easyvibegate 0.4.4

package/dist/engine/checkers/static/rls-migrations.js

@@ -0,0 +1,324 @@
+import { lineAt } from '../../util/text.js';
+const IDENT = '(?:"[^"]+"|`[^`]+`|[A-Za-z_][A-Za-z0-9_$]*)';
+const QUALIFIED = `(?:(${IDENT})\\s*\\.\\s*)?(${IDENT})`;
+const CREATE_TABLE = new RegExp(`create\\s+table\\s+(if\\s+not\\s+exists\\s+)?${QUALIFIED}`, 'gi');
+const RLS_STMT = new RegExp(`alter\\s+table\\s+(?:only\\s+)?${QUALIFIED}\\s+(enable|disable)\\s+row\\s+level\\s+security`, 'gi');
+const DROP_TABLE = new RegExp(`drop\\s+table\\s+(?:if\\s+exists\\s+)?${QUALIFIED}`, 'gi');
+// SELECT ... INTO <table> also creates a table.
+const SELECT_INTO = new RegExp(`\\bselect\\b[^;]{0,400}?\\binto\\s+${QUALIFIED}`, 'gis');
+/** Normalize one SQL identifier: quoted keeps case, unquoted folds to lowercase. */
+function normIdent(raw) {
+    if (raw.startsWith('"') && raw.endsWith('"'))
+        return raw.slice(1, -1);
+    if (raw.startsWith('`') && raw.endsWith('`'))
+        return raw.slice(1, -1);
+    return raw.toLowerCase();
+}
+const keyOf = (schema, table) => `${schema ? normIdent(schema) : 'public'}.${normIdent(table)}`;
+const displayOf = (schema, table) => (schema ? `${schema}.${table}` : table);
+/**
+ * Blank out comments and string literals (keeping newlines and offsets) so that
+ * SQL inside a string — e.g. SELECT 'ALTER TABLE x ENABLE ROW LEVEL SECURITY' —
+ * or inside a comment is never mistaken for an executed statement.
+ * Handles -- and block comments, '...' with '' escapes (and E'...'), and
+ * $$ / $tag$ dollar-quoted strings. Double-quoted identifiers are kept.
+ */
+export function maskSql(sql) {
+    const out = sql.split('');
+    const n = sql.length;
+    const blank = (from, to) => {
+        for (let k = from; k < to && k < n; k++)
+            if (out[k] !== '\n')
+                out[k] = ' ';
+    };
+    let i = 0;
+    while (i < n) {
+        const ch = sql[i];
+        const next = sql[i + 1];
+        if (ch === '-' && next === '-') {
+            let j = i;
+            while (j < n && sql[j] !== '\n')
+                j++;
+            blank(i, j);
+            i = j;
+            continue;
+        }
+        if (ch === '/' && next === '*') {
+            const close = sql.indexOf('*/', i + 2);
+            const end = close === -1 ? n : close + 2;
+            blank(i, end);
+            i = end;
+            continue;
+        }
+        if (ch === "'") {
+            let j = i + 1;
+            while (j < n) {
+                if (sql[j] === "'") {
+                    if (sql[j + 1] === "'") {
+                        j += 2;
+                        continue;
+                    }
+                    break;
+                }
+                j++;
+            }
+            const end = Math.min(j + 1, n);
+            blank(i, end);
+            i = end;
+            continue;
+        }
+        if (ch === '$') {
+            const m = /^\$([A-Za-z_][A-Za-z0-9_]*)?\$/.exec(sql.slice(i, i + 64));
+            if (m) {
+                const tag = m[0];
+                const close = sql.indexOf(tag, i + tag.length);
+                const end = close === -1 ? n : close + tag.length;
+                // `DO $$ ... $$` is executed procedural code: its DDL is real, so keep the
+                // body visible. Other dollar-quoted strings (EXECUTE format(...)) are blanked.
