checkmyvibe 1.0.2 → 1.2.0

package/README.md

@@ -1,6 +1,6 @@
 # checkmyvibe
 
-A structured, zero-dependency, local production readiness and code quality workflow packaged as an Agent Skill for AI coding assistants (such as Claude Code, Cursor, Codex, and Gemini CLI).
+A structured, zero-dependency, local production readiness and code quality workflow packaged as an Agent Skill for AI coding assistants. Built for Claude Code today; the skill and command files can be adapted to other agents' rule/command formats.
 
 AI-generated ("vibe-coded") applications built on modern AI tools frequently ship with serious, well-documented configuration and quality issues—such as exposed API keys, fake authentication stubs, permissive default database rules, and client-side pricing logic. **checkmyvibe** solves this by packaging readiness and verification checks directly into an Agent Skill. When you ask your coding agent to "run checkmyvibe" or "perform a readiness check", the agent uses checkmyvibe's local helper scripts and its own reasoning capabilities to analyze your codebase, producing a prioritized report detailing what configuration issues or gaps exist, why they matter, and how to fix them.
 
@@ -13,7 +13,7 @@ AI-generated ("vibe-coded") applications built on modern AI tools frequently shi
 *   **Fake & Stubbed Authentication:** Greps for common mock authentication markers (such as functions named `mockAuth`, `fakeLogin`, `tempAuth`, or logic that returns `true` unconditionally to bypass authentication checks).
 *   **Database Misconfigurations:** Identifies permissive default rules (such as `allow read, write: if true;` in Firebase/Firestore configs) and checks if Row-Level Security (RLS) is enabled on Supabase database schemas.
 *   **Broken Object-Level Authorization (BOLA/IDOR):** Analyzes API routes to check if endpoints fetch resources by ID without validating that the authenticated user owns or has permission to access that resource.
-*   **Client-Side Payment & Pricing Logic:** Scans checkout routes and payment integrations to check if prices or transaction values are calculated or accepted directly from client-side parameters rather than securely fetched on the server.
+*   **Client-Side Payment & Pricing Logic:** Scans checkout routes and payment integrations to check if prices or transaction values are calculated or accepted directly from client-side parameters rather than securely fetched on the server, and verifies that payment webhooks validate provider signatures before trusting event payloads.
 
 ---
 
@@ -42,21 +42,33 @@ If you prefer not to use `npx`, copy the files manually:
 1. Create a `checkmyvibe` directory inside your agent's skills path:
    * **Project-level (Claude Code):** `.claude/skills/checkmyvibe/`
    * **Global/Personal (Claude Code):** `~/.claude/skills/checkmyvibe/`
-2. Copy `SKILL.md`, the `scripts/` folder, and the `references/` folder into that directory.
+2. Copy `SKILL.md`, the `scripts/` folder, `references/` folder, and `commands/` folder into that directory.
+3. (Optional for slash command support) Copy the files from `commands/` directly into `.claude/commands/` (or `~/.claude/commands/`).
 
 ---
 
 ## Usage
 
-Once installed, your AI coding agent will automatically recognize the `checkmyvibe` skill when relevant. You can trigger the workflow explicitly:
+### Full Production Readiness Audit
+Run a complete audit across all categories before deploying or shipping:
+* Command: `/checkmyvibe`
+* Or prompt: *"Run checkmyvibe on this project"*
 
-### Claude Code / Gemini CLI
-Open your terminal in the workspace and ask:
-> "Run checkmyvibe on this project"
-*Or:*
-> "Perform a production readiness check using checkmyvibe"
+### Focused / Scoped Scanning
+When actively developing a specific feature, run focused scans for fast, targeted feedback without running the entire test suite:
 
-The agent will walk through the checks, execute the local python validation scripts, and print a prioritized markdown report (Critical / Should Fix / Worth Reviewing) with instructions on how to correct the issues.
+| Slash Command | Scope / Keyword | Included Checks | Use Case |
+| :--- | :--- | :--- | :--- |
+| `/checkmyvibe-secrets` | `/checkmyvibe secrets` | Checks 1a + 1b + 2 | Server-side and client-exposed API keys/credentials, plus `.gitignore` hygiene |
+| `/checkmyvibe-auth` | `/checkmyvibe auth` | Check 3 | Missing, mock, stubbed, or bypassed authentication guards |
+| `/checkmyvibe-db` | `/checkmyvibe db` | Check 4 | Database & BaaS rules, Supabase RLS policies, Firebase permissions |
+| `/checkmyvibe-backend` | `/checkmyvibe backend` | Checks 1a, 3, 4, 5, 6 (server), 7 (server) | All server-side logic: hardcoded server credentials, auth, DB/RLS, IDOR/BOLA, SQLi/input validation/mass assignment, payment & webhook processing |
+| `/checkmyvibe-frontend` | `/checkmyvibe frontend` | Checks 1b, 3 (client), 7 (client) | Client bundle key leaks, UI-only auth hiding, client-side pricing overrides |
+| `/checkmyvibe-payment` | `/checkmyvibe payment` | Check 7 | Client-side payment tampering, price overrides, unverified webhooks, checkout integrity |
+
+Each scoped command file contains its complete operating instructions inline — it only falls back to `SKILL.md` for the report format and severity rubric — so scoped scans work reliably even when skill auto-discovery fails.
+
+The agent will walk through the scoped checks, execute relevant local helper scripts, and print a prioritized markdown report (Critical / Should Fix / Worth Reviewing) with concrete remediation steps.
 
 ---
 

package/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: checkmyvibe
 description: >
-  Use this skill when the user asks to "check my vibe", run a production readiness check, review code quality, do a sanity check, check for exposed environment variables, or check if the app is ready to launch/ship. Also trigger proactively when the agent is about to help deploy, publish, or push an application live, or when the codebase shows signs of AI-scaffolded patterns (Supabase/Firebase config, recently generated boilerplate, auth stubs, no existing verification) and the user has not had one done yet. Covers checking for missing or placeholder authentication, exposed secrets, permissive database rules, object-level authorization, input validation, and pricing configuration in client bundles.
+  Use this skill when the user asks to "check my vibe", run a production readiness check, review code quality, do a sanity check, check for exposed environment variables, or check if the app is ready to launch/ship, or runs a scoped check like `/checkmyvibe db`, `/checkmyvibe auth`, `/checkmyvibe secrets`, `/checkmyvibe payment`, `/checkmyvibe backend`, or `/checkmyvibe frontend`. Also trigger proactively when the agent is about to help deploy, publish, or push an application live, or when the codebase shows signs of AI-scaffolded patterns (Supabase/Firebase config, recently generated boilerplate, auth stubs, no existing verification) and the user has not had one done yet.
 ---
 # checkmyvibe — Production Readiness & Code Quality Check for Vibe-Coded Apps
 
@@ -27,14 +27,34 @@ expected them to hold real user data yet.
 
