easyvibegate 0.4.4

package/dist/engine/checkers/backend/firebase.js

@@ -0,0 +1,146 @@
+import { isErr, request, sleep, unreliable } from '../../net/http.js';
+import { looksLikePlaceholder } from '../../util/text.js';
+const COMMON_COLLECTIONS = [
+    'users', 'user', 'profiles', 'accounts', 'messages', 'chats', 'posts',
+    'orders', 'payments', 'products', 'items', 'settings', 'admin', 'config',
+];
+/** Extract Firebase project identifiers from client config in the source. */
+export function discoverFirebase(all) {
+    // Docs/examples must not contribute hosts we would then send requests to.
+    const files = all.filter((f) => !/\.(md|txt|mdx|rst)$/i.test(f.rel));
+    let projectId;
+    let databaseURL;
+    let storageBucket;
+    for (const f of files) {
+        projectId ??= f.content.match(/projectId\s*:\s*["']([^"']+)["']/)?.[1];
+        databaseURL ??= f.content.match(/databaseURL\s*:\s*["']([^"']+)["']/)?.[1]
+            ?? f.content.match(/https:\/\/[a-z0-9-]+(?:-default-rtdb)?\.firebaseio\.com/)?.[0];
+        storageBucket ??= f.content.match(/storageBucket\s*:\s*["']([^"']+)["']/)?.[1];
+        if (!projectId) {
+            const dom = f.content.match(/([a-z0-9-]+)\.firebaseapp\.com/)?.[1];
+            if (dom)
+                projectId = dom;
+        }
+    }
+    if (!projectId || looksLikePlaceholder(projectId))
+        return null;
+    // Only keep hosts that belong to the project we will name in the consent prompt.
+    if (databaseURL && !databaseURL.includes(projectId))
+        databaseURL = undefined;
+    if (storageBucket && !storageBucket.includes(projectId))
+        storageBucket = undefined;
+    return { projectId, databaseURL, storageBucket };
+}
+/** Only a parsable, non-empty JSON payload proves anonymous read access. */
+function hasJsonData(body) {
+    try {
+        const v = JSON.parse(body);
+        if (v === null || v === undefined)
+            return false;
+        if (Array.isArray(v))
+            return v.length > 0;
+        if (typeof v === 'object') {
+            const o = v;
+            if ('error' in o)
+                return false;
+            return Object.keys(o).length > 0;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function hasFirestoreDocs(body) {
+    try {
+        const v = JSON.parse(body);
+        return !v.error && Array.isArray(v.documents) && v.documents.length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+function hasStorageObjects(body) {
+    try {
+        const v = JSON.parse(body);
+        return !v.error && ((Array.isArray(v.items) && v.items.length > 0) || (Array.isArray(v.prefixes) && v.prefixes.length > 0));
+    }
+    catch {
+        return false;
+    }
+}
+/** Probe Firebase RTDB, Firestore and Storage for anonymous read access. */
+export async function probeFirebase(opts) {
+    const { creds } = opts;
+    const rl = opts.rateLimitMs ?? 120;
+    const log = opts.log ?? (() => { });
+    const findings = [];
+    let attempts = 0;
+    let errors = 0;
+    // 1. Realtime Database: the root .json endpoint.
+    const rtdbBase = creds.databaseURL?.replace(/\/$/, '') ?? `https://${creds.projectId}-default-rtdb.firebaseio.com`;
+    await sleep(rl);
+    const rtdb = await request(`${rtdbBase}/.json?shallow=true`);
+    attempts++;
+    if (unreliable(rtdb) || (!isErr(rtdb) && rtdb.status >= 300 && rtdb.status < 400))
+        errors++;
+    if (!isErr(rtdb) && rtdb.status === 200 && hasJsonData(rtdb.body)) {
+        findings.push({
+            id: 'firebase_rtdb_open',
+            severity: 'critical',
+            title: 'Realtime Database is readable without auth',
+            detail: `${rtdbBase}/.json returned data to an unauthenticated request — the database rules are wide open.`,
+            fix: 'Set RTDB rules to require auth and ownership, e.g. ".read": "auth != null && auth.uid === $uid".',
+            checker: 'firebase-probe',
+            level: 2,
+            endpoint: `GET ${rtdbBase}/.json`,
+        });
+    }
+    // 2. Firestore: probe common collection names.