+                const isDoBlock = /\bdo\s*$/i.test(sql.slice(Math.max(0, i - 8), i));
+                if (isDoBlock) {
+                    const bodyStart = i + tag.length;
+                    const bodyEnd = close === -1 ? n : close;
+                    // Mask inside the body too (a string literal there is still a string),
+                    // then jump past the CLOSING delimiter — scanning from just after the
+                    // opening one would read that closing `$$` as a new opening tag and
+                    // blank the entire rest of the file, hiding every later statement.
+                    const inner = maskSql(sql.slice(bodyStart, bodyEnd));
+                    for (let k = 0; k < inner.length; k++)
+                        out[bodyStart + k] = inner[k];
+                    blank(i, bodyStart);
+                    blank(bodyEnd, end);
+                    i = end;
+                    continue;
+                }
+                blank(i, end);
+                i = end;
+                continue;
+            }
+        }
+        i++;
+    }
+    return out.join('');
+}
+/**
+ * Blank out only comments, preserving length and the `$$` delimiters that
+ * `maskSql` removes. Guard analysis needs the delimiters to find DO blocks, but
+ * must not read `-- end if` in a comment as a real block terminator.
+ */
+function maskSqlComments(sql) {
+    const out = sql.split('');
+    const n = sql.length;
+    const blank = (from, to) => {
+        for (let k = from; k < to && k < n; k++)
+            if (out[k] !== '\n')
+                out[k] = ' ';
+    };
+    let i = 0;
+    while (i < n) {
+        if (sql[i] === '-' && sql[i + 1] === '-') {
+            let j = i;
+            while (j < n && sql[j] !== '\n')
+                j++;
+            blank(i, j);
+            i = j;
+            continue;
+        }
+        if (sql[i] === '/' && sql[i + 1] === '*') {
+            const c = sql.indexOf('*/', i + 2);
+            const end = c === -1 ? n : c + 2;
+            blank(i, end);
+            i = end;
+            continue;
+        }
+        i++;
+    }
+    return out.join('');
+}
+/**
+ * Spans inside a `DO $$ … $$` body that sit between an `IF … THEN` and its
+ * `END IF`. DDL there runs only when the condition holds, and deciding that
+ * needs an interpreter — so statements in these spans are reported as
+ * "cannot be confirmed" rather than assumed to have run.
+ *
+ * IFs nest, so this matches them with a stack: taking the first `END IF` as the
+ * outer block's terminator ends the guard early and lets a statement after the
+ * inner `END IF` look unconditional. `ELSIF` is not an opener (`\bif\b` does not
+ * match inside it). Offsets are preserved, so they line up with `maskSql` output.
+ */
+function conditionalRanges(sql) {
+    const src = maskSqlComments(sql);
+    const ranges = [];
+    for (const m of src.matchAll(/\bdo\s*(\$[A-Za-z_][A-Za-z0-9_]*\$|\$\$)/gi)) {
+        const tag = m[1];
+        const bodyStart = (m.index ?? 0) + m[0].length;
+        const close = src.indexOf(tag, bodyStart);
+        const bodyEnd = close === -1 ? src.length : close;
+        const body = src.slice(bodyStart, bodyEnd);
+        const open = [];
+        for (const t of body.matchAll(/\bend\s+if\b|\bif\b/gi)) {
+            const at = t.index ?? 0;
+            if (/^end/i.test(t[0])) {
+                const from = open.pop();
+                if (from !== undefined)
+                    ranges.push([bodyStart + from, bodyStart + at]);
+            }
+            else {
+                open.push(at);
+            }
+        }
+        // An IF left unterminated guards everything to the end of the block.
+        for (const from of open)
+            ranges.push([bodyStart + from, bodyEnd]);
+    }
+    return ranges;
+}
+/**
+ * Flags each table whose latest state after replaying the migrations is
+ * "created and RLS not enabled". Migrations are replayed in apply order
+ * (files by name, statements by offset); CREATE / ENABLE / DISABLE / DROP are
+ * all modeled; CREATE IF NOT EXISTS on an existing table is a no-op; comments
+ * and string literals are ignored; quoted and schema-qualified names work.
