crumplelab 0.3.0 → 0.3.1

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "crumple",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Find out whether your AI coding agent can be hijacked, and harden it. Local scan, no key, nothing leaves the machine.",
   "author": {
     "name": "Priberry",

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.3.1
+
+- `crumple site` is now a grade anyone can finish without reading code. Each finding says why it matters in
+  plain words, what to do by hand first (like revoking a leaked key), and gives a fix prompt to paste into the
+  app builder. It names the builder when it can tell (Lovable, Bolt, Replit, Emergent, Base44, v0).
+- Re-check: run the same command again and it shows the old grade, the new one, and what got fixed. Only ids,
+  titles and scores are kept, in `~/.crumple/sites`; never keys or data.
+- `--prompt N` prints one fix prompt on its own, ready for the clipboard.
+- `--mine` now checks Firebase too: whether the Realtime Database is open (top-level names only, counted and
+  dropped) and whether common Firestore collections are readable (one document name, no fields).
+- A table anyone can read is critical when it holds people (users, profiles, orders, messages); otherwise it is
+  medium, with a prompt that keeps a public list readable but locks writes.
+- Supabase's newer `sb_publishable_` keys are recognised. A CSP set in a `<meta>` tag counts.
+- `scan` flags a pre-approved code-running MCP tool (`execute`, `run_code`, `execute_sql` and the like). With
+  "code mode" servers, one such tool reaches a whole API, so approving it approves everything its token can do.
+- The `crumple_site` MCP tool returns the prompts, and `change` on a second call in the same session.
+
 ## 0.3.0
 
 - `crumple site <url>`: checks a deployed app (Lovable, Bolt, v0, Replit, Emergent or hand-built) for secret keys

package/README.md

@@ -79,9 +79,15 @@ most often are visible to anyone who opens the site.
 
 ```bash
 npx crumplelab site myapp.lovable.app          # what every visitor can see
-npx crumplelab site myapp.lovable.app --mine   # also: which Supabase tables anyone can read
+npx crumplelab site myapp.lovable.app --mine   # also: which Supabase tables or Firebase data anyone can read
+npx crumplelab site myapp.lovable.app --prompt 1 | pbcopy   # copy fix prompt 1
 ```
 
+You get a grade from A to F and, for each problem, what it means in plain words, what to do by hand first
+(revoking a leaked key is something no AI builder can do for you), and a prompt to paste into Lovable, Bolt,
+Replit or whichever tool built the app. Run the same command again after the fix is live: it shows the old
+grade, the new one, and what got fixed.
+
 `site` reads the page and the JavaScript it serves, the way a curious stranger would, and looks for:
 
 - secret keys in code every visitor downloads (Stripe, OpenAI, Anthropic, AWS, GitHub, Slack, Resend,
@@ -92,7 +98,8 @@ npx crumplelab site myapp.lovable.app --mine   # also: which Supabase tables any
 
 With `--mine`, for an app you own, it takes the public Supabase anon key the app already ships and asks the
 database which tables anyone can read. It sends `HEAD` requests with `count=exact`, so Postgres returns a row
-count and never a row. Tables of people (users, profiles, orders, messages) are marked critical, and each
+count and never a row. For Firebase it checks whether the Realtime Database is open (top-level names only) and
+whether common Firestore collections are readable (one document name, no fields). Tables of people (users, profiles, orders, messages) are marked critical, and each
 finding says which switch to flip in Supabase.
 
 ## Fix it
@@ -177,7 +184,7 @@ Or one app at a time:
   ask "is my agent setup safe?"
 - **Gemini CLI extension:** `gemini extensions install https://github.com/priberry-data/crumplelab`
 - **Skill (Claude Code or Codex):** copy `skills/crumple` into `~/.claude/skills/` or `~/.codex/skills/`.
-- **Any MCP client:** `{"command": "npx", "args": ["-y", "crumplelab@0.3.0", "mcp"]}`. Tools: `crumple_scan`
+- **Any MCP client:** `{"command": "npx", "args": ["-y", "crumplelab@0.3.1", "mcp"]}`. Tools: `crumple_scan`
   (the setup scan, local and instant), `crumple_site` (what a deployed app shows every visitor) and
   `crumple_traps`. The full crash test spends API credit, so it stays a command you run on purpose.
 

package/bin/crumple.mjs

@@ -51,6 +51,7 @@ try {
     help: { type: "boolean", short: "h" },
     version: { type: "boolean", short: "v" },
     mine: { type: "boolean" },
+    prompt: { type: "string" },
     undo: { type: "boolean" },
   },
   });
@@ -76,7 +77,7 @@ const SEVERITY_OF = (s) => ({ critical: 40, high: 15, medium: 5, low: 1 })[s] ??
 const c = { red: (s) => `\x1b[31m${s}\x1b[0m`, green: (s) => `\x1b[32m${s}\x1b[0m`, yellow: (s) => `\x1b[33m${s}\x1b[0m`, dim: (s) => `\x1b[2m${s}\x1b[0m`, bold: (s) => `\x1b[1m${s}\x1b[0m` };
 
 // The guard speaks JSON to the agent over stdout, so it (and any machine-readable output) never gets the banner.
-if (!["guard", "audit", "mcp"].includes(positionals[0]) && !opt.json) process.stdout.write(banner({ version: VERSION, tagline: "the crash test for AI coding agents" }));
+if (!["guard", "audit", "mcp"].includes(positionals[0]) && !opt.json && !opt.prompt) process.stdout.write(banner({ version: VERSION, tagline: "the crash test for AI coding agents" }));
 