+    const readable = [];
+    for (const col of COMMON_COLLECTIONS) {
+        await sleep(rl);
+        const res = await request(`https://firestore.googleapis.com/v1/projects/${creds.projectId}/databases/(default)/documents/${col}?pageSize=1`);
+        attempts++;
+        if (unreliable(res) || (!isErr(res) && res.status >= 300 && res.status < 400))
+            errors++;
+        if (!isErr(res) && res.status === 200 && hasFirestoreDocs(res.body)) {
+            readable.push(col);
+        }
+    }
+    if (readable.length > 0) {
+        findings.push({
+            id: 'firebase_firestore_open',
+            severity: 'critical',
+            title: 'Firestore collections readable without auth',
+            detail: `Anonymous reads succeeded on: ${readable.join(', ')}. Firestore rules allow public reads.`,
+            fix: 'Tighten firestore.rules: match /{doc=**} { allow read: if request.auth != null && ...owner check... }',
+            checker: 'firebase-probe',
+            level: 2,
+            endpoint: `GET firestore/${readable[0]}`,
+        });
+    }
+    // 3. Storage bucket object listing.
+    const bucket = creds.storageBucket ?? `${creds.projectId}.appspot.com`;
+    await sleep(rl);
+    const storage = await request(`https://firebasestorage.googleapis.com/v0/b/${bucket}/o`);
+    attempts++;
+    if (unreliable(storage) || (!isErr(storage) && storage.status >= 300 && storage.status < 400))
+        errors++;
+    if (!isErr(storage) && storage.status === 200 && hasStorageObjects(storage.body)) {
+        findings.push({
+            id: 'firebase_storage_open',
+            severity: 'critical',
+            title: 'Storage bucket is listable without auth',
+            detail: `Objects in ${bucket} can be listed anonymously.`,
+            fix: 'Set Storage rules to require auth: match /{path=**} { allow read: if request.auth != null; }',
+            checker: 'firebase-probe',
+            level: 2,
+            endpoint: `GET storage/${bucket}`,
+        });
+    }
+    log(`Firebase: probed RTDB, ${COMMON_COLLECTIONS.length} Firestore collections, storage bucket ${bucket}`);
+    const status = errors === 0 ? 'completed' : errors < attempts ? 'partial' : 'failed';
+    const note = errors > 0 ? `${errors}/${attempts} requests errored` : undefined;
+    return { findings, run: { id: 'firebase-probe', level: 2, status, note } };
+}

package/dist/engine/checkers/backend/supabase.js

@@ -0,0 +1,249 @@
+import { decodeJwtPayload } from '../../util/text.js';
+import { isErr, request, sleep, unreliable } from '../../net/http.js';
+const URL_ASSIGN = /(?:NEXT_PUBLIC_|VITE_|PUBLIC_)?SUPABASE(?:_PUBLIC)?_URL\s*[:=]\s*["'`]?(https?:\/\/[^"'`\s]+)/i;
+const ANON_ASSIGN = /(?:NEXT_PUBLIC_|VITE_|PUBLIC_)?SUPABASE_(?:ANON|PUBLISHABLE)_KEY\s*[:=]\s*["'`]?([A-Za-z0-9._-]{20,})/i;
+export function classifyKey(key) {
+    if (key.startsWith('sb_publishable_'))
+        return 'publishable';
+    if (key.startsWith('sb_secret_'))
+        return 'secret';
+    const payload = decodeJwtPayload(key);
+    const role = payload?.['role'];
+    if (role === 'anon')
+        return 'jwt-anon';
+    if (role === 'authenticated')
+        return 'jwt-authenticated';
+    if (role === 'service_role')
+        return 'jwt-service';
+    return 'unknown';
+}
+/** Find a Supabase URL + a *public* key (anon JWT or publishable) in the project. */
+export function discoverSupabase(files) {
+    // Skip docs when discovering credentials so we don't mix an example URL with a real key.