+ */
+export const rlsMigrationsChecker = {
+    id: 'rls-migrations',
+    title: 'Tables created without RLS',
+    level: 0,
+    run(ctx) {
+        const sqlFiles = ctx.files.filter((f) => f.ext === '.sql').sort((a, b) => a.rel.localeCompare(b.rel));
+        if (sqlFiles.length === 0)
+            return [];
+        // RLS is a PostgreSQL feature. Do not tell a MySQL/SQLite project to enable it.
+        const allSql = sqlFiles.map((f) => f.content).join('\n');
+        const pkg = ctx.files.find((f) => f.rel === 'package.json')?.content ?? '';
+        const postgresish = ctx.detection.backends.includes('supabase') ||
+            /\b(pg|postgres|postgresql|@supabase\/|drizzle-orm|postgres\.js|node-postgres)\b/i.test(pkg) ||
+            /(enable\s+row\s+level\s+security|gen_random_uuid|\bserial\b|::\s*\w+|\bjsonb\b)/i.test(allSql) ||
+            /\b(psycopg|asyncpg|sqlalchemy\+postgres)\b/i.test(ctx.files.find((f) => f.rel === 'requirements.txt')?.content ?? '');
+        const otherEngine = /(engine\s*=\s*innodb|auto_increment|\bpragma\b|`\w+`\s*varchar)/i.test(allSql) ||
+            /\b(mysql2?|sqlite3|better-sqlite3|mariadb)\b/i.test(pkg);
+        if (otherEngine && !postgresish)
+            return [];
+        const events = [];
+        sqlFiles.forEach((f, fileIdx) => {
+            const masked = maskSql(f.content);
+            // Computed on the raw text: maskSql blanks the `$$` delimiters themselves,
+            // so the DO blocks are no longer findable there. It preserves length, so
+            // offsets from `masked` line up with these ranges exactly.
+            const guards = conditionalRanges(f.content);
+            const push = (kind, schema, table, offset, ifNotExists = false) => events.push({
+                kind, key: keyOf(schema, table), ifNotExists, file: f.rel, line: lineAt(f.content, offset),
+                display: displayOf(schema, table), fileIdx, offset,
+                conditional: guards.some(([a, b]) => offset >= a && offset < b),
+            });
+            for (const m of masked.matchAll(CREATE_TABLE))
+                push('create', m[2], m[3] ?? '', m.index ?? 0, !!m[1]);
+            for (const m of masked.matchAll(RLS_STMT))
+                push((m[3] ?? '').toLowerCase() === 'disable' ? 'disable' : 'enable', m[1], m[2] ?? '', m.index ?? 0);
+            for (const m of masked.matchAll(DROP_TABLE))
+                push('drop', m[1], m[2] ?? '', m.index ?? 0);
+            for (const m of masked.matchAll(SELECT_INTO))
+                push('create', m[1], m[2] ?? '', m.index ?? 0);
+        });
+        // True apply order: by migration file, then by statement position in the file.
+        events.sort((a, b) => a.fileIdx - b.fileIdx || a.offset - b.offset);
+        const state = new Map();
+        for (const e of events) {
+            const cur = state.get(e.key) ?? { created: false, enabled: false, file: e.file, line: e.line, display: e.display, stateFile: e.file, guarded: false };
+            // Doubt is a property of ANY guarded statement, not just a guarded ENABLE.
+            // A conditional DROP used to delete the table from the model outright, so
+            // a table left unprotected vanished from the report entirely. A later
+            // unconditional statement settles the state and clears the doubt.
+            if (e.conditional) {
+                // Keep the table in the model: assume the guarded branch did NOT run
+                // (the outcome that leaves data exposed), and record the uncertainty.