 if (positionals[0] === "mcp") {
   // MCP over stdio: the scan and the trap list, for any agent or editor that speaks MCP.
@@ -135,30 +136,31 @@ if (positionals[0] === "mcp") {
   console.log(renderSetup(rows, { name: "Crumple", undo: opt.undo, dryRun: opt["dry-run"], color: Boolean(process.stdout.isTTY && !process.env.NO_COLOR) }));
 } else if (positionals[0] === "site") {
   if (!positionals[1]) {
-    console.error("Usage: npx crumplelab site <url> [--mine]   checks a deployed app (Lovable, Bolt, v0, Replit, any site)");
+    console.error("Usage: npx crumplelab site <url> [--mine] [--prompt N] [--json]   checks a deployed app (Lovable, Bolt, v0, Replit, Emergent, any site)");
     process.exit(2);
   }
-  const { siteScan } = await import("../src/site.mjs");
+  const { siteScan, loadLast, saveRun, compare, renderSite } = await import("../src/site.mjs");
   const run = () => siteScan(positionals[1], { mine: opt.mine });
   let result;
   try {
-    result = opt.json ? await run() : await spin(`looking at ${positionals[1]} the way a stranger would`, run);
+    result = opt.json || opt.prompt ? await run() : await spin(`looking at ${positionals[1]} the way a stranger would`, run);
   } catch (e) {
     console.error(c.red(`crumple: ${e.message}`));
     process.exit(1);
   }
-  if (opt.json) console.log(JSON.stringify(result, null, 2));
-  else {
-    const col = { critical: c.red, high: c.red, medium: c.yellow, low: c.dim };
-    console.log(`\n${c.bold("Crumple site check")} · ${result.url} · ${result.scripts} scripts read${result.supabase ? " · Supabase app" : ""}\n`);
-    if (!result.findings.length) console.log(c.green("Nothing found.\n"));
-    for (const f of result.findings) {
-      console.log(`${col[f.severity](f.severity.toUpperCase().padEnd(8))} ${c.bold(f.title)} ${c.dim(`(${f.where})`)}`);
-      console.log(`         ${f.why}`);
-      console.log(`         ${c.green("Fix:")} ${f.fix}\n`);
+  if (opt.prompt) {
+    // Just one fix prompt, plain, so it can go straight to the clipboard.
+    const p = result.findings.filter((f) => f.prompt)[Number(opt.prompt) - 1];
+    if (!p) {
+      console.error(`crumple: there is no fix prompt ${opt.prompt}; this check has ${result.findings.filter((f) => f.prompt).length}.`);
+      process.exit(2);
     }
-    const color = result.score >= 75 ? c.green : result.score >= 55 ? c.yellow : c.red;
-    console.log(`Site score: ${color(`${result.score}/100 (${result.grade})`)} · read only what the site serves to every visitor${opt.mine ? "; database checked with counts only, no rows" : ""}`);
+    console.log(p.prompt);
+  } else {
+    const change = compare(loadLast(result.url, result.mine), result);
+    saveRun(result);
+    if (opt.json) console.log(JSON.stringify({ ...result, change }, null, 2));
+    else console.log(renderSite(result, change, { color: Boolean(process.stdout.isTTY && !process.env.NO_COLOR) }));
   }
   if (opt["fail-on"] && result.findings.some((f) => SEVERITY_OF(f.severity) >= SEVERITY_OF(opt["fail-on"]))) process.exitCode = 1;
 } else if (positionals[0] === "lock") {
@@ -205,7 +207,7 @@ if (positionals[0] === "mcp") {
     console.log(`Usage: crumple attack [options]
        crumple scan [--sarif f] [--fail-on high]   instant local audit of your agent setup (no key, no Docker)
        crumple setup [--dry-run] [--undo]       add Crumple to every AI coding app here (Cursor, VS Code, Windsurf, Claude, Codex, Gemini CLI, Cline, Kiro…)
-       crumple site <url> [--mine]               check a deployed app (Lovable, Bolt, v0, Replit, any site) for leaked keys and open data
+       crumple site <url> [--mine] [--prompt N]  grade a deployed app (Lovable, Bolt, v0, Replit, Emergent, any site): leaked keys, open data, fix prompts
        crumple fix [--sandbox] [--managed] [--dry-run]   harden this project's agent setup, then attack again
        crumple lock [--check]                      pin your MCP servers' tools; report any that change
        crumple list [--pack dir]                   every trap, its source and the standards it maps to

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "crumple",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Audit AI coding agent setups and deployed apps for leaked keys, open data and risky config.",
   "mcpServers": {
     "crumple": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crumplelab",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Crash-test your AI coding agent setup against prompt injection, secret leaks, malicious MCP tools and destructive actions.",
   "type": "module",
   "bin": {

package/server.json

@@ -8,12 +8,12 @@
     "url": "https://github.com/priberry-data/crumplelab",
     "source": "github"
   },
-  "version": "0.3.0",
+  "version": "0.3.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "crumplelab",
-      "version": "0.3.0",
+      "version": "0.3.1",
       "transport": {
         "type": "stdio"
       },

package/src/mcp.mjs

@@ -15,7 +15,7 @@ const TOOLS = [
   },
   {
     name: "crumple_site",
-    description: "Check a deployed web app (built with Lovable, Bolt, v0, Replit, Emergent or by hand) for secret keys shipped in its JavaScript, a Supabase service_role key in the browser, and public source maps. Reads only what the site serves to every visitor. The Supabase table check needs the owner, so run `npx crumplelab site <url> --mine` for that.",
+    description: "Grade a deployed web app (built with Lovable, Bolt, v0, Replit, Emergent or by hand) A to F for what a stranger can use against it: secret keys shipped in its JavaScript, a Supabase service_role key in the browser, public source maps, no Content-Security-Policy. Each finding has a plain-English reason, what the owner must do by hand (like revoking a key), and a fix `prompt` to apply in the app's code. Call it again after fixing: `change` lists what got fixed. Reads only what the site serves to every visitor. Database checks (which Supabase tables or Firebase data anyone can read) need the owner, so tell them to run `npx crumplelab site <url> --mine` themselves.",
     inputSchema: { type: "object", properties: { url: { type: "string", description: "The app's address, for example myapp.lovable.app" } }, required: ["url"], additionalProperties: false },
     annotations: { readOnlyHint: true, openWorldHint: true },
   },
@@ -27,12 +27,21 @@ const TOOLS = [
   },
 ];
 
