codevet-cli 1.1.0

package/.gitleaks.toml

@@ -0,0 +1,91 @@
+title = "codevet-gitleaks-config"
+
+[extend]
+useDefault = true
+
+# --no-git mode (used so CodeVet works even outside a git repo, and catches
+# uncommitted files) scans the raw filesystem and does NOT respect
+# .gitignore. Without this, build caches, dependency folders, and other
+# directories that can never actually leak via git get scanned anyway,
+# producing pure noise. Confirmed in real testing: a Next.js .next/ build
+# cache produced 6 false "Generic API Key" findings before this was added.
+[allowlist]
+paths = [
+  '''(^|[/\\])node_modules([/\\]|$)''',
+  '''(^|[/\\])\.next([/\\]|$)''',
+  '''(^|[/\\])\.nuxt([/\\]|$)''',
+  '''(^|[/\\])dist([/\\]|$)''',
+  '''(^|[/\\])build([/\\]|$)''',
+  '''(^|[/\\])out([/\\]|$)''',
+  '''(^|[/\\])coverage([/\\]|$)''',
+  '''(^|[/\\])\.turbo([/\\]|$)''',
+  '''(^|[/\\])\.git([/\\]|$)''',
+  '''(^|[/\\])target([/\\]|$)''',
+  '''(^|[/\\])vendor([/\\]|$)''',
+  '''(^|[/\\])__pycache__([/\\]|$)''',
+  '''(^|[/\\])\.venv([/\\]|$)''',
+  '''(^|[/\\])venv([/\\]|$)''',
+  '''(^|[/\\])\.cache([/\\]|$)''',
+  # Confirmed as a real false-positive source in testing: a single
+  # Angular project's .angular/cache/ produced ~90 "Generic API Key"
+  # false positives from webpack .pack binary cache blobs — their
+  # compressed/hashed content trips generic entropy-based secret
+  # detection, but they're compiler cache artifacts, never application
+  # source. Angular commits nothing sensitive here by design.
+  '''(^|[/\\])\.angular([/\\]|$)''',
+  # Yarn 2+ (Berry) commits vendored CLI binaries under .yarn/releases/
+  # and .yarn/cache/ by design (the "zero-installs" pattern) — these are
+  # third-party tool code, not application secrets, and the same
+  # generic-entropy false-positive risk applies as with webpack packs.
+  '''(^|[/\\])\.yarn([/\\]|$)''',
+  # Webpack/build-tool cache ".pack" files are binary blobs regardless of
+  # which directory they end up in — matched by extension as a safety net
+  # beyond the .angular directory rule above, since other bundlers may use
+  # differently-named cache folders we haven't seen a false positive from
+  # yet. Real secrets essentially never live in a compiled binary cache
+  # file, so this trade-off favors eliminating noise.
+  '''\.pack$''',
+]
+
+[[rules]]
+id = "generic-connection-string-credentials"
+description = "Hardcoded username/password embedded in a database or service connection string"
+regex = '''(?i)(postgres(ql)?|mysql|mongodb(\+srv)?|redis|amqp|rabbitmq):\/\/[^:\/\s"']+:[^@\/\s"']+@[^\/\s"']+'''
+tags = ["credentials", "connection-string"]
+
+# Real leaked credentials live in application source/config files, not prose
+# documentation — confirmed in real testing: 15 false positives came from
+# *.md reference/skill docs containing illustrative example connection
+# strings, not actual secrets. Markdown docs are excluded from this rule
+# specifically (not globally) since a real secret pasted into a README is
+# still worth catching by the default rules.
+[[rules.allowlists]]
+paths = [
+  '''\.md$''',
+  '''(^|[/\\])references([/\\]|$)''',
+  '''(^|[/\\])docs?([/\\]|$)''',
+  '''(^|[/\\])examples?([/\\]|$)''',
+]
+regexes = [
+  '''://(user|username|admin|test|example|localhost|127\.0\.0\.1):(password|pass|test|example|changeme)@''',
+]
+
+# Supabase's service role key bypasses Row Level Security entirely — it
+# must never reach client code. Two real, statically-detectable patterns:
+# (1) the key itself assigned to a SERVICE_ROLE-named variable, and
+# (2) the naming mistake alone (NEXT_PUBLIC_/VITE_ prefix on a
+# SERVICE_ROLE var), which guarantees the bundler ships it to the browser
+# even before any real value is filled in.