+                if (e.kind === 'create' && !cur.created) {
+                    cur.created = true;
+                    cur.enabled = false;
+                    cur.file = e.file;
+                    cur.line = e.line;
+                    cur.display = e.display;
+                }
+                if (e.kind === 'enable')
+                    cur.enabled = true;
+                if (e.kind === 'disable')
+                    cur.enabled = false;
+                cur.guarded = true;
+                cur.stateFile = e.file;
+                state.set(e.key, cur);
+                continue;
+            }
+            switch (e.kind) {
+                case 'create':
+                    if (e.ifNotExists && cur.created)
+                        break; // existing table: no-op, keep RLS state
+                    cur.created = true;
+                    cur.enabled = false;
+                    cur.file = e.file;
+                    cur.line = e.line;
+                    cur.display = e.display;
+                    cur.stateFile = e.file;
+                    cur.guarded = false;
+                    break;
+                case 'enable':
+                    cur.enabled = true;
+                    cur.stateFile = e.file;
+                    cur.guarded = false;
+                    break;
+                case 'disable':
+                    cur.enabled = false;
+                    cur.stateFile = e.file;
+                    cur.guarded = false;
+                    break;
+                case 'drop':
+                    cur.created = false;
+                    cur.enabled = false;
+                    cur.stateFile = e.file;
+                    cur.guarded = false;
+                    break;
+            }
+            state.set(e.key, cur);
+        }
+        // Within one directory, filename order IS the apply order, so the replay above
+        // is authoritative. Across directories it is a guess (a root-level
+        // `rls_policies.sql` sorts before `supabase/migrations/003_*.sql`).
+        //
+        // The ambiguity is symmetric: it matters whenever a statement of the OPPOSITE
+        // polarity to the final state lives in another directory — an ENABLE that the
+        // sort happened to put last is no more trustworthy than one it put first.
+        // Checking only the RLS-off direction let `a/…DISABLE` + `z/…ENABLE` pass clean.
+        const dirOf = (rel) => { const i = rel.lastIndexOf('/'); return i === -1 ? '' : rel.slice(0, i); };
+        const turnsOff = (k) => k === 'disable' || k === 'create';
+        const findings = [];
+        for (const [key, s] of state) {
+            if (!s.created)
+                continue;
+            const ambiguous = events.some((e) => e.key === key && dirOf(e.file) !== dirOf(s.stateFile) && (s.enabled ? turnsOff(e.kind) : e.kind === 'enable'));
+            if (s.enabled && !ambiguous && !s.guarded)
+                continue; // provably protected
+            // `guarded` means a statement we had to GUESS about decided this table's
+            // state — a conditional ENABLE, DISABLE, CREATE or DROP. Calling that
+            // "critical" would be the same false confidence as calling it clean, so it
+            // is reported as unconfirmed. A warning still fails CI (exit 1); it just
+            // does not claim to know what only the database can tell.
+            const kind = ambiguous ? 'order' : s.guarded ? 'guarded' : 'missing';
+            findings.push({
+                id: 'rls_missing',
+                severity: kind === 'missing' ? 'critical' : 'warning',
+                title: kind === 'missing' ? `Table "${s.display}" created without RLS`
+                    : kind === 'order' ? `Table "${s.display}" may end up without RLS (migration order unclear)`
+                        : `Table "${s.display}" has an unconfirmed RLS state (conditional block)`,
+                detail: kind === 'missing'
+                    ? `"${s.display}" is created in a migration and its latest state does not enable Row Level Security. If this table holds user data on Supabase, the anon key can read every row.`
+                    : kind === 'order'
+                        ? `"${s.display}" has statements in directories other than "${s.stateFile}" that contradict its final RLS state. Files in separate directories have no reliable apply order, so this cannot be decided statically — check the deployed state.`
+                        : `"${s.display}" has RLS statements inside an "IF … THEN" guard in a DO block. Whether that branch runs cannot be decided without executing the migration, so its RLS state is NOT confirmed — check the deployed state.`,
+                fix: `ALTER TABLE ${s.display} ENABLE ROW LEVEL SECURITY; then add an owner/tenant policy, and drop any permissive "USING (true)" policy (policies are OR-ed). This is a static hint — confirm the deployed state.`,
+                checker: 'rls-migrations',
+                level: 0,
+                file: s.file,
+                line: s.line,
+            });
+        }
+        return findings;
+    },
+};

package/dist/engine/checkers/static/route-inventory.js

@@ -0,0 +1,31 @@
+import { collectEndpoints } from '../../endpoints.js';
+/**
+ * Advisory: enumerate the app's HTTP endpoints as targets for the Level 2 live
+ * probe. It deliberately does NOT claim any of them lack auth — access checks
+ * usually live in middleware, so a static verdict here would be pure noise.
