easyvibegate 0.6.0 → 0.6.2

package/README.md

@@ -106,6 +106,10 @@ jobs:
 
 Плюс: `postgres://app:app@localhost` в docker-compose / CI — дефолтный логин локального контейнера, не секрет; `tracking_token` и `pagination_token` из кэша API — не секреты; папки `cache/`, `tmp/` не сканируются.
 
+Секрет в gitignored-файле, который **не** `.env` (например, пароль от прода в `.claude/settings.local.json`), — предупреждение: через git не утечёт, но лежит не там. Папка `easyvibegate-report/` сама пишет себе `.gitignore` — отчёт содержит префиксы секретов и карту эндпоинтов, коммитить его нельзя.
+
+Статическая проверка RLS видит только `CREATE TABLE` из миграций в репозитории. Таблицы, созданные из дашборда или из другого репо, перечисляет только живая проверка — если отказаться от неё, в отчёте будет часть картины, и он об этом скажет.
+
 Оценка — это отметка, а не счётчик: после пяти предупреждений балл перестаёт падать (число всё равно показано), критичные могут обнулить его по-прежнему.
 
 ## Оценка и статусы

package/dist/cli/index.js

@@ -262,6 +262,17 @@ async function main() {
     // Reports land next to the scanned project by default, so scanning several
     // projects from one shell never overwrites another project's report.
     const outDir = args.output !== undefined ? resolve(args.output) : join(root, 'easyvibegate-report');
+    // The report directory gets its OWN `.gitignore` (see prepareOutputDir) and
+    // has its stale report files deleted on every run. Both are safe for a
+    // directory that exists only to hold reports — neither is safe for the
+    // scanned project itself: `--output .` from the project root would replace
+    // the project's real .gitignore with a bare `*`, silently un-tracking the
+    // whole repo.
+    if (args.output !== undefined && outDir === root) {
+        process.stderr.write(`easyvibegate: --output must not be the scanned project itself (${root}) — pick a subdirectory, e.g. --output ${join(root, 'easyvibegate-report')}
+`);
+        process.exit(2);
+    }
     // Use the friendly wizard when a human runs it in a terminal without
     // automation flags; --wizard forces it. Either way the pipeline below is shared.
     // --ci is a non-interactive contract: never ask questions there.
@@ -368,6 +379,12 @@ function prepareOutputDir(dir) {
         if (existsSync(dir) && !statSync(dir).isDirectory())
             return 'exists and is not a directory';
         mkdirSync(dir, { recursive: true });
+        // The report names secret prefixes, database hosts and every endpoint —
+        // exactly what must not be committed. A `.gitignore` containing `*` inside
+        // the directory makes git ignore it wherever the project's own .gitignore
+        // stands (the trick node_modules-style caches use); the user's files are
+        // never edited. Rewritten every run so a stray edit cannot un-ignore it.
+        writeFileSync(join(dir, '.gitignore'), '# Written by EasyVibeGate: this report can contain secret prefixes and hosts. Never commit it.\n*\n', 'utf8');
         // Old report.md next to a fresh report.json told two different stories.
         for (const name of ['report.md', 'report.json', 'ai-fix-prompt.md']) {
             const p = join(dir, name);