+[[rules]]
+id = "supabase-service-role-key-assignment"
+description = "Supabase service_role key assigned in code — this key bypasses Row Level Security and must never reach client-side code"
+regex = '''(?i)(SUPABASE[_-]?SERVICE[_-]?ROLE[_-]?KEY|service_role_key)\s*[:=]\s*['"]eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+['"]'''
+tags = ["credentials", "supabase"]
+
+[[rules]]
+id = "supabase-service-role-key-exposed-to-client"
+description = "A SUPABASE service_role env var is prefixed for client-side exposure (NEXT_PUBLIC_/VITE_/REACT_APP_) — this ships the key straight into the browser bundle regardless of its actual value"
+regex = '''(?i)(NEXT_PUBLIC_|VITE_|REACT_APP_)[A-Z_]*SERVICE[_-]?ROLE[_-]?KEY'''
+tags = ["credentials", "supabase", "misconfiguration"]
+
+

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 CodeVet Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to
+deal in the Software without restriction, including without limitation the
+rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+sell copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

package/README.md

@@ -0,0 +1,171 @@
+# CodeVet
+
+**Vet your code before it ships.** A free, open-source security co-pilot for
+developers who aren't security experts — students, solo/indie developers,
+and small teams who can't justify an enterprise AppSec platform yet.
+
+CodeVet doesn't invent its own detection logic. It orchestrates trusted,
+independently-maintained tools (`gitleaks`, `npm audit`, `pip-audit`,
+`bearer`) and translates their output into plain language: what's wrong,
+how severe it is, why it matters, and — where possible — the exact working
+fix code, not just a description.
+
+```
+$ npx codevet scan
+
+CodeVet — scanning .
+
+Detected: node (package.json)
+
+Checking for exposed secrets...
+✖ 1 exposed secret(s) found: .env:12 — not gitignored
+
+Checking dependencies for known vulnerabilities...
+✖ axios — HIGH — MITM via proxy config prototype pollution — fix: axios@1.19.0
+
+Checking for missing security middleware...
+ CRITICAL  Table 'payments' may be missing Row Level Security
+✖ HIGH No rate limiting found
+○ MODERATE No security headers configured
+  Suggested fix — security/helmet.config.js: [real, ready-to-paste code]
+
+Checking personal data flow (via bearer)...
+✔ No personal-data-flow risks found.
+```
+
+## Install
+
+```bash
+npm install -g codevet-cli          # global — run `codevet` from any project
+# or
+npm install --save-dev codevet-cli  # per-project — run via `npx codevet`
+```
+
+## Use
+
+```bash
+codevet scan                              # scan the current directory
+codevet scan ./some/folder                # scan a specific local folder
+codevet scan https://github.com/user/repo # review a repo before you trust it
+codevet fix                               # safely upgrade flagged dependencies
+codevet fix --force                       # allow major-version upgrades
+codevet remove-dependency <name>          # explicitly uninstall a flagged package
+codevet clean ./some-repo-you-kept        # remove a repo CodeVet cloned earlier
+codevet config status                     # see which checks are enabled
+codevet config disable <check>            # turn a check off for this project
+```
+
+Full command reference: [`docs/HELP.md`](./docs/HELP.md).