 This is a first-pass review for known, documented scaffolding failure patterns. It is not a
 comprehensive external validation, and it does not cover infrastructure hosting, third-party package
-issues, or novel/business-logic-specific flaws outside the six categories
-below. Never tell the user their app is completely "secure" or "safe" in an unqualified way.
+issues, or novel/business-logic-specific flaws outside the categories below. Never tell the user their app is completely "secure" or "safe" in an unqualified way.
 The correct language is "no issues found in this pass" or "ready to ship as far as
 these checks go" — always paired with the scope reminder in the Final Summary
 section. If the app appears to handle payments, health data, or other regulated
 data, say explicitly that a professional verification is strongly recommended regardless
 of what this pass finds.
 
+## Scope selection
+
+checkmyvibe supports targeted/scoped scanning for rapid iteration during development, as well as full audits before release. When a specific scope or slash command is specified, execute only the mapped checks:
+
+| Scope / Command Keyword | Included Checks | Description / Focus Area |
+| :--- | :--- | :--- |
+| **`secrets`** | **Check 1a + Check 1b + Check 2** | Server-side and client-exposed credentials, API keys, tokens, and `.gitignore` file protection |
+| **`auth`** | **Check 3** | Missing, mock, stubbed, or bypassed authentication guards |
+| **`db`** | **Check 4** | Database & BaaS rules, Supabase RLS policies, Firebase/storage permissions |
+| **`backend`** | **Check 1a + Check 3 + Check 4 + Check 5 + Check 6 (server-side) + Check 7 (server-side)** | All server-side logic: hardcoded server credentials, auth guards, database configs, IDOR/BOLA, SQLi/input validation, mass assignment, and payment/webhook processing |
+| **`frontend`** | **Check 1b + Check 3 (client-side view) + Check 7 (client-side view)** | Client-side bundle leaks, UI-only auth hiding, and client-controlled payment/pricing logic |
+| **`payment`** | **Check 7** | Client-side payment amount tampering, price overrides, unverified webhooks, and checkout integrity |
+| *(no argument / `full`)* | **All Checks (1a–7)** | Full production readiness and code quality audit |
+
+> **Canonical definitions note:** The check definitions in this file are canonical. The scoped command files (`commands/checkmyvibe-*.md`) contain mirrored copies of their relevant checks so they can run standalone. When you change what a check does, update it here AND in every command file that mirrors it.
+
+### Rules for Scoped Runs:
+- **Execute only the selected checks:** Do not run unselected check scripts or inspect code outside the chosen scope.
+- **Explicit scope transparency:** At the start and in the final summary of the report, clearly state which checks were run and which checks were skipped.
+- **No false safety claims:** A clean scoped scan does **not** mean the app is ready for production. State clearly: *"This was a [scope]-only check. Run a full `/checkmyvibe` audit across all categories prior to launch."*
+
 ## Before you start
 
 1. **Analyze and understand the whole project first:** Walk the directory tree and analyze the repository configuration files before running any checks, generating findings, or providing instructions. Establish a solid high-level understanding of the architecture, components, and data flow.
@@ -70,7 +90,7 @@ Critical user exposure > auth bypass > IDOR > payment logic > config issues > hy
 
 The report should help the coding agent make the repo safer in the next commit, not just describe problems.
 
-## Check 1: Exposed secrets and credentials
+## Check 1a: Server-side secrets and credentials
 
 **Run the script** `scripts/scan_secrets.py` (located relative to this `SKILL.md` file) against the project root. It flags known key
 prefixes (`sk_live`, `sk_test`, `AIza`, `AKIA`, `ghp_`, `xox[bp]`), high-entropy
@@ -79,14 +99,13 @@ strings, and variable assignments where a name like `key`, `secret`, `token`, or
 
 **What counts as a finding:**
 
-- A real credential committed directly in source, e.g.:
-  `const stripeKey = "sk_live_51H8x..."` — Critical
-- A secret present only in `.env` but `.env` is not gitignored (see Check 2) —
-  Critical, because it WILL leak on the next commit even if it hasn't yet
-- A secret exposed to the client bundle — e.g. a server-only key referenced in
-  frontend code, or a Next.js env var missing the required server-only scoping
-  (using a secret key where only `NEXT_PUBLIC_`-prefixed vars should appear) —
-  Critical, this is directly shippable to every visitor's browser
+- A real credential committed directly in server-side source, e.g.:
+  `const stripeKey = "sk_live_51H8x..."` — **Critical**
+- A **live** Stripe secret key (`sk_live_...`) anywhere in source — **Critical**, charges real cards
+- A **test** Stripe secret key (`sk_test_...`) committed in source — **Should Fix**, not production-critical but test keys still must not be committed; rotate if the repo has ever been shared
+- A server-only credential referenced in frontend code, or a Next.js env var
+  missing the required server-only scoping (using a secret key where only
+  `NEXT_PUBLIC_`-prefixed vars should appear) — **Critical**, this is directly shippable to every visitor's browser
 
 **What is NOT a finding (avoid false positives):**
 
@@ -96,6 +115,20 @@ strings, and variable assignments where a name like `key`, `secret`, `token`, or
   configured. Note this distinction explicitly in the report so the user isn't
   confused about why one key is fine and another isn't.
 - Example/placeholder values clearly meant as documentation, e.g. `"your-api-key-here"`
+- Fake credentials inside unit tests, fixtures, or mock files (the scripts already skip these directories; if you find one manually, do not report it)
+
+## Check 1b: Client-exposed secrets (frontend scope view)
+
+This is the client-facing slice of Check 1a, used by the `frontend` scope. Focus on:
+
+- Secrets reachable from the client bundle: any secret referenced in frontend
+  code, anything passed through `NEXT_PUBLIC_*` / `VITE_*` / `REACT_APP_*` env
+  vars that isn't genuinely public, and secrets inlined in client config files.
+- Service-role keys (Supabase `service_role`, Firebase admin SDK private keys,
+  OpenAI/Stripe secret keys) appearing anywhere under `src/`, `app/`,
+  `components/`, `public/`, or client entry points — **Critical**.
+
+The severity rules and false-positive guidance from Check 1a apply unchanged.
 