+    const scannable = files.filter((f) => !f.rel.endsWith('.md') && !f.rel.endsWith('.txt'));
+    let url;
+    let anonKey;
+    let source;
+    for (const f of scannable) {
+        const u = f.content.match(URL_ASSIGN)?.[1];
+        if (u && !url) {
+            url = u;
+            source = f.rel;
+        }
+        const k = f.content.match(ANON_ASSIGN)?.[1];
+        if (k && !anonKey && ['publishable', 'jwt-anon'].includes(classifyKey(k)))
+            anonKey = k;
+        if (url && anonKey)
+            break;
+    }
+    if (!url) {
+        for (const f of scannable) {
+            const m = f.content.match(/https:\/\/[a-z0-9]{16,}\.supabase\.co/);
+            if (m) {
+                url = m[0];
+                source ??= f.rel;
+                break;
+            }
+        }
+    }
+    if (!anonKey) {
+        // Only a genuine anon key or publishable key — never authenticated/service.
+        outer: for (const f of scannable) {
+            for (const m of f.content.matchAll(/\bsb_publishable_[A-Za-z0-9_-]{10,}\b/g)) {
+                anonKey = m[0];
+                break outer;
+            }
+            for (const m of f.content.matchAll(/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g)) {
+                if (classifyKey(m[0]) === 'jwt-anon') {
+                    anonKey = m[0];
+                    break outer;
+                }
+            }
+        }
+    }
+    if (!url || !anonKey)
+        return null;
+    return {
+        url: url.replace(/\/+$/, ''),
+        anonKey,
+        keyKind: classifyKey(anonKey) === 'publishable' ? 'publishable' : 'jwt-anon',
+        source,
+    };
+}
+// Word-ish matching on the table name: "postcards" must not match "card",
+// "authors" must not match "auth", but "api_keys" and "ssn_records" must hit.
+const SENSITIVE_WORDS = [
+    'user', 'users', 'account', 'accounts', 'payment', 'payments', 'order', 'orders',
+    'subscription', 'subscriptions', 'auth', 'session', 'sessions', 'email', 'emails',
+    'customer', 'customers', 'profile', 'profiles', 'token', 'tokens', 'secret', 'secrets',
+    'credential', 'credentials', 'key', 'keys', 'apikey', 'apikeys', 'invoice', 'invoices',
+    'billing', 'address', 'addresses', 'phone', 'phones', 'card', 'cards', 'password',
+    'passwords', 'member', 'members', 'contact', 'contacts', 'message', 'messages', 'chat',
+    'chats', 'kyc', 'passport', 'ssn', 'pii', 'salary', 'salaries', 'payroll', 'health',
+    'medical', 'patient', 'patients', 'private', 'identity', 'identities', 'wallet', 'transaction', 'transactions',
+];
+const SENSITIVE_SET = new Set(SENSITIVE_WORDS);
+function severityForTable(table) {
+    const words = table.toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
+    return words.some((w) => SENSITIVE_SET.has(w) || SENSITIVE_SET.has(w.replace(/s$/, ''))) ? 'critical' : 'warning';
+}
+function authHeaders(key) {
+    return { apikey: key, Authorization: `Bearer ${key}` };
+}
+function curlEvidence(url, table) {
+    return `curl '${url}/rest/v1/${table}?select=*&limit=3' -H 'apikey: <ANON_KEY>' -H 'Authorization: Bearer <ANON_KEY>'`;
+}
+function parseCount(headers) {
+    const cr = headers.get('content-range');
+    if (!cr)
+        return null;
+    const total = cr.split('/').pop();
+    if (!total || total === '*')
+        return null;
+    const n = parseInt(total, 10);
+    return Number.isNaN(n) ? null : n;
+}
+async function enumerate(creds) {
+    const res = await request(`${creds.url}/rest/v1/`, { headers: authHeaders(creds.anonKey) });
+    if (isErr(res))
+        return { error: res.error };
+    if (res.status === 401 || res.status === 403)
+        return { error: `anon key rejected (HTTP ${res.status})` };
+    if (res.status >= 400)
+        return { error: `PostgREST returned HTTP ${res.status}` };
+    let spec;
+    try {
+        spec = JSON.parse(res.body);
