cleartoship 0.4.0 → 0.7.0

package/README.md

@@ -58,7 +58,7 @@ npx cleartoship
 | **CTS021** | high | Dependency registered days ago with near-zero downloads (slopsquat shape) |
 | **CTS022** | low | Runtime dependency with almost no users |
 | **CTS023** | high/medium | Name is one edit from a popular package (`expres` → `express`) |
-| **CTS024** | by CVSS | Dependency version has a **published advisory**, resolved live from [OSV.dev](https://osv.dev) |
+| **CTS024** | by CVSS | Dependency version has a **published advisory**, resolved live from [OSV.dev](https://osv.dev). Vulns in `devDependencies` are labeled and held below the gate — a linter CVE never blocks a deploy the way a shipping one does. |
 | **CTS025** | low | Dependency deprecated upstream |
 | **CTS026** | critical | Registry serves HTTP 451 — the package was pulled for malware |
 | **CTS027** | critical | Package was unpublished but still has installs; the name is open to takeover |
@@ -140,7 +140,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: murtazaozdemir/cleartoship@v0.3.0
+      - uses: murtazaozdemir/cleartoship@v0.7.0
         with:
           fail-on: critical
           comment: true

package/dist/scanners/dependencies.js

@@ -89,7 +89,8 @@ function collectFromPyproject(source, relPath) {
 }
 /** Valid npm package name, optionally scoped. */
 const NPM_NAME = String.raw `(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*`;
-const INSTALL_COMMAND = new RegExp(String.raw `\b(?:npm\s+(?:i|install|add)|yarn\s+add|pnpm\s+(?:i|install|add)|bun\s+(?:i|install|add)|npx|pnpm\s+dlx|bunx)\s+([^\n\`|;&>]+)`, 'gi');
+const INSTALL_COMMAND = new RegExp(String.raw `\b(?:npm\s+(?:i|install|add)|yarn\s+add|pnpm\s+(?:i|install|add)|bun\s+(?:i|install|add))\s+([^\n\`|;&>]+)`, 'gi');
+const RUNNER_COMMAND = new RegExp(String.raw `\b(?:npx|pnpm\s+dlx|bunx)\s+([^\n\`|;&>]+)`, 'gi');
 const PIP_COMMAND = /\b(?:pip3?\s+install|uv\s+pip\s+install|poetry\s+add|uv\s+add)\s+([^\n`|;&>]+)/gi;
 /**
  * Pulls package names out of install commands written in prose. Agent
@@ -115,7 +116,9 @@ function collectFromProse(source, relPath) {
                 if (/^[.~/]|:/.test(bare))
                     continue;
                 const ok = ecosystem === 'npm' ? npmName.test(bare) : /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(bare);
-                if (!ok)
+                // A real package name contains letters; reject list bullets, ports and
+                // version-ish tokens ("3003", "1.", "2") that show up in prose.
+                if (!ok || !/[a-z]/i.test(bare) || bare.length < 2)
                     continue;
                 out.push({ name: bare, range: '', ecosystem, file: relPath, line, dev: false, fromProse: true });
                 if (firstArgOnly)
@@ -123,6 +126,10 @@ function collectFromProse(source, relPath) {
             }
         }
     };
+    // For `npx pkg <args>` / `pnpm dlx` / `bunx`, only the first token is a
+    // package — the rest are that command's arguments (so `wrangler d1 create
+    // my-db` must not read `d1`, `create`, `my-db` as packages).
+    harvest(RUNNER_COMMAND, 'npm', true);
     harvest(INSTALL_COMMAND, 'npm', false);
     harvest(PIP_COMMAND, 'pypi', false);
     return out;
@@ -498,15 +505,28 @@ export const dependencyScanner = {
                 const worst = vulns.reduce((a, b) => ((b.cvss ?? 0) > (a.cvss ?? 0) ? b : a));
                 const cve = worst.aliases.find((a) => a.startsWith('CVE-')) ?? worst.id;
                 const others = vulns.length - 1;
+                // A devDependency's vulnerability lives in your build/CI toolchain, not
+                // in what your users run — a real concern, but not the same class as a
+                // CVE in a package that ships. Label it and hold its severity below the
+                // gate so a linter CVE never blocks a deploy the way a runtime one does.
+                const shipsToProd = !d.dev;
+                const severity = shipsToProd
+                    ? severityFromCvss(worst.cvss)
+                    : 'low';
                 result.findings.push({
                     id: 'CTS024',
-                    severity: severityFromCvss(worst.cvss),
-                    title: `Dependency has a known vulnerability (${cve})`,
+                    severity,
+                    title: shipsToProd
+                        ? `Dependency has a known vulnerability (${cve})`
+                        : `Dev dependency has a known vulnerability (${cve})`,
                     detail: `\`${d.name}@${q.version}\` is affected by ${cve}: ${worst.summary}` +
                         (worst.cvss !== null ? ` CVSS ${worst.cvss}.` : '') +
                         (others > 0
                             ? ` ${others} further advisor${others === 1 ? 'y' : 'ies'} also affect this version.`
-                            : ''),
+                            : '') +
+                        (shipsToProd
+                            ? ''
+                            : ' It is a dev/build dependency, so it does not ship to production — fix it, but it does not gate a deploy.'),
                     fix: worst.fixedIn
                         ? `Upgrade \`${d.name}\` to ${worst.fixedIn} or later.`
                         : `No fixed version is published yet. Check https://osv.dev/vulnerability/${worst.id} for mitigations.`,
@@ -517,6 +537,7 @@ export const dependencyScanner = {
                     meta: {
                         package: d.name,
                         version: q.version,
+                        production: shipsToProd,
                         resolvedFrom: versions.has(d.name) ? 'lockfile-or-range' : 'range',
                         advisories: vulns.map((v) => ({
                             id: v.id,
@@ -528,11 +549,16 @@ export const dependencyScanner = {
                 });
             });
             if (osvChecked > 0) {
-                const vulnerable = result.findings.filter((f) => f.id === 'CTS024').length;
+                const cts024 = result.findings.filter((f) => f.id === 'CTS024');
+                const shipping = cts024.filter((f) => f.meta?.production === true).length;
+                const devOnly = cts024.length - shipping;
                 result.checks.push({
                     label: `Known vulnerabilities (${osvChecked} resolved versions checked against OSV.dev)`,
-                    passed: vulnerable === 0,
-                    note: vulnerable > 0 ? `${vulnerable} affected` : undefined,
+                    // Only shipping vulnerabilities fail the check; dev/build ones are noted.
+                    passed: shipping === 0,
+                    note: cts024.length === 0
+                        ? undefined
+                        : `${shipping} shipping` + (devOnly > 0 ? `, ${devOnly} dev/build (non-blocking)` : ''),
                 });
             }
         }