+
+## What it checks today
+
+| Check | Tool | Severity model |
+|---|---|---|
+| Leaked secrets — API keys, credentials, connection strings, Supabase service-role-key exposure | `gitleaks` (extended ruleset) | Every finding is real and confirmed |
+| Dependency vulnerabilities (Node) | `npm audit` | CRITICAL/HIGH/MODERATE/LOW from the advisory database. Skipped (not failed) on pnpm-managed projects — a confirmed bug in npm itself, run `pnpm audit` directly for those |
+| Dependency vulnerabilities (Python) | `pip-audit` | Unranked — PyPA's database has no severity field; prioritize by whether a fix exists |
+| Missing security middleware — no helmet, no rate limiting, wide-open CORS, error responses leaking internals, missing Supabase Row Level Security | CodeVet's own heuristic scanner | CRITICAL/HIGH/MODERATE, each with a `Verify:` note on how the check could be wrong |
+| Personal data flow — logging or transmitting PII, secrets, etc. | `bearer` | CRITICAL/HIGH/MODERATE/LOW. **No native Windows build** — unavailable there, everything else still works |
+
+**CRITICAL** means fix it before anyone else touches the code. **HIGH**
+means fix before launch. **MODERATE** is real but rarely the sole cause of
+an incident. See [`docs/SECURITY-CHECKLIST.md`](./docs/SECURITY-CHECKLIST.md)
+for the full severity-annotated checklist this is built around.
+
+## Reviewing an unfamiliar repo before you trust it
+
+```bash
+codevet scan https://github.com/someone/some-repo
+```
+
+Clones to a temp folder, scans it, and asks before keeping anything if
+issues are found. Decline and nothing is left on disk. Accept and it's
+moved next to where you ran the command, with a provenance marker so
+`codevet clean` can safely identify and remove it later.
+
+## Running automatically on every PR
+
+```yaml
+# .github/workflows/codevet.yml
+name: CodeVet
+on: [pull_request]
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: i-akb25/codevet@v1
+```
+
+Posts results as a PR comment. Fails the check on critical/high findings
+by default — see [`docs/HELP.md`](./docs/HELP.md) to make it advisory-only.
+
+## Works inside your AI coding CLI
+
+CodeVet ships as an Agent Skill — ask Claude Code, Cursor, or OpenCode to
+"scan this project with CodeVet" and it runs directly in conversation. See
+[`AGENTS.md`](./AGENTS.md).
+
+## What it doesn't do (see [`TERMS.md`](./TERMS.md) for the full scope)
+
+Not a malware/antivirus scanner. Not a replacement for a professional
+security audit on anything handling real user data or payments at scale.
+A clean scan means the checks CodeVet currently runs found nothing — not a
+certification.
+
+## About the Socket.dev supply-chain score
+
+CodeVet's automated Socket.dev score flags Install scripts, Network access,
+Shell access, and Filesystem access as "supply chain risk." These are all
+expected and necessary — CodeVet downloads vetted, official scanner
+binaries (gitleaks, bearer) at install time or on first use, invokes them
+via the shell to run a scan, and reads your project's files to scan them.
+That's the whole job. Automated scoring can't distinguish that from
+something malicious without deeper context — see
+[`PRIVACY.md`](./PRIVACY.md) for exactly what each of these does and
+where any data goes.
+
+## Why this exists
+
+Every existing free security tool — Semgrep, Trivy, GitGuardian — is built
+for teams that already have security expertise. Nobody was serving the
+developer who's never heard of a CVE and just wants to know if it's safe
+to ship. That gap is what CodeVet is for. More in
+[`docs/ABOUT.md`](./docs/ABOUT.md).
+
+## Repository structure
+
+See [`INFO.md`](./INFO.md) for a complete, file-by-file breakdown of this
+repo — what everything is, who needs to touch it, and how to use it.
+
+## Contributing
+
+See [`CONTRIBUTING.md`](./CONTRIBUTING.md) — this project deliberately
+avoids "vibe coding": every change is type-checked, tested against a real
+reproduced scenario, and dependency-audited before merge.
+
+## Security
+
+Found a vulnerability in CodeVet itself? See [`SECURITY.md`](./SECURITY.md)
+for private disclosure — please don't open a public issue for it.
+
+## Privacy
+
+CodeVet runs entirely locally — no account, no telemetry, no CodeVet
+server. See [`PRIVACY.md`](./PRIVACY.md) for exactly what data each check
+touches and where it goes (mainly: `npm audit` talks to the npm registry,
+same as running it yourself).