+const lastSite = new Map();
+
 async function call(name, args = {}) {
   if (name === "crumple_scan") {
     const dir = path.resolve(args.path || process.cwd());
     return { project: dir, ...scan(dir), next: "Run `npx crumplelab fix` to harden, then `npx crumplelab attack` to prove it (needs Docker and an API key)." };
   }
-  if (name === "crumple_site") return (await import("./site.mjs")).siteScan(args.url, { mine: false });
+  if (name === "crumple_site") {
+    const { siteScan, compare } = await import("./site.mjs");
+    const result = await siteScan(args.url, { mine: false });
+    // Remembered for this session only, so a second call shows what the fixes changed.
+    const change = compare(lastSite.get(result.url), result);
+    lastSite.set(result.url, { at: new Date().toISOString(), score: result.score, grade: result.grade, findings: result.findings.map(({ id, severity, title }) => ({ id, severity, title })) });
+    return { ...result, change };
+  }
   if (name === "crumple_traps") return { traps: SCENARIOS.map((s) => ({ id: s.id, title: s.title, risk: s.risk })) };
   throw new Error(`unknown tool ${name}`);
 }

package/src/scan.mjs

@@ -77,6 +77,9 @@ export function scan(projectDir, { home = os.homedir() } = {}) {
       // An exact rule only ever approves that one command, so only wildcards can carry your data out.
       else if (/^Bash\((curl|wget|nc|ssh|scp|rsync|http)\b/.test(r) && r.includes("*")) add("high", where, `Network tool pre-approved (${r})`, "This is the exact command attackers use to send your .env out.", `Remove "${r}"; let the agent ask, or allow only fixed URLs.`);
       else if (/^Bash\((git|find|fd|rg|go|xargs|env|sed|awk|tar|npx|npm|pnpm|yarn|node|python3?|bash|sh)(:\*|\s\*|\*)?\)$/.test(r)) add("high", where, `Broad pre-approval that can run any program (${r})`, "Flags like `git -c core.fsmonitor=`, `find -exec`, `npm run` and `npx` turn a \"safe\" prefix into arbitrary code (Trail of Bits, 2025).", `Narrow "${r}" to exact subcommands (for example "Bash(git status)"), and install the Crumple guard, which checks flags.`);
+      // "Code mode" servers (Cloudflare's, and the pattern it started) put a whole API behind one execute tool,
+      // so approving that one tool approves every call the server's credentials allow, in one step.
+      else if (/^mcp__[\w-]+__(execute|exec|eval|run|run_?code|execute_?code|run_?script|run_?js|run_?python|code|code_?mode|execute_?sql|run_?sql|shell)$/i.test(r)) add("high", where, `A code-running MCP tool is pre-approved (${r})`, "This one tool can run any code against the API behind it, so a single injected instruction can make many changes (delete DNS records, wipe a database) with no prompt. Per-tool approvals stop meaning anything.", `Remove "${r}" from the allow list so each run asks you, and give that server a read-only or narrowly scoped token.`);
       // A single MCP tool (mcp__server__tool) is a narrow approval; a whole server or open WebFetch is not.
       else if (/^WebFetch$/.test(r) || (/^mcp__[\w-]+$/.test(r) && r.split("__").length === 2)) add("medium", where, `Pre-approved without limits (${r})`, "Lets content from anywhere drive the agent and receive data without a prompt.", `Scope "${r}" to specific domains or tools.`);
     }

package/src/site.mjs

@@ -1,28 +1,52 @@
 // crumple site <url>: checks a deployed app the way a curious stranger would, for the mistakes that
 // AI app builders (Lovable, Bolt, v0, Replit, Emergent and the rest) ship most often:
 //   - secret keys inside the JavaScript every visitor downloads
-//   - a Supabase database whose tables anyone can read with the public key (with --mine only)
+//   - a Supabase or Firebase database that anyone can read with the app's public key (with --mine only)
 //   - source maps that hand out the whole source code
-// It reads only what the site serves to every visitor. The database check asks Postgres for a row
-// count, never for rows, and runs only when you say the app is yours.
+// Every finding comes with a fix prompt to paste back into the app builder, and running the check again
+// shows what got fixed. It reads only what the site serves to every visitor. The database checks ask for
+// a row count (Supabase) or a single document name (Firebase), never for data, and run only when you say
+// the app is yours.
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
 import { SEVERITY } from "./scan.mjs";
 