+ */
+export const routeInventoryChecker = {
+    id: 'route-inventory',
+    title: 'Endpoint inventory (targets for live probe)',
+    level: 0,
+    run(ctx) {
+        const endpoints = collectEndpoints(ctx.files);
+        if (endpoints.length === 0)
+            return [];
+        const preview = endpoints
+            .slice(0, 12)
+            .map((e) => `${e.method} ${e.path}`)
+            .join(', ');
+        const more = endpoints.length > 12 ? ` (+${endpoints.length - 12} more)` : '';
+        const finding = {
+            id: 'endpoint_inventory',
+            severity: 'advisory',
+            title: `${endpoints.length} endpoint(s) discovered`,
+            detail: `Targets for the Level 2 live probe: ${preview}${more}. Static analysis cannot tell if these enforce access control — run the live probe to confirm.`,
+            fix: 'Run EasyVibeGate Level 2 against the running app to test each endpoint without auth and, with two accounts, for cross-user access (IDOR).',
+            checker: 'route-inventory',
+            level: 0,
+        };
+        return [finding];
+    },
+};

package/dist/engine/checkers/static/secrets.js

@@ -0,0 +1,262 @@
+import { decodeJwtPayload, lineAt, looksLikePlaceholder, redact, shannonEntropy } from '../../util/text.js';
+/** Real tokens mix case and digits; kebab-case identifiers do not. */
+function looksRandom(s) {
+    const body = s.replace(/^[a-z]+[-_]/i, '');
+    return /[A-Z]/.test(body) && /[0-9]/.test(body) && shannonEntropy(body) >= 3.2;
+}
+const PATTERNS = [
+    {
+        id: 'openai_key',
+        title: 'OpenAI API key',
+        re: /\bsk-(?!ant-)(?:proj-)?[A-Za-z0-9_-]{20,}\b/g,
+        severity: 'critical',
+        fix: 'Remove the key from source, read it from a server-side env var, and rotate it in the OpenAI dashboard.',
+        // ".sk-chase-dot-before-animation-delay" is a CSS class, not a key.
+        validate: looksRandom,
+    },
+    {
+        id: 'anthropic_key',
+        title: 'Anthropic API key',
+        re: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g,
+        severity: 'critical',
+        fix: 'Move the key to a server-side env var and rotate it in the Anthropic console.',
+        validate: looksRandom,
+    },
+    {
+        id: 'aws_key',
+        title: 'AWS access key ID',
+        re: /\bAKIA[0-9A-Z]{16}\b/g,
+        severity: 'critical',
+        fix: 'Deactivate the key in IAM, rotate it, and never commit AWS credentials.',
+    },
+    {
+        id: 'stripe_live',
+        title: 'Stripe live secret key',
+        re: /\b[sr]k_live_[0-9a-zA-Z]{20,}\b/g,
+        severity: 'critical',
+        fix: 'Roll the key in the Stripe dashboard immediately and keep it server-side only.',
+    },
+    {
+        id: 'github_token',
+        title: 'GitHub token',
+        re: /\b(?:ghp|gho|ghu|ghs|ghr)_[0-9A-Za-z]{36,}\b|\bgithub_pat_[0-9A-Za-z_]{22,}\b/g,
+        severity: 'critical',
+        fix: 'Revoke the token in GitHub settings and use a secret store instead.',
+    },
+    {
+        id: 'slack_token',
+        title: 'Slack token',
+        re: /\bxox[baprs]-[0-9A-Za-z-]{10,}\b/g,
+        severity: 'critical',
+        fix: 'Revoke the token in the Slack app settings and rotate it.',
+    },
+    {
+        id: 'sendgrid_key',
+        title: 'SendGrid API key',
+        re: /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g,