 ## Check 2: .gitignore hygiene
 
@@ -213,6 +246,14 @@ Spot-check forms and API endpoints for:
 - User input rendered into HTML without escaping (XSS risk), especially in
   frameworks that don't auto-escape by default
 - File uploads with no restriction on file type or size
+- **Mass assignment:** request bodies spread directly into ORM create/update calls,
+  e.g. `await prisma.user.update({ where: { id }, data: req.body })` — lets a user
+  set fields they should never control (`role`, `plan`, `isAdmin`, `emailVerified`).
+  Flag when the body is not explicitly whitelisted to safe fields. — Critical if a
+  privileged field can be set, otherwise Should Fix
+- **No rate limiting on auth endpoints:** login, signup, password reset, and OTP
+  endpoints with no throttle/attempt limit allow credential stuffing and SMS-cost
+  abuse — Worth Reviewing at minimum, Should Fix for payment-handling apps
 
 This check doesn't need to be exhaustive — flag the clearest, highest-impact
 examples rather than every single form field, and note in the summary that a
@@ -239,6 +280,30 @@ app.post('/api/checkout', async (req, res) => {
 });
 ```
 
+Also check **payment webhook signature verification** — this is the sibling flaw to
+client-side pricing and just as common:
+
+- A webhook endpoint (Stripe, Firebase, PayPal, Razorpay) that reads the event body
+  and acts on it **without verifying the signature first**. Anyone who finds the URL
+  can POST `{ "type": "payment_intent.succeeded", ... }` and get their order marked paid.
+- Correct pattern (Express + Stripe):
+  ```js
+  app.post('/api/webhooks/stripe',
+    express.raw({ type: 'application/json' }), // raw body required for signature check
+    (req, res) => {
+      const event = stripe.webhooks.constructEvent(
+        req.body, req.headers['stripe-signature'], process.env.STRIPE_WEBHOOK_SECRET
+      );
+      // only now is the event trustworthy
+    });
+  ```
+- Equivalent checks: Firebase Cloud Functions `onRequest` deployed with secret
+  headers compared server-side, PayPal webhook `verify-webhook-signature` API,
+  Razorpay `verifyPaymentSignature`. If a webhook route exists and no signature
+  verification call exists anywhere in the flow — **Critical**.
+- Discount/coupon values accepted from the client rather than looked up from a
+  trusted source server-side — same severity as price tampering.
+
 ---
 
 ## Severity rubric
@@ -285,6 +350,8 @@ Once the checks are complete, create a readiness review report. **The report mus
 - what still needs attention
 - the final readiness verdict
 
+**Post-fix verification:** if you applied fixes during this session, re-run the scripts for every category you touched and confirm the finding is actually gone before marking it fixed in the report. Report before/after per check (e.g. "scan_secrets.py: 3 findings → 0 findings"). A fix that hasn't been re-scanned must be listed as "applied, not yet verified", never as resolved.
+
 If no issues are found, still produce a short report that says no blocking issues were found in this pass, which categories were checked, and what the remaining scope limits are.
 
 ## Example report style
@@ -306,11 +373,9 @@ End every review with, in this order:
 2. Total findings by severity, e.g. "2 Critical, 3 Should Fix, 1 Worth Reviewing"
 3. A one-line verdict: "Not ready to ship — fix the Critical items first" or "No
    blocking issues found in this pass — review the Should Fix items when you can"
-4. The scope reminder: "This review covers common configuration patterns seen in AI-generated code —
-   exposed secrets, auth stubs, database rules, object-level authorization, input validation,
-   and client-side payment logic. It is not a comprehensive third-party safety audit or pentest. If this app
-   handles payment, health, or other regulated data, get a professional external review
-   before launch regardless of these results."
+4. The scope reminder:
+   - **For Full Audit:** "This review covers common configuration patterns seen in AI-generated code — exposed secrets, auth stubs, database rules, object-level authorization, input validation, and client-side payment logic. It is not a comprehensive third-party safety audit or pentest. If this app handles payment, health, or other regulated data, get a professional external review before launch regardless of these results."
+   - **For Scoped Scan:** "This was a focused [SCOPE]-only check ([LIST OF RUN CHECKS]). Skipped checks: [LIST OF SKIPPED CHECKS]. A clean scoped check does not mean the application is production-ready. Always run a full `/checkmyvibe` audit prior to release, and obtain a professional external security review if handling sensitive or regulated data."
 
 ## Notes for the agent
 

package/commands/checkmyvibe-auth.md

@@ -0,0 +1,46 @@
+# /checkmyvibe-auth — Missing or fake authentication
+
+First, locate the checkmyvibe skill file `SKILL.md`. Check these paths in order:
+
+1. `.claude/skills/checkmyvibe/SKILL.md` (project-level install)
+2. `~/.claude/skills/checkmyvibe/SKILL.md` (global install)
+3. If neither exists, search the working directory for a file named `SKILL.md` whose frontmatter contains `name: checkmyvibe`
+
+Use SKILL.md **only** for the report format, severity rubric, and final-summary structure. The complete operating instructions for this scope are below — follow them even if SKILL.md cannot be found.
+
+**Optional argument:** a target directory may be passed after the command. Default to the project root if not given. Scripts live in the `scripts/` folder next to SKILL.md.
+
+## Scope
+
+This is an **authentication-only check** (Check 3). Checks 1a/1b, 2, 4, 5, 6, and 7 are skipped and must be listed as skipped in the final summary.
+
+## Step 1 — Run the first-pass script
+
+```bash
+python <skill_dir>/scripts/check_auth_patterns.py <target>
+```
+
+It flags stub names (`mockAuth`, `fakeLogin`, `tempAuth`, `bypassAuth`, ...) and always-true auth functions. If Python is unavailable or it fails, say so and do the equivalent greps manually. The script skips test directories — do not report mock auth inside unit tests even if you see it manually.
+
+## Step 2 — Manual reasoning pass (this is where the real findings are)
+
+The script is a first pass only. Read the actual auth code: login handlers, middleware, route guards, session checks, and every route that returns or modifies user-specific data.
+
+Findings to hunt for:
+
+- **Always-true stubs:** `function isAuthenticated() { return true; }`, `const checkAdmin = () => true` — Critical.