+    }
+    catch {
+        return { error: 'PostgREST did not return an OpenAPI document' };
+    }
+    const schemas = { ...(spec.definitions ?? {}), ...(spec.components?.schemas ?? {}) };
+    let tables = Object.keys(schemas);
+    const paths = Object.keys(spec.paths ?? {});
+    if (tables.length === 0) {
+        tables = paths.filter((p) => /^\/[^/{}]+$/.test(p) && p !== '/rpc' && !p.startsWith('/rpc/')).map((p) => p.slice(1));
+    }
+    const rpc = paths.filter((p) => p.startsWith('/rpc/')).map((p) => p.slice('/rpc/'.length)).filter(Boolean);
+    return { tables, rpc };
+}
+/**
+ * Actively probe a Supabase project with its public key — the same access any
+ * visitor's browser has. READ-ONLY: it never writes. Returns the findings and a
+ * status so a failed/partial probe is never reported as a clean result.
+ */
+export async function probeSupabase(opts) {
+    const { creds } = opts;
+    const rl = opts.rateLimitMs ?? 120;
+    const log = opts.log ?? (() => { });
+    const findings = [];
+    // Only a genuine public key proves anything about anonymous access. Reject
+    // service/secret keys (bypass RLS) AND authenticated/unknown keys (not anon).
+    const kind = classifyKey(creds.anonKey);
+    if (kind !== 'jwt-anon' && kind !== 'publishable') {
+        return {
+            findings: [{
+                    id: 'supabase_key_not_public',
+                    severity: 'warning',
+                    title: 'Supabase probe skipped — key is not a public anon key',
+                    detail: `The provided key is "${kind}". Only a public anon (or publishable) key proves anything about anonymous access; probing with anything else is meaningless or unsafe.`,
+                    fix: 'Re-run with the public anon (or publishable) key. Keep service/secret keys server-side only.',
+                    checker: 'supabase-probe',
+                    level: 2,
+                }],
+            run: { id: 'supabase-probe', level: 2, status: 'skipped', note: `non-anon key (${kind})` },
+        };
+    }
+    const enumerated = await enumerate(creds);
+    if ('error' in enumerated) {
+        return {
+            findings: [],
+            run: { id: 'supabase-probe', level: 2, status: 'failed', note: enumerated.error },
+        };
+    }
+    const { tables, rpc } = enumerated;
+    log(`Supabase: ${tables.length} table(s), ${rpc.length} rpc function(s) exposed to PostgREST`);
+    let errored = 0;
+    for (const table of tables) {
+        await sleep(rl);
+        // HEAD + count=exact returns only the row count in a header — no data pulled.
+        const res = await request(`${creds.url}/rest/v1/${encodeURIComponent(table)}?select=*`, {
+            method: 'HEAD',
+            headers: { ...authHeaders(creds.anonKey), Prefer: 'count=exact', Range: '0-0', 'Range-Unit': 'items' },
+        });
+        // 5xx/429/timeout AND 3xx (a login redirect) mean we learned nothing here.
+        if (isErr(res) || res.status === 429 || res.status >= 500 || (res.status >= 300 && res.status < 400)) {
+            errored++;
+            continue;
+        }
+        if (res.status === 200 || res.status === 206) {
+            const count = parseCount(res.headers);
+            if (count === null) {
+                errored++;
+                continue;
+            } // no usable count → inconclusive, not proof
+            if (count > 0) {
+                const sev = severityForTable(table);
+                findings.push({
+                    id: 'supabase_anon_read',
+                    severity: sev,
+                    title: `Table "${table}" is readable by anyone`,
+                    detail: `The public key can read ${count} row(s) from "${table}".` +
+                        (sev === 'critical'
+                            ? ' The name suggests private/PII/financial data — if so, this is a serious leak.'