+        severity: 'critical',
+        fix: 'Revoke the key in SendGrid and store it server-side only.',
+    },
+    {
+        id: 'hf_token',
+        title: 'Hugging Face token',
+        re: /\bhf_[A-Za-z0-9]{30,}\b/g,
+        severity: 'critical',
+        fix: 'Revoke the token in Hugging Face settings and keep it server-side.',
+    },
+    {
+        id: 'npm_token',
+        title: 'npm access token',
+        re: /\bnpm_[A-Za-z0-9]{30,}\b/g,
+        severity: 'critical',
+        fix: 'Revoke the token on npmjs.com and use a CI secret instead.',
+    },
+    {
+        id: 'google_api_key',
+        title: 'Google API key',
+        re: /\bAIza[0-9A-Za-z_-]{35}\b/g,
+        severity: 'warning',
+        fix: 'Restrict the key by API and referrer, or move it server-side, then rotate it.',
+    },
+    {
+        id: 'telegram_bot',
+        title: 'Telegram bot token',
+        re: /\b\d{8,10}:[A-Za-z0-9_-]{35}\b/g,
+        severity: 'warning',
+        fix: 'Revoke the token via BotFather and keep it server-side.',
+    },
+    {
+        id: 'db_url_password',
+        title: 'Database URL with an inline password',
+        re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp|mssql):\/\/[^\s:/@"']+:([^\s:/@"']{4,})@[^\s"']+/gi,
+        severity: 'critical',
+        fix: 'Move the connection string to a server-side env var and rotate the database password — a committed DB URL grants full data access.',
+    },
+    {
+        id: 'supabase_secret_key',
+        title: 'Supabase secret key',
+        re: /\bsb_secret_[A-Za-z0-9_-]{10,}\b/g,
+        severity: 'critical',
+        fix: 'This is a Supabase secret key (full DB access). Remove it, rotate it in Supabase settings, and keep it server-side only.',
+    },
+    {
+        id: 'private_key',
+        title: 'Private key material',
+        re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/g,
+        severity: 'critical',
+        fix: 'Remove the private key from the repo, rotate the key pair, and store secrets outside source control.',
+    },
+];
+const GENERIC = /(?:api[_-]?key|secret|token|passwd|password|pwd|auth[_-]?token|access[_-]?token|client[_-]?secret|credential)["']?\s*[:=]\s*["']([^"']{8,})["']/gi;
+const JWT = /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g;
+// KEY=value / key: value / Dockerfile ENV|ARG KEY=value, with a secret-looking NAME.
+const ASSIGN = /^[ \t]*(?:export[ \t]+|ENV[ \t]+|ARG[ \t]+)?([A-Za-z_][A-Za-z0-9_.-]*)[ \t]*[:=][ \t]*(.+)$/gm;
+const SECRET_NAME = /(secret|token|password|passwd|private[_-]?key|api[_-]?key|access[_-]?key|credential)/i;
+/** Only .env* files are "server env by design" — a secret there is a warning
+ *  (env-git flags committing it). In real code/config it stays a source leak. */
+function isEnvFile(rel) {
+    return /(^|\/)\.env($|\.)/.test(rel) && !/\.(example|sample|template)$/.test(rel);
+}
+/** Files where name=value secrets are worth scanning (env + common config). */
+function isConfigish(rel) {
+    return /(^|\/)\.env($|\.)/.test(rel) || /\.(ya?ml|toml|ini|conf|properties|npmrc|netrc)$/.test(rel)
+        || /(^|\/)(Dockerfile|\.npmrc|\.netrc)$/.test(rel) || /docker-compose\.ya?ml$/.test(rel);
+}
+/**
+ * Documentation, examples and test fixtures are where sample keys legitimately
+ * live. A hit there is worth mentioning but is not a credential leak.