package/dist/scanners/rls.js

@@ -56,7 +56,25 @@ function parseColumns(body) {
 export const rlsScanner = {
     name: 'Supabase / PostgreSQL Row Level Security',
     applies(ctx) {
-        return ctx.files.some(isSql);
+        if (!ctx.files.some(isSql))
+            return false;
+        // Row Level Security is a PostgreSQL feature that Supabase builds on. This
+        // scanner must not fire on SQLite / Cloudflare D1 / Prisma-sqlite schemas,
+        // which have no RLS concept at all — doing so turns every CREATE TABLE into
+        // a false "RLS disabled" critical. Require a genuine Postgres/Supabase
+        // signal: the dependency set, a supabase/ directory, or RLS/auth idioms in
+        // the SQL itself.
+        if (ctx.framework.supabase)
+            return true;
+        for (const file of ctx.files) {
+            if (!isSql(file))
+                continue;
+            const src = read(file);
+            if (src && /\brow\s+level\s+security\b|\bauth\.(uid|jwt|role)\s*\(|\bto\s+(anon|authenticated)\b|\bcreate\s+policy\b/i.test(src)) {
+                return true;
+            }
+        }
+        return false;
     },
     async run(ctx) {
         const result = emptyResult();

package/dist/scanners/secrets.js

@@ -82,7 +82,7 @@ const HEX_DIGEST = /^[a-f0-9]{40}$|^[a-f0-9]{64}$/i;
  */
 const NON_PRODUCTION_PATH = /(^|\/)(tests?|__tests__|__mocks__|__fixtures__|fixtures?|spec|specs|examples?|docs?|demo|samples?|e2e|cypress|playwright|stories)(\/|$)|\.(test|spec|stories|fixture)\.[a-z]+$|(^|\/)(README|CHANGELOG|CONTRIBUTING)/i;
 /** Env var names that are meant to be public even though they read like secrets. */
-const PUBLIC_BY_DESIGN = /(ANON_KEY|PUBLISHABLE_KEY|PUBLIC_KEY|CLIENT_ID|MEASUREMENT_ID|PROJECT_ID|APP_ID|SENDER_ID|FIREBASE_API_KEY|MAPBOX_TOKEN|POSTHOG_KEY|SENTRY_DSN)$/;
+const PUBLIC_BY_DESIGN = /(ANON_KEY|PUBLISHABLE_KEY|PUBLIC_KEY|CLIENT_ID|MEASUREMENT_ID|PROJECT_ID|APP_ID|SENDER_ID|FIREBASE_API_KEY|MAPBOX_TOKEN|POSTHOG_KEY|SENTRY_DSN|SHOPIFY_API_KEY)$/;
 const SECRETY_NAME = /(SECRET|SERVICE_ROLE|PRIVATE|PASSWORD|PASSWD|_TOKEN|API_KEY|ACCESS_KEY|CREDENTIAL)/;
 const LOCKFILES = new Set([
     'package-lock.json', 'pnpm-lock.yaml', 'yarn.lock', 'bun.lock', 'bun.lockb',
@@ -153,6 +153,8 @@ export const secretsScanner = {
                     if (pattern.id === 'supabase-anon')
                         continue; // informational only, not reported
                     const line = lineAt(source, m.index);
+                    if (isCommentedOut(source, m.index))
+                        continue; // documented example, not a live secret
                     if (suppress.suppressed(line, 'CTS030'))
                         continue;
                     const key = `${relPath}:${line}:${pattern.id}`;

package/dist/scanners/server-actions.js

@@ -40,7 +40,18 @@ const SIGNATURE_CHECKS = [
     'webhooks.constructEvent', 'constructEvent', 'constructEventAsync', 'verifyHeader',
     'verify', 'verifySignature', 'createHmac', 'timingSafeEqual', 'Webhook', 'validateRequest',
     'verifyWebhook', 'verifyWebhookSignature',
+    // Framework webhook handlers that verify the signature internally, so the
+    // route body delegates rather than calling an hmac primitive directly.
+    'authenticate.webhook', 'webhooks.process', 'webhooks.validate', 'processWebhook',
+    'handleWebhook', 'validateWebhook', 'wh.verify', 'svix.verify',
 ];
+/**
+ * Request headers that only exist to carry a webhook signature. A handler that
+ * reads one is participating in signature verification — a route that genuinely
+ * forgot it would not reference the header at all — so reading one clears the