package/dist/engine/checkers/backend/firebase.js

@@ -1,5 +1,8 @@
 import { classifyBody, request, sleep } from '../../net/http.js';
-import { looksLikePlaceholder } from '../../util/text.js';
+import { DNS_LABEL, looksLikePlaceholder } from '../../util/text.js';
+const FIREBASEIO_URL = new RegExp(`https://${DNS_LABEL}(?:-default-rtdb)?\\.firebaseio\\.com`);
+const FIREBASEAPP_DOMAIN = new RegExp(`(${DNS_LABEL})\\.firebaseapp\\.com`);
+const FIREBASEDATABASE_APP = new RegExp(`^${DNS_LABEL}\\.firebasedatabase\\.app$`);
 const COMMON_COLLECTIONS = [
     'users', 'user', 'profiles', 'accounts', 'messages', 'chats', 'posts',
     'orders', 'payments', 'products', 'items', 'settings', 'admin', 'config',
@@ -11,13 +14,16 @@ export function discoverFirebase(all) {
     let projectId;
     let databaseURL;
     let storageBucket;
+    // This loop runs against every project file's raw content, including large
+    // ones — see `DNS_LABEL` in util/text.ts for why the two host regexes below
+    // are bounded instead of `[a-z0-9-]+`.
     for (const f of files) {
         projectId ??= f.content.match(/projectId\s*:\s*["']([^"']+)["']/)?.[1];
         databaseURL ??= f.content.match(/databaseURL\s*:\s*["']([^"']+)["']/)?.[1]
-            ?? f.content.match(/https:\/\/[a-z0-9-]+(?:-default-rtdb)?\.firebaseio\.com/)?.[0];
+            ?? f.content.match(FIREBASEIO_URL)?.[0];
         storageBucket ??= f.content.match(/storageBucket\s*:\s*["']([^"']+)["']/)?.[1];
         if (!projectId) {
-            const dom = f.content.match(/([a-z0-9-]+)\.firebaseapp\.com/)?.[1];
+            const dom = f.content.match(FIREBASEAPP_DOMAIN)?.[1];
             if (dom)
                 projectId = dom;
         }
@@ -37,7 +43,11 @@ function isOwnRtdbHost(host, projectId) {
     const regional = `${p}-default-rtdb.`; // <project>-default-rtdb.<region>.firebasedatabase.app
     return host === `${p}.firebaseio.com`
         || host === `${p}-default-rtdb.firebaseio.com`
-        || (host.startsWith(regional) && /^[a-z0-9-]+\.firebasedatabase\.app$/.test(host.slice(regional.length)))
+        // `host` here is already `new URL(...).hostname` (bounded by the caller,
+        // ownDatabaseURL below), not raw file content — but it's bounded via the
+        // shared constant anyway rather than `+`, so this stays safe even if that
+        // ever changes and nothing here looks unlike its two siblings above.
+        || (host.startsWith(regional) && FIREBASEDATABASE_APP.test(host.slice(regional.length)))
         || host === `${p}.firebaseapp.com`;
 }
 /**

package/dist/engine/checkers/backend/supabase.js

@@ -21,7 +21,11 @@ export function classifyKey(key) {
         return 'jwt-service';
     return 'unknown';
 }
-const BARE_URL = /https:\/\/[a-z0-9]{16,}\.supabase\.co/;
+// Bounded for the same reason as the shared `DNS_LABEL` in util/text.ts (a
+// quadratic-time regex on raw file content) — but a Supabase project ref is
+// its own format (no hyphens, {16,63} not {1,63}), so this stays a literal
+// rather than reusing that constant.
+const BARE_URL = /https:\/\/[a-z0-9]{16,63}\.supabase\.co/;
 const BARE_PUBLISHABLE = /\bsb_publishable_[A-Za-z0-9_-]{10,}\b/;
 const BARE_JWT = /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g;
 function isPublicKey(key) {