+
+## Author
+
+**Anurag Kumar Bharti**  
+Software Engineer
+
+- **Portfolio:** [https://ace-akb.vercel.app](https://ace-akb.vercel.app)
+- **GitHub:** [https://github.com/i-akb25](https://github.com/i-akb25)
+- **LinkedIn:** [https://linkedin.com/in/anuragkumarbharti](https://linkedin.com/in/anuragkumarbharti)
+- **Email:** anuragbhartiee25@gmail.com
+
+## License
+
+MIT — see [`LICENSE`](./LICENSE).

package/dist/config.js

@@ -0,0 +1,44 @@
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+const DEFAULT_CONFIG = { secrets: true, dependencies: true, hygiene: true, dataFlow: true };
+function configPath(projectRoot) {
+    return join(projectRoot, ".codevet", "config.json");
+}
+/**
+ * Loads per-project scanner toggles. IMPORTANT: only call this for a
+ * project the user actually owns/controls locally. Never call it on a
+ * freshly-cloned, not-yet-reviewed target — a malicious repo could ship
+ * its own .codevet/config.json set to "disabled" and bypass every check
+ * just by being cloned. Untrusted-clone scans always use the full default
+ * config, ignoring whatever the repo itself contains.
+ */
+export async function loadConfig(projectRoot) {
+    const path = configPath(projectRoot);
+    if (!existsSync(path))
+        return { ...DEFAULT_CONFIG };
+    try {
+        const raw = await readFile(path, "utf-8");
+        return { ...DEFAULT_CONFIG, ...JSON.parse(raw) };
+    }
+    catch {
+        return { ...DEFAULT_CONFIG };
+    }
+}
+export async function saveConfig(projectRoot, config) {
+    const dir = join(projectRoot, ".codevet");
+    await mkdir(dir, { recursive: true });
+    await writeFile(configPath(projectRoot), JSON.stringify(config, null, 2));
+    await ensureGitignored(projectRoot);
+}
+async function ensureGitignored(projectRoot) {
+    const gitignorePath = join(projectRoot, ".gitignore");
+    const existing = existsSync(gitignorePath)
+        ? await readFile(gitignorePath, "utf-8")
+        : "";
+    if (existing.split("\n").some((line) => line.trim() === ".codevet/")) {
+        return;
+    }
+    const separator = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+    await writeFile(gitignorePath, existing + separator + ".codevet/\n");
+}

package/dist/detectors/detectStack.js

@@ -0,0 +1,28 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+const SIGNALS = [
+    { stack: "node", file: "package.json" },
+    { stack: "python", file: "requirements.txt" },
+    { stack: "python", file: "pyproject.toml" },
+    { stack: "android", file: "build.gradle" },
+    { stack: "android", file: "build.gradle.kts" },
+    { stack: "ios", file: "Podfile" },
+];
+/**
+ * Detects which stacks are present at the root of a project directory.
+ * A repo can match more than one stack — that's expected, not an error.
+ */
+export function detectStack(projectRoot) {
+    const found = new Map();
+    for (const signal of SIGNALS) {
+        if (found.has(signal.stack))
+            continue;
+        if (existsSync(join(projectRoot, signal.file))) {
+            found.set(signal.stack, signal.file);
+        }
+    }
+    return Array.from(found.entries()).map(([stack, matchedOn]) => ({
+        stack,
+        matchedOn,
+    }));
+}

package/dist/fixLibrary/templates.js

@@ -0,0 +1,311 @@
+/**
+ * Real, working code templates shown as suggested fixes. Each one is
+ * plain, dependency-minimal Express middleware — matches the "no
+ * unnecessary abstraction" engineering rule. These are not generated per
+ * finding; they're static, reviewed content, versioned here so updates
+ * propagate to every future scan instead of going stale in someone's repo.
+ */
+export const HELMET_CONFIG = `// security/helmet.config.js
+const helmet = require('helmet');
+
+module.exports = helmet({
+  contentSecurityPolicy: {
+    directives: {
+      defaultSrc: ["'self'"],
+      scriptSrc: ["'self'"],
+      objectSrc: ["'none'"],
+    },
+  },
+  hsts: { maxAge: 31536000, includeSubDomains: true },
+});
+
+// Usage: app.use(require('./security/helmet.config'));
+`;
+export const CORS_CONFIG = `// security/cors.config.js
+const cors = require('cors');
+
+// Replace with your actual allowed origins — never use '*' once you have
+// real users, since it lets any website read your API's responses.