+                            : ' If this table is public content (e.g. products/articles) this may be intended — confirm.'),
+                    fix: `Enable RLS and make sure no permissive policy grants anon access: ALTER TABLE ${table} ENABLE ROW LEVEL SECURITY; then DROP any "USING (true)" policy and add an owner/tenant policy (a new policy is OR-ed with existing ones, so a permissive policy left in place keeps access open).`,
+                    checker: 'supabase-probe',
+                    level: 2,
+                    endpoint: `GET /rest/v1/${table}`,
+                    evidence: curlEvidence(creds.url, table),
+                });
+            }
+        }
+    }
+    // Storage buckets listable by anon.
+    await sleep(rl);
+    const buckets = await request(`${creds.url}/storage/v1/bucket`, { headers: authHeaders(creds.anonKey) });
+    let storageErrored = unreliable(buckets);
+    if (!isErr(buckets) && buckets.status === 200) {
+        try {
+            const parsed = JSON.parse(buckets.body);
+            const list = (Array.isArray(parsed) ? parsed : parsed?.buckets);
+            if (!Array.isArray(list))
+                throw new Error('unrecognized bucket listing');
+            if (list.length > 0) {
+                const objs = list.map((b) => (typeof b === 'string' ? { name: b } : b));
+                const publicOnes = objs.filter((b) => b.public).map((b) => b.name ?? b.id ?? '(unnamed)').join(', ');
+                findings.push({
+                    id: 'supabase_bucket_listing',
+                    severity: publicOnes ? 'critical' : 'warning',
+                    title: 'Storage buckets are listable by anyone',
+                    detail: `The public key can list ${list.length} storage bucket(s)${publicOnes ? `; public: ${publicOnes}` : ''}.`,
+                    fix: 'Restrict bucket listing and mark buckets private unless public access is intentional; add storage RLS policies.',
+                    checker: 'supabase-probe',
+                    level: 2,
+                    endpoint: 'GET /storage/v1/bucket',
+                });
+            }
+        }
+        catch {
+            storageErrored = true;
+        } // a 200 we cannot parse is a lost sub-check
+    }
+    if (rpc.length > 0) {
+        findings.push({
+            id: 'supabase_rpc_exposed',
+            severity: 'advisory',
+            title: `${rpc.length} RPC function(s) exposed`,
+            detail: `PostgREST exposes RPC: ${rpc.slice(0, 12).join(', ')}${rpc.length > 12 ? ' …' : ''}. Review that each checks the caller's identity.`,
+            fix: 'Ensure SECURITY DEFINER functions verify auth.uid() internally and are not callable by anon when they should not be.',
+            checker: 'supabase-probe',
+            level: 2,
+        });
+    }
+    const attempted = tables.length + 1; // tables + storage
+    const totalErr = errored + (storageErrored ? 1 : 0);
+    const status = totalErr === 0 ? 'completed' : totalErr < attempted ? 'partial' : 'failed';
+    const note = totalErr > 0 ? `${totalErr}/${attempted} probe requests errored (5xx/429/timeout)` : undefined;
+    return { findings, run: { id: 'supabase-probe', level: 2, status, note } };
+}

package/dist/engine/checkers/deep/deps.js

@@ -0,0 +1,118 @@
+import { execFile } from 'node:child_process';
+function run(cmd, args, cwd, timeoutMs) {
+    return new Promise((resolve) => {
+        execFile(cmd, args, { cwd, timeout: timeoutMs, maxBuffer: 20 * 1024 * 1024 }, (err, stdout) => {
+            // audit tools exit non-zero when vulnerabilities are found; keep stdout.
+            const e = err;
+            const failedToSpawn = !!e && (e.code === 'ENOENT' || e.killed === true);
+            const code = e && typeof e.code === 'number' ? e.code : e ? 1 : 0;
+            resolve({ stdout: stdout || '', code, failedToSpawn });
+        });
+    });
+}
+/**
+ * Level 1: dependency vulnerability audit via the project's package manager.