+// [pattern, id, what it is, what a stranger can do with it, where to revoke it]
 const SECRETS = [
-  [/sk_live_[0-9A-Za-z]{20,}/, "A live Stripe secret key", "Anyone can charge, refund and read your customers' payments."],
-  [/rk_live_[0-9A-Za-z]{20,}/, "A live Stripe restricted key", "Anyone can do whatever this key allows on your Stripe account."],
-  [/sk-(proj|svcacct|admin)-[0-9A-Za-z_-]{20,}|sk-[0-9A-Za-z]{48}\b/, "An OpenAI API key", "Anyone can run up your OpenAI bill."],
-  [/sk-ant-[0-9A-Za-z_-]{20,}/, "An Anthropic API key", "Anyone can run up your Anthropic bill."],
-  [/AKIA[0-9A-Z]{16}/, "An AWS access key", "Depending on its rights: your servers, storage and bill."],
-  [/gh[pousr]_[0-9A-Za-z]{30,}|github_pat_[0-9A-Za-z_]{20,}/, "A GitHub token", "Access to your code, and possibly the right to change it."],
-  [/xox[bpas]-[0-9A-Za-z-]{10,}/, "A Slack token", "Anyone can read or post in your Slack."],
-  [/re_[0-9A-Za-z]{8}_[0-9A-Za-z]{20,}/, "A Resend API key", "Anyone can send email as you."],
-  [/SG\.[0-9A-Za-z_-]{20,}\.[0-9A-Za-z_-]{20,}/, "A SendGrid API key", "Anyone can send email as you."],
-  [/AC[0-9a-f]{32}[^0-9a-f][\s\S]{0,80}?[0-9a-f]{32}/, "Twilio credentials", "Anyone can send texts and make calls on your account."],
-  [/gsk_[0-9A-Za-z]{40,}/, "A Groq API key", "Anyone can run up your Groq bill."],
-  [/AIza[0-9A-Za-z_-]{35}(?=[\s\S]{0,400}(generativelanguage|gemini))/, "A Google AI (Gemini) API key", "Anyone can run up your Gemini bill. (Firebase keys are public by design; this one sits next to Gemini calls.)"],
+  [/sk_live_[0-9A-Za-z]{20,}/, "stripe", "A live Stripe secret key", "Anyone can charge, refund and read your customers' payments.", "Stripe → Developers → API keys → Roll key", "STRIPE_SECRET_KEY"],
+  [/rk_live_[0-9A-Za-z]{20,}/, "stripe-restricted", "A live Stripe restricted key", "Anyone can do whatever this key allows on your Stripe account.", "Stripe → Developers → API keys → delete the restricted key", "STRIPE_RESTRICTED_KEY"],
+  [/sk-(proj|svcacct|admin)-[0-9A-Za-z_-]{20,}|sk-[0-9A-Za-z]{48}\b/, "openai", "An OpenAI API key", "Anyone can run up your OpenAI bill.", "platform.openai.com → API keys → revoke", "OPENAI_API_KEY"],
+  [/sk-ant-[0-9A-Za-z_-]{20,}/, "anthropic", "An Anthropic API key", "Anyone can run up your Anthropic bill.", "console.anthropic.com → API keys → disable", "ANTHROPIC_API_KEY"],
+  [/AKIA[0-9A-Z]{16}/, "aws", "An AWS access key", "Depending on its rights: your servers, storage and bill.", "AWS console → IAM → Users → Security credentials → deactivate the key", "AWS_SECRET_ACCESS_KEY"],
+  [/gh[pousr]_[0-9A-Za-z]{30,}|github_pat_[0-9A-Za-z_]{20,}/, "github", "A GitHub token", "Access to your code, and possibly the right to change it.", "GitHub → Settings → Developer settings → tokens → delete", "GITHUB_TOKEN"],
+  [/xox[bpas]-[0-9A-Za-z-]{10,}/, "slack", "A Slack token", "Anyone can read or post in your Slack.", "api.slack.com/apps → your app → reinstall to get a new token", "SLACK_TOKEN"],
+  [/re_[0-9A-Za-z]{8}_[0-9A-Za-z]{20,}/, "resend", "A Resend API key", "Anyone can send email as you.", "resend.com → API Keys → delete", "RESEND_API_KEY"],
+  [/SG\.[0-9A-Za-z_-]{20,}\.[0-9A-Za-z_-]{20,}/, "sendgrid", "A SendGrid API key", "Anyone can send email as you.", "SendGrid → Settings → API Keys → delete", "SENDGRID_API_KEY"],
+  [/AC[0-9a-f]{32}[^0-9a-f][\s\S]{0,80}?[0-9a-f]{32}/, "twilio", "Twilio credentials", "Anyone can send texts and make calls on your account.", "Twilio console → Account → API keys & tokens → rotate the auth token", "TWILIO_AUTH_TOKEN"],
+  [/gsk_[0-9A-Za-z]{40,}/, "groq", "A Groq API key", "Anyone can run up your Groq bill.", "console.groq.com → API Keys → delete", "GROQ_API_KEY"],
+  [/AIza[0-9A-Za-z_-]{35}(?=[\s\S]{0,400}(generativelanguage|gemini))/, "gemini", "A Google AI (Gemini) API key", "Anyone can run up your Gemini bill. (Firebase keys are public by design; this one sits next to Gemini calls.)", "aistudio.google.com → API keys → delete", "GEMINI_API_KEY"],
 ];
 const JWT = /eyJ[0-9A-Za-z_-]{10,}\.eyJ[0-9A-Za-z_-]{10,}\.[0-9A-Za-z_-]{10,}/g;
 const SUPABASE_URL = /https:\/\/([a-z0-9]{20})\.supabase\.co/;
+const FB_PROJECT = /projectId["']?\s*:\s*["']([a-z0-9-]{4,40})["']/;
+const FB_DB = /["'](https:\/\/[a-z0-9-]+(?:\.[a-z0-9-]+)*\.(?:firebaseio\.com|firebasedatabase\.app))\/?["']/;
+const FB_KEY = /apiKey["']?\s*:\s*["'](AIza[0-9A-Za-z_-]{35})["']/;
+// Firestore can't list its collections without admin rights, so try the names apps use for people and money.
+const FIRESTORE_GUESSES = ["users", "profiles", "customers", "accounts", "orders", "payments", "messages", "chats", "leads", "contacts", "posts"];
+const PERSONAL = /user|profile|customer|account|order|payment|message|chat|contact|lead|email|subscri|invoice/i;
+
+// Which app builder made this, so the fix prompt can say where to paste it.
+export function detectBuilder(host, html = "") {
+  const h = host.toLowerCase();
+  if (/\.lovable\.app$|\.lovableproject\.com$/.test(h) || /lovable-tagger|content=["']Lovable/i.test(html)) return "Lovable";
+  if (/\.bolt\.host$|\.bolt\.new$/.test(h)) return "Bolt";
+  if (/\.replit\.app$|\.repl\.co$|\.replit\.dev$/.test(h)) return "Replit";
+  if (/\.emergent\.host$|\.emergentagent\.com$|\.preview\.emergentagent\.com$/.test(h)) return "Emergent";
+  if (/\.base44\.app$/.test(h)) return "Base44";
+  if (/v0\.dev|v0\.app/.test(h) || /generated by v0/i.test(html)) return "v0";
+  return null;
+}
 
 const decodeJwt = (t) => {
   try {
@@ -46,15 +70,56 @@ async function get(url, { timeout = 15000, headers = {}, method = "GET", max = 8
   }
 }
 
