAE,yDAAyD;QAChE,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;KACzB;IACD;QACE,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,mDAAmD;QAC1D,GAAG,EAAE,SAAS;QACd,gBAAgB,EACd,oMAAoM;QACtM,GAAG,EAAE,6IAA6I;QAClJ,gBAAgB,EACd,yJAAyJ;QAC3J,KAAK,EAAE,wGAAwG;QAC/G,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;KACjC;IACD;QACE,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,8BAA8B;QACrC,GAAG,EAAE,SAAS;QACd,gBAAgB,EACd,2LAA2L;QAC7L,GAAG,EAAE,2JAA2J;QAChK,gBAAgB,EACd,8IAA8I;QAChJ,KAAK,EAAE,oHAAoH;QAC3H,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;KACzC;IACD;QACE,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,uCAAuC;QAC9C,GAAG,EAAE,SAAS;QACd,gBAAgB,EACd,sKAAsK;QACxK,GAAG,EAAE,2EAA2E;QAChF,gBAAgB,EACd,8GAA8G;QAChH,KAAK,EAAE,+IAA+I;QACtJ,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;KACjC;IACD;QACE,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,wDAAwD;QAC/D,GAAG,EAAE,SAAS;QACd,gBAAgB,EACd,6TAA6T;QAC/T,GAAG,EAAE,gLAAgL;QACrL,gBAAgB,EACd,sQAAsQ;QACxQ,KAAK,EAAE,gLAAgL;QACvL,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;KACjC;CACF,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,OAAoB;IAC9C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,eAAe,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,SAAS;QACX,CAAC;QAED,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAEvC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,SAAS;YACX,CAAC;YAED,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;gBAChC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC3D,IAAI,KAA6B,CAAC;gBAElC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACxC,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAE5E,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;wBAC3C,IAAI,CAAC,EAAE,CAAC,MAAM;4BAAE,MAAM;wBACtB,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC,SAAS;4BAAE,EAAE,CAAC,SAAS,EAAE,CAAC;wBACjD,SAAS;oBACX,CAAC;oBAED,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;oBACxC,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;oBAC5C,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;oBAElE,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,aAAa,EAAE,CAAC;oBAE1G,MAAM,OAAO,GAAY;wBACvB,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;wBACvC,IAAI,EAAE,IAAI,CAAC,YAAY;wBACvB,IAAI,EAAE,OAAO,GAAG,CAAC;wBACjB,GAAG,EAAE,IAAI,CAAC,GAAG;wBACb,QAAQ;wBACR,OAAO,EAAE,aAAa;wBACtB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACvC,CAAC;oBAEF,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAEvB,IAAI,CAAC,EAAE,CAAC,MAAM;wBAAE,MAAM;oBACtB,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC,SAAS;wBAAE,EAAE,CAAC,SAAS,EAAE,CAAC;gBACnD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAY;IACrC,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,WAAW;CAClB,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,43 @@
+export type Severity = 'critical' | 'high' | 'medium' | 'low' | 'info';
+export type ProjectType = 'nextjs' | 'vite-react' | 'express' | 'plain-html' | 'unknown';
+export interface Finding {
+    ruleId: string;
+    severity: Severity;
+    title: string;
+    plainExplanation: string;
+    file: string;
+    line: number;
+    fix: string;
+    aiPrompt: string;
+    cwe?: string;
+    snippet?: string;
+}
+export interface ScannedFile {
+    path: string;
+    relativePath: string;
+    content: string;
+    lines: string[];
+}
+export interface ScanContext {
+    root: string;
+    projectType: ProjectType;
+    files: ScannedFile[];
+}
+export interface Scanner {
+    name: string;
+    scan: (context: ScanContext) => Finding[];
+}
+export interface ScanResult {
+    projectType: ProjectType;
+    findings: Finding[];
+    filesScanned: number;
+    filesSkipped: number;
+    truncated: boolean;
+    durationMs: number;
+}
+export interface RunnerOptions {
+    root: string;
+    minSeverity?: Severity;
+    scanners?: Scanner[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAEvE,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;AAEzF,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,EAAE,WAAW,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,QAAQ,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;CACtB"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}