package/dist/engine/checkers/static/rls-migrations.js

@@ -592,27 +592,53 @@ export const rlsMigrationsChecker = {
     level: 0,
     run(ctx) {
         const sqlFiles = ctx.files.filter((f) => f.ext === '.sql').sort((a, b) => a.rel.localeCompare(b.rel));
-        if (sqlFiles.length === 0)
-            return [];
+        if (sqlFiles.length === 0) {
+            // A project that clearly talks to Supabase but ships no .sql migrations
+            // (schema managed from the dashboard, or migrations live in another repo)
+            // used to just say nothing — a silent, undeserved clean score on the exact
+            // check the tool exists for. Say what could not be checked instead.
+            const looksSupabase = ctx.detection.backends.includes('supabase') ||
+                ctx.files.some((f) => !/\.(md|mdx|txt|rst)$/i.test(f.rel) &&
+                    /(SUPABASE_(?:ANON|PUBLISHABLE)_KEY|sb_publishable_|\/rest\/v1\b|postgrest)/i.test(f.content));
+            if (!looksSupabase)
+                return [];
+            return [{
+                    id: 'rls_unverifiable_no_migrations',
+                    severity: 'info',
+                    title: 'No SQL migrations found — RLS could not be checked statically',
+                    detail: 'This project talks to Supabase, but no .sql migration files exist in this repository (the schema may be managed from the dashboard, or migrations live in a different repo). A static scan can only see table/RLS state from files it can read, so no table here could be verified this way — this is missing information, not a clean result.',
+                    fix: 'Run the live probe (consent + --i-own-this) to enumerate which tables the anon key can read, or check pg_class.relrowsecurity and pg_policies directly in the Supabase SQL editor.',
+                    checker: 'rls-migrations',
+                    level: 0,
+                }];
+        }
         // RLS is a PostgreSQL feature. The engine is decided per FILE, not per
         // project: a monorepo can hold a Postgres schema next to a Cloudflare D1
         // (SQLite) one, and a SQLite schema must never be told to enable RLS — that
         // engine has no such thing. A real D1 project once got five "critical" RLS
         // findings and a 0/100 because the old gate only knew MySQL's
         // `auto_increment` (with the underscore) and never heard of D1/wrangler.
-        const pkg = ctx.files.find((f) => f.rel === 'package.json')?.content ?? '';
-        const reqs = ctx.files.find((f) => f.rel === 'requirements.txt')?.content ?? '';
-        const codeAndEnv = ctx.files
-            .filter((f) => !/\.(md|mdx|txt|rst|sql)$/i.test(f.rel))
-            .map((f) => f.content)
-            .join('\n');
+        // A monorepo's dependencies often live in apps/*/package.json, not the
+        // workspace root. Reading only the root file missed a D1/SQLite worker's
+        // `wrangler`/`better-sqlite3` signal whenever the SQL itself carried no
+        // dialect marker either, and defaulted it to Postgres — a phantom critical
+        // on a database that has no RLS to enable.
+        const pkg = ctx.files.filter((f) => f.rel.endsWith('package.json')).map((f) => f.content).join('\n');
+        const reqs = ctx.files.filter((f) => f.rel === 'requirements.txt' || f.rel.endsWith('/requirements.txt')).map((f) => f.content).join('\n');
+        // Checked with .some() against the files themselves, not a pre-joined
+        // string: joining nearly the whole project's non-doc/non-SQL content into
+        // one string on every scan doubled peak memory for the full scanned corpus
+        // to answer what is, per project, a handful of existence checks that can
+        // each stop at the first matching file.
+        const codeFiles = ctx.files.filter((f) => !/\.(md|mdx|txt|rst|sql)$/i.test(f.rel));
+        const matchesAnyCodeFile = (re) => codeFiles.some((f) => re.test(f.content));
         const pgProject = ctx.detection.backends.includes('supabase') ||
             /\b(pg|postgres|postgresql|@supabase\/|postgres\.js|node-postgres|pg-promise)\b/i.test(pkg) ||