+// --- fix prompts ---------------------------------------------------------------------------------
+// Written for someone who can't read the code: what to do by hand first (revoking a key is something
+// no AI builder can do for you), then one prompt to paste into the builder's chat.
+const P = {
+  secret: (label, revoke, env) => ({
+    first: `Revoke the leaked key, because it is already public: ${revoke}. Then make a new one, and give it only to your backend (in Supabase: Edge Functions → Secrets, named ${env}).`,
+    prompt: `My app has ${label.replace(/^A |^An /, "a ")} in its frontend code, so every visitor can download it. Remove that key from every frontend file. Move every call that uses it into a backend function (a Supabase Edge Function, or a server route if this app has a server) that reads the key from the secret ${env}, and have the frontend call that function instead. The function must check that the user is signed in before it does anything, and must never send the key back to the browser. When you're done, list every file you changed and confirm the key appears nowhere in the frontend.`,
+  }),
+  serviceRole: () => ({
+    first: "Rotate the key, because it is already public: Supabase → Project Settings → API → generate new keys (or reset the JWT secret), then update the apps and functions that use them.",
+    prompt: "My app has the Supabase service_role key in its frontend code. That key skips every security rule. Remove it from every frontend file; the browser must only ever use the anon (publishable) key. Anything that really needs admin access goes into a Supabase Edge Function that reads SUPABASE_SERVICE_ROLE_KEY from its environment and checks the signed-in user before acting. Then make sure Row Level Security is on for every table, with policies so users reach only their own rows. List what you changed.",
+  }),
+  rls: (table, personal) => ({
+    first: null,
+    prompt: personal
+      ? `In my Supabase database, anyone on the internet can read the table "${table}" using the public anon key. Turn on Row Level Security for "${table}" and add policies so a signed-in user can read and change only their own rows: compare auth.uid() with the column that stores the owner's user id (if there is no such column, add user_id uuid references auth.users default auth.uid(), and fill it for existing rows). If some rows really must be public, add a separate read-only policy for just those rows and tell me which. Do not turn off any existing policy. Show me the SQL you ran.`
+      : `In my Supabase database, anyone on the internet can read the table "${table}" using the public anon key. First tell me in one sentence whether this app needs strangers to read "${table}" (a public product list or blog does; anything about specific users doesn't). If it should be public: turn on Row Level Security, add a policy that lets everyone read it, and allow insert, update and delete only for signed-in admins or the row's owner, so strangers can look but never change it. If it shouldn't be public: turn on Row Level Security and let a signed-in user reach only their own rows (auth.uid() = user_id). Do not turn off any existing policy. Show me the SQL you ran.`,
+    sql: personal
+      ? `alter table public."${table}" enable row level security;\ncreate policy "own rows" on public."${table}" for all using (auth.uid() = user_id) with check (auth.uid() = user_id);`
+      : `alter table public."${table}" enable row level security;\ncreate policy "anyone can read" on public."${table}" for select using (true);`,
+  }),
+  rtdb: () => ({
+    first: null,
+    prompt: 'Anyone on the internet can read my Firebase Realtime Database. Rewrite the database rules so nothing is readable or writable without signing in, and each user can only reach their own data, for example under /users/$uid with ".read": "auth.uid === $uid" and ".write": "auth.uid === $uid". Keep public only what truly must be public, and tell me which paths those are. Show me the final rules.',
+  }),
+  firestore: (coll) => ({
+    first: null,
+    prompt: `Anyone on the internet can read the Firestore collection "${coll}". Rewrite my Firestore security rules so "${coll}" (and every other collection) is closed by default, and a signed-in user can only read and write documents they own, for example match /${coll}/{id} { allow read, write: if request.auth != null && request.auth.uid == resource.data.userId; }. Adjust the owner field to whatever this app uses. Show me the final rules.`,
+  }),
+  sourceMaps: () => ({
+    first: null,
+    prompt: "My production build publishes source maps, so anyone can read my app's original source code. Turn them off for production builds only (for Vite: build.sourcemap = false in vite.config), rebuild and redeploy. Don't change anything else.",
+  }),
+  csp: (origins) => ({
+    first: null,
+    prompt: `My app has no Content-Security-Policy. Add one as a <meta http-equiv="Content-Security-Policy"> tag in index.html (or as a response header if this host supports headers). Allow scripts, styles and fonts only from my own site and the services this app really uses${origins.length ? `, including ${origins.join(", ")}` : ""}, and allow connect-src for my backend and APIs. Then test every page and fix anything the policy blocks, without loosening it to allow everything.`,
+  }),
+};
+
+// --- the check -----------------------------------------------------------------------------------
 export async function siteScan(target, { mine = false, fetcher = fetch, maxScripts = 40 } = {}) {
   const fetchOpts = (o = {}) => ({ ...o, fetcher });
   const url = new URL(/^https?:\/\//.test(target) ? target : `https://${target}`);
   const findings = [];
-  const add = (severity, where, title, why, fix) => findings.push({ severity, where, title, why, fix });
+  const add = (f) => findings.push(f);
 
   const page = await get(url.href, fetchOpts());
   if (!page.status || page.status >= 400) throw new Error(`could not load ${url.href} (${page.error || page.status})`);
   const origin = new URL(page.url || url.href).origin;
+  const builder = detectBuilder(new URL(origin).host, page.text);
 