+ * "unverified webhook" check.
+ */
+const SIGNATURE_HEADERS = /(x-shopify-hmac-sha256|x-hub-signature(-256)?|stripe-signature|svix-signature|svix-id|x-signature|x-webhook-signature|x-slack-signature|x-line-signature|paypal-transmission-sig)/i;
 /** Schema escape hatches that make validation decorative. */
 const LOOSE_SCHEMA = /\.passthrough\s*\(|z\s*\.\s*(any|unknown)\s*\(|\.catchall\s*\(/g;
 const SERVICE_ROLE_HINTS = [
@@ -121,6 +132,13 @@ function analyseFunction(path, name) {
         if (tail === 'from' || tail === 'select' || tail === 'findMany' || tail === 'findUnique' || tail === 'findFirst') {
             info.hasRead = true;
         }
+        // Reading a webhook-signature header counts as participating in
+        // verification (see SIGNATURE_HEADERS).
+        for (const arg of inner.node.arguments ?? []) {
+            if (arg?.type === 'StringLiteral' && SIGNATURE_HEADERS.test(arg.value)) {
+                info.hasSignatureCheck = true;
+            }
+        }
         // Raw SQL: db.query(`DELETE FROM ...`) / sql`UPDATE ...`
         if (tail === 'query' || tail === 'execute' || tail === 'unsafe' || tail === 'raw') {
             for (const arg of inner.node.arguments ?? []) {
@@ -249,13 +267,24 @@ export const serverActionsScanner = {
                 const writes = info.hasMutation || (isRoute && HTTP_MUTATION_METHODS.has(httpMethod));
                 const isWebhook = isRoute && httpMethod === 'POST' && /webhook|\bhooks?\b|stripe|clerk|svix/i.test(relPath);
                 const isCron = isRoute && /(^|\/)(cron|scheduled|jobs?)(\/|$)/i.test(relPath);
+                // Some endpoints are unauthenticated by design — the sign-in and
+                // account-recovery flow (you have no session yet), and public intake
+                // forms. Flagging "missing auth" there is a false positive, so it is
+                // reported at low rather than as a blocking critical.
+                const PUBLIC_BY_DESIGN_ROUTE = /(^|\/|-)(login|signin|sign-in|register|signup|sign-up|forgot-password|reset-password|verify-email|resend-verification|magic-link|contact|lead|leads|waitlist|subscribe|unsubscribe|newsletter)(\/|-|\.|$)/i;
+                const intentionallyPublic = isRoute && PUBLIC_BY_DESIGN_ROUTE.test(relPath);
                 if (writes && !info.hasAuth && info.getSessionLine === null) {
                     push({
                         id: 'CTS001',
-                        severity: 'critical',
-                        title: `Missing ${kind} authorization`,
+                        severity: intentionallyPublic ? 'low' : 'critical',
+                        title: intentionallyPublic
+                            ? `${kind} is unauthenticated (appears public by design)`
+                            : `Missing ${kind} authorization`,
                         detail: `${kind} \`${name}\` performs a database mutation without verifying the caller. ` +
-                            exposure,
+                            exposure +
+                            (intentionallyPublic
+                                ? ' This route name suggests a sign-in / account-recovery or public-intake endpoint, which is unauthenticated by design — confirm it has rate limiting and does not trust caller-supplied identifiers.'
+                                : ''),
                         fix: 'Resolve and check the session before touching the database, e.g.\n' +
                             '  const { data: { user } } = await supabase.auth.getUser()\n' +
                             "  if (!user) throw new Error('Unauthorized')\n" +