             /\b(psycopg|asyncpg|sqlalchemy\+postgres)\b/i.test(reqs);
         const hasD1 = ctx.files.some((f) => /(^|\/)wrangler\.(toml|jsonc?)$/.test(f.rel) && /d1_databases/.test(f.content));
         const sqliteProject = hasD1 ||
             /"(better-sqlite3|sqlite3|@libsql\/client)"/i.test(pkg) ||
-            /from\s+['"](bun:sqlite|drizzle-orm\/(d1|better-sqlite3|libsql))['"]/.test(codeAndEnv);
+            matchesAnyCodeFile(/from\s+['"](bun:sqlite|drizzle-orm\/(d1|better-sqlite3|libsql))['"]/);
         const mysqlProject = /"(mysql2?|mariadb)"/i.test(pkg);
         const sqliteLabel = hasD1 ? 'Cloudflare D1 (SQLite)' : 'SQLite';
         const PG_MARK = /(row\s+level\s+security|gen_random_uuid|\b(?:big)?serial\b|::\s*\w+|\bjsonb\b|\bplpgsql\b|create\s+policy|uuid_generate)/i;
@@ -664,7 +690,7 @@ export const rlsMigrationsChecker = {
         // the tool's audience is mostly Supabase, and unknown must not read as safe.
         const exposed = ctx.detection.backends.includes('supabase') ||
             /@supabase\//i.test(pkg) ||
-            /(\/rest\/v1\b|postgrest|hasura|SUPABASE_(?:ANON|PUBLISHABLE)_KEY|sb_publishable_)/i.test(codeAndEnv);
+            matchesAnyCodeFile(/(\/rest\/v1\b|postgrest|hasura|SUPABASE_(?:ANON|PUBLISHABLE)_KEY|sb_publishable_)/i);
         const serverOnly = !exposed &&
             (/"(pg|postgres|pg-promise|@prisma\/client|drizzle-orm|knex|kysely|typeorm|sequelize)"/i.test(pkg) ||
                 /\b(psycopg2?|asyncpg|sqlalchemy)\b/i.test(reqs));
@@ -787,12 +813,12 @@ export const rlsMigrationsChecker = {
                         : `Table "${s.display}" has an unconfirmed RLS state (conditional block)`,
                 detail: kind === 'missing'
                     ? (missingSeverity === 'critical'
-                        ? `"${s.display}" is created in a migration and its latest state does not enable Row Level Security. If this table holds user data on Supabase, the anon key can read every row.`
+                        ? `"${s.display}" is created in a migration and its latest state does not enable Row Level Security. On Supabase the anon role has full table privileges by default, so with RLS off the public key can READ, INSERT, UPDATE and DELETE every row through the REST API. Static view only: this covers tables created by migrations in this repository — tables created from the dashboard or elsewhere are not listed here; the live probe enumerates all of them.`
                         : `"${s.display}" is created without Row Level Security. Only server code (pg/Prisma/…) appears to talk to this database, so nothing hands its rows to clients directly — that is normal, not a hole. It becomes CRITICAL the moment a client-facing data API (Supabase/PostgREST anon key, Hasura) is put in front of the same database.`)
                     : kind === 'order'
                         ? `"${s.display}" has statements in directories other than "${s.stateFile}" that contradict its final RLS state. Files in separate directories have no reliable apply order, so this cannot be decided statically — check the deployed state.`
                         : `"${s.display}" has a table or RLS statement whose execution cannot be confirmed statically: inside an IF/LOOP branch or a block with an EXCEPTION handler, after a RETURN, in a rolled-back or unterminated transaction, or on a name a TEMP table may shadow. Whether it took effect cannot be decided without running the migration, so its RLS state is NOT confirmed — check the deployed state.`,
-                fix: `ALTER TABLE ${s.display} ENABLE ROW LEVEL SECURITY; then add an owner/tenant policy, and drop any permissive "USING (true)" policy (policies are OR-ed). This is a static hint — confirm the deployed state.`,
+                fix: `ALTER TABLE ${s.display} ENABLE ROW LEVEL SECURITY; then add an owner/tenant policy, and drop any permissive "USING (true)" policy (policies are OR-ed). Until policies exist, stop the bleeding without breaking reads: REVOKE INSERT, UPDATE, DELETE, TRUNCATE ON ${s.display} FROM anon; This is a static hint — confirm the deployed state.`,
                 checker: 'rls-migrations',
                 level: 0,
                 file: s.file,