+const ALLOWED_ORIGINS = (process.env.ALLOWED_ORIGINS || '').split(',').filter(Boolean);
+
+module.exports = cors({
+  origin(origin, callback) {
+    if (!origin || ALLOWED_ORIGINS.includes(origin)) {
+      callback(null, true);
+    } else {
+      callback(new Error('Not allowed by CORS'));
+    }
+  },
+  credentials: true,
+});
+
+// Usage: app.use(require('./security/cors.config'));
+// .env: ALLOWED_ORIGINS=https://yourapp.com,https://staging.yourapp.com
+`;
+export const ACCOUNT_BACKOFF = `// security/accountBackoff.js
+// Per-account exponential backoff — complements a per-IP rate limiter,
+// since an attacker distributing attempts across many IPs would otherwise
+// bypass IP-based limiting entirely. Uses exponential backoff (delay
+// doubles each failed attempt) rather than a hard lockout, since hard
+// lockouts let an attacker lock a real user out of their own account (a
+// denial-of-service against your own users).
+//
+//   const { checkAccountBackoff, recordFailedAttempt, recordSuccessfulAttempt } = require('./security/accountBackoff');
+//
+//   app.post('/login', async (req, res) => {
+//     const { email } = req.body;
+//     const backoff = checkAccountBackoff(email);
+//     if (backoff.blocked) {
+//       return res.status(429).json({ error: \`Try again in \${backoff.retryAfterSeconds}s\` });
+//     }
+//     const valid = await verifyPassword(...);
+//     if (!valid) {
+//       recordFailedAttempt(email);
+//       return res.status(401).json({ error: 'Invalid credentials' });
+//     }
+//     recordSuccessfulAttempt(email);
+//     // ...issue token
+//   });
+//
+// In-memory by default — fine for a single instance. For multi-instance
+// deployments, swap the Map for Redis (same interface, different backing
+// store) so backoff state is shared across instances.
+
+const attempts = new Map();
+
+const BASE_DELAY_MS = parseInt(process.env.AUTH_BACKOFF_BASE_MS ?? '1000', 10);
+const MAX_DELAY_MS = parseInt(process.env.AUTH_BACKOFF_MAX_MS ?? '300000', 10);
+const RESET_AFTER_MS = parseInt(process.env.AUTH_BACKOFF_RESET_MS ?? '3600000', 10);
+
+function checkAccountBackoff(accountKey) {
+  const record = attempts.get(accountKey);
+  if (!record) return { blocked: false };
+
+  const elapsedSinceLastAttempt = Date.now() - record.lastAttemptAt;
+  if (elapsedSinceLastAttempt > RESET_AFTER_MS) {
+    attempts.delete(accountKey);
+    return { blocked: false };
+  }
+
+  const requiredDelay = Math.min(BASE_DELAY_MS * 2 ** record.failCount, MAX_DELAY_MS);
+
+  if (elapsedSinceLastAttempt < requiredDelay) {
+    return { blocked: true, retryAfterSeconds: Math.ceil((requiredDelay - elapsedSinceLastAttempt) / 1000) };
+  }
+
+  return { blocked: false };
+}
+
+function recordFailedAttempt(accountKey) {
+  const record = attempts.get(accountKey) ?? { failCount: 0, lastAttemptAt: 0 };
+  record.failCount += 1;
+  record.lastAttemptAt = Date.now();
+  attempts.set(accountKey, record);
+}
+
+function recordSuccessfulAttempt(accountKey) {
+  attempts.delete(accountKey);
+}
+
+module.exports = { checkAccountBackoff, recordFailedAttempt, recordSuccessfulAttempt };
+`;
+export const RATE_LIMITER = `// security/rateLimiter.middleware.js
+const rateLimit = require('express-rate-limit');
+
+// Stricter limits on auth routes, looser on general API traffic — apply
+// the right one per route rather than one blanket limiter for everything.