+ */
+function isExampleContext(rel) {
+    return /\.(md|txt|mdx|rst)$/i.test(rel)
+        || /\.(example|sample|template|dist)$/i.test(rel)
+        || /(^|\/)(docs?|examples?|fixtures?|__fixtures__|__tests__|test|tests|spec|__mocks__)(\/|$)/i.test(rel)
+        || /\.(test|spec)\.[a-z]+$/i.test(rel);
+}
+export const secretsChecker = {
+    id: 'secrets',
+    title: 'Hardcoded secrets',
+    level: 0,
+    run(ctx) {
+        const findings = [];
+        for (const file of ctx.files) {
+            const { rel } = file;
+            const content = file.content.replace(/^\uFEFF/, ''); // a BOM must not eat line 1
+            const env = isEnvFile(rel);
+            const example = isExampleContext(rel);
+            const push = (f) => {
+                if (example) {
+                    findings.push({
+                        ...f,
+                        severity: 'info',
+                        title: `${f.title} (in docs/example file)`,
+                        detail: `${f.detail} This looks like documentation or a fixture — confirm it is not a real credential.`,
+                    });
+                }
+                else
+                    findings.push(f);
+            };
+            for (const p of PATTERNS) {
+                for (const m of content.matchAll(p.re)) {
+                    const hit = m[0];
+                    if (looksLikePlaceholder(hit))
+                        continue; // YOUR_KEY / EXAMPLE / xxxxx / <...>
+                    if (p.validate && !p.validate(hit))
+                        continue;
+                    // A secret in a server env/config file is expected — the risk is
+                    // committing it (env-git flags that), so it is a warning, not a leak.
+                    const severity = env && p.severity === 'critical' ? 'warning' : p.severity;
+                    push({
+                        id: p.id,
+                        severity,
+                        title: env ? `${p.title} (in env/config file)` : p.title,
+                        detail: env
+                            ? `${p.title} in ${rel} (${redact(hit)}). Normal for server env — keep this file gitignored and out of client bundles.`
+                            : `${p.title} found in source: ${redact(hit)}`,
+                        fix: env ? 'Keep this file out of git and out of client bundles; rotate the value if it may have been committed.' : p.fix,
+                        checker: 'secrets',
+                        level: 0,
+                        file: rel,
+                        line: lineAt(content, m.index ?? 0),
+                        evidence: redact(hit),
+                    });
+                }
+            }
+            // Supabase service_role key (a JWT whose payload role is service_role).
+            for (const m of content.matchAll(JWT)) {
+                const payload = decodeJwtPayload(m[0]);
+                if (payload && payload['role'] === 'service_role') {
+                    push({
+                        id: 'supabase_service_role_key',
+                        severity: env ? 'warning' : 'critical',
+                        title: env ? 'Supabase service_role key (in env/config file)' : 'Supabase service_role key in source',
+                        detail: env
+                            ? `A service_role JWT is in ${rel}. Fine for server env only — never commit it or ship it to the client; keep the file gitignored.`
+                            : 'A service_role JWT bypasses Row Level Security entirely and is in source/client code. It must never ship to the client or the repo.',
+                        fix: env
+                            ? 'Keep it server-side only, ensure the file is gitignored, and rotate it if it may have been committed.'
+                            : 'Remove it, rotate the service_role key in Supabase settings, and use it only in trusted server code.',
+                        checker: 'secrets',
+                        level: 0,
+                        file: rel,
+                        line: lineAt(content, m.index ?? 0),
+                        evidence: redact(m[0]),
+                    });
+                }
+            }
+            // Quoted key/secret assignments in code, filtered by placeholder + entropy.
+            for (const m of content.matchAll(GENERIC)) {
+                const value = m[1] ?? '';
+                if (looksLikePlaceholder(value) || shannonEntropy(value) < 3.2)
+                    continue;
+                push({
+                    id: 'generic_secret',
+                    severity: 'warning',
+                    title: 'Possible hardcoded secret',
+                    detail: `A high-entropy value is assigned to a secret-looking name: ${redact(value)}`,
+                    fix: 'If this is a real credential, move it to a server-side env var and rotate it. If not, rename the variable or add `// easyvibegate-ignore`.',
+                    checker: 'secrets',
+                    level: 0,
+                    file: rel,
+                    line: lineAt(content, m.index ?? 0),
+                    evidence: redact(value),
+                });
+            }
+            // name=value / key: value assignments (env, config, Dockerfile ENV/ARG).