package/dist/engine/checkers/static/secrets.js

@@ -1,5 +1,11 @@
 import { decodeJwtPayload, lineAt, looksLikePlaceholder, redact, shannonEntropy } from '../../util/text.js';
 import { createExposure } from '../../util/git-exposure.js';
+import { partitionIgnores } from '../../config.js';
+/** No project-wide rules — used to run ONLY the inline-marker half of partitionIgnores. */
+const EMPTY_CONFIG = { ignore: [], ignorePaths: [] };
+/** Lower number = more severe. One copy, used both to cap a severity and to rank duplicates. */
+const SEVERITY_RANK = { critical: 0, warning: 1, info: 2, advisory: 3 };
+const atMost = (sev, cap) => (SEVERITY_RANK[sev] < SEVERITY_RANK[cap] ? cap : sev);
 /** Real tokens mix case and digits; kebab-case identifiers do not. */
 function looksRandom(s) {
     const body = s.replace(/^[a-z]+[-_]/i, '');
@@ -173,6 +179,23 @@ const JWT = /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g
 // KEY=value / key: value / Dockerfile ENV|ARG KEY=value, with a secret-looking NAME.
 const ASSIGN = /^[ \t]*(?:export[ \t]+|ENV[ \t]+|ARG[ \t]+)?([A-Za-z_][A-Za-z0-9_.-]*)[ \t]*[:=][ \t]*(.+)$/gm;
 const SECRET_NAME = /(secret|token|password|passwd|private[_-]?key|api[_-]?key|access[_-]?key|credential)/i;
+/**
+ * Shell-style `NAME=value` anywhere in a line, in any file: `PGPASSWORD=… psql`,
+ * `TOKEN=… curl`, a permission rule in .claude/settings.local.json. Upper-case
+ * names only, so prose like "password=…" in docs does not count.
+ *
+ * The leading class is `*` (zero or more), not `+`: a bare name that IS one of
+ * the keywords (`SECRET=…`, `TOKEN=…`, `API_KEY=…`, no prefix at all — an
+ * extremely common shape in real scripts) needs zero characters before the
+ * keyword, and requiring at least one meant those never matched at all. There
+ * is deliberately no trailing lookahead: `{8,}` on a fixed character class
+ * already stops at the first character outside it, so a value followed by
+ * `;`, `)`, `,` or `]` (`export TOKEN=abc123;`, `foo(SECRET=abc123)`) still
+ * matches correctly — an earlier version's trailing negative lookahead
+ * rejected exactly those common shell/call-site endings.
+ */
+// Values are ASCII token characters: `PASSWORD=та_же_что_и_выше` in a README is prose.
+const INLINE_ENV = /\b([A-Z0-9_]*(?:PASSWORD|PASSWD|SECRET|TOKEN|API_KEY|ACCESS_KEY|PRIVATE_KEY)[A-Z0-9_]*)=([A-Za-z0-9_\-./+=:@]{8,})/g;
 /** Only .env* files are "server env by design" — a secret there is a warning
  *  (env-git flags committing it). In real code/config it stays a source leak. */
 function isEnvFile(rel) {
@@ -229,8 +252,6 @@ export const secretsChecker = {
             // looksLikeRealMaterial). A docs/fixture path may only downgrade a
             // heuristic or sample-looking hit to info; proven material stays at
             // warning there — the path lowers confidence, it does not make it safe.
-            const rank = { critical: 0, warning: 1, info: 2, advisory: 3 };
-            const atMost = (sev, cap) => (rank[sev] < rank[cap] ? cap : sev);
             /**
              * Severity = what the value is × how it can leak. The pattern says what it
              * is; the example/docs path lowers confidence; git exposure decides how
@@ -275,10 +296,17 @@ export const secretsChecker = {
                     // env-git check's finding, not this one's — reporting it twice at
                     // warning is what made people stop reading.
                     if (env && ex !== 'committed') {
+                        // This also covers `ex === 'ignored'`: an env file is always the
+                        // right place for a secret whether or not it's ALSO gitignored, so
+                        // there is nothing a separate ignored-env-file branch would add.
                         out = { ...out, severity: 'advisory', detail: `${out.detail} Not committed — this is where the value belongs; keep the file out of git and out of client bundles.` };
                     }
                     else if (ex === 'ignored') {
-                        out = { ...out, severity: 'advisory', detail: `${out.detail} This file is gitignored, so the value cannot leak through git — keep it that way and out of client bundles.` };
+                        // Gitignored, but not an env file: a credential pasted into a tool
+                        // config or a script (a prod DB password inside a permission rule in
+                        // .claude/settings.local.json was reported as a mere advisory). It
+                        // cannot leak through git today; it still does not belong there.
+                        out = { ...out, severity: atMost(out.severity, 'warning'), detail: `${out.detail} The file is gitignored, so this cannot leak through git — but it is a credential pasted into a config/source file, not an env var. Move it to .env (also gitignored) so one \`git add -A\` or a shared zip never carries it.` };
                     }
                     else if (ex === 'untracked') {
                         out = { ...out, severity: atMost(out.severity, 'warning'), detail: `${out.detail} The file is not committed yet — it is one \`git add -A\` away from being. Add it to .gitignore or move the value to an env var.` };
@@ -364,6 +392,31 @@ export const secretsChecker = {
                     evidence: redact(value),
                 }, false, value);
             }
+            // Inline shell-style assignments mid-line, outside env/config files (those