+function makeLimiter({ windowMs, max }) {
+  return rateLimit({
+    windowMs,
+    max,
+    standardHeaders: true,
+    legacyHeaders: false,
+    message: { error: 'Too many requests, please try again later.' },
+  });
+}
+
+module.exports = {
+  authLimiter: makeLimiter({
+    windowMs: Number(process.env.AUTH_RATE_LIMIT_WINDOW_MS) || 15 * 60 * 1000,
+    max: Number(process.env.AUTH_RATE_LIMIT_MAX) || 5,
+  }),
+  publicLimiter: makeLimiter({
+    windowMs: Number(process.env.PUBLIC_RATE_LIMIT_WINDOW_MS) || 15 * 60 * 1000,
+    max: Number(process.env.PUBLIC_RATE_LIMIT_MAX) || 100,
+  }),
+  authenticatedLimiter: makeLimiter({
+    windowMs: Number(process.env.AUTHED_RATE_LIMIT_WINDOW_MS) || 15 * 60 * 1000,
+    max: Number(process.env.AUTHED_RATE_LIMIT_MAX) || 300,
+  }),
+};
+
+// Usage: app.use('/login', authLimiter); app.use('/api', publicLimiter);
+// Thresholds are env-configurable, not hardcoded, per the checklist.
+`;
+export const ERROR_HANDLER = `// security/errorHandler.middleware.js
+// Must be registered LAST, after all routes.
+module.exports = function errorHandler(err, req, res, next) {
+  // Full details go to server-side logs — never to the client.
+  console.error(err);
+
+  // The client only ever sees a generic message, never a stack trace,
+  // file path, or raw database error.
+  res.status(err.statusCode || 500).json({
+    error: 'Something went wrong. Please try again.',
+  });
+};
+
+// Usage: app.use(errorHandler); // after every other app.use()/route
+`;
+export const HASH_PASSWORD = `// security/auth/hashPassword.js
+const argon2 = require('argon2');
+
+async function hashPassword(plainPassword) {
+  return argon2.hash(plainPassword);
+}
+
+async function verifyPassword(plainPassword, hash) {
+  return argon2.verify(hash, plainPassword);
+}
+
+module.exports = { hashPassword, verifyPassword };
+`;
+export const JWT_TOKEN = `// security/auth/generateToken.js
+const jwt = require('jsonwebtoken');
+
+const SECRET = process.env.JWT_SECRET;
+if (!SECRET) {
+  throw new Error('JWT_SECRET is not set — refusing to start without it.');
+}
+
+function generateToken(payload, expiresIn = '15m') {
+  return jwt.sign(payload, SECRET, { expiresIn });
+}
+
+function verifyToken(token) {
+  return jwt.verify(token, SECRET); // throws on invalid/expired
+}
+
+module.exports = { generateToken, verifyToken };
+// Pair a short-lived access token with a separate, longer-lived refresh
+// token stored server-side (or httpOnly cookie) — never a single
+// long-lived token for everything.
+`;
+export const VALIDATION_SCHEMA = `// security/validation/authSchemas.js
+const { z } = require('zod');
+
+// Strict schema: type, length, and format all enforced. Anything that
+// doesn't match is REJECTED, not silently sanitized/escaped.
+const signupSchema = z.object({
+  email: z.string().email().max(254),
+  password: z.string().min(12).max(128),
+});
+
+const loginSchema = z.object({
+  email: z.string().email().max(254),
+  password: z.string().min(1).max(128),
+});
+
+module.exports = { signupSchema, loginSchema };
+// Usage: const data = signupSchema.parse(req.body); // throws on invalid input
+`;
+export const ENV_EXAMPLE = `# .env.example — copy to .env and fill in real values. Never commit .env itself.