   // Every script the page loads from its own site, plus the scripts those import.
   const srcs = new Set();
@@ -77,13 +142,19 @@ export async function siteScan(target, { mine = false, fetcher = fetch, maxScrip
   }
 
   let supabase = null;
+  let firebase = null;
   const keysSeen = new Set();
+  const thirdParty = new Set();
   for (const b of bundles) {
-    for (const [re, title, why] of SECRETS) {
+    for (const m of b.text.matchAll(/https:\/\/([a-z0-9-]+\.)+[a-z]{2,}/gi)) {
+      const o = new URL(m[0]).origin;
+      if (o !== origin && /supabase\.co|firebase|googleapis|stripe\.com|clerk|posthog|sentry|vercel/.test(o)) thirdParty.add(o.replace(/^https:\/\/[a-z0-9]{20}\.supabase\.co$/, "https://*.supabase.co"));
+    }
+    for (const [re, id, title, why, revoke, env] of SECRETS) {
       const m = b.text.match(re);
       if (m && !keysSeen.has(m[0])) {
         keysSeen.add(m[0]);
-        add("critical", b.where, `${title} is in code every visitor downloads`, `${why} Found: ${m[0].slice(0, 8)}…`, "Revoke this key now, make a new one, and call that service only from your backend (an edge function or server route), never from the browser.");
+        add({ id: `secret:${id}`, severity: "critical", where: b.where, title: `${title} is in code every visitor downloads`, why: `${why} Found: ${m[0].slice(0, 8)}…`, fix: "Revoke this key now, make a new one, and call that service only from your backend (an edge function or server route), never from the browser.", ...P.secret(title, revoke, env) });
       }
     }
     for (const t of b.text.match(JWT) || []) {
@@ -91,52 +162,208 @@ export async function siteScan(target, { mine = false, fetcher = fetch, maxScrip
       if (!p) continue;
       if (p.role === "service_role" && !keysSeen.has(t)) {
         keysSeen.add(t);
-        add("critical", b.where, "Your Supabase service_role key is in the browser code", "This key skips every security rule: anyone can read, change and delete all of your data and users.", "Rotate it in Supabase (Settings → API) and use it only on a server. The browser should only ever have the anon key.");
+        add({ id: "supabase:service_role", severity: "critical", where: b.where, title: "Your Supabase service_role key is in the browser code", why: "This key skips every security rule: anyone can read, change and delete all of your data and users.", fix: "Rotate it in Supabase (Settings → API) and use it only on a server. The browser should only ever have the anon key.", ...P.serviceRole() });
       }
       if (p.role === "anon" && p.iss === "supabase") supabase = { ...(supabase || {}), anon: t, ref: p.ref };
     }
+    const pk = b.text.match(/sb_publishable_[0-9A-Za-z_-]{20,}/);
+    if (pk) supabase = { ...(supabase || {}), anon: supabase?.anon || pk[0] };
     const su = b.text.match(SUPABASE_URL);
     if (su) supabase = { ...(supabase || {}), url: su[0], ref: supabase?.ref || su[1] };
+    const fp = b.text.match(FB_PROJECT);
+    if (fp && /firebase/i.test(b.text)) {
+      firebase = { ...(firebase || {}), project: fp[1] };
+      const db = b.text.match(FB_DB);
+      if (db) firebase.db = db[1];
+      const k = b.text.match(FB_KEY);
+      if (k) firebase.key = k[1];
+    }
     if (b.url && /sourceMappingURL=([^\s'"]+\.map)/.test(b.text)) {
       const mapUrl = new URL(b.text.match(/sourceMappingURL=([^\s'"]+\.map)/)[1], b.url).href;
       const r = await get(mapUrl, fetchOpts({ method: "HEAD" }));
-      if (r.status === 200 && !findings.some((f) => f.title.startsWith("Source maps")))
-        add("medium", new URL(mapUrl).pathname, "Source maps are public", "Anyone can read your app's original source code, including comments and any logic you assumed was hidden.", "Turn off source maps in production builds (for Vite: build.sourcemap = false).");
+      if (r.status === 200 && !findings.some((f) => f.id === "sourcemaps"))
+        add({ id: "sourcemaps", severity: "medium", where: new URL(mapUrl).pathname, title: "Source maps are public", why: "Anyone can read your app's original source code, including comments and any logic you assumed was hidden.", fix: "Turn off source maps in production builds (for Vite: build.sourcemap = false).", ...P.sourceMaps() });
     }
   }
 