+- **Stub-named helpers still wired in:** `mockAuth`, `devAuth`, `bypassAuth` reachable in production paths — Critical. Properly guarded behind `NODE_ENV === 'development'` → Should Fix (env misconfig leaks these constantly); verify the guard actually covers every import/call site.
+- **Protected routes with no auth check at all:** list every route returning user-specific data, then check each one calls the session/auth middleware. A `/api/orders/:id` with no guard is Critical regardless of what the UI does.
+- **Client-side-only enforcement:** UI hides a button/route for logged-out users but the underlying API never verifies the session — Critical. Anyone calls the API directly. To confirm this you MUST read the corresponding server route; do not clear a finding from the frontend alone.
+- **Commented-out auth checks** with an active bypass nearby.
+- **JWT/session verification gaps:** tokens decoded but not verified (`jwt.decode` instead of `jwt.verify`, no algorithm pinning), sessions accepted from client-controlled storage without server validation — Critical.
+
+## Step 3 — Judgment rules
+
+- Read the function body fully before flagging or clearing — never decide from the name alone.
+- Prefer one precise finding over several weak ones; tag uncertain items `High confidence` / `Medium confidence` / `Needs manual review`.
+- Identify the stack's intended auth mechanism (NextAuth, Clerk, Supabase Auth, custom JWT) first; "missing" means missing relative to how routes access user data, not absence of a specific library.
+
+## Report
+
+Use the format, severity rubric, and final-summary structure from SKILL.md. Scope reminder: "authentication-only check — secrets, .gitignore, database rules, IDOR, input validation, and payment checks were skipped. This does not mean the app is production-ready. Run a full `/checkmyvibe` audit before launch."

package/commands/checkmyvibe-backend.md

@@ -0,0 +1,62 @@
+# /checkmyvibe-backend — Server-side audit
+
+First, locate the checkmyvibe skill file `SKILL.md`. Check these paths in order:
+
+1. `.claude/skills/checkmyvibe/SKILL.md` (project-level install)
+2. `~/.claude/skills/checkmyvibe/SKILL.md` (global install)
+3. If neither exists, search the working directory for a file named `SKILL.md` whose frontmatter contains `name: checkmyvibe`
+
+Use SKILL.md **only** for the report format, severity rubric, and final-summary structure. The complete operating instructions for this scope are below — follow them even if SKILL.md cannot be found.
+
+**Optional argument:** a target directory may be passed after the command. Default to the project root if not given. Scripts live in the `scripts/` folder next to SKILL.md.
+
+## Scope
+
+This is a **backend-only check**: Check 1a (server-side secrets) + Check 3 (auth) + Check 4 (db) + Check 5 (IDOR) + Check 6 server-side + Check 7 server-side. Skipped and to be listed as such in the summary: Check 1b (client-exposed secrets), Check 2 (.gitignore hygiene), and client-side views of checks 3/6/7.
+
+## Step 1 — Run all three scripts
+
+```bash
+python <skill_dir>/scripts/scan_secrets.py <target>
+python <skill_dir>/scripts/check_auth_patterns.py <target>
+python <skill_dir>/scripts/check_db_config.py <target>
+```
+
+Triage per the rules in `/checkmyvibe-secrets`, `/checkmyvibe-auth`, and `/checkmyvibe-db` respectively: live keys Critical / test keys Should Fix; mock-auth hits outside tests need manual reading; missing RLS and `USING (true)` policies are Critical on user-data tables. If Python is unavailable, do each check manually and say so in the report.
+
+## Step 2 — IDOR sweep (Check 5 — spend the most time here)
+
+This is the single most common serious flaw in AI-generated apps. Enumerate every route that takes an ID (URL param, query string, or body field) and touches a database record:
+
+```js
+// Finding example — Critical: any logged-in user reads ANY order
+app.get('/api/orders/:id', requireAuth, async (req, res) => {
+  const order = await db.query('SELECT * FROM orders WHERE id = $1', [req.params.id]);
+  res.json(order);
+});
+
+// Correct fix pattern: scope by owner, return 404 when absent
+const order = await db.query(
+  'SELECT * FROM orders WHERE id = $1 AND user_id = $2', [req.params.id, req.user.id]);
+if (!order) return res.status(404).json({ error: 'Not found' });
+```
+
+Check GET (exposure), PUT/PATCH (unauthorized modification), and DELETE (often most damaging) for all of them. An auth guard alone is not enough — ownership must be enforced in the query or immediately after fetch.
+
+## Step 3 — Server-side input handling (Check 6)
+
+- SQL built by string concatenation instead of parameterized queries/ORM → Critical.
+- **Mass assignment:** `req.body` spread straight into ORM create/update (`prisma.user.update({ data: req.body })`, `User.findByIdAndUpdate(id, req.body)`) letting users set `role`, `plan`, `isAdmin`, `emailVerified` → Critical; non-privileged fields → Should Fix.
+- Unescaped user input into HTML in non-auto-escaping frameworks → flag worst cases.
+- Login/signup/password-reset/OTP endpoints with no rate limiting → Should Fix for payment-handling apps, Worth Reviewing otherwise.
+- File uploads with no type/size restriction.
+
+## Step 4 — Payment processing & webhooks (Check 7, server side)
+
+- Price/discount/total taken from request body, query param, or hidden field instead of looked up from the DB → Critical.
+- **Webhook signature verification:** every payment webhook route (Stripe, PayPal, Razorpay, Firebase) must verify the signature before trusting the body — e.g. Stripe's `stripe.webhooks.constructEvent(rawBody, sigHeader, webhookSecret)` with the raw body. A webhook route with no signature verification anywhere in its flow → Critical: anyone can POST "payment succeeded" and get their order marked paid.
+- Webhook handlers acting on unverified amounts read from the event body → same severity.
+
+## Report
+
+Use the format, severity rubric, evidence/confidence rules, and post-fix verification step from SKILL.md. Fix priority when multiple issues exist: critical user exposure > auth bypass > IDOR > payment logic > config > hygiene. Scope reminder: "backend-only check — client-exposed secrets, .gitignore hygiene, and frontend-side views were skipped. This does not mean the app is production-ready. Run a full `/checkmyvibe` audit before launch."

package/commands/checkmyvibe-db.md

@@ -0,0 +1,51 @@
+# /checkmyvibe-db — Database & BaaS misconfiguration
+
+First, locate the checkmyvibe skill file `SKILL.md`. Check these paths in order:
+
+1. `.claude/skills/checkmyvibe/SKILL.md` (project-level install)
+2. `~/.claude/skills/checkmyvibe/SKILL.md` (global install)
+3. If neither exists, search the working directory for a file named `SKILL.md` whose frontmatter contains `name: checkmyvibe`
