@quantracode/vibecheck 0.0.1 → 0.0.2

package/dist/scanners/privacy/debug-flags.js

@@ -1,124 +0,0 @@
-import { resolvePath, readFileSync } from "../../utils/file-utils.js";
-import { generateFingerprint, generateFindingId } from "../../utils/fingerprint.js";
-const RULE_ID = "VC-PRIV-003";
-/**
- * VC-PRIV-003: Debug flags enabled in production-ish config
- *
- * Detect:
- * - next.config.* or server config with `dev: true`, `debug: true`, or logging level "debug"
- *
- * Precision:
- * - Only if NODE_ENV is checked or project appears production-ready
- */
-export async function scanDebugFlags(context) {
-    const { repoRoot, fileIndex } = context;
-    const findings = [];
-    // Check if project appears production-ready
-    const hasVercelConfig = fileIndex.configFiles.some((f) => f.includes("vercel.json"));
-    const pkgPath = resolvePath(repoRoot, "package.json");
-    const pkgContent = readFileSync(pkgPath);
-    const hasBuildScript = pkgContent && /"build"\s*:/.test(pkgContent);
-    const isProdReady = hasVercelConfig || hasBuildScript;
-    if (!isProdReady) {
-        return findings;
-    }
-    // Check config files for debug flags
-    const configPatterns = [
-        "next.config.js",
-        "next.config.mjs",
-        "next.config.ts",
-        "server.config.js",
-        "server.config.ts",
-        "app.config.js",
-        "app.config.ts",
-    ];
-    for (const configFile of configPatterns) {
-        const relPath = fileIndex.configFiles.find((f) => f.endsWith(configFile));
-        if (!relPath)
-            continue;
-        const absPath = resolvePath(repoRoot, relPath);
-        const content = readFileSync(absPath);
-        if (!content)
-            continue;
-        // Check for debug flags
-        const debugPatterns = [
-            { pattern: /\bdev\s*:\s*true\b/, flag: "dev: true" },
-            { pattern: /\bdebug\s*:\s*true\b/, flag: "debug: true" },
-            { pattern: /logLevel\s*:\s*['"]debug['"]/, flag: 'logLevel: "debug"' },
-            { pattern: /LOG_LEVEL\s*=\s*['"]debug['"]/, flag: 'LOG_LEVEL="debug"' },
-            { pattern: /reactStrictMode\s*:\s*false\b/, flag: "reactStrictMode: false" },
-        ];
-        for (const { pattern, flag } of debugPatterns) {
-            const match = content.match(pattern);
-            if (!match)
-                continue;
-            // Check if it's conditional on NODE_ENV (which is acceptable)
-            const lineIndex = content.substring(0, match.index).split("\n").length;
-            const lines = content.split("\n");
-            const contextStart = Math.max(0, lineIndex - 5);
-            const contextEnd = Math.min(lines.length, lineIndex + 3);
-            const contextLines = lines.slice(contextStart, contextEnd).join("\n");
-            // Skip if guarded by NODE_ENV check
-            if (/process\.env\.NODE_ENV\s*[!=]==?\s*['"]development['"]/i.test(contextLines)) {
-                continue;
-            }
-            const evidence = [
-                {
-                    file: relPath,
-                    startLine: lineIndex,
-                    endLine: lineIndex,
-                    snippet: lines[lineIndex - 1]?.trim() ?? flag,
-                    label: `Debug flag: ${flag}`,
-                },
-            ];
-            if (hasVercelConfig) {
-                evidence.push({
-                    file: "vercel.json",
-                    startLine: 1,
-                    endLine: 1,
-                    snippet: "Project has Vercel deployment config",
-                    label: "Production deployment detected",
-                });
-            }
-            const fingerprint = generateFingerprint({
-                ruleId: RULE_ID,
-                file: relPath,
-                symbol: flag,
-                startLine: lineIndex,
-            });
-            findings.push({
-                id: generateFindingId({
-                    ruleId: RULE_ID,
-                    file: relPath,
-                    symbol: flag,
-                }),
-                ruleId: RULE_ID,
-                title: `Debug flag "${flag}" may be enabled in production`,
-                description: `The configuration file contains ${flag} which may be active in production. Debug modes often expose sensitive information, enable verbose error messages, or disable security features. This configuration is not guarded by a NODE_ENV check.`,
-                severity: "medium",
-                confidence: 0.75,
-                category: "config",
-                evidence,
-                remediation: {
-                    recommendedFix: `Ensure debug flags are only enabled in development. Use environment variables or NODE_ENV checks.`,
-                    patch: `// Guard debug flags with environment check:
-const isDev = process.env.NODE_ENV === 'development';
-
-module.exports = {
-  // Only enable in development
-  ...(isDev && { debug: true }),
-
-  // Or use environment variable:
-  debug: process.env.DEBUG === 'true',
-};`,
-                },
-                links: {
-                    cwe: "https://cwe.mitre.org/data/definitions/489.html",
-                    owasp: "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/",
-                },
-                fingerprint,
-            });
-        }
-    }
-    return findings;
-}