+            // go through ASSIGN below). A prod DB password inside a permission rule in
+            // .claude/settings.local.json was invisible to both other name-based rules.
+            if (!isConfigish(rel)) {
+                for (const m of content.matchAll(INLINE_ENV)) {
+                    const name = m[1] ?? '';
+                    const value = m[2] ?? '';
+                    if (looksLikePlaceholder(value) || shannonEntropy(value) < 3.0)
+                        continue;
+                    if (!/[0-9]/.test(value) && value.length < 24)
+                        continue;
+                    push({
+                        id: 'env_secret',
+                        severity: 'warning',
+                        title: 'Secret in an inline assignment',
+                        detail: `"${name}" is assigned a high-entropy value inline in ${rel}: ${redact(value)}`,
+                        fix: 'Move the value to a gitignored .env and reference it by name; rotate it if the file was ever shared.',
+                        checker: 'secrets',
+                        level: 0,
+                        file: rel,
+                        line: lineAt(content, m.index ?? 0),
+                        evidence: redact(value),
+                    }, false, value);
+                }
+            }
             // name=value / key: value assignments (env, config, Dockerfile ENV/ARG).
             if (isConfigish(rel)) {
                 for (const m of content.matchAll(ASSIGN)) {
@@ -395,18 +448,59 @@ export const secretsChecker = {
         }
         // De-duplicate only true repeats: the same secret, same place, same rule.
         // (Keying on file:line alone hid every extra key on a minified line.)
-        const order = { critical: 0, warning: 1, info: 2, advisory: 3 };
         const seen = new Map();
         for (const f of findings) {
             const key = `${f.file ?? ''}:${f.line ?? 0}:${f.id}:${f.evidence ?? ''}`;
             const cur = seen.get(key);
-            if (!cur || order[f.severity] < order[cur.severity])
+            if (!cur || SEVERITY_RANK[f.severity] < SEVERITY_RANK[cur.severity])
                 seen.set(key, f);
         }
         // A vendor pattern or a decoded JWT already identifies the value on a line;
         // the name-based env_secret / generic_secret there is the same fact twice.
         const NAME_BASED = new Set(['env_secret', 'generic_secret']);
         const specificAt = new Set([...seen.values()].filter((f) => !NAME_BASED.has(f.id)).map((f) => `${f.file ?? ''}:${f.line ?? 0}`));
-        return [...seen.values()].filter((f) => !(NAME_BASED.has(f.id) && specificAt.has(`${f.file ?? ''}:${f.line ?? 0}`)));
+        const kept = [...seen.values()].filter((f) => !(NAME_BASED.has(f.id) && specificAt.has(`${f.file ?? ''}:${f.line ?? 0}`)));
+        // Eleven advisories saying "secret in gitignored .env.local — fine" are one
+        // observation printed eleven times. Fold them into one line per file that
+        // names the variables; anything above advisory stays line by line.
+        //
+        // The final `applyIgnores` pass (scan.ts) only sees whatever this checker
+        // returns — once N findings become one summary Finding with a single
+        // `line`, a `// easyvibegate-ignore` comment placed above any secret but
+        // the first in the group can no longer reach it. Filter each candidate
+        // through the SAME inline-marker check first (an empty config so only the
+        // marker, not project-wide `ignore`/`ignorePaths` rules, applies here —
+        // those still run again, correctly, against whatever this returns), so an
+        // individually silenced secret is dropped before folding, not after.
+        const byFile = new Map();
+        for (const f of kept) {
+            if (f.id !== 'env_secret' || f.severity !== 'advisory' || !isEnvFile(f.file ?? ''))
+                continue;
+            byFile.set(f.file ?? '', [...(byFile.get(f.file ?? '') ?? []), f]);
+        }
+        const folded = new Set();
+        const summaries = [];
+        for (const [file, allCandidates] of byFile) {
+            const group = partitionIgnores(allCandidates, EMPTY_CONFIG, ctx.files).kept;
+            // A member the marker silenced must not reappear individually either —
+            // it is done with, not merely "too few left to fold".
+            for (const f of allCandidates)
+                if (!group.includes(f))
+                    folded.add(f);
+            if (group.length < 2)
+                continue;
+            for (const f of group)
+                folded.add(f);
+            const names = group.map((f) => /^"([^"]+)"/.exec(f.detail)?.[1] ?? '?');
+            const first = group.reduce((a, b) => ((a.line ?? 0) <= (b.line ?? 0) ? a : b));
+            summaries.push({
+                ...first,
+                title: `${group.length} secrets in ${file} (not committed — where they belong)`,
+                detail: `${file} holds ${group.length} secret-looking values (${names.join(', ')}). The file is not committed, so nothing leaks through git; keep it that way and out of client bundles.`,
+                fix: 'Nothing to change here. Keep the file gitignored; rotate any value that may ever have been committed or shared.',
+                evidence: undefined,
+            });
+        }
+        return [...kept.filter((f) => !folded.has(f)), ...summaries];
     },
 };