+
+Use SKILL.md **only** for the report format, severity rubric, and final-summary structure. The complete operating instructions for this scope are below — follow them even if SKILL.md cannot be found.
+
+**Optional argument:** a target directory may be passed after the command. Default to the project root if not given. Scripts live in the `scripts/` folder next to SKILL.md.
+
+## Scope
+
+This is a **database-only check** (Check 4). Checks 1a/1b, 2, 3, 5, 6, and 7 are skipped and must be listed as skipped in the final summary.
+
+## Step 1 — Run the first-pass script
+
+```bash
+python <skill_dir>/scripts/check_db_config.py <target>
+```
+
+It scans SQL files for tables created without RLS and permissive policies (`USING (true)` / `WITH CHECK (true)`), Firestore/storage rules for `allow ...: if true`, and Realtime Database rules set to `"true"`. If Python is unavailable or it fails, do the equivalent checks by reading schema/rules files manually and say so in the report.
+
+## Step 2 — Supabase (if used)
+
+- Every table holding user-specific data must have `ENABLE ROW LEVEL SECURITY`. A table without it → Critical.
+- Policies granting broad access fail: `FOR SELECT USING (true)`, policies `TO public/anon` with unconditional USING/CHECK → Critical.
+- Recommended fix pattern:
+  ```sql
+  CREATE POLICY "users see own orders" ON orders
+    FOR SELECT USING (auth.uid() = user_id);
+  ```
+- Check migrations/schema files under `supabase/migrations/`, `db/`, or wherever `.sql` files live. Also confirm RLS wasn't enabled *after* data was already readable via the anon key in earlier deployments.
+
+## Step 3 — Firebase (if used)
+
+- `firestore.rules`: any `allow read, write: if true;` on collections holding user data → Critical. Test-mode rules (`allow read, write: if <timestamp>`) pasted into prod-like configs → Should Fix minimum.
+- `database.rules.json` (Realtime DB): `".read": "true"` / `".write": "true"` on user-data nodes → Critical.
+- Rules files present but clearly unused/default → Worth Reviewing; verify which project they deploy to.
+
+## Step 4 — Storage buckets
+
+Supabase Storage, Firebase Storage, S3:
+
+- Public buckets holding private user content (documents, receipts, profile files) → Critical.
+- Public buckets for genuinely public assets (avatars, static images) → not findings; note the distinction.
+
+## Report
+
+Use the format, severity rubric, and final-summary structure from SKILL.md. Scope reminder: "database-only check — secrets, .gitignore, authentication, IDOR, input validation, and payment checks were skipped. This does not mean the app is production-ready. Run a full `/checkmyvibe` audit before launch."

package/commands/checkmyvibe-frontend.md

@@ -0,0 +1,48 @@
+# /checkmyvibe-frontend — Client-side audit
+
+First, locate the checkmyvibe skill file `SKILL.md`. Check these paths in order:
+
+1. `.claude/skills/checkmyvibe/SKILL.md` (project-level install)
+2. `~/.claude/skills/checkmyvibe/SKILL.md` (global install)
+3. If neither exists, search the working directory for a file named `SKILL.md` whose frontmatter contains `name: checkmyvibe`
+
+Use SKILL.md **only** for the report format, severity rubric, and final-summary structure. The complete operating instructions for this scope are below — follow them even if SKILL.md cannot be found.
+
+**Optional argument:** a target directory may be passed after the command. Default to the project root if not given. Scripts live in the `scripts/` folder next to SKILL.md.
+
+## Scope
+
+This is a **frontend-only check**: Check 1b (client-exposed secrets) + Check 3 viewed from the client (UI-only enforcement) + Check 7 viewed from the client (client-controlled pricing). Skipped and to be listed as such in the summary: Check 1a standalone triage, Check 2 (.gitignore), Check 4 (db rules), Check 5 (IDOR sweep), and full server-side reviews of auth/input/payment.
+
+## Step 1 — Client-exposed secrets (run script, then manual pass)
+
+```bash
+python <skill_dir>/scripts/scan_secrets.py <target>
+```
+
+Then manually inspect everything reachable from the browser:
+
+- Framework env prefixes bundle values INTO shipped JS: `NEXT_PUBLIC_*`, `VITE_*`, `REACT_APP_*`, `EXPO_PUBLIC_*`. Any secret behind one of these → Critical.
+- Supabase `service_role` key, Firebase admin SDK JSON, OpenAI/Stripe secret keys anywhere under `src/`, `app/`, `components/`, `pages/`, `public/`, or client entry files → Critical.
+- Publishable keys (`pk_`, Supabase anon key, Firebase web config `apiKey`) are public-by-design → NOT findings; say so explicitly so the report isn't confusing.
+- Placeholders and test-fixture values → not findings.
+
+## Step 2 — UI-only auth enforcement (Check 3, client view)
+
+Find every place the UI gates access: redirects on protected pages, hidden nav items, disabled buttons, client route guards:
+
+- For each gated feature, open the corresponding API route/mutation and confirm it independently verifies the session server-side. If it does not → Critical ("hiding the button does nothing; anyone calls the API directly").
+- Auth state trusted purely from client storage (localStorage JWT, global store) to protect data → Critical if no server verification exists.
+- You must read the server routes to clear or confirm findings — a clean-looking frontend proves nothing on its own.
+
+## Step 3 — Client-controlled pricing (Check 7, client view)
+
+Inspect checkout/cart/pricing flows:
+
+- Prices, discounts, totals, or quantities computed client-side and sent as the chargeable value (hidden form fields, request bodies, query params) → Critical on the corresponding server endpoint.
+- Coupon codes validated only in the UI → flag the endpoint that accepts them without server-side validation.
+- Note exactly which server endpoint accepts the tainted value so the backend fix is obvious.
+
+## Report
+
+Use the format, severity rubric, and final-summary structure from SKILL.md. Scope reminder: "frontend-only check — server-side secret triage, .gitignore hygiene, database rules, IDOR, server input validation, and webhook verification were skipped. This does not mean the app is production-ready. Run a full `/checkmyvibe` audit before launch."

package/commands/checkmyvibe-payment.md

@@ -0,0 +1,52 @@
+# /checkmyvibe-payment — Payment & pricing integrity
+
+First, locate the checkmyvibe skill file `SKILL.md`. Check these paths in order:
+
+1. `.claude/skills/checkmyvibe/SKILL.md` (project-level install)
+2. `~/.claude/skills/checkmyvibe/SKILL.md` (global install)
+3. If neither exists, search the working directory for a file named `SKILL.md` whose frontmatter contains `name: checkmyvibe`
+
+Use SKILL.md **only** for the report format, severity rubric, and final-summary structure. The complete operating instructions for this scope are below — follow them even if SKILL.md cannot be found.
+
+**Optional argument:** a target directory may be passed after the command. Default to the project root if not given. Scripts live in the `scripts/` folder next to SKILL.md.
+
+## Scope
+
+This is a **payment/pricing-only check** (Check 7, both client and server views). Checks 1a/1b, 2, 3, 4, 5, and 6 are skipped and must be listed as skipped in the final summary. Note: if this app handles real payments, state in the report that a professional external review is strongly recommended regardless of findings.
+
+## Step 1 — Map the payment surface
+
+Identify the provider (Stripe, PayPal, Razorpay, Firebase-based, custom) and locate: checkout endpoints, webhook routes, cart/price calculation code (client and server), subscription/plan management, and coupon/discount handling. If there is no payment code at all, report "No issues found — no payment flow exists" and stop.
+
+## Step 2 — Server-side price trust
+
+For each chargeable action:
+
+- Is the amount read from the request (body field, query param, hidden form field) or computed from client-supplied data? → Critical:
+  ```js
+  // Finding example — Critical
+  const { productId, price } = req.body;
+  await chargeCard(req.user.paymentMethod, price);
+
+  // Correct fix pattern — server looks up the price
+  const { productId } = req.body;
+  const product = await db.query('SELECT price FROM products WHERE id = $1', [productId]);
+  await chargeCard(req.user.paymentMethod, product.price);
+  ```
+- Quantities, currency, plan tiers, or seat counts accepted from the client and multiplied into totals without server-side lookup → same severity.
+- Coupons/discounts validated only on the client, or discount values sent by the client rather than looked up server-side → Critical.
+- Free-trial/trial-flag booleans trusted from request bodies → Critical (anyone posts `trial: true` forever).
+
+## Step 3 — Webhook signature verification (most-missed check)
+
+Every payment webhook route must verify authenticity BEFORE trusting or acting on its body:
+
+- Stripe: `stripe.webhooks.constructEvent(rawBody, sigHeader, process.env.STRIPE_WEBHOOK_SECRET)` with `express.raw({ type: 'application/json' })` on the route. No signature verification anywhere in the handler chain → Critical: anyone who finds the URL can POST a fake `payment_intent.succeeded` and get orders marked paid for free.
+- PayPal: `verify-webhook-signature` API call missing → Critical.
+- Razorpay: missing `verifyPaymentSignature` / HMAC comparison → Critical.
+- Firebase/custom webhooks: no shared-secret header compared server-side → Critical.
+- Also flag webhook handlers that fulfill orders based on amounts read from the unverified event payload instead of re-fetching them server-side.
+
+## Report
+
+Use the format, severity rubric, and final-summary structure from SKILL.md. Scope reminder: "payment-only check — secrets, .gitignore, authentication, database rules, IDOR, and input validation were skipped. This does not mean the app is production-ready. Run a full `/checkmyvibe` audit before launch, and get a professional security review before handling real money."

package/commands/checkmyvibe-secrets.md

@@ -0,0 +1,55 @@
+# /checkmyvibe-secrets — Exposed secrets & .gitignore hygiene
+
+First, locate the checkmyvibe skill file `SKILL.md`. Check these paths in order:
+
+1. `.claude/skills/checkmyvibe/SKILL.md` (project-level install)
+2. `~/.claude/skills/checkmyvibe/SKILL.md` (global install)
+3. If neither exists, search the working directory for a file named `SKILL.md` whose frontmatter contains `name: checkmyvibe`
+
+Use SKILL.md **only** for the report format, severity rubric, and final-summary structure. The complete operating instructions for this scope are below — follow them even if SKILL.md cannot be found.
+
+**Optional argument:** a target directory may be passed after the command. Default to the project root if not given. Scripts live in the `scripts/` folder next to SKILL.md.
+
+## Scope
+
+This is a **secrets-only check**: Check 1a (server-side secrets) + Check 1b (client-exposed secrets) + Check 2 (.gitignore hygiene). Checks 3–7 are skipped and must be listed as skipped in the final summary.
+
+## Step 1 — Run both scripts
+
+```bash
+python <skill_dir>/scripts/scan_secrets.py <target>
+python <skill_dir>/scripts/check_gitignore.py <target>
+```
+
+If Python is unavailable or a script fails, say so explicitly in the report ("automated secret scan could not run; manually reviewed instead") and do the equivalent manually: grep for key prefixes (`sk_live_`, `sk_test_`, `AIza`, `AKIA`, `ghp_`, `xox[bp]-`) and literal assignments to names containing `key`, `secret`, `token`, `password`.
+
+## Step 2 — Triage every script finding
+
+The scripts over-match on purpose. For each hit, open the file and decide:
+
+- **Live Stripe key (`sk_live_...`)** → Critical. Charges real cards. Recommend immediate rotation at dashboard.stripe.com, not just deletion.
+- **Test Stripe key (`sk_test_...`) in source** → Should Fix. Not production-critical but must not be committed; rotate if the repo was ever shared/pushed publicly.
+- **AWS `AKIA`, Google `AIza`, GitHub `ghp_`, Slack tokens in source** → Critical. Recommend revoking at the provider console.
+- **Publishable keys (`pk_live`, `pk_test`, Supabase anon keys, Firebase apiKey config)** → NOT findings. These are public-by-design; say so in one line so the user isn't confused.
+- **Placeholders** (`your-api-key-here`, `<secret>`, dummy values) → not findings.
+- Anything inside test/fixture/mock directories → not findings (the scripts already skip these).
+
+## Step 3 — Client-exposure pass (Check 1b)
+
+Manually verify secrets aren't reachable from the browser:
+
+- Grep frontend code (`src/`, `app/`, `components/`, `pages/`, `public/`, client entry points) for references to secret env vars or service-role keys.
+- In Next.js: any secret used outside a server-only context, or a secret var incorrectly prefixed with `NEXT_PUBLIC_`. In Vite/CRA: secrets behind `VITE_*` / `REACT_APP_*` get bundled into shipped JS — Critical.
+- Supabase `service_role` key, Firebase admin SDK private key JSON, OpenAI/Stripe secret keys appearing anywhere client-reachable → Critical.
+
+## Step 4 — .gitignore hygiene (Check 2)
+
+From `check_gitignore.py` output plus manual review:
+
+- `.env` / `.env.local` present but not ignored → Critical regardless of contents.
+- No `.gitignore` at all with secret files present → Critical.
+- Run `git log --all --full-history -- .env` (if git available). If `.env` was ever committed → Critical, and state plainly: removing it now is not enough; every secret in git history must be rotated because history stays recoverable.
+
+## Report
+
+Use the format, severity rubric, and final-summary structure from SKILL.md. Scope reminder for this run: "secrets-only check — Checks 3 (auth), 4 (db), 5 (IDOR), 6 (inputs), and 7 (payments) were skipped. This does not mean the app is secure. Run a full `/checkmyvibe` audit before launch."

package/commands/checkmyvibe.md

@@ -0,0 +1,26 @@
+# /checkmyvibe — Full production readiness audit
+
+First, locate the checkmyvibe skill file `SKILL.md`. Check these paths in order:
+
+1. `.claude/skills/checkmyvibe/SKILL.md` (project-level install)
+2. `~/.claude/skills/checkmyvibe/SKILL.md` (global install)
+3. If neither exists, search the working directory for a file named `SKILL.md` whose frontmatter contains `name: checkmyvibe`
+
+If it still cannot be found, tell the user and stop — do not improvise an audit without the skill definitions.
+
+**Optional argument:** a target directory may be passed after the command (e.g. `/checkmyvibe src/`). Default to the project root if not given.
+
+Then read `SKILL.md` in full and run the **complete audit: Checks 1a, 1b, 2, 3, 4, 5, 6, and 7**:
+
+- Check 1a — server-side secrets and credentials
+- Check 1b — client-exposed secrets
+- Check 2 — .gitignore hygiene (including git-history check for committed `.env`)
+- Check 3 — missing or fake authentication
+- Check 4 — database / BaaS misconfiguration (Supabase RLS, Firebase rules, storage)
+- Check 5 — broken object-level authorization (IDOR/BOLA), route by route
+- Check 6 — unvalidated inputs, SQLi/XSS risk, mass assignment, missing rate limiting on auth endpoints
+- Check 7 — client-side payment/pricing logic AND webhook signature verification
+
+Run every script in the skill's `scripts/` folder that maps to Checks 1–4 (`scan_secrets.py`, `check_gitignore.py`, `check_auth_patterns.py`, `check_db_config.py`) against the target directory before relying on your own reasoning. If Python is unavailable or a script fails, state that explicitly in the report and do the check manually instead of silently skipping it.
+
+Use the report format, severity rubric, evidence/confidence rules, post-fix verification step, and full-audit final summary structure defined in `SKILL.md`.

package/install.js

@@ -9,13 +9,17 @@ const readline = require('readline');
 const srcSkill = path.join(__dirname, 'SKILL.md');
 const srcScripts = path.join(__dirname, 'scripts');
 const srcReferences = path.join(__dirname, 'references');
+const srcCommands = path.join(__dirname, 'commands');
 
 // Destination selection
 const cwd = process.cwd();
 const hasLocalClaude = fs.existsSync(path.join(cwd, '.claude'));
 
-const localDest = path.join(cwd, '.claude', 'skills', 'checkmyvibe');
-const globalDest = path.join(os.homedir(), '.claude', 'skills', 'checkmyvibe');
+const localSkillDest = path.join(cwd, '.claude', 'skills', 'checkmyvibe');
+const localCommandsDest = path.join(cwd, '.claude', 'commands');
+
+const globalSkillDest = path.join(os.homedir(), '.claude', 'skills', 'checkmyvibe');
+const globalCommandsDest = path.join(os.homedir(), '.claude', 'commands');
 
 function copyRecursiveSync(src, dest) {
   if (fs.statSync(src).isDirectory()) {
@@ -28,34 +32,54 @@ function copyRecursiveSync(src, dest) {
   }
 }
 
-function performInstall(destPath) {
+function performInstall(skillDest, commandsDest) {
   try {
-    console.log(`\nInstalling checkmyvibe to: ${destPath}...`);
+    console.log(`\nInstalling checkmyvibe skill to: ${skillDest}...`);
     
-    // Clear destination if it already exists (overwrite mode)
-    if (fs.existsSync(destPath)) {
+    // Clear skill destination if it already exists (overwrite mode)
+    if (fs.existsSync(skillDest)) {
       if (fs.rmSync) {
-        fs.rmSync(destPath, { recursive: true, force: true });
+        fs.rmSync(skillDest, { recursive: true, force: true });
       } else {
-        fs.rmdirSync(destPath, { recursive: true });
+        fs.rmdirSync(skillDest, { recursive: true });
       }
     }
-    fs.mkdirSync(destPath, { recursive: true });
+    fs.mkdirSync(skillDest, { recursive: true });
 
     // Copy SKILL.md
-    fs.copyFileSync(srcSkill, path.join(destPath, 'SKILL.md'));
+    fs.copyFileSync(srcSkill, path.join(skillDest, 'SKILL.md'));
     
-    // Copy folders
-    copyRecursiveSync(srcScripts, path.join(destPath, 'scripts'));
-    copyRecursiveSync(srcReferences, path.join(destPath, 'references'));
+    // Copy folders into skill destination
+    copyRecursiveSync(srcScripts, path.join(skillDest, 'scripts'));
+    copyRecursiveSync(srcReferences, path.join(skillDest, 'references'));
+    if (fs.existsSync(srcCommands)) {
+      copyRecursiveSync(srcCommands, path.join(skillDest, 'commands'));
+    }
+
+    // Install slash commands into agent commands directory
+    if (fs.existsSync(srcCommands)) {
+      console.log(`Installing slash commands to: ${commandsDest}...`);
+      fs.mkdirSync(commandsDest, { recursive: true });
+      fs.readdirSync(srcCommands).forEach((cmdFile) => {
+        if (cmdFile.endsWith('.md')) {
+          fs.copyFileSync(path.join(srcCommands, cmdFile), path.join(commandsDest, cmdFile));
+        }
+      });
+    }
 
     console.log('\n=========================================');
-    console.log('🎉 checkmyvibe Agent Skill installed!');
+    console.log('🎉 checkmyvibe Agent Skill & Commands installed!');
     console.log('=========================================');
     console.log('\nHow to run checkmyvibe:');
-    console.log('1. Open your terminal in the target repository.');
-    console.log('2. Ask your coding agent: "run checkmyvibe" or "perform a readiness check"');
-    console.log('3. The agent will execute checkmyvibe\'s checks and output a prioritized report!');
+    console.log('• Full Audit:');
+    console.log('  /checkmyvibe  or  "run checkmyvibe"');
+    console.log('\n• Focused / Scoped Scans:');
+    console.log('  /checkmyvibe secrets   (or /checkmyvibe-secrets)   -> Exposed secrets & .gitignore');
+    console.log('  /checkmyvibe auth      (or /checkmyvibe-auth)      -> Authentication checks');
+    console.log('  /checkmyvibe db        (or /checkmyvibe-db)        -> Database & BaaS rules / RLS');
+    console.log('  /checkmyvibe backend   (or /checkmyvibe-backend)   -> Server-side (auth, db, IDOR, input, payment)');
+    console.log('  /checkmyvibe frontend  (or /checkmyvibe-frontend)  -> Client-side (bundle leaks, client auth, pricing)');
+    console.log('  /checkmyvibe payment   (or /checkmyvibe-payment)   -> Payment & pricing integrity');
     console.log('=========================================\n');
   } catch (err) {
     console.error('Error installing skill:', err.message);
@@ -65,7 +89,7 @@ function performInstall(destPath) {
 
 if (hasLocalClaude) {
   // If .claude folder exists in the project root, install at project level directly
-  performInstall(localDest);
+  performInstall(localSkillDest, localCommandsDest);
 } else {
   // Prompt user for local vs global/personal installation
   const rl = readline.createInterface({
@@ -74,16 +98,16 @@ if (hasLocalClaude) {
   });
 
   console.log('No local .claude/ directory detected in the current working directory.');
-  console.log(`1. Install locally to current directory: ${path.join('.claude', 'skills', 'checkmyvibe')}`);
-  console.log(`2. Install globally/personally: ${globalDest.replace(os.homedir(), '~')}`);
+  console.log(`1. Install locally to current directory: ${path.join('.claude', 'skills', 'checkmyvibe')} & ${path.join('.claude', 'commands')}`);
+  console.log(`2. Install globally/personally: ${globalSkillDest.replace(os.homedir(), '~')} & ${globalCommandsDest.replace(os.homedir(), '~')}`);
   
   rl.question('\nSelect installation destination (1 or 2, default 2): ', (answer) => {
     rl.close();
     const selection = answer.trim();
     if (selection === '1') {
-      performInstall(localDest);
+      performInstall(localSkillDest, localCommandsDest);
     } else {
-      performInstall(globalDest);
+      performInstall(globalSkillDest, globalCommandsDest);
     }
   });
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "checkmyvibe",
-  "version": "1.0.2",
+  "version": "1.2.0",
   "description": "A structured production readiness and code quality workflow Agent Skill for AI coding assistants to catch common vibe-coded configuration issues.",
   "main": "install.js",
   "bin": {
@@ -9,6 +9,7 @@
   },
   "files": [
     "SKILL.md",
+    "commands/",
     "scripts/",
     "references/",
     "install.js",

package/scripts/check_auth_patterns.py

@@ -2,12 +2,22 @@
 import os
 import sys
 import re
+import fnmatch
 
 SKIP_DIRS = {
     'node_modules', '.git', 'build', 'dist', '.next', '.svelte-kit', 
-    '__pycache__', 'venv', '.venv', 'env', 'coverage', 'out'
+    '__pycache__', 'venv', '.venv', 'env', 'coverage', 'out',
+    # Test/support directories: mock auth there is intentional, not a finding
+    '__tests__', '__mocks__', '__snapshots__', 'tests', 'test', 'spec',
+    'fixtures', 'mocks', 'e2e', 'cypress', '.storybook'
 }
 
+TEST_FILE_PATTERNS = ['*.test.*', '*.spec.*', '*.stories.*', '*.mock.*']
+
+def is_test_file(filename):
+    """Skip unit-test/spec/story/mock files: stubbed auth there is expected."""
+    return any(fnmatch.fnmatch(filename, pat) for pat in TEST_FILE_PATTERNS)
+
 SKIP_EXTS = {
     '.png', '.jpg', '.jpeg', '.gif', '.ico', '.pdf', '.zip', '.tar', 
     '.gz', '.mp3', '.mp4', '.mov', '.db', '.sqlite', '.exe', '.dll',
@@ -98,7 +108,7 @@ def main():
         
         for file in files:
             ext = os.path.splitext(file)[1].lower()
-            if ext in SKIP_EXTS or file.startswith('.'):
+            if ext in SKIP_EXTS or is_test_file(file) or file.startswith('.'):
                 continue
                 
             file_path = os.path.join(root, file)

package/scripts/check_db_config.py

@@ -2,8 +2,18 @@
 import os
 import sys
 import re
+import fnmatch
 
-SKIP_DIRS = {'node_modules', '.git', 'dist', 'build'}
+SKIP_DIRS = {
+    'node_modules', '.git', 'dist', 'build',
+    '__tests__', '__mocks__', 'tests', 'test', 'spec', 'fixtures',
+    'mocks', 'e2e', 'cypress'
+}
+
+TEST_FILE_PATTERNS = ['*.test.*', '*.spec.*', '*.mock.*']
+
+def is_test_file(filename):
+    return any(fnmatch.fnmatch(filename, pat) for pat in TEST_FILE_PATTERNS)
 
 # Permissive rules patterns for Firestore and Firebase Storage
 FIREBASE_PERMISSIVE = re.compile(r'allow\s+[\w\s,]+:\s*if\s+true\s*;')
@@ -108,6 +118,8 @@ def main():
         dirs[:] = [d for d in dirs if d not in SKIP_DIRS and not d.startswith('.')]
         
         for file in files:
+            if is_test_file(file):
+                continue
             file_path = os.path.join(root, file)
             rel_path = os.path.relpath(file_path, target_dir)
             

package/scripts/scan_secrets.py

@@ -3,14 +3,24 @@ import os
 import sys
 import re
 import math
+import fnmatch
 
 # Directories to skip during scanning
 SKIP_DIRS = {
     'node_modules', '.git', 'build', 'dist', '.next', '.svelte-kit', 
     '__pycache__', 'venv', '.venv', 'env', 'coverage', 'out', '.expo',
-    '.output', '.nuxt'
+    '.output', '.nuxt',
+    # Test/support directories: mocked credentials here are expected, not leaks
+    '__tests__', '__mocks__', '__snapshots__', 'tests', 'test', 'spec',
+    'fixtures', 'mocks', 'e2e', 'cypress', '.storybook'
 }
 
+TEST_FILE_PATTERNS = ['*.test.*', '*.spec.*', '*.stories.*', '*.mock.*']
+
+def is_test_file(filename):
+    """Skip unit-test/spec/story/mock files: fake keys there are intentional."""
+    return any(fnmatch.fnmatch(filename, pat) for pat in TEST_FILE_PATTERNS)
+
 # File extensions to skip (binary/media/lockfiles/assets)
 SKIP_EXTS = {
     '.png', '.jpg', '.jpeg', '.gif', '.ico', '.pdf', '.zip', '.tar', 
@@ -20,12 +30,13 @@ SKIP_EXTS = {
     '.svg', '.css', '.scss', '.less', '.html', '.xml'
 }
 
-# Regexes for known API key formats
+# Regexes for known API key formats (live keys are Critical; test keys are Should Fix)
 API_KEY_PATTERNS = [
     (re.compile(r'AIza[0-9A-Za-z-_]{35}'), 'Google API Key'),
     (re.compile(r'AKIA[0-9A-Z]{16}'), 'AWS Access Key ID'),
     (re.compile(r'ghp_[a-zA-Z0-9]{36,40}'), 'GitHub Personal Access Token'),
-    (re.compile(r'sk_(live|test)_[0-9a-zA-Z]{24,96}'), 'Stripe Secret Key'),
+    (re.compile(r'sk_live_[0-9a-zA-Z]{24,96}'), 'Stripe LIVE Secret Key (Critical: charges real cards)'),
+    (re.compile(r'sk_test_[0-9a-zA-Z]{24,96}'), 'Stripe TEST Secret Key (Should Fix: not production-critical but must not be committed)'),
     (re.compile(r'xox[bapr]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32}'), 'Slack Token'),
 ]
 
@@ -134,7 +145,9 @@ def main():
         for file in files:
             ext = os.path.splitext(file)[1].lower()
             # Skip hidden files unless they are .env configuration files
-            if ext in SKIP_EXTS or (file.startswith('.') and not file.startswith('.env')):
+            if ext in SKIP_EXTS or is_test_file(file):
+                continue
+            if file.startswith('.') and not file.startswith('.env'):
                 continue
                 
             file_path = os.path.join(root, file)