+  const database = supabase?.url && supabase.anon ? "Supabase" : firebase?.project ? "Firebase" : null;
+  if (database && !mine)
+    add({ id: "db:skipped", severity: "low", where: database, title: "Database checks skipped", why: `This app uses ${database}. Crumple can check which of its data anyone on the internet can read, but only for an app you own.`, fix: `Run \`npx crumplelab site ${url.host} --mine\` if this is your app.`, first: null, prompt: null });
+
   // Supabase: with the public anon key, which tables can anyone read?
   let tables = null;
-  if (supabase?.url && supabase.anon) {
-    if (!mine) {
-      add("low", "Supabase", "Database checks skipped", "This app uses Supabase. Crumple can check which tables anyone on the internet can read, but only for an app you own.", `Run \`npx crumplelab site ${url.host} --mine\` if this is your app.`);
-    } else {
-      const h = { apikey: supabase.anon, authorization: `Bearer ${supabase.anon}` };
-      const api = await get(`${supabase.url}/rest/v1/`, fetchOpts({ headers: h }));
-      let names = [];
+  if (mine && supabase?.url && supabase.anon) {
+    // The newer sb_publishable_ keys aren't JWTs and go in the apikey header only.
+    const h = { apikey: supabase.anon, ...(supabase.anon.startsWith("eyJ") && { authorization: `Bearer ${supabase.anon}` }) };
+    const api = await get(`${supabase.url}/rest/v1/`, fetchOpts({ headers: h }));
+    let names = [];
+    try {
+      names = Object.keys(JSON.parse(api.text).paths || {}).map((p) => p.slice(1)).filter((p) => p && !p.startsWith("rpc/"));
+    } catch {}
+    tables = [];
+    for (const t of names.slice(0, 60)) {
+      // A HEAD request with count=exact returns how many rows are visible, and no rows.
+      const r = await get(`${supabase.url}/rest/v1/${encodeURIComponent(t)}?select=*`, fetchOpts({ method: "HEAD", headers: { ...h, prefer: "count=exact", range: "0-0" } }));
+      const n = Number((r.headers?.get("content-range") || "").split("/")[1]);
+      if (r.status < 300 && n > 0) tables.push({ table: t, rows: n });
+    }
+    for (const { table, rows } of tables) {
+      const personal = PERSONAL.test(table);
+      const why = personal
+        ? "The anon key is public (it ships in your app), so a table without Row Level Security is readable by everyone. This is how most vibe-coded apps have leaked data."
+        : "The anon key is public (it ships in your app). If this table is meant to be public, like a product list, reading it is fine, but make sure strangers can't change it. If it isn't, it's leaking.";
+      add({ id: `supabase:table:${table}`, severity: personal ? "critical" : "medium", where: `Supabase table "${table}"`, title: `Anyone on the internet can read ${rows.toLocaleString("en-US")} row${rows > 1 ? "s" : ""} of "${table}"`, why, fix: `In Supabase, open Table Editor → ${table} → turn on RLS, then add a policy so people read only their own rows (for example: auth.uid() = user_id).`, ...P.rls(table, personal) });
+    }
+  }
+
+  // Firebase: is the Realtime Database or a common Firestore collection open to anyone?
+  let firebaseOpen = null;
+  if (mine && firebase?.project) {
+    firebaseOpen = [];
+    if (firebase.db) {
+      // shallow=true returns only the top-level key names, each mapped to true; we count them and drop them.
+      const r = await get(`${firebase.db}/.json?shallow=true`, fetchOpts());
+      let keys = 0;
       try {
-        names = Object.keys(JSON.parse(api.text).paths || {}).map((p) => p.slice(1)).filter((p) => p && !p.startsWith("rpc/"));
+        const v = JSON.parse(r.text);
+        keys = v && typeof v === "object" ? Object.keys(v).length : v != null ? 1 : 0;
       } catch {}
-      tables = [];
-      for (const t of names.slice(0, 60)) {
-        // A HEAD request with count=exact returns how many rows are visible, and no rows.
-        const r = await get(`${supabase.url}/rest/v1/${encodeURIComponent(t)}?select=*`, fetchOpts({ method: "HEAD", headers: { ...h, prefer: "count=exact", range: "0-0" } }));
-        const n = Number((r.headers?.get("content-range") || "").split("/")[1]);
-        if (r.status < 300 && n > 0) tables.push({ table: t, rows: n });
+      if (r.status === 200 && keys > 0) {
+        firebaseOpen.push({ where: "Realtime Database", keys });
+        add({ id: "firebase:rtdb", severity: "critical", where: "Firebase Realtime Database", title: "Anyone on the internet can read your Firebase Realtime Database", why: `Its rules let visitors who aren't signed in read it (${keys} top-level ${keys > 1 ? "branches" : "branch"} visible). Everything under them is open.`, fix: "In Firebase → Realtime Database → Rules, require sign-in and limit each user to their own data.", ...P.rtdb() });
       }
-      for (const { table, rows } of tables) {
-        const personal = /user|profile|customer|account|order|payment|message|contact|lead|email|subscri|invoice/i.test(table);
-        add(personal ? "critical" : "high", `Supabase table "${table}"`, `Anyone on the internet can read ${rows.toLocaleString("en-US")} row${rows > 1 ? "s" : ""} of "${table}"`, "The anon key is public (it ships in your app), so a table without Row Level Security is readable by everyone. This is how most vibe-coded apps have leaked data.", `In Supabase, open Table Editor → ${table} → turn on RLS, then add a policy so people read only their own rows (for example: auth.uid() = user_id).`);
+    }
+    for (const coll of FIRESTORE_GUESSES) {
+      // pageSize=1 and a mask on a field that doesn't exist: at most one document name comes back, no fields.
+      const q = `pageSize=1&mask.fieldPaths=__crumple_none${firebase.key ? `&key=${firebase.key}` : ""}`;
+      const r = await get(`https://firestore.googleapis.com/v1/projects/${firebase.project}/databases/(default)/documents/${coll}?${q}`, fetchOpts());
+      let n = 0;
+      try {
+        n = (JSON.parse(r.text).documents || []).length;
+      } catch {}
+      if (r.status === 200 && n > 0) {
+        firebaseOpen.push({ where: `Firestore "${coll}"` });
+        add({ id: `firebase:firestore:${coll}`, severity: PERSONAL.test(coll) ? "critical" : "high", where: `Firestore collection "${coll}"`, title: `Anyone on the internet can read the Firestore collection "${coll}"`, why: "Your Firestore rules let visitors who aren't signed in read it. Crumple asked for one document name and no fields; a stranger would take everything.", fix: `In Firebase → Firestore → Rules, close "${coll}" to everyone except its owner.`, ...P.firestore(coll) });
       }
     }
   }
 
-  if (!page.headers?.get("content-security-policy")) add("low", "response headers", "No Content-Security-Policy", "If an attacker gets a script into the page (through a comment, a profile field or a dependency), nothing stops it from sending your users' data out.", "Add a Content-Security-Policy header in your host's settings.");
+  if (!page.headers?.get("content-security-policy") && !/http-equiv=["']Content-Security-Policy/i.test(page.text))
+    add({ id: "csp", severity: "low", where: "response headers", title: "No Content-Security-Policy", why: "If an attacker gets a script into the page (through a comment, a profile field or a dependency), nothing stops it from sending your users' data out.", fix: "Add a Content-Security-Policy header in your host's settings.", ...P.csp([...thirdParty].slice(0, 6)) });
 