+ * Returns a status so an audit that could not run (offline, missing tool,
+ * registry error) is never reported as "no vulnerabilities".
+ */
+export async function auditDeps(root, packageManagers, timeoutMs = 60000) {
+    const pm = packageManagers.includes('pnpm')
+        ? 'pnpm'
+        : packageManagers.includes('yarn')
+            ? 'yarn'
+            : packageManagers.includes('bun')
+                ? 'bun'
+                : 'npm';
+    if (pm === 'bun') {
+        return {
+            findings: [],
+            run: { id: 'deps', level: 1, status: 'unsupported', note: 'bun audit is not yet supported — run `bun audit` manually' },
+        };
+    }
+    const failed = (note) => ({
+        findings: [],
+        run: { id: 'deps', level: 1, status: 'failed', note },
+    });
+    const res = await run(pm, ['audit', '--json'], root, timeoutMs);
+    if (res.failedToSpawn)
+        return failed(`${pm} not found or timed out`);
+    if (!res.stdout.trim())
+        return failed(`${pm} audit produced no output (offline or no lockfile?)`);
+    let counts;
+    let vulnMap = {};
+    if (pm === 'yarn') {
+        let summary;
+        for (const line of res.stdout.split('\n')) {
+            const s = line.trim();
+            if (!s.startsWith('{'))
+                continue;
+            try {
+                const obj = JSON.parse(s);
+                if (obj.type === 'auditSummary' && obj.data?.vulnerabilities)
+                    summary = obj.data.vulnerabilities;
+            }
+            catch { /* skip */ }
+        }
+        if (!summary)
+            return failed('could not parse yarn audit output');
+        counts = summary;
+    }
+    else {
+        let parsed;
+        try {
+            parsed = JSON.parse(res.stdout);
+        }
+        catch {
+            const line = res.stdout.trim().split('\n').filter(Boolean).pop() ?? '';
+            try {
+                parsed = JSON.parse(line);
+            }
+            catch {
+                return failed('could not parse audit output');
+            }
+        }
+        // A valid JSON error envelope (e.g. registry unavailable) is NOT "clean".
+        if (parsed.error !== undefined || !parsed.metadata?.vulnerabilities) {
+            return failed('audit returned an error or an unrecognized shape');
+        }
+        counts = parsed.metadata.vulnerabilities;
+        vulnMap = parsed.vulnerabilities ?? {};
+    }
+    const critical = counts.critical ?? 0;
+    const high = counts.high ?? 0;
+    const moderate = counts.moderate ?? 0;
+    const low = counts.low ?? 0;
+    const total = counts.total ?? critical + high + moderate + low;
+    const findings = [];
+    if (total > 0) {
+        const severity = critical + high > 0 ? 'critical' : moderate > 0 ? 'warning' : 'info';
+        findings.push({
+            id: 'deps_vulnerabilities',
+            severity,
+            title: `${total} vulnerable dependenc${total === 1 ? 'y' : 'ies'}`,
+            detail: `${pm} audit: ${critical} critical, ${high} high, ${moderate} moderate, ${low} low.`,
+            fix: `Run \`${pm} audit${pm === 'npm' ? ' fix' : ''}\` and upgrade the flagged packages; check breaking changes.`,
+            checker: 'deps',
+            level: 1,
+        });
+        const named = Object.values(vulnMap)
+            .filter((v) => v.severity === 'critical' || v.severity === 'high')
+            .map((v) => v.name)
+            .filter(Boolean)
+            .slice(0, 8);
+        if (named.length) {
+            findings.push({
+                id: 'deps_top_packages',
+                severity: 'info',
+                title: 'High/critical packages to upgrade',
+                detail: named.join(', '),
+                fix: 'Upgrade these first; they carry the most severe advisories.',
+                checker: 'deps',
+                level: 1,
+            });
+        }
+    }
+    // "completed" with zero findings means genuinely no known vulns — the status,
+    // not an info finding, records that the check ran cleanly.