package/dist/scanners/privacy/index.d.ts

@@ -1,6 +0,0 @@
-import type { ScannerPack } from "../types.js";
-export declare const privacyPack: ScannerPack;
-export { scanSensitiveLogging } from "./sensitive-logging.js";
-export { scanOverBroadResponse } from "./over-broad-response.js";
-export { scanDebugFlags } from "./debug-flags.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/scanners/privacy/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/scanners/privacy/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAK/C,eAAO,MAAM,WAAW,EAAE,WAIzB,CAAC;AAEF,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/scanners/privacy/index.js

@@ -1,11 +0,0 @@
-import { scanSensitiveLogging } from "./sensitive-logging.js";
-import { scanOverBroadResponse } from "./over-broad-response.js";
-import { scanDebugFlags } from "./debug-flags.js";
-export const privacyPack = {
-    id: "privacy",
-    name: "Privacy & Data Protection",
-    scanners: [scanSensitiveLogging, scanOverBroadResponse, scanDebugFlags],
-};
-export { scanSensitiveLogging } from "./sensitive-logging.js";
-export { scanOverBroadResponse } from "./over-broad-response.js";
-export { scanDebugFlags } from "./debug-flags.js";

package/dist/scanners/privacy/over-broad-response.d.ts

@@ -1,15 +0,0 @@
-import type { Finding } from "@vibecheck/schema";
-import type { ScanContext } from "../types.js";
-/**
- * VC-PRIV-002: Over-broad API response (returns whole ORM model)
- *
- * Detect in route handlers returning:
- * - prisma.<model>.findMany({}) without select/include restrictions AND direct return
- * - prisma.<model>.findUnique({ where }) without select AND direct return
- *
- * Precision:
- * - Only flag if the model name suggests sensitive entity (user, account, etc.)
- * - OR fields: password, hash, token are present in schema.prisma
- */
-export declare function scanOverBroadResponse(context: ScanContext): Promise<Finding[]>;
-//# sourceMappingURL=over-broad-response.d.ts.map

package/dist/scanners/privacy/over-broad-response.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"over-broad-response.d.ts","sourceRoot":"","sources":["../../../src/scanners/privacy/over-broad-response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAA0B,MAAM,mBAAmB,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAM/C;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAwGpF"}

