cleartoship 0.12.1 → 0.12.2

package/README.md

@@ -251,7 +251,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: murtazaozdemir/cleartoship@v0.12.1
+      - uses: murtazaozdemir/cleartoship@v0.12.2
         with:
           fail-on: critical
           comment: true
@@ -273,7 +273,7 @@ above `fail-on`) for use in later steps. The comment is *sticky* — re-runs edi
 the same comment instead of piling up.
 
 By default the action runs the scanner version its own ref declares, so
-`@v0.12.1` runs `cleartoship@0.12.1` and pinning the ref pins the behaviour. If
+`@v0.12.2` runs `cleartoship@0.12.2` and pinning the ref pins the behaviour. If
 that version is not on the registry, it builds from its own checkout instead, so
 `uses: …@ref` works against an unpublished commit.
 

package/action.yml

@@ -29,7 +29,7 @@ inputs:
   version:
     description: >-
       Version of the cleartoship npm package to run. Defaults to the version this
-      action's own ref declares, so `uses: …@v0.12.1` runs cleartoship@0.12.1. Set
+      action's own ref declares, so `uses: …@v0.12.2` runs cleartoship@0.12.2. Set
       `latest` to always track the newest release, or `local` to build from the checkout.
     required: false
     default: ''
@@ -76,7 +76,7 @@ runs:
       run: |
         # With no version pinned, run the exact version this action's checkout
         # declares. That keeps the action ref and the scanner in lockstep:
-        # `uses: <owner>/cleartoship@v0.12.1` runs cleartoship@0.12.1 instead of
+        # `uses: <owner>/cleartoship@v0.12.2` runs cleartoship@0.12.2 instead of
         # whatever npm happens to tag `latest` at the time.
         ver="$INPUT_VERSION"
         if [ -z "$ver" ]; then

package/dist/scanners/community.js

@@ -254,6 +254,20 @@ const MATCH_GUARDS = {
     // cannot tell whether the auth check is already there, and CTS001 can:
     // matching on the module's own vocabulary keeps this from contradicting it.
     VG1025: (_match, source) => !/\b(auth\.getUser|getServerSession|getServerAuthSession|requireUser|requireAuth|requireUserId|currentUser|handleSessionToken|verifyRequest|getSession)\s*\(/.test(source),
+    // `jwt.sign(payload, getJwtSecret(), { expiresIn: TOKEN_EXPIRY })` was
+    // reported as a token without expiry: the pattern's `[^)]` scan for
+    // `expiresIn` stops at the first `)`, which here belongs to `getJwtSecret()`.
+    // Read the whole call before saying the option is absent.
+    VG061: (_match, source, index) => !/\b(expiresIn|exp\s*:|setExpirationTime)\b/.test(source.slice(index, index + 300)),
+    // The "sink" half of the upload rule matched the word *upload* inside a
+    // sentence — "Please upload a CSV file exported from Shopify". A filename
+    // reaching a string is not a filename reaching a filesystem.
+    VG993: (match, source, index, spans) => !isInside(spans, index + match.length - 1, 'string'),
+    // A login endpoint is server code. This fired on `<Link href="/login">Back to
+    // sign in</Link>` in a client page, where "verify" and "login" are words in
+    // markup rather than a password comparison behind an HTTP handler.
+    VG148: (match, source) => !/^\s*(['"])use client\1/m.test(source.slice(0, 400)) &&
+        /(bcrypt\.compare|argon2\.verify|\b(compare|verify|verifyPassword)\s*\()/.test(match),
     // SSRF is a *server* being made to fetch a URL it should not. A module marked
     // `'use client'` runs in the browser, where the request leaves the user's own
     // machine and crosses no trust boundary of yours.
@@ -298,6 +312,25 @@ function inapplicable(ctx) {
         ids.add('VG132');
         why.push('VG132 body-size limit (Next.js sets one by default)');
     }
+    // A rule that names a platform cannot apply to a project that does not use
+    // it. "Supabase Auth Missing Middleware" was reported against an app with no
+    // Supabase dependency at all — advice about a library it does not import.
+    for (const [name, present, keyword] of [
+        ['Supabase', ctx.framework.supabase, /supabase/i],
+        ['Firebase', ctx.framework.firebase, /firebase|firestore/i],
+    ]) {
+        if (present)
+            continue;
+        let n = 0;
+        for (const rule of GUARDVIBE_RULES) {
+            if (keyword.test(rule.name) || keyword.test(rule.description)) {
+                ids.add(rule.id);
+                n++;
+            }
+        }
+        if (n > 0)
+            why.push(`${n} ${name} rules (no ${name} dependency)`);
+    }
     return { ids, why };
 }
 /**

package/dist/types.d.ts

@@ -54,6 +54,7 @@ export interface FrameworkInfo {
     stripe: boolean;
     python: boolean;
     reactNative: boolean;
+    firebase: boolean;
     /** Human-readable one-liner for the CLI header. */
     describe(): string;
 }

package/dist/utils/detect.js

@@ -56,6 +56,10 @@ export function detectFramework(root, files) {
         python: exists(join(root, 'requirements.txt')) ||
             exists(join(root, 'pyproject.toml')),
         reactNative,
+        firebase: hasDep(pkg, 'firebase') ||
+            hasDep(pkg, 'firebase-admin') ||
+            hasDep(pkg, '@firebase/app') ||
+            exists(join(root, 'firebase.json')),
         describe() {
             const parts = [];
             if (this.nextjs === 'app-router')
@@ -80,6 +84,8 @@ export function detectFramework(root, files) {
                 parts.push('Python');
             if (this.reactNative)
                 parts.push('React Native');
+            if (this.firebase)
+                parts.push('Firebase');
             return parts.length ? parts.join(' + ') : 'generic JavaScript/TypeScript';
         },
     };

package/examples/security.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: murtazaozdemir/cleartoship@v0.12.1
+      - uses: murtazaozdemir/cleartoship@v0.12.2
         with:
           fail-on: critical   # block the PR only on criticals
           comment: true        # post a summary comment on the PR

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cleartoship",
-  "version": "0.12.1",
+  "version": "0.12.2",
   "description": "The 30-second pre-launch security clearance for AI-built & vibe-coded apps. Catches missing Server Action auth, Supabase RLS holes, hallucinated npm packages and leaked keys.",
   "keywords": [
     "security",