package/dist/utils/files.js

@@ -3,8 +3,9 @@ import { join, relative, sep } from 'node:path';
 const SKIP_DIRS = new Set([
     'node_modules', '.git', '.next', '.turbo', '.vercel', '.wrangler',
     'dist', 'build', 'out', 'coverage', '.venv', 'venv', '__pycache__',
+    '.open-next', '.sst', '.vercel',
     '.cache', '.pnpm-store', 'vendor', 'target', '.svelte-kit', '.nuxt',
-    '.cts-cache', '_reference',
+    '.cts-cache', '_reference', 'site',
 ]);
 const SCAN_EXTS = new Set([
     '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.mts', '.cts', '.sql',
@@ -24,6 +25,29 @@ const AGENT_FILES = new Set([
 ]);
 /** Files bigger than this are almost certainly bundles or fixtures, not source. */
 const MAX_FILE_BYTES = 2_000_000;
+/**
+ * Precise generated-code detection — deliberately NOT a blanket skip of any
+ * `generated/` directory, which can legitimately hold hand-written code. Matches
+ * the codegen outputs that produce false positives (a Prisma client ships its
+ * own credentials, queryRawUnsafe and dynamic requires that are safe in vendor
+ * code but read as findings), and files carrying a generated banner.
+ */
+const GENERATED_PATH = /(^|\/)(generated|__generated__)\/(prisma|graphql|gql|client)(\/|$)|(^|\/)\.prisma(\/|$)|\.(generated|gen)\.[cm]?[jt]sx?$/i;
+const GENERATED_BANNER = /(^|\n).{0,4}(@generated\b|this (file|code) (is|was) (auto[- ]?)?generated|code generated by|do not edit|prisma client js|autogenerated)/i;
+function looksGenerated(fullPath, size) {
+    if (GENERATED_PATH.test(fullPath))
+        return true;
+    // Cheap banner check on the first chunk for the ambiguous cases only.
+    if (!/(^|\/)(generated|gen|__generated__|codegen)(\/|$)/i.test(fullPath))
+        return false;
+    try {
+        const head = readFileSync(fullPath, 'utf8').slice(0, 400);
+        return GENERATED_BANNER.test(head);
+    }
+    catch {
+        return false;
+    }
+}
 export function walk(root) {
     const found = [];
     const stack = [root];
@@ -56,12 +80,13 @@ export function walk(root) {
             const dot = entry.lastIndexOf('.');
             const ext = dot === -1 ? '' : entry.slice(dot);
             // .env, .env.local, requirements.txt and friends have no useful extension.
-            if (SCAN_EXTS.has(ext) ||
+            const scannable = SCAN_EXTS.has(ext) ||
                 AGENT_FILES.has(entry) ||
                 NAMED_FILES.has(entry) ||
                 entry.startsWith('Dockerfile') ||
                 entry.startsWith('.env') ||
-                entry === 'requirements.txt') {
+                entry === 'requirements.txt';
+            if (scannable && !looksGenerated(full, st.size)) {
                 found.push(full);
             }
         }

package/examples/security.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: murtazaozdemir/cleartoship@v0.3.0
+      - uses: murtazaozdemir/cleartoship@v0.7.0
         with:
           fail-on: critical   # block the PR only on criticals
           comment: true        # post a summary comment on the PR

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cleartoship",
-  "version": "0.4.0",
+  "version": "0.7.0",
   "description": "The 30-second pre-launch security clearance for AI-built & vibe-coded apps. Catches missing Server Action auth, Supabase RLS holes, hallucinated npm packages and leaked keys.",
   "keywords": [
     "security",