@vaultcompass/vault-guard-core 1.2.1 → 1.2.3

package/dist/scanners/secret-scanner.js

@@ -58,7 +58,10 @@ const BUILTIN_PATTERNS = new Map([
     ['aws-secret-context', { regex: /(?:aws_secret_access_key|AWS_SECRET_ACCESS_KEY)\s*[=:]\s*["']?([a-zA-Z0-9/+]{40})/gi, severity: 'critical' }],
     ['gcp-service-account', { regex: /"type":\s*"service_account"/g, severity: 'critical' }],
     ['gcp-api-key', { regex: /AIza[a-zA-Z0-9_-]{35}/g, severity: 'critical' }],
-    ['gcp-oauth', { regex: /[0-9]+-[a-zA-Z0-9_]{32}\.apps\.googleusercontent\.com/g, severity: 'critical' }],
+    // OAuth 2.0 client ID, not a secret: Google documents these as safe for
+    // client-side / public embedding (only the paired client *secret* is
+    // sensitive). Kept at low severity for visibility, not blocking.
+    ['gcp-oauth', { regex: /[0-9]+-[a-zA-Z0-9_]{32}\.apps\.googleusercontent\.com/g, severity: 'low' }],
     ['azure-storage', { regex: /DefaultEndpointsProtocol=https;AccountName=[^;]+;AccountKey=[A-Za-z0-9+/=]{20,}/g, severity: 'critical' }],
     // --- Database connection strings ---
     ['postgresql-url', { regex: /postgres(?:ql)?:\/\/[^:@\s]+:[^@\s]+@[^:\s/]+(?::\d+)?\/\S+/g, severity: 'critical', connectionString: true }],

package/dist/utils/file-utils.js

@@ -173,10 +173,57 @@ function collectGitignoreChain(resolvedScan, stopAt) {
     raw.reverse();
     return raw;
 }
+/**
+ * Recursively discover `.gitignore` files inside `root` (inclusive of `root`
+ * itself), skipping directories the walk never descends into anyway
+ * ({@link shouldIgnoreDirectory}) so this pre-pass stays cheap. Scanning from
+ * an ancestor of a nested `.gitignore` (e.g. `vault-guard scan .` in a repo
+ * with a per-package `.gitignore`) otherwise never sees that file: the ignore
+ * filter was only ever built from ancestors of the scan root, not descendants.
+ */
+function collectDescendantGitignores(root) {
+    const found = [];
+    const stack = [root];
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        let entries;
+        try {
+            entries = fs_1.default.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (entry.isSymbolicLink())
+                continue;
+            const full = path_1.default.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                if (shouldIgnoreDirectory(entry.name))
+                    continue;
+                stack.push(full);
+            }
+            else if (entry.isFile() && entry.name === '.gitignore') {
+                try {
+                    found.push({ dir, absGitignore: full, content: fs_1.default.readFileSync(full, 'utf-8') });
+                }
+                catch {
+                    /* unreadable .gitignore — treat as absent */
+                }
+            }
+        }
+    }
+    // Shallow-to-deep, matching collectGitignoreChain's ordering, so more
+    // specific nested rules are added (and can override) after broader ones.
+    found.sort((a, b) => a.dir.split(path_1.default.sep).length - b.dir.split(path_1.default.sep).length);
+    return found;
+}
 function buildIgnoreFilter(resolvedScanRoot) {
     const gitRoot = findGitRoot(resolvedScanRoot);
     const stopAt = gitRoot ?? filesystemRootFor(resolvedScanRoot);
-    const chain = collectGitignoreChain(resolvedScanRoot, stopAt);
+    const ancestorChain = collectGitignoreChain(resolvedScanRoot, stopAt);
+    const seen = new Set(ancestorChain.map(c => c.absGitignore));
+    const descendantChain = collectDescendantGitignores(resolvedScanRoot).filter(c => !seen.has(c.absGitignore));
+    const chain = [...ancestorChain, ...descendantChain];
     const ig = (0, ignore_1.default)();
     for (const { dir, content } of chain) {
         const relDir = path_1.default.relative(stopAt, dir).split(path_1.default.sep).join('/');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vaultcompass/vault-guard-core",
-  "version": "1.2.1",
+  "version": "1.2.3",
   "description": "Secret-scanning engine: vendor-anchored patterns, entropy gating, baselines, SARIF/JSON, hook helpers.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",