+    return { findings, run: { id: 'deps', level: 1, status: 'completed' } };
+}

package/dist/engine/checkers/index.js

@@ -0,0 +1,15 @@
+import { secretsChecker } from './static/secrets.js';
+import { clientExposureChecker } from './static/client-exposure.js';
+import { configRisksChecker } from './static/config-risks.js';
+import { rlsMigrationsChecker } from './static/rls-migrations.js';
+import { envGitChecker } from './static/env-git.js';
+import { routeInventoryChecker } from './static/route-inventory.js';
+/** Level 0 checkers: read-only static analysis, no install, any stack. */
+export const staticCheckers = [
+    secretsChecker,
+    clientExposureChecker,
+    configRisksChecker,
+    rlsMigrationsChecker,
+    envGitChecker,
+    routeInventoryChecker,
+];

package/dist/engine/checkers/live/endpoint-probe.js

@@ -0,0 +1,72 @@
+import { concretePath } from '../../endpoints.js';
+import { isErr, request, sleep } from '../../net/http.js';
+/** Real, non-empty JSON payload — `[]`, `{}` and `{"error":...}` are not data. */
+function looksLikeData(body) {
+    const t = body.trim();
+    if (t.length < 2 || !(t.startsWith('{') || t.startsWith('[')))
+        return false;
+    try {
+        const v = JSON.parse(t);
+        if (Array.isArray(v))
+            return v.length > 0;
+        if (v && typeof v === 'object') {
+            const o = v;
+            if ('error' in o || 'errors' in o)
+                return false;
+            return Object.keys(o).length > 0;
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Hit each GET-able endpoint with no authentication. A 200 with JSON data is a
+ * candidate "no access control" hole — reported as a warning to confirm, since
+ * some endpoints are legitimately public.
+ */
+export async function probeEndpointsUnauth(appUrl, endpoints, rateLimitMs = 100) {
+    const base = appUrl.replace(/\/$/, '');
+    const findings = [];
+    const candidates = endpoints.filter((e) => e.method === 'GET' || e.method === 'ANY');
+    const MAX = 60;
+    const targets = candidates.slice(0, MAX);
+    const dropped = candidates.length - targets.length;
+    if (targets.length === 0) {
+        return { findings, run: { id: 'endpoint-probe', level: 2, status: 'skipped', note: 'no GET endpoints discovered' } };
+    }
+    let errors = 0;
+    for (const e of targets) {
+        await sleep(rateLimitMs);
+        const path = concretePath(e.path).replace(/^\/?/, '/');
+        const res = await request(base + path, { headers: { accept: 'application/json' } });
+        if (isErr(res) || res.status === 429 || res.status >= 500 || (res.status >= 300 && res.status < 400)) {
+            errors++;
+            continue;
+        }
+        if (res.status !== 200)
+            continue;
+        if (!looksLikeData(res.body))
+            continue;
+        findings.push({
+            id: 'endpoint_no_auth',
+            severity: 'warning',
+            title: `Endpoint returns data without authentication`,
+            detail: `GET ${path} responded 200 with JSON to an unauthenticated request. Confirm this endpoint is meant to be public.`,
+            fix: 'Require a session/token check on this route (middleware or an explicit guard) if the data is not meant to be public.',
+            checker: 'endpoint-probe',
+            level: 2,
+            endpoint: `GET ${path}`,
+            evidence: `curl '${base}${path}'`,
+        });
+    }
+    const status = errors >= targets.length ? 'failed' : errors > 0 || dropped > 0 ? 'partial' : 'completed';
+    const notes = [];
+    if (errors > 0)
+        notes.push(`${errors}/${targets.length} endpoint requests errored`);
+    if (dropped > 0)
+        notes.push(`only ${MAX}/${candidates.length} endpoints probed (cap)`);
+    const note = notes.length ? notes.join('; ') : undefined;
+    return { findings, run: { id: 'endpoint-probe', level: 2, status, note } };
+}