+JWT_SECRET=
+ALLOWED_ORIGINS=https://yourapp.com
+AUTH_RATE_LIMIT_MAX=5
+PUBLIC_RATE_LIMIT_MAX=100
+DATABASE_URL=
+`;
+export const SECURITY_CHECK_WORKFLOW = `# .github/workflows/security-check.yml
+name: security-check
+on: [push, pull_request]
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: 20 }
+      - run: npm ci
+      - run: npm audit --audit-level=high
+      - uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+`;
+export const PRE_COMMIT_HOOK = `#!/usr/bin/env sh
+# .husky/pre-commit — requires: npm install -D husky && npx husky init
+npx gitleaks protect --staged --no-banner || {
+  echo "Blocked: gitleaks found a potential secret in your staged changes.";
+  exit 1;
+}
+`;
+export const FILE_UPLOAD = `// security/fileUpload.middleware.js
+const multer = require('multer');
+const path = require('node:path');
+const crypto = require('node:crypto');
+
+const ALLOWED_MIME_TYPES = new Set(['image/jpeg', 'image/png', 'image/webp', 'application/pdf']);
+const MAX_FILE_SIZE = 5 * 1024 * 1024; // 5MB
+
+// Store outside the web root — never somewhere a webserver would execute
+// an uploaded file (e.g. never inside a directory served with script
+// execution enabled).
+const UPLOAD_DIR = path.join(process.cwd(), 'private-uploads');
+
+const storage = multer.diskStorage({
+  destination: UPLOAD_DIR,
+  filename(req, file, cb) {
+    // Never trust the original filename — generate a random one instead.
+    cb(null, crypto.randomBytes(16).toString('hex'));
+  },
+});
+
+const upload = multer({
+  storage,
+  limits: { fileSize: MAX_FILE_SIZE },
+  fileFilter(req, file, cb) {
+    if (!ALLOWED_MIME_TYPES.has(file.mimetype)) {
+      return cb(new Error('Unsupported file type'));
+    }
+    cb(null, true);
+  },
+});
+
+// IMPORTANT: fileFilter only checks the client-provided mimetype header,
+// which can be spoofed. After upload, verify actual file content with a
+// library like 'file-type' (reads magic bytes) before trusting it.
+
+module.exports = { upload, UPLOAD_DIR };
+// Usage: app.post('/upload', upload.single('file'), uploadHandler);
+`;
+export const RLS_ENABLE = `-- Enable Row Level Security on a table, then add a policy.
+-- Without RLS, the public anon key can read/write this table directly —
+-- this is the #1 cause of drained/defaced Supabase-backed apps.
+
+ALTER TABLE your_table_name ENABLE ROW LEVEL SECURITY;
+
+-- Example: users can only read their own rows.
+CREATE POLICY "Users can read their own rows"
+  ON your_table_name
+  FOR SELECT
+  USING (auth.uid() = user_id);
+
+-- Repeat ALTER TABLE ... ENABLE ROW LEVEL SECURITY for every table —
+-- there are no exceptions. A table with RLS enabled but no policies
+-- denies all access by default, which is a safe starting point.
+`;
+export const FIX_TEMPLATES = {
+    helmet: { id: "helmet", title: "security/helmet.config.js", code: HELMET_CONFIG },
+    cors: { id: "cors", title: "security/cors.config.js", code: CORS_CONFIG },
+    rateLimit: { id: "rateLimit", title: "security/rateLimiter.middleware.js", code: RATE_LIMITER },
+    accountBackoff: { id: "accountBackoff", title: "security/accountBackoff.js", code: ACCOUNT_BACKOFF },
+    errorHandler: { id: "errorHandler", title: "security/errorHandler.middleware.js", code: ERROR_HANDLER },
+    hashPassword: { id: "hashPassword", title: "security/auth/hashPassword.js", code: HASH_PASSWORD },
+    jwt: { id: "jwt", title: "security/auth/generateToken.js", code: JWT_TOKEN },
+    validation: { id: "validation", title: "security/validation/authSchemas.js", code: VALIDATION_SCHEMA },
+    envExample: { id: "envExample", title: ".env.example", code: ENV_EXAMPLE },
+    ciWorkflow: { id: "ciWorkflow", title: ".github/workflows/security-check.yml", code: SECURITY_CHECK_WORKFLOW },
+    preCommit: { id: "preCommit", title: ".husky/pre-commit", code: PRE_COMMIT_HOOK },
+    fileUpload: { id: "fileUpload", title: "security/fileUpload.middleware.js", code: FILE_UPLOAD },
+    rlsEnable: { id: "rlsEnable", title: "enable-rls.sql", code: RLS_ENABLE },
+};