package/dist/scanners/privacy/over-broad-response.js

@@ -1,109 +0,0 @@
-import { resolvePath } from "../../utils/file-utils.js";
-import { generateFingerprint, generateFindingId } from "../../utils/fingerprint.js";
-const RULE_ID = "VC-PRIV-002";
-/**
- * VC-PRIV-002: Over-broad API response (returns whole ORM model)
- *
- * Detect in route handlers returning:
- * - prisma.<model>.findMany({}) without select/include restrictions AND direct return
- * - prisma.<model>.findUnique({ where }) without select AND direct return
- *
- * Precision:
- * - Only flag if the model name suggests sensitive entity (user, account, etc.)
- * - OR fields: password, hash, token are present in schema.prisma
- */
-export async function scanOverBroadResponse(context) {
-    const { repoRoot, fileIndex, helpers, prismaSchemaInfo } = context;
-    const findings = [];
-    // Scan API route files
-    for (const relPath of fileIndex.apiRouteFiles) {
-        const absPath = resolvePath(repoRoot, relPath);
-        const sourceFile = helpers.parseFile(absPath);
-        if (!sourceFile)
-            continue;
-        const handlers = helpers.findRouteHandlers(sourceFile);
-        for (const handler of handlers) {
-            const prismaQueries = helpers.findPrismaQueries(handler.functionNode);
-            for (const query of prismaQueries) {
-                // Skip if has select (data is restricted)
-                if (query.hasSelect)
-                    continue;
-                // Check if model has sensitive fields from prisma schema
-                let hasSensitiveFields = false;
-                if (prismaSchemaInfo) {
-                    const modelInfo = prismaSchemaInfo.models.get(query.model.toLowerCase());
-                    if (modelInfo) {
-                        hasSensitiveFields = modelInfo.hasSensitiveFields;
-                    }
-                }
-                // Determine severity based on sensitive fields
-                const severity = hasSensitiveFields ? "high" : "medium";
-                const evidence = [
-                    {
-                        file: relPath,
-                        startLine: query.line,
-                        endLine: query.line,
-                        snippet: query.snippet,
-                        label: `Returns full ${query.model} model without select restriction`,
-                    },
-                ];
-                // Add prisma schema evidence if available
-                if (hasSensitiveFields && prismaSchemaInfo) {
-                    const modelInfo = prismaSchemaInfo.models.get(query.model.toLowerCase());
-                    if (modelInfo) {
-                        evidence.push({
-                            file: "prisma/schema.prisma",
-                            startLine: 1,
-                            endLine: 1,
-                            snippet: `Model ${modelInfo.name} has sensitive fields: ${modelInfo.fields.filter(f => /password|hash|token|secret/i.test(f)).join(", ")}`,
-                            label: "Sensitive fields in model",
-                        });
-                    }
-                }
-                const fingerprint = generateFingerprint({
-                    ruleId: RULE_ID,
-                    file: relPath,
-                    symbol: `${query.model}.${query.operation}`,
-                    startLine: query.line,
-                });
-                findings.push({
-                    id: generateFindingId({
-                        ruleId: RULE_ID,
-                        file: relPath,
-                        symbol: `${query.model}.${query.operation}`,
-                        startLine: query.line,
-                    }),
-                    ruleId: RULE_ID,
-                    title: `Over-broad ${query.model} response exposes all fields`,
-                    description: `The ${query.operation} query on the ${query.model} model returns all fields without using a \`select\` clause. This may inadvertently expose sensitive fields like passwords, tokens, or internal IDs to API consumers.${hasSensitiveFields ? " The Prisma schema indicates this model contains sensitive fields." : ""}`,
-                    severity,
-                    confidence: hasSensitiveFields ? 0.9 : 0.75,
-                    category: "privacy",
-                    evidence,
-                    remediation: {
-                        recommendedFix: `Use Prisma's \`select\` clause to explicitly choose which fields to return. Never expose password hashes, tokens, or other sensitive data in API responses.`,
-                        patch: `// Instead of:
-const users = await prisma.${query.model.toLowerCase()}.${query.operation}();
-
-// Use select to return only needed fields:
-const users = await prisma.${query.model.toLowerCase()}.${query.operation}({
-  select: {
-    id: true,
-    name: true,
-    email: true,
-    createdAt: true,
-    // Explicitly omit: password, passwordHash, tokens, etc.
-  },
-});`,
-                    },
-                    links: {
-                        cwe: "https://cwe.mitre.org/data/definitions/359.html",
-                        owasp: "https://owasp.org/API-Security/editions/2023/en/0xa3-broken-object-property-level-authorization/",
-                    },
-                    fingerprint,
-                });
-            }
-        }
-    }
-    return findings;
-}

