@produtype/core 1.7.0 → 1.7.1

package/dist/analyzer/analyzeProject.js

@@ -233,6 +233,20 @@ function isTestOrExamplePath(file) {
         || /\.(e2e|e2e-spec|cy|stories)\.(ts|tsx|js|jsx|mjs|cjs)$/i.test(file)
         || /_spec\.rb$/i.test(file)
         || /_test\.(go|py|rb|java|cs|php)$/i.test(file)
+        || /_test\.exs$/i.test(file)
+        /**
+         * Mix names its environments, and the file name is the environment.
+         *
+         * `config/test.exs` and `config/dev.exs` are compiled only under `MIX_ENV=test` and
+         * `MIX_ENV=dev`; a production release carries `config/prod.exs` and
+         * `config/runtime.exs` and neither of the other two. supabase/realtime keeps
+         * `metrics_jwt_secret: "test"` in `config/test.exs` and it was the one `critical`
+         * in its report — a literal written to be fake, read as production configuration.
+         *
+         * The same argument as `_test.go`: the name is the toolchain's, not the author's,
+         * and it says which build the file is part of.
+         */
+        || /(^|\/)config\/(test|dev)\.exs$/i.test(file)
         || /(^|\/)test[-_][^/]+\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(file)
         /**
          * The other half of the convention.

package/dist/analyzer/detectEnv.js

@@ -25,6 +25,23 @@ const GENERIC_SECRET_ASSIGNMENT_RE = /(JWT_SECRET|SECRET_KEY|SESSION_SECRET|API_
  * because the identifier does — so the value itself was never looked at.
  */
 const REDACTED_VALUE_RE = /[:=]\s*['"`](\*{2,}|x{3,}|<?\[?redacted\]?>?|hidden|\.{3,})['"`]/i;
+/**
+ * A sentence assigned to a secret-named identifier is not a secret.
+ *
+ * `secret_key: "must be #{@secret_key_size} bytes in Base 64 URL alphabet"` is
+ * Livebook's validation message, returned when somebody types a bad key, and it was
+ * the one `critical` in its report. The finding is "Weak/fallback secret values" and
+ * the value was never looked at: every test above runs on the whole line, and the
+ * line says "secret" because the identifier does. The redaction rule beside this one
+ * was the same discovery made once, for one shape, and patched there.
+ *
+ * A secret is a token. It has no spaces in it and it is not a template with a
+ * variable in the middle — an error message, a label and a sentence all do. Three
+ * Elixir products raised this `critical` on the day Elixir became readable, and
+ * `critical` is the severity that caps maturity, so it was the loudest thing in each
+ * of three reports about products that had done nothing wrong.
+ */
+const VALUE_IS_A_SENTENCE_RE = /[:=]\s*(['"`])[^'"`]*(?:\s|#\{|\$\{)[^'"`]*\1/;
 function classifySecretFallback(snippet) {
     if (/JWT_SECRET/i.test(snippet))
         return 'jwt';
@@ -166,6 +183,7 @@ async function detectEnv(ctx) {
         && !namesItself(m.snippet)
         && !valueIsAnIdentifier(m.snippet)
         && !REDACTED_VALUE_RE.test(m.snippet)
+        && !VALUE_IS_A_SENTENCE_RE.test(m.snippet)
         && !isTableEntry(m)
         && !isAnotherSettingsModule(m.file));
     for (const m of weakHits) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.7.0",
+  "version": "1.7.1",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {