checkmyvibe 1.2.0 → 1.3.0

package/scripts/check_payment_config.py

@@ -0,0 +1,146 @@
+#!/usr/bin/env python3
+import os
+import sys
+import re
+import fnmatch
+
+# Ensure stdout supports UTF-8 on Windows
+if hasattr(sys.stdout, 'reconfigure'):
+    sys.stdout.reconfigure(encoding='utf-8', errors='replace')
+
+SKIP_DIRS = {
+    'node_modules', '.git', 'dist', 'build', '.next', '.svelte-kit',
+    '__tests__', '__mocks__', 'tests', 'test', 'spec', 'fixtures',
+    'mocks', 'e2e', 'cypress', 'venv', '.venv'
+}
+
+TEST_FILE_PATTERNS = ['*.test.*', '*.spec.*', '*.mock.*']
+
+def is_test_file(filename):
+    return any(fnmatch.fnmatch(filename, pat) for pat in TEST_FILE_PATTERNS)
+
+# Patterns for client-controlled payment amounts
+CLIENT_PRICE_PATTERNS = [
+    (re.compile(r'(?i)\b(?:amount|price|unit_amount|total)\s*:\s*(?:req\.body|req\.query)\.(?:amount|price|unit_amount|total)\b'),
+     "Charge amount or price is read directly from client request body/query (Critical: client price tampering)"),
+    (re.compile(r'(?i)const\s*\{\s*[^}]*(?:price|amount|total)[^}]*\}\s*=\s*req\.body'),
+     "Price or amount extracted directly from req.body (Critical: verify amount is fetched server-side from DB)"),
+]
+
+# Patterns detecting payment webhook routes
+WEBHOOK_ROUTE_PATTERN = re.compile(
+    r'(?i)\b(?:app|router)\s*\.\s*(?:post|all)\s*\(\s*[\'"`][^\'"`]*(?:webhook|stripe|lemonsqueezy|dodo|paddle|razorpay)[^\'"`]*[\'"`]'
+)
+
+# Provider signature verification patterns
+STRIPE_SIG_PATTERN = re.compile(r'(?i)stripe\.webhooks\.constructEvent\s*\(')
+LEMON_SIG_PATTERN = re.compile(r'(?i)(?:x-signature|crypto\.createHmac|createHmac\s*\(\s*[\'"]sha256[\'"])')
+DODO_SIG_PATTERN = re.compile(r'(?i)(?:webhook-signature|dodo\.webhooks|verifyWebhookSignature)')
+PADDLE_SIG_PATTERN = re.compile(r'(?i)(?:paddle\.webhooks|validateWebhookSignature|crypto\.createHmac)')
+RAZORPAY_SIG_PATTERN = re.compile(r'(?i)(?:validateWebhookSignature|verifyPaymentSignature|crypto\.createHmac)')
+
+# Subscription cancellation lifecycle patterns
+SUB_CANCEL_PATTERNS = re.compile(
+    r'(?i)(?:customer\.subscription\.deleted|subscription_cancelled|subscription\.canceled|subscription\.expired|invoice\.payment_failed)'
+)
+
+# Billing portal IDOR
+PORTAL_IDOR_PATTERN = re.compile(
+    r'(?i)\bbillingPortal\.sessions\.create\s*\(\s*\{[^}]*customer\s*:\s*req\.body\b'
+)
+
+def scan_file(file_path):
+    findings = []
+    try:
+        with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
+            content = f.read()
+            lines = content.splitlines()
+
+        # 1. Line by line pattern matching
+        for line_num, line in enumerate(lines, 1):
+            for pattern, desc in CLIENT_PRICE_PATTERNS:
+                if pattern.search(line):
+                    findings.append((line_num, desc))
+
+            if PORTAL_IDOR_PATTERN.search(line):
+                findings.append((line_num, "Billing portal session created with customer ID from req.body (IDOR risk: user can manage another's subscription)"))
+
+        # 2. Webhook verification checks across webhook handlers
+        is_webhook_file = (
+            any(kw in file_path.lower() for kw in ['webhook', 'stripe', 'lemonsqueezy', 'dodo', 'paddle', 'razorpay'])
+            or WEBHOOK_ROUTE_PATTERN.search(content)
+            or 'webhook' in content.lower()
+        )
+        
+        if is_webhook_file:
+            # Strip comments to prevent false negatives from keywords in comments
+            content_no_comments = re.sub(r'//.*$', '', content, flags=re.M)
+            content_no_comments = re.sub(r'/\*.*?\*/', '', content_no_comments, flags=re.S)
+            content_no_comments = re.sub(r'#.*$', '', content_no_comments, flags=re.M)
+
+            # Check Stripe webhook files
+            if 'stripe' in content.lower() and ('event' in content.lower() or 'webhook' in content.lower()):
+                if not STRIPE_SIG_PATTERN.search(content_no_comments) and ('checkout.session' in content or 'payment_intent' in content):
+                    findings.append((1, "Stripe webhook handler detected without stripe.webhooks.constructEvent signature verification (Critical)"))
+
+            # Check Lemon Squeezy webhooks
+            if 'lemon' in content.lower() and ('signature' in content.lower() or 'event' in content.lower() or 'webhook' in content.lower()):
+                if not LEMON_SIG_PATTERN.search(content_no_comments):
+                    findings.append((1, "Lemon Squeezy webhook handler missing HMAC SHA-256 signature verification via x-signature header (Critical)"))
+
+            # Check Dodo Payments webhooks
+            if 'dodo' in content.lower() and ('webhook' in content.lower() or 'event' in content.lower()):
+                if not DODO_SIG_PATTERN.search(content_no_comments):
+                    findings.append((1, "Dodo Payments webhook handler missing signature verification (Critical)"))
+
+            # Check Razorpay webhooks
+            if 'razorpay' in content.lower() and ('webhook' in content.lower() or 'payment' in content.lower()):
+                if not RAZORPAY_SIG_PATTERN.search(content_no_comments):
+                    findings.append((1, "Razorpay payment/webhook handler missing signature verification check (Critical)"))
+
+            # Check for subscription cancellation handling in subscription webhook files
+            if ('subscription' in content.lower() or 'checkout.session.completed' in content.lower()) and ('user' in content.lower() or 'plan' in content.lower()):
+                if not SUB_CANCEL_PATTERNS.search(content):
+                    findings.append((1, "Subscription webhook handler handles setup/checkout but lacks subscription cancellation/failure handling (customer.subscription.deleted / subscription_cancelled) - allows revoked users to retain access"))
+
+    except Exception:
+        pass
+
+    return findings
+
+def main():
+    target_dir = sys.argv[1] if len(sys.argv) > 1 else '.'
+    target_dir = os.path.abspath(target_dir)
+
+    findings_by_file = {}
+
+    for root, dirs, files in os.walk(target_dir):
+        dirs[:] = [d for d in dirs if d not in SKIP_DIRS and not d.startswith('.')]
+
+        for file in files:
+            if is_test_file(file):
+                continue
+            if file in ['check_payment_config.py', 'check_db_config.py', 'scan_secrets.py', 'check_auth_patterns.py', 'check_gitignore.py']:
+                continue
+            if not any(file.endswith(ext) for ext in ['.js', '.ts', '.jsx', '.tsx', '.py', '.php', '.go']):
+                continue
+
+            file_path = os.path.join(root, file)
+            rel_path = os.path.relpath(file_path, target_dir)
+
+            file_findings = scan_file(file_path)
+            if file_findings:
+                findings_by_file[rel_path] = file_findings
+
+    if not findings_by_file:
+        print("PASS: No payment integrity or webhook security flaws detected.")
+        sys.exit(0)
+
+    print("FAIL: The following payment integrity issues were found:")
+    for rel_path, file_findings in findings_by_file.items():
+        for line_num, desc in file_findings:
+            print(f"{rel_path}:{line_num}: {desc}")
+    sys.exit(1)
+
+if __name__ == '__main__':
+    main()

package/scripts/scan_secrets.py

@@ -5,6 +5,10 @@ import re
 import math
 import fnmatch
 
+# Ensure stdout supports UTF-8 on Windows
+if hasattr(sys.stdout, 'reconfigure'):
+    sys.stdout.reconfigure(encoding='utf-8', errors='replace')
+
 # Directories to skip during scanning
 SKIP_DIRS = {
     'node_modules', '.git', 'build', 'dist', '.next', '.svelte-kit', 
@@ -30,16 +34,46 @@ SKIP_EXTS = {
     '.svg', '.css', '.scss', '.less', '.html', '.xml'
 }
 
+import base64
+import json
+
 # Regexes for known API key formats (live keys are Critical; test keys are Should Fix)
 API_KEY_PATTERNS = [
     (re.compile(r'AIza[0-9A-Za-z-_]{35}'), 'Google API Key'),
     (re.compile(r'AKIA[0-9A-Z]{16}'), 'AWS Access Key ID'),
     (re.compile(r'ghp_[a-zA-Z0-9]{36,40}'), 'GitHub Personal Access Token'),
+    (re.compile(r'github_pat_[0-9a-zA-Z_]{82}'), 'GitHub Fine-Grained Personal Access Token (Critical)'),
     (re.compile(r'sk_live_[0-9a-zA-Z]{24,96}'), 'Stripe LIVE Secret Key (Critical: charges real cards)'),
     (re.compile(r'sk_test_[0-9a-zA-Z]{24,96}'), 'Stripe TEST Secret Key (Should Fix: not production-critical but must not be committed)'),
+    (re.compile(r'whsec_[0-9a-zA-Z]{32,64}'), 'Stripe Webhook Secret (Critical: allows forging payment events)'),
     (re.compile(r'xox[bapr]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32}'), 'Slack Token'),
+    # Modern AI and Developer Providers
+    (re.compile(r'sk-(?:proj|None)-[a-zA-Z0-9_-]{48,160}'), 'OpenAI Secret API Key (Critical: charges API usage)'),
+    (re.compile(r'sk-ant-api03-[a-zA-Z0-9_-]{80,120}'), 'Anthropic Claude API Key (Critical: charges API usage)'),
+    (re.compile(r'gsk_[a-zA-Z0-9]{52}'), 'Groq API Key'),
+    (re.compile(r're_[a-zA-Z0-9]{32,48}'), 'Resend Email API Key (Critical: email sending/spam abuse)'),
+    (re.compile(r'SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}'), 'SendGrid API Key (Critical: email sending/spam abuse)'),
+    (re.compile(r'npm_[0-9a-zA-Z]{36}'), 'NPM Access Token (Critical: package publishing)'),
+    (re.compile(r'phx_[a-zA-Z0-9]{40,64}'), 'PostHog Personal API Key (Critical)'),
+    (re.compile(r'pplx-[a-zA-Z0-9]{48}'), 'Perplexity API Key'),
+    (re.compile(r'hf_[a-zA-Z0-9]{34}'), 'HuggingFace Access Token'),
+    (re.compile(r'(?:postgres|postgresql|mysql|mongodb(?:\+srv)?|redis):\/\/[a-zA-Z0-9_.-]+:[^@\s]+@[a-zA-Z0-9_.-]+'), 'Hardcoded Database Connection URI with password (Critical)'),
 ]
 
+JWT_PATTERN = re.compile(r'\beyJ[a-zA-Z0-9_-]+\.([a-zA-Z0-9_-]+)\.[a-zA-Z0-9_-]+\b')
+
+def inspect_jwt_payload(token_payload_b64):
+    """Inspect base64 JWT payload for sensitive roles like Supabase service_role."""
+    try:
+        padded = token_payload_b64 + '=' * (-len(token_payload_b64) % 4)
+        payload_bytes = base64.urlsafe_b64decode(padded.encode('utf-8'))
+        payload = json.loads(payload_bytes.decode('utf-8', errors='ignore'))
+        if payload.get('role') == 'service_role':
+            return 'Supabase Service Role JWT (Critical: bypasses all Row Level Security)'
+    except Exception:
+        pass
+    return None
+
 # Regex for variable assignments with potential hardcoded secrets
 # Matches: name = "string" or "name": "string", where name contains key, secret, token, password, credential, auth
 ASSIGNMENT_PATTERN = re.compile(
@@ -81,6 +115,12 @@ def scan_file(file_path):
                     if pattern.search(line):
                         findings.append((line_num, f"Exposed {name}"))
                         
+                # Check for JWT tokens (e.g. Supabase service_role)
+                for jwt_match in JWT_PATTERN.finditer(line):
+                    jwt_desc = inspect_jwt_payload(jwt_match.group(1))
+                    if jwt_desc:
+                        findings.append((line_num, f"Exposed {jwt_desc}"))
+                        
                 # 2. Check variable assignments
                 for match in ASSIGNMENT_PATTERN.finditer(line):
                     var_name, quote, val = match.groups()
@@ -144,6 +184,9 @@ def main():
         
         for file in files:
             ext = os.path.splitext(file)[1].lower()
+            # Skip checkmyvibe audit reports so reported secrets don't self-flag
+            if 'checkmyvibe-report' in file.lower():
+                continue
             # Skip hidden files unless they are .env configuration files
             if ext in SKIP_EXTS or is_test_file(file):
                 continue