auditai-scan 0.7.5 → 0.8.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +9 -1
- package/dist/auditai-scan.mjs +3010 -1889
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -5,10 +5,18 @@ tools ship most: cross-tenant reads, missing or permissive RLS, service-role mis
|
|
|
5
5
|
admin routes and server actions, mass assignment, roles read from user-editable metadata.
|
|
6
6
|
|
|
7
7
|
```bash
|
|
8
|
-
npx auditai-scan
|
|
8
|
+
npx auditai-scan --snapshot-query # a read-only query: run it in the Supabase SQL editor
|
|
9
|
+
npx auditai-scan --snapshot snapshot.json # what your live database lets a stranger do
|
|
10
|
+
npx auditai-scan . # scan the current repo
|
|
9
11
|
npx auditai-scan . --migrations supabase/migrations --fail-on likely # CI gate
|
|
10
12
|
```
|
|
11
13
|
|
|
14
|
+
The snapshot query reads the Postgres catalog (tables, row level security, policies, grants,
|
|
15
|
+
functions, storage buckets) and changes nothing; no row of your data is read. Findings about the
|
|
16
|
+
database are headlines and come with the migration that closes them. Findings inferred from
|
|
17
|
+
application code are printed as leads: about one in four is real on code the rules have never seen,
|
|
18
|
+
so they are capped at medium and never fail `--fail-on`.
|
|
19
|
+
|
|
12
20
|
No account, no model call, no network. Source, rules and the eval corpus:
|
|
13
21
|
https://github.com/audit0/auditai-scanner. The hosted product that reproduces, fixes and proves
|
|
14
22
|
findings in a sandbox lives at https://auditai.sh.
|