package/dist/engine/detect.js

@@ -1,5 +1,7 @@
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
+import { DNS_LABEL } from './util/text.js';
+const SUPABASE_URL_FALLBACK = new RegExp(`https?://${DNS_LABEL}\\.supabase\\.co`, 'i');
 /** Infer the project's frameworks, backends, languages and package managers. */
 export function detect(root, files) {
     const relSet = new Set(files.map((f) => f.rel));
@@ -99,8 +101,10 @@ export function detect(root, files) {
             frameworks.add('rails');
     }
     // Content fallback for projects without a package.json — kept strict to avoid
-    // false positives from code that merely mentions a backend by name.
-    if (!backends.has('supabase') && files.some((f) => /https?:\/\/[a-z0-9-]+\.supabase\.co/i.test(f.content))) {
+    // false positives from code that merely mentions a backend by name. Uses the
+    // shared bounded DNS_LABEL (see util/text.ts) so this cannot go quadratic on
+    // a long run of matching characters in a large file.
+    if (!backends.has('supabase') && files.some((f) => SUPABASE_URL_FALLBACK.test(f.content))) {
         backends.add('supabase');
     }
     if (!backends.has('firebase') && files.some((f) => /\binitializeApp\s*\(/.test(f.content) && /firebase/i.test(f.content))) {