+            if (isConfigish(rel)) {
+                for (const m of content.matchAll(ASSIGN)) {
+                    const name = m[1] ?? '';
+                    if (!SECRET_NAME.test(name))
+                        continue;
+                    const value = (m[2] ?? '').trim().replace(/^["']|["']$/g, '').replace(/["'].*$/, '');
+                    if (value.length < 8 || looksLikePlaceholder(value) || shannonEntropy(value) < 3.0)
+                        continue;
+                    push({
+                        id: 'env_secret',
+                        severity: 'warning',
+                        title: env ? 'Secret in env file' : 'Secret in config file',
+                        detail: `"${name}" holds a high-entropy value in ${rel}: ${redact(value)}`,
+                        fix: env
+                            ? 'Fine for server env — keep this file gitignored and out of the client; rotate if it may have leaked.'
+                            : 'Move this secret out of committed config into a server-side secret store, and rotate it.',
+                        checker: 'secrets',
+                        level: 0,
+                        file: rel,
+                        line: lineAt(content, m.index ?? 0),
+                        evidence: redact(value),
+                    });
+                }
+            }
+        }
+        // De-duplicate only true repeats: the same secret, same place, same rule.
+        // (Keying on file:line alone hid every extra key on a minified line.)
+        const rank = { critical: 0, warning: 1, info: 2, advisory: 3 };
+        const seen = new Map();
+        for (const f of findings) {
+            const key = `${f.file ?? ''}:${f.line ?? 0}:${f.id}:${f.evidence ?? ''}`;
+            const cur = seen.get(key);
+            if (!cur || rank[f.severity] < rank[cur.severity])
+                seen.set(key, f);
+        }
+        return [...seen.values()];
+    },
+};

package/dist/engine/config.js

@@ -0,0 +1,54 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+const DEFAULT_CONFIG = { ignore: [], ignorePaths: [] };
+const CONFIG_NAMES = ['easyvibegate.config.json', '.easyvibegaterc.json'];
+export function loadConfig(root, explicitPath) {
+    const candidates = explicitPath ? [explicitPath] : CONFIG_NAMES.map((n) => join(root, n));
+    for (const p of candidates) {
+        let text;
+        try {
+            text = readFileSync(p, 'utf8');
+        }
+        catch {
+            continue; // no such config here — try the next candidate
+        }
+        try {
+            const raw = JSON.parse(text);
+            return {
+                ignore: Array.isArray(raw.ignore) ? raw.ignore : [],
+                ignorePaths: Array.isArray(raw.ignorePaths) ? raw.ignorePaths : [],
+            };
+        }
+        catch (e) {
+            // The file exists but is broken: say so instead of silently ignoring every rule.
+            return { ...DEFAULT_CONFIG, problem: `${p}: invalid JSON (${e instanceof Error ? e.message : String(e)})` };
+        }
+    }
+    return DEFAULT_CONFIG;
+}
+const INLINE_MARKER = 'easyvibegate-ignore';
+/** Drop findings suppressed by config rules or inline `// easyvibegate-ignore` markers. */
+export function applyIgnores(findings, config, files) {
+    const byRel = new Map(files.map((f) => [f.rel, f.content.split('\n')]));
+    const isConfigIgnored = (f) => {
+        const keys = [f.id, f.checker];
+        if (f.file)
+            keys.push(`${f.id}:${f.file}`, `${f.checker}:${f.file}`);
+        if (config.ignore.some((rule) => keys.includes(rule)))
+            return true;
+        if (f.file && config.ignorePaths.some((sub) => f.file.includes(sub)))
+            return true;
+        return false;
+    };
+    const isInlineIgnored = (f) => {
+        if (!f.file || !f.line)
+            return false;
+        const lines = byRel.get(f.file);
+        if (!lines)
+            return false;
+        const current = lines[f.line - 1] ?? '';
+        const prev = f.line >= 2 ? lines[f.line - 2] ?? '' : '';
+        return current.includes(INLINE_MARKER) || prev.includes(INLINE_MARKER);
+    };
+    return findings.filter((f) => !isConfigIgnored(f) && !isInlineIgnored(f));
+}