package/dist/scanners/privacy/sensitive-logging.d.ts

@@ -1,11 +0,0 @@
-import type { Finding } from "@vibecheck/schema";
-import type { ScanContext } from "../types.js";
-/**
- * VC-PRIV-001: Sensitive data logged
- *
- * Detects console.log/info/error or logger calls that include:
- * - tokens, authorization headers, passwords, secrets
- * - Variables named: password, token, auth, authorization, cookie, session, secret, apiKey
- */
-export declare function scanSensitiveLogging(context: ScanContext): Promise<Finding[]>;
-//# sourceMappingURL=sensitive-logging.d.ts.map

package/dist/scanners/privacy/sensitive-logging.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sensitive-logging.d.ts","sourceRoot":"","sources":["../../../src/scanners/privacy/sensitive-logging.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAgB,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAM/C;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CA2EnF"}

package/dist/scanners/privacy/sensitive-logging.js

@@ -1,78 +0,0 @@
-import { resolvePath } from "../../utils/file-utils.js";
-import { generateFingerprint, generateFindingId } from "../../utils/fingerprint.js";
-const RULE_ID = "VC-PRIV-001";
-/**
- * VC-PRIV-001: Sensitive data logged
- *
- * Detects console.log/info/error or logger calls that include:
- * - tokens, authorization headers, passwords, secrets
- * - Variables named: password, token, auth, authorization, cookie, session, secret, apiKey
- */
-export async function scanSensitiveLogging(context) {
-    const { repoRoot, fileIndex, helpers } = context;
-    const findings = [];
-    // Scan all source files
-    for (const relPath of fileIndex.allSourceFiles) {
-        const absPath = resolvePath(repoRoot, relPath);
-        const sourceFile = helpers.parseFile(absPath);
-        if (!sourceFile)
-            continue;
-        // Find all functions in the file
-        const functions = sourceFile.getFunctions();
-        const arrowFunctions = sourceFile.getDescendantsOfKind(
-        // @ts-expect-error - ts-morph types
-        sourceFile.getProject().getTypeChecker().compilerObject.SyntaxKind?.ArrowFunction ?? 213);
-        // Check module-level code as well
-        const sensitiveLogCalls = helpers.findSensitiveLogCalls({
-            // Create a pseudo-function node that covers the whole file
-            getDescendantsOfKind: (kind) => sourceFile.getDescendantsOfKind(kind),
-            getText: () => sourceFile.getText(),
-        });
-        for (const logCall of sensitiveLogCalls) {
-            const evidence = [
-                {
-                    file: relPath,
-                    startLine: logCall.line,
-                    endLine: logCall.line,
-                    snippet: logCall.snippet,
-                    label: `Sensitive data logged: ${logCall.sensitiveVars.join(", ")}`,
-                },
-            ];
-            const fingerprint = generateFingerprint({
-                ruleId: RULE_ID,
-                file: relPath,
-                symbol: logCall.sensitiveVars[0],
-                startLine: logCall.line,
-            });
-            findings.push({
-                id: generateFindingId({
-                    ruleId: RULE_ID,
-                    file: relPath,
-                    symbol: logCall.sensitiveVars[0],
-                    startLine: logCall.line,
-                }),
-                ruleId: RULE_ID,
-                title: `Sensitive data in logs: ${logCall.sensitiveVars.join(", ")}`,
-                description: `The ${logCall.logMethod} call includes sensitive data (${logCall.sensitiveVars.join(", ")}). This could expose credentials, tokens, or other sensitive information in log files, monitoring systems, or console output.`,
-                severity: logCall.severity,
-                confidence: 0.88,
-                category: "privacy",
-                evidence,
-                remediation: {
-                    recommendedFix: `Remove sensitive data from log statements. Only log non-sensitive identifiers like user IDs, timestamps, or action types.`,
-                    patch: `// Instead of:
-console.log("Login:", { email, password });
-
-// Do:
-console.log("Login attempt:", { email, timestamp: Date.now() });`,
-                },
-                links: {
-                    cwe: "https://cwe.mitre.org/data/definitions/532.html",
-                    owasp: "https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/",
-                },
-                fingerprint,
-            });
-        }
-    }
-    return findings;
-}