   const penalty = findings.reduce((a, f) => a + SEVERITY[f.severity], 0);
   const score = Math.max(0, 100 - penalty);
   const grade = score >= 90 ? "A" : score >= 75 ? "B" : score >= 60 ? "C" : score >= 40 ? "D" : "F";
   const order = ["critical", "high", "medium", "low"];
   findings.sort((a, b) => order.indexOf(a.severity) - order.indexOf(b.severity));
-  return { url: origin, score, grade, scripts: bundles.length - 1, supabase: supabase ? { project: supabase.ref, checked: mine, readable: tables } : null, findings };
+  return {
+    url: origin,
+    builder,
+    score,
+    grade,
+    verdict: VERDICT[grade],
+    mine,
+    scripts: bundles.length - 1,
+    supabase: supabase ? { project: supabase.ref, checked: mine, readable: tables } : null,
+    firebase: firebase ? { project: firebase.project, checked: mine, readable: firebaseOpen } : null,
+    findings,
+    pasteInto: builder || "your AI app builder or coding agent",
+  };
+}
+
+export const VERDICT = {
+  A: "Nothing serious a stranger can use against you.",
+  B: "No open doors, a few loose ends.",
+  C: "Fix these before you share the link widely.",
+  D: "A stranger can do real damage. Fix the red items today.",
+  F: "Your users' data or your accounts are exposed right now. Fix the red items before anything else.",
+};
+
+// --- re-check ------------------------------------------------------------------------------------
+// The last result for each site is kept on this machine (ids, titles and score only: no keys, no data),
+// so running the check again shows what the fixes changed.
+const HISTORY = () => path.join(process.env.CRUMPLE_HOME ?? path.join(os.homedir(), ".crumple"), "sites");
+const historyFile = (origin, mine, dir) => path.join(dir, `${new URL(origin).host.replace(/[^\w.-]/g, "_")}${mine ? ".mine" : ""}.json`);
+
+export function loadLast(origin, mine, dir = HISTORY()) {
+  try {
+    return JSON.parse(fs.readFileSync(historyFile(origin, mine, dir), "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+export function saveRun(result, dir = HISTORY()) {
+  const slim = { at: new Date().toISOString(), score: result.score, grade: result.grade, findings: result.findings.map(({ id, severity, title }) => ({ id, severity, title })) };
+  try {
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(historyFile(result.url, result.mine, dir), JSON.stringify(slim, null, 2) + "\n");
+  } catch {}
+  return slim;
+}
+
+// What changed between two runs: fixed, still open, new.
+export function compare(prev, result) {
+  if (!prev) return null;
+  const now = new Map(result.findings.map((f) => [f.id, f]));
+  const before = new Map(prev.findings.map((f) => [f.id, f]));
+  return {
+    since: prev.at,
+    before: { score: prev.score, grade: prev.grade },
+    after: { score: result.score, grade: result.grade },
+    fixed: prev.findings.filter((f) => !now.has(f.id)).map((f) => f.title),
+    open: result.findings.filter((f) => before.has(f.id)).map((f) => f.title),
+    new: result.findings.filter((f) => !before.has(f.id)).map((f) => f.title),
+  };
+}
+
+// --- the report a person reads ---------------------------------------------------------------------
+const wrap = (s, w = 92, pad = "    ") => {
+  const out = [];
+  for (const para of String(s).split("\n")) {
+    let line = "";
+    for (const word of para.split(" ")) {
+      if ((line + " " + word).trim().length > w) (out.push(pad + line.trim()), (line = word));
+      else line += " " + word;
+    }
+    out.push(pad + line.trim());
+  }
+  return out.join("\n");
+};
+
+export function renderSite(r, change, { color = true, mine = r.mine } = {}) {
+  const k = (code) => (s) => (color ? `\x1b[${code}m${s}\x1b[0m` : s);
+  const red = k("31"), green = k("32"), yellow = k("33"), dim = k("2"), bold = k("1"), cyan = k("36");
+  const col = { critical: red, high: red, medium: yellow, low: dim };
+  const gcol = r.score >= 75 ? green : r.score >= 55 ? yellow : red;
+  const L = [];
+  L.push("", `${bold("Crumple site check")} · ${r.url}${r.builder ? ` · built with ${r.builder}` : ""} · ${r.scripts} scripts read${r.supabase ? " · Supabase" : ""}${r.firebase ? " · Firebase" : ""}`, "");
+  L.push(`  Grade ${gcol(bold(r.grade))}  ${gcol(`${r.score}/100`)}  ${r.verdict}`);
+  if (change) {
+    const arrow = change.after.score > change.before.score ? green : change.after.score < change.before.score ? red : dim;
+    L.push(`  ${arrow(`Was ${change.before.grade} (${change.before.score}) on ${change.since.slice(0, 10)}, now ${change.after.grade} (${change.after.score}).`)}`);
+    for (const t of change.fixed) L.push(`  ${green("✓ fixed")}  ${t}`);
+    for (const t of change.new) L.push(`  ${red("+ new")}    ${t}`);
+    if (!change.fixed.length && !change.new.length) L.push(dim("  Nothing changed since the last check."));
+  }
+  L.push("");
+  if (!r.findings.length) L.push(green("  Nothing found."), "");
+  let n = 0;
+  for (const f of r.findings) {
+    const num = f.prompt ? `${++n}.` : "  ";
+    L.push(`${num.padStart(3)} ${col[f.severity](f.severity.toUpperCase().padEnd(8))} ${bold(f.title)} ${dim(`(${f.where})`)}`);
+    L.push(wrap(f.why, 88, "             "));
+    if (f.first) L.push(wrap(`${yellow("Do this yourself first:")} ${f.first}`, 88, "             "));
+    if (f.prompt) {
+      L.push(`             ${cyan(`Then paste this into ${r.pasteInto}:`)}`);
+      L.push(wrap(f.prompt, 84, `             ${dim("│")} `));
+    } else L.push(wrap(`${green("Next:")} ${f.fix}`, 88, "             "));
+    L.push("");
+  }
+  L.push(dim(`Read only what the site serves to every visitor${mine ? "; database checked with counts and names only, never data" : ""}.`));
+  if (n) {
+    L.push(dim(`Fix the red items first, one prompt at a time. Copy one prompt: npx crumplelab site ${new URL(r.url).host}${mine ? " --mine" : ""} --prompt 1 | pbcopy`));
+    L.push(dim("After the fixes are live, run this same command again: it shows what got fixed."));
+  }
+  return L.join("\n");
 }