package/dist/engine/util/text.js

@@ -48,3 +48,15 @@ export function decodeJwtPayload(token) {
         return null;
     }
 }
+/**
+ * A DNS label, bounded to its real maximum (RFC 1035, 63 octets) — never `+`.
+ * Used right before a literal host suffix (`.firebaseapp.com`, `.supabase.co`)
+ * in a regex run against raw, unbounded file content. An open `[a-z0-9-]+` in
+ * that position is a classic quadratic-time regex: at every position inside a
+ * long run of matching characters (a minified bundle, a base64 blob, a lockfile
+ * hash) the engine greedily consumes to the end and backtracks one character at
+ * a time looking for a literal that never comes. Measured: a 500KB matching run
+ * took over two minutes unbounded; bounded, the same file scans in single-digit
+ * milliseconds — and no real hostname label is longer than this anyway.
+ */
+export const DNS_LABEL = '[a-z0-9-]{1,63}';

package/dist/engine/walk.js

@@ -8,11 +8,25 @@ const SKIP_DIRS = new Set([
     // folder names above misses a venv called anything else (tools/ytenv/...),
     // and then every key inside a vendored library is reported as the user's leak.
     'site-packages', '__pypackages__', 'bower_components', 'Pods',
-    // Cached API responses and scratch output are data, not the project's code.
-    // 559 of 569 "generic secrets" in one real project were pagination and
-    // tracking tokens inside data/cache/*.json.
-    'cache', 'caches', 'tmp', 'temp', '.tmp',
+    // Yarn Berry vendors its own release script and zips dependencies here —
+    // tool-managed, not the user's code (and often full of high-entropy blobs
+    // that would otherwise read as secrets).
+    '.yarn',
 ]);
+/**
+ * Names ambiguous enough that they are sometimes real source (a module named
+ * "cache", a package called "tmp") and sometimes pure data. Skipped only when
+ * `relDir` (the ambiguous directory's own path, relative to the project root,
+ * e.g. "cache" or "data/cache") has at most 2 path segments — i.e. the
+ * directory IS the root's own child, or is nested exactly one level below it.
+ * The real-world evidence for this was `data/cache/*.json` full of API
+ * pagination tokens, 559 of 569 "generic secrets" in one real project. Deeper
+ * nesting (`apps/api/src/lib/cache/`, 4 segments) is ordinary source and stays
+ * scanned; blanket name-matching at any depth once made a source directory
+ * invisible to every check with no visible coverage gap.
+ */
+const AMBIGUOUS_DATA_DIRS = new Set(['cache', 'caches', 'tmp', 'temp', '.tmp']);
+const isShallowDataDir = (name, relDir) => AMBIGUOUS_DATA_DIRS.has(name) && relDir.split('/').length <= 2;
 const TEXT_EXT = new Set([
     '.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.vue', '.svelte',
     '.py', '.rb', '.php', '.go', '.rs', '.java', '.kt', '.cs',
@@ -63,7 +77,8 @@ export function walk(root, opts = {}) {
                 // link to a directory or a scannable file is unchecked content, and
                 // silently dropping it let a project whose `migrations` was a symlink
                 // PASS with full coverage. Count it so the walk is reported partial.
-                if (SKIP_DIRS.has(ent.name))
+                const relLink = relative(root, full).split(sep).join('/');
+                if (SKIP_DIRS.has(ent.name) || isShallowDataDir(ent.name, relLink))
                     continue;
                 try {
                     const target = statSync(full); // follows the link
@@ -76,7 +91,8 @@ export function walk(root, opts = {}) {
                 continue;
             }
             if (ent.isDirectory()) {
-                if (!SKIP_DIRS.has(ent.name) && !excluded.has(resolve(full)))
+                const relDir = relative(root, full).split(sep).join('/');
+                if (!SKIP_DIRS.has(ent.name) && !isShallowDataDir(ent.name, relDir) && !excluded.has(resolve(full)))
                     stack.push(full);
                 continue;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "easyvibegate",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "Interactive security scanner for vibe-coded apps (focus: Next.js + Supabase). Checks common risks and shows evidence where it can.",
   "type": "module",
   "bin": {